map[Fixes:map[Hash:bf4c02d5e772903be5bf8952bac730a2956d0619 Title:rt2x00: reset usb devices at probe] KernelBranch:master KernelCommit:5d6919055dec134de3c40167a490f33c74c12581 KernelRepo:git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git PatchDescription:wifi: rt2x00usb: fix NULL pointer dereference in rt2x00usb_disconnect()

In `rt2x00usb_probe()`, `usb_reset_device()` is called early. If this
reset fails or detects an unexpected device state (which is common with
malicious or rapidly disconnecting simulated USB devices), the USB core
schedules an asynchronous logical disconnect for the device. If the
probe function subsequently fails (e.g., due to hardware allocation or
registration failure), it cleans up by freeing the hardware struct and
setting the interface data to NULL via `usb_set_intfdata(usb_intf,
NULL)`.

Due to a race condition with the asynchronous disconnect scheduled by
the early reset, the `rt2x00usb_disconnect()` callback can be invoked
even after the probe has failed and cleared the interface data. When
`rt2x00usb_disconnect()` is called, it fetches the interface data using
`usb_get_intfdata()` and unconditionally dereferences it to access
`hw->priv`, leading to a kernel panic since `hw` is NULL.

Fix this by adding a NULL check for `hw` at the beginning of
`rt2x00usb_disconnect()`. If `hw` is NULL, it means the probe failed and
the cleanup has already been performed, so the function can safely
return early. PatchDiff:diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
index 174d89b0b..ea6ceb3a1 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
@@ -858,7 +858,12 @@ EXPORT_SYMBOL_GPL(rt2x00usb_probe);
 void rt2x00usb_disconnect(struct usb_interface *usb_intf)
 {
 	struct ieee80211_hw *hw = usb_get_intfdata(usb_intf);
-	struct rt2x00_dev *rt2x00dev = hw->priv;
+	struct rt2x00_dev *rt2x00dev;
+
+	if (!hw)
+		return;
+
+	rt2x00dev = hw->priv;
 
 	/*
 	 * Free all allocated data.
 Recipients:[map[Email:linux-kernel@vger.kernel.org Name: To:false] map[Email:linux-wireless@vger.kernel.org Name: To:true] map[Email:stf_xl@wp.pl Name:Stanislaw Gruszka To:true]]]

map[KernelBranch:master KernelCommit:5d6919055dec134de3c40167a490f33c74c12581 KernelRepo:git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git]

map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE 

#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#include <linux/usb/ch9.h>

static unsigned long long procid;

static void sleep_ms(uint64_t ms)
{
	usleep(ms * 1000);
}

#define MAX_FDS 30

#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32
#define USB_MAX_FDS 6

struct usb_endpoint_index {
	struct usb_endpoint_descriptor desc;
	int handle;
};

struct usb_iface_index {
	struct usb_interface_descriptor* iface;
	uint8_t bInterfaceNumber;
	uint8_t bAlternateSetting;
	uint8_t bInterfaceClass;
	struct usb_endpoint_index eps[USB_MAX_EP_NUM];
	int eps_num;
};

struct usb_device_index {
	struct usb_device_descriptor* dev;
	struct usb_config_descriptor* config;
	uint8_t bDeviceClass;
	uint8_t bMaxPower;
	int config_length;
	struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
	int ifaces_num;
	int iface_cur;
};

struct usb_info {
	int fd;
	struct usb_device_index index;
};

static struct usb_info usb_devices[USB_MAX_FDS];

static struct usb_device_index* lookup_usb_index(int fd)
{
	for (int i = 0; i < USB_MAX_FDS; i++) {
		if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd)
			return &usb_devices[i].index;
	}
	return NULL;
}

static int usb_devices_num;

static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index)
{
	if (length < sizeof(*index->dev) + sizeof(*index->config))
		return false;
	memset(index, 0, sizeof(*index));
	index->dev = (struct usb_device_descriptor*)buffer;
	index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
	index->bDeviceClass = index->dev->bDeviceClass;
	index->bMaxPower = index->config->bMaxPower;
	index->config_length = length - sizeof(*index->dev);
	index->iface_cur = -1;
	size_t offset = 0;
	while (true) {
		if (offset + 1 >= length)
			break;
		uint8_t desc_length = buffer[offset];
		uint8_t desc_type = buffer[offset + 1];
		if (desc_length <= 2)
			break;
		if (offset + desc_length > length)
			break;
		if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) {
			struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset);
			index->ifaces[index->ifaces_num].iface = iface;
			index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber;
			index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting;
			index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass;
			index->ifaces_num++;
		}
		if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
			struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
			if (iface->eps_num < USB_MAX_EP_NUM) {
				memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc));
				iface->eps_num++;
			}
		}
		offset += desc_length;
	}
	return true;
}

static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len)
{
	int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED);
	if (i >= USB_MAX_FDS)
		return NULL;
	if (!parse_usb_descriptor(dev, dev_len, &usb_devices[i].index))
		return NULL;
	__atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE);
	return &usb_devices[i].index;
}

struct vusb_connect_string_descriptor {
	uint32_t len;
	char* str;
} __attribute__((packed));

struct vusb_connect_descriptors {
	uint32_t qual_len;
	char* qual;
	uint32_t bos_len;
	char* bos;
	uint32_t strs_len;
	struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));

static const char default_string[] = {
    8, USB_DT_STRING,
    's', 0, 'y', 0, 'z', 0
};

static const char default_lang_id[] = {
    4, USB_DT_STRING,
    0x09, 0x04
};

static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs,
				       const struct usb_ctrlrequest* ctrl,
				       struct usb_qualifier_descriptor* qual,
				       char** response_data, uint32_t* response_length)
{
	struct usb_device_index* index = lookup_usb_index(fd);
	uint8_t str_idx;
	if (!index)
		return false;
	switch (ctrl->bRequestType & USB_TYPE_MASK) {
	case USB_TYPE_STANDARD:
		switch (ctrl->bRequest) {
		case USB_REQ_GET_DESCRIPTOR:
			switch (ctrl->wValue >> 8) {
			case USB_DT_DEVICE:
				*response_data = (char*)index->dev;
				*response_length = sizeof(*index->dev);
				return true;
			case USB_DT_CONFIG:
				*response_data = (char*)index->config;
				*response_length = index->config_length;
				return true;
			case USB_DT_STRING:
				str_idx = (uint8_t)ctrl->wValue;
				if (descs && str_idx < descs->strs_len) {
					*response_data = descs->strs[str_idx].str;
					*response_length = descs->strs[str_idx].len;
					return true;
				}
				if (str_idx == 0) {
					*response_data = (char*)&default_lang_id[0];
					*response_length = default_lang_id[0];
					return true;
				}
				*response_data = (char*)&default_string[0];
				*response_length = default_string[0];
				return true;
			case USB_DT_BOS:
				*response_data = descs->bos;
				*response_length = descs->bos_len;
				return true;
			case USB_DT_DEVICE_QUALIFIER:
				if (!descs->qual) {
					qual->bLength = sizeof(*qual);
					qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
					qual->bcdUSB = index->dev->bcdUSB;
					qual->bDeviceClass = index->dev->bDeviceClass;
					qual->bDeviceSubClass = index->dev->bDeviceSubClass;
					qual->bDeviceProtocol = index->dev->bDeviceProtocol;
					qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
					qual->bNumConfigurations = index->dev->bNumConfigurations;
					qual->bRESERVED = 0;
					*response_data = (char*)qual;
					*response_length = sizeof(*qual);
					return true;
				}
				*response_data = descs->qual;
				*response_length = descs->qual_len;
				return true;
			default:
				break;
			}
			break;
		default:
			break;
		}
		break;
	default:
		break;
	}
	return false;
}

typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs,
					      const struct usb_ctrlrequest* ctrl, bool* done);

static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs,
						const struct usb_ctrlrequest* ctrl, bool* done)
{
	switch (ctrl->bRequestType & USB_TYPE_MASK) {
	case USB_TYPE_STANDARD:
		switch (ctrl->bRequest) {
		case USB_REQ_SET_CONFIGURATION:
			*done = true;
			return true;
		default:
			break;
		}
		break;
	}
	return false;
}

struct vusb_descriptor {
	uint8_t req_type;
	uint8_t desc_type;
	uint32_t len;
	char data[0];
} __attribute__((packed));

struct vusb_descriptors {
	uint32_t len;
	struct vusb_descriptor* generic;
	struct vusb_descriptor* descs[0];
} __attribute__((packed));

struct vusb_response {
	uint8_t type;
	uint8_t req;
	uint32_t len;
	char data[0];
} __attribute__((packed));

struct vusb_responses {
	uint32_t len;
	struct vusb_response* generic;
	struct vusb_response* resps[0];
} __attribute__((packed));

static bool lookup_control_response(const struct vusb_descriptors* descs, const struct vusb_responses* resps,
				    struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length)
{
	int descs_num = 0;
	int resps_num = 0;
	if (descs)
		descs_num = (descs->len - offsetof(struct vusb_descriptors, descs)) / sizeof(descs->descs[0]);
	if (resps)
		resps_num = (resps->len - offsetof(struct vusb_responses, resps)) / sizeof(resps->resps[0]);
	uint8_t req = ctrl->bRequest;
	uint8_t req_type = ctrl->bRequestType & USB_TYPE_MASK;
	uint8_t desc_type = ctrl->wValue >> 8;
	if (req == USB_REQ_GET_DESCRIPTOR) {
		int i;
		for (i = 0; i < descs_num; i++) {
			struct vusb_descriptor* desc = descs->descs[i];
			if (!desc)
				continue;
			if (desc->req_type == req_type && desc->desc_type == desc_type) {
				*response_length = desc->len;
				if (*response_length != 0)
					*response_data = &desc->data[0];
				else
					*response_data = NULL;
				return true;
			}
		}
		if (descs && descs->generic) {
			*response_data = &descs->generic->data[0];
			*response_length = descs->generic->len;
			return true;
		}
	} else {
		int i;
		for (i = 0; i < resps_num; i++) {
			struct vusb_response* resp = resps->resps[i];
			if (!resp)
				continue;
			if (resp->type == req_type && resp->req == req) {
				*response_length = resp->len;
				if (*response_length != 0)
					*response_data = &resp->data[0];
				else
					*response_data = NULL;
				return true;
			}
		}
		if (resps && resps->generic) {
			*response_data = &resps->generic->data[0];
			*response_length = resps->generic->len;
			return true;
		}
	}
	return false;
}

#define UDC_NAME_LENGTH_MAX 128

struct usb_raw_init {
	__u8 driver_name[UDC_NAME_LENGTH_MAX];
	__u8 device_name[UDC_NAME_LENGTH_MAX];
	__u8 speed;
};

enum usb_raw_event_type {
	USB_RAW_EVENT_INVALID = 0,
	USB_RAW_EVENT_CONNECT = 1,
	USB_RAW_EVENT_CONTROL = 2,
};

struct usb_raw_event {
	__u32 type;
	__u32 length;
	__u8 data[0];
};

struct usb_raw_ep_io {
	__u16 ep;
	__u16 flags;
	__u32 length;
	__u8 data[0];
};

#define USB_RAW_EPS_NUM_MAX 30
#define USB_RAW_EP_NAME_MAX 16
#define USB_RAW_EP_ADDR_ANY 0xff

struct usb_raw_ep_caps {
	__u32 type_control : 1;
	__u32 type_iso : 1;
	__u32 type_bulk : 1;
	__u32 type_int : 1;
	__u32 dir_in : 1;
	__u32 dir_out : 1;
};

struct usb_raw_ep_limits {
	__u16 maxpacket_limit;
	__u16 max_streams;
	__u32 reserved;
};

struct usb_raw_ep_info {
	__u8 name[USB_RAW_EP_NAME_MAX];
	__u32 addr;
	struct usb_raw_ep_caps caps;
	struct usb_raw_ep_limits limits;
};

struct usb_raw_eps_info {
	struct usb_raw_ep_info eps[USB_RAW_EPS_NUM_MAX];
};

#define USB_RAW_IOCTL_INIT _IOW('U', 0, struct usb_raw_init)
#define USB_RAW_IOCTL_RUN _IO('U', 1)
#define USB_RAW_IOCTL_EVENT_FETCH _IOR('U', 2, struct usb_raw_event)
#define USB_RAW_IOCTL_EP0_WRITE _IOW('U', 3, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP0_READ _IOWR('U', 4, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP_ENABLE _IOW('U', 5, struct usb_endpoint_descriptor)
#define USB_RAW_IOCTL_EP_DISABLE _IOW('U', 6, __u32)
#define USB_RAW_IOCTL_EP_WRITE _IOW('U', 7, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP_READ _IOWR('U', 8, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_CONFIGURE _IO('U', 9)
#define USB_RAW_IOCTL_VBUS_DRAW _IOW('U', 10, __u32)
#define USB_RAW_IOCTL_EPS_INFO _IOR('U', 11, struct usb_raw_eps_info)
#define USB_RAW_IOCTL_EP0_STALL _IO('U', 12)
#define USB_RAW_IOCTL_EP_SET_HALT _IOW('U', 13, __u32)
#define USB_RAW_IOCTL_EP_CLEAR_HALT _IOW('U', 14, __u32)
#define USB_RAW_IOCTL_EP_SET_WEDGE _IOW('U', 15, __u32)

static int usb_raw_open()
{
	return open("/dev/raw-gadget", O_RDWR);
}

static int usb_raw_init(int fd, uint32_t speed, const char* driver, const char* device)
{
	struct usb_raw_init arg;
	strncpy((char*)&arg.driver_name[0], driver, sizeof(arg.driver_name));
	strncpy((char*)&arg.device_name[0], device, sizeof(arg.device_name));
	arg.speed = speed;
	return ioctl(fd, USB_RAW_IOCTL_INIT, &arg);
}

static int usb_raw_run(int fd)
{
	return ioctl(fd, USB_RAW_IOCTL_RUN, 0);
}

static int usb_raw_ep_write(int fd, struct usb_raw_ep_io* io)
{
	return ioctl(fd, USB_RAW_IOCTL_EP_WRITE, io);
}

static int usb_raw_configure(int fd)
{
	return ioctl(fd, USB_RAW_IOCTL_CONFIGURE, 0);
}

static int usb_raw_vbus_draw(int fd, uint32_t power)
{
	return ioctl(fd, USB_RAW_IOCTL_VBUS_DRAW, power);
}

static int usb_raw_ep0_write(int fd, struct usb_raw_ep_io* io)
{
	return ioctl(fd, USB_RAW_IOCTL_EP0_WRITE, io);
}

static int usb_raw_ep0_read(int fd, struct usb_raw_ep_io* io)
{
	return ioctl(fd, USB_RAW_IOCTL_EP0_READ, io);
}

static int usb_raw_event_fetch(int fd, struct usb_raw_event* event)
{
	return ioctl(fd, USB_RAW_IOCTL_EVENT_FETCH, event);
}

static int usb_raw_ep_enable(int fd, struct usb_endpoint_descriptor* desc)
{
	return ioctl(fd, USB_RAW_IOCTL_EP_ENABLE, desc);
}

static int usb_raw_ep_disable(int fd, int ep)
{
	return ioctl(fd, USB_RAW_IOCTL_EP_DISABLE, ep);
}

static int usb_raw_ep0_stall(int fd)
{
	return ioctl(fd, USB_RAW_IOCTL_EP0_STALL, 0);
}

static int lookup_interface(int fd, uint8_t bInterfaceNumber, uint8_t bAlternateSetting)
{
	struct usb_device_index* index = lookup_usb_index(fd);
	if (!index)
		return -1;
	for (int i = 0; i < index->ifaces_num; i++) {
		if (index->ifaces[i].bInterfaceNumber == bInterfaceNumber &&
		    index->ifaces[i].bAlternateSetting == bAlternateSetting)
			return i;
	}
	return -1;
}

static int lookup_endpoint(int fd, uint8_t bEndpointAddress)
{
	struct usb_device_index* index = lookup_usb_index(fd);
	if (!index)
		return -1;
	if (index->iface_cur < 0)
		return -1;
	for (int ep = 0; ep < index->ifaces[index->iface_cur].eps_num; ep++)
		if (index->ifaces[index->iface_cur].eps[ep].desc.bEndpointAddress == bEndpointAddress)
			return index->ifaces[index->iface_cur].eps[ep].handle;
	return -1;
}

#define USB_MAX_PACKET_SIZE 4096

struct usb_raw_control_event {
	struct usb_raw_event inner;
	struct usb_ctrlrequest ctrl;
	char data[USB_MAX_PACKET_SIZE];
};

struct usb_raw_ep_io_data {
	struct usb_raw_ep_io inner;
	char data[USB_MAX_PACKET_SIZE];
};

static void set_interface(int fd, int n)
{
	struct usb_device_index* index = lookup_usb_index(fd);
	if (!index)
		return;
	if (index->iface_cur >= 0 && index->iface_cur < index->ifaces_num) {
		for (int ep = 0; ep < index->ifaces[index->iface_cur].eps_num; ep++) {
			int rv = usb_raw_ep_disable(fd, index->ifaces[index->iface_cur].eps[ep].handle);
			if (rv < 0) {
			} else {
			}
		}
	}
	if (n >= 0 && n < index->ifaces_num) {
		for (int ep = 0; ep < index->ifaces[n].eps_num; ep++) {
			int rv = usb_raw_ep_enable(fd, &index->ifaces[n].eps[ep].desc);
			if (rv < 0) {
			} else {
				index->ifaces[n].eps[ep].handle = rv;
			}
		}
		index->iface_cur = n;
	}
}

static int configure_device(int fd)
{
	struct usb_device_index* index = lookup_usb_index(fd);
	if (!index)
		return -1;
	int rv = usb_raw_vbus_draw(fd, index->bMaxPower);
	if (rv < 0) {
		return rv;
	}
	rv = usb_raw_configure(fd);
	if (rv < 0) {
		return rv;
	}
	set_interface(fd, 0);
	return 0;
}

static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev,
					  const struct vusb_connect_descriptors* descs,
					  lookup_connect_out_response_t lookup_connect_response_out)
{
	if (!dev) {
		return -1;
	}
	int fd = usb_raw_open();
	if (fd < 0) {
		return fd;
	}
	if (fd >= MAX_FDS) {
		close(fd);
		return -1;
	}
	struct usb_device_index* index = add_usb_index(fd, dev, dev_len);
	if (!index) {
		return -1;
	}
	char device[32];
	sprintf(&device[0], "dummy_udc.%llu", procid);
	int rv = usb_raw_init(fd, speed, "dummy_udc", &device[0]);
	if (rv < 0) {
		return rv;
	}
	rv = usb_raw_run(fd);
	if (rv < 0) {
		return rv;
	}
	bool done = false;
	while (!done) {
		struct usb_raw_control_event event;
		event.inner.type = 0;
		event.inner.length = sizeof(event.ctrl);
		rv = usb_raw_event_fetch(fd, (struct usb_raw_event*)&event);
		if (rv < 0) {
			return rv;
		}
		if (event.inner.type != USB_RAW_EVENT_CONTROL)
			continue;
		char* response_data = NULL;
		uint32_t response_length = 0;
		struct usb_qualifier_descriptor qual;
		if (event.ctrl.bRequestType & USB_DIR_IN) {
			if (!lookup_connect_response_in(fd, descs, &event.ctrl, &qual, &response_data, &response_length)) {
				usb_raw_ep0_stall(fd);
				continue;
			}
		} else {
			if (!lookup_connect_response_out(fd, descs, &event.ctrl, &done)) {
				usb_raw_ep0_stall(fd);
				continue;
			}
			response_data = NULL;
			response_length = event.ctrl.wLength;
		}
		if ((event.ctrl.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD &&
		    event.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
			rv = configure_device(fd);
			if (rv < 0) {
				return rv;
			}
		}
		struct usb_raw_ep_io_data response;
		response.inner.ep = 0;
		response.inner.flags = 0;
		if (response_length > sizeof(response.data))
			response_length = 0;
		if (event.ctrl.wLength < response_length)
			response_length = event.ctrl.wLength;
		response.inner.length = response_length;
		if (response_data)
			memcpy(&response.data[0], response_data, response_length);
		else
			memset(&response.data[0], 0, response_length);
		if (event.ctrl.bRequestType & USB_DIR_IN) {
			rv = usb_raw_ep0_write(fd, (struct usb_raw_ep_io*)&response);
		} else {
			rv = usb_raw_ep0_read(fd, (struct usb_raw_ep_io*)&response);
		}
		if (rv < 0) {
			return rv;
		}
	}
	sleep_ms(200);
	return fd;
}

static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3)
{
	uint64_t speed = a0;
	uint64_t dev_len = a1;
	const char* dev = (const char*)a2;
	const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3;
	return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic);
}

static volatile long syz_usb_control_io(volatile long a0, volatile long a1, volatile long a2)
{
	int fd = a0;
	const struct vusb_descriptors* descs = (const struct vusb_descriptors*)a1;
	const struct vusb_responses* resps = (const struct vusb_responses*)a2;
	struct usb_raw_control_event event;
	event.inner.type = 0;
	event.inner.length = USB_MAX_PACKET_SIZE;
	int rv = usb_raw_event_fetch(fd, (struct usb_raw_event*)&event);
	if (rv < 0) {
		return rv;
	}
	if (event.inner.type != USB_RAW_EVENT_CONTROL) {
		return -1;
	}
	char* response_data = NULL;
	uint32_t response_length = 0;
	if ((event.ctrl.bRequestType & USB_DIR_IN) && event.ctrl.wLength) {
		if (!lookup_control_response(descs, resps, &event.ctrl, &response_data, &response_length)) {
			usb_raw_ep0_stall(fd);
			return -1;
		}
	} else {
		if ((event.ctrl.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD ||
		    event.ctrl.bRequest == USB_REQ_SET_INTERFACE) {
			int iface_num = event.ctrl.wIndex;
			int alt_set = event.ctrl.wValue;
			int iface_index = lookup_interface(fd, iface_num, alt_set);
			if (iface_index < 0) {
			} else {
				set_interface(fd, iface_index);
			}
		}
		response_length = event.ctrl.wLength;
	}
	struct usb_raw_ep_io_data response;
	response.inner.ep = 0;
	response.inner.flags = 0;
	if (response_length > sizeof(response.data))
		response_length = 0;
	if (event.ctrl.wLength < response_length)
		response_length = event.ctrl.wLength;
	if ((event.ctrl.bRequestType & USB_DIR_IN) && !event.ctrl.wLength) {
		response_length = USB_MAX_PACKET_SIZE;
	}
	response.inner.length = response_length;
	if (response_data)
		memcpy(&response.data[0], response_data, response_length);
	else
		memset(&response.data[0], 0, response_length);
	if ((event.ctrl.bRequestType & USB_DIR_IN) && event.ctrl.wLength) {
		rv = usb_raw_ep0_write(fd, (struct usb_raw_ep_io*)&response);
	} else {
		rv = usb_raw_ep0_read(fd, (struct usb_raw_ep_io*)&response);
	}
	if (rv < 0) {
		return rv;
	}
	sleep_ms(200);
	return 0;
}

static volatile long syz_usb_ep_write(volatile long a0, volatile long a1, volatile long a2, volatile long a3)
{
	int fd = a0;
	uint8_t ep = a1;
	uint32_t len = a2;
	char* data = (char*)a3;
	int ep_handle = lookup_endpoint(fd, ep);
	if (ep_handle < 0) {
		return -1;
	}
	struct usb_raw_ep_io_data io_data;
	io_data.inner.ep = ep_handle;
	io_data.inner.flags = 0;
	if (len > sizeof(io_data.data))
		len = sizeof(io_data.data);
	io_data.inner.length = len;
	memcpy(&io_data.data[0], data, len);
	int rv = usb_raw_ep_write(fd, (struct usb_raw_ep_io*)&io_data);
	if (rv < 0) {
		return rv;
	}
	sleep_ms(200);
	return 0;
}

static volatile long syz_usb_disconnect(volatile long a0)
{
	int fd = a0;
	int rv = close(fd);
	sleep_ms(200);
	return rv;
}

uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};

int main(void)
{
		syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	const char* reason;
	(void)reason;
				intptr_t res = 0;
	if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
//  syz_usb_connect arguments: [
//    speed: usb_device_speed = 0x3 (8 bytes)
//    dev_len: len = 0x24 (8 bytes)
//    dev: ptr[in, usb_device_descriptor] {
//      usb_device_descriptor {
//        inner: usb_device_descriptor_verbose_t[flags[usb_versions, int16], 0, 0, 0, flags[usb_device_max_packet_sizes, int8], 0, 0, 0, array[usb_config_descriptor, 1]] {
//          bLength: const = 0x12 (1 bytes)
//          bDescriptorType: const = 0x1 (1 bytes)
//          bcdUSB: usb_versions = 0x250 (2 bytes)
//          bDeviceClass: const = 0x54 (1 bytes)
//          bDeviceSubClass: const = 0x30 (1 bytes)
//          bDeviceProtocol: const = 0x5 (1 bytes)
//          bMaxPacketSize0: usb_device_max_packet_sizes = 0x10 (1 bytes)
//          idVendor: const = 0xdb0 (2 bytes)
//          idProduct: const = 0x6869 (2 bytes)
//          bcdDevice: const = 0x73b3 (2 bytes)
//          iManufacturer: const = 0x1 (1 bytes)
//          iProduct: const = 0x2 (1 bytes)
//          iSerialNumber: const = 0x3 (1 bytes)
//          bNumConfigurations: len = 0x1 (1 bytes)
//          configs: array[usb_config_descriptor] {
//            usb_config_descriptor {
//              inner: usb_config_descriptor_verbose_t[int8, len[interfaces, int8], int8, flags[usb_config_attributes, int8], int8, void, array[usb_interface_descriptor, 1:4]] {
//                bLength: const = 0x9 (1 bytes)
//                bDescriptorType: const = 0x2 (1 bytes)
//                wTotalLength: len = 0x12 (2 bytes)
//                bNumInterfaces: len = 0x1 (1 bytes)
//                bConfigurationValue: int8 = 0x0 (1 bytes)
//                iConfiguration: int8 = 0x0 (1 bytes)
//                bmAttributes: usb_config_attributes = 0x0 (1 bytes)
//                bMaxPower: int8 = 0x0 (1 bytes)
//                extra: buffer: {} (length 0x0)
//                interfaces: array[usb_interface_descriptor] {
//                }
//              }
//            }
//          }
//        }
//      }
//    }
//    conn_descs: ptr[in, vusb_connect_descriptors] {
//      vusb_connect_descriptors {
//        qual_len: len = 0x0 (4 bytes)
//        qual: nil
//        bos_len: len = 0x0 (4 bytes)
//        bos: nil
//        strs_len: len = 0x0 (4 bytes)
//        strs: array[vusb_connect_string_descriptor] {
//        }
//      }
//    }
//  ]
//  returns fd_usb
*(uint8_t*)0x200000000100 = 0x12;
*(uint8_t*)0x200000000101 = 1;
*(uint16_t*)0x200000000102 = 0x250;
*(uint8_t*)0x200000000104 = 0x54;
*(uint8_t*)0x200000000105 = 0x30;
*(uint8_t*)0x200000000106 = 5;
*(uint8_t*)0x200000000107 = 0x10;
*(uint16_t*)0x200000000108 = 0xdb0;
*(uint16_t*)0x20000000010a = 0x6869;
*(uint16_t*)0x20000000010c = 0x73b3;
*(uint8_t*)0x20000000010e = 1;
*(uint8_t*)0x20000000010f = 2;
*(uint8_t*)0x200000000110 = 3;
*(uint8_t*)0x200000000111 = 1;
*(uint8_t*)0x200000000112 = 9;
*(uint8_t*)0x200000000113 = 2;
*(uint16_t*)0x200000000114 = 0x12;
*(uint8_t*)0x200000000116 = 1;
*(uint8_t*)0x200000000117 = 0;
*(uint8_t*)0x200000000118 = 0;
*(uint8_t*)0x200000000119 = 0;
*(uint8_t*)0x20000000011a = 0;
*(uint32_t*)0x200000000080 = 0;
*(uint64_t*)0x200000000084 = 0;
*(uint32_t*)0x20000000008c = 0;
*(uint64_t*)0x200000000090 = 0;
*(uint32_t*)0x200000000098 = 0;
	res = -1;
res = syz_usb_connect(/*speed=USB_SPEED_HIGH*/3, /*dev_len=*/0x24, /*dev=*/0x200000000100, /*conn_descs=*/0x200000000080);
	if (res != -1)
		r[0] = res;
//  syz_usb_disconnect arguments: [
//    fd: fd_usb (resource)
//  ]
syz_usb_disconnect(/*fd=*/r[0]);
//  syz_usb_connect arguments: [
//    speed: usb_device_speed = 0x0 (8 bytes)
//    dev_len: len = 0x24 (8 bytes)
//    dev: ptr[inout, array[ANYUNION]] {
//      array[ANYUNION] {
//      }
//    }
//    conn_descs: ptr[in, vusb_connect_descriptors] {
//      vusb_connect_descriptors {
//        qual_len: len = 0x0 (4 bytes)
//        qual: nil
//        bos_len: len = 0x0 (4 bytes)
//        bos: nil
//        strs_len: len = 0x0 (4 bytes)
//        strs: array[vusb_connect_string_descriptor] {
//        }
//      }
//    }
//  ]
//  returns fd_usb
*(uint32_t*)0x200000001000 = 0;
*(uint64_t*)0x200000001004 = 0;
*(uint32_t*)0x20000000100c = 0;
*(uint64_t*)0x200000001010 = 0;
*(uint32_t*)0x200000001018 = 0;
	res = -1;
res = syz_usb_connect(/*speed=*/0, /*dev_len=*/0x24, /*dev=*/0x200000000b40, /*conn_descs=*/0x200000001000);
	if (res != -1)
		r[1] = res;
//  syz_usb_control_io$printer arguments: [
//    fd: fd_usb_printer (resource)
//    descs: nil
//    resps: ptr[in, vusb_responses_printer] {
//      vusb_responses_printer {
//        len: len = 0x34 (4 bytes)
//        generic: ptr[in, vusb_response_generic] {
//          vusb_response_generic {
//            type: usb_request_types = 0x40 (1 bytes)
//            req: usb_requests = 0x13 (1 bytes)
//            len: bytesize = 0x85 (4 bytes)
//            data: buffer: {d3 f3 4d 70 ec 2d af d9 06 dd 1b 81 bf 70 fc b8 f6 4b 98 b2 c9 40 3d 2c ba 44 cd 3d 6f 8d 0b 6c ee b6 7d 32 a0 de 29 e2 c0 8f c8 06 33 e7 89 e4 e9 63 aa ad 3d 76 3f d4 3d 62 0a 33 db 2b 97 30 5a f8 8c 7d 00 d0 7c f0 eb 98 ba d1 a6 86 64 56 b6 1d bd ee 6e 55 3f cd 6d bf ac 7e 61 ab 8b ff 4a 8e 06 dc ac 8d ca 6b 9f a9 25 64 6a be ec e0 c1 1f 1f 04 9c 77 c9 2f 52 f3 20 d1 f0 8f c4 a7 ad 67 c2 14 59} (length 0x85)
//          }
//        }
//        USB_REQ_GET_INTERFACE: nil
//        USB_REQ_GET_CONFIGURATION: nil
//        USBLP_REQ_GET_ID: nil
//        USBLP_REQ_GET_STATUS: nil
//        USBLP_REQ_HP_CHANNEL_CHANGE_REQUEST: nil
//      }
//    }
//  ]
*(uint32_t*)0x200000000540 = 0x34;
*(uint64_t*)0x200000000544 = 0x2000000001c0;
*(uint8_t*)0x2000000001c0 = 0x40;
*(uint8_t*)0x2000000001c1 = 0x13;
*(uint32_t*)0x2000000001c2 = 0x85;
memcpy((void*)0x2000000001c6, "... [truncated large byte array] ...", 133);
*(uint64_t*)0x20000000054c = 0;
*(uint64_t*)0x200000000554 = 0;
*(uint64_t*)0x20000000055c = 0;
*(uint64_t*)0x200000000564 = 0;
*(uint64_t*)0x20000000056c = 0;
syz_usb_control_io(/*fd=*/r[1], /*descs=*/0, /*resps=*/0x200000000540);
//  syz_usb_disconnect arguments: [
//    fd: fd_usb (resource)
//  ]
syz_usb_disconnect(/*fd=*/-1);
//  syz_usb_connect arguments: [
//    speed: usb_device_speed = 0x2 (8 bytes)
//    dev_len: len = 0x24 (8 bytes)
//    dev: ptr[in, usb_device_descriptor] {
//      usb_device_descriptor {
//        inner: usb_device_descriptor_verbose_t[flags[usb_versions, int16], 0, 0, 0, flags[usb_device_max_packet_sizes, int8], 0, 0, 0, array[usb_config_descriptor, 1]] {
//          bLength: const = 0x12 (1 bytes)
//          bDescriptorType: const = 0x1 (1 bytes)
//          bcdUSB: usb_versions = 0x110 (2 bytes)
//          bDeviceClass: const = 0x2d (1 bytes)
//          bDeviceSubClass: const = 0x83 (1 bytes)
//          bDeviceProtocol: const = 0x57 (1 bytes)
//          bMaxPacketSize0: usb_device_max_packet_sizes = 0x20 (1 bytes)
//          idVendor: const = 0xbda (2 bytes)
//          idProduct: const = 0x5088 (2 bytes)
//          bcdDevice: const = 0xd380 (2 bytes)
//          iManufacturer: const = 0x1 (1 bytes)
//          iProduct: const = 0x2 (1 bytes)
//          iSerialNumber: const = 0x3 (1 bytes)
//          bNumConfigurations: len = 0x1 (1 bytes)
//          configs: array[usb_config_descriptor] {
//            usb_config_descriptor {
//              inner: usb_config_descriptor_verbose_t[int8, len[interfaces, int8], int8, flags[usb_config_attributes, int8], int8, void, array[usb_interface_descriptor, 1:4]] {
//                bLength: const = 0x9 (1 bytes)
//                bDescriptorType: const = 0x2 (1 bytes)
//                wTotalLength: len = 0x12 (2 bytes)
//                bNumInterfaces: len = 0x1 (1 bytes)
//                bConfigurationValue: int8 = 0xa (1 bytes)
//                iConfiguration: int8 = 0x3 (1 bytes)
//                bmAttributes: usb_config_attributes = 0x40 (1 bytes)
//                bMaxPower: int8 = 0x8 (1 bytes)
//                extra: buffer: {} (length 0x0)
//                interfaces: array[usb_interface_descriptor] {
//                }
//              }
//            }
//          }
//        }
//      }
//    }
//    conn_descs: nil
//  ]
//  returns fd_usb
*(uint8_t*)0x200000000000 = 0x12;
*(uint8_t*)0x200000000001 = 1;
*(uint16_t*)0x200000000002 = 0x110;
*(uint8_t*)0x200000000004 = 0x2d;
*(uint8_t*)0x200000000005 = 0x83;
*(uint8_t*)0x200000000006 = 0x57;
*(uint8_t*)0x200000000007 = 0x20;
*(uint16_t*)0x200000000008 = 0xbda;
*(uint16_t*)0x20000000000a = 0x5088;
*(uint16_t*)0x20000000000c = 0xd380;
*(uint8_t*)0x20000000000e = 1;
*(uint8_t*)0x20000000000f = 2;
*(uint8_t*)0x200000000010 = 3;
*(uint8_t*)0x200000000011 = 1;
*(uint8_t*)0x200000000012 = 9;
*(uint8_t*)0x200000000013 = 2;
*(uint16_t*)0x200000000014 = 0x12;
*(uint8_t*)0x200000000016 = 1;
*(uint8_t*)0x200000000017 = 0xa;
*(uint8_t*)0x200000000018 = 3;
*(uint8_t*)0x200000000019 = 0x40;
*(uint8_t*)0x20000000001a = 8;
syz_usb_connect(/*speed=USB_SPEED_FULL*/2, /*dev_len=*/0x24, /*dev=*/0x200000000000, /*conn_descs=*/0);
//  syz_usb_control_io$uac1 arguments: [
//    fd: fd_usb_uac1 (resource)
//    descs: nil
//    resps: nil
//  ]
syz_usb_control_io(/*fd=*/r[1], /*descs=*/0, /*resps=*/0);
//  syz_usb_control_io arguments: [
//    fd: fd_usb (resource)
//    descs: nil
//    resps: ptr[in, vusb_responses] {
//      vusb_responses {
//        len: len = 0x84 (4 bytes)
//        generic: nil
//        get_interface: nil
//        get_configuration: nil
//        hub_USB_REQ_GET_STATUS_hub: nil
//        hub_USB_REQ_GET_STATUS_port: nil
//        asix_AX_CMD_READ_MII_REG: ptr[in, vusb_response_t[USB_TYPE_VENDOR, AX_CMD_READ_MII_REG, int16]] {
//          vusb_response_t[USB_TYPE_VENDOR, AX_CMD_READ_MII_REG, int16] {
//            type: const = 0x40 (1 bytes)
//            req: const = 0x7 (1 bytes)
//            len: bytesize = 0x2 (4 bytes)
//            data: int16 = 0x1 (2 bytes)
//          }
//        }
//        asix_AX_CMD_STATMNGSTS_REG: nil
//        asix_AX_CMD_READ_EEPROM: nil
//        asix_AX_CMD_READ_RX_CTL: nil
//        asix_AX_CMD_READ_NODE_ID: nil
//        asix_AX88172_CMD_READ_NODE_ID: nil
//        asix_AX_CMD_READ_PHY_ID: nil
//        asix_AX_CMD_READ_MEDIUM_STATUS: nil
//        asix_AX_CMD_READ_MONITOR_MODE: nil
//        asix_AX_CMD_READ_GPIOS: nil
//        asix_AX_CMD_SW_PHY_STATUS: nil
//      }
//    }
//  ]
*(uint32_t*)0x200000000ec0 = 0x84;
*(uint64_t*)0x200000000ec4 = 0;
*(uint64_t*)0x200000000ecc = 0;
*(uint64_t*)0x200000000ed4 = 0;
*(uint64_t*)0x200000000edc = 0;
*(uint64_t*)0x200000000ee4 = 0;
*(uint64_t*)0x200000000eec = 0x200000000a00;
*(uint8_t*)0x200000000a00 = 0x40;
*(uint8_t*)0x200000000a01 = 7;
*(uint32_t*)0x200000000a02 = 2;
*(uint16_t*)0x200000000a06 = 1;
*(uint64_t*)0x200000000ef4 = 0;
*(uint64_t*)0x200000000efc = 0;
*(uint64_t*)0x200000000f04 = 0;
*(uint64_t*)0x200000000f0c = 0;
*(uint64_t*)0x200000000f14 = 0;
*(uint64_t*)0x200000000f1c = 0;
*(uint64_t*)0x200000000f24 = 0;
*(uint64_t*)0x200000000f2c = 0;
*(uint64_t*)0x200000000f34 = 0;
*(uint64_t*)0x200000000f3c = 0;
syz_usb_control_io(/*fd=*/r[1], /*descs=*/0, /*resps=*/0x200000000ec0);
//  syz_usb_connect arguments: [
//    speed: usb_device_speed = 0x0 (8 bytes)
//    dev_len: len = 0x6b (8 bytes)
//    dev: nil
//    conn_descs: nil
//  ]
//  returns fd_usb
syz_usb_connect(/*speed=*/0, /*dev_len=*/0x6b, /*dev=*/0, /*conn_descs=*/0);
//  syz_usb_connect$hid arguments: [
//    speed: usb_device_speed = 0x0 (8 bytes)
//    dev_len: len = 0x36 (8 bytes)
//    dev: nil
//    conn_descs: nil
//  ]
//  returns fd_usb_hid
	res = -1;
res = syz_usb_connect(/*speed=*/0, /*dev_len=*/0x36, /*dev=*/0, /*conn_descs=*/0);
	if (res != -1)
		r[2] = res;
//  syz_usb_ep_write arguments: [
//    fd: fd_usb (resource)
//    ep: int8 = 0x81 (1 bytes)
//    len: len = 0x0 (8 bytes)
//    data: ptr[in, buffer] {
//      buffer: {} (length 0x0)
//    }
//  ]
syz_usb_ep_write(/*fd=*/r[2], /*ep=*/0x81, /*len=*/0, /*data=*/0x200000000300);
	return 0;
}
]

map[KernelSrc:/app/workdir/cache/src/ecd8bb68855fdd08aa08215ac485989bac875215]

map[KernelObj:/app/workdir/cache/build/e7ea68e0c7e8b5c35c1e0a57f4f6536a1eab3ac8]

