last executing test programs: 1.854587814s ago: executing program 2 (id=3): ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000e09d7040460a2196324f01020301090224000100000000090400000206d3450009050102100000000009058b0240"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000240)=ANY=[@ANYBLOB="20131d000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.809768974s ago: executing program 1 (id=5): iopl(0x3) r0 = syz_usb_connect$cdc_ncm(0x0, 0x76, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902640002010000000904010001020d0000052406000105240000000d240f0100000000000000000006241a"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 1.096771585s ago: executing program 0 (id=10): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x1000000, &(0x7f00000002c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(r0, 0x0, 0x0) lseek(r0, 0x3, 0x1) 1.070891325s ago: executing program 0 (id=11): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=ANY=[@ANYBLOB="800000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c000280050001000000000008000740000000011c00108008000140000000000800024000000000080003"], 0x80}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x38, 0x3, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}]}, 0x38}}, 0x0) 272.612916ms ago: executing program 3 (id=14): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x0) 163.368748ms ago: executing program 3 (id=15): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r0, 0x0, r1) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x11, 0x10, 0x0, 0x0) 163.049468ms ago: executing program 3 (id=16): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000340)='\x00', 0x1, 0x4c001, 0x0, 0x0) sendto$inet(r0, &(0x7f00000004c0)='.', 0x1, 0x12, 0x0, 0x0) recvfrom$inet(r0, 0x0, 0x0, 0xc9100120, 0x0, 0x0) 162.938458ms ago: executing program 3 (id=17): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000000)=@req3={0x8000, 0xfffffff7, 0x80, 0x20000}, 0x1c) 162.404778ms ago: executing program 0 (id=18): mkdir(&(0x7f0000000200)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000000)='./bus\x00', &(0x7f0000000040)='./bus\x00', &(0x7f00000000c0), 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./bus\x00', 0x0, 0x3ae4c21, &(0x7f0000000340)={[], [{@fscontext={'fscontext', 0x3d, 'user_u'}}]}) 151.024729ms ago: executing program 1 (id=19): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) getsockopt$bt_BT_VOICE(r0, 0x12, 0xb, 0x0, &(0x7f0000000080)) 94.028619ms ago: executing program 3 (id=20): mkdir(&(0x7f0000000300)='./bus\x00', 0x17a) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={[], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@fscontext={'fscontext', 0x3d, 'system_u'}}]}) 93.843819ms ago: executing program 1 (id=21): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x1fe) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) copy_file_range(r1, 0x0, r0, 0x0, 0xffffffffa003e45b, 0x700000000000000) 93.740449ms ago: executing program 0 (id=22): r0 = memfd_create(0x0, 0x0) write$binfmt_misc(r0, &(0x7f0000000180)="e502", 0x2) execveat(r0, 0x0, 0x0, 0x0, 0x1000) 88.437449ms ago: executing program 1 (id=23): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000001340)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000001300)={&(0x7f0000001200)={0x50, 0x1, 0x2, 0x401, 0x0, 0x0, {0xa, 0x0, 0x9}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x20}}, {0x14, 0x4, @private2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x1}, 0x24000010) 81.742819ms ago: executing program 3 (id=24): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000000009040000010300000009210000000122080009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002208000000a201"], 0x0}, 0x0) 34.08899ms ago: executing program 0 (id=25): r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) sendfile(r1, r0, 0x0, 0x3a) 33.80272ms ago: executing program 1 (id=26): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x30, 0x1, 0x0, 0xfffff031}]}) 33.58798ms ago: executing program 0 (id=27): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = dup2(r1, r0) ioctl$VHOST_VDPA_GET_DEVICE_ID(r2, 0x4008af24, &(0x7f0000002d80)) 0s ago: executing program 1 (id=28): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='rlog_pages=00000000000000065537,readahead=0']) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.62' (ED25519) to the list of known hosts. [ 24.759978][ T36] audit: type=1400 audit(1750952475.000:64): avc: denied { mounton } for pid=281 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.761474][ T281] cgroup: Unknown subsys name 'net' [ 24.782674][ T36] audit: type=1400 audit(1750952475.000:65): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.810085][ T36] audit: type=1400 audit(1750952475.030:66): avc: denied { unmount } for pid=281 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.810239][ T281] cgroup: Unknown subsys name 'devices' [ 24.972896][ T281] cgroup: Unknown