last executing test programs: 8.322334121s ago: executing program 2 (id=3): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='+4\n\x00', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='2049\n\x00', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000140)='8\n\x00', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./mnt\x00', 0x1ff) mount$nfs4(&(0x7f00000001c0)='127.0.0.1:/\x00', &(0x7f0000000180)='./mnt\x00', &(0x7f0000000200), 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='vers=4.1,addr=127.0.0.1,clientaddr=127.0.0.1\x00']) 6.294368177s ago: executing program 3 (id=4): syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff040140861246200001000000010902200001010080fa0904000002ff0401000705810200020007050202000200"], 0x0) nanosleep(&(0x7f0000000400)={0x0, 0x1dcd6500}, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0) sendmsg$NFC_CMD_DEV_UP(r0, &(0x7f0000000200)={&(0x7f0000000240), 0xc, &(0x7f0000000280)={&(0x7f0000000300)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}]}, 0x1c}}, 0x0) (async) 5.382915294s ago: executing program 1 (id=2): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='md0\x00', 0x3) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./ram0\x00', 0x81ff, 0x100) openat(0xffffffffffffff9c, &(0x7f0000000400)='./ram0\x00', 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/level\x00', 0x2, 0x0) write(r1, &(0x7f0000000600)='raid1\x00', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/block/md0/md/raid_disks\x00', 0x2, 0x0) write(r2, &(0x7f0000000800)='1\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r3, &(0x7f0000000a00)='1:0\x00', 0x3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/block/md0/md/dev-ram0/slot\x00', 0x2, 0x0) write(r4, &(0x7f0000000c00)='0\x00', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./sys/block/md0/md/array_state\x00', 0x2, 0x0) write(r5, &(0x7f0000000e00)='active\x00', 0x6) 5.190083437s ago: executing program 0 (id=1): syz_usb_connect(0x2, 0x5a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002e0010140341278560000010203010902480002010080fa0904000003e00101000905810240000100000905020240000000000905830340000100000904010002e0010100090584014000010000090504014000010000"], &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000100)={0x1}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000180)={0x1f, 0x0, 0x1}, 0x6) write(r0, &(0x7f00000001c0)="f100040000", 0x5) ioctl$sock_bt_hci(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000240)={0x1f, 0x1, 0x1}, 0x6) write(r0, &(0x7f0000000280)="f100040000", 0x5) 4.521405343s ago: executing program 1 (id=5): r0 = syz_usb_connect(0x2, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff401e041c400001010203010902220001010080fa0904000000ffffff000904000101ffffff0007058101000201"], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0xa1, 0x1, "02"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) r1 = syz_open_dev$video(&(0x7f0000000080), 0x0, 0x2) read(r1, &(0x7f0000000300)=""/4096, 0x1000) 3.429597108s ago: executing program 3 (id=6): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='intel_pmc_usb\x00', 0xe) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/intel_pmc_usb/bind\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='pcspkr\x00', 0x7) 2.736549055s ago: executing program 3 (id=7): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/cluster\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/cluster/mycluster\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/mycluster/node\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/cluster/mycluster/node/mynode\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/cluster/mycluster/node/mynode/ipv4_address\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/cluster/mycluster/node/mynode/ipv4_port\x00', 0x2, 0x0) write(r1, &(0x7f00000003c0)='7777\n\x00', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/cluster/mycluster/node/mynode/num\x00', 0x2, 0x0) write(r2, &(0x7f00000002c0)='0\n\x00', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/mycluster/node/mynode/local\x00', 0x2, 0x0) write(r3, &(0x7f0000000240)='1\n\x00', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/cluster/mycluster/heartbeat\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/cluster/mycluster/heartbeat/myregion\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/cluster/mycluster/heartbeat/myregion/block_bytes\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='512\n\x00', 0x4) openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/cluster/mycluster/heartbeat/myregion/start_block\x00', 0x2, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000800)='./ram0\x00', 0x8000, 0x100) r5 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./ram0\x00', 0x2, 0x0) dup2(r5, 0x64) r6 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/cluster/mycluster/heartbeat/myregion/dev\x00', 0x2, 0x0) write(r6, &(0x7f0000000640)='100\n\x00', 0x4) 945.76899ms ago: executing program 3 (id=8): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/block/sda/device/scsi_disk/0:0:0:0/max_write_same_blocks\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='65535\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/sda\x00', 