map[OtherCrashReports:[[pid  4053] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4047] <... setxattr resumed>)     = -1 EINVAL (Invalid argument)
[pid  4052] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  4051] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid  4047] write(2, "SYZFAIL: setfilecon: setxattr failed\n", 37) = 37
[pid  4047] write(2, " (errno 22: Invalid argument)\n", 30) = 30
[pid  4047] exit_group(67)              = ?
[pid  4053] <... openat resumed>)       = 3
[pid  4052] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4053] setns(201, 0 <unfinished ...>
[pid  4052] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4053] <... setns resumed>)        = 0
[pid  4052] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4053] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC <unfinished ...>
[pid  4052] <... mount resumed>)        = 0
[pid  4053] <... socket resumed>)       = 5
[pid  4052] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4053] sendto(5, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x64\x65\x76\x6c\x69\x6e\x6b\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4052] <... mkdirat resumed>)      = 0
[pid  4050] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid  4052] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... mount resumed>)        = 0
[pid  4050] <... mount resumed>)        = 0
[pid  4047] +++ exited with 67 +++
[pid  4035] <... pselect6 resumed>)     = 1 (in [23], left {tv_sec=0, tv_nsec=812885697})
[pid  4053] <... sendto resumed>)       = 32
[pid  4051] mkdirat(AT_FDCWD, "./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid  4050] mkdirat(AT_FDCWD, "./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4047, si_uid=10999, si_status=67, si_utime=0, si_stime=3 /* 0.03 s */} ---
[pid  4053] recvfrom(5 <unfinished ...>
[pid  4052] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4051] <... mkdirat resumed>)      = 0
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4035] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4051] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4050] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] <... rt_sigreturn resumed>) = 1
[pid  4053] <... recvfrom resumed>, [{nlmsg_len=1236, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x64\x65\x76\x6c\x69\x6e\x6b\x00\x06\x00\x01\x00\x16\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00\x78\x04\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x05\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 1236
[pid  4052] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700 <unfinished ...>
[pid  4051] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4050] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4035] read(23 <unfinished ...>
[pid  4051] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4050] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] <... read resumed>, "SYZFAIL: setfilecon: setxattr failed\n (errno 22: Invalid argument)\n", 1024) = 67
[pid  4051] <... mount resumed>)        = 0
[pid  4050] <... mount resumed>)        = 0
[pid  4035] pselect6(34, [3 11 13 16 18 21 23 26 28 31 33], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4051] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid  4050] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid  4035] <... pselect6 resumed>)     = 2 (in [21 23], left {tv_sec=0, tv_nsec=999977260})
[pid  4052] <... mkdirat resumed>)      = 0
[pid  4051] <... mkdirat resumed>)      = 0
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4035] read(23 <unfinished ...>
[pid  4053] recvfrom(5 <unfinished ...>
[pid  4052] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4051] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4050] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] <... read resumed>, "", 1024) = 0
[pid  4053] <... recvfrom resumed>, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  4052] <... mkdirat resumed>)      = 0
[pid  4051] <... mount resumed>)        = 0
[pid  4050] <... mount resumed>)        = 0
[pid  4035] kill(4047, SIGKILL <unfinished ...>
[pid  4053] sendto(5, [{nlmsg_len=56, nlmsg_type=0x16 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x25\x00\x00\x00\x08\x00\x01\x00\x70\x63\x69\x00\x11\x00\x02\x00\x30\x30\x30\x30\x3a\x30\x30\x3a\x31\x30\x2e\x30\x00\x00\x00\x00\x08\x00\x8a\x00\x03\x00\x00\x00"], 56, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4052] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700 <unfinished ...>
[pid  4051] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4050] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] <... kill resumed>)         = 0
[pid  4053] <... sendto resumed>)       = 56
[pid  4052] <... mkdirat resumed>)      = 0
[pid  4051] <... mount resumed>)        = 0
[pid  4050] <... mount resumed>)        = 0
[pid  4051] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4050] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4050] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4035] read(23 <unfinished ...>
[pid  4051] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4050] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] <... read resumed>, "", 1024) = 0
[pid  4053] recvfrom(5 <unfinished ...>
[pid  4052] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4051] <... mount resumed>)        = 0
[pid  4050] <... mount resumed>)        = 0
[pid  4053] <... recvfrom resumed>, [{nlmsg_len=76, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=56, nlmsg_type=0x16 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x25\x00\x00\x00\x08\x00\x01\x00\x70\x63\x69\x00\x11\x00\x02\x00\x30\x30\x30\x30\x3a\x30\x30\x3a\x31\x30\x2e\x30\x00\x00\x00\x00\x08\x00\x8a\x00\x03\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 76
[pid  4052] <... mkdirat resumed>)      = 0
[pid  4053] close(5 <unfinished ...>
[pid  4051] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4050] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4053] <... close resumed>)        = 0
[pid  4052] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4053] setns(3, 0 <unfinished ...>
[pid  4051] <... mkdirat resumed>)      = 0
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4053] <... setns resumed>)        = 0
[pid  4052] <... mount resumed>)        = 0
[pid  4051] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4050] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4053] close(3)                    = 0
[pid  4052] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4050] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4053] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC <unfinished ...>
[pid  4052] <... mount resumed>)        = 0
[pid  4051] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700 <unfinished ...>
[pid  4050] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700 <unfinished ...>
[pid  4053] <... socket resumed>)       = 3
[pid  4052] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4053] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE <unfinished ...>
[pid  4051] <... mkdirat resumed>)      = 0
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4052] <... mount resumed>)        = 0
[pid  4051] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4050] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4053] <... socket resumed>)       = 5
[pid  4052] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4053] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x64\x65\x76\x6c\x69\x6e\x6b\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4052] <... mkdirat resumed>)      = 0
[pid  4051] <... mkdirat resumed>)      = 0
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4053] <... sendto resumed>)       = 32
[pid  4052] pivot_root("./syz-tmp", "./syz-tmp/pivot") = 0
[pid  4051] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700 <unfinished ...>
[pid  4050] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700 <unfinished ...>
[pid  4053] recvfrom(3, [{nlmsg_len=1236, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x64\x65\x76\x6c\x69\x6e\x6b\x00\x06\x00\x01\x00\x16\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00\x78\x04\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x05\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 1236
[pid  4052] chdir("/" <unfinished ...>
[pid  4051] <... mkdirat resumed>)      = 0
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4035] write(3, "\x0c\x01\x00\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x20\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x10\x00\x10\x00\x00\x00\x02\x00\x00\x00\x18\x00\x00\x00\x7c\x00\x00\x00\x98\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x62\x00\x00\x00\x53\x59\x5a\x46\x41\x49\x4c\x3a\x20\x73\x65\x74\x66\x69\x6c\x65\x63\x6f\x6e\x3a"..., 272 <unfinished ...>
[pid  4053] recvfrom(3 <unfinished ...>
[pid  4052] <... chdir resumed>)        = 0
[pid  4053] <... recvfrom resumed>, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  4052] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4050] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4053] sendto(3, [{nlmsg_len=48, nlmsg_type=0x16 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x300, nlmsg_seq=0, nlmsg_pid=0}, "\x05\x00\x00\x00\x08\x00\x01\x00\x70\x63\x69\x00\x11\x00\x02\x00\x30\x30\x30\x30\x3a\x30\x30\x3a\x31\x30\x2e\x30\x00\x00\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4051] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4035] <... write resumed>)        = 272
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fc6347caf000002}], 128, 992, NULL, 0) = 1
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4052] <... umount2 resumed>)      = 0
[pid  4051] <... mkdirat resumed>)      = 0
[pid  4050] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] pipe2( <unfinished ...>
[pid  4027] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4051] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4050] <... mount resumed>)        = 0
[pid  4035] <... pipe2 resumed>[29, 32], 0) = 0
[pid  4027] <... futex resumed>)        = 0
[pid  4025] sched_yield( <unfinished ...>
[pid  4051] <... mount resumed>)        = 0
[pid  4050] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4027] read(6, "\x0c\x01\x00\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x20\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x10\x00\x10\x00\x00\x00\x02\x00\x00\x00\x18\x00\x00\x00\x7c\x00\x00\x00\x98\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x62\x00\x00\x00\x53\x59\x5a\x46\x41\x49\x4c\x3a\x20\x73\x65\x74\x66\x69\x6c\x65\x63\x6f\x6e\x3a"..., 21347228) = 272
[pid  4051] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4050] <... mount resumed>)        = 0
[pid  4035] pipe2( <unfinished ...>
[pid  4051] <... mount resumed>)        = 0
[pid  4050] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] <... pipe2 resumed>[34, 35], 0) = 0
[pid  4027] futex(0x2059c2bff960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4050] <... mount resumed>)        = 0
[pid  4035] pipe2( <unfinished ...>
[pid  4034] <... futex resumed>)        = 0
[pid  4027] <... futex resumed>)        = 1
[pid  4035] <... pipe2 resumed>[36, 37], 0) = 0
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4050] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4027] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x20\x38\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0b\x00\x00\x00"..., 192 <unfinished ...>
[pid  4051] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4051] <... mount resumed>)        = 0
[pid  4050] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4027] <... write resumed>)        = 192
[pid  4051] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4050] <... pivot_root resumed>)   = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4025] <... sched_yield resumed>)  = 0
[pid  4051] <... mkdirat resumed>)      = 0
[pid  4050] chdir("/" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4027] read(6 <unfinished ...>
[pid  4025] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4051] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4050] <... chdir resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4027] <... read resumed>, 0x2059c4680000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4025] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4051] <... pivot_root resumed>)   = 0
[pid  4050] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4027] futex(0x2059c04dd160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4051] chdir("/" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... chdir resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4050] <... umount2 resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=949033026} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] chroot("./newroot" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] chroot("./newroot" <unfinished ...>
[pid  4051] <... umount2 resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] <... chroot resumed>)       = 0
[pid  4050] chdir("/" <unfinished ...>
[pid  4053] <... sendto resumed>)       = 48
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] <... chroot resumed>)       = 0
[pid  4051] chroot("./newroot" <unfinished ...>
[pid  4050] <... chdir resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... chroot resumed>)       = 0
[pid  4050] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] chdir("/" <unfinished ...>
[pid  4050] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... chdir resumed>)        = 0
[pid  4050] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] recvfrom(3 <unfinished ...>
[pid  4052] chdir("/" <unfinished ...>
[pid  4051] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... recvfrom resumed>, [{nlmsg_len=20, nlmsg_type=NLMSG_DONE, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=0, nlmsg_pid=1}, -19], 4096, 0, NULL, NULL) = 20
[pid  4052] <... chdir resumed>)        = 0
[pid  4051] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4050] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] mkdirat(AT_FDCWD, "/dev/binderfs", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] close(5 <unfinished ...>
[pid  4052] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... close resumed>)        = 0
[pid  4052] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] close(3 <unfinished ...>
[pid  4052] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] write(3, "100000", 6 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... write resumed>)        = 6
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] mkdirat(AT_FDCWD, "./syz-tmp", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] mount("", "./syz-tmp", "tmpfs", 0, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] <... mount resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] mkdirat(AT_FDCWD, "./syz-tmp/newroot", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] mkdirat(AT_FDCWD, "./syz-tmp/newroot/dev", 0700 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... mount resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] mkdirat(AT_FDCWD, "./syz-tmp/newroot/proc", 0700 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] <... mount resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] mkdirat(AT_FDCWD, "./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid  4051] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4051] mkdirat(AT_FDCWD, "/dev/binderfs", 0777) = -1 EEXIST (File exists)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... mkdirat resumed>)      = 0
[pid  4051] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... mount resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... mount resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] <... mount resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... mount resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4053] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4053] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700 <unfinished ...>
[pid  4050] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4050] getpid( <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] <... getpid resumed>)       = 1
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... mkdirat resumed>)      = 0
[pid  4052] mkdirat(AT_FDCWD, "/dev/binderfs", 0777 <unfinished ...>
[pid  4050] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz0", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4052] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... mkdirat resumed>)      = 0
[pid  4050] openat(AT_FDCWD, "/syzcgroup/unified/syz0/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4053] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4050] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... mkdirat resumed>)      = 0
[pid  4053] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] write(3, "32", 2 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] <... write resumed>)        = 2
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] openat(AT_FDCWD, "/syzcgroup/unified/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] <... mount resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  4050] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] write(3, "1", 1 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... mount resumed>)        = 0
[pid  4053] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] <... pivot_root resumed>)   = 0
[pid  4050] <... write resumed>)        = 1
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] chdir("/" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] <... chdir resumed>)        = 0
[pid  4053] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4050] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz0", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 ENOENT (No such file or directory)
[pid  4051] getpid( <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... getpid resumed>)       = 1
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... capset resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] getpid( <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... getpid resumed>)       = 1
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz1", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... umount2 resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] chroot("./newroot" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... chroot resumed>)       = 0
[pid  4051] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] openat(AT_FDCWD, "/syzcgroup/unified/syz1/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] chdir("/" <unfinished ...>
[pid  4051] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] write(3, "32", 2 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] <... chdir resumed>)        = 0
[pid  4051] <... write resumed>)        = 2
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4051] openat(AT_FDCWD, "/syzcgroup/unified/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] write(3, "1", 1 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] <... openat resumed>)       = 3
[pid  4051] <... write resumed>)        = 1
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz1", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4050] write(3, "1", 1 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4052] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4051] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4050] <... write resumed>)        = 1
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4051] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] write(3, "1", 1 <unfinished ...>
[pid  4050] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4051] <... write resumed>)        = 1
[pid  4050] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4052] getpid( <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... close resumed>)        = 0
[pid  4050] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4052] <... getpid resumed>)       = 1
[pid  4051] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4050] <... openat resumed>)       = 3
[pid  4052] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz3", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] write(3, "313524224", 9 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... write resumed>)        = 9
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4050] write(3, "313524224", 9 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] <... write resumed>)        = 9
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4050] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] write(3, "314572800", 9 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... write resumed>)        = 9
[pid  4050] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] close(3 <unfinished ...>
[pid  4050] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] mkdirat(AT_FDCWD, "/syzcgroup/net/syz1", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4050] write(3, "314572800", 9 <unfinished ...>
[pid  4051] openat(AT_FDCWD, "/syzcgroup/net/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4050] <... write resumed>)        = 9
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... openat resumed>)       = 3
[pid  4050] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] write(3, "1", 1 <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] mkdirat(AT_FDCWD, "/syzcgroup/net/syz0", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] <... mkdirat resumed>)      = 0
[pid  4052] openat(AT_FDCWD, "/syzcgroup/unified/syz3/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] write(3, "32", 2 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] <... write resumed>)        = 2
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4052] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] <... close resumed>)        = 0
[pid  4052] openat(AT_FDCWD, "/syzcgroup/unified/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4051] <... write resumed>)        = 1
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] openat(AT_FDCWD, "/syzcgroup/net/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] <... openat resumed>)       = 3
[pid  4050] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... socket resumed>)       = 3
[pid  4050] write(3, "1", 1 <unfinished ...>
[pid  4052] write(3, "1", 1 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] <... write resumed>)        = 1
[pid  4051] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4050] <... write resumed>)        = 1
[pid  4052] close(3 <unfinished ...>
[pid  4051] <... getsockopt resumed>, 0x7f7d989673e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] close(3 <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4051] <... getsockopt resumed>, 0x7f7d98967a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4050] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... getsockopt resumed>, 0x7f7d989680e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] <... close resumed>)        = 0
[pid  4050] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4052] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz3", 0777 <unfinished ...>
[pid  4053] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4051] close(3 <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7ff6622373e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4050] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] <... getsockopt resumed>, 0x7ff662237a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7ff6622380e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... socket resumed>)       = 3
[pid  4050] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] mkdirat(AT_FDCWD, "/dev/binderfs", 0777 <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4051] <... getsockopt resumed>, 0x7f7d98968768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] close(3 <unfinished ...>
[pid  4050] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4050] <... getsockopt resumed>, 0x7ff662238768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4051] <... socket resumed>)       = 3
[pid  4050] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... getsockopt resumed>, 0x7f7d9896afc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4050] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... getsockopt resumed>, 0x7f7d9896b688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] <... getsockopt resumed>, 0x7ff66223afc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4050] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... getsockopt resumed>, 0x7f7d9896bd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] <... getsockopt resumed>, 0x7ff66223b688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4050] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] <... mkdirat resumed>)      = 0
[pid  4051] <... getsockopt resumed>, 0x7f7d9896c408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] <... getsockopt resumed>, 0x7ff66223bd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... getsockopt resumed>, 0x7f7d9896cac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4051] close(3 <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7ff66223c408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4050] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4051] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7ff66223cac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4052] <... openat resumed>)       = 3
[pid  4035] <... mmap resumed>)         = 0x7fd910a37000
[pid  4051] <... socket resumed>)       = 3
[pid  4050] close(3 <unfinished ...>
[pid  4035] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4052] write(3, "1", 1 <unfinished ...>
[pid  4051] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4035] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4051] <... getsockopt resumed>, 0x7f7d98968e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7fd910a37000, stack_size=0x9000}, 88 <unfinished ...>
[pid  4052] <... write resumed>)        = 1
[pid  4051] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO, 0x7f7d989694c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4051] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4052] close(3 <unfinished ...>
[pid  4050] <... socket resumed>)       = 3
/strace: Process 4074 attached
[pid  4051] <... getsockopt resumed>, 0x7f7d98969b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4052] <... close resumed>)        = 0
[pid  4051] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7ff662238e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] rt_sigprocmask(SIG_BLOCK, NULL <unfinished ...>
[pid  4051] <... getsockopt resumed>, 0x7f7d9896a248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4074] <... rt_sigprocmask resumed>, ~[KILL STOP], 8) = 0
[pid  4052] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4051] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7ff6622394c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] setpgid(0, 0 <unfinished ...>
[pid  4051] <... getsockopt resumed>, 0x7f7d9896a908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4051] close(3 <unfinished ...>
[pid  4074] <... setpgid resumed>)      = 0
[pid  4052] <... openat resumed>)       = 3
[pid  4051] <... close resumed>)        = 0
[pid  4050] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4074] dup2(29, 0 <unfinished ...>
[pid  4052] write(3, "313524224", 9 <unfinished ...>
[pid  4074] <... dup2 resumed>)         = 0
[pid  4052] <... write resumed>)        = 9
[pid  4050] <... getsockopt resumed>, 0x7ff662239b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4051] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7ff66223a248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4051] <... write resumed>)        = 4
[pid  4050] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4051] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7ff66223a908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] dup2(35, 1 <unfinished ...>
[pid  4052] close(3 <unfinished ...>
[pid  4051] <... mkdirat resumed>)      = 0
[pid  4050] close(3 <unfinished ...>
[pid  4074] <... dup2 resumed>)         = 1
[pid  4052] <... close resumed>)        = 0
[pid  4050] <... close resumed>)        = 0
[pid  4051] openat(AT_FDCWD, "/dev/loop1", O_RDWR <unfinished ...>
[pid  4074] dup2(37, 2 <unfinished ...>
[pid  4052] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4074] <... dup2 resumed>)         = 2
[pid  4051] <... openat resumed>)       = 3
[pid  4051] ioctl(3, LOOP_CLR_FD)       = -1 ENXIO (No such device or address)
[pid  4051] close(3 <unfinished ...>
[pid  4074] dup2(14, 3 <unfinished ...>
[pid  4052] <... openat resumed>)       = 3
[pid  4051] <... close resumed>)        = 0
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4074] <... dup2 resumed>)         = 3
[pid  4052] write(3, "314572800", 9 <unfinished ...>
[pid  4051] <... socket resumed>)       = 3
[pid  4050] <... write resumed>)        = 4
[pid  4051] close(3 <unfinished ...>
[pid  4050] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4074] dup2(17, 4 <unfinished ...>
[pid  4052] <... write resumed>)        = 9
[pid  4051] <... close resumed>)        = 0
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4074] <... dup2 resumed>)         = 4
[pid  4052] close(3 <unfinished ...>
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] openat(AT_FDCWD, "/dev/loop0", O_RDWR <unfinished ...>
[pid  4074] close(5 <unfinished ...>
[pid  4052] <... close resumed>)        = 0
[pid  4051] <... socket resumed>)       = 3
[pid  4051] close(3 <unfinished ...>
[pid  4050] <... openat resumed>)       = 3
[pid  4051] <... close resumed>)        = 0
[pid  4052] mkdirat(AT_FDCWD, "/syzcgroup/net/syz3", 0777 <unfinished ...>
[pid  4074] <... close resumed>)        = 0
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4050] ioctl(3, LOOP_CLR_FD)       = -1 ENXIO (No such device or address)
[pid  4050] close(3 <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4051] <... close resumed>)        = 0
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4052] <... mkdirat resumed>)      = 0
[pid  4051] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] <... socket resumed>)       = 3
[pid  4074] close(6)                    = 0
[pid  4051] <... socket resumed>)       = 3
[pid  4050] close(3 <unfinished ...>
[pid  4074] close(7 <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4074] <... close resumed>)        = 0
[pid  4052] openat(AT_FDCWD, "/syzcgroup/net/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4074] close(8 <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4074] <... close resumed>)        = 0
[pid  4052] <... openat resumed>)       = 3
[pid  4051] <... close resumed>)        = 0
[pid  4050] <... socket resumed>)       = 3
[pid  4074] close(9 <unfinished ...>
[pid  4052] write(3, "1", 1 <unfinished ...>
[pid  4074] <... close resumed>)        = 0
[pid  4051] read(249 <unfinished ...>
[pid  4050] close(3 <unfinished ...>
[pid  4074] close(10 <unfinished ...>
[pid  4052] <... write resumed>)        = 1
[pid  4050] <... close resumed>)        = 0
[pid  4074] <... close resumed>)        = 0
[pid  4074] close(11 <unfinished ...>
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4052] close(3 <unfinished ...>
[pid  4074] <... close resumed>)        = 0
[pid  4074] close(12 <unfinished ...>
[pid  4050] <... socket resumed>)       = 3
[pid  4050] close(3)                    = 0
[pid  4074] <... close resumed>)        = 0
[pid  4052] <... close resumed>)        = 0
[pid  4074] close(13 <unfinished ...>
[pid  4052] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4053] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4050] <... socket resumed>)       = 3
[pid  4074] <... close resumed>)        = 0
[pid  4053] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4052] <... socket resumed>)       = 3
[pid  4050] close(3 <unfinished ...>
[pid  4074] close(14 <unfinished ...>
[pid  4053] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4052] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4074] <... close resumed>)        = 0
[pid  4052] <... getsockopt resumed>, 0x7fe3a18173e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] close(15 <unfinished ...>
[pid  4053] getpid( <unfinished ...>
[pid  4074] <... close resumed>)        = 0
[pid  4052] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4074] close(16 <unfinished ...>
[pid  4053] <... getpid resumed>)       = 1
[pid  4074] <... close resumed>)        = 0
[pid  4052] <... getsockopt resumed>, 0x7fe3a1817a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] close(17 <unfinished ...>
[pid  4053] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz4", 0777 <unfinished ...>
[pid  4050] read(249 <unfinished ...>
[pid  4074] <... close resumed>)        = 0
[pid  4052] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4053] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4074] close(18)                   = 0
[pid  4053] openat(AT_FDCWD, "/syzcgroup/unified/syz4/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4052] <... getsockopt resumed>, 0x7fe3a18180e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] close(19)                   = 0
[pid  4053] <... openat resumed>)       = 3
[pid  4074] close(20 <unfinished ...>
[pid  4053] write(3, "32", 2 <unfinished ...>
[pid  4052] close(3 <unfinished ...>
[pid  4074] <... close resumed>)        = 0
[pid  4053] <... write resumed>)        = 2
[pid  4052] <... close resumed>)        = 0
[pid  4052] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4074] close(21 <unfinished ...>
[pid  4053] close(3 <unfinished ...>
[pid  4052] <... socket resumed>)       = 3
[pid  4074] <... close resumed>)        = 0
[pid  4053] <... close resumed>)        = 0
[pid  4074] close(22 <unfinished ...>
[pid  4053] openat(AT_FDCWD, "/syzcgroup/unified/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4052] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4074] <... close resumed>)        = 0
[pid  4053] <... openat resumed>)       = 3
[pid  4052] <... getsockopt resumed>, 0x7fe3a1818768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] close(23)                   = 0
[pid  4052] close(3 <unfinished ...>
[pid  4074] close(24 <unfinished ...>
[pid  4053] write(3, "1", 1 <unfinished ...>
[pid  4052] <... close resumed>)        = 0
[pid  4074] <... close resumed>)        = 0
[pid  4074] close(25 <unfinished ...>
[pid  4053] <... write resumed>)        = 1
[pid  4052] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4074] <... close resumed>)        = 0
[pid  4052] <... socket resumed>)       = 3
[pid  4053] close(3 <unfinished ...>
[pid  4074] close(26 <unfinished ...>
[pid  4053] <... close resumed>)        = 0
[pid  4074] <... close resumed>)        = 0
[pid  4053] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz4", 0777 <unfinished ...>
[pid  4052] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4074] close(27 <unfinished ...>
[pid  4053] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4074] <... close resumed>)        = 0
[pid  4074] close(28)                   = 0
[pid  4074] close(29 <unfinished ...>
[pid  4052] <... getsockopt resumed>, 0x7fe3a181afc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] <... close resumed>)        = 0
[pid  4074] close(30 <unfinished ...>
[pid  4052] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4074] <... close resumed>)        = 0
[pid  4053] openat(AT_FDCWD, "/syzcgroup/cpu/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4052] <... getsockopt resumed>, 0x7fe3a181b688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] close(31 <unfinished ...>
[pid  4053] <... openat resumed>)       = 3
[pid  4052] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4074] <... close resumed>)        = 0
[pid  4053] write(3, "1", 1 <unfinished ...>
[pid  4052] <... getsockopt resumed>, 0x7fe3a181bd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] close(32 <unfinished ...>
[pid  4053] <... write resumed>)        = 1
[pid  4074] <... close resumed>)        = 0
[pid  4074] close(33 <unfinished ...>
[pid  4052] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4074] <... close resumed>)        = 0
[pid  4053] close(3 <unfinished ...>
[pid  4052] <... getsockopt resumed>, 0x7fe3a181c408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] close(34)                   = 0
[pid  4053] <... close resumed>)        = 0
[pid  4052] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4074] close(35 <unfinished ...>
[pid  4053] openat(AT_FDCWD, "/syzcgroup/cpu/syz4/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4052] <... getsockopt resumed>, 0x7fe3a181cac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] <... close resumed>)        = 0
[pid  4053] <... openat resumed>)       = 3
[pid  4052] close(3 <unfinished ...>
[pid  4074] close(36 <unfinished ...>
[pid  4052] <... close resumed>)        = 0
[pid  4074] <... close resumed>)        = 0
[pid  4053] write(3, "313524224", 9 <unfinished ...>
[pid  4052] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4074] close(37)                   = 0
[pid  4053] <... write resumed>)        = 9
[pid  4052] <... socket resumed>)       = 3
[pid  4074] close(38 <unfinished ...>
[pid  4053] close(3 <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] <... close resumed>)        = 0
[pid  4074] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] openat(AT_FDCWD, "/syzcgroup/cpu/syz4/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4052] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4074] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... openat resumed>)       = 3
[pid  4074] close(39 <unfinished ...>
[pid  4052] <... getsockopt resumed>, 0x7fe3a1818e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] write(3, "314572800", 9 <unfinished ...>
[pid  4052] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4074] close(40 <unfinished ...>
[pid  4053] <... write resumed>)        = 9
[pid  4052] <... getsockopt resumed>, 0x7fe3a18194c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] close(3 <unfinished ...>
[pid  4052] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4074] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4053] <... close resumed>)        = 0
[pid  4052] <... getsockopt resumed>, 0x7fe3a1819b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] close(42 <unfinished ...>
[pid  4053] mkdirat(AT_FDCWD, "/syzcgroup/net/syz4", 0777 <unfinished ...>
[pid  4052] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4052] <... getsockopt resumed>, 0x7fe3a181a248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4053] openat(AT_FDCWD, "/syzcgroup/net/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4052] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4074] close(44 <unfinished ...>
[pid  4053] <... openat resumed>)       = 3
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] write(3, "1", 1 <unfinished ...>
[pid  4052] <... getsockopt resumed>, 0x7fe3a181a908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] close(45 <unfinished ...>
[pid  4053] <... write resumed>)        = 1
[pid  4052] close(3 <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4052] <... close resumed>)        = 0
[pid  4074] close(46 <unfinished ...>
[pid  4053] close(3 <unfinished ...>
[pid  4052] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] <... close resumed>)        = 0
[pid  4052] <... write resumed>)        = 4
[pid  4074] close(47)                   = -1 EBADF (Bad file descriptor)
[pid  4053] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4052] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4074] close(48 <unfinished ...>
[pid  4053] <... socket resumed>)       = 3
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4074] close(49 <unfinished ...>
[pid  4052] <... mkdirat resumed>)      = 0
[pid  4053] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] <... getsockopt resumed>, 0x7f01a06073e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] close(50 <unfinished ...>
[pid  4053] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4052] openat(AT_FDCWD, "/dev/loop3", O_RDWR <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] <... getsockopt resumed>, 0x7f01a0607a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4052] <... openat resumed>)       = 3
[pid  4074] close(51 <unfinished ...>
[pid  4053] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4052] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4074] close(52 <unfinished ...>
[pid  4053] <... getsockopt resumed>, 0x7f01a06080e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4052] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] close(3 <unfinished ...>
[pid  4052] close(3 <unfinished ...>
[pid  4074] close(53 <unfinished ...>
[pid  4053] <... close resumed>)        = 0
[pid  4052] <... close resumed>)        = 0
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4074] close(54 <unfinished ...>
[pid  4053] <... socket resumed>)       = 3
[pid  4052] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4052] <... socket resumed>)       = 3
[pid  4074] close(55 <unfinished ...>
[pid  4053] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4052] close(3 <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] <... getsockopt resumed>, 0x7f01a0608768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4052] <... close resumed>)        = 0
[pid  4074] close(56 <unfinished ...>
[pid  4053] close(3 <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] <... close resumed>)        = 0
[pid  4052] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4074] close(57)                   = -1 EBADF (Bad file descriptor)
[pid  4053] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4074] close(58 <unfinished ...>
[pid  4053] <... socket resumed>)       = 3
[pid  4052] <... socket resumed>)       = 3
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4052] close(3 <unfinished ...>
[pid  4074] close(59 <unfinished ...>
[pid  4053] <... getsockopt resumed>, 0x7f01a060afc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4052] <... close resumed>)        = 0
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4052] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4074] close(60 <unfinished ...>
[pid  4053] <... getsockopt resumed>, 0x7f01a060b688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4052] <... socket resumed>)       = 3
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4074] close(61 <unfinished ...>
[pid  4053] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] <... getsockopt resumed>, 0x7f01a060bd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4052] close(3 <unfinished ...>
[pid  4074] close(62 <unfinished ...>
[pid  4053] getsockopt(3, SOL_IP, IPT_SO_GET_INFO, 0x7f01a060c408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4052] <... close resumed>)        = 0
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4074] close(63 <unfinished ...>
[pid  4053] <... getsockopt resumed>, 0x7f01a060cac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4052] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] close(3 <unfinished ...>
[pid  4052] <... socket resumed>)       = 3
[pid  4074] close(64)                   = -1 EBADF (Bad file descriptor)
[pid  4053] <... close resumed>)        = 0
[pid  4052] close(3 <unfinished ...>
[pid  4074] close(65 <unfinished ...>
[pid  4053] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4052] <... close resumed>)        = 0
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] <... socket resumed>)       = 3
[pid  4052] read(249 <unfinished ...>
[pid  4074] close(66 <unfinished ...>
[pid  4053] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4074] close(67 <unfinished ...>
[pid  4053] <... getsockopt resumed>, 0x7f01a0608e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4074] close(68 <unfinished ...>
[pid  4053] <... getsockopt resumed>, 0x7f01a06094c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4074] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4053] <... getsockopt resumed>, 0x7f01a0609b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] close(70 <unfinished ...>
[pid  4053] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] <... getsockopt resumed>, 0x7f01a060a248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4074] close(71 <unfinished ...>
[pid  4053] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4074] close(72 <unfinished ...>
[pid  4053] <... getsockopt resumed>, 0x7f01a060a908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4053] close(3)                    = 0
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4074] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4074] close(74 <unfinished ...>
[pid  4053] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4074] close(75 <unfinished ...>
[pid  4053] <... write resumed>)        = 4
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4074] close(76 <unfinished ...>
[pid  4053] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] <... mkdirat resumed>)      = 0
[pid  4074] close(77)                   = -1 EBADF (Bad file descriptor)
[pid  4074] close(78 <unfinished ...>
[pid  4053] openat(AT_FDCWD, "/dev/loop4", O_RDWR <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4074] close(79 <unfinished ...>
[pid  4053] <... openat resumed>)       = 3
[pid  4053] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4074] close(80 <unfinished ...>
[pid  4053] close(3 <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4074] close(81 <unfinished ...>
[pid  4053] <... close resumed>)        = 0
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4074] close(82 <unfinished ...>
[pid  4053] <... socket resumed>)       = 3
[pid  4053] close(3 <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] <... close resumed>)        = 0
[pid  4074] close(83 <unfinished ...>
[pid  4053] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] <... socket resumed>)       = 3
[pid  4074] close(84)                   = -1 EBADF (Bad file descriptor)
[pid  4053] close(3 <unfinished ...>
[pid  4074] close(85 <unfinished ...>
[pid  4053] <... close resumed>)        = 0
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4074] close(86 <unfinished ...>
[pid  4053] <... socket resumed>)       = 3
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4074] close(87)                   = -1 EBADF (Bad file descriptor)
[pid  4053] close(3 <unfinished ...>
[pid  4074] close(88)                   = -1 EBADF (Bad file descriptor)
[pid  4074] close(89 <unfinished ...>
[pid  4053] <... close resumed>)        = 0
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4074] close(90)                   = -1 EBADF (Bad file descriptor)
[pid  4074] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4074] close(92)                   = -1 EBADF (Bad file descriptor)
[pid  4074] close(93)                   = -1 EBADF (Bad file descriptor)
[pid  4074] close(94)                   = -1 EBADF (Bad file descriptor)
[pid  4074] close(95)                   = -1 EBADF (Bad file descriptor)
[pid  4053] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4074] close(96 <unfinished ...>
[pid  4053] <... socket resumed>)       = 3
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4074] close(97 <unfinished ...>
[pid  4053] close(3 <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4053] <... close resumed>)        = 0
[pid  4074] close(98)                   = -1 EBADF (Bad file descriptor)
[pid  4074] close(99 <unfinished ...>
[pid  4053] read(249 <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4074] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(102)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(104)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(106)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(110)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(118)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(119)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(120)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(129)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(130)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(134)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(135)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(142)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(154)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(155)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(158)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(159 <unfinished ...>
[pid  4034] <... epoll_pwait resumed>, [], 128, 950, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4034] futex(0x2059c04dd160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4074] close(160 <unfinished ...>
[pid  4034] <... futex resumed>)        = 1
[pid  4027] <... futex resumed>)        = 0
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4074] close(161 <unfinished ...>
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4034] futex(0x2059c2bff960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4074] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=845644261} <unfinished ...>
[pid  4074] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(163)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(164)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(168)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(169)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(182)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(183)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(184)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(185)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(186)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(188)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(189)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(190)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(191)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(194)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(195)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(196)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(200)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(202)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(204)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(205)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(206)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(207)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(208)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(209)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(210)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(211)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(213)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(214)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(215)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(216)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(217)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(218)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(219)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(220)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(223)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(224)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(225)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(228)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(229)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(230)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(231)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(232)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(233)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(234)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(235)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(236)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(237)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(240)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(241)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(244)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(245)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(246)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(247)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(248)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(251)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(252)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(253)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4074] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4074] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4074] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffe3fa80ef0 /* 2 vars */ <unfinished ...>
[pid  4035] <... clone3 resumed>)       = 4074
[pid  4035] munmap(0x7fd910a37000, 36864) = 0
[pid  4035] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4035] fcntl(34, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(34, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] fcntl(36, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(36, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] close(29)                   = 0
[pid  4035] close(35)                   = 0
[pid  4035] close(37)                   = 0
[pid  4035] close(20 <unfinished ...>
[pid  4074] <... execve resumed>)       = 0
[pid  4035] <... close resumed>)        = 0
[pid  4035] close(21)                   = 0
[pid  4074] brk(NULL <unfinished ...>
[pid  4035] close(23 <unfinished ...>
[pid  4074] <... brk resumed>)          = 0x55557178c000
[pid  4035] <... close resumed>)        = 0
[pid  4074] brk(0x55557178ce80 <unfinished ...>
[pid  4035] write(32, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x12\x38\x02\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64 <unfinished ...>
[pid  4074] <... brk resumed>)          = 0x55557178ce80
[pid  4035] <... write resumed>)        = 64
[pid  4074] arch_prctl(ARCH_SET_FS, 0x55557178c500 <unfinished ...>
[pid  4035] pselect6(37, [3 11 13 16 18 26 28 31 33 34 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8}) = 5 (in [3 11 16 26 31], left {tv_sec=0, tv_nsec=999984038})
[pid  4035] read(3 <unfinished ...>
[pid  4074] <... arch_prctl resumed>)   = 0
[pid  4035] <... read resumed>, "\xbc\x00\x00\x00", 4) = 4
[pid  4074] set_tid_address(0x55557178c7d0 <unfinished ...>
[pid  4035] read(3 <unfinished ...>
[pid  4074] <... set_tid_address resumed>) = 4074
[pid  4035] <... read resumed>, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x20\x38\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4074] set_robust_list(0x55557178c7e0, 24 <unfinished ...>
[pid  4035] read(11 <unfinished ...>
[pid  4074] <... set_robust_list resumed>) = 0
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4074] prlimit64(0, RLIMIT_STACK, NULL <unfinished ...>
[pid  4035] write(3, "\x2c\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x0e\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x00\x00\x06\x00\x0c\x00\x04\x00\x06\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 846, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4074] <... prlimit64 resumed>, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4027] futex(0x2059c2bff960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4025] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4074] readlinkat(AT_FDCWD, "/proc/self/exe" <unfinished ...>
[pid  4035] <... write resumed>)        = 48
[pid  4034] <... futex resumed>)        = 0
[pid  4027] <... futex resumed>)        = 1
[pid  4025] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4074] <... readlinkat resumed>, "/syz-executor", 4096) = 13
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4074] getrandom( <unfinished ...>
[pid  4034] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fc6347caf000002}], 128, 0, NULL, 0) = 1
[pid  4074] <... getrandom resumed>"\xc1\x4a\xe6\xa9\x81\x27\x34\x18", 8, GRND_NONBLOCK) = 8
[pid  4034] futex(0x2059c0508160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4074] brk(NULL <unfinished ...>
[pid  4034] <... futex resumed>)        = 1
[pid  4028] <... futex resumed>)        = 0
[pid  4034] read(6 <unfinished ...>
[pid  4028] futex(0x2059c0508160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4074] <... brk resumed>)          = 0x55557178ce80
[pid  4074] brk(0x5555717ade80 <unfinished ...>
[pid  4034] <... read resumed>, "\x2c\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x0e\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x00\x00\x06\x00\x0c\x00\x04\x00\x06\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 21347228) = 48
[pid  4074] <... brk resumed>)          = 0x5555717ade80
[pid  4034] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x10\x3a\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0c\x00\x00\x00"..., 192 <unfinished ...>
[pid  4074] brk(0x5555717ae000)         = 0x5555717ae000
[pid  4074] mprotect(0x7f389c549000, 1236992, PROT_READ) = 0
[pid  4034] <... write resumed>)        = 192
[pid  4074] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4034] read(6 <unfinished ...>
[pid  4074] <... prctl resumed>)        = 0
[pid  4034] <... read resumed>, 0x2059c4680000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4034] futex(0x2059c2bff960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4074] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x1ffffffff000
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=125615239} <unfinished ...>
[pid  4074] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200000000000
[pid  4074] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200001000000
[pid  4074] rt_sigaction(SIGCHLD, {sa_handler=0x7f389c2e0780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f389c3ce1d0}, NULL, 8) = 0
[pid  4074] pkey_alloc(0, PKEY_UNRESTRICTED) = -1 EINVAL (Invalid argument)
[pid  4074] getrandom("\x52\x03\x50\x17\x4b\x27\xa2\x8a", 8, GRND_NONBLOCK) = 8
[pid  4074] mkdir("./syzkaller.IAdFrk", 0700) = 0
[pid  4035] write(10, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4074] chmod("./syzkaller.IAdFrk", 0777 <unfinished ...>
[pid  4050] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4035] <... write resumed>)        = 48
[pid  4074] <... chmod resumed>)        = 0
[pid  4050] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] read(16, "\x00\x00\x00\x00", 4) = 4
[pid  4035] write(3, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00", 56 <unfinished ...>
[pid  4074] chdir("./syzkaller.IAdFrk" <unfinished ...>
[pid  4050] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] <... write resumed>)        = 56
[pid  4074] <... chdir resumed>)        = 0
[pid  4050] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fc6347caf000002}], 128, 146, NULL, 0) = 1
[pid  4074] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4027] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4074] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4027] <... futex resumed>)        = 1
[pid  4074] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4027] read(6 <unfinished ...>
[pid  4025] <... futex resumed>)        = 0
[pid  4074] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4027] <... read resumed>, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00", 21347228) = 56
[pid  4074] rt_sigaction(SIGSEGV, {sa_handler=0x7f389c2e2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f389c3ce1d0} <unfinished ...>
[pid  4027] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x10\xb8\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0d\x00\x00\x00"..., 192 <unfinished ...>
[pid  4074] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4027] <... write resumed>)        = 192
[pid  4074] rt_sigaction(SIGBUS, {sa_handler=0x7f389c2e2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f389c3ce1d0}, NULL, 8) = 0
[pid  4074] getpid( <unfinished ...>
[pid  4027] read(6 <unfinished ...>
[pid  4074] <... getpid resumed>)       = 4074
[pid  4027] <... read resumed>, 0x2059c4680000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4074] mmap(0x1b32620000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4074] <... mmap resumed>)         = 0x1b32620000
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4074] getpid( <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4074] <... getpid resumed>)       = 4074
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=104223120} <unfinished ...>
[pid  4074] mmap(0x1b33624000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0) = 0x1b33624000
[pid  4074] close(3)                    = 0
[pid  4074] fcntl(5, F_GETFD)           = -1 EBADF (Bad file descriptor)
[pid  4074] fcntl(6, F_GETFD)           = -1 EBADF (Bad file descriptor)
[pid  4074] dup2(0, 249)                = 249
[pid  4074] dup2(1, 248)                = 248
[pid  4074] dup2(2, 1)                  = 1
[pid  4074] dup2(2, 0 <unfinished ...>
[pid  4050] <... clone resumed>, child_tidptr=0x5555913767d0) = 2
/strace: Process 4075 attached
[pid  4074] <... dup2 resumed>)         = 0
[pid  4074] read(249, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x12\x38\x02\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4075] set_robust_list(0x5555913767e0, 24 <unfinished ...>
[pid  4050] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4075] <... set_robust_list resumed>) = 0
[pid  4074] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR) = 3
[pid  4074] dup2(3, 216 <unfinished ...>
[pid  4075] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4074] <... dup2 resumed>)         = 216
[pid  4050] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4075] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4074] close(3 <unfinished ...>
[pid  4075] chdir("./0" <unfinished ...>
[pid  4074] <... close resumed>)        = 0
[pid  4075] <... chdir resumed>)        = 0
[pid  4074] ioctl(216, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4075] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  4075] setpgid(0, 0)               = 0
[pid  4075] symlinkat("/syzcgroup/unified/syz0", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4074] <... ioctl resumed>)        = 0
[pid  4075] <... symlinkat resumed>)    = 0
[pid  4035] write(15, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4074] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4075] symlinkat("/syzcgroup/cpu/syz0", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4074] <... mmap resumed>)         = 0x7f389be8e000
[pid  4051] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4035] <... write resumed>)        = 48
[pid  4075] <... symlinkat resumed>)    = 0
[pid  4051] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] read(26 <unfinished ...>
[pid  4074] mmap(0x7f389be8f000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 216, 0 <unfinished ...>
[pid  4051] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4051] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4075] symlinkat("/syzcgroup/net/syz0", AT_FDCWD, "./cgroup.net" <unfinished ...>
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4035] write(3, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x03\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00", 56 <unfinished ...>
[pid  4075] <... symlinkat resumed>)    = 0
[pid  4035] <... write resumed>)        = 56
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fc6347caf000002}], 128, 104, NULL, 0) = 1
[pid  4027] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1/strace: Process 4076 attached
 <unfinished ...>
[pid  4051] <... clone resumed>, child_tidptr=0x55558da1e7d0) = 2
[pid  4027] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4027] read(6 <unfinished ...>
[pid  4076] set_robust_list(0x55558da1e7e0, 24 <unfinished ...>
[pid  4051] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4027] <... read resumed>, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x03\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00", 21347228) = 56
[pid  4075] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4027] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x10\x38\x01\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0e\x00\x00\x00"..., 192 <unfinished ...>
[pid  4076] <... set_robust_list resumed>) = 0
[pid  4051] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4075] <... openat resumed>)       = 3
[pid  4075] write(3, "1000", 4)         = 4
[pid  4075] close(3 <unfinished ...>
[pid  4027] <... write resumed>)        = 192
[pid  4076] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4075] <... close resumed>)        = 0
[pid  4074] <... mmap resumed>)         = 0x7f389be8f000
[pid  4075] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs" <unfinished ...>
[pid  4027] read(6 <unfinished ...>
[pid  4075] <... symlinkat resumed>)    = 0
[pid  4076] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4074] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4027] <... read resumed>, 0x2059c4680000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4074] <... openat resumed>)       = 3
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4076] chdir("./0" <unfinished ...>
[pid  4074] dup2(3, 217 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4074] <... dup2 resumed>)         = 217
[pid  4074] close(3)                    = 0
[pid  4074] ioctl(217, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4076] <... chdir resumed>)        = 0
[pid  4075] close(249)                  = 0
[pid  4075] close(248)                  = 0
[pid  4075] prctl(PR_SET_NAME, "syz.0.1" <unfinished ...>
[pid  4076] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4075] <... prctl resumed>)        = 0
[pid  4075] close(4)                    = 0
[pid  4076] <... prctl resumed>)        = 0
[pid  4076] setpgid(0, 0 <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=38853043} <unfinished ...>
[pid  4076] <... setpgid resumed>)      = 0
[pid  4076] symlinkat("/syzcgroup/unified/syz1", AT_FDCWD, "./cgroup") = 0