subsys name 'hugetlb' [ 24.978706][ T281] cgroup: Unknown subsys name 'rlimit' [ 25.074728][ T36] audit: type=1400 audit(1750952475.320:67): avc: denied { setattr } for pid=281 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.098131][ T36] audit: type=1400 audit(1750952475.320:68): avc: denied { mounton } for pid=281 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.122869][ T36] audit: type=1400 audit(1750952475.320:69): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 25.153055][ T283] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 25.161931][ T36] audit: type=1400 audit(1750952475.410:70): avc: denied { relabelto } for pid=283 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.187412][ T36] audit: type=1400 audit(1750952475.410:71): avc: denied { write } for pid=283 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.198494][ T281] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.213023][ T36] audit: type=1400 audit(1750952475.440:72): avc: denied { read } for pid=281 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.247416][ T36] audit: type=1400 audit(1750952475.440:73): avc: denied { open } for pid=281 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.371428][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.378609][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.385956][ T288] bridge_slave_0: entered allmulticast mode [ 26.392650][ T288] bridge_slave_0: entered promiscuous mode [ 26.399940][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.407310][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.414625][ T288] bridge_slave_1: entered allmulticast mode [ 26.424057][ T288] bridge_slave_1: entered promiscuous mode [ 26.540522][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.547709][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.554844][ T294] bridge_slave_0: entered allmulticast mode [ 26.561211][ T294] bridge_slave_0: entered promiscuous mode [ 26.567759][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.574951][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.582052][ T294] bridge_slave_1: entered allmulticast mode [ 26.588284][ T294] bridge_slave_1: entered promiscuous mode [ 26.657768][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.664931][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.672099][ T292] bridge_slave_0: entered allmulticast mode [ 26.678434][ T292] bridge_slave_0: entered promiscuous mode [ 26.684986][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.692051][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.699205][ T292] bridge_slave_1: entered allmulticast mode [ 26.705549][ T292] bridge_slave_1: entered promiscuous mode [ 26.739244][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.746361][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.753468][ T293] bridge_slave_0: entered allmulticast mode [ 26.759705][ T293] bridge_slave_0: entered promiscuous mode [ 26.766200][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.773266][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.780536][ T293] bridge_slave_1: entered allmulticast mode [ 26.786834][ T293] bridge_slave_1: entered promiscuous mode [ 26.823478][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.830555][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.837838][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.844890][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.907453][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.914534][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.921834][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.928879][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.946644][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.954036][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.961888][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.969209][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.005941][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.013036][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.021448][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.028496][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.076935][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.084025][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.092800][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.099857][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.142232][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.149295][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.157332][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.164409][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.192816][ T288] veth0_vlan: entered promiscuous mode [ 27.201081][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.208148][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.215855][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.222998][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.244857][ T294] veth0_vlan: entered promiscuous mode [ 27.263963][ T292] veth0_vlan: entered promiscuous mode [ 27.273270][ T288] veth1_macvtap: entered promiscuous mode [ 27.299899][ T292] veth1_macvtap: entered promiscuous mode [ 27.306760][ T293] veth0_vlan: entered promiscuous mode [ 27.316703][ T294] veth1_macvtap: entered promiscuous mode [ 27.339324][ T288] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 27.377950][ T293] veth1_macvtap: entered promiscuous mode [ 27.467024][ T321] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 27.619945][ T329] loop7: detected capacity change from 0 to 16384 [ 27.670349][ T10] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 27.681279][ T329] I/O error, dev loop7, sector 11264 op 0x0:(READ) flags 0x80700 phys_seg 2 prio class 0 [ 27.691495][ T312] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 27.702677][ T329] I/O error, dev loop7, sector 11520 op 0x0:(READ) flags 0x80700 phys_seg 20 prio class 0 [ 27.713207][ T329] I/O error, dev loop7, sector 11264 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 27.723022][ T329] Buffer I/O error on dev loop7, logical block 1408, async page read [ 27.769276][ T328] I/O error, dev loop7, sector 0 op 0x1:(WRITE) flags 0x4800 phys_seg 128 prio class 0 [ 27.779724][ T328] Buffer I/O error on dev loop7, logical block 0, lost async page write [ 27.788358][ T328] Buffer I/O error on dev loop7, logical block 1, lost async page write [ 27.797831][ T328] Buffer I/O error on dev loop7, logical block 2, lost async page write [ 27.806412][ T328] Buffer I/O error on dev loop7, logical block 3, lost async page write [ 27.815325][ T328] Buffer I/O error on dev loop7, logical block 4, lost async page write [ 27.824057][ T328] Buffer I/O error on dev loop7, logical block 5, lost async page write [ 27.833264][ T328] Buffer I/O error on dev loop7, logical block 6, lost async page write [ 27.842019][ T328] Buffer I/O error on dev loop7, logical block 7, lost async page write [ 27.851371][ T328] Buffer I/O error on dev loop7, logical block 8, lost async page write [ 27.860060][ T10] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 27.870080][ T312] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 27.881409][ T10] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 27.891902][ T312] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 27.905456][ T328] I/O error, dev loop7, sector 1024 op 0x1:(WRITE) flags 0x4800 phys_seg 128 prio class 0 [ 27.915540][ T312] usb 2-1: config 1 has no interface number 0 [ 27.922421][ T312] usb 2-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 27.936078][ T10] usb 3-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 27.945700][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.948564][ T328] I/O error, dev loop7, sector 2048 op 0x1:(WRITE) flags 0x4800 phys_seg 128 prio class 0 [ 27.956143][ T10] usb 3-1: Product: syz [ 27.968578][ T10] usb 3-1: Manufacturer: syz [ 27.973485][ T10] usb 3-1: SerialNumber: syz [ 27.978855][ T312] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 27.988150][ T312] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.995147][ T328] I/O error, dev loop7, sector 3072 op 0x1:(WRITE) flags 0x4800 phys_seg 128 prio class 0 [ 27.997315][ T312] usb 2-1: Product: syz [ 28.010742][ T10] usb 3-1: config 0 descriptor?? [ 28.015818][ T312] usb 2-1: Manufacturer: syz [ 28.020828][ T312] usb 2-1: SerialNumber: syz [ 28.023367][ T311] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 28.032164][ T328] I/O error, dev loop7, sector 4096 op 0x1:(WRITE) flags 0x4800 phys_seg 128 prio class 0 [ 28.043884][ T311] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 28.045339][ T312] usb 2-1: selecting invalid altsetting 1 [ 28.063063][ T328] I/O error, dev loop7, sector 5120 op 0x1:(WRITE) flags 0x4800 phys_seg 128 prio class 0 [ 28.079149][ T328] I/O error, dev loop7, sector 6144 op 0x1:(WRITE) flags 0x4800 phys_seg 128 prio class 0 [ 28.300236][ T311] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 28.307674][ T311] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 28.716805][ T312] cdc_ncm 2-1:1.1: failed GET_NTB_PARAMETERS [ 28.722939][ T312] cdc_ncm 2-1:1.1: bind() failure [ 28.729578][ T312] usb 2-1: USB disconnect, device number 2 [ 28.803776][ T10] dm9601: No valid MAC address in EEPROM, using 00:00:00:00:00:00 [ 29.004584][ T10] dm9601 3-1:0.0 (unnamed net_device) (uninitialized): Error reading chip ID [ 29.014866][ T10] usb 3-1: USB disconnect, device number 2 [ 29.106330][ T356] SELinux: security_context_str_to_sid (user_u) failed with errno=-22 [ 29.127142][ T360] SELinux: security_context_str_to_sid (sysadm_u) failed with errno=-22 [ 29.249455][ T376] ------------[ cut here ]------------ [ 29.255098][ T376] WARNING: CPU: 1 PID: 376 at mm/page_alloc.c:5159 __alloc_pages_noprof+0xe4/0x6c0 [ 29.264601][ T376] Modules linked in: [ 29.268551][ T376] CPU: 1 