0x2, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000000)={0x0, 0x1000}) 894.113364ms ago: executing program 2 (id=9): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/core/rd_mcp_0/rd1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/core/rd_mcp_0/rd1/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='rd_pages=32768\x00', 0xe) r1 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/core/rd_mcp_0/rd1/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r2, &(0x7f0000000500)='0x1d6b\x00', 0x6) r3 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r3, &(0x7f0000000580)='0x0104\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000740)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000840)='./config/target/core/rd_mcp_0/rd1\x00', 0xffffffffffffff9c, &(0x7f0000000880)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0/rd1\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/nexus\x00', 0x2, 0x0) write(r4, &(0x7f0000000940)='naa.6001405123456789\x00', 0x14) symlinkat(&(0x7f0000000980)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f00000009c0)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r5, &(0x7f0000000a40)='dummy_udc.0\x00', 0xb) nanosleep(&(0x7f0000000000)={0x1}, 0x0) r6 = syz_open_dev$sg(0x0, 0x0, 0x0) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000100)={0x53, 0xfffffffe, 0xa, 0x0, @buffer={0x0, 0x1c, &(0x7f0000000200)=""/28}, &(0x7f0000000300)="5f000000000000001c00", &(0x7f0000000400), 0x0, 0x0, 0x0, 0x0}) 742.223301ms ago: executing program 0 (id=10): syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e0e0104100002020001000000000000"], 0x11) nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000080)="2d000000010001", 0x7) close(r0) 256.459168ms ago: executing program 3 (id=11): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/drivers/e1000/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='0000:00:02.0\x00', 0xd) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/drivers/e1000/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='0000:00:03.0\x00', 0xd) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/drivers/e1000/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000180)='0000:00:04.0\x00', 0xd) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/e1000e/new_id\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='8086 100e ffffffff ffffffff 0 0 e\x00', 0x22) (async) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r4 = socket(0x2, 0x2, 0x0) ioctl(r4, 0x8914, &(0x7f0000000b00)="657468300000000000000000000000000100"/40) ioctl(r4, 0x8914, &(0x7f0000000c00)="657468310000000000000000000000000100"/40) ioctl(r4, 0x8914, &(0x7f0000000d00)="657468320000000000000000000000000100"/40) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) 0s ago: executing program 0 (id=12): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000040)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000080), 0x2) read(r0, &(0x7f00000000c0)=""/1, 0x1) read(r0, &(0x7f0000000100)=""/1, 0x1) read(r0, &(0x7f0000000140)=""/1, 0x1) read(r0, &(0x7f0000000180)=""/1, 0x1) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.188' (ED25519) to the list of known hosts. [ 82.496342][ T5577] cgroup: Unknown subsys name 'net' [ 82.734386][ T5577] cgroup: Unknown subsys name 'cpuset' [ 82.789787][ T5577] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 84.765256][ T5577] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 88.658719][ T4907] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 88.680984][ T4907] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 88.683868][ T4907] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 88.687683][ T4907] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.688844][ T4907] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 88.779953][ T60] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 88.787344][ T60] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 88.802655][ T60] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 88.812176][ T60] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 88.814306][ T60] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 88.891370][ T60] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 88.910948][ T60] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 88.912763][ T60] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 88.914295][ T60] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 88.915463][ T60] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 89.093845][ T60] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 89.112186][ T60] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 89.113043][ T60] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 89.115208][ T60] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 89.116586][ T60] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 90.791008][ T60] Bluetooth: hci0: command tx timeout [ 90.870130][ T60] Bluetooth: hci1: command tx timeout [ 90.996400][ T5594] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.997574][ T5594] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.997796][ T5594] bridge_slave_0: entered allmulticast mode [ 91.012573][ T5594] bridge_slave_0: entered promiscuous mode [ 