[pid  4074] <... ioctl resumed>)        = 0
[pid  4074] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4076] symlinkat("/syzcgroup/cpu/syz1", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4074] <... mmap resumed>)         = 0x7f389ba8c000
[pid  4074] mmap(0x7f389ba8d000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 217, 0 <unfinished ...>
[pid  4076] <... symlinkat resumed>)    = 0
[pid  4076] symlinkat("/syzcgroup/net/syz1", AT_FDCWD, "./cgroup.net") = 0
[pid  4076] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  4076] write(3, "1000", 4 <unfinished ...>
[pid  4074] <... mmap resumed>)         = 0x7f389ba8d000
[pid  4076] <... write resumed>)        = 4
[pid  4035] write(25, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4074] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4076] close(3 <unfinished ...>
[pid  4074] <... openat resumed>)       = 3
[pid  4035] <... write resumed>)        = 48
[pid  4074] dup2(3, 218 <unfinished ...>
[pid  4035] read(31 <unfinished ...>
[pid  4076] <... close resumed>)        = 0
[pid  4052] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4076] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs" <unfinished ...>
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4074] <... dup2 resumed>)         = 218
[pid  4035] write(3, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x04\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00", 56 <unfinished ...>
[pid  4076] <... symlinkat resumed>)    = 0
[pid  4074] close(3 <unfinished ...>
[pid  4035] <... write resumed>)        = 56
[pid  4076] close(249 <unfinished ...>
[pid  4074] <... close resumed>)        = 0
[pid  4052] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fc6347caf000002}], 128, 49, NULL, 0) = 1
[pid  4076] <... close resumed>)        = 0
[pid  4076] close(248 <unfinished ...>
[pid  4052] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4027] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4076] <... close resumed>)        = 0
[pid  4074] ioctl(218, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4025] sched_yield( <unfinished ...>
[pid  4076] prctl(PR_SET_NAME, "syz.1.2" <unfinished ...>
[pid  4052] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4027] <... futex resumed>)        = 0
[pid  4076] <... prctl resumed>)        = 0
[pid  4027] read(6, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x04\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00", 21347228) = 56
[pid  4025] <... sched_yield resumed>)  = 0
[pid  4025] epoll_pwait(4, [], 128, 0, NULL, 0) = 0
[pid  4076] close(4 <unfinished ...>
[pid  4027] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x14\x38\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0f\x00\x00\x00"..., 192 <unfinished ...>
[pid  4076] <... close resumed>)        = 0
/strace: Process 4077 attached
[pid  4075] futex(0x7ff662265fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4074] <... ioctl resumed>)        = 0
[pid  4027] <... write resumed>)        = 192
[pid  4077] set_robust_list(0x5555872007e0, 24 <unfinished ...>
[pid  4075] <... futex resumed>)        = 0
[pid  4074] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4052] <... clone resumed>, child_tidptr=0x5555872007d0) = 2
[pid  4027] read(6 <unfinished ...>
[pid  4077] <... set_robust_list resumed>) = 0
[pid  4075] rt_sigaction(SIGRT_1, {sa_handler=0x7ff66200c3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7ff661f8e1d0} <unfinished ...>
[pid  4074] <... mmap resumed>)         = 0x7f389b68a000
[pid  4052] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4027] <... read resumed>, 0x2059c4680000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4077] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4075] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4074] mmap(0x7f389b68b000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 218, 0 <unfinished ...>
[pid  4052] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4077] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4075] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4027] futex(0x2059c2bff960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4075] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4074] <... mmap resumed>)         = 0x7f389b68b000
[pid  4034] <... futex resumed>)        = 0
[pid  4027] <... futex resumed>)        = 1
[pid  4077] chdir("./0" <unfinished ...>
[pid  4075] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4074] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4077] <... chdir resumed>)        = 0
[pid  4075] <... mmap resumed>)         = 0x7ff661e27000
[pid  4074] <... openat resumed>)       = 3
[pid  4027] futex(0x2059c04dd160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4077] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4075] mprotect(0x7ff661e28000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4074] dup2(3, 219)                = 219
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=976314107} <unfinished ...>
[pid  4077] <... prctl resumed>)        = 0
[pid  4074] close(3 <unfinished ...>
[pid  4077] setpgid(0, 0 <unfinished ...>
[pid  4075] <... mprotect resumed>)     = 0
[pid  4074] <... close resumed>)        = 0
[pid  4074] ioctl(219, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4077] <... setpgid resumed>)      = 0
[pid  4075] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4075] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7ff661e47990, parent_tid=0x7ff661e47990, exit_signal=0, stack=0x7ff661e27000, stack_size=0x201c0, tls=0x7ff661e476c0}/strace: Process 4078 attached
 <unfinished ...>
[pid  4077] symlinkat("/syzcgroup/unified/syz3", AT_FDCWD, "./cgroup") = 0
[pid  4078] set_robust_list(0x7ff661e479a0, 24) = 0
[pid  4077] symlinkat("/syzcgroup/cpu/syz3", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4075] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4074] <... ioctl resumed>)        = 0
[pid  4078] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4075] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4074] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4078] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4075] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4078] futex(0x7ff662265fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4075] futex(0x7ff662265fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4074] <... openat resumed>)       = 3
[pid  4078] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4075] <... futex resumed>)        = 0
[pid  4074] dup2(3, 220 <unfinished ...>
[pid  4078] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4075] futex(0x7ff662265fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4074] <... dup2 resumed>)         = 220
[pid  4078] <... mmap resumed>)         = 0x1ffffffff000
[pid  4077] <... symlinkat resumed>)    = 0
[pid  4074] close(3 <unfinished ...>
[pid  4078] futex(0x7ff662265fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4077] symlinkat("/syzcgroup/net/syz3", AT_FDCWD, "./cgroup.net" <unfinished ...>
[pid  4074] <... close resumed>)        = 0
[pid  4078] <... futex resumed>)        = 1
[pid  4075] <... futex resumed>)        = 0
[pid  4078] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4077] <... symlinkat resumed>)    = 0
[pid  4075] futex(0x7ff662265fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4074] ioctl(220, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4078] <... mmap resumed>)         = 0x200000000000
[pid  4077] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4075] <... futex resumed>)        = 0
[pid  4078] futex(0x7ff662265fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4075] futex(0x7ff662265fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4078] <... futex resumed>)        = 0
[pid  4075] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4078] futex(0x7ff662265fa8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4075] futex(0x7ff662265fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4077] <... openat resumed>)       = 3
[pid  4077] write(3, "1000", 4)         = 4
[pid  4078] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4077] close(3 <unfinished ...>
[pid  4075] <... futex resumed>)        = 0
[pid  4074] <... ioctl resumed>)        = 0
[pid  4078] <... mmap resumed>)         = 0x200001000000
[pid  4075] futex(0x7ff662265fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4074] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4078] futex(0x7ff662265fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4077] <... close resumed>)        = 0
[pid  4075] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4078] <... futex resumed>)        = 0
[pid  4075] close_range(3, 30, 0 <unfinished ...>
[pid  4074] <... openat resumed>)       = 3
[pid  4077] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs" <unfinished ...>
[pid  4078] futex(0x7ff662265fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4075] <... close_range resumed>)  = 0
[pid  4074] dup2(3, 221 <unfinished ...>
[pid  4075] exit_group(0 <unfinished ...>
[pid  4074] <... dup2 resumed>)         = 221
[pid  4078] <... futex resumed>)        = ?
[pid  4075] <... exit_group resumed>)   = ?
[pid  4074] close(3 <unfinished ...>
[pid  4078] +++ exited with 0 +++
[pid  4077] <... symlinkat resumed>)    = 0
[pid  4077] close(249 <unfinished ...>
[pid  4074] <... close resumed>)        = 0
[pid  4077] <... close resumed>)        = 0
[pid  4075] +++ exited with 0 +++
[pid  4074] ioctl(221, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4077] close(248)                  = 0
[pid  4050] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
[pid  4077] prctl(PR_SET_NAME, "syz.3.4") = 0
[pid  4050] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4077] close(4)                    = 0
[pid  4074] <... ioctl resumed>)        = 0
[pid  4050] <... rt_sigreturn resumed>) = 0
[pid  4074] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4076] futex(0x7f7d98995fac, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid  4074] <... openat resumed>)       = 3
[pid  4076] rt_sigaction(SIGRT_1, {sa_handler=0x7f7d9873c3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f7d986be1d0} <unfinished ...>
[pid  4074] dup2(3, 222 <unfinished ...>
[pid  4050] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4035] write(30, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4074] <... dup2 resumed>)         = 222
[pid  4050] <... write resumed>)        = 4
[pid  4076] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4074] close(3)                    = 0
[pid  4076] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4074] ioctl(222, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4050] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4076] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] <... write resumed>)        = 48
[pid  4076] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4053] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4050] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] pselect6(37, [3 11 13 16 18 26 28 31 33 34 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4076] <... mmap resumed>)         = 0x7f7d98557000
[pid  4053] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] <... pselect6 resumed>)     = 2 (in [3 11], left {tv_sec=0, tv_nsec=999982463})
[pid  4076] mprotect(0x7f7d98558000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4053] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4050] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4035] read(3, "\xbc\x00\x00\x00", 4) = 4
[pid  4076] <... mprotect resumed>)     = 0
[pid  4035] read(3 <unfinished ...>
[pid  4050] <... openat resumed>)       = 3
[pid  4053] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4035] <... read resumed>, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x10\x3a\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4050] fstat(3 <unfinished ...>
[pid  4035] read(11, "\x00\x00\x00\x00", 4) = 4
[pid  4035] write(3, "\xac\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x18\x00\x0c\x00\x00\x00\x04\x00\x00\x00\x00\x00\x08\x00\x10\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00\x10\x00\x00\x00\x80\x4f\x47\x0c"..., 176 <unfinished ...>
[pid  4050] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4035] <... write resumed>)        = 176
[pid  4035] kill(4045, SIGKILL)         = 0
[pid  4050] getdents64(3/strace: Process 4079 attached
 <unfinished ...>
[pid  4077] futex(0x7fe3a1845fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4076] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4074] <... ioctl resumed>)        = 0
[pid  4050] <... getdents64 resumed>, 0x5555913898c0 /* 6 entries */, 32768) = 176
[pid  4034] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fc6347caf000002}], 128, 978, NULL, 0) = 1
[pid  4077] <... futex resumed>)        = 0
[pid  4076] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4079] set_robust_list(0x555568b567e0, 24 <unfinished ...>
[pid  4076] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f7d98577990, parent_tid=0x7f7d98577990, exit_signal=0, stack=0x7f7d98557000, stack_size=0x201c0, tls=0x7f7d985776c0} <unfinished ...>
[pid  4053] <... clone resumed>, child_tidptr=0x555568b567d0) = 2
[pid  4079] <... set_robust_list resumed>) = 0
[pid  4053] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4079] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4077] rt_sigaction(SIGRT_1, {sa_handler=0x7fe3a15ec3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fe3a156e1d0} <unfinished ...>
[pid  4076] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4053] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4050] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4034] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1/strace: Process 4080 attached
 <unfinished ...>
[pid  4079] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4077] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4074] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4050] <... umount2 resumed>)      = ?
[pid  4045] +++ killed by SIGKILL +++
[pid  4034] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4034] read(6 <unfinished ...>
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4045, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=3 /* 0.03 s */} ---
[pid  4035] rt_sigreturn({mask=[]})     = 4045
[pid  4035] pipe2([20, 21], 0)          = 0
[pid  4074] <... openat resumed>)       = 3
[pid  4035] pipe2( <unfinished ...>
[pid  4034] <... read resumed>, "\xac\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x18\x00\x0c\x00\x00\x00\x04\x00\x00\x00\x00\x00\x08\x00\x10\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00\x10\x00\x00\x00\x80\x4f\x47\x0c"..., 21347228) = 176
[pid  4074] dup2(3, 223 <unfinished ...>
[pid  4035] <... pipe2 resumed>[23, 29], 0) = 0
[pid  4080] set_robust_list(0x7f7d985779a0, 24 <unfinished ...>
[pid  4076] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4074] <... dup2 resumed>)         = 223
[pid  4035] pipe2( <unfinished ...>
[pid  4080] <... set_robust_list resumed>) = 0
[pid  4076] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4074] close(3 <unfinished ...>
[pid  4035] <... pipe2 resumed>[35, 37], 0) = 0
[pid  4034] futex(0x2059c04dd160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4080] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4077] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4076] futex(0x7f7d98995fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4074] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4080] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4077] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4076] <... futex resumed>)        = 0
[pid  4074] ioctl(223, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4034] <... futex resumed>)        = 1
[pid  4027] <... futex resumed>)        = 0
[pid  4079] chdir("./0" <unfinished ...>
[pid  4076] futex(0x7f7d98995fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4080] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4077] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4034] read(6 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4080] <... mmap resumed>)         = 0x1ffffffff000
[pid  4079] <... chdir resumed>)        = 0
[pid  4077] <... mmap resumed>)         = 0x7fe3a1407000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4034] <... read resumed>, 0x2059c4680000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4077] mprotect(0x7fe3a1408000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4027] write(5, "\x01\x00\x00\x00\x00\x00\x00\x00", 8 <unfinished ...>
[pid  4080] futex(0x7f7d98995fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4077] <... mprotect resumed>)     = 0
[pid  4074] <... ioctl resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4034] <... epoll_pwait resumed>, [{events=EPOLLIN, data=0x33dbe88}], 128, -1, NULL, 0) = 1
[pid  4027] <... write resumed>)        = 8
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4077] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4034] read(5 <unfinished ...>
[pid  4027] futex(0x2059c04dd160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=884030945} <unfinished ...>
[pid  4080] <... futex resumed>)        = 1
[pid  4079] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4077] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4076] <... futex resumed>)        = 0
[pid  4074] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4034] <... read resumed>, "\x01\x00\x00\x00\x00\x00\x00\x00", 8) = 8
[pid  4080] futex(0x7f7d98995fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4077] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fe3a1427990, parent_tid=0x7fe3a1427990, exit_signal=0, stack=0x7fe3a1407000, stack_size=0x201c0, tls=0x7fe3a14276c0}/strace: Process 4081 attached
 <unfinished ...>
[pid  4080] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4076] futex(0x7f7d98995fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4074] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4081] set_robust_list(0x7fe3a14279a0, 24 <unfinished ...>
[pid  4080] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4077] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4076] <... futex resumed>)        = 0
[pid  4074] dup2(3, 215 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4081] <... set_robust_list resumed>) = 0
[pid  4080] <... mmap resumed>)         = 0x200000000000
[pid  4079] <... prctl resumed>)        = 0
[pid  4077] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4076] futex(0x7f7d98995fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4081] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4080] futex(0x7f7d98995fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4079] setpgid(0, 0 <unfinished ...>
[pid  4077] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4074] <... dup2 resumed>)         = 215
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4081] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4080] <... futex resumed>)        = 1
[pid  4079] <... setpgid resumed>)      = 0
[pid  4076] <... futex resumed>)        = 0
[pid  4074] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4081] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4079] symlinkat("/syzcgroup/unified/syz4", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4077] futex(0x7fe3a1845fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4076] futex(0x7f7d98995fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4074] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4081] <... mmap resumed>)         = 0x1ffffffff000
[pid  4077] <... futex resumed>)        = 0
[pid  4076] <... futex resumed>)        = 0
[pid  4074] ioctl(215, KCOV_INIT_TRACE, 0x100000 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4080] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4081] futex(0x7fe3a1845fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4080] <... mmap resumed>)         = 0x200001000000
[pid  4077] futex(0x7fe3a1845fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4076] futex(0x7f7d98995fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4081] <... futex resumed>)        = 0
[pid  4079] <... symlinkat resumed>)    = 0
[pid  4077] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] +++ killed by SIGKILL +++
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4081] futex(0x7fe3a1845fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4077] futex(0x7fe3a1845fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4079] symlinkat("/syzcgroup/cpu/syz4", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4080] futex(0x7f7d98995fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4079] <... symlinkat resumed>)    = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4081] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4080] <... futex resumed>)        = 1
[pid  4077] <... futex resumed>)        = 0
[pid  4076] <... futex resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4080] futex(0x7f7d98995fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4079] symlinkat("/syzcgroup/net/syz4", AT_FDCWD, "./cgroup.net" <unfinished ...>
[pid  4076] close_range(3, 30, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4081] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4079] <... symlinkat resumed>)    = 0
[pid  4077] futex(0x7fe3a1845fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4079] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4076] <... close_range resumed>)  = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4079] <... openat resumed>)       = 3
[pid  4076] exit_group(0)               = ?
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4081] <... mmap resumed>)         = 0x200000000000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4080] <... futex resumed>)        = ?
[pid  4079] write(3, "1000", 4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4081] futex(0x7fe3a1845fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4079] <... write resumed>)        = 4
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4079] close(3 <unfinished ...>
[pid  4081] <... futex resumed>)        = 1
[pid  4077] <... futex resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4081] futex(0x7fe3a1845fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4079] <... close resumed>)        = 0
[pid  4077] futex(0x7fe3a1845fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4081] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4077] <... futex resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4081] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4079] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs" <unfinished ...>
[pid  4077] futex(0x7fe3a1845fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4081] <... mmap resumed>)         = 0x200001000000
[pid  4079] <... symlinkat resumed>)    = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4081] futex(0x7fe3a1845fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4079] close(249 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4079] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4079] close(248)                  = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4079] prctl(PR_SET_NAME, "syz.4.5") = 0
[pid  4079] close(4 <unfinished ...>
[pid  4081] <... futex resumed>)        = 1
[pid  4079] <... close resumed>)        = 0
[pid  4077] <... futex resumed>)        = 0
[pid  4081] futex(0x7fe3a1845fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4077] close_range(3, 30, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4077] <... close_range resumed>)  = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4077] exit_group(0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4077] <... exit_group resumed>)   = ?
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4081] <... futex resumed>)        = ?
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4081] +++ exited with 0 +++
[pid  4080] +++ exited with 0 +++
[pid  4077] +++ exited with 0 +++
[pid  4076] +++ exited with 0 +++
[pid  4074] <... ioctl resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4074] mmap(NULL, 8396800, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4052] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4051] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4074] <... mmap resumed>)         = 0x7f389ae88000
[pid  4052] <... rt_sigreturn resumed>) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4074] mmap(0x7f389ae89000, 8388608, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 215, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... rt_sigreturn resumed>) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4074] <... mmap resumed>)         = 0x7f389ae89000
[pid  4052] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] <... write resumed>)        = 4
[pid  4074] unshare(CLONE_NEWPID <unfinished ...>
[pid  4052] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4074] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4074] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4052] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4074] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4052] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... write resumed>)        = 4
[pid  4051] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] fstat(3 <unfinished ...>
[pid  4051] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4052] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4052] getdents64(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
/strace: Process 4082 attached
[pid  4079] futex(0x7f01a0635fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4052] <... getdents64 resumed>, 0x5555872138c0 /* 6 entries */, 32768) = 176
[pid  4051] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] set_robust_list(0x55557178c7e0, 24 <unfinished ...>
[pid  4052] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4082] <... set_robust_list resumed>) = 0
[pid  4074] <... clone resumed>, child_tidptr=0x55557178c7d0) = 4082
[pid  4051] fstat(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4074] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4052] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4051] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4079] <... futex resumed>)        = 0
[pid  4074] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4052] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4051] getdents64(3 <unfinished ...>
[pid  4052] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4051] <... getdents64 resumed>, 0x55558da318c0 /* 6 entries */, 32768) = 176
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4079] rt_sigaction(SIGRT_1, {sa_handler=0x7f01a03dc3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f01a035e1d0} <unfinished ...>
[pid  4052] unlink("./0/binderfs" <unfinished ...>
[pid  4051] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4079] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4051] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... prctl resumed>)        = 0
[pid  4079] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4052] <... unlink resumed>)       = 0
[pid  4051] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] getppid( <unfinished ...>
[pid  4079] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4052] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4051] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... getppid resumed>)      = 0
[pid  4079] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4052] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4082] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4079] <... mmap resumed>)         = 0x7f01a01f7000
[pid  4052] newfstatat(AT_FDCWD, "./0/cgroup.net" <unfinished ...>
[pid  4051] unlink("./0/binderfs" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... openat resumed>)       = 3
[pid  4079] mprotect(0x7f01a01f8000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4052] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4051] <... unlink resumed>)       = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] dup2(3, 201 <unfinished ...>
[pid  4079] <... mprotect resumed>)     = 0
[pid  4052] unlink("./0/cgroup.net" <unfinished ...>
[pid  4051] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... dup2 resumed>)         = 201
[pid  4079] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] close(3 <unfinished ...>
[pid  4079] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4052] <... unlink resumed>)       = 0
[pid  4051] newfstatat(AT_FDCWD, "./0/cgroup.net" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... close resumed>)        = 0
[pid  4079] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f01a0217990, parent_tid=0x7f01a0217990, exit_signal=0, stack=0x7f01a01f7000, stack_size=0x201c0, tls=0x7f01a02176c0} <unfinished ...>
[pid  4052] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4051] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
/strace: Process 4083 attached
[pid  4082] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4052] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4051] unlink("./0/cgroup.net" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... prlimit64 resumed>, NULL) = 0
[pid  4052] newfstatat(AT_FDCWD, "./0/cgroup.cpu" <unfinished ...>
[pid  4082] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024} <unfinished ...>
[pid  4083] set_robust_list(0x7f01a02179a0, 24 <unfinished ...>
[pid  4082] <... prlimit64 resumed>, NULL) = 0
[pid  4079] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4052] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4051] <... unlink resumed>)       = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024} <unfinished ...>
[pid  4083] <... set_robust_list resumed>) = 0
[pid  4082] <... prlimit64 resumed>, NULL) = 0
[pid  4079] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4052] unlink("./0/cgroup.cpu" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4083] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4082] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4079] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4052] <... unlink resumed>)       = 0
[pid  4051] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4083] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4082] <... prlimit64 resumed>, NULL) = 0
[pid  4079] futex(0x7f01a0635fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4052] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4051] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4083] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4082] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  4052] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4051] newfstatat(AT_FDCWD, "./0/cgroup.cpu" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4083] <... mmap resumed>)         = 0x1ffffffff000
[pid  4082] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} <unfinished ...>
[pid  4079] <... futex resumed>)        = 0
[pid  4052] newfstatat(AT_FDCWD, "./0/cgroup" <unfinished ...>
[pid  4051] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4083] futex(0x7f01a0635fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4082] <... prlimit64 resumed>, NULL) = 0
[pid  4079] futex(0x7f01a0635fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4052] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4051] unlink("./0/cgroup.cpu" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] unshare(CLONE_NEWNS <unfinished ...>
[pid  4083] <... futex resumed>)        = 0
[pid  4082] <... unshare resumed>)      = 0
[pid  4079] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4052] unlink("./0/cgroup" <unfinished ...>
[pid  4051] <... unlink resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4083] futex(0x7f01a0635fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4083] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4079] futex(0x7f01a0635fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4052] <... unlink resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4052] getdents64(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4083] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4082] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4079] <... futex resumed>)        = 0
[pid  4052] <... getdents64 resumed>, 0x5555872138c0 /* 0 entries */, 32768) = 0
[pid  4051] newfstatat(AT_FDCWD, "./0/cgroup" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4083] <... mmap resumed>)         = 0x200000000000
[pid  4082] <... mount resumed>)        = 0
[pid  4079] futex(0x7f01a0635fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4052] close(3 <unfinished ...>
[pid  4051] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4083] futex(0x7f01a0635fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4082] unshare(CLONE_NEWIPC <unfinished ...>
[pid  4079] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4052] <... close resumed>)        = 0
[pid  4051] unlink("./0/cgroup" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4083] <... futex resumed>)        = 0
[pid  4082] <... unshare resumed>)      = 0
[pid  4079] futex(0x7f01a0635fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4052] unlinkat(AT_FDCWD, "./0", AT_REMOVEDIR <unfinished ...>
[pid  4051] <... unlink resumed>)       = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4083] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4052] <... unlinkat resumed>)     = 0
[pid  4051] getdents64(3 <unfinished ...>
[pid  4083] <... mmap resumed>)         = 0x200001000000
[pid  4079] <... futex resumed>)        = 0
[pid  4051] <... getdents64 resumed>, 0x55558da318c0 /* 0 entries */, 32768) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4083] futex(0x7f01a0635fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4079] futex(0x7f01a0635fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4052] mkdirat(AT_FDCWD, "./1", 0777 <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4083] <... futex resumed>)        = 0
[pid  4082] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4079] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4052] <... mkdirat resumed>)      = 0
[pid  4051] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4083] futex(0x7f01a0635fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4082] <... unshare resumed>)      = 0
[pid  4079] close_range(3, 30, 0 <unfinished ...>
[pid  4052] openat(AT_FDCWD, "/dev/loop3", O_RDWR <unfinished ...>
[pid  4051] unlinkat(AT_FDCWD, "./0", AT_REMOVEDIR <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4079] <... close_range resumed>)  = 0
[pid  4052] <... openat resumed>)       = 3
[pid  4051] <... unlinkat resumed>)     = 0
[pid  4082] unshare(CLONE_NEWUTS <unfinished ...>
[pid  4079] exit_group(0 <unfinished ...>
[pid  4052] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4051] mkdirat(AT_FDCWD, "./1", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4083] <... futex resumed>)        = ?
[pid  4082] <... unshare resumed>)      = 0
[pid  4079] <... exit_group resumed>)   = ?
[pid  4052] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4051] <... mkdirat resumed>)      = 0
[pid  4083] +++ exited with 0 +++
[pid  4082] unshare(CLONE_SYSVSEM <unfinished ...>
[pid  4052] close(3 <unfinished ...>
[pid  4051] openat(AT_FDCWD, "/dev/loop1", O_RDWR <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4052] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... unshare resumed>)      = 0
[pid  4082] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  4079] +++ exited with 0 +++
[pid  4052] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4051] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
[pid  4052] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] write(3, "16777216", 8 <unfinished ...>
[pid  4053] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4052] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... write resumed>)        = 8
[pid  4052] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] close(3 <unfinished ...>
[pid  4053] <... rt_sigreturn resumed>) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... close resumed>)        = 0
[pid  4052] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4051] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4052] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... openat resumed>)       = 3
[pid  4053] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4052] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] write(3, "536870912", 9 <unfinished ...>
[pid  4053] <... write resumed>)        = 4
[pid  4052] <... close resumed>)        = 0
[pid  4051] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... write resumed>)        = 9
[pid  4053] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4052] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] close(3 <unfinished ...>
[pid  4053] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4052] <... socket resumed>)       = 3
[pid  4051] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... close resumed>)        = 0
[pid  4053] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4052] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4053] <... openat resumed>)       = 3
[pid  4052] <... close resumed>)        = 0
[pid  4051] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... openat resumed>)       = 3
[pid  4053] fstat(3 <unfinished ...>
[pid  4052] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4052] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] write(3, "1024", 4 <unfinished ...>
[pid  4053] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4052] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... write resumed>)        = 4
[pid  4053] getdents64(3 <unfinished ...>
[pid  4052] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] close(3 <unfinished ...>
[pid  4053] <... getdents64 resumed>, 0x555568b69900 /* 6 entries */, 32768) = 176
[pid  4052] read(249 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... close resumed>)        = 0
[pid  4053] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4053] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... openat resumed>)       = 3
[pid  4053] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] write(3, "8192", 4 <unfinished ...>
[pid  4053] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... write resumed>)        = 4
[pid  4053] unlink("./0/binderfs" <unfinished ...>
[pid  4051] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] close(3 <unfinished ...>
[pid  4053] <... unlink resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... close resumed>)        = 0
[pid  4053] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4053] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... openat resumed>)       = 3
[pid  4053] newfstatat(AT_FDCWD, "./0/cgroup.net" <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] write(3, "1024", 4 <unfinished ...>
[pid  4053] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... write resumed>)        = 4
[pid  4053] unlink("./0/cgroup.net" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... unlink resumed>)       = 0
[pid  4082] close(3 <unfinished ...>
[pid  4053] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... close resumed>)        = 0
[pid  4053] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4053] newfstatat(AT_FDCWD, "./0/cgroup.cpu" <unfinished ...>
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4082] <... openat resumed>)       = 3
[pid  4053] unlink("./0/cgroup.cpu" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] <... unlink resumed>)       = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] write(3, "1024", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... write resumed>)        = 4
[pid  4053] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] close(3 <unfinished ...>
[pid  4053] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... close resumed>)        = 0
[pid  4053] newfstatat(AT_FDCWD, "./0/cgroup" <unfinished ...>
[pid  4051] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4053] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... openat resumed>)       = 3
[pid  4053] unlink("./0/cgroup" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... unlink resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] write(3, "1024 1048576 500 1024", 21 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... write resumed>)        = 21
[pid  4053] getdents64(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] close(3 <unfinished ...>
[pid  4053] <... getdents64 resumed>, 0x555568b69900 /* 0 entries */, 32768) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... close resumed>)        = 0
[pid  4053] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] close(3 <unfinished ...>
[pid  4082] getpid( <unfinished ...>
[pid  4053] unlinkat(AT_FDCWD, "./0", AT_REMOVEDIR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... getpid resumed>)       = 1
[pid  4053] <... unlinkat resumed>)     = 0
[pid  4051] <... close resumed>)        = 0
[pid  4082] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4053] mkdirat(AT_FDCWD, "./1", 0777 <unfinished ...>
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4053] <... mkdirat resumed>)      = 0
[pid  4082] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4053] openat(AT_FDCWD, "/dev/loop4", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... capset resumed>)       = 0
[pid  4053] <... openat resumed>)       = 3
[pid  4051] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] unshare(CLONE_NEWNET <unfinished ...>
[pid  4053] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4053] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... socket resumed>)       = 3
[pid  4051] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] close(3 <unfinished ...>
[pid  4051] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] close(3 <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] <... close resumed>)        = 0
[pid  4051] read(249 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4053] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4053] read(249 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] write(3, "0 65535", 7 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... write resumed>)        = 7
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] write(3, "100000", 6 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... write resumed>)        = 6
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] close(3)                    = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] mkdirat(AT_FDCWD, "./syz-tmp", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] mount("", "./syz-tmp", "tmpfs", 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... mount resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] mkdirat(AT_FDCWD, "./syz-tmp/newroot", 0777) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] mkdirat(AT_FDCWD, "./syz-tmp/newroot/dev", 0700 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... mount resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] mkdirat(AT_FDCWD, "./syz-tmp/newroot/proc", 0700 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] mkdirat(AT_FDCWD, "./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... mount resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... mount resumed>)        = 0
[pid  4082] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... mount resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... mount resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... mount resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... mount resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... mount resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... pivot_root resumed>)   = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] chdir("/" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... chdir resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... umount2 resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] chroot("./newroot" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... chroot resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] chdir("/" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... chdir resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4082] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] mkdirat(AT_FDCWD, "/dev/binderfs", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fd910a37000
[pid  4035] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4035] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7fd910a37000, stack_size=0x9000}, 88/strace: Process 4087 attached
 <unfinished ...>
[pid  4082] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4087] rt_sigprocmask(SIG_BLOCK, NULL <unfinished ...>
[pid  4082] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4087] <... rt_sigprocmask resumed>, ~[KILL STOP], 8) = 0
[pid  4082] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4087] setpgid(0, 0 <unfinished ...>
[pid  4082] getpid( <unfinished ...>
[pid  4087] <... setpgid resumed>)      = 0
[pid  4082] <... getpid resumed>)       = 1
[pid  4087] dup2(20, 0 <unfinished ...>
[pid  4082] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz2", 0777 <unfinished ...>
[pid  4087] <... dup2 resumed>)         = 0
[pid  4082] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4087] dup2(29, 1 <unfinished ...>
[pid  4082] openat(AT_FDCWD, "/syzcgroup/unified/syz2/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4087] <... dup2 resumed>)         = 1
[pid  4082] <... openat resumed>)       = 3
[pid  4087] dup2(37, 2 <unfinished ...>
[pid  4082] write(3, "32", 2 <unfinished ...>
[pid  4087] <... dup2 resumed>)         = 2
[pid  4082] <... write resumed>)        = 2
[pid  4087] dup2(7, 3 <unfinished ...>
[pid  4082] close(3 <unfinished ...>
[pid  4087] <... dup2 resumed>)         = 3
[pid  4082] <... close resumed>)        = 0
[pid  4087] dup2(8, 4 <unfinished ...>
[pid  4082] openat(AT_FDCWD, "/syzcgroup/unified/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4087] <... dup2 resumed>)         = 4
[pid  4087] close(5 <unfinished ...>
[pid  4082] <... openat resumed>)       = 3
[pid  4087] <... close resumed>)        = 0
[pid  4087] close(6)                    = 0
[pid  4087] close(7)                    = 0
[pid  4082] write(3, "1", 1 <unfinished ...>
[pid  4087] close(8)                    = 0
[pid  4087] close(9)                    = 0
[pid  4087] close(10)                   = 0
[pid  4087] close(11 <unfinished ...>
[pid  4082] <... write resumed>)        = 1
[pid  4082] close(3)                    = 0
[pid  4082] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz2", 0777) = -1 EEXIST (File exists)
[pid  4082] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3
[pid  4087] <... close resumed>)        = 0
[pid  4082] write(3, "1", 1 <unfinished ...>
[pid  4087] close(12 <unfinished ...>
[pid  4082] <... write resumed>)        = 1
[pid  4087] <... close resumed>)        = 0
[pid  4082] close(3 <unfinished ...>
[pid  4087] close(13 <unfinished ...>
[pid  4082] <... close resumed>)        = 0
[pid  4087] <... close resumed>)        = 0
[pid  4082] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4087] close(14 <unfinished ...>
[pid  4082] <... openat resumed>)       = 3
[pid  4087] <... close resumed>)        = 0
[pid  4082] write(3, "313524224", 9 <unfinished ...>
[pid  4087] close(15 <unfinished ...>
[pid  4082] <... write resumed>)        = 9
[pid  4087] <... close resumed>)        = 0
[pid  4082] close(3 <unfinished ...>
[pid  4087] close(16 <unfinished ...>
[pid  4082] <... close resumed>)        = 0
[pid  4087] <... close resumed>)        = 0
[pid  4087] close(17 <unfinished ...>
[pid  4082] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4087] <... close resumed>)        = 0
[pid  4082] <... openat resumed>)       = 3
[pid  4087] close(18 <unfinished ...>
[pid  4082] write(3, "314572800", 9 <unfinished ...>
[pid  4087] <... close resumed>)        = 0
[pid  4087] close(19 <unfinished ...>
[pid  4082] <... write resumed>)        = 9
[pid  4087] <... close resumed>)        = 0
[pid  4082] close(3 <unfinished ...>
[pid  4087] close(20)                   = 0
[pid  4082] <... close resumed>)        = 0
[pid  4087] close(21)                   = 0
[pid  4082] mkdirat(AT_FDCWD, "/syzcgroup/net/syz2", 0777 <unfinished ...>
[pid  4087] close(22 <unfinished ...>
[pid  4082] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4087] <... close resumed>)        = 0
[pid  4082] openat(AT_FDCWD, "/syzcgroup/net/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4087] close(23 <unfinished ...>
[pid  4082] <... openat resumed>)       = 3
[pid  4087] <... close resumed>)        = 0
[pid  4087] close(24 <unfinished ...>
[pid  4082] write(3, "1", 1 <unfinished ...>
[pid  4087] <... close resumed>)        = 0
[pid  4082] <... write resumed>)        = 1
[pid  4087] close(25)                   = 0
[pid  4087] close(26 <unfinished ...>
[pid  4082] close(3 <unfinished ...>
[pid  4087] <... close resumed>)        = 0
[pid  4082] <... close resumed>)        = 0
[pid  4087] close(27 <unfinished ...>
[pid  4082] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4087] <... close resumed>)        = 0
[pid  4082] <... socket resumed>)       = 3
[pid  4087] close(28)                   = 0
[pid  4082] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4087] close(29)                   = 0
[pid  4087] close(30)                   = 0
[pid  4087] close(31)                   = 0
[pid  4082] <... getsockopt resumed>, 0x7f389c6773e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4087] close(32)                   = 0
[pid  4082] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4087] close(33 <unfinished ...>
[pid  4082] <... getsockopt resumed>, 0x7f389c677a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4087] <... close resumed>)        = 0
[pid  4082] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4087] close(34 <unfinished ...>
[pid  4082] <... getsockopt resumed>, 0x7f389c6780e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4087] <... close resumed>)        = 0
[pid  4087] close(35 <unfinished ...>
[pid  4082] close(3 <unfinished ...>
[pid  4087] <... close resumed>)        = 0
[pid  4082] <... close resumed>)        = 0
[pid  4087] close(36)                   = 0
[pid  4082] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4087] close(37)                   = 0
[pid  4087] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4087] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4087] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] close(39 <unfinished ...>
[pid  4082] <... getsockopt resumed>, 0x7f389c678768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4082] close(3)                    = 0
[pid  4087] close(40)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(42 <unfinished ...>
[pid  4082] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4082] <... socket resumed>)       = 3
[pid  4087] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4082] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4087] close(44)                   = -1 EBADF (Bad file descriptor)
[pid  4082] <... getsockopt resumed>, 0x7f389c67afc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4087] close(45)                   = -1 EBADF (Bad file descriptor)
[pid  4082] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4087] close(46 <unfinished ...>
[pid  4082] <... getsockopt resumed>, 0x7f389c67b688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4082] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4087] close(47 <unfinished ...>
[pid  4082] <... getsockopt resumed>, 0x7f389c67bd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4082] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4087] close(48 <unfinished ...>
[pid  4082] <... getsockopt resumed>, 0x7f389c67c408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4082] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4087] close(49)                   = -1 EBADF (Bad file descriptor)
[pid  4082] <... getsockopt resumed>, 0x7f389c67cac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4087] close(50 <unfinished ...>
[pid  4082] close(3 <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4082] <... close resumed>)        = 0
[pid  4087] close(51)                   = -1 EBADF (Bad file descriptor)
[pid  4082] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4087] close(52 <unfinished ...>
[pid  4082] <... socket resumed>)       = 3
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4087] close(53 <unfinished ...>
[pid  4082] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4082] <... getsockopt resumed>, 0x7f389c678e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4087] close(54 <unfinished ...>
[pid  4082] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4087] close(55 <unfinished ...>
[pid  4082] <... getsockopt resumed>, 0x7f389c6794c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4082] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4087] close(56 <unfinished ...>
[pid  4082] <... getsockopt resumed>, 0x7f389c679b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4082] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4087] close(57 <unfinished ...>
[pid  4082] <... getsockopt resumed>, 0x7f389c67a248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4082] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4087] close(58 <unfinished ...>
[pid  4082] <... getsockopt resumed>, 0x7f389c67a908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4082] close(3)                    = 0
[pid  4087] close(59)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(60)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(61)                   = -1 EBADF (Bad file descriptor)
[pid  4082] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4087] close(62)                   = -1 EBADF (Bad file descriptor)
[pid  4082] <... write resumed>)        = 4
[pid  4087] close(63)                   = -1 EBADF (Bad file descriptor)
[pid  4082] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4087] close(64)                   = -1 EBADF (Bad file descriptor)
[pid  4082] <... mkdirat resumed>)      = 0
[pid  4087] close(65)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(66)                   = -1 EBADF (Bad file descriptor)
[pid  4082] openat(AT_FDCWD, "/dev/loop2", O_RDWR <unfinished ...>
[pid  4087] close(67 <unfinished ...>
[pid  4082] <... openat resumed>)       = 3
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4082] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4087] close(68)                   = -1 EBADF (Bad file descriptor)
[pid  4082] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4087] close(69 <unfinished ...>
[pid  4082] close(3 <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4082] <... close resumed>)        = 0
[pid  4087] close(70 <unfinished ...>
[pid  4082] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4082] <... socket resumed>)       = 3
[pid  4087] close(71)                   = -1 EBADF (Bad file descriptor)
[pid  4082] close(3 <unfinished ...>
[pid  4087] close(72 <unfinished ...>
[pid  4082] <... close resumed>)        = 0
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4087] close(73 <unfinished ...>
[pid  4082] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4082] <... socket resumed>)       = 3
[pid  4087] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(75)                   = -1 EBADF (Bad file descriptor)
[pid  4082] close(3 <unfinished ...>
[pid  4087] close(76 <unfinished ...>
[pid  4082] <... close resumed>)        = 0
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4087] close(77 <unfinished ...>
[pid  4082] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4082] <... socket resumed>)       = 3
[pid  4087] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(79 <unfinished ...>
[pid  4082] close(3 <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4087] close(80 <unfinished ...>
[pid  4082] <... close resumed>)        = 0
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4082] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4087] close(81)                   = -1 EBADF (Bad file descriptor)
[pid  4082] <... socket resumed>)       = 3
[pid  4087] close(82)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(83 <unfinished ...>
[pid  4082] close(3 <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4082] <... close resumed>)        = 0
[pid  4087] close(84)                   = -1 EBADF (Bad file descriptor)
[pid  4082] read(249 <unfinished ...>
[pid  4087] close(85)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(86)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(87)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(88)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(89)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(90)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(92)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(93)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(94)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(95)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(96)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(98)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(99)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(102)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(104)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(106)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(110)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(118)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(119)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(120)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(129)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(130)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4025] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4087] close(133 <unfinished ...>
[pid  4034] <... epoll_pwait resumed>, [], 128, 881, NULL, 0) = 0
[pid  4025] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4087] close(134 <unfinished ...>
[pid  4034] futex(0x2059c04dd160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4034] <... futex resumed>)        = 1
[pid  4027] <... futex resumed>)        = 0
[pid  4087] close(135 <unfinished ...>
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4087] close(136 <unfinished ...>
[pid  4034] futex(0x2059c2bff960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4087] close(137 <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=981940838} <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4087] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(142)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(154)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(155)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(158)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(163)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(164)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(168)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(169)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(182)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(183)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(184)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(185)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(186)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(188)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(189)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(190)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(191)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(194)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(195)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(196)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(200)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(202)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(204)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(205)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(206)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(207)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(208)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(209)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(210)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(211)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(213)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(214)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(215)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(216)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(217)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(218)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(219)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(220)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(223)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(224)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(225)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(228)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(229)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(230)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(231)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(232)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(233)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(234)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(235)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(236)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(237)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(240)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(241)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(244)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(245)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(246)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(247)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(248)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4027] <... epoll_pwait resumed>, [], 128, 982, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4087] close(251 <unfinished ...>
[pid  4027] futex(0x2059c2bff960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4034] <... futex resumed>)        = 0
[pid  4027] <... futex resumed>)        = 1
[pid  4087] close(252 <unfinished ...>
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4087] close(253 <unfinished ...>
[pid  4034] futex(0x2059c2bff960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=998472425} <unfinished ...>
[pid  4087] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4087] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4087] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffe3fa80e70 /* 2 vars */ <unfinished ...>
[pid  4035] <... clone3 resumed>)       = 4087
[pid  4087] <... execve resumed>)       = 0
[pid  4035] munmap(0x7fd910a37000, 36864) = 0
[pid  4035] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4035] fcntl(23, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(23, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] fcntl(35, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(35, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] close(20)                   = 0
[pid  4035] close(29)                   = 0
[pid  4035] close(37)                   = 0
[pid  4035] close(10)                   = 0
[pid  4035] close(11)                   = 0
[pid  4035] close(13 <unfinished ...>
[pid  4087] brk(NULL <unfinished ...>
[pid  4035] <... close resumed>)        = 0
[pid  4087] <... brk resumed>)          = 0x55556a0c3000
[pid  4035] write(21, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x12\x38\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64 <unfinished ...>
[pid  4087] brk(0x55556a0c3e80 <unfinished ...>
[pid  4035] <... write resumed>)        = 64
[pid  4087] <... brk resumed>)          = 0x55556a0c3e80
[pid  4035] pselect6(37, [3 16 18 23 26 28 31 33 34 35 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8}) = 5 (in [3 16 26 31 34], left {tv_sec=0, tv_nsec=999985367})
[pid  4035] read(3, "\xbc\x00\x00\x00", 4) = 4
[pid  4035] read(3 <unfinished ...>
[pid  4087] arch_prctl(ARCH_SET_FS, 0x55556a0c3500 <unfinished ...>
[pid  4035] <... read resumed>, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x10\xb8\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0d\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4087] <... arch_prctl resumed>)   = 0
[pid  4087] set_tid_address(0x55556a0c37d0 <unfinished ...>
[pid  4035] read(16 <unfinished ...>
[pid  4087] <... set_tid_address resumed>) = 4087
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4087] set_robust_list(0x55556a0c37e0, 24 <unfinished ...>
[pid  4035] write(3, "\xb4\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x01\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 184 <unfinished ...>
[pid  4087] <... set_robust_list resumed>) = 0
[pid  4035] <... write resumed>)        = 184
[pid  4087] prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4035] kill(4046, SIGKILL <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fc6347caf000002}], 128, 999, NULL, 0) = 1
[pid  4087] readlinkat(AT_FDCWD, "/proc/self/exe" <unfinished ...>
[pid  4035] <... kill resumed>)         = 0
[pid  4027] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4087] <... readlinkat resumed>, "/syz-executor", 4096) = 13
[pid  4087] getrandom( <unfinished ...>
[pid  4027] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4087] <... getrandom resumed>"\x43\xa4\x12\xe2\x0c\xc1\x06\x65", 8, GRND_NONBLOCK) = 8
[pid  4087] brk(NULL)                   = 0x55556a0c3e80
[pid  4087] brk(0x55556a0e4e80)         = 0x55556a0e4e80
[pid  4087] brk(0x55556a0e5000 <unfinished ...>
[pid  4051] <... read resumed> <unfinished ...>) = ?