UID: 0 PID: 376 Comm: syz.1.28 Not tainted 6.12.30-syzkaller-g1ccb219f8cda #0 7a2e1ed1be67dd4e5f42c8044c2ea2ca0199c2ac [ 29.281826][ T376] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 29.292096][ T376] RIP: 0010:__alloc_pages_noprof+0xe4/0x6c0 [ 29.298033][ T376] Code: 0f 1f 44 00 00 41 83 fd 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d 94 31 ee 05 00 0f 85 c4 00 00 00 c6 05 87 31 ee 05 01 <0f> 0b 31 c0 e9 b6 00 00 00 41 83 fd 0a 0f 87 aa 00 00 00 44 89 6c [ 29.317757][ T376] RSP: 0018:ffffc9000d087880 EFLAGS: 00010246 [ 29.323973][ T376] RAX: 0000000000000000 RBX: 1ffff92001a10f14 RCX: 0000000000000000 [ 29.332012][ T376] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000d087928 [ 29.340007][ T376] RBP: ffffc9000d0879b0 R08: ffffc9000d087927 R09: 0000000000000000 [ 29.348032][ T376] R10: ffffc9000d087910 R11: fffff52001a10f25 R12: ffffc9000d0878c0 [ 29.356233][ T376] R13: 000000000000000f R14: dffffc0000000000 R15: 0000000000000000 [ 29.364273][ T376] FS: 00007f8cc6a9a6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 29.373338][ T376] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.379958][ T376] CR2: 0000200000001000 CR3: 0000000114928000 CR4: 00000000003526b0 [ 29.388004][ T376] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 29.396146][ T376] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 29.404187][ T376] Call Trace: [ 29.407572][ T376] [ 29.410548][ T376] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 29.416647][ T376] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 29.420388][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 29.422433][ T376] ? incfs_realloc_mount_info+0xa7/0x4d0 [ 29.435530][ T376] ___kmalloc_large_node+0x9c/0x1d0 [ 29.440788][ T376] ? incfs_realloc_mount_info+0xa7/0x4d0 [ 29.446466][ T376] __kmalloc_large_node_noprof+0x1e/0xe0 [ 29.452150][ T376] ? incfs_realloc_mount_info+0xa7/0x4d0 [ 29.457823][ T376] __kmalloc_noprof+0x26d/0x450 [ 29.462746][ T376] incfs_realloc_mount_info+0xa7/0x4d0 [ 29.468499][ T376] ? incfs_add_sysfs_node+0x118/0x240 [ 29.473991][ T376] incfs_alloc_mount_info+0x479/0x600 [ 29.479410][ T376] incfs_mount_fs+0x3ca/0x960 [ 29.484152][ T376] ? __cfi_incfs_mount_fs+0x10/0x10 [ 29.489385][ T376] ? vfs_parse_fs_string+0x102/0x170 [ 29.494751][ T376] ? selinux_capable+0x38/0x50 [ 29.499550][ T376] legacy_get_tree+0x106/0x1b0 [ 29.504377][ T376] ? __cfi_incfs_mount_fs+0x10/0x10 [ 29.509606][ T376] vfs_get_tree+0xa1/0x290 [ 29.514079][ T376] do_new_mount+0x251/0xb40 [ 29.518658][ T376] ? security_capable+0xcf/0xf0 [ 29.523650][ T376] path_mount+0x688/0x1050 [ 29.528102][ T376] ? putname+0x113/0x150 [ 29.532398][ T376] __se_sys_mount+0x2bd/0x480 [ 29.537114][ T376] ? __x64_sys_mount+0xf0/0xf0 [ 29.541984][ T376] ? __kasan_check_write+0x18/0x20 [ 29.547134][ T376] ? fpregs_restore_userregs+0x11d/0x260 [ 29.552914][ T376] __x64_sys_mount+0xc3/0xf0 [ 29.557713][ T376] x64_sys_call+0x2021/0x2ee0 [ 29.562486][ T376] do_syscall_64+0x58/0xf0 [ 29.566972][ T376] ? clear_bhb_loop+0x50/0xa0 [ 29.571697][ T376] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 29.577627][ T376] RIP: 0033:0x7f8cc5b8e929 [ 29.580396][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 29.582133][ T376] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 29.588851][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 29.606988][ T376] RSP: 002b:00007f8cc6a9a038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 29.607023][ T376] RAX: ffffffffffffffda RBX: 00007f8cc5db5fa0 RCX: 00007f8cc5b8e929 [ 29.607041][ T376] RDX: 0000200000000140 RSI: 0000200000000080 RDI: 0000200000000000 [ 29.618504][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 29.626588][ T376] RBP: 00007f8cc5c10b39 R08: 0000200000000200 R09: 0000000000000000 [ 29.635049][ T10] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 29.642664][ T376] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 29.652829][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.660420][ T376] R13: 0000000000000000 R14: 00007f8cc5db5fa0 R15: 00007ffc9e31bb58 [ 29.660446][ T376] [ 29.672997][ T10] usb 4-1: config 0 descriptor?? [ 29.677486][ T376] ---[ end trace 0000000000000000 ]--- [ 29.707020][ T376] incfs: Error allocating mount info. -12 [ 29.713647][ T376] incfs: mount failed -12 [ 30.095744][ T10] savu 0003:1E7D:2D5A.0001: unknown main item tag 0x0 [ 30.102641][ T10] savu 0003:1E7D:2D5A.0001: unknown main item tag 0x0 [ 30.109426][ T10] savu 0003:1E7D:2D5A.0001: unknown main item tag 0x0 [ 30.116336][ T10] savu 0003:1E7D:2D5A.0001: unknown main item tag 0x0 [ 30.123208][ T10] savu 0003:1E7D:2D5A.0001: unknown main item tag 0x0 [ 30.130021][ T10] savu 0003:1E7D:2D5A.0001: unbalanced collection at end of report description [ 30.139268][ T10] savu 0003:1E7D:2D5A.0001: parse failed [ 30.144963][ T10] savu 0003:1E7D:2D5A.0001: probe with driver savu failed with error -22 [ 30.300471][ T10] usb 4-1: USB disconnect, device number 2