91.029690][ T60] Bluetooth: hci2: command tx timeout [ 91.078068][ T5594] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.078400][ T5594] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.078680][ T5594] bridge_slave_1: entered allmulticast mode [ 91.102369][ T5594] bridge_slave_1: entered promiscuous mode [ 91.189301][ T60] Bluetooth: hci3: command tx timeout [ 91.262564][ T5594] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.310853][ T5594] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.311281][ T5590] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.311577][ T5590] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.311775][ T5590] bridge_slave_0: entered allmulticast mode [ 91.314720][ T5590] bridge_slave_0: entered promiscuous mode [ 91.403106][ T5590] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.403440][ T5590] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.403670][ T5590] bridge_slave_1: entered allmulticast mode [ 91.406313][ T5590] bridge_slave_1: entered promiscuous mode [ 91.540767][ T5597] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.541058][ T5597] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.541270][ T5597] bridge_slave_0: entered allmulticast mode [ 91.543886][ T5597] bridge_slave_0: entered promiscuous mode [ 91.546879][ T5606] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.547234][ T5606] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.547526][ T5606] bridge_slave_0: entered allmulticast mode [ 91.560023][ T5606] bridge_slave_0: entered promiscuous mode [ 91.605218][ T5594] team0: Port device team_slave_0 added [ 91.629554][ T5597] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.629919][ T5597] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.630212][ T5597] bridge_slave_1: entered allmulticast mode [ 91.634731][ T5597] bridge_slave_1: entered promiscuous mode [ 91.636837][ T5606] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.637110][ T5606] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.637309][ T5606] bridge_slave_1: entered allmulticast mode [ 91.642257][ T5606] bridge_slave_1: entered promiscuous mode [ 91.663576][ T5594] team0: Port device team_slave_1 added [ 91.698319][ T5590] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.773109][ T5590] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.843750][ T822] cfg80211: failed to load regulatory.db [ 91.882452][ T5597] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.888517][ T5606] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.912224][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.912240][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.912260][ T5594] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.972261][ T5597] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.976706][ T5606] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.999645][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.999657][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.999678][ T5594] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.005454][ T5590] team0: Port device team_slave_0 added [ 92.097491][ T5590] team0: Port device team_slave_1 added [ 92.165005][ T5597] team0: Port device team_slave_0 added [ 92.168689][ T5606] team0: Port device team_slave_0 added [ 92.202233][ T5597] team0: Port device team_slave_1 added [ 92.205680][ T5606] team0: Port device team_slave_1 added [ 92.234078][ T5590] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.234089][ T5590] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.234108][ T5590] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.320915][ T5590] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.320927][ T5590] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.320947][ T5590] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.403496][ T5594] hsr_slave_0: entered promiscuous mode [ 92.405526][ T5594] hsr_slave_1: entered promiscuous mode [ 92.427977][ T5597] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.427988][ T5597] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.428007][ T5597] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.438041][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.438093][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.438169][ T5606] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.488805][ T5597] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.488854][ T5597] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.488930][ T5597] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.507937][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.507978][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.508058][ T5606] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.869246][ T60] Bluetooth: hci0: command tx timeout [ 92.949123][ T60] Bluetooth: hci1: command tx timeout [ 93.004045][ T5590] hsr_slave_0: entered promiscuous mode [ 93.005747][ T5590] hsr_slave_1: entered promiscuous mode [ 93.007296][ T5590] debugfs: 'hsr0' already exists in 'hsr' [ 93.007389][ T5590] Cannot create hsr debugfs directory [ 93.109226][ T60] Bluetooth: hci2: command tx timeout [ 93.136213][ T5597] hsr_slave_0: entered promiscuous mode [ 93.138147][ T5597] hsr_slave_1: entered promiscuous mode [ 93.143599][ T5597] debugfs: 'hsr0' already exists in 'hsr' [ 93.143668][ T5597] Cannot create hsr debugfs directory [ 93.167000][ T5606] hsr_slave_0: entered promiscuous mode [ 93.168697][ T5606] hsr_slave_1: entered promiscuous mode [ 93.174656][ T5606] debugfs: 'hsr0' already exists in 'hsr' [ 93.174725][ T5606] Cannot create hsr debugfs directory [ 93.269178][ T60] Bluetooth: hci3: command tx timeout [ 94.072666][ T5594] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 94.134450][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 94.142484][ T5594] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 94.187029][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 94.197358][ T5594] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 94.227066][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 94.251766][ T5594] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 94.295231][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 94.426299][ T5597] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 94.466992][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 94.476650][ T5597] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 94.514090][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 94.528327][ T5597] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 94.554444][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 94.583657][ T5597] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 94.625338][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 94.763085][ T5606] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 94.808135][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 94.832088][ T5606] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 94.864372][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 94.867543][ T5606] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 94.906285][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 94.935221][ T5606] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 94.949278][ T60] Bluetooth: hci0: command tx timeout [ 94.980030][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 95.039257][ T60] Bluetooth: hci1: command tx timeout [ 95.152821][ T5590] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 95.189399][ T60] Bluetooth: hci2: command tx timeout [ 95.203424][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 95.222589][ T5590] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 95.264242][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 95.286239][ T5590] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 95.313480][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 95.331858][ T5590] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 95.359837][ T60] Bluetooth: hci3: command tx timeout [ 95.370762][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 95.448789][ T5594] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.567187][ T5594] 8021q: adding VLAN 0 to HW filter on device team0 [ 95.643526][ T5597] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.671972][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.672553][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 95.747932][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.748068][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 95.818769][ T5597] 8021q: adding VLAN 0 to HW filter on device team0 [ 95.878793][ T5606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.892703][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.892878][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 95.954832][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.954991][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.088082][ T5606] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.141797][ T1189] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.145844][ T1189] bridge0: port 1(bridge_slave_0) entered forwarding state [ 96.174566][ T5590] 8021q: adding VLAN 0 to HW filter on device bond0 [ 96.242015][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.242185][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.403749][ T5590] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.500270][ T1127] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.500470][ T1127] bridge0: port 1(bridge_slave_0) entered forwarding state [ 96.576615][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.577814][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.033894][ T60] Bluetooth: hci0: command tx timeout [ 97.109265][ T60] Bluetooth: hci1: command tx timeout [ 97.183896][ T5594] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 97.269215][ T60] Bluetooth: hci2: command tx timeout [ 97.433759][ T60] Bluetooth: hci3: command tx timeout [ 97.616171][ T5594] veth0_vlan: entered promiscuous mode [ 97.697720][ T5594] veth1_vlan: entered promiscuous mode [ 97.839906][ T5597] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.023102][ T5594] veth0_macvtap: entered promiscuous mode [ 98.088930][ T5594] veth1_macvtap: entered promiscuous mode [ 98.172251][ T5606] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.237258][ T5590] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.258023][ T5597] veth0_vlan: entered promiscuous mode [ 98.276634][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 98.363963][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 98.402048][ T5597] veth1_vlan: entered promiscuous mode [ 98.431923][ T1189] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.438621][ T1189] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.476802][ T1026] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.493252][ T1026] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.726960][ T5606] veth0_vlan: entered promiscuous mode [ 98.927514][ T5590] veth0_vlan: entered promiscuous mode [ 98.963684][ T5606] veth1_vlan: entered promiscuous mode [ 99.002890][ T5597] veth0_macvtap: entered promiscuous mode [ 99.048782][ T5590] veth1_vlan: entered promiscuous mode [ 99.072122][ T5597] veth1_macvtap: entered promiscuous mode [ 99.095792][ T34] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.095807][ T34] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.271374][ T5597] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.273125][ T1189] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.273144][ T1189] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.335152][ T5597] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.344531][ T5606] veth0_macvtap: entered promiscuous mode [ 99.410348][ T5606] veth1_macvtap: entered promiscuous mode [ 99.422741][ T5590] veth0_macvtap: entered promiscuous mode [ 99.428725][ T1026] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.458602][ T1026] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.489766][ T1026] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.507682][ T1026] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.517167][ T5590] veth1_macvtap: entered promiscuous mode [ 99.796416][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.992139][ T5590] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.047325][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.075999][ T5590] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.126451][ T72] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.162105][ T72] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.197993][ T72] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.291533][ T72] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.410639][ T72] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.428290][ T72] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.483776][ T34] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.483799][ T34] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.537418][ T72] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.598852][ T72] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.187286][ T1189] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.187303][ T1189] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.785257][ T34] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.785278][ T34] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.938614][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.938635][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.205545][ T1127] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.205568][ T1127] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.242862][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.242883][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.523851][ T1896] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 102.873505][ T1896] usb 4-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 1.00 [ 102.873542][ T1896] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.613170][ T1896] usb 4-1: NFC: intf ffff88802b066000 id ffffffff8edca240 [ 103.945836][ T9] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 104.138866][ T9] usb 1-1: not running at top speed; connect to a high speed hub [ 104.158961][ T1896] nfcmrvl 4-1:1.0: NFC: registered with nci successfully [ 104.196472][ T9] usb 1-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 0.00 [ 104.196509][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.196523][ T9] usb 1-1: Product: syz [ 104.196534][ T9] usb 1-1: Manufacturer: syz [ 104.196544][ T9] usb 1-1: SerialNumber: syz [ 104.200981][ T5688] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 104.370614][ T5688] usb 2-1: not running at top speed; connect to a high speed hub [ 104.393248][ T5688] usb 2-1: New USB device found, idVendor=041e, idProduct=401c, bcdDevice= 1.00 [ 104.393279][ T5688] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.393312][ T5688] usb 2-1: Product: syz [ 104.393327][ T5688] usb 2-1: Manufacturer: syz [ 104.393341][ T5688] usb 2-1: SerialNumber: syz [ 104.508493][ T1896] usb 4-1: USB disconnect, device number 2 [ 104.541378][ T5688] gspca_main: gspca_zc3xx-2.14.0 probing 041e:401c [ 104.593170][ T5740] NFSD: Failed to start, no listeners configured. [ 104.777161][ T9] input: syz syz as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input5 [ 104.871337][ T1896] usb 4-1: NFC: intf ffff88802b066000 [ 106.422962][ T39] audit: type=1800 audit(1785863765.483:2): pid=5772 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed comm="syz.3.7" name="num" dev="configfs" ino=8215 res=0 