last executing test programs: 2.107664665s ago: executing program 2 (id=3): r0 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0204800, &(0x7f0000000040)={0x80000000, 0x0}) 1.08226698s ago: executing program 1 (id=2): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='+3 +4 +4.1 +4.2\n', 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f00000001c0)='1\n', 0x2) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) nanosleep(&(0x7f0000000240)={0x2}, 0x0) mount$nfs4(&(0x7f0000000280)='127.0.0.1:/\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f00000002c0), 0x0, 0x0) 74.13931ms ago: executing program 1 (id=6): syz_usb_connect(0x2, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040ca0810010001000000010902200001010080320904000002ff0000000705830240000007050402400000"], 0x0) nanosleep(&(0x7f0000000100)={0x1}, 0x0) 0s ago: executing program 2 (id=7): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='proc\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/sys/kernel/panic_on_warn\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='0\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./config\x00', &(0x7f0000000500)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x2, 0x0) write(r1, &(0x7f0000000b00)='rd_pages=1024\x00', 0xd) r2 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x2, 0x0) write(r2, &(0x7f0000000d00)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./config/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001600)='./config/target/usb_gadget/naa.1234567890\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001700)='./config/target/usb_gadget/naa.1234567890/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001800)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001900)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000900)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f0000001a00)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0/virtual_device\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000001b00)='./config/target/usb_gadget/naa.1234567890/tpgt_1/nexus\x00', 0x2, 0x0) write(r3, &(0x7f0000001c00)='naa.1234567890\x00', 0xe) r4 = openat(0xffffffffffffff9c, &(0x7f0000001d00)='./config/target/usb_gadget/naa.1234567890/tpgt_1/enable\x00', 0x2, 0x0) write(r4, &(0x7f0000001e00)='1\x00', 0x1) symlinkat(&(0x7f0000001300)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000001f00)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r5, &(0x7f0000002000)='dummy_udc.0\x00', 0xb) nanosleep(&(0x7f0000002100)={0x1}, 0x0) r6 = syz_open_dev$sg(&(0x7f0000002200), 0x0, 0x2) ioctl$SG_IO(r6, 0x2285, &(0x7f0000002300)={0x53, 0xfffffffe, 0xa, 0x0, @buffer={0x0, 0x18, &(0x7f0000002400)=""/24}, &(0x7f0000002500)="5f000000000000001800", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$SG_IO(r6, 0x2285, &(0x7f0000002600)={0x53, 0xfffffffe, 0xa, 0x0, @buffer={0x0, 0x18, &(0x7f0000002700)=""/24}, &(0x7f0000002800)="5f050100000000001800", 0x0, 0x0, 0x0, 0x0, 0x0}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.183' (ED25519) to the list of known hosts. [ 77.420593][ T5605] cgroup: Unknown subsys name 'net' [ 77.550147][ T5605] cgroup: Unknown subsys name 'cpuset' [ 77.560757][ T5605] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 79.150193][ T5605] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 81.597320][ T5622] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 81.597908][ T5618] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 81.607033][ T5622] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 81.607056][ T5618] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 81.608039][ T5618] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 81.608328][ T5618] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 81.617344][ T5622] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 81.618130][ T5625] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 81.619248][ T5625] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 81.620929][ T5625] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 81.647683][ T5625] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 81.652288][ T5625] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 81.652771][ T5625] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 81.654239][ T5625] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 81.663195][ T5625] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 81.727791][ T5618] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 81.737739][ T5618] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 81.745318][ T5618] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 81.751544][ T5618] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 81.753159][ T5618] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 81.776817][ T5618] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 81.785292][ T5618] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 81.795310][ T5618] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 81.800822][ T5618] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 81.803248][ T5618] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 83.677389][ T5625] Bluetooth: hci0: command tx timeout [ 83.723102][ T5623] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.723518][ T5623] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.728676][ T5623] bridge_slave_0: entered allmulticast mode [ 83.737816][ T5623] bridge_slave_0: entered promiscuous mode [ 83.756253][ T5625] Bluetooth: hci2: command tx timeout [ 83.756265][ T5618] Bluetooth: hci1: command tx timeout [ 83.797963][ T5623] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.798181][ T5623] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.798598][ T5623] bridge_slave_1: entered allmulticast mode [ 83.805640][ T5623] bridge_slave_1: entered promiscuous mode [ 83.826310][ T5625] Bluetooth: hci3: command tx timeout [ 83.826318][ T5618] Bluetooth: hci4: command tx timeout [ 83.855489][ T5621] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.863853][ T5621] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.866887][ T5621] bridge_slave_0: entered allmulticast mode [ 83.874224][ T5621] bridge_slave_0: entered promiscuous mode [ 83.900092][ T5616] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.900450][ T5616] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.900883][ T5616] bridge_slave_0: entered allmulticast mode [ 83.907434][ T5616] bridge_slave_0: entered promiscuous mode [ 83.932098][ T5621] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.932330][ T5621] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.932679][ T5621] bridge_slave_1: entered allmulticast mode [ 83.941127][ T5621] bridge_slave_1: entered promiscuous mode [ 83.987773][ T5616] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.994973][ T5616] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.995081][ T5616] bridge_slave_1: entered allmulticast mode [ 83.997874][ T5616] bridge_slave_1: entered promiscuous mode [ 84.033556][ T5623] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.043436][ T5623] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.043619][ T5617] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.043720][ T5617] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.043833][ T5617] bridge_slave_0: entered allmulticast mode [ 84.050964][ T5617] bridge_slave_0: entered promiscuous mode [ 84.125466][ T5617] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.125831][ T5617] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.128072][ T5617] bridge_slave_1: entered allmulticast mode [ 84.133222][ T5617] bridge_slave_1: entered promiscuous mode [ 84.150397][ T5616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.175357][ T5621] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.207438][ T5616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.207962][ T5627] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.208220][ T5627] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.208537][ T5627] bridge_slave_0: entered allmulticast mode [ 84.214632][ T5627] bridge_slave_0: entered promiscuous mode [ 84.231219][ T5621] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.238438][ T5623] team0: Port device team_slave_0 added [ 84.275140][ T5627] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.275509][ T5627] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.275855][ T5627] bridge_slave_1: entered allmulticast mode [ 84.282214][ T5627] bridge_slave_1: entered promiscuous mode [ 84.309706][ T5623] team0: Port device team_slave_1 added [ 84.327757][ T5617] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.379970][ T5617] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.389158][ T5616] team0: Port device team_slave_0 added [ 84.408577][ T5621] team0: Port device team_slave_0 added [ 84.414624][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.414684][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.414746][ T5623] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.462388][ T5616] team0: Port device team_slave_1 added [ 84.481021][ T5627] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.490290][ T5621] team0: Port device team_slave_1 added [ 84.492781][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.492822][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.492893][ T5623] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.554273][ T5627] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.583100][ T5617] team0: Port device team_slave_0 added [ 84.587921][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.587958][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.588023][ T5616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.645599][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.646498][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.646581][ T5621] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.664194][ T5617] team0: Port device team_slave_1 added [ 84.668086][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.668127][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.668193][ T5616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.753925][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.753968][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.754004][ T5621] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.809527][ T5627] team0: Port device team_slave_0 added [ 84.845287][ T5627] team0: Port device team_slave_1 added [ 84.857835][ T5623] hsr_slave_0: entered promiscuous mode [ 84.861955][ T5623] hsr_slave_1: entered promiscuous mode [ 84.869638][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.869691][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.869719][ T5617] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.936057][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.943111][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.943134][ T5617] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.008898][ T5616] hsr_slave_0: entered promiscuous mode [ 85.011957][ T5616] hsr_slave_1: entered promiscuous mode [ 85.013842][ T5616] debugfs: 'hsr0' already exists in 'hsr' [ 85.014096][ T5616] Cannot create hsr debugfs directory [ 85.034745][ T5627] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.034790][ T5627] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.034817][ T5627] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.086852][ T5621] hsr_slave_0: entered promiscuous mode [ 85.089908][ T5621] hsr_slave_1: entered promiscuous mode [ 85.091743][ T5621] debugfs: 'hsr0' already exists in 'hsr' [ 85.091789][ T5621] Cannot create hsr debugfs directory [ 85.106434][ T5627] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.106498][ T5627] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.106569][ T5627] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.255181][ T5617] hsr_slave_0: entered promiscuous mode [ 85.261397][ T5617] hsr_slave_1: entered promiscuous mode [ 85.263825][ T5617] debugfs: 'hsr0' already exists in 'hsr' [ 85.263877][ T5617] Cannot create hsr debugfs directory [ 85.346343][ T5627] hsr_slave_0: entered promiscuous mode [ 85.348961][ T5627] hsr_slave_1: entered promiscuous mode [ 85.351591][ T5627] debugfs: 'hsr0' already exists in 'hsr' [ 85.351643][ T5627] Cannot create hsr debugfs directory [ 85.746181][ T5625] Bluetooth: hci0: command tx timeout [ 85.826352][ T5625] Bluetooth: hci2: command tx timeout [ 85.836172][ T5625] Bluetooth: hci1: command tx timeout [ 85.844490][ T5616] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 85.860006][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 85.865821][ T5616] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 85.879323][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 85.881763][ T5616] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 85.895772][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 85.904945][ T5616] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 85.907195][ T5625] Bluetooth: hci3: command tx timeout [ 85.912310][ T5625] Bluetooth: hci4: command tx timeout [ 85.928072][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.007187][ T5623] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 86.017615][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.022262][ T5623] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 86.038667][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.048543][ T5623] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 86.060722][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.078709][ T5623] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 86.089181][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.181413][ T5621] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 86.193754][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.198278][ T5621] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 86.211239][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.223563][ T5621] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 86.234538][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.248330][ T5621] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 86.259756][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.358627][ T5617] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 86.368859][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.387344][ T5617] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 86.399085][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.422051][ T5617] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 86.431842][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.446483][ T5617] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 86.456129][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.487521][ T5616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.555929][ T5627] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 86.567458][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.589383][ T5616] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.598141][ T5627] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 86.610037][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.612385][ T5627] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 86.624814][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.647294][ T5627] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 86.660211][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.681039][ T1172] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.682844][ T1172] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.744247][ T5623] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.758711][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.758839][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.860631][ T5623] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.906418][ T5621] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.917129][ T1172] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.917234][ T1172] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.953242][ T1172] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.953369][ T1172] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.064362][ T5621] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.120342][ T1172] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.120469][ T1172] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.149457][ T5617] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.205124][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.206551][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.304327][ T5617] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.387305][ T1172] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.387446][ T1172] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.443276][ T5627] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.490514][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.491764][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.569128][ T5627] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.622797][ T3287] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.622990][ T3287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.659759][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.659897][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.826615][ T5625] Bluetooth: hci0: command tx timeout [ 87.909508][ T5618] Bluetooth: hci2: command tx timeout [ 87.909618][ T5625] Bluetooth: hci1: command tx timeout [ 87.986842][ T5625] Bluetooth: hci4: command tx timeout [ 87.986896][ T5625] Bluetooth: hci3: command tx timeout [ 88.331588][ T5616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.504271][ T5616] veth0_vlan: entered promiscuous mode [ 88.524947][ T5616] veth1_vlan: entered promiscuous mode [ 88.580027][ T5623] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.670427][ T5616] veth0_macvtap: entered promiscuous mode [ 88.704814][ T5616] veth1_macvtap: entered promiscuous mode [ 88.796884][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.835554][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.877668][ T5623] veth0_vlan: entered promiscuous mode [ 88.895737][ T5621] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.939476][ T5623] veth1_vlan: entered promiscuous mode [ 89.202741][ T5623] veth0_macvtap: entered promiscuous mode [ 89.226749][ T5617] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.237665][ T3287] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.237802][ T3287] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.237859][ T3287] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.238133][ T3287] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.264963][ T1172] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.265027][ T1172] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.267833][ T5623] veth1_macvtap: entered promiscuous mode [ 89.343857][ T5627] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.400460][ T51] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.400506][ T51] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.458221][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.499774][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.546753][ T275] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.546844][ T275] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.546913][ T275] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.546959][ T275] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.594702][ T5616] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 89.620210][ T5617] veth0_vlan: entered promiscuous mode [ 89.690149][ T5617] veth1_vlan: entered promiscuous mode [ 89.755306][ T5627] veth0_vlan: entered promiscuous mode [ 89.916684][ T5618] Bluetooth: hci0: command tx timeout [ 89.948832][ T5627] veth1_vlan: entered promiscuous mode [ 89.984547][ T51] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.984598][ T51] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.999981][ T5618] Bluetooth: hci1: command tx timeout [ 90.000075][ T5618] Bluetooth: hci2: command tx timeout [ 