[pid  4046] +++ killed by SIGKILL +++
[pid  4027] read(6 <unfinished ...>
[pid  4025] sched_yield( <unfinished ...>
[pid  4027] <... read resumed>, "\xb4\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x01\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 21347228) = 184
[pid  4027] futex(0x2059c2bff960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4087] <... brk resumed>)          = 0x55556a0e5000
[pid  4027] <... futex resumed>)        = 1
[pid  4034] <... futex resumed>)        = 0
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4027] read(6 <unfinished ...>
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4027] <... read resumed>, 0x2059c4680000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4034] futex(0x2059c2bff960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4025] <... sched_yield resumed>)  = 0
[pid  4087] mprotect(0x7f686d279000, 1236992, PROT_READ <unfinished ...>
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4046, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=2 /* 0.02 s */} ---
[pid  4087] <... mprotect resumed>)     = 0
[pid  4051] +++ killed by SIGKILL +++
[pid  4035] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4025] sched_getaffinity(0, 8192, [0 1]) = 8
[pid  4035] <... rt_sigreturn resumed>) = 4046
[pid  4035] pipe2([10, 11], 0)          = 0
[pid  4035] pipe2( <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=890072009} <unfinished ...>
[pid  4035] <... pipe2 resumed>[13, 20], 0) = 0
[pid  4035] pipe2([29, 37], 0)          = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... prctl resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... mmap resumed>)         = 0x1ffffffff000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... mmap resumed>)         = 0x200000000000
[pid  4087] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... mmap resumed>)         = 0x200001000000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] rt_sigaction(SIGCHLD, {sa_handler=0x7f686d010780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f686d0fe1d0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] pkey_alloc(0, PKEY_UNRESTRICTED <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... pkey_alloc resumed>)   = -1 EINVAL (Invalid argument)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] getrandom( <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... getrandom resumed>"\xe2\x79\x2f\x49\x27\x16\x1d\x36", 8, GRND_NONBLOCK) = 8
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] mkdir("./syzkaller.8zs0Rc", 0700 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... mkdir resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] chmod("./syzkaller.8zs0Rc", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... chmod resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] chdir("./syzkaller.8zs0Rc" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... chdir resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] rt_sigaction(SIGSEGV, {sa_handler=0x7f686d012b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f686d0fe1d0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] rt_sigaction(SIGBUS, {sa_handler=0x7f686d012b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f686d0fe1d0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] getpid( <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... getpid resumed>)       = 4087
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] mmap(0x1b33320000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... mmap resumed>)         = 0x1b33320000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] getpid( <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... getpid resumed>)       = 4087
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] mmap(0x1b34324000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... mmap resumed>)         = 0x1b34324000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] fcntl(5, F_GETFD <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] fcntl(6, F_GETFD <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] dup2(0, 249)                = 249
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] dup2(1, 248 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... dup2 resumed>)         = 248
[pid  4087] dup2(2, 1 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... dup2 resumed>)         = 1
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] dup2(2, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... dup2 resumed>)         = 0
[pid  4087] read(249 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x12\x38\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] dup2(3, 216 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... dup2 resumed>)         = 216
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] ioctl(216, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... ioctl resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... mmap resumed>)         = 0x7f686cbbe000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] mmap(0x7f686cbbf000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 216, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... mmap resumed>)         = 0x7f686cbbf000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] dup2(3, 217 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... dup2 resumed>)         = 217
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] ioctl(217, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... ioctl resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... mmap resumed>)         = 0x7f686c7bc000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] mmap(0x7f686c7bd000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 217, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... mmap resumed>)         = 0x7f686c7bd000
[pid  4087] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR) = 3
[pid  4087] dup2(3, 218)                = 218
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] close(3)                    = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] ioctl(218, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... ioctl resumed>)        = 0
[pid  4087] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f686c3ba000
[pid  4087] mmap(0x7f686c3bb000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 218, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... mmap resumed>)         = 0x7f686c3bb000
[pid  4087] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... openat resumed>)       = 3
[pid  4087] dup2(3, 219 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... dup2 resumed>)         = 219
[pid  4087] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... close resumed>)        = 0
[pid  4087] ioctl(219, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... ioctl resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... mmap resumed>)         = 0x7f686bfb8000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] mmap(0x7f686bfb9000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 219, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... mmap resumed>)         = 0x7f686bfb9000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] dup2(3, 220 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... dup2 resumed>)         = 220
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] ioctl(220, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... ioctl resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f686bbb6000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] mmap(0x7f686bbb7000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 220, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... mmap resumed>)         = 0x7f686bbb7000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] dup2(3, 221 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... dup2 resumed>)         = 221
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] ioctl(221, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... ioctl resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... mmap resumed>)         = 0x7f686b7b4000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] mmap(0x7f686b7b5000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 221, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... mmap resumed>)         = 0x7f686b7b5000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... openat resumed>)       = 3
[pid  4087] dup2(3, 215 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... dup2 resumed>)         = 215
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] ioctl(215, KCOV_INIT_TRACE, 0x100000 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... ioctl resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] mmap(NULL, 8396800, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... mmap resumed>)         = 0x7f686afb2000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] mmap(0x7f686afb3000, 8388608, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 215, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... mmap resumed>)         = 0x7f686afb3000
[pid  4087] unshare(CLONE_NEWPID <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
/strace: Process 4088 attached
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... clone resumed>, child_tidptr=0x55556a0c37d0) = 4088
[pid  4088] set_robust_list(0x55556a0c37e0, 24 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... set_robust_list resumed>) = 0
[pid  4087] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... prctl resumed>)        = 0
[pid  4088] getppid( <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... getppid resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] dup2(3, 201 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... dup2 resumed>)         = 201
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... close resumed>)        = 0
[pid  4088] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... prlimit64 resumed>, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... prlimit64 resumed>, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... prlimit64 resumed>, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... prlimit64 resumed>, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... prlimit64 resumed>, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... prlimit64 resumed>, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] unshare(CLONE_NEWNS <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... unshare resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... mount resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] unshare(CLONE_NEWIPC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] unshare(CLONE_NEWUTS <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] unshare(CLONE_SYSVSEM <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... unshare resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] write(3, "16777216", 8 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... write resumed>)        = 8
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] write(3, "536870912", 9 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... write resumed>)        = 9
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] write(3, "1024", 4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... write resumed>)        = 4
[pid  4035] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4088] close(3 <unfinished ...>
[pid  4035] <... mmap resumed>)         = 0x7fd910a37000
[pid  4088] <... close resumed>)        = 0
[pid  4035] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4088] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4088] <... openat resumed>)       = 3
[pid  4035] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7fd910a37000, stack_size=0x9000}, 88 <unfinished ...>
[pid  4088] write(3, "8192", 4/strace: Process 4089 attached
 <unfinished ...>
[pid  4089] rt_sigprocmask(SIG_BLOCK, NULL <unfinished ...>
[pid  4088] <... write resumed>)        = 4
[pid  4089] <... rt_sigprocmask resumed>, ~[KILL STOP], 8) = 0
[pid  4089] setpgid(0, 0 <unfinished ...>
[pid  4088] close(3)                    = 0
[pid  4089] <... setpgid resumed>)      = 0
[pid  4089] dup2(10, 0 <unfinished ...>
[pid  4088] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4089] <... dup2 resumed>)         = 0
[pid  4088] <... openat resumed>)       = 3
[pid  4089] dup2(20, 1)                 = 1
[pid  4089] dup2(37, 2)                 = 2
[pid  4089] dup2(9, 3 <unfinished ...>
[pid  4088] write(3, "1024", 4 <unfinished ...>
[pid  4089] <... dup2 resumed>)         = 3
[pid  4088] <... write resumed>)        = 4
[pid  4089] dup2(12, 4)                 = 4
[pid  4088] close(3 <unfinished ...>
[pid  4089] close(5 <unfinished ...>
[pid  4088] <... close resumed>)        = 0
[pid  4089] <... close resumed>)        = 0
[pid  4089] close(6 <unfinished ...>
[pid  4088] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4089] <... close resumed>)        = 0
[pid  4088] <... openat resumed>)       = 3
[pid  4089] close(7)                    = 0
[pid  4089] close(8)                    = 0
[pid  4089] close(9)                    = 0
[pid  4089] close(10 <unfinished ...>
[pid  4088] write(3, "1024", 4 <unfinished ...>
[pid  4089] <... close resumed>)        = 0
[pid  4088] <... write resumed>)        = 4
[pid  4089] close(11)                   = 0
[pid  4088] close(3 <unfinished ...>
[pid  4089] close(12 <unfinished ...>
[pid  4088] <... close resumed>)        = 0
[pid  4089] <... close resumed>)        = 0
[pid  4089] close(13 <unfinished ...>
[pid  4088] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4089] <... close resumed>)        = 0
[pid  4088] <... openat resumed>)       = 3
[pid  4089] close(14)                   = 0
[pid  4088] write(3, "1024 1048576 500 1024", 21 <unfinished ...>
[pid  4089] close(15 <unfinished ...>
[pid  4088] <... write resumed>)        = 21
[pid  4089] <... close resumed>)        = 0
[pid  4088] close(3 <unfinished ...>
[pid  4089] close(16)                   = 0
[pid  4088] <... close resumed>)        = 0
[pid  4089] close(17)                   = 0
[pid  4088] getpid( <unfinished ...>
[pid  4089] close(18 <unfinished ...>
[pid  4088] <... getpid resumed>)       = 1
[pid  4089] <... close resumed>)        = 0
[pid  4088] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4089] close(19)                   = 0
[pid  4088] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4089] close(20 <unfinished ...>
[pid  4088] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4089] <... close resumed>)        = 0
[pid  4089] close(21 <unfinished ...>
[pid  4088] <... capset resumed>)       = 0
[pid  4089] <... close resumed>)        = 0
[pid  4089] close(22 <unfinished ...>
[pid  4088] unshare(CLONE_NEWNET <unfinished ...>
[pid  4089] <... close resumed>)        = 0
[pid  4089] close(23)                   = 0
[pid  4089] close(24)                   = 0
[pid  4089] close(25)                   = 0
[pid  4089] close(26)                   = 0
[pid  4089] close(27)                   = 0
[pid  4089] close(28 <unfinished ...>
[pid  4088] <... unshare resumed>)      = 0
[pid  4089] <... close resumed>)        = 0
[pid  4089] close(29 <unfinished ...>
[pid  4088] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4089] <... close resumed>)        = 0
[pid  4088] <... openat resumed>)       = 3
[pid  4089] close(30 <unfinished ...>
[pid  4088] write(3, "0 65535", 7 <unfinished ...>
[pid  4089] <... close resumed>)        = 0
[pid  4088] <... write resumed>)        = 7
[pid  4089] close(31 <unfinished ...>
[pid  4088] close(3 <unfinished ...>
[pid  4089] <... close resumed>)        = 0
[pid  4089] close(32 <unfinished ...>
[pid  4088] <... close resumed>)        = 0
[pid  4089] <... close resumed>)        = 0
[pid  4089] close(33)                   = 0
[pid  4089] close(34)                   = 0
[pid  4089] close(35 <unfinished ...>
[pid  4088] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4089] <... close resumed>)        = 0
[pid  4088] <... openat resumed>)       = 3
[pid  4089] close(36)                   = 0
[pid  4089] close(37)                   = 0
[pid  4089] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4088] write(3, "100000", 6 <unfinished ...>
[pid  4089] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] close(39)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(40 <unfinished ...>
[pid  4088] <... write resumed>)        = 6
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(41 <unfinished ...>
[pid  4088] close(3 <unfinished ...>
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(42 <unfinished ...>
[pid  4088] <... close resumed>)        = 0
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(44)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(45)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(46)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(47)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(48)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(49)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(50)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(51)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(52)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(53)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(54)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(55)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(56)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(57)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(58)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(59)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(60)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(61)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(62)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(63)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(64)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(65)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(66)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(67)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(68)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(70)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(71)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(72)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(75)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(76)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(77)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(79)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(80)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(81)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(82)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(84)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(85 <unfinished ...>
[pid  4088] mkdirat(AT_FDCWD, "./syz-tmp", 0777 <unfinished ...>
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(86)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(87)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(88)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(89)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(90)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(92)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(93)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(94)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(95)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(96)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(98)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(99)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(102)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(104)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(106)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(110)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(118)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(119)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(120)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(126 <unfinished ...>
[pid  4088] <... mkdirat resumed>)      = 0
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(129)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(130)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(131 <unfinished ...>
[pid  4088] mount("", "./syz-tmp", "tmpfs", 0, NULL <unfinished ...>
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(134)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(135)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4088] <... mount resumed>)        = 0
[pid  4089] close(140 <unfinished ...>
[pid  4088] mkdirat(AT_FDCWD, "./syz-tmp/newroot", 0777 <unfinished ...>
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(142)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4088] <... mkdirat resumed>)      = 0
[pid  4089] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4088] mkdirat(AT_FDCWD, "./syz-tmp/newroot/dev", 0700 <unfinished ...>
[pid  4089] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4088] <... mkdirat resumed>)      = 0
[pid  4089] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4088] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4089] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4088] <... mount resumed>)        = 0
[pid  4089] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4088] mkdirat(AT_FDCWD, "./syz-tmp/newroot/proc", 0700 <unfinished ...>
[pid  4089] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(154)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(155)                  = -1 EBADF (Bad file descriptor)
[pid  4088] <... mkdirat resumed>)      = 0
[pid  4089] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4088] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid  4089] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(158)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4088] <... mount resumed>)        = 0
[pid  4089] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4088] mkdirat(AT_FDCWD, "./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid  4089] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(163 <unfinished ...>
[pid  4088] <... mkdirat resumed>)      = 0
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(164 <unfinished ...>
[pid  4088] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(165 <unfinished ...>
[pid  4088] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4027] <... epoll_pwait resumed>, [], 128, 905, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(167 <unfinished ...>
[pid  4088] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4027] futex(0x2059c2bff960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4089] close(168 <unfinished ...>
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(169)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(171 <unfinished ...>
[pid  4088] <... mount resumed>)        = 0
[pid  4034] <... futex resumed>)        = 0
[pid  4027] <... futex resumed>)        = 1
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4089] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4089] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4088] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4089] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(182)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(183)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(184)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(185)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(186)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(188)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(189)                  = -1 EBADF (Bad file descriptor)
[pid  4088] <... mkdirat resumed>)      = 0
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4089] close(190)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(191 <unfinished ...>
[pid  4088] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4034] futex(0x2059c2bff960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=934289692} <unfinished ...>
[pid  4089] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(194 <unfinished ...>
[pid  4088] <... mount resumed>)        = 0
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(195 <unfinished ...>
[pid  4088] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(196)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4088] <... mount resumed>)        = 0
[pid  4089] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4088] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4089] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(200)                  = -1 EBADF (Bad file descriptor)
[pid  4088] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4089] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4088] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4089] close(202)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4088] <... mount resumed>)        = 0
[pid  4089] close(204)                  = -1 EBADF (Bad file descriptor)
[pid  4088] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4089] close(205)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(206)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(207)                  = -1 EBADF (Bad file descriptor)
[pid  4088] <... mkdirat resumed>)      = 0
[pid  4089] close(208)                  = -1 EBADF (Bad file descriptor)
[pid  4088] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4089] close(209)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(210)                  = -1 EBADF (Bad file descriptor)
[pid  4088] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4089] close(211 <unfinished ...>
[pid  4088] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700 <unfinished ...>
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(213 <unfinished ...>
[pid  4088] <... mkdirat resumed>)      = 0
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4088] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4089] close(214)                  = -1 EBADF (Bad file descriptor)
[pid  4088] <... mkdirat resumed>)      = 0
[pid  4089] close(215)                  = -1 EBADF (Bad file descriptor)
[pid  4088] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700 <unfinished ...>
[pid  4089] close(216 <unfinished ...>
[pid  4088] <... mkdirat resumed>)      = 0
[pid  4088] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4088] <... mkdirat resumed>)      = 0
[pid  4089] close(217 <unfinished ...>
[pid  4088] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(218)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(219)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(220)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(222 <unfinished ...>
[pid  4088] <... mount resumed>)        = 0
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4088] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4089] close(223)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(224 <unfinished ...>
[pid  4088] <... mount resumed>)        = 0
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(225 <unfinished ...>
[pid  4088] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4088] <... mount resumed>)        = 0
[pid  4089] close(228 <unfinished ...>
[pid  4088] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(229 <unfinished ...>
[pid  4088] <... mkdirat resumed>)      = 0
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(230)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(231 <unfinished ...>
[pid  4088] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4088] <... pivot_root resumed>)   = 0
[pid  4089] close(232)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(233)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(234)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(235)                  = -1 EBADF (Bad file descriptor)
[pid  4088] chdir("/" <unfinished ...>
[pid  4089] close(236 <unfinished ...>
[pid  4088] <... chdir resumed>)        = 0
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(237 <unfinished ...>
[pid  4088] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4088] <... umount2 resumed>)      = 0
[pid  4089] close(240)                  = -1 EBADF (Bad file descriptor)
[pid  4088] chroot("./newroot" <unfinished ...>
[pid  4089] close(241 <unfinished ...>
[pid  4088] <... chroot resumed>)       = 0
[pid  4088] chdir("/" <unfinished ...>
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4088] <... chdir resumed>)        = 0
[pid  4089] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(244)                  = -1 EBADF (Bad file descriptor)
[pid  4088] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4089] close(245)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(246)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(247)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(248 <unfinished ...>
[pid  4088] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4088] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4089] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(251)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(252)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(253)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4089] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4089] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffe3fa80e70 /* 2 vars */ <unfinished ...>
[pid  4035] <... clone3 resumed>)       = 4089
[pid  4035] munmap(0x7fd910a37000, 36864) = 0
[pid  4035] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4089] <... execve resumed>)       = 0
[pid  4088] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4035] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] fcntl(13, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(13, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] fcntl(29, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(29, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] close(10)                   = 0
[pid  4035] close(20)                   = 0
[pid  4035] close(37)                   = 0
[pid  4035] close(15)                   = 0
[pid  4035] close(16)                   = 0
[pid  4035] close(18 <unfinished ...>
[pid  4088] mkdirat(AT_FDCWD, "/dev/binderfs", 0777 <unfinished ...>
[pid  4089] brk(NULL <unfinished ...>
[pid  4035] <... close resumed>)        = 0
[pid  4035] write(11, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x12\x38\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64 <unfinished ...>
[pid  4089] <... brk resumed>)          = 0x5555904a2000
[pid  4088] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4089] brk(0x5555904a2e80 <unfinished ...>
[pid  4035] <... write resumed>)        = 64
[pid  4088] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4089] <... brk resumed>)          = 0x5555904a2e80
[pid  4035] read(34, "\x00\x00\x00\x00", 4) = 4
[pid  4035] write(3, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x02\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00", 56 <unfinished ...>
[pid  4089] arch_prctl(ARCH_SET_FS, 0x5555904a2500 <unfinished ...>
[pid  4035] <... write resumed>)        = 56
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fc6347caf000002}], 128, 965, NULL, 0) = 1
[pid  4027] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1) = 1
[pid  4027] read(6, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x02\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00", 21347228) = 56
[pid  4027] write(6, "\x84\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x44\x00\x38\x00\x30\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x40\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00\x02\x00\x00\x00"..., 136) = 136
[pid  4089] <... arch_prctl resumed>)   = 0
[pid  4025] <... futex resumed>)        = 0
[pid  4089] set_tid_address(0x5555904a27d0 <unfinished ...>
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4089] <... set_tid_address resumed>) = 4089
[pid  4089] set_robust_list(0x5555904a27e0, 24 <unfinished ...>
[pid  4027] read(6 <unfinished ...>
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4089] <... set_robust_list resumed>) = 0
[pid  4027] <... read resumed>, 0x2059c4680000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4025] sched_getaffinity(0, 8192, [0 1]) = 8
[pid  4027] epoll_pwait(4, [], 128, 0, NULL, 0) = 0
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=657320943} <unfinished ...>
[pid  4089] prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4089] readlinkat(AT_FDCWD, "/proc/self/exe", "/syz-executor", 4096) = 13
[pid  4089] getrandom("\x4b\x8c\x58\xcc\x6d\x0c\x49\x0b", 8, GRND_NONBLOCK) = 8
[pid  4089] brk(NULL)                   = 0x5555904a2e80
[pid  4089] brk(0x5555904c3e80)         = 0x5555904c3e80
[pid  4089] brk(0x5555904c4000)         = 0x5555904c4000
[pid  4089] mprotect(0x7fd691959000, 1236992, PROT_READ <unfinished ...>
[pid  4035] write(32, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4089] <... mprotect resumed>)     = 0
[pid  4088] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4089] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4088] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 ENOENT (No such file or directory)
[pid  4089] <... prctl resumed>)        = 0
[pid  4082] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4035] <... write resumed>)        = 48
[pid  4089] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4088] getpid( <unfinished ...>
[pid  4082] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4089] <... mmap resumed>)         = 0x1ffffffff000
[pid  4088] <... getpid resumed>)       = 1
[pid  4082] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4089] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4088] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz0", 0777 <unfinished ...>
[pid  4035] read(26 <unfinished ...>
[pid  4089] <... mmap resumed>)         = 0x200000000000
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4089] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4088] <... mkdirat resumed>)      = -1 EEXIST (File exists)
/strace: Process 4092 attached
[pid  4035] write(3, "\xb4\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x03\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 184 <unfinished ...>
[pid  4088] openat(AT_FDCWD, "/syzcgroup/unified/syz0/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4082] <... clone resumed>, child_tidptr=0x55557178c7d0) = 2
[pid  4035] <... write resumed>)        = 184
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fc6347caf000002}], 128, 657, NULL, 0) = 1
[pid  4088] <... openat resumed>)       = 3
[pid  4082] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] kill(4048, SIGKILL <unfinished ...>
[pid  4027] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4089] <... mmap resumed>)         = 0x200001000000
[pid  4088] write(3, "32", 2 <unfinished ...>
[pid  4082] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4092] set_robust_list(0x55557178c7e0, 24 <unfinished ...>
[pid  4035] <... kill resumed>)         = 0
[pid  4027] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4089] rt_sigaction(SIGCHLD, {sa_handler=0x7fd6916f0780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7fd6917de1d0} <unfinished ...>
[pid  4088] <... write resumed>)        = 2
[pid  4027] read(6 <unfinished ...>
[pid  4025] sched_yield( <unfinished ...>
[pid  4092] <... set_robust_list resumed>) = 0
[pid  4089] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4088] close(3 <unfinished ...>
[pid  4092] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4089] pkey_alloc(0, PKEY_UNRESTRICTED <unfinished ...>
[pid  4027] <... read resumed>, "\xb4\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x03\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 21347228) = 184
[pid  4025] <... sched_yield resumed>)  = 0
[pid  4092] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4089] <... pkey_alloc resumed>)   = -1 EINVAL (Invalid argument)
[pid  4088] <... close resumed>)        = 0
[pid  4048] +++ killed by SIGKILL +++
[pid  4052] <... read resumed> <unfinished ...>) = ?
[pid  4027] futex(0x2059c2bff960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4048, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=3 /* 0.03 s */} ---
[pid  4035] rt_sigreturn({mask=[]})     = 4048
[pid  4035] pipe2([10, 15], 0)          = 0
[pid  4035] pipe2( <unfinished ...>
[pid  4089] getrandom( <unfinished ...>
[pid  4035] <... pipe2 resumed>[16, 18], 0) = 0
[pid  4092] chdir("./0" <unfinished ...>
[pid  4089] <... getrandom resumed>"\x1a\x9b\xe5\x6c\x38\x7f\x08\x71", 8, GRND_NONBLOCK) = 8
[pid  4088] openat(AT_FDCWD, "/syzcgroup/unified/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] pipe2( <unfinished ...>
[pid  4034] <... futex resumed>)        = 0
[pid  4027] <... futex resumed>)        = 1
[pid  4092] <... chdir resumed>)        = 0
[pid  4089] mkdir("./syzkaller.G1DqDL", 0700 <unfinished ...>
[pid  4088] <... openat resumed>)       = 3
[pid  4035] <... pipe2 resumed>[20, 37], 0) = 0
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4027] read(6 <unfinished ...>
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4092] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4027] <... read resumed>, 0x2059c4680000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4092] <... prctl resumed>)        = 0
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4092] setpgid(0, 0 <unfinished ...>
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4092] <... setpgid resumed>)      = 0
[pid  4034] futex(0x2059c2bff960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=578346290} <unfinished ...>
[pid  4092] symlinkat("/syzcgroup/unified/syz2", AT_FDCWD, "./cgroup") = 0
[pid  4088] write(3, "1", 1 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] symlinkat("/syzcgroup/cpu/syz2", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... symlinkat resumed>)    = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] symlinkat("/syzcgroup/net/syz2", AT_FDCWD, "./cgroup.net") = 0
[pid  4088] <... write resumed>)        = 1
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4089] <... mkdir resumed>)        = 0
[pid  4088] close(3 <unfinished ...>
[pid  4052] +++ killed by SIGKILL +++
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] chmod("./syzkaller.G1DqDL", 0777 <unfinished ...>
[pid  4088] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... openat resumed>)       = 3
[pid  4089] <... chmod resumed>)        = 0
[pid  4088] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz0", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] write(3, "1000", 4 <unfinished ...>
[pid  4089] chdir("./syzkaller.G1DqDL" <unfinished ...>
[pid  4088] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... write resumed>)        = 4
[pid  4089] <... chdir resumed>)        = 0
[pid  4088] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] close(3 <unfinished ...>
[pid  4089] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4088] <... openat resumed>)       = 3
[pid  4089] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4092] <... close resumed>)        = 0
[pid  4088] write(3, "1", 1 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs" <unfinished ...>
[pid  4089] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... symlinkat resumed>)    = 0
[pid  4089] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4088] <... write resumed>)        = 1
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] close(249 <unfinished ...>
[pid  4089] rt_sigaction(SIGSEGV, {sa_handler=0x7fd6916f2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fd6917de1d0} <unfinished ...>
[pid  4088] close(3 <unfinished ...>
[pid  4092] <... close resumed>)        = 0
[pid  4089] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4088] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4092] close(248 <unfinished ...>
[pid  4089] rt_sigaction(SIGBUS, {sa_handler=0x7fd6916f2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fd6917de1d0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... close resumed>)        = 0
[pid  4089] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4088] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] prctl(PR_SET_NAME, "syz.2.6" <unfinished ...>
[pid  4089] getpid( <unfinished ...>
[pid  4088] write(3, "313524224", 9 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... prctl resumed>)        = 0
[pid  4089] <... getpid resumed>)       = 4089
[pid  4088] <... write resumed>)        = 9
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] mmap(0x1b33664000, 6029312, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0x40000 <unfinished ...>
[pid  4089] mmap(0x1b33520000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0 <unfinished ...>
[pid  4088] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... mmap resumed>)         = 0x1b33664000
[pid  4089] <... mmap resumed>)         = 0x1b33520000
[pid  4088] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] close(4 <unfinished ...>
[pid  4089] getpid( <unfinished ...>
[pid  4088] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... close resumed>)        = 0
[pid  4089] <... getpid resumed>)       = 4089
[pid  4088] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] futex(0x7f389c6a5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4089] mmap(0x1b34524000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0 <unfinished ...>
[pid  4088] write(3, "314572800", 9 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] <... mmap resumed>)         = 0x1b34524000
[pid  4088] <... write resumed>)        = 9
[pid  4089] close(3 <unfinished ...>
[pid  4088] close(3 <unfinished ...>
[pid  4089] <... close resumed>)        = 0
[pid  4088] <... close resumed>)        = 0
[pid  4089] fcntl(5, F_GETFD <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4088] mkdirat(AT_FDCWD, "/syzcgroup/net/syz0", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... futex resumed>)        = 0
[pid  4089] fcntl(6, F_GETFD <unfinished ...>
[pid  4088] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] rt_sigaction(SIGRT_1, {sa_handler=0x7f389c44c3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f389c3ce1d0} <unfinished ...>
[pid  4089] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4088] openat(AT_FDCWD, "/syzcgroup/net/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4089] dup2(0, 249 <unfinished ...>
[pid  4088] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4089] <... dup2 resumed>)         = 249
[pid  4088] write(3, "1", 1 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4089] dup2(1, 248 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4089] <... dup2 resumed>)         = 248
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... mmap resumed>)         = 0x7f389ae67000
[pid  4089] dup2(2, 1)                  = 1
[pid  4089] dup2(2, 0)                  = 0
[pid  4089] read(249, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x12\x38\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4092] mprotect(0x7f389ae68000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4089] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] <... mprotect resumed>)     = 0
[pid  4089] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4089] dup2(3, 216 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4089] <... dup2 resumed>)         = 216
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f389ae87990, parent_tid=0x7f389ae87990, exit_signal=0, stack=0x7f389ae67000, stack_size=0x201c0, tls=0x7f389ae876c0} <unfinished ...>
[pid  4089] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL/strace: Process 4093 attached
 <unfinished ...>
[pid  4089] <... close resumed>)        = 0
[pid  4088] <... write resumed>)        = 1
[pid  4092] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4093] set_robust_list(0x7f389ae879a0, 24 <unfinished ...>
[pid  4089] ioctl(216, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4093] <... set_robust_list resumed>) = 0
[pid  4092] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4088] close(3 <unfinished ...>
[pid  4093] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4092] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4088] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4093] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4092] futex(0x7f389c6a5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4093] ioctl(216, KCOV_ENABLE, 0)  = 0
[pid  4093] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
[pid  4092] <... futex resumed>)        = 0
[pid  4089] <... ioctl resumed>)        = 0
[pid  4088] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4093] futex(0x7f389c6a5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4092] futex(0x7f389c6a5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4089] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4088] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4093] <... futex resumed>)        = 0
[pid  4092] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4089] <... mmap resumed>)         = 0x7fd691296000
[pid  4093] futex(0x7f389c6a5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4088] <... getsockopt resumed>, 0x7f686d3a73e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] mmap(0x7fd691297000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 216, 0 <unfinished ...>
[pid  4088] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... getsockopt resumed>, 0x7f686d3a7a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4088] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO, 0x7f686d3a80e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] close(3)                    = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO, 0x7f686d3a8768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4088] close(3)                    = 0
[pid  4088] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] futex(0x7f389c6a5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4089] <... mmap resumed>)         = 0x7fd691297000
[pid  4088] <... socket resumed>)       = 3
[pid  4093] <... futex resumed>)        = 0
[pid  4092] <... futex resumed>)        = 1
[pid  4089] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4088] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4093] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4088] <... getsockopt resumed>, 0x7f686d3aafc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4088] getsockopt(3, SOL_IP, IPT_SO_GET_INFO, 0x7f686d3ab688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4088] getsockopt(3, SOL_IP, IPT_SO_GET_INFO, 0x7f686d3abd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4088] getsockopt(3, SOL_IP, IPT_SO_GET_INFO, 0x7f686d3ac408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4088] getsockopt(3, SOL_IP, IPT_SO_GET_INFO, 0x7f686d3acac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4088] close(3 <unfinished ...>
[pid  4093] <... mmap resumed>)         = 0x200000000000
[pid  4088] <... close resumed>)        = 0
[pid  4088] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4093] futex(0x7f389c6a5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4092] futex(0x7f389c6a5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4089] <... openat resumed>)       = 3
[pid  4088] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4089] dup2(3, 217 <unfinished ...>
[pid  4088] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4093] <... futex resumed>)        = 0
[pid  4092] futex(0x7f389c6a5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] <... dup2 resumed>)         = 217
[pid  4088] <... getsockopt resumed>, 0x7f686d3a8e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4093] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4089] close(3 <unfinished ...>
[pid  4088] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] <... close resumed>)        = 0
[pid  4088] <... getsockopt resumed>, 0x7f686d3a94c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4093] <... mmap resumed>)         = 0x200001000000
[pid  4092] <... futex resumed>)        = 0
[pid  4089] ioctl(217, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4088] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4093] futex(0x7f389c6a5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] futex(0x7f389c6a5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4093] <... futex resumed>)        = 0
[pid  4092] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4088] <... getsockopt resumed>, 0x7f686d3a9b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4088] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4093] futex(0x7f389c6a5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4088] <... getsockopt resumed>, 0x7f686d3aa248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] close_range(3, 30, 0 <unfinished ...>
[pid  4088] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... getsockopt resumed>, 0x7f686d3aa908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4088] close(3)                    = 0
[pid  4088] write(248, "\x00\x00\x00\x00", 4) = 4
[pid  4088] mkdirat(AT_FDCWD, "./0", 0777) = 0
[pid  4092] <... close_range resumed>)  = 0
[pid  4092] exit_group(0)               = ?
[pid  4093] <... futex resumed>)        = ?
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] openat(AT_FDCWD, "/dev/loop0", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4088] close(3)                    = 0
[pid  4089] <... ioctl resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd690e94000
[pid  4088] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4089] mmap(0x7fd690e95000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 217, 0 <unfinished ...>
[pid  4088] <... socket resumed>)       = 3
[pid  4088] close(3)                    = 0
[pid  4088] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4088] close(3)                    = 0
[pid  4088] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... socket resumed>)       = 3
[pid  4088] close(3)                    = 0
[pid  4088] read(249 <unfinished ...>
[pid  4093] +++ exited with 0 +++
[pid  4092] +++ exited with 0 +++
[pid  4089] <... mmap resumed>)         = 0x7fd690e95000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
[pid  4082] rt_sigreturn({mask=[]})     = 2
[pid  4082] write(248, "\x00\x00\x00\x00", 4) = 4
[pid  4082] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4082] fstat(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] <... openat resumed>)       = 3
[pid  4082] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] getdents64(3 <unfinished ...>
[pid  4089] dup2(3, 218 <unfinished ...>
[pid  4082] <... getdents64 resumed>, 0x55557179f8c0 /* 6 entries */, 32768) = 176
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] <... dup2 resumed>)         = 218
[pid  4082] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4089] close(3)                    = 0
[pid  4082] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4089] ioctl(218, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] unlink("./0/binderfs" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... unlink resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4082] newfstatat(AT_FDCWD, "./0/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4082] unlink("./0/cgroup.net")    = 0
[pid  4082] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4082] newfstatat(AT_FDCWD, "./0/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4082] unlink("./0/cgroup.cpu")    = 0
[pid  4082] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4082] newfstatat(AT_FDCWD, "./0/cgroup" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] <... ioctl resumed>)        = 0
[pid  4089] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4089] <... mmap resumed>)         = 0x7fd690a92000
[pid  4089] mmap(0x7fd690a93000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 218, 0 <unfinished ...>
[pid  4082] unlink("./0/cgroup" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] <... mmap resumed>)         = 0x7fd690a93000
[pid  4089] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR) = 3
[pid  4082] <... unlink resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] dup2(3, 219)                = 219
[pid  4089] close(3)                    = 0
[pid  4089] ioctl(219, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4082] getdents64(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] <... ioctl resumed>)        = 0
[pid  4082] <... getdents64 resumed>, 0x55557179f8c0 /* 0 entries */, 32768) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] unlinkat(AT_FDCWD, "./0", AT_REMOVEDIR) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] mkdirat(AT_FDCWD, "./1", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] <... mmap resumed>)         = 0x7fd690690000
[pid  4082] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] openat(AT_FDCWD, "/dev/loop2", O_RDWR <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] mmap(0x7fd690691000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 219, 0 <unfinished ...>
[pid  4082] <... openat resumed>)       = 3
[pid  4082] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] <... mmap resumed>)         = 0x7fd690691000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] <... openat resumed>)       = 3
[pid  4082] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] dup2(3, 220 <unfinished ...>
[pid  4082] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] <... dup2 resumed>)         = 220
[pid  4082] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] close(3 <unfinished ...>
[pid  4082] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] <... close resumed>)        = 0
[pid  4082] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] ioctl(220, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4082] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4082] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4082] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] <... ioctl resumed>)        = 0
[pid  4082] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4082] read(249 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] <... mmap resumed>)         = 0x7fd69028e000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] mmap(0x7fd69028f000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 220, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] <... mmap resumed>)         = 0x7fd69028f000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] dup2(3, 221)                = 221
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] close(3)                    = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] ioctl(221, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] <... ioctl resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd68fe8c000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] mmap(0x7fd68fe8d000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 221, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] <... mmap resumed>)         = 0x7fd68fe8d000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] dup2(3, 215)                = 215
[pid  4089] close(3)                    = 0
[pid  4089] ioctl(215, KCOV_INIT_TRACE, 0x100000 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] <... ioctl resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] mmap(NULL, 8396800, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] <... mmap resumed>)         = 0x7fd68f68a000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] mmap(0x7fd68f68b000, 8388608, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 215, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] <... mmap resumed>)         = 0x7fd68f68b000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] unshare(CLONE_NEWPID <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL/strace: Process 4094 attached
 <unfinished ...>
[pid  4089] <... clone resumed>, child_tidptr=0x5555904a27d0) = 4094
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] set_robust_list(0x5555904a27e0, 24 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... set_robust_list resumed>) = 0
[pid  4089] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] getppid( <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... getppid resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... openat resumed>)       = 3
[pid  4094] dup2(3, 201 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... dup2 resumed>)         = 201
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... close resumed>)        = 0
[pid  4094] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... prlimit64 resumed>, NULL) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... prlimit64 resumed>, NULL) = 0
[pid  4094] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... prlimit64 resumed>, NULL) = 0
[pid  4094] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... prlimit64 resumed>, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... prlimit64 resumed>, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] unshare(CLONE_NEWNS <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... mount resumed>)        = 0
[pid  4094] unshare(CLONE_NEWIPC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... unshare resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] unshare(CLONE_NEWUTS <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... unshare resumed>)      = 0
[pid  4094] unshare(CLONE_SYSVSEM <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... unshare resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] write(3, "16777216", 8)     = 8
[pid  4094] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... openat resumed>)       = 3
[pid  4094] write(3, "536870912", 9 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... write resumed>)        = 9
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] write(3, "1024", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] write(3, "8192", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... write resumed>)        = 4
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... openat resumed>)       = 3
[pid  4094] write(3, "1024", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... write resumed>)        = 4
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] write(3, "1024", 4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... write resumed>)        = 4
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] write(3, "1024 1048576 500 1024", 21 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... write resumed>)        = 21
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] getpid( <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... getpid resumed>)       = 1
[pid  4094] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... capset resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] unshare(CLONE_NEWNET <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... unshare resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] write(3, "0 65535", 7 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... write resumed>)        = 7
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4094] <... close resumed>)        = 0
[pid  4035] <... mmap resumed>)         = 0x7fd910a37000
[pid  4035] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4094] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3
[pid  4035] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4094] write(3, "100000", 6 <unfinished ...>
[pid  4035] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7fd910a37000, stack_size=0x9000}, 88 <unfinished ...>
[pid  4094] <... write resumed>)        = 6
/strace: Process 4095 attached
[pid  4094] close(3)                    = 0
[pid  4094] mkdirat(AT_FDCWD, "./syz-tmp", 0777 <unfinished ...>
[pid  4095] rt_sigprocmask(SIG_BLOCK, NULL, ~[KILL STOP], 8) = 0
[pid  4094] <... mkdirat resumed>)      = 0
[pid  4095] setpgid(0, 0 <unfinished ...>
[pid  4094] mount("", "./syz-tmp", "tmpfs", 0, NULL <unfinished ...>
[pid  4095] <... setpgid resumed>)      = 0
[pid  4094] <... mount resumed>)        = 0
[pid  4095] dup2(10, 0)                 = 0
[pid  4095] dup2(18, 1 <unfinished ...>
[pid  4094] mkdirat(AT_FDCWD, "./syz-tmp/newroot", 0777 <unfinished ...>
[pid  4095] <... dup2 resumed>)         = 1
[pid  4095] dup2(37, 2 <unfinished ...>
[pid  4094] <... mkdirat resumed>)      = 0
[pid  4095] <... dup2 resumed>)         = 2
[pid  4095] dup2(19, 3)                 = 3
[pid  4094] mkdirat(AT_FDCWD, "./syz-tmp/newroot/dev", 0700 <unfinished ...>
[pid  4095] dup2(22, 4 <unfinished ...>
[pid  4094] <... mkdirat resumed>)      = 0
[pid  4095] <... dup2 resumed>)         = 4
[pid  4095] close(5)                    = 0
[pid  4094] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4095] close(6 <unfinished ...>
[pid  4094] <... mount resumed>)        = 0
[pid  4095] <... close resumed>)        = 0
[pid  4095] close(7 <unfinished ...>
[pid  4094] mkdirat(AT_FDCWD, "./syz-tmp/newroot/proc", 0700 <unfinished ...>
[pid  4095] <... close resumed>)        = 0
[pid  4094] <... mkdirat resumed>)      = 0
[pid  4095] close(8)                    = 0
[pid  4095] close(9)                    = 0
[pid  4095] close(10)                   = 0
[pid  4095] close(11 <unfinished ...>
[pid  4094] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid  4095] <... close resumed>)        = 0
[pid  4094] <... mount resumed>)        = 0
[pid  4095] close(12)                   = 0
[pid  4094] mkdirat(AT_FDCWD, "./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid  4095] close(13 <unfinished ...>
[pid  4094] <... mkdirat resumed>)      = 0
[pid  4095] <... close resumed>)        = 0
[pid  4095] close(14)                   = 0
[pid  4095] close(15)                   = 0
[pid  4095] close(16)                   = 0
[pid  4094] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4095] close(17)                   = 0
[pid  4094] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4095] close(18)                   = 0
[pid  4094] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4095] close(19)                   = 0
[pid  4095] close(20 <unfinished ...>
[pid  4094] <... mount resumed>)        = 0
[pid  4095] <... close resumed>)        = 0
[pid  4095] close(21)                   = 0
[pid  4094] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid  4095] close(22)                   = 0
[pid  4095] close(23)                   = 0
[pid  4095] close(24)                   = 0
[pid  4095] close(25)                   = 0
[pid  4095] close(26)                   = 0
[pid  4095] close(27)                   = 0
[pid  4095] close(28)                   = 0
[pid  4095] close(29)                   = 0
[pid  4095] close(30)                   = 0
[pid  4095] close(31)                   = 0
[pid  4095] close(32)                   = 0
[pid  4094] <... mkdirat resumed>)      = 0
[pid  4095] close(33)                   = 0
[pid  4095] close(34)                   = 0
[pid  4094] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 579, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4095] close(35 <unfinished ...>
[pid  4027] futex(0x2059c2bff960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4095] <... close resumed>)        = 0
[pid  4034] <... futex resumed>)        = 0
[pid  4027] <... futex resumed>)        = 1
[pid  4095] close(36 <unfinished ...>
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4095] <... close resumed>)        = 0
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4034] futex(0x2059c2bff960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=996023582} <unfinished ...>
[pid  4095] close(37)                   = 0
[pid  4095] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4094] <... mount resumed>)        = 0
[pid  4095] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4095] close(39)                   = -1 EBADF (Bad file descriptor)
[pid  4094] <... mount resumed>)        = 0
[pid  4095] close(40)                   = -1 EBADF (Bad file descriptor)
[pid  4094] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4095] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4094] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4094] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4095] close(44 <unfinished ...>
[pid  4094] <... mount resumed>)        = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(45 <unfinished ...>
[pid  4094] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... mkdirat resumed>)      = 0
[pid  4095] close(46)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(47)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(48)                   = -1 EBADF (Bad file descriptor)
[pid  4094] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4095] close(49)                   = -1 EBADF (Bad file descriptor)
[pid  4094] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4095] close(50)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(51 <unfinished ...>
[pid  4094] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... mkdirat resumed>)      = 0
[pid  4095] close(52)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(53)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(54)                   = -1 EBADF (Bad file descriptor)
[pid  4094] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4095] close(55 <unfinished ...>
[pid  4094] <... mkdirat resumed>)      = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(56)                   = -1 EBADF (Bad file descriptor)
[pid  4094] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700 <unfinished ...>
[pid  4095] close(57 <unfinished ...>
[pid  4094] <... mkdirat resumed>)      = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(58)                   = -1 EBADF (Bad file descriptor)
[pid  4094] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4095] close(59 <unfinished ...>
[pid  4094] <... mkdirat resumed>)      = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(60 <unfinished ...>
[pid  4094] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... mount resumed>)        = 0