errno=0 [ 106.423083][ T39] audit: type=1800 audit(1785863765.583:3): pid=5771 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed comm="syz.3.7" name="ipv4_port" dev="configfs" ino=7732 res=0 errno=0 [ 106.659947][ T39] audit: type=1800 audit(1785863765.873:4): pid=5770 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed comm="syz.3.7" name="ipv4_address" dev="configfs" ino=8214 res=0 errno=0 [ 106.716555][ T39] audit: type=1800 audit(1785863765.933:5): pid=5771 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed comm="syz.3.7" name="local" dev="configfs" ino=7733 res=0 errno=0 [ 106.796513][ T9] usb 1-1: USB disconnect, device number 2 [ 107.882896][ T5780] Bluetooth: MGMT ver 1.23 [ 108.038609][ T5688] gspca_zc3xx: reg_r err -71 [ 108.064142][ T39] audit: type=1800 audit(1785863767.283:6): pid=5779 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed comm="syz.2.9" name="idVendor" dev="configfs" ino=7751 res=0 errno=0 [ 108.116340][ T39] audit: type=1800 audit(1785863767.333:7): pid=5779 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed comm="syz.2.9" name="idProduct" dev="configfs" ino=7752 res=0 errno=0 [ 108.556424][ T39] audit: type=1800 audit(1785863767.773:8): pid=5797 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed comm="syz.2.9" name="nexus" dev="configfs" ino=7776 res=0 errno=0 [ 108.612734][ T5779] [ 108.612746][ T5779] ====================================================== [ 108.612756][ T5779] WARNING: possible circular locking dependency detected [ 108.612776][ T5779] syzkaller #0 Not tainted [ 108.612788][ T5779] ------------------------------------------------------ [ 108.612797][ T5779] syz.2.9/5779 is trying to acquire lock: [ 108.612811][ T5779] ffffffff8f1defd8 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x21/0x2f0 [ 108.612870][ T5779] [ 108.612870][ T5779] but task is already holding lock: [ 108.612877][ T5779] ffff888038ea4388 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x59/0x260 [ 108.612929][ T5779] [ 108.612929][ T5779] which lock already depends on the new lock. [ 108.612929][ T5779] [ 108.612937][ T5779] [ 108.612937][ T5779] the existing dependency chain (in reverse order) is: [ 108.612945][ T5779] [ 108.612945][ T5779] -> #3 (&gi->lock){+.+.}-{4:4}: [ 108.612976][ T5779] mutex_lock_nested+0x5a/0x1d0 [ 108.613003][ T5779] config_usb_cfg_link+0x59/0x260 [ 108.613024][ T5779] configfs_symlink+0x59a/0x1030 [ 108.613054][ T5779] vfs_symlink+0x18b/0x330 [ 108.613083][ T5779] filename_symlinkat+0x1cd/0x420 [ 108.613114][ T5779] __se_sys_symlinkat+0x4e/0x2b0 [ 108.613143][ T5779] do_syscall_64+0x17b/0x530 [ 108.613162][ T5779] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.613187][ T5779] [ 108.613187][ T5779] -> #2 (&sb->s_type->i_mutex_key#25){++++}-{4:4}: [ 108.613223][ T5779] down_write+0x3a/0x50 [ 108.613243][ T5779] configfs_depend_item_unlocked+0x153/0x420 [ 108.613270][ T5779] usbg_make_tpg+0x1f6/0x590 [ 108.613301][ T5779] target_fabric_make_tpg+0xa8/0x6d0 [ 108.613320][ T5779] configfs_mkdir+0x4f6/0x9e0 [ 108.613343][ T5779] vfs_mkdir+0x408/0x620 [ 108.613368][ T5779] filename_mkdirat+0x289/0x520 [ 108.613394][ T5779] __se_sys_mkdirat+0x35/0x150 [ 108.613420][ T5779] do_syscall_64+0x17b/0x530 [ 108.613438][ T5779] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.613458][ T5779] [ 108.613458][ T5779] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 108.613487][ T5779] mutex_lock_nested+0x5a/0x1d0 [ 108.613512][ T5779] usbg_make_tpg+0x147/0x590 [ 108.613542][ T5779] target_fabric_make_tpg+0xa8/0x6d0 [ 108.613569][ T5779] configfs_mkdir+0x4f6/0x9e0 [ 108.613593][ T5779] vfs_mkdir+0x408/0x620 [ 108.613618][ T5779] filename_mkdirat+0x289/0x520 [ 108.613644][ T5779] __se_sys_mkdirat+0x35/0x150 [ 108.613670][ T5779] do_syscall_64+0x17b/0x530 [ 108.613689][ T5779] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.613709][ T5779] [ 108.613709][ T5779] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 108.613739][ T5779] __lock_acquire+0x15ff/0x2e40 [ 108.613757][ T5779] lock_acquire+0x115/0x350 [ 108.613788][ T5779] mutex_lock_nested+0x5a/0x1d0 [ 108.613812][ T5779] tcm_alloc+0x21/0x2f0 [ 108.613828][ T5779] usb_get_function+0x63/0xb0 [ 108.613858][ T5779] config_usb_cfg_link+0x148/0x260 [ 108.613877][ T5779] configfs_symlink+0x59a/0x1030 [ 108.613904][ T5779] vfs_symlink+0x18b/0x330 [ 108.613932][ T5779] filename_symlinkat+0x1cd/0x420 [ 108.613961][ T5779] __se_sys_symlinkat+0x4e/0x2b0 [ 108.613990][ T5779] do_syscall_64+0x17b/0x530 [ 108.614008][ T5779] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.614028][ T5779] [ 108.614028][ T5779] other info that might help us debug this: [ 108.614028][ T5779] [ 108.614036][ T5779] Chain exists of: [ 108.614036][ T5779] tpg_instances_lock --> &sb->s_type->i_mutex_key#25 --> &gi->lock [ 108.614036][ T5779] [ 108.614078][ T5779] Possible unsafe locking scenario: [ 108.614078][ T5779] [ 108.614085][ T5779] CPU0 CPU1 [ 108.614092][ T5779] ---- ---- [ 108.614099][ T5779] lock(&gi->lock); [ 108.614113][ T5779] lock(&sb->s_type->i_mutex_key#25 [ 108.614127][ T5793] ------------[ cut here ]------------ [ 108.614130][ T5779] ); [ 108.614136][ T5779] lock(&gi->lock [ 108.614140][ T5793] mas->ld_seq != lock_sequence(map) [ 108.614149][ T5779] ); [ 108.614156][ T5779] lock(tpg_instances_lock); [ 108.614171][ T5779] [ 108.614171][ T5779] *** DEADLOCK *** [ 108.614171][ T5779] [ 108.614157][ T5793] WARNING: lib/maple_tree.c:1188 at mas_find+0xa02/0xca0, CPU#0: modprobe/5793 [ 108.614177][ T5779] locks held by syz.2.9/5779: 3, last CPU#1: [ 108.614193][ T5793] Modules linked in: [ 108.614194][ T5779] #0: [ 108.614200][ T5793] [ 108.614200][ T5779] ffff88801eb56510 (sb_writers#14){.