90.068728][ T5618] Bluetooth: hci4: command tx timeout [ 90.069488][ T5625] Bluetooth: hci3: command tx timeout [ 90.243596][ T5621] veth0_vlan: entered promiscuous mode [ 90.325573][ T3287] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.325640][ T3287] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.425098][ T5617] veth0_macvtap: entered promiscuous mode [ 90.517804][ T5621] veth1_vlan: entered promiscuous mode [ 90.594213][ T5617] veth1_macvtap: entered promiscuous mode [ 90.633423][ T5627] veth0_macvtap: entered promiscuous mode [ 90.659378][ T5627] veth1_macvtap: entered promiscuous mode [ 90.699371][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.771713][ T5627] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.780071][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.854972][ T5627] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.874044][ T5621] veth0_macvtap: entered promiscuous mode [ 90.888571][ T1115] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.900622][ T5813] NFSD: Failed to start, no listeners configured. [ 90.922414][ T5621] veth1_macvtap: entered promiscuous mode [ 90.936778][ T60] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.936850][ T60] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.936957][ T60] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.937117][ T60] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.937216][ T60] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.937316][ T60] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.937417][ T60] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.063758][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.138438][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.264191][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.264242][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.282608][ T1115] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.283131][ T1115] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.367595][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.367643][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.418826][ T1115] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.492728][ T1115] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.492774][ T1115] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.547050][ T60] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.638014][ T60] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.638062][ T60] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.712876][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.712931][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.846878][ T5817] se_device not configured yet, cannot port link [ 91.857623][ T5817] [ 91.860011][ T5817] ====================================================== [ 91.867053][ T5817] WARNING: possible circular locking dependency detected [ 91.874110][ T5817] syzkaller #0 Not tainted [ 91.878547][ T5817] ------------------------------------------------------ [ 91.885591][ T5817] syz.2.7/5817 is trying to acquire lock: [ 91.891332][ T5817] ffffffff8fc710c0 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x21/0x2e0 [ 91.900283][ T5817] [ 91.900283][ T5817] but task is already holding lock: [ 91.907668][ T5817] ffff888032082390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x59/0x260 [ 91.916681][ T5817] [ 91.916681][ T5817] which lock already depends on the new lock. [ 91.916681][ T5817] [ 91.919344][ T30] cfg80211: failed to load regulatory.db [ 91.932744][ T5817] [ 91.932744][ T5817] the existing dependency chain (in reverse order) is: [ 91.941780][ T5817] [ 91.941780][ T5817] -> #2 (&gi->lock){+.+.}-{4:4}: [ 91.948951][ T5817] __mutex_lock+0x19c/0x15a0 [ 91.954118][ T5817] config_usb_cfg_link+0x59/0x260 [ 91.959705][ T5817] configfs_symlink+0x74e/0x11d0 [ 91.965208][ T5817] vfs_symlink+0x18b/0x330 [ 91.970180][ T5817] filename_symlinkat+0x1cd/0x410 [ 91.975761][ T5817] __se_sys_symlinkat+0x4e/0x2b0 [ 91.981252][ T5817] do_syscall_64+0x166/0x520 [ 91.986406][ T5817] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.992857][ T5817] [ 91.992857][ T5817] -> #1 (&sb->s_type->i_mutex_key#25){++++}-{4:4}: [ 92.001604][ T5817] down_write+0x96/0x200 [ 92.006411][ T5817] configfs_depend_item_unlocked+0x153/0x420 [ 92.012953][ T5817] usbg_make_tpg+0x1e0/0x550 [ 92.018104][ T5817] target_fabric_make_tpg+0xa8/0x6d0 [ 92.023943][ T5817] configfs_mkdir+0x4f6/0x9e0 [ 92.029200][ T5817] vfs_mkdir+0x398/0x710 [ 92.033998][ T5817] filename_mkdirat+0x285/0x510 [ 92.039390][ T5817] __se_sys_mkdirat+0x35/0x150 [ 92.044692][ T5817] do_syscall_64+0x166/0x520 [ 92.049823][ T5817] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.056255][ T5817] [ 92.056255][ T5817] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 92.064202][ T5817] __lock_acquire+0x15ff/0x2e50 [ 92.069596][ T5817] lock_acquire+0x115/0x350 [ 92.074631][ T5817] __mutex_lock+0x19c/0x15a0 [ 92.079769][ T5817] tcm_alloc+0x21/0x2e0 [ 92.084463][ T5817] usb_get_function+0x63/0xb0 [ 92.089686][ T5817] config_usb_cfg_link+0x148/0x260 [ 92.095332][ T5817] configfs_symlink+0x74e/0x11d0 [ 92.100821][ T5817] vfs_symlink+0x18b/0x330 [ 92.105794][ T5817] filename_symlinkat+0x1cd/0x410 [ 92.111368][ T5817] __se_sys_symlinkat+0x4e/0x2b0 [ 92.116881][ T5817] do_syscall_64+0x166/0x520 [ 92.122120][ T5817] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.128555][ T5817] [ 92.128555][ T5817] other info that might help us debug this: [ 92.128555][ T5817] [ 92.138877][ T5817] Chain exists of: [ 92.138877][ T5817] tpg_instances_lock --> &sb->s_type->i_mutex_key#25 --> &gi->lock [ 92.138877][ T5817] [ 92.152813][ T5817] Possible unsafe locking scenario: [ 92.152813][ T5817] [ 92.160392][ T5817] CPU0 CPU1 [ 92.165772][ T5817] ---- ---- [ 92.171146][ T5817] lock(&gi->lock); [ 92.175065][ T5817] lock(&sb->s_type->i_mutex_key#25); [ 92.183066][ T5817] lock(&gi->lock); [ 92.189515][ T5817] lock(tpg_instances_lock); [ 92.194215][ T5817] [ 92.194215][ T5817] *** DEADLOCK *** [ 92.194215][ T5817] [ 92.202373][ T5817] locks held by syz.2.7/5817: 3, last CPU#0: [ 92.208366][ T5817] #0: ffff88801d37e460 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 92.217648][ T5817] #1: ffff888055b76280 (&sb->s_type->i_mutex_key#25){++++}-{4:4}, at: configfs_symlink+0x4d0/0x11d0 [ 92.228570][ T5817] #2: ffff888032082390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x59/0x260 [ 92.238015][ T5817] [ 92.238015][ T5817] stack backtrace: [ 92.243939][ T5817] CPU: 0 UID: 0 PID: 5817 Comm: syz.2.7 Not tainted syzkaller #0 PREEMPT(full) [ 92.252980][ T5817] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 92.263089][ T5817] Call Trace: [ 92.266401][ T5817] [ 92.269356][ T5817] dump_stack_lvl+0xe8/0x150 [ 92.273973][ T5817] print_circular_bug+0x2e2/0x300 [ 92.279026][ T5817] check_noncircular+0x12f/0x150 [ 92.283994][ T5817] __lock_acquire+0x15ff/0x2e50 [ 92.288869][ T5817] ? __lock_acquire+0x14b9/0x2e50 [ 92.293911][ T5817] ? __pfx_stack_trace_save+0x10/0x10 [ 92.299325][ T5817] lock_acquire+0x115/0x350 [ 92.303843][ T5817] ? tcm_alloc+0x21/0x2e0 [ 92.308198][ T5817] __mutex_lock+0x19c/0x15a0 [ 92.312930][ T5817] ? tcm_alloc+0x21/0x2e0 [ 92.317317][ T5817] ? rcu_is_watching+0x16/0xb0 [ 92.322139][ T5817] ? trace_contention_end+0x3d/0x140 [ 92.327449][ T5817] ? __mutex_lock+0x30a/0x15a0 [ 92.332257][ T5817] ? tcm_alloc+0x21/0x2e0 [ 92.336608][ T5817] ? __pfx___mutex_lock+0x10/0x10 [ 92.341745][ T5817] ? lock_acquire+0x115/0x350 [ 92.346444][ T5817] ? __pfx___mutex_lock+0x10/0x10 [ 92.351500][ T5817] tcm_alloc+0x21/0x2e0 [ 92.355686][ T5817] usb_get_function+0x63/0xb0 [ 92.360392][ T5817] config_usb_cfg_link+0x148/0x260 [ 92.365527][ T5817] configfs_symlink+0x74e/0x11d0 [ 92.370491][ T5817] ? lookup_one_qstr_excl+0x1d4/0x360 [ 92.375905][ T5817] ? make_vfsuid+0x49/0xa0 [ 92.380359][ T5817] ? generic_permission+0x2ba/0x660 [ 92.385588][ T5817] ? __pfx_configfs_symlink+0x10/0x10 [ 92.390989][ T5817] ? bpf_lsm_inode_symlink+0x9/0x20 [ 92.396213][ T5817] vfs_symlink+0x18b/0x330 [ 92.400655][ T5817] ? security_path_symlink+0xfd/0x360 [ 92.406051][ T5817] filename_symlinkat+0x1cd/0x410 [ 92.411111][ T5817] ? __might_fault+0xaf/0x130 [ 92.415835][ T5817] ? __pfx_filename_symlinkat+0x10/0x10 [ 92.421423][ T5817] ? do_getname+0x151/0x250 [ 92.426392][ T5817] __se_sys_symlinkat+0x4e/0x2b0 [ 92.431373][ T5817] do_syscall_64+0x166/0x520 [ 92.436000][ T5817] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.442106][ T5817] ? clear_bhb_loop+0x70/0xc0 [ 92.446813][ T5817] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.452734][ T5817] RIP: 0033:0x7f4f1b99e159 [ 92.457187][ T5817] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.476812][ T5817] RSP: 002b:00007f4f1c910028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 92.485266][ T5817] RAX: ffffffffffffffda RBX: 00007f4f1bc25fa0 RCX: 00007f4f1b99e159 [ 92.493266][ T5817] RDX: 0000200000001400 RSI: ffffffffffffff9c RDI: 0000200000001300 [ 92.501301][ T5817] RBP: 00007f4f1ba35024 R08: 0000000000000000 R09: 0000000000000000 [ 92.509312][ T5817] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.517314][ T5817] R13: 00007f4f1bc26038 R14: 00007f4f1bc25fa0 R15: 00007fffb7a66088 [ 92.525330][ T5817] [ 92.539321][ T1172] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.539346][ T1172] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.796208][ T25] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 92.826098][ T5717] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 92.976374][ T5717] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.03 [ 92.977559][ T5717] usb 1-1: Dual-Role OTG device on HNP port [ 92.978004][ T5717] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.986397][ T9] Using the BOT protocol [ 92.998075][ T9] Using the UAS protocol [ 93.014799][ T5717] scsi host1: uas [ 93.955043][ T25] usb 2-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 93.964979][ T25] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 93.965047][ T25] usb 2-1: can't read configurations, error -71