[pid  4095] close(61)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(62)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(63 <unfinished ...>
[pid  4094] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... mount resumed>)        = 0
[pid  4095] close(64)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(65 <unfinished ...>
[pid  4094] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... mount resumed>)        = 0
[pid  4095] close(66)                   = -1 EBADF (Bad file descriptor)
[pid  4094] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4095] close(67 <unfinished ...>
[pid  4094] <... mkdirat resumed>)      = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(68)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4094] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4095] close(70 <unfinished ...>
[pid  4094] <... pivot_root resumed>)   = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(71 <unfinished ...>
[pid  4094] chdir("/" <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... chdir resumed>)        = 0
[pid  4095] close(72 <unfinished ...>
[pid  4094] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(75)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(76 <unfinished ...>
[pid  4094] <... umount2 resumed>)      = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(77)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(79)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(80 <unfinished ...>
[pid  4094] chroot("./newroot" <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(81 <unfinished ...>
[pid  4094] <... chroot resumed>)       = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(82 <unfinished ...>
[pid  4094] chdir("/" <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... chdir resumed>)        = 0
[pid  4095] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4094] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4095] close(84 <unfinished ...>
[pid  4094] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4095] close(85)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(86)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(87)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(88)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(89)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(90)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(92)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(93)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(94)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(95)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(96)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(98)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(99)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(102)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(104)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(106)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(110)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4094] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4095] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4094] mkdirat(AT_FDCWD, "/dev/binderfs", 0777 <unfinished ...>
[pid  4095] close(118)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(119)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(120 <unfinished ...>
[pid  4094] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(121 <unfinished ...>
[pid  4094] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4094] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4095] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4094] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4095] close(128 <unfinished ...>
[pid  4094] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(129 <unfinished ...>
[pid  4094] getpid( <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... getpid resumed>)       = 1
[pid  4095] close(130 <unfinished ...>
[pid  4094] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz1", 0777 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4095] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4094] openat(AT_FDCWD, "/syzcgroup/unified/syz1/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4095] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(134)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(135)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4094] <... openat resumed>)       = 3
[pid  4095] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(140 <unfinished ...>
[pid  4094] write(3, "32", 2 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(142)                  = -1 EBADF (Bad file descriptor)
[pid  4094] <... write resumed>)        = 2
[pid  4095] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4094] close(3 <unfinished ...>
[pid  4095] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(146 <unfinished ...>
[pid  4094] <... close resumed>)        = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(154)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(155)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(158 <unfinished ...>
[pid  4094] openat(AT_FDCWD, "/syzcgroup/unified/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4094] <... openat resumed>)       = 3
[pid  4095] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(163)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(164)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4094] write(3, "1", 1 <unfinished ...>
[pid  4095] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4094] <... write resumed>)        = 1
[pid  4095] close(168 <unfinished ...>
[pid  4094] close(3 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... close resumed>)        = 0
[pid  4095] close(169 <unfinished ...>
[pid  4094] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz1", 0777 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4095] close(170 <unfinished ...>
[pid  4094] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... openat resumed>)       = 3
[pid  4095] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4094] write(3, "1", 1 <unfinished ...>
[pid  4095] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4094] <... write resumed>)        = 1
[pid  4095] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(175 <unfinished ...>
[pid  4094] close(3 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(176 <unfinished ...>
[pid  4094] <... close resumed>)        = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4095] close(177 <unfinished ...>
[pid  4094] <... openat resumed>)       = 3
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] write(3, "313524224", 9 <unfinished ...>
[pid  4095] close(178 <unfinished ...>
[pid  4094] <... write resumed>)        = 9
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] close(3)                    = 0
[pid  4094] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4095] close(179 <unfinished ...>
[pid  4094] <... openat resumed>)       = 3
[pid  4094] write(3, "314572800", 9)    = 9
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] close(3 <unfinished ...>
[pid  4095] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4094] <... close resumed>)        = 0
[pid  4095] close(181 <unfinished ...>
[pid  4094] mkdirat(AT_FDCWD, "/syzcgroup/net/syz1", 0777 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4094] openat(AT_FDCWD, "/syzcgroup/net/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3
[pid  4095] close(182 <unfinished ...>
[pid  4094] write(3, "1", 1 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... write resumed>)        = 1
[pid  4095] close(183 <unfinished ...>
[pid  4094] close(3 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(184)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(185 <unfinished ...>
[pid  4094] <... close resumed>)        = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4095] close(186 <unfinished ...>
[pid  4094] <... socket resumed>)       = 3
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4095] close(187 <unfinished ...>
[pid  4094] <... getsockopt resumed>, 0x7fd691a873e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO, 0x7fd691a87a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4094] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO, 0x7fd691a880e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4094] close(3)                    = 0
[pid  4094] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4095] close(188)                  = -1 EBADF (Bad file descriptor)
[pid  4094] <... socket resumed>)       = 3
[pid  4095] close(189 <unfinished ...>
[pid  4094] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... getsockopt resumed>, 0x7fd691a88768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4095] close(190 <unfinished ...>
[pid  4094] close(3 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(191 <unfinished ...>
[pid  4094] <... close resumed>)        = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4095] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(193 <unfinished ...>
[pid  4094] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... getsockopt resumed>, 0x7fd691a8afc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4095] close(194)                  = -1 EBADF (Bad file descriptor)
[pid  4094] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4095] close(195 <unfinished ...>
[pid  4094] <... getsockopt resumed>, 0x7fd691a8b688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(196 <unfinished ...>
[pid  4094] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... getsockopt resumed>, 0x7fd691a8bd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4095] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4094] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4095] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4094] <... getsockopt resumed>, 0x7fd691a8c408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4095] close(200 <unfinished ...>
[pid  4094] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... getsockopt resumed>, 0x7fd691a8cac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4095] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4094] close(3 <unfinished ...>
[pid  4095] close(202 <unfinished ...>
[pid  4094] <... close resumed>)        = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4095] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(204)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(205 <unfinished ...>
[pid  4094] <... socket resumed>)       = 3
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(206 <unfinished ...>
[pid  4094] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... getsockopt resumed>, 0x7fd691a88e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4095] close(207 <unfinished ...>
[pid  4094] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... getsockopt resumed>, 0x7fd691a894c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4095] close(208 <unfinished ...>
[pid  4094] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... getsockopt resumed>, 0x7fd691a89b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4095] close(209 <unfinished ...>
[pid  4094] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(210 <unfinished ...>
[pid  4094] <... getsockopt resumed>, 0x7fd691a8a248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4095] close(211 <unfinished ...>
[pid  4094] <... getsockopt resumed>, 0x7fd691a8a908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] close(3 <unfinished ...>
[pid  4095] close(212 <unfinished ...>
[pid  4094] <... close resumed>)        = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4095] close(213)                  = -1 EBADF (Bad file descriptor)
[pid  4094] <... write resumed>)        = 4
[pid  4095] close(214 <unfinished ...>
[pid  4094] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(215 <unfinished ...>
[pid  4094] <... mkdirat resumed>)      = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(216 <unfinished ...>
[pid  4094] openat(AT_FDCWD, "/dev/loop1", O_RDWR <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(217 <unfinished ...>
[pid  4094] <... openat resumed>)       = 3
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(218 <unfinished ...>
[pid  4094] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4095] close(219 <unfinished ...>
[pid  4094] close(3 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(220 <unfinished ...>
[pid  4094] <... close resumed>)        = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(223)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(224)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(225)                  = -1 EBADF (Bad file descriptor)
[pid  4094] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4095] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4094] <... socket resumed>)       = 3
[pid  4095] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(228)                  = -1 EBADF (Bad file descriptor)
[pid  4094] close(3 <unfinished ...>
[pid  4095] close(229 <unfinished ...>
[pid  4094] <... close resumed>)        = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4095] close(230 <unfinished ...>
[pid  4094] <... socket resumed>)       = 3
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(231 <unfinished ...>
[pid  4094] close(3 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... close resumed>)        = 0
[pid  4095] close(232 <unfinished ...>
[pid  4094] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(233)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(234)                  = -1 EBADF (Bad file descriptor)
[pid  4094] <... socket resumed>)       = 3
[pid  4095] close(235)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(236)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(237 <unfinished ...>
[pid  4094] close(3 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... close resumed>)        = 0
[pid  4095] close(238 <unfinished ...>
[pid  4094] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4094] <... socket resumed>)       = 3
[pid  4095] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4094] close(3 <unfinished ...>
[pid  4095] close(240 <unfinished ...>
[pid  4094] <... close resumed>)        = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(241)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4094] read(249 <unfinished ...>
[pid  4095] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(244)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(245)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(246)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(247)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(248)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(251)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(252)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(253)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4095] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4095] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffe3fa80e70 /* 2 vars */ <unfinished ...>
[pid  4035] <... clone3 resumed>)       = 4095
[pid  4035] munmap(0x7fd910a37000, 36864 <unfinished ...>
[pid  4095] <... execve resumed>)       = 0
[pid  4035] <... munmap resumed>)       = 0
[pid  4035] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4095] brk(NULL <unfinished ...>
[pid  4035] fcntl(16, F_GETFL <unfinished ...>
[pid  4095] <... brk resumed>)          = 0x55559373d000
[pid  4095] brk(0x55559373de80 <unfinished ...>
[pid  4035] <... fcntl resumed>)        = 0 (flags O_RDONLY)
[pid  4035] fcntl(16, F_SETFL, O_RDONLY|O_NONBLOCK <unfinished ...>
[pid  4095] <... brk resumed>)          = 0x55559373de80
[pid  4035] <... fcntl resumed>)        = 0
[pid  4035] fcntl(20, F_GETFL <unfinished ...>
[pid  4095] arch_prctl(ARCH_SET_FS, 0x55559373d500 <unfinished ...>
[pid  4035] <... fcntl resumed>)        = 0 (flags O_RDONLY)
[pid  4095] <... arch_prctl resumed>)   = 0
[pid  4035] fcntl(20, F_SETFL, O_RDONLY|O_NONBLOCK <unfinished ...>
[pid  4095] set_tid_address(0x55559373d7d0) = 4095
[pid  4035] <... fcntl resumed>)        = 0
[pid  4095] set_robust_list(0x55559373d7e0, 24) = 0
[pid  4035] close(10)                   = 0
[pid  4035] close(18)                   = 0
[pid  4095] prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4035] close(37)                   = 0
[pid  4095] readlinkat(AT_FDCWD, "/proc/self/exe" <unfinished ...>
[pid  4035] close(25)                   = 0
[pid  4035] close(26 <unfinished ...>
[pid  4095] <... readlinkat resumed>, "/syz-executor", 4096) = 13
[pid  4035] <... close resumed>)        = 0
[pid  4095] getrandom( <unfinished ...>
[pid  4035] close(28 <unfinished ...>
[pid  4095] <... getrandom resumed>"\xaa\x07\xbe\xf8\x9c\xc2\x55\xbf", 8, GRND_NONBLOCK) = 8
[pid  4035] <... close resumed>)        = 0
[pid  4095] brk(NULL)                   = 0x55559373de80
[pid  4035] write(15, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x12\x39\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64 <unfinished ...>
[pid  4095] brk(0x55559375ee80 <unfinished ...>
[pid  4035] <... write resumed>)        = 64
[pid  4095] <... brk resumed>)          = 0x55559375ee80
[pid  4035] read(31 <unfinished ...>
[pid  4095] brk(0x55559375f000 <unfinished ...>
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4095] <... brk resumed>)          = 0x55559375f000
[pid  4035] write(3, "\xb4\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x04\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 184 <unfinished ...>
[pid  4095] mprotect(0x7f9055669000, 1236992, PROT_READ <unfinished ...>
[pid  4035] <... write resumed>)        = 184
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fc6347caf000002}], 128, 996, NULL, 0) = 1
[pid  4035] kill(4049, SIGKILL <unfinished ...>
[pid  4027] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1) = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4095] <... mprotect resumed>)     = 0
[pid  4027] read(6 <unfinished ...>
[pid  4025] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4095] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4035] <... kill resumed>)         = 0
[pid  4027] <... read resumed>, "\xb4\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x04\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 21347228) = 184
[pid  4025] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4027] futex(0x2059c2bff960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4034] <... futex resumed>)        = 0
[pid  4027] <... futex resumed>)        = 1
[pid  4095] <... prctl resumed>)        = 0
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4027] read(6 <unfinished ...>
[pid  4095] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4027] <... read resumed>, 0x2059c4680000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4095] <... mmap resumed>)         = 0x1ffffffff000
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4095] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4034] futex(0x2059c2bff960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4095] <... mmap resumed>)         = 0x200000000000
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=543200779} <unfinished ...>
[pid  4095] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4053] <... read resumed> <unfinished ...>) = ?
[pid  4049] +++ killed by SIGKILL +++
[pid  4095] <... mmap resumed>)         = 0x200001000000
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4049, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=2 /* 0.02 s */} ---
[pid  4095] rt_sigaction(SIGCHLD, {sa_handler=0x7f9055400780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f90554ee1d0} <unfinished ...>
[pid  4035] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4095] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4035] <... rt_sigreturn resumed>) = 4049
[pid  4095] pkey_alloc(0, PKEY_UNRESTRICTED <unfinished ...>
[pid  4035] pipe2( <unfinished ...>
[pid  4095] <... pkey_alloc resumed>)   = -1 EINVAL (Invalid argument)
[pid  4035] <... pipe2 resumed>[10, 18], 0) = 0
[pid  4095] getrandom( <unfinished ...>
[pid  4035] pipe2( <unfinished ...>
[pid  4095] <... getrandom resumed>"\x84\x83\x50\x94\xd2\x9a\xa4\x9e", 8, GRND_NONBLOCK) = 8
[pid  4035] <... pipe2 resumed>[25, 26], 0) = 0
[pid  4095] mkdir("./syzkaller.gR7lQL", 0700 <unfinished ...>
[pid  4035] pipe2([28, 37], 0)          = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... mkdir resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] chmod("./syzkaller.gR7lQL", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... chmod resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] chdir("./syzkaller.gR7lQL" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... chdir resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] rt_sigaction(SIGSEGV, {sa_handler=0x7f9055402b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f90554ee1d0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4053] +++ killed by SIGKILL +++
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] rt_sigaction(SIGBUS, {sa_handler=0x7f9055402b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f90554ee1d0} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] getpid( <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... getpid resumed>)       = 4095
[pid  4095] mmap(0x1b33b20000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... mmap resumed>)         = 0x1b33b20000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] getpid( <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... getpid resumed>)       = 4095
[pid  4095] mmap(0x1b34b24000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... mmap resumed>)         = 0x1b34b24000
[pid  4095] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] fcntl(5, F_GETFD <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] fcntl(6, F_GETFD <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] dup2(0, 249 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... dup2 resumed>)         = 249
[pid  4095] dup2(1, 248 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... dup2 resumed>)         = 248
[pid  4095] dup2(2, 1 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... dup2 resumed>)         = 1
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] dup2(2, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... dup2 resumed>)         = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] read(249 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x12\x39\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] dup2(3, 216 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... dup2 resumed>)         = 216
[pid  4095] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... close resumed>)        = 0
[pid  4095] ioctl(216, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... ioctl resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... mmap resumed>)         = 0x7f9054fae000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] mmap(0x7f9054faf000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 216, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... mmap resumed>)         = 0x7f9054faf000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... openat resumed>)       = 3
[pid  4095] dup2(3, 217 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... dup2 resumed>)         = 217
[pid  4095] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... close resumed>)        = 0
[pid  4095] ioctl(217, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... ioctl resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9054bac000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] mmap(0x7f9054bad000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 217, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... mmap resumed>)         = 0x7f9054bad000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR) = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] dup2(3, 218 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... dup2 resumed>)         = 218
[pid  4095] close(3)                    = 0
[pid  4095] ioctl(218, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... ioctl resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... mmap resumed>)         = 0x7f90547aa000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] mmap(0x7f90547ab000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 218, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... mmap resumed>)         = 0x7f90547ab000
[pid  4095] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] dup2(3, 219)                = 219
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] ioctl(219, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... ioctl resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... mmap resumed>)         = 0x7f90543a8000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] mmap(0x7f90543a9000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 219, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... mmap resumed>)         = 0x7f90543a9000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] dup2(3, 220)                = 220
[pid  4095] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... close resumed>)        = 0
[pid  4095] ioctl(220, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... ioctl resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... mmap resumed>)         = 0x7f9053fa6000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] mmap(0x7f9053fa7000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 220, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... mmap resumed>)         = 0x7f9053fa7000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR) = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] dup2(3, 221 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... dup2 resumed>)         = 221
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] close(3)                    = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] ioctl(221, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... ioctl resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... mmap resumed>)         = 0x7f9053ba4000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] mmap(0x7f9053ba5000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 221, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... mmap resumed>)         = 0x7f9053ba5000
[pid  4095] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] dup2(3, 215 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... dup2 resumed>)         = 215
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] ioctl(215, KCOV_INIT_TRACE, 0x100000 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... ioctl resumed>)        = 0
[pid  4095] mmap(NULL, 8396800, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... mmap resumed>)         = 0x7f90533a2000
[pid  4095] mmap(0x7f90533a3000, 8388608, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 215, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... mmap resumed>)         = 0x7f90533a3000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] ioctl(215, KCOV_REMOTE_ENABLE, 0x7ffdee962c90 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... ioctl resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] unshare(CLONE_NEWPID <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
/strace: Process 4098 attached
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4095] <... clone resumed>, child_tidptr=0x55559373d7d0) = 4098
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] set_robust_list(0x55559373d7e0, 24 <unfinished ...>
[pid  4095] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... set_robust_list resumed>) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... prctl resumed>)        = 0
[pid  4098] getppid()                   = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] dup2(3, 201 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... dup2 resumed>)         = 201
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... prlimit64 resumed>, NULL) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... prlimit64 resumed>, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... prlimit64 resumed>, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... prlimit64 resumed>, NULL) = 0
[pid  4098] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... prlimit64 resumed>, NULL) = 0
[pid  4098] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... prlimit64 resumed>, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] unshare(CLONE_NEWNS <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... unshare resumed>)      = 0
[pid  4098] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... mount resumed>)        = 0
[pid  4098] unshare(CLONE_NEWIPC)       = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] unshare(CLONE_NEWUTS <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... unshare resumed>)      = 0
[pid  4098] unshare(CLONE_SYSVSEM <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] write(3, "16777216", 8 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... write resumed>)        = 8
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] write(3, "536870912", 9)    = 9
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] write(3, "1024", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... write resumed>)        = 4
[pid  4098] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] write(3, "8192", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] write(3, "1024", 4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... write resumed>)        = 4
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... openat resumed>)       = 3
[pid  4098] write(3, "1024", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... close resumed>)        = 0
[pid  4098] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] write(3, "1024 1048576 500 1024", 21 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... write resumed>)        = 21
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] getpid()                    = 1
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... capset resumed>)       = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] unshare(CLONE_NEWNET <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] write(3, "0 65535", 7 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... write resumed>)        = 7
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... close resumed>)        = 0
[pid  4098] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] write(3, "100000", 6 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... write resumed>)        = 6
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] mkdirat(AT_FDCWD, "./syz-tmp", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] mount("", "./syz-tmp", "tmpfs", 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] <... mount resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] mkdirat(AT_FDCWD, "./syz-tmp/newroot", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4098] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fd910a37000
[pid  4098] mkdirat(AT_FDCWD, "./syz-tmp/newroot/dev", 0700 <unfinished ...>
[pid  4035] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4098] <... mkdirat resumed>)      = 0
[pid  4035] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7fd910a37000, stack_size=0x9000}, 88 <unfinished ...>
[pid  4098] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL/strace: Process 4099 attached
) = 0
[pid  4099] rt_sigprocmask(SIG_BLOCK, NULL <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 543, NULL, 0) = 0
[pid  4099] <... rt_sigprocmask resumed>, ~[KILL STOP], 8) = 0
[pid  4098] mkdirat(AT_FDCWD, "./syz-tmp/newroot/proc", 0700 <unfinished ...>
[pid  4027] futex(0x2059c2bff960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4099] setpgid(0, 0 <unfinished ...>
[pid  4098] <... mkdirat resumed>)      = 0
[pid  4034] <... futex resumed>)        = 0
[pid  4027] <... futex resumed>)        = 1
[pid  4099] <... setpgid resumed>)      = 0
[pid  4034] epoll_pwait(4, [], 128, 0, NULL, 0) = 0
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4027] futex(0x2059c04dd160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4099] dup2(10, 0 <unfinished ...>
[pid  4098] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid  4099] <... dup2 resumed>)         = 0
[pid  4099] dup2(26, 1 <unfinished ...>
[pid  4098] <... mount resumed>)        = 0
[pid  4099] <... dup2 resumed>)         = 1
[pid  4099] dup2(37, 2)                 = 2
[pid  4099] dup2(24, 3)                 = 3
[pid  4099] dup2(27, 4)                 = 4
[pid  4098] mkdirat(AT_FDCWD, "./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4099] close(5)                    = 0
[pid  4098] <... mkdirat resumed>)      = 0
[pid  4099] close(6)                    = 0
[pid  4099] close(7)                    = 0
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=980577975} <unfinished ...>
[pid  4099] close(8 <unfinished ...>
[pid  4098] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4099] <... close resumed>)        = 0
[pid  4098] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4099] close(9)                    = 0
[pid  4099] close(10 <unfinished ...>
[pid  4098] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  4099] <... close resumed>)        = 0
[pid  4099] close(11 <unfinished ...>
[pid  4098] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid  4099] <... close resumed>)        = 0
[pid  4098] <... mkdirat resumed>)      = 0
[pid  4099] close(12)                   = 0
[pid  4099] close(13)                   = 0
[pid  4099] close(14)                   = 0
[pid  4099] close(15 <unfinished ...>
[pid  4098] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4099] <... close resumed>)        = 0
[pid  4098] <... mount resumed>)        = 0
[pid  4099] close(16)                   = 0
[pid  4099] close(17)                   = 0
[pid  4099] close(18 <unfinished ...>
[pid  4098] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4099] <... close resumed>)        = 0
[pid  4098] <... mount resumed>)        = 0
[pid  4099] close(19)                   = 0
[pid  4099] close(20)                   = 0
[pid  4099] close(21 <unfinished ...>
[pid  4098] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4099] <... close resumed>)        = 0
[pid  4098] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4099] close(22)                   = 0
[pid  4099] close(23 <unfinished ...>
[pid  4098] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4099] <... close resumed>)        = 0
[pid  4098] <... mount resumed>)        = 0
[pid  4099] close(24)                   = 0
[pid  4098] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4099] close(25 <unfinished ...>
[pid  4098] <... mkdirat resumed>)      = 0
[pid  4099] <... close resumed>)        = 0
[pid  4099] close(26)                   = 0
[pid  4099] close(27)                   = 0
[pid  4099] close(28)                   = 0
[pid  4099] close(29)                   = 0
[pid  4098] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4099] close(30 <unfinished ...>
[pid  4098] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4099] <... close resumed>)        = 0
[pid  4099] close(31)                   = 0
[pid  4099] close(32)                   = 0
[pid  4099] close(33 <unfinished ...>
[pid  4098] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700 <unfinished ...>
[pid  4099] <... close resumed>)        = 0
[pid  4098] <... mkdirat resumed>)      = 0
[pid  4099] close(34)                   = 0
[pid  4098] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4099] close(35 <unfinished ...>
[pid  4098] <... mkdirat resumed>)      = 0
[pid  4099] <... close resumed>)        = 0
[pid  4099] close(36)                   = 0
[pid  4099] close(37)                   = 0
[pid  4099] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4099] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4098] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700 <unfinished ...>
[pid  4099] close(39)                   = -1 EBADF (Bad file descriptor)
[pid  4098] <... mkdirat resumed>)      = 0
[pid  4099] close(40)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(44 <unfinished ...>
[pid  4098] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4098] <... mkdirat resumed>)      = 0
[pid  4099] close(45)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(46)                   = -1 EBADF (Bad file descriptor)
[pid  4098] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  4099] close(47)                   = -1 EBADF (Bad file descriptor)
[pid  4098] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4099] close(48 <unfinished ...>
[pid  4098] <... mount resumed>)        = 0
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(49)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(50 <unfinished ...>
[pid  4098] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4098] <... mount resumed>)        = 0
[pid  4099] close(51)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(52)                   = -1 EBADF (Bad file descriptor)
[pid  4098] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4099] close(53 <unfinished ...>
[pid  4098] <... mkdirat resumed>)      = 0
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(54 <unfinished ...>
[pid  4098] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4098] <... pivot_root resumed>)   = 0
[pid  4099] close(55)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(56)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(57)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(58)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(59)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(60)                   = -1 EBADF (Bad file descriptor)
[pid  4098] chdir("/" <unfinished ...>
[pid  4099] close(61 <unfinished ...>
[pid  4098] <... chdir resumed>)        = 0
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4098] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4099] close(62)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(63)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(64 <unfinished ...>
[pid  4098] <... umount2 resumed>)      = 0
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(65)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(66)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(67)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(68 <unfinished ...>
[pid  4098] chroot("./newroot" <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4098] <... chroot resumed>)       = 0
[pid  4099] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4098] chdir("/" <unfinished ...>
[pid  4099] close(70 <unfinished ...>
[pid  4098] <... chdir resumed>)        = 0
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(71)                   = -1 EBADF (Bad file descriptor)
[pid  4098] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4099] close(72 <unfinished ...>
[pid  4098] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4098] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4099] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(75)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(76)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(77)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(79)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(80)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(81)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(82)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(84)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(85)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(86)                   = -1 EBADF (Bad file descriptor)
[pid  4098] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4099] close(87)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(88)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(89)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(90 <unfinished ...>
[pid  4098] mkdirat(AT_FDCWD, "/dev/binderfs", 0777 <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4098] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4099] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(92)                   = -1 EBADF (Bad file descriptor)
[pid  4098] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4099] close(93)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(94)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(95)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(96)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(98)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(99)                   = -1 EBADF (Bad file descriptor)
[pid  4099] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(102)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(104)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(106)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(110)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(118)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(119)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(120)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(129 <unfinished ...>
[pid  4098] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(130 <unfinished ...>
[pid  4098] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4098] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4099] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(134 <unfinished ...>
[pid  4098] getpid( <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(135 <unfinished ...>
[pid  4098] <... getpid resumed>)       = 1
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(136 <unfinished ...>
[pid  4098] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz3", 0777 <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(137 <unfinished ...>
[pid  4098] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(138 <unfinished ...>
[pid  4098] openat(AT_FDCWD, "/syzcgroup/unified/syz3/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4098] <... openat resumed>)       = 3
[pid  4099] close(142)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(154)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(155)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(158)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4098] write(3, "32", 2 <unfinished ...>
[pid  4099] close(160 <unfinished ...>
[pid  4098] <... write resumed>)        = 2
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4098] close(3 <unfinished ...>
[pid  4099] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4098] <... close resumed>)        = 0
[pid  4099] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(163 <unfinished ...>
[pid  4098] openat(AT_FDCWD, "/syzcgroup/unified/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(164 <unfinished ...>
[pid  4098] <... openat resumed>)       = 3
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4098] write(3, "1", 1 <unfinished ...>
[pid  4099] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4098] <... write resumed>)        = 1
[pid  4099] close(168 <unfinished ...>
[pid  4098] close(3 <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4098] <... close resumed>)        = 0
[pid  4099] close(169 <unfinished ...>
[pid  4098] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz3", 0777 <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4098] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4099] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4098] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4099] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(181 <unfinished ...>
[pid  4098] <... openat resumed>)       = 3
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4098] write(3, "1", 1 <unfinished ...>
[pid  4099] close(182 <unfinished ...>
[pid  4098] <... write resumed>)        = 1
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4098] close(3 <unfinished ...>
[pid  4099] close(183 <unfinished ...>
[pid  4098] <... close resumed>)        = 0
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4098] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4099] close(184)                  = -1 EBADF (Bad file descriptor)
[pid  4098] <... openat resumed>)       = 3
[pid  4099] close(185 <unfinished ...>
[pid  4098] write(3, "313524224", 9 <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4098] <... write resumed>)        = 9
[pid  4099] close(186)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(188 <unfinished ...>
[pid  4098] close(3 <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(189)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(190)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(191)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4098] <... close resumed>)        = 0
[pid  4099] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4098] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4099] close(194)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(195)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(196)                  = -1 EBADF (Bad file descriptor)
[pid  4098] <... openat resumed>)       = 3
[pid  4099] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(199 <unfinished ...>
[pid  4098] write(3, "314572800", 9 <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(200 <unfinished ...>
[pid  4098] <... write resumed>)        = 9
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(202)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4098] close(3 <unfinished ...>
[pid  4099] close(204)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(205)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(206)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(207)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(208)                  = -1 EBADF (Bad file descriptor)
[pid  4098] <... close resumed>)        = 0
[pid  4099] close(209)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(210)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(211)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(213)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(214)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(215)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(216)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(217)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(218)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(219)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(220)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(223)                  = -1 EBADF (Bad file descriptor)
[pid  4098] mkdirat(AT_FDCWD, "/syzcgroup/net/syz3", 0777 <unfinished ...>
[pid  4099] close(224)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(225)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4098] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4099] close(228)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(229)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(230)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(231 <unfinished ...>
[pid  4098] openat(AT_FDCWD, "/syzcgroup/net/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(232 <unfinished ...>
[pid  4098] <... openat resumed>)       = 3
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(233 <unfinished ...>
[pid  4098] write(3, "1", 1 <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(234 <unfinished ...>
[pid  4098] <... write resumed>)        = 1
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(235 <unfinished ...>
[pid  4098] close(3 <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(236)                  = -1 EBADF (Bad file descriptor)
[pid  4098] <... close resumed>)        = 0
[pid  4099] close(237)                  = -1 EBADF (Bad file descriptor)
[pid  4098] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4099] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(240)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(241 <unfinished ...>
[pid  4098] <... socket resumed>)       = 3
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(242 <unfinished ...>
[pid  4098] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(244 <unfinished ...>
[pid  4098] <... getsockopt resumed>, 0x7f90557973e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(245 <unfinished ...>
[pid  4098] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(246)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(247)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(248 <unfinished ...>
[pid  4098] <... getsockopt resumed>, 0x7f9055797a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(250 <unfinished ...>
[pid  4098] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(251)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(252 <unfinished ...>
[pid  4098] <... getsockopt resumed>, 0x7f90557980e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4099] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] close(253)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4099] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4098] close(3 <unfinished ...>
[pid  4099] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4099] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffe3fa80e70 /* 2 vars */ <unfinished ...>
[pid  4098] <... close resumed>)        = 0
[pid  4035] <... clone3 resumed>)       = 4099
[pid  4035] munmap(0x7fd910a37000, 36864) = 0
[pid  4035] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4035] fcntl(25, F_GETFL <unfinished ...>
[pid  4098] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... fcntl resumed>)        = 0 (flags O_RDONLY)
[pid  4035] fcntl(25, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] fcntl(28, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(28, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] close(10 <unfinished ...>
[pid  4098] <... socket resumed>)       = 3
[pid  4035] <... close resumed>)        = 0
[pid  4035] close(26 <unfinished ...>
[pid  4098] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4035] <... close resumed>)        = 0
[pid  4099] <... execve resumed>)       = 0
[pid  4098] <... getsockopt resumed>, 0x7f9055798768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] close(37)                   = 0
[pid  4035] close(30)                   = 0
[pid  4035] close(31 <unfinished ...>
[pid  4098] close(3 <unfinished ...>
[pid  4035] <... close resumed>)        = 0
[pid  4099] brk(NULL <unfinished ...>
[pid  4098] <... close resumed>)        = 0
[pid  4035] close(33 <unfinished ...>
[pid  4099] <... brk resumed>)          = 0x55557c399000
[pid  4098] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... close resumed>)        = 0
[pid  4099] brk(0x55557c399e80 <unfinished ...>
[pid  4035] write(18, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\x3c\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64 <unfinished ...>
[pid  4099] <... brk resumed>)          = 0x55557c399e80
[pid  4035] <... write resumed>)        = 64
[pid  4035] pselect6(37, [3 13 16 20 23 25 28 29 34 35 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4099] arch_prctl(ARCH_SET_FS, 0x55557c399500 <unfinished ...>
[pid  4035] <... pselect6 resumed>)     = 4 (in [3 13 23 34], left {tv_sec=0, tv_nsec=999982080})
[pid  4035] read(3, "\xbc\x00\x00\x00", 4) = 4
[pid  4099] <... arch_prctl resumed>)   = 0
[pid  4035] read(3 <unfinished ...>
[pid  4099] set_tid_address(0x55557c3997d0 <unfinished ...>
[pid  4035] <... read resumed>, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x10\x38\x01\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4099] <... set_tid_address resumed>) = 4099
[pid  4035] read(23 <unfinished ...>
[pid  4099] set_robust_list(0x55557c3997e0, 24 <unfinished ...>
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4099] <... set_robust_list resumed>) = 0
[pid  4099] prlimit64(0, RLIMIT_STACK, NULL <unfinished ...>
[pid  4035] write(3, "\x2c\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x0e\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x00\x00\x06\x00\x0c\x00\x04\x00\x06\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4099] <... prlimit64 resumed>, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4098] <... socket resumed>)       = 3
[pid  4034] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fc6347caf000002}], 128, 993, NULL, 0) = 1
[pid  4099] readlinkat(AT_FDCWD, "/proc/self/exe" <unfinished ...>
[pid  4034] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4099] <... readlinkat resumed>, "/syz-executor", 4096) = 13
[pid  4034] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4098] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] <... write resumed>)        = 48
[pid  4034] read(6 <unfinished ...>
[pid  4099] getrandom( <unfinished ...>
[pid  4035] write(21, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4034] <... read resumed>, "\x2c\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x0e\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x00\x00\x06\x00\x0c\x00\x04\x00\x06\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00", 21347228) = 48
[pid  4099] <... getrandom resumed>"\x90\xec\xa7\x43\xc0\xdd\x61\x46", 8, GRND_NONBLOCK) = 8
[pid  4088] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4035] <... write resumed>)        = 48
[pid  4034] read(6 <unfinished ...>
[pid  4099] brk(NULL <unfinished ...>
[pid  4088] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] read(13 <unfinished ...>
[pid  4034] <... read resumed>, 0x2059c4680000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4099] <... brk resumed>)          = 0x55557c399e80
[pid  4098] <... getsockopt resumed>, 0x7f905579afc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4088] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4099] brk(0x55557c3bae80 <unfinished ...>
[pid  4088] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4035] write(3, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x01\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00", 56 <unfinished ...>
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4098] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4099] <... brk resumed>)          = 0x55557c3bae80
[pid  4098] <... getsockopt resumed>, 0x7f905579b688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... write resumed>)        = 56
[pid  4099] brk(0x55557c3bb000 <unfinished ...>
[pid  4035] write(11, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=660569941} <unfinished ...>
[pid  4099] <... brk resumed>)          = 0x55557c3bb000
[pid  4035] <... write resumed>)        = 48
[pid  4098] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4099] mprotect(0x7f2891329000, 1236992, PROT_READ <unfinished ...>
[pid  4098] <... getsockopt resumed>, 0x7f905579bd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] read(34 <unfinished ...>
[pid  4034] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fc6347caf000002}], 128, 663, NULL, 0) = 1
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4034] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4098] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] write(3, "\x0c\xfe\x01\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x02\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x14\x00\x00\x00"..., 130576 <unfinished ...>
[pid  4034] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4099] <... mprotect resumed>)     = 0
[pid  4098] <... getsockopt resumed>, 0x7f905579c408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4094] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4025] sched_yield( <unfinished ...>
[pid  4098] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4094] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] <... write resumed>)        = 130576
[pid  4034] read(6 <unfinished ...>
[pid  4098] <... getsockopt resumed>, 0x7f905579cac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4094] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4034] <... read resumed>, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x01\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x0c\xfe\x01\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00"..., 21347228) = 130632
[pid  4098] close(3 <unfinished ...>
[pid  4094] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4099] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4098] <... close resumed>)        = 0
[pid  4035] kill(4074, SIGKILL)         = 0
[pid  4025] <... sched_yield resumed>)  = 0
[pid  4099] <... prctl resumed>)        = 0
[pid  4099] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x1ffffffff000
[pid  4098] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4034] futex(0x2059c04dd160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4099] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200000000000
[pid  4099] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200001000000
[pid  4098] <... socket resumed>)       = 3
[pid  4034] <... futex resumed>)        = 1
[pid  4025] epoll_pwait(4, [{events=EPOLLOUT, data=0x3fc6347caf000002}], 128, 0, NULL, 0) = 1
[pid  4034] read(6, 0x2059c4680000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4099] rt_sigaction(SIGCHLD, {sa_handler=0x7f28910c0780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f28911ae1d0} <unfinished ...>
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4099] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4027] <... futex resumed>)        = 0
[pid  4027] futex(0x2059c04dd160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4099] pkey_alloc(0, PKEY_UNRESTRICTED) = -1 EINVAL (Invalid argument)
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=647698304} <unfinished ...>
[pid  4099] getrandom("\xfa\x47\x59\x25\x68\xb6\x28\x2a", 8, GRND_NONBLOCK) = 8
[pid  4099] mkdir("./syzkaller.WRoXPR", 0700) = 0
[pid  4098] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4099] chmod("./syzkaller.WRoXPR", 0777 <unfinished ...>
[pid  4098] <... getsockopt resumed>, 0x7f9055798e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4098] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4099] <... chmod resumed>)        = 0
[pid  4098] <... getsockopt resumed>, 0x7f90557994c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4099] chdir("./syzkaller.WRoXPR" <unfinished ...>
[pid  4098] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4099] <... chdir resumed>)        = 0
[pid  4098] <... getsockopt resumed>, 0x7f9055799b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4099] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4098] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4099] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4098] <... getsockopt resumed>, 0x7f905579a248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4099] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4098] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4099] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4098] <... getsockopt resumed>, 0x7f905579a908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4099] rt_sigaction(SIGSEGV, {sa_handler=0x7f28910c2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f28911ae1d0}, NULL, 8) = 0
[pid  4098] close(3 <unfinished ...>
[pid  4099] rt_sigaction(SIGBUS, {sa_handler=0x7f28910c2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f28911ae1d0}, NULL, 8) = 0
[pid  4099] getpid()                    = 4099
[pid  4099] mmap(0x1b2bf20000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0 <unfinished ...>
[pid  4098] <... close resumed>)        = 0
[pid  4099] <... mmap resumed>)         = 0x1b2bf20000
[pid  4099] getpid( <unfinished ...>
[pid  4098] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4099] <... getpid resumed>)       = 4099
[pid  4099] mmap(0x1b2cf24000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0) = 0x1b2cf24000
[pid  4098] <... write resumed>)        = 4
[pid  4099] close(3)                    = 0
[pid  4099] fcntl(5, F_GETFD <unfinished ...>
[pid  4098] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4099] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4099] fcntl(6, F_GETFD)           = -1 EBADF (Bad file descriptor)
[pid  4099] dup2(0, 249)                = 249
[pid  4099] dup2(1, 248)                = 248
[pid  4099] dup2(2, 1)                  = 1
[pid  4099] dup2(2, 0)                  = 0
[pid  4099] read(249, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\x3c\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4099] unshare(CLONE_NEWPID)       = 0
[pid  4099] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4099] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 4104 attached
/strace: Process 4103 attached
/strace: Process 4102 attached
, child_tidptr=0x55557c3997d0) = 4102
[pid  4098] <... mkdirat resumed>)      = 0
[pid  4082] <... read resumed> <unfinished ...>) = ?
[pid  4074] +++ killed by SIGKILL +++
[pid  4099] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4074, si_uid=0, si_status=SIGKILL, si_utime=1 /* 0.01 s */, si_stime=8 /* 0.08 s */} ---
[pid  4103] set_robust_list(0x55556a0c37e0, 24 <unfinished ...>
[pid  4102] set_robust_list(0x55557c3997e0, 24 <unfinished ...>
[pid  4088] <... clone resumed>, child_tidptr=0x55556a0c37d0) = 2
[pid  4035] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4103] <... set_robust_list resumed>) = 0
[pid  4102] <... set_robust_list resumed>) = 0
[pid  4099] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4088] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] <... rt_sigreturn resumed>) = 4074
[pid  4104] set_robust_list(0x5555904a27e0, 24 <unfinished ...>
[pid  4103] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4102] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4088] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] pipe2( <unfinished ...>
[pid  4104] <... set_robust_list resumed>) = 0
[pid  4098] openat(AT_FDCWD, "/dev/loop3", O_RDWR <unfinished ...>
[pid  4094] <... clone resumed>, child_tidptr=0x5555904a27d0) = 2
[pid  4104] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4103] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4102] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] <... pipe2 resumed>[10, 26], 0) = 0
[pid  4104] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4103] chdir("./0" <unfinished ...>
[pid  4102] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4098] <... openat resumed>)       = 3
[pid  4094] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4104] chdir("./0" <unfinished ...>
[pid  4103] <... chdir resumed>)        = 0
[pid  4098] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4094] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] pipe2( <unfinished ...>
[pid  4102] <... prctl resumed>)        = 0
[pid  4103] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4102] getppid( <unfinished ...>
[pid  4103] <... prctl resumed>)        = 0
[pid  4102] <... getppid resumed>)      = 0
[pid  4098] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4035] <... pipe2 resumed>[30, 31], 0) = 0
[pid  4104] <... chdir resumed>)        = 0
[pid  4103] setpgid(0, 0 <unfinished ...>
[pid  4102] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4098] close(3 <unfinished ...>
[pid  4035] pipe2( <unfinished ...>
[pid  4103] <... setpgid resumed>)      = 0
[pid  4102] <... openat resumed>)       = 3
[pid  4098] <... close resumed>)        = 0
[pid  4035] <... pipe2 resumed>[33, 37], 0) = 0
[pid  4098] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4103] symlinkat("/syzcgroup/unified/syz0", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4104] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4102] dup2(3, 201 <unfinished ...>
[pid  4098] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4104] <... prctl resumed>)        = 0
[pid  4103] <... symlinkat resumed>)    = 0
[pid  4102] <... dup2 resumed>)         = 201
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] setpgid(0, 0 <unfinished ...>
[pid  4102] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4104] <... setpgid resumed>)      = 0
[pid  4103] symlinkat("/syzcgroup/cpu/syz0", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4102] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] symlinkat("/syzcgroup/unified/syz1", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4102] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4102] <... prlimit64 resumed>, NULL) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] <... symlinkat resumed>)    = 0
[pid  4102] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024} <unfinished ...>
[pid  4098] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4104] symlinkat("/syzcgroup/cpu/syz1", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4103] <... symlinkat resumed>)    = 0
[pid  4102] <... prlimit64 resumed>, NULL) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] <... symlinkat resumed>)    = 0
[pid  4103] symlinkat("/syzcgroup/net/syz0", AT_FDCWD, "./cgroup.net" <unfinished ...>
[pid  4102] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024} <unfinished ...>
[pid  4098] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4104] symlinkat("/syzcgroup/net/syz1", AT_FDCWD, "./cgroup.net" <unfinished ...>
[pid  4103] <... symlinkat resumed>)    = 0
[pid  4102] <... prlimit64 resumed>, NULL) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4103] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4102] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4103] <... openat resumed>)       = 3
[pid  4102] <... prlimit64 resumed>, NULL) = 0
[pid  4098] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] <... symlinkat resumed>)    = 0
[pid  4102] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} <unfinished ...>
[pid  4104] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4103] write(3, "1000", 4 <unfinished ...>
[pid  4102] <... prlimit64 resumed>, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4104] <... openat resumed>)       = 3
[pid  4102] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} <unfinished ...>