+.+}-{0:0} [ 108.614227][ T5793] CPU: 0 UID: 0 PID: 5793 Comm: modprobe Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 108.614233][ T5779] , at: mnt_want_write+0x41/0x90 [ 108.614253][ T5793] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 108.614262][ T5779] #1: ffff88803dac06e0 ( [ 108.614270][ T5793] RIP: 0010:mas_find+0xa02/0xca0 [ 108.614279][ T5779] &sb->s_type->i_mutex_key#25){++++}-{4:4} [ 108.614299][ T5793] Code: 74 08 4c 89 f7 e8 5e 39 e9 f6 49 c7 06 ff ff ff ff 31 c0 e9 16 fd ff ff e8 7b e1 7c f6 31 c0 e9 0a fd ff ff e8 6f e1 7c f6 90 <0f> 0b 90 e9 65 f7 ff ff e8 61 e1 7c f6 31 c0 e9 f0 fc ff ff e8 55 [ 108.614301][ T5779] , at: configfs_symlink+0x3af/0x1030 [ 108.614319][ T5793] RSP: 0018:ffffc900065378b8 EFLAGS: 00010293 [ 108.614331][ T5779] #2: [ 108.614333][ T5793] [ 108.614340][ T5779] ffff888038ea4388 [ 108.614339][ T5793] RAX: ffffffff8b48c241 RBX: 1ffff92000ca6f75 RCX: ffff8880312a0000 [ 108.614349][ T5779] (&gi->lock [ 108.614356][ T5793] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 108.614359][ T5779] ){+.+.}-{4:4} [ 108.614370][ T5793] RBP: 0000000000000067 R08: 0000000000000000 R09: 0000000000000000 [ 108.614369][ T5779] , at: config_usb_cfg_link+0x59/0x260 [ 108.614385][ T5793] R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: 00000000ffffffff [ 108.614391][ T5779] [ 108.614391][ T5779] stack backtrace: [ 108.614402][ T5779] CPU: 1 UID: 0 PID: 5779 Comm: syz.2.9 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 108.614401][ T5793] R13: ffffc90006537bb4 R14: ffffc90006537b60 R15: ffffc90006537ba8 [ 108.614427][ T5779] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 108.614425][ T5793] FS: 0000000000000000(0000) GS:ffff8881259f2000(0000) knlGS:0000000000000000 [ 108.614439][ T5779] Call Trace: [ 108.614444][ T5793] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 108.614448][ T5779] [ 108.614459][ T5793] CR2: 00007fbc8293b700 CR3: 000000002a394000 CR4: 00000000003526f0 [ 108.614456][ T5779] dump_stack_lvl+0xe8/0x150 [ 108.614477][ T5793] Call Trace: [ 108.614485][ T5793] [ 108.614484][ T5779] print_circular_bug+0x2e2/0x300 [ 108.614494][ T5793] ? unlink_file_vma_batch_add+0x129/0x1e0 [ 108.614513][ T5779] check_noncircular+0x12f/0x150 [ 108.614522][ T5793] free_pgtables+0x712/0xb70 [ 108.614549][ T5793] ? __pfx_free_pgtables+0x10/0x10 [ 108.614543][ T5779] __lock_acquire+0x15ff/0x2e40 [ 108.614575][ T5779] ? __lock_acquire+0x14b9/0x2e40 [ 108.614574][ T5793] ? rwbase_write_lock+0x550/0x720 [ 108.614603][ T5793] exit_mmap+0x4aa/0x9f0 [ 108.614605][ T5779] lock_acquire+0x115/0x350 [ 108.614633][ T5793] ? __pfx_exit_mmap+0x10/0x10 [ 108.614641][ T5779] ? tcm_alloc+0x21/0x2f0 [ 108.614664][ T5779] ? tcm_alloc+0x21/0x2f0 [ 108.614662][ T5793] ? do_raw_spin_lock+0x12b/0x2f0 [ 108.614686][ T5779] ? tcm_alloc+0x21/0x2f0 [ 108.614698][ T5793] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 108.614705][ T5779] mutex_lock_nested+0x5a/0x1d0 [ 108.614724][ T5793] ? __pfx_exit_aio+0x10/0x10 [ 108.614732][ T5779] ? tcm_alloc+0x21/0x2f0 [ 108.614749][ T5779] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 108.614754][ T5793] ? uprobe_clear_state+0x2a7/0x3e0 [ 108.614773][ T5779] tcm_alloc+0x21/0x2f0 [ 108.614789][ T5793] __mmput+0xcb/0x3e0 [ 108.614793][ T5779] usb_get_function+0x63/0xb0 [ 108.614811][ T5793] exit_mm+0x186/0x240 [ 108.614825][ T5779] config_usb_cfg_link+0x148/0x260 [ 108.614842][ T5793] do_exit+0x6cd/0x2360 [ 108.614851][ T5779] configfs_symlink+0x59a/0x1030 [ 108.614874][ T5793] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 108.614882][ T5779] ? lookup_one_qstr_excl+0x1d4/0x360 [ 108.614904][ T5793] ? __pfx_do_exit+0x10/0x10 [ 108.614907][ T5779] ? make_vfsuid+0x49/0xa0 [ 108.614936][ T5793] ? rt_spin_unlock+0x157/0x200 [ 108.614941][ T5779] ? __pfx_configfs_symlink+0x10/0x10 [ 108.614967][ T5793] ? rt_spin_unlock+0x163/0x200 [ 108.614974][ T5779] ? bpf_lsm_inode_symlink+0x9/0x20 [ 108.614997][ T5793] do_group_exit+0x22d/0x2f0 [ 108.615005][ T5779] vfs_symlink+0x18b/0x330 [ 108.615030][ T5793] __x64_sys_exit_group+0x3f/0x40 [ 108.615035][ T5779] ? security_path_symlink+0xf3/0x310 [ 108.615069][ T5793] x64_sys_call+0x18bf/0x18c0 [ 108.615073][ T5779] filename_symlinkat+0x1cd/0x420 [ 108.615100][ T5793] do_syscall_64+0x17b/0x530 [ 108.615109][ T5779] ? __pfx_filename_symlinkat+0x10/0x10 [ 108.615120][ T5793] ? irqentry_exit+0x10f/0x8f0 [ 108.615140][ T5793] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.615142][ T5779] ? strncpy_from_user+0x150/0x2c0 [ 108.615161][ T5793] ? clear_bhb_loop+0x40/0x90 [ 108.615170][ T5779] ? do_getname+0x151/0x250 [ 108.615186][ T5793] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.615204][ T5779] __se_sys_symlinkat+0x4e/0x2b0 [ 108.615208][ T5793] RIP: 0033:0x7fdea5a056c5 [ 108.615230][ T5793] Code: Unable to access opcode bytes at 0x7fdea5a0569b. [ 108.615242][ T5793] RSP: 002b:00007ffc37383998 EFLAGS: 00000202 [ 108.615238][ T5779] do_syscall_64+0x17b/0x530 [ 108.615256][ T5793] ORIG_RAX: 00000000000000e7 [ 108.615260][ T5779] ? irqentry_exit+0x10f/0x8f0 [ 108.615265][ T5793] RAX: ffffffffffffffda RBX: 00007fdea5b06fe8 RCX: 00007fdea5a056c5 [ 108.615281][ T5793] RDX: 00000000000000e7 RSI: ffffffffffffff88 RDI: 0000000000000001 [ 108.615280][ T5779] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.615296][ T5793] RBP: 0000000000000001 R08: 00007ffc37383928 R09: 0000000000000000 [ 108.615303][ T5779] ? clear_bhb_loop+0x40/0x90 [ 108.615310][ T5793] R10: 00007ffc373837c0 R11: 0000000000000202 R12: 0000000000000000 [ 108.615323][ T5793] R13: 0000000000000001 R14: 00007fdea5b05680 R15: 00007fdea5b07000 [ 108.615328][ T5779] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.615347][ T5793] [ 108.615351][ T5779] RIP: 0033:0x7fcdfe1ee019 [ 108.615358][ T5793] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 108.615375][ T5793] CPU: 0 UID: 0 PID: 5793 Comm: modprobe Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 108.615399][ T5793] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 108.615411][ T5793] Call Trace: [ 108.615418][ T5793] [ 108.615426][ T5793] vpanic+0x56c/0xa60 [ 108.615447][ T5793] ? __pfx__printk+0x10/0x10 [ 108.615472][ T5793] ? __pfx_vpanic+0x10/0x10 [ 108.615489][ T5793] ? is_bpf_text_address+0x292/0x2b0 [ 108.615512][ T5793] ? is_bpf_text_address+0x26/0x2b0 [ 108.615540][ T5793] panic+0xc5/0xd0 [ 108.615560][ T5793] ? __pfx_panic+0x10/0x10 [ 108.615588][ T5793] __warn+0x315/0x4c0 [ 108.615606][ T5793] ? mas_find+0xa02/0xca0 [ 108.615625][ T5793] ? mas_find+0xa02/0xca0 [ 108.615644][ T5793] __report_bug+0x276/0x570 [ 108.615665][ T5793] ? mas_find+0xa02/0xca0 [ 108.615685][ T5793] ? __pfx___report_bug+0x10/0x10 [ 108.615713][ T5793] ? mas_find+0xa02/0xca0 [ 108.615732][ T5793] report_bug+0x16a/0x220 [ 108.615753][ T5793] ? mas_find+0xa02/0xca0 [ 108.615772][ T5793] ? mas_find+0xa04/0xca0 [ 108.615790][ T5793] handle_bug+0x9c/0x200 [ 108.615814][ T5793] exc_invalid_op+0x1a/0x50 [ 108.615838][ T5793] asm_exc_invalid_op+0x1a/0x20 [ 108.615857][ T5793] RIP: 0010:mas_find+0xa02/0xca0 [ 108.615878][ T5793] Code: 74 08 4c 89 f7 e8 5e 39 e9 f6 49 c7 06 ff ff ff ff 31 c0 e9 16 fd ff ff e8 7b e1 7c f6 31 c0 e9 0a fd ff ff e8 6f e1 7c f6 90 <0f> 0b 90 e9 65 f7 ff ff e8 61 e1 7c f6 31 c0 e9 f0 fc ff ff e8 55 [ 108.615896][ T5793] RSP: 0018:ffffc900065378b8 EFLAGS: 00010293 [ 108.615914][ T5793] RAX: ffffffff8b48c241 RBX: 1ffff92000ca6f75 RCX: ffff8880312a0000 [ 108.615930][ T5793] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 108.615943][ T5793] RBP: 0000000000000067 R08: 0000000000000000 R09: 0000000000000000 [ 108.615956][ T5793] R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: 00000000ffffffff [ 108.615970][ T5793] R13: ffffc90006537bb4 R14: ffffc90006537b60 R15: ffffc90006537ba8 [ 108.615990][ T5793] ? mas_find+0xa01/0xca0 [ 108.616020][ T5793] ? mas_find+0xa01/0xca0 [ 108.616038][ T5793] ? unlink_file_vma_batch_add+0x129/0x1e0 [ 108.616067][ T5793] free_pgtables+0x712/0xb70 [ 108.616091][ T5793] ? __pfx_free_pgtables+0x10/0x10 [ 108.616112][ T5793] ? rwbase_write_lock+0x550/0x720 [ 108.616137][ T5793] exit_mmap+0x4aa/0x9f0 [ 108.616164][ T5793] ? __pfx_exit_mmap+0x10/0x10 [ 108.616189][ T5793] ? do_raw_spin_lock+0x12b/0x2f0 [ 108.616220][ T5793] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 108.616243][ T5793] ? __pfx_exit_aio+0x10/0x10 [ 108.616268][ T5793] ? uprobe_clear_state+0x2a7/0x3e0 [ 108.616298][ T5793] __mmput+0xcb/0x3e0 [ 108.616316][ T5793] exit_mm+0x186/0x240 [ 108.616343][ T5793] do_exit+0x6cd/0x2360 [ 108.616370][ T5793] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 108.616396][ T5793] ? __pfx_do_exit+0x10/0x10 [ 108.616422][ T5793] ? rt_spin_unlock+0x157/0x200 [ 108.616449][ T5793] ? rt_spin_unlock+0x163/0x200 [ 108.616474][ T5793] do_group_exit+0x22d/0x2f0 [ 108.616502][ T5793] __x64_sys_exit_group+0x3f/0x40 [ 108.616528][ T5793] x64_sys_call+0x18bf/0x18c0 [ 108.616564][ T5793] do_syscall_64+0x17b/0x530 [ 108.616585][ T5793] ? irqentry_exit+0x10f/0x8f0 [ 108.616604][ T5793] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.616626][ T5793] ? clear_bhb_loop+0x40/0x90 [ 108.616649][ T5793] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.616669][ T5793] RIP: 0033:0x7fdea5a056c5 [ 108.616685][ T5793] Code: Unable to access opcode bytes at 0x7fdea5a0569b. [ 108.616696][ T5793] RSP: 002b:00007ffc37383998 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7 [ 108.616718][ T5793] RAX: ffffffffffffffda RBX: 00007fdea5b06fe8 RCX: 00007fdea5a056c5 [ 108.616734][ T5793] RDX: 00000000000000e7 RSI: ffffffffffffff88 RDI: 0000000000000001 [ 108.616748][ T5793] RBP: 0000000000000001 R08: 00007ffc37383928 R09: 0000000000000000 [ 108.616761][ T5793] R10: 00007ffc373837c0 R11: 0000000000000202 R12: 0000000000000000 [ 108.616775][ T5793] R13: 0000000000000001 R14: 00007fdea5b05680 R15: 00007fdea5b07000 [ 108.616798][ T5793] [ 108.617396][ T5793] Kernel Offset: disabled