last executing test programs: 148.986551ms ago: executing program 1 (id=2): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/xhci_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='0000:00:1d.0\x00', 0xd) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/drivers/xhci_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='0000:00:1d.0\x00', 0xd) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/platform/devices/serial8250/driver_override\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='xhci-hcd\x00', 0x9) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/platform/drivers/xhci-hcd/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='serial8250\x00', 0xb) r4 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/platform/drivers/xhci-hcd/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000700)='serial8250\x00', 0xb) 108.30348ms ago: executing program 1 (id=6): openat(0xffffffffffffff9c, &(0x7f0000000040)='proc/vmcore\x00', 0x0, 0x0) 71.477006ms ago: executing program 1 (id=7): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/usb/drivers/usbtest/bind\x00', 0x1, 0x0) 113.53µs ago: executing program 1 (id=8): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x29}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000100)='fd/3\x00') 0s ago: executing program 4 (id=5): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x777) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget\x00', 0x777) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x777) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions\x00', 0x777) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/phonet.usb0/ifname\x00', 0x0, 0x0) read(r0, &(0x7f0000000200), 0x100) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.160' (ED25519) to the list of known hosts. [ 28.361452][ T4700] cgroup: Unknown subsys name 'net' [ 28.461413][ T4700] cgroup: Unknown subsys name 'cpuset' [ 28.463508][ T4700] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 28.620836][ T4700] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 29.386765][ T4715] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 29.387260][ T4715] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 29.387619][ T4715] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 29.389451][ T4723] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 29.389735][ T4723] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 29.391822][ T4720] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 29.392050][ T4720] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 29.393746][ T4720] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 29.395595][ T4715] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 29.396718][ T4715] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 29.397126][ T4723] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 29.397543][ T4723] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 29.398103][ T4723] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 29.398536][ T4723] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 29.398692][ T4723] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 29.398814][ T4723] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 29.400405][ T4723] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 29.403223][ T4720] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 29.403708][ T4720] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 29.404491][ T4723] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 29.421083][ T4713] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 29.422713][ T4713] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 29.424297][ T4713] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 29.429781][ T4713] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 29.435227][ T4713] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 29.754264][ T4711] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.754684][ T4711] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.754809][ T4711] bridge_slave_0: entered allmulticast mode [ 29.755316][ T4711] bridge_slave_0: entered promiscuous mode [ 29.782529][ T4711] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.782628][ T4711] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.782707][ T4711] bridge_slave_1: entered allmulticast mode [ 29.783199][ T4711] bridge_slave_1: entered promiscuous mode [ 29.805329][ T4711] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.806370][ T4711] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.836532][ T4711] team0: Port device team_slave_0 added [ 29.844514][ T4710] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.845922][ T4710] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.847335][ T4710] bridge_slave_0: entered allmulticast mode [ 29.848907][ T4710] bridge_slave_0: entered promiscuous mode [ 29.851261][ T4711] team0: Port device team_slave_1 added [ 29.858826][ T4710] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.858902][ T4710] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.859016][ T4710] bridge_slave_1: entered allmulticast mode [ 29.859487][ T4710] bridge_slave_1: entered promiscuous mode [ 29.897295][ T4710] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.901008][ T4718] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.901116][ T4718] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.901208][ T4718] bridge_slave_0: entered allmulticast mode [ 29.901648][ T4718] bridge_slave_0: entered promiscuous mode [ 29.918039][ T4711] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.919591][ T4711] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.919631][ T4711] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.920772][ T4711] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.920781][ T4711] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.920797][ T4711] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.931682][ T4711] hsr_slave_0: entered promiscuous mode [ 29.932021][ T4711] hsr_slave_1: entered promiscuous mode [ 29.933519][ T4710] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.939112][ T4718] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.939880][ T4718] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.940359][ T4718] bridge_slave_1: entered allmulticast mode [ 29.940864][ T4718] bridge_slave_1: entered promiscuous mode [ 29.950237][ T4710] team0: Port device team_slave_0 added [ 29.951097][ T4710] team0: Port device team_slave_1 added [ 29.964944][ T4712] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.966366][ T4712] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.967710][ T4712] bridge_slave_0: entered allmulticast mode [ 29.969278][ T4712] bridge_slave_0: entered promiscuous mode [ 29.978212][ T4718] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.985269][ T4722] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.986525][ T4722] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.987923][ T4722] bridge_slave_0: entered allmulticast mode [ 29.989522][ T4722] bridge_slave_0: entered promiscuous mode [ 29.990951][ T4712] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.991026][ T4712] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.991126][ T4712] bridge_slave_1: entered allmulticast mode [ 29.991553][ T4712] bridge_slave_1: entered promiscuous mode [ 29.998785][ T4718] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.005065][ T4710] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.005288][ T4710] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.005310][ T4710] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.006034][ T4722] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.006131][ T4722] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.006198][ T4722] bridge_slave_1: entered allmulticast mode [ 30.006966][ T4722] bridge_slave_1: entered promiscuous mode [ 30.012278][ T4712] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.013515][ T4712] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.021975][ T4718] team0: Port device team_slave_0 added [ 30.022254][ T4710] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.022261][ T4710] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.022275][ T4710] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.034548][ T4718] team0: Port device team_slave_1 added [ 30.035984][ T4722] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.057717][ T4722] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.062066][ T4712] team0: Port device team_slave_0 added [ 30.063098][ T4712] team0: Port device team_slave_1 added [ 30.067671][ T4710] hsr_slave_0: entered promiscuous mode [ 30.068005][ T4710] hsr_slave_1: entered promiscuous mode [ 30.068231][ T4710] debugfs: 'hsr0' already exists in 'hsr' [ 30.068279][ T4710] Cannot create hsr debugfs directory [ 30.072264][ T4718] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.072289][ T4718] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.072303][ T4718] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.082364][ T4718] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.082390][ T4718] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.082402][ T4718] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.087089][ T4722] team0: Port device team_slave_0 added [ 30.088743][ T4722] team0: Port device team_slave_1 added [ 30.103125][ T4712] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.103157][ T4712] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.103181][ T4712] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.115698][ T4712] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.115728][ T4712] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.115745][ T4712] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.129881][ T4718] hsr_slave_0: entered promiscuous mode [ 30.130801][ T4718] hsr_slave_1: entered promiscuous mode [ 30.131011][ T4718] debugfs: 'hsr0' already exists in 'hsr' [ 30.131022][ T4718] Cannot create hsr debugfs directory [ 30.133154][ T4722] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.133162][ T4722] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.133174][ T4722] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.134164][ T4722] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.134174][ T4722] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.134189][ T4722] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.173338][ T4712] hsr_slave_0: entered promiscuous mode [ 30.173680][ T4712] hsr_slave_1: entered promiscuous mode [ 30.173892][ T4712] debugfs: 'hsr0' already exists in 'hsr' [ 30.173902][ T4712] Cannot create hsr debugfs directory [ 30.180789][ T4722] hsr_slave_0: entered promiscuous mode [ 30.181114][ T4722] hsr_slave_1: entered promiscuous mode [ 30.181301][ T4722] debugfs: 'hsr0' already exists in 'hsr' [ 30.181310][ T4722] Cannot create hsr debugfs directory [ 30.191196][ T4711] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 30.193399][ T4711] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.206733][ T4711] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 30.209385][ T4711] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.221116][ T4711] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 30.223515][ T4711] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.226904][ T4711] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 30.229315][ T4711] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.290421][ T4710] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 30.292657][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.294429][ T4710] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 30.296676][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.298381][ T4710] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 30.301134][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.309874][ T4710] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 30.312751][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.313800][ T4711] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.313831][ T4711] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.313983][ T4711] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.314014][ T4711] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.342483][ T4710] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.342528][ T4710] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.342622][ T4710] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.342657][ T4710] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.351367][ T4718] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 30.353658][ T4718] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.354449][ T4718] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 30.356091][ T4718] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.357935][ T4718] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 30.359125][ T4718] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.361631][ T4718] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 30.363782][ T4718] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.394688][ T4711] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.400625][ T15] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.402940][ T15] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.406001][ T15] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.408045][ T15] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.419097][ T4710] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.421331][ T4712] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 30.423735][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.425469][ T4712] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 30.427451][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.431789][ T4711] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.439146][ T4710] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.441604][ T4712] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 30.443912][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.447794][ T15] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.447844][ T15] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.448498][ T15] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.448520][ T15] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.455071][ T4712] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 30.457466][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.462117][ T15] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.462157][ T15] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.468156][ T891] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.468210][ T891] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.495310][ T4710] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.495357][ T4710] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.521071][ T4722] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 30.523461][ T4722] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.524140][ T4722] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 30.526728][ T4722] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.534298][ T4722] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 30.536960][ T4722] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.538650][ T4722] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 30.541347][ T4722] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.558739][ T4718] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.576658][ T4718] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.601805][ T891] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.601854][ T891] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.612871][ T3764] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.612923][ T3764] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.642235][ T4712] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.646670][ T4722] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.662833][ T4712] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.675244][ T4722] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.677267][ T4710] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.679174][ T3879] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.679215][ T3879] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.682974][ T3879] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.683012][ T3879] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.698879][ T891] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.698935][ T891] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.699532][ T891] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.699551][ T891] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.717115][ T4722] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.727754][ T4712] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.733337][ T4712] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.744031][ T4711] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.776017][ T4710] veth0_vlan: entered promiscuous mode [ 30.788255][ T4710] veth1_vlan: entered promiscuous mode [ 30.824850][ T4710] veth0_macvtap: entered promiscuous mode [ 30.848857][ T4710] veth1_macvtap: entered promiscuous mode [ 30.857578][ T4710] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.860511][ T4710] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.874600][ T891] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.874706][ T891] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.874766][ T891] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.874892][ T891] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.922760][ T4711] veth0_vlan: entered promiscuous mode [ 30.935428][ T4711] veth1_vlan: entered promiscuous mode [ 30.945619][ T4711] veth0_macvtap: entered promiscuous mode [ 30.946762][ T4711] veth1_macvtap: entered promiscuous mode [ 30.964491][ T3879] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.964537][ T3879] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.978068][ T4711] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.985353][ T4711] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.995838][ T4718] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.998506][ T891] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.998553][ T891] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.008908][ T4722] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.012511][ T4712] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.051627][ T40] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.057991][ T4710] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.078777][ T4712] veth0_vlan: entered promiscuous mode [ 31.079621][ T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.079634][ T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.088807][ T4718] veth0_vlan: entered promiscuous mode [ 31.094300][ T40] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.096532][ T891] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.096745][ T891] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.103235][ T4722] veth0_vlan: entered promiscuous mode [ 31.108450][ T4712] veth1_vlan: entered promiscuous mode [ 31.114580][ T4722] veth1_vlan: entered promiscuous mode [ 31.131610][ T891] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.131646][ T891] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.132475][ T4718] veth1_vlan: entered promiscuous mode [ 31.144225][ T4712] veth0_macvtap: entered promiscuous mode [ 31.159142][ T4712] veth1_macvtap: entered promiscuous mode [ 31.167567][ T4722] veth0_macvtap: entered promiscuous mode [ 31.176410][ T4722] veth1_macvtap: entered promiscuous mode [ 31.189026][ T4722] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.193641][ T4718] veth0_macvtap: entered promiscuous mode [ 31.196498][ T4718] veth1_macvtap: entered promiscuous mode [ 31.204688][ T4712] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.211376][ T4722] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.216852][ T4718] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.223703][ T4712] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.231828][ T4718] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.234923][ T4899] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 31.235143][ T4899] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 31.247800][ T4898] ================================================================== [ 31.247821][ T4898] BUG: KASAN: slab-out-of-bounds in gether_get_ifname+0x104/0x124 [ 31.247843][ T4898] Read of size 1 at addr ffff0000d9257042 by task syz.4.5/4898 [ 31.247852][ T4898] [ 31.247856][ T4898] CPU: 0 UID: 0 PID: 4898 Comm: syz.4.5 Not tainted syzkaller #0 PREEMPT [ 31.247866][ T4898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 31.247872][ T4898] Call trace: [ 31.247876][ T4898] show_stack+0x2c/0x3c (C) [ 31.247891][ T4898] __dump_stack+0x30/0x40 [ 31.247904][ T4898] dump_stack_lvl+0xd8/0x12c [ 31.247916][ T4898] print_address_description+0xb0/0x238 [ 31.247926][ T4898] print_report+0x68/0x84 [ 31.247934][ T4898] kasan_report+0x8c/0xc4 [ 31.247945][ T4898] __asan_report_load1_noabort+0x20/0x2c [ 31.247958][ T4898] gether_get_ifname+0x104/0x124 [ 31.247968][ T4898] f_phonet_ifname_show+0x4c/0x60 [ 31.247980][ T4898] configfs_read_iter+0x234/0x508 [ 31.247993][ T4898] vfs_read+0x498/0x8c8 [ 31.248002][ T4898] ksys_read+0x12c/0x228 [ 31.248009][ T4898] __arm64_sys_read+0x84/0x98 [ 31.248017][ T4898] invoke_syscall+0x98/0x244 [ 31.248030][ T4898] el0_svc_common+0xec/0x23c [ 31.248041][ T4898] do_el0_svc+0x4c/0x5c [ 31.248053][ T4898] el0_svc+0x64/0x260 [ 31.248064][ T4898] el0t_64_sync_handler+0x44/0x104 [ 31.248074][ T4898] el0t_64_sync+0x198/0x19c [ 31.248083][ T4898] [ 31.248085][ T4898] Allocated by task 4898: [ 31.248090][ T4898] kasan_save_track+0x40/0x78 [ 31.248099][ T4898] kasan_save_alloc_info+0x40/0x50 [ 31.248109][ T4898] __kasan_kmalloc+0x9c/0xb4 [ 31.248118][ T4898] __kvmalloc_node_noprof+0x460/0x7d8 [ 31.248127][ T4898] alloc_netdev_mqs+0xac/0xf2c [ 31.248135][ T4898] gphonet_setup_default+0x38/0x88 [ 31.248145][ T4898] phonet_alloc_inst+0x84/0x100 [ 31.248155][ T4898] try_get_usb_function_instance+0xe4/0x164 [ 31.248165][ T4898] usb_get_function_instance+0x24/0xb0 [ 31.248173][ T4898] function_make+0x110/0x300 [ 31.248183][ T4898] configfs_mkdir+0x374/0x7d4 [ 31.248189][ T4898] vfs_mkdir+0x2dc/0x464 [ 31.248197][ T4898] filename_mkdirat+0x228/0x3f4 [ 31.248206][ T4898] __arm64_sys_mkdirat+0x9c/0xc0 [ 31.248215][ T4898] invoke_syscall+0x98/0x244 [ 31.248225][ T4898] el0_svc_common+0xec/0x23c [ 31.248235][ T4898] do_el0_svc+0x4c/0x5c [ 31.248245][ T4898] el0_svc+0x64/0x260 [ 31.248253][ T4898] el0t_64_sync_handler+0x44/0x104 [ 31.248261][ T4898] el0t_64_sync+0x198/0x19c [ 31.248267][ T4898] [ 31.248270][ T4898] The buggy address belongs to the object at ffff0000d9256000 [ 31.248270][ T4898] which belongs to the cache kmalloc-cg-4k of size 4096 [ 31.248276][ T4898] The buggy address is located 314 bytes to the right of [ 31.248276][ T4898] allocated 3848-byte region [ffff0000d9256000, ffff0000d9256f08) [ 31.248285][ T4898] [ 31.248287][ T4898] The buggy address belongs to the physical page: [ 31.248291][ T4898] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x119250 [ 31.248299][ T4898] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 31.248305][ T4898] memcg:ffff0000c7161981 [ 31.248309][ T4898] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 31.248317][ T4898] page_type: f5(slab) [ 31.248325][ T4898] raw: 05ffc00000000040 ffff0000c000b500 dead000000000100 dead000000000122 [ 31.248333][ T4898] raw: 0000000000000000 0000000800040004 00000000f5000000 ffff0000c7161981 [ 31.248341][ T4898] head: 05ffc00000000040 ffff0000c000b500 dead000000000100 dead000000000122 [ 31.248348][ T4898] head: 0000000000000000 0000000800040004 00000000f5000000 ffff0000c7161981 [ 31.248355][ T4898] head: 05ffc00000000003 fffffdffc3649401 00000000ffffffff 00000000ffffffff [ 31.248362][ T4898] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 31.248366][ T4898] page dumped because: kasan: bad access detected [ 31.248370][ T4898] [ 31.248371][ T4898] Memory state around the buggy address: [ 31.248376][ T4898] ffff0000d9256f00: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.248381][ T4898] ffff0000d9256f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.248387][ T4898] >ffff0000d9257000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.248391][ T4898] ^ [ 31.248396][ T4898] ffff0000d9257080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.248401][ T4898] ffff0000d9257100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.248405][ T4898] ================================================================== [ 31.250201][ T4898] Disabling lock debugging due to kernel taint [ 31.308603][ T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.308615][ T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.321046][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.321060][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.321136][ T39] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.321470][ T39] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.321496][ T39] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.321511][ T39] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.321525][ T39] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.321539][ T39] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.321552][ T39] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.321574][ T39] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.321590][ T39] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.321604][ T39] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.321617][ T39] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.321631][ T39] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.347415][ T3764] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.347429][ T3764] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.357527][ T3764] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.357538][ T3764] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.364219][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.364245][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.372483][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.372514][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.450193][ T4717] Bluetooth: hci4: command tx timeout [ 31.450222][ T4717] Bluetooth: hci2: command tx timeout [ 31.450243][ T4717] Bluetooth: hci1: command tx timeout [ 31.450258][ T4717] Bluetooth: hci0: command tx timeout [ 31.450333][ T4713] Bluetooth: hci3: command tx timeout [ 33.529990][ T50] Bluetooth: hci0: command tx timeout [ 33.530022][ T50] Bluetooth: hci1: command tx timeout [ 33.530046][ T50] Bluetooth: hci2: command tx timeout [ 33.530061][ T50] Bluetooth: hci4: command tx timeout [ 33.530733][ T4713] Bluetooth: hci3: command tx timeout [ 35.610268][ T4717] Bluetooth: hci3: command tx timeout [ 35.610300][ T4717] Bluetooth: hci4: command tx timeout [ 35.610324][ T4717] Bluetooth: hci2: command tx timeout [ 35.610341][ T4717] Bluetooth: hci1: command tx timeout [ 35.610358][ T4717] Bluetooth: hci0: command tx timeout [ 37.689994][ T4713] Bluetooth: hci0: command tx timeout [ 37.690021][ T4720] Bluetooth: hci4: command tx timeout [ 37.690028][ T4713] Bluetooth: hci3: command tx timeout [ 37.690798][ T4717] Bluetooth: hci1: command tx timeout [ 37.690820][ T50] Bluetooth: hci2: command tx timeout