[pid  4098] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] write(3, "1000", 4 <unfinished ...>
[pid  4103] <... write resumed>)        = 4
[pid  4102] <... prlimit64 resumed>, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4104] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4103] close(3 <unfinished ...>
[pid  4102] unshare(CLONE_NEWNS <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4104] close(3 <unfinished ...>
[pid  4103] <... close resumed>)        = 0
[pid  4102] <... unshare resumed>)      = 0
[pid  4098] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] <... close resumed>)        = 0
[pid  4103] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs") = 0
[pid  4098] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4104] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] <... symlinkat resumed>)    = 0
[pid  4103] close(249 <unfinished ...>
[pid  4102] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4098] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4104] close(249 <unfinished ...>
[pid  4103] <... close resumed>)        = 0
[pid  4102] <... mount resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] <... close resumed>)        = 0
[pid  4103] close(248 <unfinished ...>
[pid  4104] close(248 <unfinished ...>
[pid  4103] <... close resumed>)        = 0
[pid  4102] unshare(CLONE_NEWIPC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4104] <... close resumed>)        = 0
[pid  4103] prctl(PR_SET_NAME, "syz.0.7" <unfinished ...>
[pid  4102] <... unshare resumed>)      = 0
[pid  4104] prctl(PR_SET_NAME, "syz.1.8" <unfinished ...>
[pid  4103] <... prctl resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4103] mmap(0x1b34364000, 6029312, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0x40000 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4103] <... mmap resumed>)         = 0x1b34364000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] <... prctl resumed>)        = 0
[pid  4103] close(4 <unfinished ...>
[pid  4098] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4104] mmap(0x1b34564000, 14417920, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0x40000 <unfinished ...>
[pid  4098] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] <... mmap resumed>)         = 0x1b34564000
[pid  4103] <... close resumed>)        = 0
[pid  4102] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4104] close(4 <unfinished ...>
[pid  4103] futex(0x7f686d3d5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4102] <... unshare resumed>)      = 0
[pid  4098] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] <... close resumed>)        = 0
[pid  4102] unshare(CLONE_NEWUTS <unfinished ...>
[pid  4104] futex(0x7fd691ab5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4102] <... unshare resumed>)      = 0
[pid  4098] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4104] <... futex resumed>)        = 0
[pid  4103] <... futex resumed>)        = 0
[pid  4102] unshare(CLONE_SYSVSEM <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] rt_sigaction(SIGRT_1, {sa_handler=0x7fd69185c3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fd6917de1d0} <unfinished ...>
[pid  4103] rt_sigaction(SIGRT_1, {sa_handler=0x7f686d17c3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f686d0fe1d0} <unfinished ...>
[pid  4102] <... unshare resumed>)      = 0
[pid  4104] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4103] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4102] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4098] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4104] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid  4103] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4103] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4104] <... mmap resumed>)         = 0x7fd68f669000
[pid  4103] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4102] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4104] mprotect(0x7fd68f66a000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4103] <... mmap resumed>)         = 0x7f686af91000
[pid  4104] <... mprotect resumed>)     = 0
[pid  4102] write(3, "16777216", 8 <unfinished ...>
[pid  4098] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4103] mprotect(0x7f686af92000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4102] <... write resumed>)        = 8
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4104] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4103] <... mprotect resumed>)     = 0
[pid  4102] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fd68f689990, parent_tid=0x7fd68f689990, exit_signal=0, stack=0x7fd68f669000, stack_size=0x201c0, tls=0x7fd68f6896c0} <unfinished ...>
[pid  4103] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4102] <... close resumed>)        = 0
[pid  4098] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4102] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  4098] read(249/strace: Process 4105 attached
 <unfinished ...>
[pid  4104] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4103] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4102] write(3, "536870912", 9 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4105] set_robust_list(0x7fd68f6899a0, 24 <unfinished ...>
[pid  4103] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f686afb1990, parent_tid=0x7f686afb1990, exit_signal=0, stack=0x7f686af91000, stack_size=0x201c0, tls=0x7f686afb16c0} <unfinished ...>
[pid  4102] <... write resumed>)        = 9
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4105] <... set_robust_list resumed>) = 0
[pid  4104] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4102] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4102] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4105] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4104] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4105] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4104] futex(0x7fd691ab5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4102] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4102] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4102] write(3, "1024", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4105] ioctl(216, KCOV_ENABLE, 0x1 <unfinished ...>
[pid  4104] <... futex resumed>)        = 0
[pid  4102] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4105] <... ioctl resumed>)        = 0
[pid  4104] futex(0x7fd691ab5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4102] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4102] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4105] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4102] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4102] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4105] <... mmap resumed>)         = 0x1ffffffff000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4102] write(3, "8192", 4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4105] futex(0x7fd691ab5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4102] <... write resumed>)        = 4
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL/strace: Process 4106 attached
 <unfinished ...>
[pid  4105] <... futex resumed>)        = 1
[pid  4104] <... futex resumed>)        = 0
[pid  4103] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4102] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4106] set_robust_list(0x7f686afb19a0, 24 <unfinished ...>
[pid  4105] futex(0x7fd691ab5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4106] <... set_robust_list resumed>) = 0
[pid  4102] <... close resumed>)        = 0
[pid  4106] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4106] futex(0x7f686d3d5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4102] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  4103] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4102] write(3, "1024", 4 <unfinished ...>
[pid  4103] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4102] <... write resumed>)        = 4
[pid  4102] close(3)                    = 0
[pid  4102] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[pid  4102] write(3, "1024", 4 <unfinished ...>
[pid  4103] futex(0x7f686d3d5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4102] <... write resumed>)        = 4
[pid  4102] close(3)                    = 0
[pid  4103] <... futex resumed>)        = 1
[pid  4102] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4106] <... futex resumed>)        = 0
[pid  4102] <... openat resumed>)       = 3
[pid  4106] ioctl(216, KCOV_ENABLE, 0 <unfinished ...>
[pid  4103] futex(0x7f686d3d5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4106] <... ioctl resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4106] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4102] write(3, "1024 1048576 500 1024", 21) = 21
[pid  4102] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4102] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4102] getpid( <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4102] <... getpid resumed>)       = 1
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4106] <... mmap resumed>)         = 0x1ffffffff000
[pid  4102] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4102] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4106] futex(0x7f686d3d5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4102] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4106] <... futex resumed>)        = 1
[pid  4103] <... futex resumed>)        = 0
[pid  4106] futex(0x7f686d3d5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4102] <... capset resumed>)       = 0
[pid  4103] futex(0x7f686d3d5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4102] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4102] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4102] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4106] <... futex resumed>)        = 0
[pid  4103] <... futex resumed>)        = 1
[pid  4102] <... socket resumed>)       = 5
[pid  4106] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4106] <... mmap resumed>)         = 0x200000000000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4106] futex(0x7f686d3d5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4103] futex(0x7f686d3d5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4102] ioctl(5, SIOCGIFINDEX, {ifr_name="nr4" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4106] <... futex resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4106] futex(0x7f686d3d5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4103] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4103] futex(0x7f686d3d5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4103] <... futex resumed>)        = 1
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4103] futex(0x7f686d3d5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4106] <... futex resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4106] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4106] <... mmap resumed>)         = 0x200001000000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4106] futex(0x7f686d3d5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4106] <... futex resumed>)        = 1
[pid  4103] <... futex resumed>)        = 0
[pid  4103] close_range(3, 30, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4103] <... close_range resumed>)  = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4103] exit_group(0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4103] <... exit_group resumed>)   = ?
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] futex(0x7fd691ab5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] <... futex resumed>)        = 1
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] futex(0x7fd691ab5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4105] <... futex resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4105] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4105] <... mmap resumed>)         = 0x200000000000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4106] +++ exited with 0 +++
[pid  4105] futex(0x7fd691ab5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4103] +++ exited with 0 +++
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4105] <... futex resumed>)        = 1
[pid  4104] <... futex resumed>)        = 0
[pid  4088] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4105] futex(0x7fd691ab5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4088] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4104] futex(0x7fd691ab5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4088] <... rt_sigreturn resumed>) = -1 EINTR (Interrupted system call)
[pid  4104] <... futex resumed>)        = 1
[pid  4105] <... futex resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4105] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4104] futex(0x7fd691ab5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4105] <... mmap resumed>)         = 0x200001000000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4105] futex(0x7fd691ab5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4105] <... futex resumed>)        = 1
[pid  4104] <... futex resumed>)        = 0
[pid  4088] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4105] futex(0x7fd691ab5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... openat resumed>)       = 3
[pid  4088] fstat(3, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] getdents64(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... getdents64 resumed>, 0x55556a0d68c0 /* 6 entries */, 32768) = 176
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4088] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4104] close_range(3, 30, 0 <unfinished ...>
[pid  4088] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4104] <... close_range resumed>)  = 0
[pid  4088] unlink("./0/binderfs" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4104] exit_group(0 <unfinished ...>
[pid  4088] <... unlink resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4104] <... exit_group resumed>)   = ?
[pid  4088] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4105] <... futex resumed>)        = ?
[pid  4088] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] newfstatat(AT_FDCWD, "./0/cgroup.net" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] unlink("./0/cgroup.net")    = 0
[pid  4088] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] newfstatat(AT_FDCWD, "./0/cgroup.cpu" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] unlink("./0/cgroup.cpu" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... unlink resumed>)       = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4088] newfstatat(AT_FDCWD, "./0/cgroup" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] unlink("./0/cgroup" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... unlink resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] getdents64(3 <unfinished ...>
[pid  4082] +++ killed by SIGKILL +++
[pid  4088] <... getdents64 resumed>, 0x55556a0d68c0 /* 0 entries */, 32768) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... close resumed>)        = 0
[pid  4088] unlinkat(AT_FDCWD, "./0", AT_REMOVEDIR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... unlinkat resumed>)     = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] mkdirat(AT_FDCWD, "./1", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4102] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4102] close(5)                    = 0
[pid  4102] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x00\x00\x00\x00\x08\x00\x02\x00\xac\x1e\x00\x05\x08\x00\x01\x00\xac\x1e\x00\x05"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4105] +++ exited with 0 +++
[pid  4104] +++ exited with 0 +++
[pid  4102] <... sendto resumed>)       = 40
[pid  4088] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4102] recvfrom(3 <unfinished ...>
[pid  4094] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} ---
[pid  4088] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4102] <... recvfrom resumed>, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x00\x00\x00\x00\x08\x00\x02\x00\xac\x1e\x00\x05\x08\x00\x01\x00\xac\x1e\x00\x05"]}], 4096, 0, NULL, NULL) = 60
[pid  4088] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4102] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4094] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4088] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4102] <... socket resumed>)       = 5
[pid  4094] <... rt_sigreturn resumed>) = 0
[pid  4088] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4102] ioctl(5, SIOCGIFINDEX, {ifr_name="nr4" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4088] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4088] <... close resumed>)        = 0
[pid  4094] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] fstat(3 <unfinished ...>
[pid  4088] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4094] getdents64(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... getdents64 resumed>, 0x5555904b58c0 /* 6 entries */, 32768) = 176
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] unlink("./0/binderfs" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... unlink resumed>)       = 0
[pid  4094] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4088] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4088] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] newfstatat(AT_FDCWD, "./0/cgroup.net" <unfinished ...>
[pid  4088] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] unlink("./0/cgroup.net" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... unlink resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] newfstatat(AT_FDCWD, "./0/cgroup.cpu" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4088] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] unlink("./0/cgroup.cpu" <unfinished ...>
[pid  4088] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... unlink resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4088] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] newfstatat(AT_FDCWD, "./0/cgroup" <unfinished ...>
[pid  4088] read(249 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] unlink("./0/cgroup" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... unlink resumed>)       = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] getdents64(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... getdents64 resumed>, 0x5555904b58c0 /* 0 entries */, 32768) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] unlinkat(AT_FDCWD, "./0", AT_REMOVEDIR <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... unlinkat resumed>)     = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] mkdirat(AT_FDCWD, "./1", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] close(3)                    = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4102] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4094] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4102] close(5 <unfinished ...>
[pid  4094] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4094] <... close resumed>)        = 0
[pid  4102] <... close resumed>)        = 0
[pid  4094] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4102] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0b\x00\x01\x00\xbb\xbb\xbb\x00\x00\x00\x04\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4094] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4102] <... sendto resumed>)       = 44
[pid  4094] close(3 <unfinished ...>
[pid  4102] recvfrom(3 <unfinished ...>
[pid  4094] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4094] read(249 <unfinished ...>
[pid  4102] <... recvfrom resumed>, [{nlmsg_len=64, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0b\x00\x01\x00\xbb\xbb\xbb\x00\x00\x00\x04\x00"]}], 4096, 0, NULL, NULL) = 64
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4102] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4102] <... socket resumed>)       = 5
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4102] ioctl(5, SIOCGIFINDEX, {ifr_name="rose4" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fd910a37000
[pid  4035] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4035] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7fd910a37000, stack_size=0x9000}, 88/strace: Process 4116 attached
 <unfinished ...>
[pid  4116] rt_sigprocmask(SIG_BLOCK, NULL, ~[KILL STOP], 8) = 0
[pid  4116] setpgid(0, 0)               = 0
[pid  4116] dup2(10, 0)                 = 0
[pid  4116] dup2(31, 1)                 = 1
[pid  4116] dup2(37, 2)                 = 2
[pid  4116] dup2(14, 3)                 = 3
[pid  4116] dup2(17, 4)                 = 4
[pid  4116] close(5)                    = 0
[pid  4116] close(6)                    = 0
[pid  4116] close(7)                    = 0
[pid  4116] close(8)                    = 0
[pid  4116] close(9)                    = 0
[pid  4116] close(10)                   = 0
[pid  4116] close(11)                   = 0
[pid  4116] close(12)                   = 0
[pid  4116] close(13)                   = 0
[pid  4116] close(14)                   = 0
[pid  4116] close(15)                   = 0
[pid  4116] close(16)                   = 0
[pid  4116] close(17)                   = 0
[pid  4116] close(18)                   = 0
[pid  4116] close(19)                   = 0
[pid  4116] close(20)                   = 0
[pid  4116] close(21)                   = 0
[pid  4116] close(22)                   = 0
[pid  4116] close(23)                   = 0
[pid  4116] close(24)                   = 0
[pid  4116] close(25)                   = 0
[pid  4116] close(26)                   = 0
[pid  4116] close(27)                   = 0
[pid  4116] close(28)                   = 0
[pid  4116] close(29)                   = 0
[pid  4116] close(30)                   = 0
[pid  4116] close(31)                   = 0
[pid  4116] close(32)                   = 0
[pid  4102] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4116] close(33)                   = 0
[pid  4102] close(5 <unfinished ...>
[pid  4116] close(34)                   = 0
[pid  4116] close(35)                   = 0
[pid  4116] close(36)                   = 0
[pid  4116] close(37)                   = 0
[pid  4116] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4116] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4116] close(39 <unfinished ...>
[pid  4102] <... close resumed>)        = 0
[pid  4116] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4116] close(40 <unfinished ...>
[pid  4102] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x00\x00\x00\x00\x08\x00\x02\x00\xac\x1e\x01\x05\x08\x00\x01\x00\xac\x1e\x01\x05"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4116] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4116] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(44)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(45 <unfinished ...>
[pid  4102] <... sendto resumed>)       = 40
[pid  4116] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4116] close(46)                   = -1 EBADF (Bad file descriptor)
[pid  4102] recvfrom(3 <unfinished ...>
[pid  4116] close(47)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(48 <unfinished ...>
[pid  4102] <... recvfrom resumed>, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x00\x00\x00\x00\x08\x00\x02\x00\xac\x1e\x01\x05\x08\x00\x01\x00\xac\x1e\x01\x05"]}], 4096, 0, NULL, NULL) = 60
[pid  4116] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4116] close(49)                   = -1 EBADF (Bad file descriptor)
[pid  4102] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4116] close(50)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(51)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(52)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(53)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(54)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(55 <unfinished ...>
[pid  4102] <... socket resumed>)       = 5
[pid  4116] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4102] ioctl(5, SIOCGIFINDEX, {ifr_name="rose4" <unfinished ...>
[pid  4116] close(56)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(57)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(58)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(59)                   = -1 EBADF (Bad file descriptor)
[pid  4034] <... epoll_pwait resumed>, [], 128, 648, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4025] sched_getaffinity(0, 8192, [0 1]) = 8
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4116] close(60 <unfinished ...>
[pid  4034] futex(0x2059c04dd160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4116] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4034] <... futex resumed>)        = 1
[pid  4027] <... futex resumed>)        = 0
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4116] close(61 <unfinished ...>
[pid  4034] futex(0x2059c2bff960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=985902898} <unfinished ...>
[pid  4116] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4116] close(62)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(63)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(64)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(65)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(66)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(67)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(68)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(70)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(71)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(72)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(75)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(76)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(77)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(79)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(80)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(81)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(82)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(84)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(85)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(86)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(87)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(88)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(89)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(90)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(92)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(93)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(94)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(95)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(96)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(98)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(99)                   = -1 EBADF (Bad file descriptor)
[pid  4116] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(102)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(104)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(106)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(108 <unfinished ...>
[pid  4102] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4116] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4102] close(5 <unfinished ...>
[pid  4116] close(109 <unfinished ...>
[pid  4102] <... close resumed>)        = 0
[pid  4116] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4116] close(110)                  = -1 EBADF (Bad file descriptor)
[pid  4102] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x01\x00\xbb\xbb\xbb\x01\x04\x00\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4116] close(111 <unfinished ...>
[pid  4102] <... sendto resumed>)       = 44
[pid  4116] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4116] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4102] recvfrom(3 <unfinished ...>
[pid  4116] close(113 <unfinished ...>
[pid  4102] <... recvfrom resumed>, [{nlmsg_len=64, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x01\x00\xbb\xbb\xbb\x01\x04\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 64
[pid  4116] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4116] close(114 <unfinished ...>
[pid  4102] close(3 <unfinished ...>
[pid  4116] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4102] <... close resumed>)        = 0
[pid  4116] close(115 <unfinished ...>
[pid  4102] unshare(CLONE_NEWNET <unfinished ...>
[pid  4116] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4116] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(118)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(119)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(120)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(129)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(130)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(134)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(135)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(142 <unfinished ...>
[pid  4102] <... unshare resumed>)      = 0
[pid  4116] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4102] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4116] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4102] <... openat resumed>)       = 3
[pid  4116] close(148 <unfinished ...>
[pid  4102] write(3, "0 65535", 7 <unfinished ...>
[pid  4116] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4116] close(149 <unfinished ...>
[pid  4102] <... write resumed>)        = 7
[pid  4116] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4102] close(3 <unfinished ...>
[pid  4116] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4102] <... close resumed>)        = 0
[pid  4116] close(151 <unfinished ...>
[pid  4102] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE <unfinished ...>
[pid  4116] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4102] <... socket resumed>)       = 3
[pid  4116] close(152 <unfinished ...>
[pid  4102] sendto(3, [{nlmsg_len=84, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00\x03\x00\x69\x70\x36\x67\x72\x65\x74\x61\x70\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x14\x00\x12\x00\x0d\x00\x01\x00\x69\x70\x36\x67\x72\x65\x74\x61\x70\x00\x00\x00"], 84, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4116] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4116] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(154)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(155)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(158)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(163)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(164)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(168)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(169)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(182)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(183)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(184)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(185)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(186)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(188)                  = -1 EBADF (Bad file descriptor)
[pid  4102] <... sendto resumed>)       = 84
[pid  4116] close(189)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(190)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(191)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4102] recvfrom(3 <unfinished ...>
[pid  4116] close(194 <unfinished ...>
[pid  4102] <... recvfrom resumed>, [{nlmsg_len=104, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=84, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00\x03\x00\x69\x70\x36\x67\x72\x65\x74\x61\x70\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x14\x00\x12\x00\x0d\x00\x01\x00\x69\x70\x36\x67\x72\x65\x74\x61\x70\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 104
[pid  4116] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4102] sendto(3, [{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x03\x00\x62\x72\x69\x64\x67\x65\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x0a\x00\x01\x00\x62\x72\x69\x64\x67\x65\x00\x00"], 76, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4116] close(195)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(196)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(200)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(202)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(204)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(205)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(206)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(207)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(208)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(209)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(210)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(211)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(213)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(214)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(215)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(216)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(217)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(218)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(219)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(220)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(223)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(224)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(225)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(228)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(229)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(230)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(231)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(232)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(233)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(234)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(235)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(236)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(237)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(240)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(241)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(244)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(245)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(246)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(247)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(248)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(251)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(252)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(253)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4116] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4116] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4116] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffe3fa80e70 /* 2 vars */ <unfinished ...>
[pid  4035] <... clone3 resumed>)       = 4116
[pid  4035] munmap(0x7fd910a37000, 36864) = 0
[pid  4116] <... execve resumed>)       = 0
[pid  4035] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4035] fcntl(30, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(30, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] fcntl(33, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(33, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] close(10)                   = 0
[pid  4035] close(31 <unfinished ...>
[pid  4116] brk(NULL <unfinished ...>
[pid  4102] <... sendto resumed>)       = 76
[pid  4035] <... close resumed>)        = 0
[pid  4116] <... brk resumed>)          = 0x55556f906000
[pid  4116] brk(0x55556f906e80)         = 0x55556f906e80
[pid  4116] arch_prctl(ARCH_SET_FS, 0x55556f906500 <unfinished ...>
[pid  4102] recvfrom(3 <unfinished ...>
[pid  4035] close(37 <unfinished ...>
[pid  4116] <... arch_prctl resumed>)   = 0
[pid  4102] <... recvfrom resumed>, [{nlmsg_len=96, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x03\x00\x62\x72\x69\x64\x67\x65\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x0a\x00\x01\x00\x62\x72\x69\x64\x67\x65\x00\x00"]}], 4096, 0, NULL, NULL) = 96
[pid  4035] <... close resumed>)        = 0
[pid  4116] set_tid_address(0x55556f9067d0) = 4116
[pid  4116] set_robust_list(0x55556f9067e0, 24) = 0
[pid  4116] prlimit64(0, RLIMIT_STACK, NULL <unfinished ...>
[pid  4102] sendto(3, [{nlmsg_len=72, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x76\x63\x61\x6e\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x76\x63\x61\x6e"], 72, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4035] close(32 <unfinished ...>
[pid  4116] <... prlimit64 resumed>, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4116] readlinkat(AT_FDCWD, "/proc/self/exe" <unfinished ...>
[pid  4035] <... close resumed>)        = 0
[pid  4116] <... readlinkat resumed>, "/syz-executor", 4096) = 13
[pid  4035] close(34 <unfinished ...>
[pid  4116] getrandom("\x65\xc6\x8b\xba\xf9\x18\x7a\x3a", 8, GRND_NONBLOCK) = 8
[pid  4035] <... close resumed>)        = 0
[pid  4116] brk(NULL)                   = 0x55556f906e80
[pid  4035] close(36 <unfinished ...>
[pid  4116] brk(0x55556f927e80 <unfinished ...>
[pid  4035] <... close resumed>)        = 0
[pid  4116] <... brk resumed>)          = 0x55556f927e80
[pid  4035] write(26, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x20\x38\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64 <unfinished ...>
[pid  4116] brk(0x55556f928000 <unfinished ...>
[pid  4035] <... write resumed>)        = 64
[pid  4116] <... brk resumed>)          = 0x55556f928000
[pid  4035] pselect6(36, [3 13 16 20 23 25 28 29 30 33 35], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4116] mprotect(0x7f0a3a3a9000, 1236992, PROT_READ <unfinished ...>
[pid  4035] <... pselect6 resumed>)     = 4 (in [3 13 16 23], left {tv_sec=0, tv_nsec=999987102})
[pid  4116] <... mprotect resumed>)     = 0
[pid  4035] read(3, "\xbc\x00\x00\x00", 4) = 4
[pid  4035] read(3, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x14\x38\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4035] read(23, "\x00\x00\x00\x00", 4) = 4
[pid  4035] write(3, "\x24\x2a\x02\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x18\x00\x0c\x00\x00\x00\x04\x00\x00\x00\x00\x00\x08\x00\x10\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x14\x00\x00\x00\x0c\x00\x00\x00\x40\x9c\x7a\x3f"..., 141864 <unfinished ...>
[pid  4116] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4035] <... write resumed>)        = 141864
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fc6347caf000002}], 128, 986, NULL, 0) = 1
[pid  4027] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4116] <... prctl resumed>)        = 0
[pid  4027] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4116] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4035] kill(4087, SIGKILL <unfinished ...>
[pid  4027] read(6 <unfinished ...>
[pid  4116] <... mmap resumed>)         = 0x1ffffffff000
[pid  4035] <... kill resumed>)         = 0
[pid  4027] <... read resumed>, "\x24\x2a\x02\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x18\x00\x0c\x00\x00\x00\x04\x00\x00\x00\x00\x00\x08\x00\x10\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x14\x00\x00\x00\x0c\x00\x00\x00\x40\x9c\x7a\x3f"..., 21347228) = 141864
[pid  4116] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200000000000
[pid  4116] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200001000000
[pid  4116] rt_sigaction(SIGCHLD, {sa_handler=0x7f0a3a140780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f0a3a22e1d0}, NULL, 8) = 0
[pid  4116] pkey_alloc(0, PKEY_UNRESTRICTED) = -1 EINVAL (Invalid argument)
[pid  4116] getrandom("\x13\xa5\xc1\xbe\x19\xd5\xc6\x1c", 8, GRND_NONBLOCK) = 8
[pid  4116] mkdir("./syzkaller.1dnAg1", 0700) = 0
[pid  4025] epoll_pwait(4, [{events=EPOLLOUT, data=0x3fc6347caf000002}], 128, 0, NULL, 0) = 1
[pid  4116] chmod("./syzkaller.1dnAg1", 0777) = 0
[pid  4116] chdir("./syzkaller.1dnAg1") = 0
[pid  4116] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
[pid  4116] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
[pid  4116] rt_sigaction(SIGSEGV, {sa_handler=0x7f0a3a142b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f0a3a22e1d0} <unfinished ...>
[pid  4027] futex(0x2059c2bff960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4116] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4116] rt_sigaction(SIGBUS, {sa_handler=0x7f0a3a142b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f0a3a22e1d0}, NULL, 8) = 0
[pid  4116] getpid()                    = 4116
[pid  4116] mmap(0x1b2d020000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0) = 0x1b2d020000
[pid  4027] <... futex resumed>)        = 1
[pid  4116] getpid( <unfinished ...>
[pid  4027] read(6 <unfinished ...>
[pid  4034] <... futex resumed>)        = 0
[pid  4027] <... read resumed>, 0x2059c4680000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4025] futex(0x2059c0508160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4116] <... getpid resumed>)       = 4116
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4027] futex(0x2059c04dd160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4116] mmap(0x1b2e024000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0) = 0x1b2e024000
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4116] close(3 <unfinished ...>
[pid  4028] <... futex resumed>)        = 0
[pid  4025] <... futex resumed>)        = 1
[pid  4116] <... close resumed>)        = 0
[pid  4034] write(5, "\x01\x00\x00\x00\x00\x00\x00\x00", 8 <unfinished ...>
[pid  4028] epoll_pwait(4 <unfinished ...>
[pid  4116] fcntl(5, F_GETFD)           = -1 EBADF (Bad file descriptor)
[pid  4116] fcntl(6, F_GETFD)           = -1 EBADF (Bad file descriptor)
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=578252427} <unfinished ...>
[pid  4116] dup2(0, 249)                = 249
[pid  4116] dup2(1, 248)                = 248
[pid  4116] dup2(2, 1 <unfinished ...>
[pid  4034] <... write resumed>)        = 8
[pid  4028] <... epoll_pwait resumed>, [{events=EPOLLIN, data=0x33dbe88}], 128, -1, NULL, 0) = 1
[pid  4116] <... dup2 resumed>)         = 1
[pid  4034] futex(0x2059c2bff960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4028] read(5 <unfinished ...>
[pid  4116] dup2(2, 0 <unfinished ...>
[pid  4028] <... read resumed>, "\x01\x00\x00\x00\x00\x00\x00\x00", 8) = 8
[pid  4116] <... dup2 resumed>)         = 0
[pid  4028] epoll_pwait(4 <unfinished ...>
[pid  4116] read(249 <unfinished ...>
[pid  4028] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4116] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x20\x38\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4028] epoll_pwait(4 <unfinished ...>
[pid  4116] unshare(CLONE_NEWPID)       = 0
[pid  4116] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4116] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 4132 attached
, child_tidptr=0x55556f9067d0) = 4132
[pid  4116] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4132] set_robust_list(0x55556f9067e0, 24) = 0
[pid  4116] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4132] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4132] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  4102] <... sendto resumed>)       = 72
[pid  4088] <... read resumed> <unfinished ...>) = ?
[pid  4087] +++ killed by SIGKILL +++
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4087, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=12 /* 0.12 s */} ---
[pid  4035] rt_sigreturn({mask=[]})     = 4087
[pid  4035] pipe2([10, 31], 0)          = 0
[pid  4035] pipe2([32, 34], 0)          = 0
[pid  4102] recvfrom(3 <unfinished ...>
[pid  4035] pipe2([36, 37], 0)          = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] getppid( <unfinished ...>
[pid  4102] <... recvfrom resumed>, [{nlmsg_len=92, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=72, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x76\x63\x61\x6e\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x76\x63\x61\x6e"]}], 4096, 0, NULL, NULL) = 92
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... getppid resumed>)      = 0
[pid  4132] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] <... openat resumed>)       = 3
[pid  4102] sendto(3, [{nlmsg_len=72, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x62\x6f\x6e\x64\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x62\x6f\x6e\x64"], 72, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] dup2(3, 201 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... dup2 resumed>)         = 201
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... prlimit64 resumed>, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... prlimit64 resumed>, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... prlimit64 resumed>, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... prlimit64 resumed>, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] <... prlimit64 resumed>, NULL) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... prlimit64 resumed>, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] unshare(CLONE_NEWNS <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... unshare resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] <... mount resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] unshare(CLONE_NEWIPC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... unshare resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] unshare(CLONE_NEWUTS <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... unshare resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] unshare(CLONE_SYSVSEM <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] write(3, "16777216", 8 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... write resumed>)        = 8
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] write(3, "536870912", 9 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... write resumed>)        = 9
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] write(3, "1024", 4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... write resumed>)        = 4
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] write(3, "8192", 4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... write resumed>)        = 4
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] write(3, "1024", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] write(3, "1024", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... write resumed>)        = 4
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] write(3, "1024 1048576 500 1024", 21 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] <... write resumed>)        = 21
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] unshare(CLONE_NEWNET <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4102] <... sendto resumed>)       = 72
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4102] recvfrom(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4102] <... recvfrom resumed>, [{nlmsg_len=92, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=72, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x62\x6f\x6e\x64\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x62\x6f\x6e\x64"]}], 4096, 0, NULL, NULL) = 92
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] <... unshare resumed>)      = 0
[pid  4102] sendto(3, [{nlmsg_len=72, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x74\x65\x61\x6d\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x74\x65\x61\x6d"], 72, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] mkdirat(AT_FDCWD, "/dev/binderfs", 0777) = -1 EEXIST (File exists)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] +++ killed by SIGKILL +++
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4102] <... sendto resumed>)       = 72
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4102] recvfrom(3, [{nlmsg_len=92, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=72, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x74\x65\x61\x6d\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x74\x65\x61\x6d"]}], 4096, 0, NULL, NULL) = 92
[pid  4132] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4102] sendto(3, [{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x64\x75\x6d\x6d\x79\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x09\x00\x01\x00\x64\x75\x6d\x6d\x79\x00\x00\x00"], 76, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] setgroups(0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] <... setgroups resumed>)    = 0
[pid  4132] setresgid(65534, 65534, 65534) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] setresuid(65534, 65534, 65534 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] <... setresuid resumed>)    = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] <... prctl resumed>)        = 0
[pid  4132] prctl(PR_SET_DUMPABLE, SUID_DUMP_USER <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... prctl resumed>)        = 0
[pid  4132] getpid()                    = 1
[pid  4132] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz2", 0777) = -1 EACCES (Permission denied)
[pid  4132] openat(AT_FDCWD, "/syzcgroup/unified/syz2/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] <... openat resumed>)       = -1 EACCES (Permission denied)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] openat(AT_FDCWD, "/syzcgroup/unified/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] <... openat resumed>)       = -1 EACCES (Permission denied)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz2", 0777) = -1 EACCES (Permission denied)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... openat resumed>)       = -1 EACCES (Permission denied)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] <... openat resumed>)       = -1 EACCES (Permission denied)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] <... openat resumed>)       = -1 EACCES (Permission denied)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] mkdirat(AT_FDCWD, "/syzcgroup/net/syz2", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... mkdirat resumed>)      = -1 EACCES (Permission denied)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] openat(AT_FDCWD, "/syzcgroup/net/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC) = -1 EACCES (Permission denied)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... write resumed>)        = 4
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4132] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] openat(AT_FDCWD, "/dev/loop2", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] <... openat resumed>)       = -1 EACCES (Permission denied)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4132] read(249 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fd910a37000
[pid  4035] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4035] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7fd910a37000, stack_size=0x9000}, 88/strace: Process 4143 attached
 <unfinished ...>
[pid  4143] rt_sigprocmask(SIG_BLOCK, NULL <unfinished ...>
[pid  4102] <... sendto resumed>)       = 76
[pid  4143] <... rt_sigprocmask resumed>, ~[KILL STOP], 8) = 0
[pid  4102] recvfrom(3 <unfinished ...>
[pid  4143] setpgid(0, 0 <unfinished ...>
[pid  4102] <... recvfrom resumed>, [{nlmsg_len=96, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x64\x75\x6d\x6d\x79\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x09\x00\x01\x00\x64\x75\x6d\x6d\x79\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 96
[pid  4143] <... setpgid resumed>)      = 0
[pid  4143] dup2(10, 0 <unfinished ...>
[pid  4102] sendto(3, [{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x6e\x69\x63\x76\x66\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x09\x00\x01\x00\x6e\x69\x63\x76\x66\x00\x00\x00"], 76, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4143] <... dup2 resumed>)         = 0
[pid  4143] dup2(34, 1)                 = 1
[pid  4143] dup2(37, 2)                 = 2
[pid  4143] dup2(7, 3)                  = 3
[pid  4143] dup2(8, 4)                  = 4
[pid  4143] close(5)                    = 0
[pid  4143] close(6)                    = 0
[pid  4143] close(7)                    = 0
[pid  4143] close(8)                    = 0
[pid  4143] close(9)                    = 0
[pid  4143] close(10)                   = 0
[pid  4143] close(11)                   = 0
[pid  4143] close(12)                   = 0
[pid  4143] close(13)                   = 0
[pid  4143] close(14)                   = 0
[pid  4143] close(15)                   = 0
[pid  4143] close(16)                   = 0
[pid  4143] close(17)                   = 0
[pid  4143] close(18)                   = 0
[pid  4143] close(19)                   = 0
[pid  4143] close(20)                   = 0
[pid  4143] close(21)                   = 0
[pid  4143] close(22)                   = 0
[pid  4143] close(23)                   = 0
[pid  4143] close(24)                   = 0
[pid  4143] close(25)                   = 0
[pid  4143] close(26)                   = 0
[pid  4102] <... sendto resumed>)       = 76
[pid  4143] close(27)                   = 0
[pid  4143] close(28)                   = 0
[pid  4102] recvfrom(3, [{nlmsg_len=96, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x6e\x69\x63\x76\x66\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x09\x00\x01\x00\x6e\x69\x63\x76\x66\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 96
[pid  4143] close(29)                   = 0
[pid  4102] sendto(3, [{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x6e\x6c\x6d\x6f\x6e\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x09\x00\x01\x00\x6e\x6c\x6d\x6f\x6e\x00\x00\x00"], 76, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4143] close(30)                   = 0
[pid  4143] close(31)                   = 0
[pid  4143] close(32)                   = 0
[pid  4143] close(33)                   = 0
[pid  4143] close(34)                   = 0
[pid  4143] close(35)                   = 0
[pid  4143] close(36)                   = 0
[pid  4143] close(37)                   = 0
[pid  4143] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4143] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] close(39)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(40)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(44)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(45)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(46)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(47)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(48)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(49)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(50)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(51)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(52)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(53)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(54)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(55)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(56)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(57)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(58)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(59)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(60)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(61)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(62)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(63)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(64)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(65)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(66)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(67)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(68)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(70)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(71)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(72)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(75)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(76)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(77)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(79)                   = -1 EBADF (Bad file descriptor)
[pid  4102] <... sendto resumed>)       = 76
[pid  4143] close(80)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(81)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(82)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(84)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(85)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(86)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(87)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(88)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(89)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(90)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(92)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(93)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(94)                   = -1 EBADF (Bad file descriptor)
[pid  4143] close(95 <unfinished ...>
[pid  4102] recvfrom(3 <unfinished ...>
[pid  4143] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4143] close(96 <unfinished ...>
[pid  4102] <... recvfrom resumed>, [{nlmsg_len=96, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x6e\x6c\x6d\x6f\x6e\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x09\x00\x01\x00\x6e\x6c\x6d\x6f\x6e\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 96
[pid  4143] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4143] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4102] sendto(3, [{nlmsg_len=72, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x63\x61\x69\x66\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x63\x61\x69\x66"], 72, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4143] close(98 <unfinished ...>
[pid  4028] <... epoll_pwait resumed>, [], 128, 575, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4143] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4143] close(99 <unfinished ...>
[pid  4028] futex(0x2059c2bff960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4143] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4034] <... futex resumed>)        = 0
[pid  4028] <... futex resumed>)        = 1
[pid  4143] close(100 <unfinished ...>
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4143] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4034] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4028] epoll_pwait(4 <unfinished ...>
[pid  4143] close(101 <unfinished ...>
[pid  4034] futex(0x2059c2bff960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4143] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4143] close(102)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(104)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(106)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(110)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(116 <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=989383533} <unfinished ...>
[pid  4143] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4143] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(118)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(119)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(120)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(129)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(130)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(134)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(135)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(141 <unfinished ...>
[pid  4102] <... sendto resumed>)       = 72
[pid  4102] recvfrom(3, [{nlmsg_len=92, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=72, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x63\x61\x69\x66\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x63\x61\x69\x66"]}], 4096, 0, NULL, NULL) = 92
[pid  4143] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4143] close(142 <unfinished ...>
[pid  4102] sendto(3, [{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x03\x00\x62\x61\x74\x61\x64\x76\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x0a\x00\x01\x00\x62\x61\x74\x61\x64\x76\x00\x00"], 76, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4143] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4143] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(154)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(155)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(158)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(163)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(164)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(168)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(169)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(182)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(183)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(184)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(185)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(186)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(188)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(189)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(190)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(191)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(194)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(195)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(196)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(200)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(202)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(204)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(205)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(206)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(207)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(208)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(209)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(210)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(211)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(213)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(214)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(215)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(216)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(217)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(218 <unfinished ...>
[pid  4102] <... sendto resumed>)       = 76
[pid  4143] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4143] close(219 <unfinished ...>
[pid  4102] recvfrom(3 <unfinished ...>
[pid  4143] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4143] close(220 <unfinished ...>
[pid  4102] <... recvfrom resumed>, [{nlmsg_len=96, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x03\x00\x62\x61\x74\x61\x64\x76\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x0a\x00\x01\x00\x62\x61\x74\x61\x64\x76\x00\x00"]}], 4096, 0, NULL, NULL) = 96
[pid  4143] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4102] sendto(3, [{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x76\x78\x63\x61\x6e\x31\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x09\x00\x01\x00\x76\x78\x63\x61\x6e\x00\x00\x00"], 76, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4143] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(223)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(224)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(225)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(228)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(229)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(230)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(231)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(232)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(233)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(234)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(235)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(236)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(237)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(240)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(241)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(244)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(245)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(246)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(247)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(248)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(251)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(252)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(253)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4143] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4143] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4143] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffe3fa80e70 /* 2 vars */ <unfinished ...>
[pid  4035] <... clone3 resumed>)       = 4143
[pid  4143] <... execve resumed>)       = 0
[pid  4035] munmap(0x7fd910a37000, 36864) = 0
[pid  4035] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4035] fcntl(32, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(32, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] fcntl(36, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(36, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] close(10)                   = 0
[pid  4035] close(34)                   = 0
[pid  4035] close(37)                   = 0
[pid  4102] <... sendto resumed>)       = 76
[pid  4035] close(21 <unfinished ...>
[pid  4102] recvfrom(3, [{nlmsg_len=96, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x76\x78\x63\x61\x6e\x31\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x09\x00\x01\x00\x76\x78\x63\x61\x6e\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 96
[pid  4035] <... close resumed>)        = 0
[pid  4143] brk(NULL)                   = 0x55557b6fd000
[pid  4102] sendto(3, [{nlmsg_len=60, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4035] close(23 <unfinished ...>
[pid  4143] brk(0x55557b6fde80 <unfinished ...>
[pid  4035] <... close resumed>)        = 0
[pid  4143] <... brk resumed>)          = 0x55557b6fde80
[pid  4035] close(35)                   = 0
[pid  4143] arch_prctl(ARCH_SET_FS, 0x55557b6fd500 <unfinished ...>
[pid  4035] write(31, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\x3a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64 <unfinished ...>
[pid  4143] <... arch_prctl resumed>)   = 0
[pid  4035] <... write resumed>)        = 64
[pid  4035] read(13, "\x00\x00\x00\x00", 4) = 4
[pid  4143] set_tid_address(0x55557b6fd7d0 <unfinished ...>
[pid  4035] write(3, "\x34\x46\x01\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x01\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 83512 <unfinished ...>
[pid  4143] <... set_tid_address resumed>) = 4143
[pid  4035] <... write resumed>)        = 83512
[pid  4028] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fc6347caf000002}], 128, 991, NULL, 0) = 1
[pid  4143] set_robust_list(0x55557b6fd7e0, 24 <unfinished ...>
[pid  4028] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1) = 1
[pid  4143] <... set_robust_list resumed>) = 0
[pid  4028] read(6 <unfinished ...>
[pid  4025] <... futex resumed>)        = 0
[pid  4143] prlimit64(0, RLIMIT_STACK, NULL <unfinished ...>
[pid  4028] <... read resumed>, "\x34\x46\x01\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x01\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 21347228) = 83512
[pid  4143] <... prlimit64 resumed>, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4028] futex(0x2059c2bff960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4025] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4035] kill(4089, SIGKILL)         = 0
[pid  4143] readlinkat(AT_FDCWD, "/proc/self/exe" <unfinished ...>
[pid  4034] <... futex resumed>)        = 0
[pid  4028] <... futex resumed>)        = 1
[pid  4025] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4028] read(6 <unfinished ...>
[pid  4143] <... readlinkat resumed>, "/syz-executor", 4096) = 13
[pid  4028] <... read resumed>, 0x2059c4680000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4143] getrandom( <unfinished ...>
[pid  4028] epoll_pwait(4 <unfinished ...>
[pid  4034] epoll_pwait(4 <unfinished ...>
[pid  4028] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4028] futex(0x2059c0508160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4143] <... getrandom resumed>"\x10\xe3\x5b\x35\xc3\x2b\x94\x06", 8, GRND_NONBLOCK) = 8
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=718227373} <unfinished ...>
[pid  4143] brk(NULL)                   = 0x55557b6fde80
[pid  4143] brk(0x55557b71ee80)         = 0x55557b71ee80
[pid  4143] brk(0x55557b71f000)         = 0x55557b71f000
[pid  4143] mprotect(0x7f2328f89000, 1236992, PROT_READ) = 0
[pid  4143] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  4143] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x1ffffffff000
[pid  4143] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200000000000
[pid  4143] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4102] <... sendto resumed>)       = 60
[pid  4143] <... mmap resumed>)         = 0x200001000000
[pid  4143] rt_sigaction(SIGCHLD, {sa_handler=0x7f2328d20780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f2328e0e1d0} <unfinished ...>
[pid  4102] recvfrom(3 <unfinished ...>
[pid  4143] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4143] pkey_alloc(0, PKEY_UNRESTRICTED <unfinished ...>
[pid  4102] <... recvfrom resumed>, [{nlmsg_len=80, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=60, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68"]}], 4096, 0, NULL, NULL) = 80
[pid  4143] <... pkey_alloc resumed>)   = -1 EINVAL (Invalid argument)
[pid  4094] <... read resumed> <unfinished ...>) = ?
[pid  4089] +++ killed by SIGKILL +++
[pid  4143] getrandom( <unfinished ...>
[pid  4102] sendto(3, [{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x03\x00\x77\x67\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x14\x00\x12\x00\x0d\x00\x01\x00\x77\x69\x72\x65\x67\x75\x61\x72\x64\x00\x00\x00"], 76, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4143] <... getrandom resumed>"\xce\x5b\x0b\x10\x97\x3e\xc3\xde", 8, GRND_NONBLOCK) = 8
[pid  4143] mkdir("./syzkaller.MakKu9", 0700 <unfinished ...>
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4089, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=14 /* 0.14 s */} ---
[pid  4143] <... mkdir resumed>)        = 0
[pid  4035] rt_sigreturn({mask=[]})     = 4089
[pid  4143] chmod("./syzkaller.MakKu9", 0777 <unfinished ...>
[pid  4035] pipe2( <unfinished ...>
[pid  4143] <... chmod resumed>)        = 0
[pid  4035] <... pipe2 resumed>[10, 21], 0) = 0
[pid  4143] chdir("./syzkaller.MakKu9" <unfinished ...>
[pid  4035] pipe2( <unfinished ...>
[pid  4143] <... chdir resumed>)        = 0
[pid  4143] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4035] <... pipe2 resumed>[23, 34], 0) = 0
[pid  4143] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4143] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4035] pipe2( <unfinished ...>
[pid  4143] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4035] <... pipe2 resumed>[35, 37], 0) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] rt_sigaction(SIGSEGV, {sa_handler=0x7f2328d22b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f2328e0e1d0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] rt_sigaction(SIGBUS, {sa_handler=0x7f2328d22b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f2328e0e1d0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4143] getpid( <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] <... getpid resumed>)       = 4143
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] mmap(0x1b2eb20000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] <... mmap resumed>)         = 0x1b2eb20000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] getpid( <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] <... getpid resumed>)       = 4143
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] mmap(0x1b2fb24000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] <... mmap resumed>)         = 0x1b2fb24000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] fcntl(5, F_GETFD <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] fcntl(6, F_GETFD <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] dup2(0, 249 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] <... dup2 resumed>)         = 249
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] dup2(1, 248 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] <... dup2 resumed>)         = 248
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] dup2(2, 1 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] <... dup2 resumed>)         = 1
[pid  4143] dup2(2, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] <... dup2 resumed>)         = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] read(249 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\x3a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] unshare(CLONE_NEWPID <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] <... unshare resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
/strace: Process 4165 attached
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] <... clone resumed>, child_tidptr=0x55557b6fd7d0) = 4165
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] set_robust_list(0x55557b6fd7e0, 24 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... set_robust_list resumed>) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... prctl resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] getppid( <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... getppid resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... openat resumed>)       = 3
[pid  4102] <... sendto resumed>)       = 76
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] dup2(3, 201 <unfinished ...>
[pid  4102] recvfrom(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... dup2 resumed>)         = 201
[pid  4102] <... recvfrom resumed>, [{nlmsg_len=96, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x03\x00\x77\x67\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x14\x00\x12\x00\x0d\x00\x01\x00\x77\x69\x72\x65\x67\x75\x61\x72\x64\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 96
[pid  4165] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4102] sendto(3, [{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x03\x00\x77\x67\x31\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x14\x00\x12\x00\x0d\x00\x01\x00\x77\x69\x72\x65\x67\x75\x61\x72\x64\x00\x00\x00"], 76, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4165] <... close resumed>)        = 0
[pid  4094] +++ killed by SIGKILL +++
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... prlimit64 resumed>, NULL) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... prlimit64 resumed>, NULL) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... prlimit64 resumed>, NULL) = 0
[pid  4165] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... prlimit64 resumed>, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... prlimit64 resumed>, NULL) = 0
[pid  4165] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] unshare(CLONE_NEWNS <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... unshare resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... mount resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] unshare(CLONE_NEWIPC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] unshare(CLONE_NEWUTS <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... unshare resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] unshare(CLONE_SYSVSEM <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] write(3, "16777216", 8 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... write resumed>)        = 8
[pid  4165] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] write(3, "536870912", 9 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... write resumed>)        = 9
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] write(3, "1024", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4102] <... sendto resumed>)       = 76
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... openat resumed>)       = 3
[pid  4102] recvfrom(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] write(3, "8192", 4 <unfinished ...>
[pid  4102] <... recvfrom resumed>, [{nlmsg_len=96, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x03\x00\x77\x67\x31\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x14\x00\x12\x00\x0d\x00\x01\x00\x77\x69\x72\x65\x67\x75\x61\x72\x64\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 96
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... write resumed>)        = 4
[pid  4165] close(3 <unfinished ...>
[pid  4102] sendto(3, [{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x03\x00\x77\x67\x32\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x14\x00\x12\x00\x0d\x00\x01\x00\x77\x69\x72\x65\x67\x75\x61\x72\x64\x00\x00\x00"], 76, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... close resumed>)        = 0
[pid  4165] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] write(3, "1024", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] write(3, "1024", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... close resumed>)        = 0
[pid  4165] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] write(3, "1024 1048576 500 1024", 21 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... write resumed>)        = 21
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] getpid()                    = 1
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... capset resumed>)       = 0
[pid  4102] <... sendto resumed>)       = 76
[pid  4102] recvfrom(3, [{nlmsg_len=96, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x03\x00\x77\x67\x32\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x14\x00\x12\x00\x0d\x00\x01\x00\x77\x69\x72\x65\x67\x75\x61\x72\x64\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 96
[pid  4165] unshare(CLONE_NEWNET <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4102] sendto(3, [{nlmsg_len=140, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x03\x00\x62\x72\x69\x64\x67\x65\x5f\x73\x6c\x61\x76\x65\x5f\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x03\x00\x76\x65\x74\x68\x30\x5f\x74\x6f"...], 140, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... unshare resumed>)      = 0
[pid  4165] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] write(3, "0 65535", 7 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... write resumed>)        = 7
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] newfstatat(AT_FDCWD, "/dev/net/tun" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... newfstatat resumed>, {st_mode=S_IFCHR|0666, st_rdev=makedev(0xa, 0xc8), ...}, 0) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... openat resumed>)       = -1 ENODEV (No such device)
[pid  4165] write(2, "SYZFAIL: tun: can't open /dev/net/tun\n", 38 <unfinished ...>
[pid  4102] <... sendto resumed>)       = 140
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... write resumed>)        = 38
[pid  4102] recvfrom(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] write(2, " (errno 19: No such device)\n", 28 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4102] <... recvfrom resumed>, [{nlmsg_len=160, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=140, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x03\x00\x62\x72\x69\x64\x67\x65\x5f\x73\x6c\x61\x76\x65\x5f\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x03\x00\x76\x65\x74\x68\x30\x5f\x74\x6f"...]}], 4096, 0, NULL, NULL) = 160
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4165] <... write resumed>)        = 28
[pid  4102] sendto(3, [{nlmsg_len=140, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x03\x00\x62\x72\x69\x64\x67\x65\x5f\x73\x6c\x61\x76\x65\x5f\x31\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x03\x00\x76\x65\x74\x68\x31\x5f\x74\x6f"...], 140, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4165] exit_group(67 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] <... exit_group resumed>)   = ?
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4165] +++ exited with 67 +++
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4165, si_uid=0, si_status=67, si_utime=0, si_stime=6 /* 0.06 s */} ---
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] <... rt_sigreturn resumed>) = 4165
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] write(2, "loop exited with status 67\n", 27 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] <... write resumed>)        = 27
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] write(248, "\x43\x00\x00\x00", 4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] <... write resumed>)        = 4
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4143] exit_group(67 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] <... exit_group resumed>)   = ?
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4143] +++ exited with 67 +++
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4143, si_uid=0, si_status=67, si_utime=0, si_stime=3 /* 0.03 s */} ---
[pid  4035] rt_sigreturn({mask=[]})     = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
 [pid  4057] <... openat resumed>)       = -1 ENODEV (No such device)
[pid  4056] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4053] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4052] <... openat resumed>)       = 3
[pid  4058] close(5 <unfinished ...>
[pid  4057] write(2, "SYZFAIL: tun: can't open /dev/net/tun\n", 38 <unfinished ...>
[pid  4056] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4058] <... close resumed>)        = 0
[pid  4057] <... write resumed>)        = 38
[pid  4053] <... mmap resumed>)         = 0x7fd83d304000
[pid  4052] dup2(3, 215 <unfinished ...>
[pid  4041] <... pselect6 resumed>)     = 1 (in [28], left {tv_sec=0, tv_nsec=841782325})
[pid  4058] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x00\x00\x00\x00\x08\x00\x02\x00\xac\x1e\x00\x05\x08\x00\x01\x00\xac\x1e\x00\x05"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4057] write(2, " (errno 19: No such device)\n", 28 <unfinished ...>
[pid  4056] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4053] mmap(0x7fd83d305000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 221, 0 <unfinished ...>
[pid  4052] <... dup2 resumed>)         = 215
[pid  4041] read(28 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 40
[pid  4057] <... write resumed>)        = 28
[pid  4056] <... mount resumed>)        = 0
[pid  4041] <... read resumed>, "SYZFAIL: tun: can't open /dev/net/tun\n (errno 19: No such device)\n", 1024) = 66
[pid  4041] pselect6(34, [3 11 13 16 18 21 23 26 28 31 33], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4057] exit_group(67 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4057] <... exit_group resumed>)   = ?
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x00\x00\x00\x00\x08\x00\x02\x00\xac\x1e\x00\x05\x08\x00\x01\x00\xac\x1e\x00\x05"]}], 4096, 0, NULL, NULL) = 60
[pid  4056] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid  4057] +++ exited with 67 +++
[pid  4053] <... mmap resumed>)         = 0x7fd83d305000
[pid  4052] close(3 <unfinished ...>
[pid  4056] <... mkdirat resumed>)      = 0
[pid  4052] <... close resumed>)        = 0
[pid  4053] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4052] ioctl(215, KCOV_INIT_TRACE, 0x100000 <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
[pid  4056] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="nr4" <unfinished ...>
[pid  4056] <... mount resumed>)        = 0
[pid  4054] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4057, si_uid=0, si_status=67, si_utime=0, si_stime=1 /* 0.01 s */} ---
[pid  4054] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4053] <... openat resumed>)       = 3
[pid  4056] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4054] <... rt_sigreturn resumed>) = 4057
[pid  4053] dup2(3, 215 <unfinished ...>
[pid  4056] <... mount resumed>)        = 0
[pid  4054] write(2, "loop exited with status 67\n", 27) = 27
[pid  4041] <... pselect6 resumed>)     = 1 (in [28], left {tv_sec=0, tv_nsec=970420869})
[pid  4056] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] read(28 <unfinished ...>
[pid  4056] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4054] write(248, "\x43\x00\x00\x00", 4 <unfinished ...>
[pid  4041] <... read resumed>, "loop exited with status 67\n", 1024) = 27
[pid  4041] pselect6(34, [3 11 13 16 18 21 23 26 28 31 33], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4056] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4054] <... write resumed>)        = 4
[pid  4041] <... pselect6 resumed>)     = 1 (in [26], left {tv_sec=0, tv_nsec=999721991})
[pid  4041] read(26, "\x43\x00\x00\x00", 4) = 4
[pid  4053] <... dup2 resumed>)         = 215
[pid  4053] close(3 <unfinished ...>
[pid  4041] write(3, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x03\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00", 56 <unfinished ...>
[pid  4053] <... close resumed>)        = 0
[pid  4056] <... mount resumed>)        = 0
[pid  4054] exit_group(67 <unfinished ...>
[pid  4053] ioctl(215, KCOV_INIT_TRACE, 0x100000 <unfinished ...>
[pid  4041] <... write resumed>)        = 56
[pid  4054] <... exit_group resumed>)   = ?
[pid  4033] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fa8a7c277000002}], 128, 995, NULL, 0) = 1
[pid  4033] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4056] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4033] <... futex resumed>)        = 1
[pid  4056] <... mkdirat resumed>)      = 0
[pid  4033] read(6, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x03\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00", 21347228) = 56
[pid  4031] <... futex resumed>)        = 0
[pid  4033] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x10\x38\x04\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0b\x00\x00\x00"..., 192 <unfinished ...>
[pid  4031] sched_getaffinity(0, 8192, [0 1]) = 8
[pid  4056] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid  4033] <... write resumed>)        = 192
[pid  4056] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700 <unfinished ...>
[pid  4033] read(6 <unfinished ...>
[pid  4056] <... mkdirat resumed>)      = 0
[pid  4033] <... read resumed>, 0x16a7cd080000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4033] epoll_pwait(4, [], 128, 0, NULL, 0) = 0
[pid  4031] epoll_pwait(4 <unfinished ...>
[pid  4056] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4031] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4056] <... mkdirat resumed>)      = 0
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=641198022} <unfinished ...>
[pid  4056] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700) = 0
[pid  4056] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700) = 0
[pid  4052] <... ioctl resumed>)        = 0
[pid  4056] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  4056] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4053] <... ioctl resumed>)        = 0
[pid  4052] mmap(NULL, 8396800, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4056] <... mount resumed>)        = 0
[pid  4056] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4053] mmap(NULL, 8396800, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4052] <... mmap resumed>)         = 0x7efe597ea000
[pid  4056] <... mount resumed>)        = 0
[pid  4053] <... mmap resumed>)         = 0x7fd83cb02000
[pid  4052] mmap(0x7efe597eb000, 8388608, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 215, 0 <unfinished ...>
[pid  4056] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4054] +++ exited with 67 +++
[pid  4053] mmap(0x7fd83cb03000, 8388608, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 215, 0 <unfinished ...>
[pid  4056] <... mkdirat resumed>)      = 0
[pid  4056] pivot_root("./syz-tmp", "./syz-tmp/pivot") = 0
[pid  4056] chdir("/")                  = 0
[pid  4056] umount2("./pivot", MNT_DETACH) = 0
[pid  4056] chroot("./newroot")         = 0
[pid  4056] chdir("/")                  = 0
[pid  4056] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777) = -1 EEXIST (File exists)
[pid  4056] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4052] <... mmap resumed>)         = 0x7efe597eb000
[pid  4053] <... mmap resumed>)         = 0x7fd83cb03000
[pid  4053] unshare(CLONE_NEWPID <unfinished ...>
[pid  4052] unshare(CLONE_NEWPID)       = 0
[pid  4052] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4053] <... unshare resumed>)      = 0
[pid  4052] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4053] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4052] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4053] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4053] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4041] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4054, si_uid=0, si_status=67, si_utime=0, si_stime=3 /* 0.03 s */} ---
[pid  4041] rt_sigreturn({mask=[]})     = 140190409326592
[pid  4041] write(25, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = -1 EPIPE (Broken pipe)
[pid  4041] --- SIGPIPE {si_signo=SIGPIPE, si_code=SI_USER, si_pid=4041, si_uid=0} ---
[pid  4041] kill(4054, SIGKILL)         = 0
[pid  4041] read(28, "", 1024)          = 0
/strace: Process 4069 attached
/strace: Process 4068 attached
[pid  4056] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4056] mkdirat(AT_FDCWD, "/dev/binderfs", 0777) = -1 EEXIST (File exists)
[pid  4056] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4069] set_robust_list(0x55557b5837e0, 24 <unfinished ...>
[pid  4068] set_robust_list(0x55555c7fb7e0, 24 <unfinished ...>
[pid  4053] <... clone resumed>, child_tidptr=0x55555c7fb7d0) = 4068
[pid  4052] <... clone resumed>, child_tidptr=0x55557b5837d0) = 4069
[pid  4069] <... set_robust_list resumed>) = 0
[pid  4068] <... set_robust_list resumed>) = 0
[pid  4069] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4068] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4053] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4052] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4069] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4068] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4053] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4068] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4069] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4068] <... prctl resumed>)        = 0
[pid  4052] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4068] getppid()                   = 0
[pid  4069] <... prctl resumed>)        = 0
[pid  4068] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4069] getppid()                   = 0
[pid  4068] <... openat resumed>)       = 3
[pid  4069] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4068] dup2(3, 201 <unfinished ...>
[pid  4069] <... openat resumed>)       = 3
[pid  4068] <... dup2 resumed>)         = 201
[pid  4069] dup2(3, 201 <unfinished ...>
[pid  4068] close(3 <unfinished ...>
[pid  4069] <... dup2 resumed>)         = 201
[pid  4069] close(3 <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4069] <... close resumed>)        = 0
[pid  4068] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4069] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4068] <... prlimit64 resumed>, NULL) = 0
[pid  4069] <... prlimit64 resumed>, NULL) = 0
[pid  4068] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024} <unfinished ...>
[pid  4069] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024} <unfinished ...>
[pid  4068] <... prlimit64 resumed>, NULL) = 0
[pid  4069] <... prlimit64 resumed>, NULL) = 0
[pid  4068] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024} <unfinished ...>
[pid  4069] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  4068] <... prlimit64 resumed>, NULL) = 0
[pid  4069] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4068] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4069] <... prlimit64 resumed>, NULL) = 0
[pid  4068] <... prlimit64 resumed>, NULL) = 0
[pid  4069] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} <unfinished ...>
[pid  4068] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} <unfinished ...>
[pid  4069] <... prlimit64 resumed>, NULL) = 0
[pid  4069] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} <unfinished ...>
[pid  4068] <... prlimit64 resumed>, NULL) = 0
[pid  4069] <... prlimit64 resumed>, NULL) = 0
[pid  4069] unshare(CLONE_NEWNS <unfinished ...>
[pid  4068] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} <unfinished ...>
[pid  4069] <... unshare resumed>)      = 0
[pid  4068] <... prlimit64 resumed>, NULL) = 0
[pid  4069] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4068] unshare(CLONE_NEWNS)        = 0
[pid  4069] <... mount resumed>)        = 0
[pid  4068] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4069] unshare(CLONE_NEWIPC)       = 0
[pid  4068] <... mount resumed>)        = 0
[pid  4069] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4068] unshare(CLONE_NEWIPC <unfinished ...>
[pid  4069] <... unshare resumed>)      = 0
[pid  4068] <... unshare resumed>)      = 0
[pid  4068] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4069] unshare(CLONE_NEWUTS <unfinished ...>
[pid  4068] <... unshare resumed>)      = 0
[pid  4069] <... unshare resumed>)      = 0
[pid  4068] unshare(CLONE_NEWUTS <unfinished ...>
[pid  4069] unshare(CLONE_SYSVSEM <unfinished ...>
[pid  4068] <... unshare resumed>)      = 0
[pid  4069] <... unshare resumed>)      = 0
[pid  4068] unshare(CLONE_SYSVSEM)      = 0
[pid  4069] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4068] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  4068] write(3, "16777216", 8 <unfinished ...>
[pid  4069] <... openat resumed>)       = 3
[pid  4068] <... write resumed>)        = 8
[pid  4068] close(3)                    = 0
[pid  4068] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  4069] write(3, "16777216", 8 <unfinished ...>
[pid  4068] write(3, "536870912", 9 <unfinished ...>
[pid  4069] <... write resumed>)        = 8
[pid  4068] <... write resumed>)        = 9
[pid  4069] close(3 <unfinished ...>
[pid  4068] close(3)                    = 0
[pid  4069] <... close resumed>)        = 0
[pid  4069] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4068] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4069] <... openat resumed>)       = 3
[pid  4068] <... openat resumed>)       = 3
[pid  4069] write(3, "536870912", 9 <unfinished ...>
[pid  4068] write(3, "1024", 4 <unfinished ...>
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4056] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4068] <... write resumed>)        = 4
[pid  4068] close(3 <unfinished ...>
[pid  4056] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4069] <... write resumed>)        = 9
[pid  4068] <... close resumed>)        = 0
[pid  4058] close(5 <unfinished ...>
[pid  4056] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4058] <... close resumed>)        = 0
[pid  4056] getpid( <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0b\x00\x01\x00\xbb\xbb\xbb\x00\x00\x00\x04\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4056] <... getpid resumed>)       = 1
[pid  4069] close(3 <unfinished ...>
[pid  4068] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4069] <... close resumed>)        = 0
[pid  4068] <... openat resumed>)       = 3
[pid  4056] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4069] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4056] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4069] <... openat resumed>)       = 3
[pid  4069] write(3, "1024", 4 <unfinished ...>
[pid  4068] write(3, "8192", 4 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 44
[pid  4056] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4068] <... write resumed>)        = 4
[pid  4056] <... capset resumed>)       = 0
[pid  4068] close(3 <unfinished ...>
[pid  4056] getpid( <unfinished ...>
[pid  4069] <... write resumed>)        = 4
[pid  4068] <... close resumed>)        = 0
[pid  4056] <... getpid resumed>)       = 1
[pid  4069] close(3 <unfinished ...>
[pid  4068] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4056] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz0", 0777 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4068] <... openat resumed>)       = 3
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=64, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0b\x00\x01\x00\xbb\xbb\xbb\x00\x00\x00\x04\x00"]}], 4096, 0, NULL, NULL) = 64
[pid  4056] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4069] <... close resumed>)        = 0
[pid  4068] write(3, "1024", 4 <unfinished ...>
[pid  4041] write(3, "\x2c\x01\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x24\x00\x18\x00\x08\x00\x0c\x00\x07\x00\x10\x00\x14\x00\x10\x00\x00\x00\x00\x00\x00\x01\x03\x00\x00\x00\x18\x00\x00\x00\x94\x00\x00\x00\xb0\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7c\x00\x00\x00\x53\x59\x5a\x46\x41\x49\x4c\x3a\x20\x74\x75\x6e"..., 304 <unfinished ...>
[pid  4069] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4056] openat(AT_FDCWD, "/syzcgroup/unified/syz0/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4068] <... write resumed>)        = 4
[pid  4056] <... openat resumed>)       = 3
[pid  4069] <... openat resumed>)       = 3
[pid  4068] close(3 <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4056] write(3, "32", 2 <unfinished ...>
[pid  4041] <... write resumed>)        = 304
[pid  4033] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fa8a7c277000002}], 128, 643, NULL, 0) = 1
[pid  4069] write(3, "8192", 4 <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4069] <... write resumed>)        = 4
[pid  4068] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4069] close(3 <unfinished ...>
[pid  4068] <... openat resumed>)       = 3
[pid  4069] <... close resumed>)        = 0
[pid  4068] write(3, "1024", 4 <unfinished ...>
[pid  4069] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4068] <... write resumed>)        = 4
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="rose4" <unfinished ...>
[pid  4056] <... write resumed>)        = 2
[pid  4041] pipe2( <unfinished ...>
[pid  4033] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4056] close(3 <unfinished ...>
[pid  4041] <... pipe2 resumed>[29, 32], 0) = 0
[pid  4033] <... futex resumed>)        = 1
[pid  4031] <... futex resumed>)        = 0
[pid  4056] <... close resumed>)        = 0
[pid  4033] read(6 <unfinished ...>
[pid  4056] openat(AT_FDCWD, "/syzcgroup/unified/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] pipe2( <unfinished ...>
[pid  4033] <... read resumed>, "\x2c\x01\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x24\x00\x18\x00\x08\x00\x0c\x00\x07\x00\x10\x00\x14\x00\x10\x00\x00\x00\x00\x00\x00\x01\x03\x00\x00\x00\x18\x00\x00\x00\x94\x00\x00\x00\xb0\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7c\x00\x00\x00\x53\x59\x5a\x46\x41\x49\x4c\x3a\x20\x74\x75\x6e"..., 21347228) = 304
[pid  4056] <... openat resumed>)       = 3
[pid  4041] <... pipe2 resumed>[34, 35], 0) = 0
[pid  4033] futex(0x16a7c9156960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4056] write(3, "1", 1 <unfinished ...>
[pid  4041] pipe2( <unfinished ...>
[pid  4033] <... futex resumed>)        = 1
[pid  4032] <... futex resumed>)        = 0
[pid  4033] read(6 <unfinished ...>
[pid  4068] close(3 <unfinished ...>
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4069] <... openat resumed>)       = 3
[pid  4041] <... pipe2 resumed>[36, 37], 0) = 0
[pid  4033] <... read resumed>, 0x16a7cd080000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4032] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4069] write(3, "1024", 4 <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4032] futex(0x16a7c9156960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=431917754} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] <... write resumed>)        = 4
[pid  4068] <... openat resumed>)       = 3
[pid  4056] <... write resumed>)        = 1
[pid  4069] close(3 <unfinished ...>
[pid  4068] write(3, "1024 1048576 500 1024", 21 <unfinished ...>
[pid  4056] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] <... close resumed>)        = 0
[pid  4068] <... write resumed>)        = 21
[pid  4056] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz0", 0777 <unfinished ...>
[pid  4068] close(3 <unfinished ...>
[pid  4056] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] <... close resumed>)        = 0
[pid  4068] <... close resumed>)        = 0
[pid  4056] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4069] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4068] getpid( <unfinished ...>
[pid  4056] <... openat resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... openat resumed>)       = 3
[pid  4068] <... getpid resumed>)       = 1
[pid  4056] write(3, "1", 1 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] write(3, "1024", 4 <unfinished ...>
[pid  4068] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4056] <... write resumed>)        = 1
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... write resumed>)        = 4
[pid  4068] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] close(3 <unfinished ...>
[pid  4068] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4056] <... close resumed>)        = 0
[pid  4056] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] <... close resumed>)        = 0
[pid  4068] <... capset resumed>)       = 0
[pid  4056] <... openat resumed>)       = 3
[pid  4056] write(3, "313524224", 9 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] <... write resumed>)        = 9
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4068] unshare(CLONE_NEWNET <unfinished ...>
[pid  4056] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... openat resumed>)       = 3
[pid  4056] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] write(3, "314572800", 9 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] <... write resumed>)        = 9
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] mkdirat(AT_FDCWD, "/syzcgroup/net/syz0", 0777 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] write(3, "1024 1048576 500 1024", 21 <unfinished ...>
[pid  4056] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4056] openat(AT_FDCWD, "/syzcgroup/net/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... write resumed>)        = 21
[pid  4056] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] write(3, "1", 1 <unfinished ...>
[pid  4069] <... close resumed>)        = 0
[pid  4056] <... write resumed>)        = 1
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] getpid( <unfinished ...>
[pid  4056] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] <... getpid resumed>)       = 1
[pid  4056] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] <... socket resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO, 0x7fa843f073e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4056] <... getsockopt resumed>, 0x7fa843f07a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4056] <... getsockopt resumed>, 0x7fa843f080e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] <... close resumed>)        = 0
[pid  4056] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] <... socket resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... capset resumed>)       = 0
[pid  4056] <... getsockopt resumed>, 0x7fa843f08768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] <... socket resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] <... getsockopt resumed>, 0x7fa843f0afc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] unshare(CLONE_NEWNET <unfinished ...>
[pid  4056] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] <... getsockopt resumed>, 0x7fa843f0b688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] getsockopt(3, SOL_IP, IPT_SO_GET_INFO, 0x7fa843f0bd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] <... getsockopt resumed>, 0x7fa843f0c408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] <... getsockopt resumed>, 0x7fa843f0cac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] <... close resumed>)        = 0
[pid  4056] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] <... socket resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] <... getsockopt resumed>, 0x7fa843f08e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] <... getsockopt resumed>, 0x7fa843f094c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4056] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO, 0x7fa843f09b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO, 0x7fa843f0a248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] <... getsockopt resumed>, 0x7fa843f0a908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] <... write resumed>)        = 4
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] openat(AT_FDCWD, "/dev/loop0", O_RDWR <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4056] close(3)                    = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4056] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] <... socket resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] <... socket resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4056] <... socket resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4056] read(249 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... unshare resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] write(3, "0 65535", 7 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... write resumed>)        = 7
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] close(3 <unfinished ...>
[pid  4068] <... unshare resumed>)      = 0
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] close(5)                    = 0
[pid  4058] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x00\x00\x00\x00\x08\x00\x02\x00\xac\x1e\x01\x05\x08\x00\x01\x00\xac\x1e\x01\x05"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] <... close resumed>)        = 0
[pid  4068] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4058] <... sendto resumed>)       = 40
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x00\x00\x00\x00\x08\x00\x02\x00\xac\x1e\x01\x05\x08\x00\x01\x00\xac\x1e\x01\x05"]}], 4096, 0, NULL, NULL) = 60
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4068] <... openat resumed>)       = 3
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4069] <... openat resumed>)       = 3
[pid  4068] write(3, "0 65535", 7 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] write(3, "100000", 6)       = 6
[pid  4068] <... write resumed>)        = 7
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] close(3)                    = 0
[pid  4068] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] <... openat resumed>)       = 3
[pid  4069] close(3 <unfinished ...>
[pid  4068] write(3, "100000", 6 <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="rose4" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... close resumed>)        = 0
[pid  4068] <... write resumed>)        = 6
[pid  4069] mkdirat(AT_FDCWD, "./syz-tmp", 0777 <unfinished ...>
[pid  4068] close(3 <unfinished ...>
[pid  4069] <... mkdirat resumed>)      = 0
[pid  4068] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] mkdirat(AT_FDCWD, "./syz-tmp", 0777 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] <... mkdirat resumed>)      = 0
[pid  4069] mount("", "./syz-tmp", "tmpfs", 0, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] mount("", "./syz-tmp", "tmpfs", 0, NULL) = 0
[pid  4068] mkdirat(AT_FDCWD, "./syz-tmp/newroot", 0777) = 0
[pid  4068] mkdirat(AT_FDCWD, "./syz-tmp/newroot/dev", 0700) = 0
[pid  4068] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  4069] <... mount resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] mkdirat(AT_FDCWD, "./syz-tmp/newroot", 0777 <unfinished ...>
[pid  4068] mkdirat(AT_FDCWD, "./syz-tmp/newroot/proc", 0700 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... mkdirat resumed>)      = 0
[pid  4068] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] <... mount resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] mkdirat(AT_FDCWD, "./syz-tmp/newroot/dev", 0700 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... mkdirat resumed>)      = 0
[pid  4068] mkdirat(AT_FDCWD, "./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] <... mkdirat resumed>)      = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] <... mount resumed>)        = 0
[pid  4068] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4069] mkdirat(AT_FDCWD, "./syz-tmp/newroot/proc", 0700 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... mkdirat resumed>)      = 0
[pid  4068] <... mount resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] <... mkdirat resumed>)      = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid  4068] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] <... mount resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] <... mount resumed>)        = 0
[pid  4069] mkdirat(AT_FDCWD, "./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid  4068] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... mkdirat resumed>)      = 0
[pid  4068] <... mount resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4068] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4068] <... mount resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... mount resumed>)        = 0
[pid  4068] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4068] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] <... mount resumed>)        = 0
[pid  4068] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4068] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4068] <... mkdirat resumed>)      = 0
[pid  4069] <... mount resumed>)        = 0
[pid  4068] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... mkdirat resumed>)      = 0
[pid  4068] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] <... mount resumed>)        = 0
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4068] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] <... mount resumed>)        = 0
[pid  4058] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4068] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700 <unfinished ...>
[pid  4068] <... mount resumed>)        = 0
[pid  4058] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x01\x00\xbb\xbb\xbb\x01\x04\x00\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... mkdirat resumed>)      = 0
[pid  4068] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4068] <... mkdirat resumed>)      = 0
[pid  4058] <... sendto resumed>)       = 44
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] <... mkdirat resumed>)      = 0
[pid  4068] <... pivot_root resumed>)   = 0
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] chdir("/" <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] <... chdir resumed>)        = 0
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=64, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x01\x00\xbb\xbb\xbb\x01\x04\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 64
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700 <unfinished ...>
[pid  4068] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... mkdirat resumed>)      = 0
[pid  4068] <... umount2 resumed>)      = 0
[pid  4058] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4068] chroot("./newroot" <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] <... chroot resumed>)       = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] <... mkdirat resumed>)      = 0
[pid  4068] chdir("/" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4068] <... chdir resumed>)        = 0
[pid  4058] unshare(CLONE_NEWNET <unfinished ...>
[pid  4068] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777) = -1 EEXIST (File exists)
[pid  4068] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... mount resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] <... mount resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f809d8bf000
[pid  4041] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4041] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7f809d8bf000, stack_size=0x9000}, 88/strace: Process 4083 attached
 <unfinished ...>
[pid  4069] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4083] rt_sigprocmask(SIG_BLOCK, NULL <unfinished ...>
[pid  4069] <... mount resumed>)        = 0
[pid  4083] <... rt_sigprocmask resumed>, ~[KILL STOP], 8) = 0
[pid  4069] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4083] setpgid(0, 0)               = 0
[pid  4069] <... mkdirat resumed>)      = 0
[pid  4083] dup2(29, 0 <unfinished ...>
[pid  4069] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4083] <... dup2 resumed>)         = 0
[pid  4083] dup2(35, 1 <unfinished ...>
[pid  4069] <... pivot_root resumed>)   = 0
[pid  4083] <... dup2 resumed>)         = 1
[pid  4083] dup2(37, 2)                 = 2
[pid  4069] chdir("/" <unfinished ...>
[pid  4083] dup2(19, 3 <unfinished ...>
[pid  4069] <... chdir resumed>)        = 0
[pid  4083] <... dup2 resumed>)         = 3
[pid  4069] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4083] dup2(22, 4 <unfinished ...>
[pid  4069] <... umount2 resumed>)      = 0
[pid  4083] <... dup2 resumed>)         = 4
[pid  4069] chroot("./newroot" <unfinished ...>
[pid  4083] close(5)                    = 0
[pid  4069] <... chroot resumed>)       = 0
[pid  4083] close(6 <unfinished ...>
[pid  4069] chdir("/" <unfinished ...>
[pid  4083] <... close resumed>)        = 0
[pid  4083] close(7 <unfinished ...>
[pid  4069] <... chdir resumed>)        = 0
[pid  4083] <... close resumed>)        = 0
[pid  4069] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4083] close(8 <unfinished ...>
[pid  4069] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4058] <... unshare resumed>)      = 0
[pid  4083] <... close resumed>)        = 0
[pid  4069] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4083] close(9 <unfinished ...>
[pid  4058] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4083] <... close resumed>)        = 0
[pid  4083] close(10 <unfinished ...>
[pid  4058] <... openat resumed>)       = 3
[pid  4083] <... close resumed>)        = 0
[pid  4058] write(3, "0 65535", 7 <unfinished ...>
[pid  4083] close(11)                   = 0
[pid  4058] <... write resumed>)        = 7
[pid  4083] close(12 <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4083] <... close resumed>)        = 0
[pid  4083] close(13 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4083] <... close resumed>)        = 0
[pid  4058] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE <unfinished ...>
[pid  4083] close(14 <unfinished ...>
[pid  4058] <... socket resumed>)       = 3
[pid  4083] <... close resumed>)        = 0
[pid  4058] sendto(3, [{nlmsg_len=84, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00\x03\x00\x69\x70\x36\x67\x72\x65\x74\x61\x70\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x14\x00\x12\x00\x0d\x00\x01\x00\x69\x70\x36\x67\x72\x65\x74\x61\x70\x00\x00\x00"], 84, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4083] close(15 <unfinished ...>
[pid  4069] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4068] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4083] <... close resumed>)        = 0
[pid  4069] mkdirat(AT_FDCWD, "/dev/binderfs", 0777 <unfinished ...>
[pid  4068] mkdirat(AT_FDCWD, "/dev/binderfs", 0777 <unfinished ...>
[pid  4083] close(16 <unfinished ...>
[pid  4069] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4068] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4083] <... close resumed>)        = 0
[pid  4069] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4068] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4083] close(17)                   = 0
[pid  4083] close(18)                   = 0
[pid  4083] close(19)                   = 0
[pid  4083] close(20)                   = 0
[pid  4083] close(21)                   = 0
[pid  4083] close(22)                   = 0
[pid  4083] close(23)                   = 0
[pid  4083] close(24)                   = 0
[pid  4083] close(25)                   = 0
[pid  4083] close(26)                   = 0
[pid  4083] close(27)                   = 0
[pid  4083] close(28)                   = 0
[pid  4083] close(29)                   = 0
[pid  4083] close(30)                   = 0
[pid  4083] close(31)                   = 0
[pid  4083] close(32)                   = 0
[pid  4083] close(33)                   = 0
[pid  4083] close(34)                   = 0
[pid  4083] close(35)                   = 0
[pid  4083] close(36)                   = 0
[pid  4083] close(37)                   = 0
[pid  4083] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4083] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4083] close(39)                   = -1 EBADF (Bad file descriptor)
[pid  4083] close(40)                   = -1 EBADF (Bad file descriptor)
[pid  4083] close(41 <unfinished ...>
[pid  4069] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4083] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4069] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4083] close(43 <unfinished ...>
[pid  4069] getpid( <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] <... getpid resumed>)       = 1
[pid  4083] close(44)                   = -1 EBADF (Bad file descriptor)
[pid  4069] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz1", 0777 <unfinished ...>
[pid  4083] close(45)                   = -1 EBADF (Bad file descriptor)
[pid  4069] <... mkdirat resumed>)      = 0
[pid  4083] close(46)                   = -1 EBADF (Bad file descriptor)
[pid  4083] close(47)                   = -1 EBADF (Bad file descriptor)
[pid  4083] close(48 <unfinished ...>
[pid  4069] openat(AT_FDCWD, "/syzcgroup/unified/syz1/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4083] close(49)                   = -1 EBADF (Bad file descriptor)
[pid  4083] close(50)                   = -1 EBADF (Bad file descriptor)
[pid  4069] <... openat resumed>)       = 3
[pid  4083] close(51)                   = -1 EBADF (Bad file descriptor)
[pid  4083] close(52 <unfinished ...>
[pid  4069] write(3, "32", 2 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] <... write resumed>)        = 2
[pid  4083] close(53)                   = -1 EBADF (Bad file descriptor)
[pid  4069] close(3 <unfinished ...>
[pid  4083] close(54 <unfinished ...>
[pid  4069] <... close resumed>)        = 0
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4083] close(55 <unfinished ...>
[pid  4069] openat(AT_FDCWD, "/syzcgroup/unified/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4083] close(56 <unfinished ...>
[pid  4069] <... openat resumed>)       = 3
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4083] close(57 <unfinished ...>
[pid  4069] write(3, "1", 1 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4083] close(58)                   = -1 EBADF (Bad file descriptor)
[pid  4069] <... write resumed>)        = 1
[pid  4083] close(59 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 84
[pid  4033] <... epoll_pwait resumed>, [], 128, 432, NULL, 0) = 0
[pid  4031] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4083] close(60 <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=104, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=84, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00\x03\x00\x69\x70\x36\x67\x72\x65\x74\x61\x70\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x14\x00\x12\x00\x0d\x00\x01\x00\x69\x70\x36\x67\x72\x65\x74\x61\x70\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 104
[pid  4033] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] close(3 <unfinished ...>
[pid  4068] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4058] sendto(3, [{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x03\x00\x62\x72\x69\x64\x67\x65\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x0a\x00\x01\x00\x62\x72\x69\x64\x67\x65\x00\x00"], 76, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4033] futex(0x16a7c9156960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4083] close(61 <unfinished ...>
[pid  4069] <... close resumed>)        = 0
[pid  4068] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4033] <... futex resumed>)        = 1
[pid  4032] <... futex resumed>)        = 0
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4031] epoll_pwait(4 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4033] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4031] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4083] close(62 <unfinished ...>
[pid  4068] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4033] futex(0x16a7c9157160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz1", 0777 <unfinished ...>
[pid  4068] getpid( <unfinished ...>
[pid  4083] close(63 <unfinished ...>
[pid  4068] <... getpid resumed>)       = 1
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=595504842} <unfinished ...>
[pid  4068] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz2", 0777) = -1 EEXIST (File exists)
[pid  4068] openat(AT_FDCWD, "/syzcgroup/unified/syz2/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] <... openat resumed>)       = 3
[pid  4083] close(64)                   = -1 EBADF (Bad file descriptor)
[pid  4068] write(3, "32", 2 <unfinished ...>
[pid  4083] close(65)                   = -1 EBADF (Bad file descriptor)
[pid  4068] <... write resumed>)        = 2
[pid  4083] close(66 <unfinished ...>
[pid  4068] close(3 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] <... close resumed>)        = 0
[pid  4083] close(67)                   = -1 EBADF (Bad file descriptor)
[pid  4068] openat(AT_FDCWD, "/syzcgroup/unified/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4083] close(68)                   = -1 EBADF (Bad file descriptor)
[pid  4083] close(69 <unfinished ...>
[pid  4069] <... mkdirat resumed>)      = 0
[pid  4068] <... openat resumed>)       = 3
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4083] close(70)                   = -1 EBADF (Bad file descriptor)
[pid  4068] write(3, "1", 1 <unfinished ...>
[pid  4083] close(71 <unfinished ...>
[pid  4069] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] <... openat resumed>)       = 3
[pid  4083] close(72 <unfinished ...>
[pid  4069] write(3, "1", 1 <unfinished ...>
[pid  4068] <... write resumed>)        = 1
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] close(3 <unfinished ...>
[pid  4083] close(73 <unfinished ...>
[pid  4069] <... write resumed>)        = 1
[pid  4068] <... close resumed>)        = 0
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4083] close(74 <unfinished ...>
[pid  4069] close(3 <unfinished ...>
[pid  4068] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz2", 0777 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4083] close(75 <unfinished ...>
[pid  4068] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] <... close resumed>)        = 0
[pid  4068] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4083] close(76 <unfinished ...>
[pid  4069] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4068] <... openat resumed>)       = 3
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] <... openat resumed>)       = 3
[pid  4083] close(77 <unfinished ...>
[pid  4068] write(3, "1", 1 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4083] close(78 <unfinished ...>
[pid  4069] write(3, "313524224", 9 <unfinished ...>
[pid  4068] <... write resumed>)        = 1
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4083] close(79 <unfinished ...>
[pid  4069] <... write resumed>)        = 9
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] close(3 <unfinished ...>
[pid  4068] close(3 <unfinished ...>
[pid  4083] close(80 <unfinished ...>
[pid  4069] <... close resumed>)        = 0
[pid  4068] <... close resumed>)        = 0
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4069] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4083] close(81)                   = -1 EBADF (Bad file descriptor)
[pid  4069] <... openat resumed>)       = 3
[pid  4068] <... openat resumed>)       = 3
[pid  4083] close(82 <unfinished ...>
[pid  4068] write(3, "313524224", 9 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] write(3, "314572800", 9 <unfinished ...>
[pid  4068] <... write resumed>)        = 9
[pid  4083] close(83 <unfinished ...>
[pid  4069] <... write resumed>)        = 9
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] close(3 <unfinished ...>
[pid  4083] close(84 <unfinished ...>
[pid  4069] close(3 <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4058] <... sendto resumed>)       = 76
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] <... close resumed>)        = 0
[pid  4069] mkdirat(AT_FDCWD, "/syzcgroup/net/syz1", 0777 <unfinished ...>
[pid  4068] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4083] close(85 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=96, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x03\x00\x62\x72\x69\x64\x67\x65\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x0a\x00\x01\x00\x62\x72\x69\x64\x67\x65\x00\x00"]}], 4096, 0, NULL, NULL) = 96
[pid  4083] close(86 <unfinished ...>
[pid  4069] <... mkdirat resumed>)      = 0
[pid  4068] <... openat resumed>)       = 3
[pid  4058] sendto(3, [{nlmsg_len=72, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x76\x63\x61\x6e\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x76\x63\x61\x6e"], 72, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] openat(AT_FDCWD, "/syzcgroup/net/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4068] write(3, "314572800", 9 <unfinished ...>
[pid  4083] close(87 <unfinished ...>
[pid  4068] <... write resumed>)        = 9
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] close(3 <unfinished ...>
[pid  4083] close(88)                   = -1 EBADF (Bad file descriptor)
[pid  4083] close(89)                   = -1 EBADF (Bad file descriptor)
[pid  4083] close(90)                   = -1 EBADF (Bad file descriptor)
[pid  4083] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4083] close(92)                   = -1 EBADF (Bad file descriptor)
[pid  4083] close(93 <unfinished ...>
[pid  4069] <... openat resumed>)       = 3
[pid  4068] <... close resumed>)        = 0
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4083] close(94 <unfinished ...>
[pid  4068] mkdirat(AT_FDCWD, "/syzcgroup/net/syz2", 0777 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4083] close(95)                   = -1 EBADF (Bad file descriptor)
[pid  4068] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4083] close(96)                   = -1 EBADF (Bad file descriptor)
[pid  4083] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4083] close(98)                   = -1 EBADF (Bad file descriptor)
[pid  4083] close(99)                   = -1 EBADF (Bad file descriptor)
[pid  4083] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(102 <unfinished ...>
[pid  4069] write(3, "1", 1 <unfinished ...>
[pid  4068] openat(AT_FDCWD, "/syzcgroup/net/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4083] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(104 <unfinished ...>
[pid  4069] <... write resumed>)        = 1
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] <... openat resumed>)       = 3
[pid  4083] close(105 <unfinished ...>
[pid  4068] write(3, "1", 1 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] <... write resumed>)        = 1
[pid  4083] close(106 <unfinished ...>
[pid  4068] close(3 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] <... close resumed>)        = 0
[pid  4083] close(107 <unfinished ...>
[pid  4069] close(3 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 72
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4083] close(108 <unfinished ...>
[pid  4069] <... close resumed>)        = 0
[pid  4068] <... socket resumed>)       = 3
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=92, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=72, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x76\x63\x61\x6e\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x76\x63\x61\x6e"]}], 4096, 0, NULL, NULL) = 92
[pid  4083] close(109 <unfinished ...>
[pid  4069] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4068] <... getsockopt resumed>, 0x7fd83eef73e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=72, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x62\x6f\x6e\x64\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x62\x6f\x6e\x64"], 72, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4083] close(110 <unfinished ...>
[pid  4069] <... socket resumed>)       = 3
[pid  4068] <... getsockopt resumed>, 0x7fd83eef7a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4083] close(111 <unfinished ...>
[pid  4069] <... getsockopt resumed>, 0x7efe5bbe73e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4068] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4083] close(112 <unfinished ...>
[pid  4069] <... getsockopt resumed>, 0x7efe5bbe7a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4068] <... getsockopt resumed>, 0x7fd83eef80e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4083] close(113 <unfinished ...>
[pid  4068] close(3 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4083] close(114 <unfinished ...>
[pid  4069] <... getsockopt resumed>, 0x7efe5bbe80e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] close(3 <unfinished ...>
[pid  4083] close(115 <unfinished ...>
[pid  4069] <... close resumed>)        = 0
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4083] close(116 <unfinished ...>
[pid  4069] <... socket resumed>)       = 3
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4083] close(117 <unfinished ...>
[pid  4069] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO, 0x7efe5bbe8768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4068] <... socket resumed>)       = 3
[pid  4069] close(3)                    = 0
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4083] close(118 <unfinished ...>
[pid  4069] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4068] <... getsockopt resumed>, 0x7fd83eef8768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4069] <... socket resumed>)       = 3
[pid  4068] close(3 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] <... close resumed>)        = 0
[pid  4083] close(119 <unfinished ...>
[pid  4068] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4068] <... socket resumed>)       = 3
[pid  4083] close(120 <unfinished ...>
[pid  4069] <... getsockopt resumed>, 0x7efe5bbeafc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4068] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4083] close(121 <unfinished ...>
[pid  4069] <... getsockopt resumed>, 0x7efe5bbeb688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4083] close(122 <unfinished ...>
[pid  4069] <... getsockopt resumed>, 0x7efe5bbebd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4083] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4069] <... getsockopt resumed>, 0x7efe5bbec408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4068] <... getsockopt resumed>, 0x7fd83eefafc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4083] close(124 <unfinished ...>
[pid  4069] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4068] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] <... getsockopt resumed>, 0x7efe5bbecac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4068] <... getsockopt resumed>, 0x7fd83eefb688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4083] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(128 <unfinished ...>
[pid  4068] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4069] close(3 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] <... close resumed>)        = 0
[pid  4068] <... getsockopt resumed>, 0x7fd83eefbd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4083] close(129 <unfinished ...>
[pid  4068] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] <... getsockopt resumed>, 0x7fd83eefc408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4083] close(130 <unfinished ...>
[pid  4068] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] <... getsockopt resumed>, 0x7fd83eefcac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4083] close(131 <unfinished ...>
[pid  4068] close(3 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 72
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4083] close(132 <unfinished ...>
[pid  4068] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] <... socket resumed>)       = 3
[pid  4083] close(133 <unfinished ...>
[pid  4069] <... socket resumed>)       = 3
[pid  4068] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=92, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=72, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x62\x6f\x6e\x64\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x62\x6f\x6e\x64"]}], 4096, 0, NULL, NULL) = 92
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4068] <... getsockopt resumed>, 0x7fd83eef8e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4083] close(134 <unfinished ...>
[pid  4069] <... getsockopt resumed>, 0x7efe5bbe8e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4068] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=72, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x74\x65\x61\x6d\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x74\x65\x61\x6d"], 72, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4068] <... getsockopt resumed>, 0x7fd83eef94c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4083] close(135 <unfinished ...>
[pid  4068] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] <... getsockopt resumed>, 0x7fd83eef9b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4083] close(136 <unfinished ...>
[pid  4068] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] <... getsockopt resumed>, 0x7fd83eefa248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4083] close(137 <unfinished ...>
[pid  4068] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] <... getsockopt resumed>, 0x7fd83eefa908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4083] close(138 <unfinished ...>
[pid  4068] close(3 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] <... close resumed>)        = 0
[pid  4083] close(139 <unfinished ...>
[pid  4069] <... getsockopt resumed>, 0x7efe5bbe94c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4068] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] <... write resumed>)        = 4
[pid  4083] close(140 <unfinished ...>
[pid  4068] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4068] <... mkdirat resumed>)      = 0
[pid  4069] <... getsockopt resumed>, 0x7efe5bbe9b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4083] close(141 <unfinished ...>
[pid  4069] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4068] openat(AT_FDCWD, "/dev/loop2", O_RDWR <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] <... getsockopt resumed>, 0x7efe5bbea248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4068] <... openat resumed>)       = 3
[pid  4083] close(142 <unfinished ...>
[pid  4068] ioctl(3, LOOP_CLR_FD)       = -1 ENXIO (No such device or address)
[pid  4068] close(3 <unfinished ...>
[pid  4069] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4069] <... getsockopt resumed>, 0x7efe5bbea908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4083] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4069] close(3 <unfinished ...>
[pid  4068] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4069] <... close resumed>)        = 0
[pid  4083] close(144 <unfinished ...>
[pid  4068] <... socket resumed>)       = 3
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4068] close(3 <unfinished ...>
[pid  4083] close(145 <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] <... write resumed>)        = 4
[pid  4068] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4083] close(146 <unfinished ...>
[pid  4069] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] <... mkdirat resumed>)      = 0
[pid  4083] close(147 <unfinished ...>
[pid  4069] openat(AT_FDCWD, "/dev/loop1", O_RDWR <unfinished ...>
[pid  4068] <... socket resumed>)       = 3
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] <... openat resumed>)       = 3
[pid  4083] close(148 <unfinished ...>
[pid  4069] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4068] close(3 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 72
[pid  4069] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4069] close(3 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4069] <... close resumed>)        = 0
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=92, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=72, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x74\x65\x61\x6d\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x74\x65\x61\x6d"]}], 4096, 0, NULL, NULL) = 92
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4058] sendto(3, [{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x64\x75\x6d\x6d\x79\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x09\x00\x01\x00\x64\x75\x6d\x6d\x79\x00\x00\x00"], 76, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4083] close(149 <unfinished ...>
[pid  4069] <... socket resumed>)       = 3
[pid  4068] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4069] close(3)                    = 0
[pid  4069] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] <... socket resumed>)       = 3
[pid  4083] close(150 <unfinished ...>
[pid  4068] <... socket resumed>)       = 3
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] close(3 <unfinished ...>
[pid  4068] close(3 <unfinished ...>
[pid  4083] close(151 <unfinished ...>
[pid  4069] <... close resumed>)        = 0
[pid  4068] <... close resumed>)        = 0
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4068] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4083] close(152 <unfinished ...>
[pid  4069] <... socket resumed>)       = 3
[pid  4068] <... socket resumed>)       = 3
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] close(3 <unfinished ...>
[pid  4083] close(153 <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4068] read(249 <unfinished ...>
[pid  4083] close(154 <unfinished ...>
[pid  4069] close(3 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4083] close(155 <unfinished ...>
[pid  4069] <... close resumed>)        = 0
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4083] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(158 <unfinished ...>
[pid  4069] <... socket resumed>)       = 3
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4069] close(3 <unfinished ...>
[pid  4083] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4069] <... close resumed>)        = 0
[pid  4083] close(161 <unfinished ...>
[pid  4069] read(249 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4083] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(163)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(164)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(168)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(169)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(182)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(183)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(184)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(185)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(186)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(188)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(189)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(190)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(191)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(194)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(195)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(196)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(200)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(202)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... sendto resumed>)       = 76
[pid  4083] close(204 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4083] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=96, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x64\x75\x6d\x6d\x79\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x09\x00\x01\x00\x64\x75\x6d\x6d\x79\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 96
[pid  4083] close(205)                  = -1 EBADF (Bad file descriptor)
[pid  4058] sendto(3, [{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x6e\x69\x63\x76\x66\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x09\x00\x01\x00\x6e\x69\x63\x76\x66\x00\x00\x00"], 76, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4083] close(206)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(207)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(208)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(209)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(210)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(211)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(213)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(214)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(215)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(216)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(217)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(218)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(219)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(220)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(223)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(224)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(225)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(228)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(229)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(230)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(231)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(232)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(233)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(234)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(235)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(236)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(237)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(240)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(241)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(244)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(245)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(246)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(247)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(248)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(251)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(252)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(253)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4083] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4083] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4083] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffc25fc6ad0 /* 2 vars */ <unfinished ...>
[pid  4041] <... clone3 resumed>)       = 4083
[pid  4083] <... execve resumed>)       = 0
[pid  4041] munmap(0x7f809d8bf000, 36864) = 0
[pid  4041] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4041] fcntl(34, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4041] fcntl(34, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4041] fcntl(36, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4041] fcntl(36, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4041] close(29)                   = 0
[pid  4041] close(35)                   = 0
[pid  4041] close(37)                   = 0
[pid  4041] close(25)                   = 0
[pid  4041] close(26)                   = 0
[pid  4041] close(28)                   = 0
[pid  4041] write(32, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\x38\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4041] pselect6(37, [3 11 13 16 18 21 23 31 33 34 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8}) = 4 (in [3 11 16 21], left {tv_sec=0, tv_nsec=999986425})
[pid  4041] read(3, "\xbc\x00\x00\x00", 4) = 4
[pid  4041] read(3 <unfinished ...>
[pid  4083] brk(NULL <unfinished ...>
[pid  4058] <... sendto resumed>)       = 76
[pid  4041] <... read resumed>, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x10\x38\x04\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] read(11 <unfinished ...>
[pid  4083] <... brk resumed>)          = 0x55558dae0000
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=96, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x6e\x69\x63\x76\x66\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x09\x00\x01\x00\x6e\x69\x63\x76\x66\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 96
[pid  4041] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4083] brk(0x55558dae0e80 <unfinished ...>
[pid  4041] write(3, "\x2c\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x0e\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x00\x00\x06\x00\x0c\x00\x04\x00\x06\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4083] <... brk resumed>)          = 0x55558dae0e80
[pid  4058] sendto(3, [{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x6e\x6c\x6d\x6f\x6e\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x09\x00\x01\x00\x6e\x6c\x6d\x6f\x6e\x00\x00\x00"], 76, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4032] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fa8a7c277000002}], 128, 597, NULL, 0) = 1
[pid  4083] arch_prctl(ARCH_SET_FS, 0x55558dae0500 <unfinished ...>
[pid  4041] write(10, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4041] read(16, "\x00\x00\x00\x00", 4) = 4
[pid  4041] write(3, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00", 56) = 56
[pid  4083] <... arch_prctl resumed>)   = 0
[pid  4056] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4032] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1) = 1
[pid  4031] <... futex resumed>)        = 0
[pid  4083] set_tid_address(0x55558dae07d0) = 4083
[pid  4031] sched_yield( <unfinished ...>
[pid  4083] set_robust_list(0x55558dae07e0, 24) = 0
[pid  4083] prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4083] readlinkat(AT_FDCWD, "/proc/self/exe", "/syz-executor", 4096) = 13
[pid  4083] getrandom("\x4a\x02\xa5\x08\x21\x73\x0d\x76", 8, GRND_NONBLOCK) = 8
[pid  4083] brk(NULL)                   = 0x55558dae0e80
[pid  4083] brk(0x55558db01e80)         = 0x55558db01e80
[pid  4083] brk(0x55558db02000 <unfinished ...>
[pid  4032] read(6, "\x2c\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x0e\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x00\x00\x06\x00\x0c\x00\x04\x00\x06\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00"..., 21347228) = 104
[pid  4083] <... brk resumed>)          = 0x55558db02000
[pid  4032] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x10\xb8\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0c\x00\x00\x00"..., 192 <unfinished ...>
[pid  4083] mprotect(0x7f367c129000, 1236992, PROT_READ <unfinished ...>
[pid  4031] <... sched_yield resumed>)  = 0
[pid  4083] <... mprotect resumed>)     = 0
[pid  4031] epoll_pwait(4 <unfinished ...>
[pid  4083] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4032] <... write resumed>)        = 192
[pid  4031] <... epoll_pwait resumed>, [{events=EPOLLOUT, data=0x3fa8a7c277000002}], 128, 0, NULL, 0) = 1
[pid  4083] <... prctl resumed>)        = 0
[pid  4032] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x20\x38\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0d\x00\x00\x00"..., 192 <unfinished ...>
[pid  4031] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4083] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4056] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4031] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4083] <... mmap resumed>)         = 0x1ffffffff000
[pid  4083] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4056] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4032] <... write resumed>)        = 192
[pid  4083] <... mmap resumed>)         = 0x200000000000
[pid  4056] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4032] read(6 <unfinished ...>
[pid  4031] epoll_pwait(4 <unfinished ...>
[pid  4083] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4032] <... read resumed>, 0x16a7cd080000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4031] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4083] <... mmap resumed>)         = 0x200001000000
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4083] rt_sigaction(SIGCHLD, {sa_handler=0x7f367bec0780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f367bfae1d0} <unfinished ...>
[pid  4032] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
/strace: Process 4110 attached
[pid  4083] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4032] futex(0x16a7c9157160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4110] set_robust_list(0x5555684e97e0, 24 <unfinished ...>
[pid  4083] pkey_alloc(0, PKEY_UNRESTRICTED <unfinished ...>
[pid  4056] <... clone resumed>, child_tidptr=0x5555684e97d0) = 2
[pid  4033] <... futex resumed>)        = 0
[pid  4032] <... futex resumed>)        = 1
[pid  4110] <... set_robust_list resumed>) = 0
[pid  4083] <... pkey_alloc resumed>)   = -1 EINVAL (Invalid argument)
[pid  4056] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4083] getrandom( <unfinished ...>
[pid  4033] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4110] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4083] <... getrandom resumed>"\x48\x17\xbf\x5a\xca\xe1\x02\x92", 8, GRND_NONBLOCK) = 8
[pid  4056] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4033] write(5, "\x01\x00\x00\x00\x00\x00\x00\x00", 8 <unfinished ...>
[pid  4110] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4083] mkdir("./syzkaller.OE5vgi", 0700 <unfinished ...>
[pid  4033] <... write resumed>)        = 8
[pid  4032] <... epoll_pwait resumed>, [{events=EPOLLIN, data=0x33dbe88}], 128, 332, NULL, 0) = 1
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=315156851} <unfinished ...>
[pid  4033] futex(0x16a7c9157160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4083] <... mkdir resumed>)        = 0
[pid  4032] read(5, "\x01\x00\x00\x00\x00\x00\x00\x00", 8) = 8
[pid  4032] epoll_pwait(4, [], 128, 0, NULL, 0) = 0
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4083] chmod("./syzkaller.OE5vgi", 0777) = 0
[pid  4083] chdir("./syzkaller.OE5vgi") = 0
[pid  4083] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
[pid  4083] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4110] chdir("./0" <unfinished ...>
[pid  4083] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4083] rt_sigaction(SIGSEGV, {sa_handler=0x7f367bec2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f367bfae1d0}, NULL, 8) = 0
[pid  4110] <... chdir resumed>)        = 0
[pid  4083] rt_sigaction(SIGBUS, {sa_handler=0x7f367bec2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f367bfae1d0}, NULL, 8) = 0
[pid  4083] getpid()                    = 4083
[pid  4083] mmap(0x1b32f20000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0) = 0x1b32f20000
[pid  4083] getpid()                    = 4083
[pid  4083] mmap(0x1b33f24000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0) = 0x1b33f24000
[pid  4110] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4083] close(3)                    = 0
[pid  4083] fcntl(5, F_GETFD)           = -1 EBADF (Bad file descriptor)
[pid  4083] fcntl(6, F_GETFD)           = -1 EBADF (Bad file descriptor)
[pid  4083] dup2(0, 249)                = 249
[pid  4083] dup2(1, 248 <unfinished ...>
[pid  4110] <... prctl resumed>)        = 0
[pid  4083] <... dup2 resumed>)         = 248
[pid  4110] setpgid(0, 0 <unfinished ...>
[pid  4083] dup2(2, 1)                  = 1
[pid  4083] dup2(2, 0)                  = 0
[pid  4083] read(249, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\x38\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4083] unshare(CLONE_NEWPID)       = 0
[pid  4083] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4083] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4110] <... setpgid resumed>)      = 0
/strace: Process 4111 attached
[pid  4110] symlinkat("/syzcgroup/unified/syz0", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4058] <... sendto resumed>)       = 76
[pid  4041] write(15, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4111] set_robust_list(0x55558dae07e0, 24 <unfinished ...>
[pid  4110] <... symlinkat resumed>)    = 0
[pid  4083] <... clone resumed>, child_tidptr=0x55558dae07d0) = 4111
[pid  4069] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] <... write resumed>)        = 48
[pid  4111] <... set_robust_list resumed>) = 0
[pid  4110] symlinkat("/syzcgroup/cpu/syz0", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4083] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4069] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4111] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4110] <... symlinkat resumed>)    = 0
[pid  4083] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4069] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=96, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x6e\x6c\x6d\x6f\x6e\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x09\x00\x01\x00\x6e\x6c\x6d\x6f\x6e\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 96
[pid  4041] read(21 <unfinished ...>
[pid  4111] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4110] symlinkat("/syzcgroup/net/syz0", AT_FDCWD, "./cgroup.net" <unfinished ...>
[pid  4069] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4111] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  4111] getppid( <unfinished ...>
[pid  4041] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4111] <... getppid resumed>)      = 0
[pid  4041] write(3, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x02\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00", 56 <unfinished ...>
[pid  4111] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=72, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x63\x61\x69\x66\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x63\x61\x69\x66"], 72, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] <... write resumed>)        = 56
[pid  4032] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fa8a7c277000002}], 128, 311, NULL, 0) = 1
/strace: Process 4114 attached
[pid  4111] <... openat resumed>)       = 3
[pid  4110] <... symlinkat resumed>)    = 0
[pid  4111] dup2(3, 201 <unfinished ...>
[pid  4114] set_robust_list(0x55557b5837e0, 24 <unfinished ...>
[pid  4110] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4032] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4114] <... set_robust_list resumed>) = 0
[pid  4111] <... dup2 resumed>)         = 201
[pid  4111] close(3)                    = 0
[pid  4114] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4111] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4114] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4032] <... futex resumed>)        = 1
[pid  4031] <... futex resumed>)        = 0
[pid  4031] sched_yield()               = 0
[pid  4111] <... prlimit64 resumed>, NULL) = 0
[pid  4031] futex(0x16a7c9156538, FUTEX_WAIT_PRIVATE, 4294967295, NULL <unfinished ...>
[pid  4111] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  4114] chdir("./0" <unfinished ...>
[pid  4111] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024} <unfinished ...>
[pid  4069] <... clone resumed>, child_tidptr=0x55557b5837d0) = 2
[pid  4032] futex(0x16a7c9156538, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4110] <... openat resumed>)       = 3
[pid  4111] <... prlimit64 resumed>, NULL) = 0
[pid  4069] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4032] <... futex resumed>)        = 1
[pid  4031] <... futex resumed>)        = 0
[pid  4111] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4069] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4032] read(6 <unfinished ...>
[pid  4114] <... chdir resumed>)        = 0
[pid  4110] write(3, "1000", 4 <unfinished ...>
[pid  4032] <... read resumed>, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x02\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00", 21347228) = 56
[pid  4114] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4111] <... prlimit64 resumed>, NULL) = 0
[pid  4110] <... write resumed>)        = 4
[pid  4114] <... prctl resumed>)        = 0
[pid  4111] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} <unfinished ...>
[pid  4031] epoll_pwait(4 <unfinished ...>
[pid  4114] setpgid(0, 0 <unfinished ...>
[pid  4111] <... prlimit64 resumed>, NULL) = 0
[pid  4110] close(3 <unfinished ...>
[pid  4032] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x14\x38\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0e\x00\x00\x00"..., 192 <unfinished ...>
[pid  4031] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4114] <... setpgid resumed>)      = 0
[pid  4111] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  4110] <... close resumed>)        = 0
[pid  4111] unshare(CLONE_NEWNS)        = 0
[pid  4110] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs" <unfinished ...>
[pid  4114] symlinkat("/syzcgroup/unified/syz1", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4110] <... symlinkat resumed>)    = 0
[pid  4111] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4110] close(249 <unfinished ...>
[pid  4111] <... mount resumed>)        = 0
[pid  4110] <... close resumed>)        = 0
[pid  4111] unshare(CLONE_NEWIPC <unfinished ...>
[pid  4114] <... symlinkat resumed>)    = 0
[pid  4110] close(248 <unfinished ...>
[pid  4032] <... write resumed>)        = 192
[pid  4114] symlinkat("/syzcgroup/cpu/syz1", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4111] <... unshare resumed>)      = 0
[pid  4110] <... close resumed>)        = 0
[pid  4032] read(6 <unfinished ...>
[pid  4114] <... symlinkat resumed>)    = 0
[pid  4110] prctl(PR_SET_NAME, "syz.0.1" <unfinished ...>
[pid  4032] <... read resumed>, 0x16a7cd080000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4114] symlinkat("/syzcgroup/net/syz1", AT_FDCWD, "./cgroup.net" <unfinished ...>
[pid  4110] <... prctl resumed>)        = 0
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4110] close(4 <unfinished ...>
[pid  4031] epoll_pwait(4 <unfinished ...>
[pid  4032] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4110] <... close resumed>)        = 0
[pid  4031] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4110] futex(0x7fa843f35fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4111] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4114] <... symlinkat resumed>)    = 0
[pid  4111] <... unshare resumed>)      = 0
[pid  4114] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4111] unshare(CLONE_NEWUTS <unfinished ...>
[pid  4110] <... futex resumed>)        = 0
[pid  4114] <... openat resumed>)       = 3
[pid  4111] <... unshare resumed>)      = 0
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=197199759} <unfinished ...>
[pid  4114] write(3, "1000", 4 <unfinished ...>
[pid  4111] unshare(CLONE_SYSVSEM <unfinished ...>
[pid  4110] rt_sigaction(SIGRT_1, {sa_handler=0x7fa843cdc3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fa843c5e1d0} <unfinished ...>
[pid  4114] <... write resumed>)        = 4
[pid  4114] close(3 <unfinished ...>
[pid  4110] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4111] <... unshare resumed>)      = 0
[pid  4114] <... close resumed>)        = 0
[pid  4110] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4111] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4058] <... sendto resumed>)       = 72
[pid  4114] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs" <unfinished ...>
[pid  4110] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4110] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4058] recvfrom(3, [{nlmsg_len=92, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=72, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x63\x61\x69\x66\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x63\x61\x69\x66"]}], 4096, 0, NULL, NULL) = 92
[pid  4114] <... symlinkat resumed>)    = 0
[pid  4111] <... openat resumed>)       = 3
[pid  4110] <... mmap resumed>)         = 0x7fa843aff000
[pid  4058] sendto(3, [{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x03\x00\x62\x61\x74\x61\x64\x76\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x0a\x00\x01\x00\x62\x61\x74\x61\x64\x76\x00\x00"], 76, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] write(20, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4114] close(249 <unfinished ...>
[pid  4111] write(3, "16777216", 8 <unfinished ...>
[pid  4110] mprotect(0x7fa843b00000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4114] <... close resumed>)        = 0
[pid  4111] <... write resumed>)        = 8
[pid  4111] close(3 <unfinished ...>
[pid  4114] close(248 <unfinished ...>
[pid  4111] <... close resumed>)        = 0
[pid  4110] <... mprotect resumed>)     = 0
[pid  4114] <... close resumed>)        = 0
[pid  4111] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4068] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4041] <... write resumed>)        = 48
[pid  4114] prctl(PR_SET_NAME, "syz.1.2" <unfinished ...>
[pid  4111] <... openat resumed>)       = 3
[pid  4110] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4114] <... prctl resumed>)        = 0
[pid  4111] write(3, "536870912", 9 <unfinished ...>
[pid  4068] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4041] pselect6(37, [3 11 13 16 18 21 23 31 33 34 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4114] mmap(0x1b32064000, 6029312, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0x40000 <unfinished ...>
[pid  4111] <... write resumed>)        = 9
[pid  4110] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4068] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4041] <... pselect6 resumed>)     = 1 (in [3], left {tv_sec=0, tv_nsec=999985332})
[pid  4114] <... mmap resumed>)         = 0x1b32064000
[pid  4111] close(3 <unfinished ...>
[pid  4110] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fa843b1f990, parent_tid=0x7fa843b1f990, exit_signal=0, stack=0x7fa843aff000, stack_size=0x201c0, tls=0x7fa843b1f6c0} <unfinished ...>
[pid  4068] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4041] read(3/strace: Process 4119 attached
 <unfinished ...>
[pid  4114] close(4 <unfinished ...>
[pid  4111] <... close resumed>)        = 0
[pid  4119] set_robust_list(0x7fa843b1f9a0, 24 <unfinished ...>
[pid  4114] <... close resumed>)        = 0
[pid  4111] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4110] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4041] <... read resumed>, "\xbc\x00\x00\x00", 4) = 4
[pid  4119] <... set_robust_list resumed>) = 0
[pid  4041] read(3, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x10\xb8\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4110] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4041] pselect6(37, [3 11 13 16 18 21 23 31 33 34 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4119] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4111] <... openat resumed>)       = 3
[pid  4110] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4041] <... pselect6 resumed>)     = 1 (in [3], left {tv_sec=0, tv_nsec=999986248})
[pid  4041] read(3 <unfinished ...>
[pid  4119] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4110] futex(0x7fa843f35fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4041] <... read resumed>, "\xbc\x00\x00\x00", 4) = 4
[pid  4119] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4114] futex(0x7efe5bc15fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4111] write(3, "1024", 4 <unfinished ...>
[pid  4110] <... futex resumed>)        = 0
[pid  4119] <... mmap resumed>)         = 0x1ffffffff000
[pid  4114] <... futex resumed>)        = 0
[pid  4111] <... write resumed>)        = 4
[pid  4110] futex(0x7fa843f35fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4041] read(3 <unfinished ...>
[pid  4119] futex(0x7fa843f35fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4114] rt_sigaction(SIGRT_1, {sa_handler=0x7efe5b9bc3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7efe5b93e1d0} <unfinished ...>
[pid  4111] close(3 <unfinished ...>
[pid  4110] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4041] <... read resumed>, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x20\x38\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0d\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4119] <... futex resumed>)        = 0
[pid  4114] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4111] <... close resumed>)        = 0
[pid  4110] futex(0x7fa843f35fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4041] pselect6(37, [3 11 13 16 18 21 23 31 33 34 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4119] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4114] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4111] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] <... pselect6 resumed>)     = 1 (in [3], left {tv_sec=0, tv_nsec=999985785})
[pid  4119] <... mmap resumed>)         = 0x200000000000
[pid  4114] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4111] <... openat resumed>)       = 3
[pid  4110] <... futex resumed>)        = 0
[pid  4041] read(3 <unfinished ...>
[pid  4119] futex(0x7fa843f35fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4114] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4111] write(3, "8192", 4 <unfinished ...>
[pid  4041] <... read resumed>, "\xbc\x00\x00\x00", 4) = 4
[pid  4119] <... futex resumed>)        = 0
[pid  4114] <... mmap resumed>)         = 0x7efe597c9000
[pid  4111] <... write resumed>)        = 4
[pid  4119] futex(0x7fa843f35fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4114] mprotect(0x7efe597ca000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4111] close(3 <unfinished ...>
[pid  4110] futex(0x7fa843f35fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4041] read(3 <unfinished ...>
[pid  4114] <... mprotect resumed>)     = 0
[pid  4111] <... close resumed>)        = 0
[pid  4110] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4111] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4114] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4111] <... openat resumed>)       = 3
[pid  4110] futex(0x7fa843f35fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4114] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4114] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7efe597e9990, parent_tid=0x7efe597e9990, exit_signal=0, stack=0x7efe597c9000, stack_size=0x201c0, tls=0x7efe597e96c0} <unfinished ...>
[pid  4110] <... futex resumed>)        = 1
[pid  4041] <... read resumed>, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x14\x38\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4119] <... futex resumed>)        = 0
[pid  4110] futex(0x7fa843f35fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4041] pselect6(37, [3 11 13 16 18 21 23 31 33 34 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4119] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4111] write(3, "1024", 4/strace: Process 4120 attached
 <unfinished ...>
[pid  4119] <... mmap resumed>)         = 0x200001000000
[pid  4111] <... write resumed>)        = 4
[pid  4120] set_robust_list(0x7efe597e99a0, 24 <unfinished ...>
[pid  4119] futex(0x7fa843f35fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4114] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4111] close(3 <unfinished ...>
[pid  4120] <... set_robust_list resumed>) = 0
[pid  4119] <... futex resumed>)        = 1
[pid  4114] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4119] futex(0x7fa843f35fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4120] rt_sigprocmask(SIG_SETMASK, []/strace: Process 4121 attached
 <unfinished ...>
[pid  4114] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4111] <... close resumed>)        = 0
[pid  4120] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4110] <... futex resumed>)        = 0
[pid  4058] <... sendto resumed>)       = 76
[pid  4121] set_robust_list(0x55555c7fb7e0, 24 <unfinished ...>
[pid  4120] ioctl(216, KCOV_ENABLE, 0 <unfinished ...>
[pid  4114] futex(0x7efe5bc15fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4110] close_range(3, 30, 0 <unfinished ...>
[pid  4068] <... clone resumed>, child_tidptr=0x55555c7fb7d0) = 2
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4121] <... set_robust_list resumed>) = 0
[pid  4120] <... ioctl resumed>)        = 0
[pid  4114] <... futex resumed>)        = 0
[pid  4111] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4110] <... close_range resumed>)  = 0
[pid  4068] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=96, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x03\x00\x62\x61\x74\x61\x64\x76\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x0a\x00\x01\x00\x62\x61\x74\x61\x64\x76\x00\x00"]}], 4096, 0, NULL, NULL) = 96
[pid  4121] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4120] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4114] futex(0x7efe5bc15fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4111] <... openat resumed>)       = 3
[pid  4110] exit_group(0 <unfinished ...>
[pid  4068] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4058] sendto(3, [{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x76\x78\x63\x61\x6e\x31\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x09\x00\x01\x00\x76\x78\x63\x61\x6e\x00\x00\x00"], 76, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4121] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4120] <... mmap resumed>)         = 0x1ffffffff000
[pid  4119] <... futex resumed>)        = ?
[pid  4111] write(3, "1024", 4 <unfinished ...>
[pid  4110] <... exit_group resumed>)   = ?
[pid  4120] futex(0x7efe5bc15fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4111] <... write resumed>)        = 4
[pid  4120] <... futex resumed>)        = 1
[pid  4114] <... futex resumed>)        = 0
[pid  4111] close(3 <unfinished ...>
[pid  4120] futex(0x7efe5bc15fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4111] <... close resumed>)        = 0
[pid  4121] chdir("./0" <unfinished ...>
[pid  4111] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4114] futex(0x7efe5bc15fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4111] <... openat resumed>)       = 3
[pid  4111] write(3, "1024 1048576 500 1024", 21 <unfinished ...>
[pid  4121] <... chdir resumed>)        = 0
[pid  4120] <... futex resumed>)        = 0
[pid  4119] +++ exited with 0 +++
[pid  4114] <... futex resumed>)        = 1
[pid  4111] <... write resumed>)        = 21
[pid  4110] +++ exited with 0 +++
[pid  4120] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4114] futex(0x7efe5bc15fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4111] close(3 <unfinished ...>
[pid  4056] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
[pid  4111] <... close resumed>)        = 0
[pid  4056] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4111] getpid( <unfinished ...>
[pid  4056] <... rt_sigreturn resumed>) = -1 EINTR (Interrupted system call)
[pid  4111] <... getpid resumed>)       = 1
[pid  4111] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4121] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4120] <... mmap resumed>)         = 0x200000000000
[pid  4111] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4056] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4111] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4121] <... prctl resumed>)        = 0
[pid  4056] <... write resumed>)        = 4
[pid  4120] futex(0x7efe5bc15fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4121] setpgid(0, 0 <unfinished ...>
[pid  4111] <... capset resumed>)       = 0
[pid  4056] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4041] <... pselect6 resumed>)     = 1 (in [11], left {tv_sec=0, tv_nsec=916812834})
[pid  4121] <... setpgid resumed>)      = 0
[pid  4120] <... futex resumed>)        = 1
[pid  4114] <... futex resumed>)        = 0
[pid  4111] unshare(CLONE_NEWNET <unfinished ...>
[pid  4056] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4041] read(11 <unfinished ...>
[pid  4032] <... epoll_pwait resumed>, [], 128, 202, NULL, 0) = 0
[pid  4120] futex(0x7efe5bc15fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4056] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4121] symlinkat("/syzcgroup/unified/syz2", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4114] futex(0x7efe5bc15fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 76
[pid  4041] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4032] futex(0x16a7c9157160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4031] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4120] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4114] <... futex resumed>)        = 0
[pid  4056] <... openat resumed>)       = 3
[pid  4041] write(3, "\xac\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x18\x00\x0c\x00\x00\x00\x04\x00\x00\x00\x00\x00\x08\x00\x10\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00\x10\x00\x00\x00\xc0\x26\x11\x17"..., 176 <unfinished ...>
[pid  4033] <... futex resumed>)        = 0
[pid  4032] <... futex resumed>)        = 1
[pid  4031] epoll_pwait(4 <unfinished ...>
[pid  4120] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4114] futex(0x7efe5bc15fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4056] fstat(3 <unfinished ...>
[pid  4041] <... write resumed>)        = 176
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4031] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4121] <... symlinkat resumed>)    = 0
[pid  4120] <... mmap resumed>)         = 0x200001000000
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=96, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x76\x78\x63\x61\x6e\x31\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x09\x00\x01\x00\x76\x78\x63\x61\x6e\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 96
[pid  4056] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4041] kill(4051, SIGKILL <unfinished ...>
[pid  4121] symlinkat("/syzcgroup/cpu/syz2", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4120] futex(0x7efe5bc15fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4111] <... unshare resumed>)      = 0
[pid  4058] sendto(3, [{nlmsg_len=60, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4056] getdents64(3 <unfinished ...>
[pid  4041] <... kill resumed>)         = 0
[pid  4033] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fa8a7c277000002}], 128, 0, NULL, 0) = 1
[pid  4121] <... symlinkat resumed>)    = 0
[pid  4120] <... futex resumed>)        = 1
[pid  4114] <... futex resumed>)        = 0
[pid  4111] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4056] <... getdents64 resumed>, 0x5555684fc8c0 /* 6 entries */, 32768) = 176
[pid  4033] read(6 <unfinished ...>
[pid  4121] symlinkat("/syzcgroup/net/syz2", AT_FDCWD, "./cgroup.net" <unfinished ...>
[pid  4120] futex(0x7efe5bc15fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4114] close_range(3, 30, 0 <unfinished ...>
[pid  4056] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4033] <... read resumed>, "\xac\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x18\x00\x0c\x00\x00\x00\x04\x00\x00\x00\x00\x00\x08\x00\x10\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00\x10\x00\x00\x00\xc0\x26\x11\x17"..., 21347228) = 176
[pid  4121] <... symlinkat resumed>)    = 0
[pid  4111] <... openat resumed>)       = 3
[pid  4056] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4121] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4114] <... close_range resumed>)  = 0
[pid  4111] write(3, "0 65535", 7 <unfinished ...>
[pid  4056] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4033] futex(0x16a7c918a960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4121] <... openat resumed>)       = 3
[pid  4114] exit_group(0 <unfinished ...>
[pid  4111] <... write resumed>)        = 7
[pid  4056] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4033] <... futex resumed>)        = 1
[pid  4121] write(3, "1000", 4 <unfinished ...>
[pid  4120] <... futex resumed>)        = ?
[pid  4114] <... exit_group resumed>)   = ?
[pid  4111] close(3 <unfinished ...>
[pid  4056] unlink("./0/binderfs" <unfinished ...>
[pid  4033] read(6 <unfinished ...>
[pid  4121] <... write resumed>)        = 4
[pid  4120] +++ exited with 0 +++
[pid  4111] <... close resumed>)        = 0
[pid  4056] <... unlink resumed>)       = 0
[pid  4035] <... futex resumed>)        = 0
[pid  4121] close(3 <unfinished ...>
[pid  4111] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4033] <... read resumed>, 0x16a7cd080000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4121] <... close resumed>)        = 0
[pid  4111] <... openat resumed>)       = 3
[pid  4056] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4033] futex(0x16a7c9157160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4056] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4056] newfstatat(AT_FDCWD, "./0/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4056] unlink("./0/cgroup.net" <unfinished ...>
[pid  4121] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs" <unfinished ...>
[pid  4111] write(3, "100000", 6 <unfinished ...>
[pid  4056] <... unlink resumed>)       = 0
[pid  4121] <... symlinkat resumed>)    = 0
[pid  4121] close(249 <unfinished ...>
[pid  4111] <... write resumed>)        = 6
[pid  4035] futex(0x16a7c918a960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4121] <... close resumed>)        = 0
[pid  4111] close(3 <unfinished ...>
[pid  4051] +++ killed by SIGKILL +++
[pid  4121] close(248 <unfinished ...>
[pid  4111] <... close resumed>)        = 0
[pid  4121] <... close resumed>)        = 0
[pid  4111] mkdirat(AT_FDCWD, "./syz-tmp", 0777 <unfinished ...>
[pid  4041] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4051, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=7 /* 0.07 s */} ---
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=907610622} <unfinished ...>
[pid  4121] prctl(PR_SET_NAME, "syz.2.3" <unfinished ...>
[pid  4111] <... mkdirat resumed>)      = 0
[pid  4041] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4121] <... prctl resumed>)        = 0
[pid  4041] <... rt_sigreturn resumed>) = 4051
[pid  4121] mmap(0x1b32164000, 14417920, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0x40000 <unfinished ...>
[pid  4041] pipe2( <unfinished ...>
[pid  4121] <... mmap resumed>)         = 0x1b32164000
[pid  4041] <... pipe2 resumed>[25, 26], 0) = 0
[pid  4121] close(4)                    = 0
[pid  4041] pipe2( <unfinished ...>
[pid  4121] futex(0x7fd83ef25fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4041] <... pipe2 resumed>[28, 29], 0) = 0
[pid  4111] mount("", "./syz-tmp", "tmpfs", 0, NULL <unfinished ...>
[pid  4041] pipe2( <unfinished ...>
[pid  4121] <... futex resumed>)        = 0
[pid  4111] <... mount resumed>)        = 0
[pid  4041] <... pipe2 resumed>[35, 37], 0) = 0
[pid  4121] rt_sigaction(SIGRT_1, {sa_handler=0x7fd83eccc3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fd83ec4e1d0} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4121] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4111] mkdirat(AT_FDCWD, "./syz-tmp/newroot", 0777 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4121] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4111] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4121] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4111] mkdirat(AT_FDCWD, "./syz-tmp/newroot/dev", 0700 <unfinished ...>
[pid  4121] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4111] <... mkdirat resumed>)      = 0
[pid  4121] <... mmap resumed>)         = 0x7fd83cae1000
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4121] mprotect(0x7fd83cae2000, 131072, PROT_READ|PROT_WRITE) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4121] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4121] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4111] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4121] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fd83cb01990, parent_tid=0x7fd83cb01990, exit_signal=0, stack=0x7fd83cae1000, stack_size=0x201c0, tls=0x7fd83cb016c0} <unfinished ...>
[pid  4111] <... mount resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] mkdirat(AT_FDCWD, "./syz-tmp/newroot/proc", 0700 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... mkdirat resumed>)      = 0
/strace: Process 4128 attached
[pid  4111] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... mount resumed>)        = 0
[pid  4058] <... sendto resumed>)       = 60
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4128] set_robust_list(0x7fd83cb019a0, 24 <unfinished ...>
[pid  4121] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4111] mkdirat(AT_FDCWD, "./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4128] <... set_robust_list resumed>) = 0
[pid  4121] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4111] <... mkdirat resumed>)      = 0
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=80, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=60, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x0c\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68"]}], 4096, 0, NULL, NULL) = 80
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4128] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4121] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4114] +++ exited with 0 +++
[pid  4111] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4056] +++ killed by SIGKILL +++
[pid  4069] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
[pid  4069] rt_sigreturn({mask=[]})     = -1 EINTR (Interrupted system call)
[pid  4069] write(248, "\x00\x00\x00\x00", 4) = 4
[pid  4128] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4121] futex(0x7fd83ef25fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4111] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4069] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x03\x00\x77\x67\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x14\x00\x12\x00\x0d\x00\x01\x00\x77\x69\x72\x65\x67\x75\x61\x72\x64\x00\x00\x00"], 76, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4128] ioctl(216, KCOV_ENABLE, 0x1 <unfinished ...>
[pid  4121] <... futex resumed>)        = 0
[pid  4111] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4069] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4128] <... ioctl resumed>)        = 0
[pid  4121] futex(0x7fd83ef25fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4111] <... mount resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid  4069] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4128] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4069] <... openat resumed>)       = 3
[pid  4111] <... mkdirat resumed>)      = 0
[pid  4069] fstat(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4128] <... mmap resumed>)         = 0x1ffffffff000
[pid  4111] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4069] getdents64(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] <... getdents64 resumed>, 0x55557b5968c0 /* 6 entries */, 32768) = 176
[pid  4128] futex(0x7fd83ef25fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4111] <... mount resumed>)        = 0
[pid  4069] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4069] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4128] <... futex resumed>)        = 1
[pid  4121] <... futex resumed>)        = 0
[pid  4111] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4069] unlink("./0/binderfs" <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4128] futex(0x7fd83ef25fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4069] <... unlink resumed>)       = 0
[pid  4069] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4069] newfstatat(AT_FDCWD, "./0/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4069] unlink("./0/cgroup.net")    = 0
[pid  4111] <... mount resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4069] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4069] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] newfstatat(AT_FDCWD, "./0/cgroup.cpu" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] unlink("./0/cgroup.cpu" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] <... unlink resumed>)       = 0
[pid  4069] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4111] <... mount resumed>)        = 0
[pid  4069] newfstatat(AT_FDCWD, "./0/cgroup" <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4069] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] unlink("./0/cgroup" <unfinished ...>
[pid  4111] <... mkdirat resumed>)      = 0
[pid  4069] <... unlink resumed>)       = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] getdents64(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] <... getdents64 resumed>, 0x55557b5968c0 /* 0 entries */, 32768) = 0
[pid  4111] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4069] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700 <unfinished ...>
[pid  4069] <... close resumed>)        = 0
[pid  4111] <... mkdirat resumed>)      = 0
[pid  4069] unlinkat(AT_FDCWD, "./0", AT_REMOVEDIR <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] <... unlinkat resumed>)     = 0
[pid  4111] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4069] mkdirat(AT_FDCWD, "./1", 0777 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... mkdirat resumed>)      = 0
[pid  4069] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700 <unfinished ...>
[pid  4069] openat(AT_FDCWD, "/dev/loop1", O_RDWR <unfinished ...>
[pid  4111] <... mkdirat resumed>)      = 0
[pid  4069] <... openat resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] ioctl(3, LOOP_CLR_FD)       = -1 ENXIO (No such device or address)
[pid  4069] close(3)                    = 0
[pid  4058] <... sendto resumed>)       = 76
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4069] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4069] close(3)                    = 0
[pid  4121] futex(0x7fd83ef25fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4111] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4069] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4111] <... mkdirat resumed>)      = 0
[pid  4069] <... socket resumed>)       = 3
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=96, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x03\x00\x77\x67\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x14\x00\x12\x00\x0d\x00\x01\x00\x77\x69\x72\x65\x67\x75\x61\x72\x64\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 96
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4128] <... futex resumed>)        = 0
[pid  4121] <... futex resumed>)        = 1
[pid  4111] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4069] close(3 <unfinished ...>
[pid  4128] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4121] futex(0x7fd83ef25fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4111] <... mount resumed>)        = 0
[pid  4069] <... close resumed>)        = 0
[pid  4058] sendto(3, [{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x03\x00\x77\x67\x31\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x14\x00\x12\x00\x0d\x00\x01\x00\x77\x69\x72\x65\x67\x75\x61\x72\x64\x00\x00\x00"], 76, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4128] <... mmap resumed>)         = 0x200000000000
[pid  4111] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4069] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4128] futex(0x7fd83ef25fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4111] <... mount resumed>)        = 0
[pid  4069] <... socket resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4128] <... futex resumed>)        = 1
[pid  4121] <... futex resumed>)        = 0
[pid  4069] close(3 <unfinished ...>
[pid  4128] futex(0x7fd83ef25fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4111] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4069] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4121] futex(0x7fd83ef25fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4069] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4128] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4121] <... futex resumed>)        = 0
[pid  4111] <... mount resumed>)        = 0
[pid  4069] <... socket resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4128] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4121] futex(0x7fd83ef25fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4111] <... mkdirat resumed>)      = 0
[pid  4069] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4069] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4128] <... mmap resumed>)         = 0x200001000000
[pid  4111] <... pivot_root resumed>)   = 0
[pid  4069] read(249 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4128] futex(0x7fd83ef25fac, FUTEX_WAKE_PRIVATE, 1000000) = 1
[pid  4121] <... futex resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4128] futex(0x7fd83ef25fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4121] close_range(3, 30, 0 <unfinished ...>
[pid  4111] chdir("/" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4121] <... close_range resumed>)  = 0
[pid  4111] <... chdir resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4121] exit_group(0 <unfinished ...>
[pid  4128] <... futex resumed>)        = ?
[pid  4121] <... exit_group resumed>)   = ?
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4128] +++ exited with 0 +++
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... umount2 resumed>)      = 0
[pid  4058] <... sendto resumed>)       = 76
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] chroot("./newroot" <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=96, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x03\x00\x77\x67\x31\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x14\x00\x12\x00\x0d\x00\x01\x00\x77\x69\x72\x65\x67\x75\x61\x72\x64\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 96
[pid  4121] +++ exited with 0 +++
[pid  4111] <... chroot resumed>)       = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
[pid  4068] rt_sigreturn({mask=[]})     = 2
[pid  4068] write(248, "\x00\x00\x00\x00", 4) = 4
[pid  4068] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4068] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4111] chdir("/" <unfinished ...>
[pid  4068] <... openat resumed>)       = 3
[pid  4058] sendto(3, [{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x03\x00\x77\x67\x32\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x14\x00\x12\x00\x0d\x00\x01\x00\x77\x69\x72\x65\x67\x75\x61\x72\x64\x00\x00\x00"], 76, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... chdir resumed>)        = 0
[pid  4068] fstat(3 <unfinished ...>
[pid  4111] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4068] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4068] getdents64(3 <unfinished ...>
[pid  4111] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4068] <... getdents64 resumed>, 0x55555c80e8c0 /* 6 entries */, 32768) = 176
[pid  4068] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4068] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4068] unlink("./0/binderfs")      = 0
[pid  4068] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4068] newfstatat(AT_FDCWD, "./0/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] unlink("./0/cgroup.net" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] <... unlink resumed>)       = 0
[pid  4068] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4068] newfstatat(AT_FDCWD, "./0/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] unlink("./0/cgroup.cpu" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] <... unlink resumed>)       = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4068] newfstatat(AT_FDCWD, "./0/cgroup" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] unlink("./0/cgroup" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] <... unlink resumed>)       = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] getdents64(3, 0x55555c80e8c0 /* 0 entries */, 32768) = 0
[pid  4068] close(3)                    = 0
[pid  4068] unlinkat(AT_FDCWD, "./0", AT_REMOVEDIR) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] mkdirat(AT_FDCWD, "./1", 0777) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] openat(AT_FDCWD, "/dev/loop2", O_RDWR <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... sendto resumed>)       = 76
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] <... openat resumed>)       = 3
[pid  4058] recvfrom(3, [{nlmsg_len=96, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=76, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x03\x00\x77\x67\x32\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x14\x00\x12\x00\x0d\x00\x01\x00\x77\x69\x72\x65\x67\x75\x61\x72\x64\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 96
[pid  4111] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4068] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=140, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x03\x00\x62\x72\x69\x64\x67\x65\x5f\x73\x6c\x61\x76\x65\x5f\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x03\x00\x76\x65\x74\x68\x30\x5f\x74\x6f"...], 140, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] mkdirat(AT_FDCWD, "/dev/binderfs", 0777 <unfinished ...>
[pid  4068] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4111] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4068] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4068] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4068] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] <... socket resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] close(3)                    = 0
[pid  4068] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] <... socket resumed>)       = 3
[pid  4068] close(3)                    = 0
[pid  4068] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4068] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4068] read(249 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... sendto resumed>)       = 140
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=160, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=140, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x03\x00\x62\x72\x69\x64\x67\x65\x5f\x73\x6c\x61\x76\x65\x5f\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x03\x00\x76\x65\x74\x68\x30\x5f\x74\x6f"...]}], 4096, 0, NULL, NULL) = 160
[pid  4111] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=140, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x03\x00\x62\x72\x69\x64\x67\x65\x5f\x73\x6c\x61\x76\x65\x5f\x31\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x03\x00\x76\x65\x74\x68\x31\x5f\x74\x6f"...], 140, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4111] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] getpid()                    = 1
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz5", 0777 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] openat(AT_FDCWD, "/syzcgroup/unified/syz5/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] write(3, "32", 2)           = 2
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] close(3)                    = 0
[pid  4111] openat(AT_FDCWD, "/syzcgroup/unified/syz5/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3
[pid  4058] <... sendto resumed>)       = 140
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] write(3, "1", 1 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=160, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=140, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x03\x00\x62\x72\x69\x64\x67\x65\x5f\x73\x6c\x61\x76\x65\x5f\x31\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x03\x00\x76\x65\x74\x68\x31\x5f\x74\x6f"...]}], 4096, 0, NULL, NULL) = 160
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... write resumed>)        = 1
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4111] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz5", 0777 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... socket resumed>)       = 5
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="bridge_slave_0" <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... mkdirat resumed>)      = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] openat(AT_FDCWD, "/syzcgroup/cpu/syz5/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] write(3, "1", 1 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... write resumed>)        = 1
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] openat(AT_FDCWD, "/syzcgroup/cpu/syz5/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... openat resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] write(3, "313524224", 9 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... write resumed>)        = 9
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] openat(AT_FDCWD, "/syzcgroup/cpu/syz5/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] write(3, "314572800", 9 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... write resumed>)        = 9
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] mkdirat(AT_FDCWD, "/syzcgroup/net/syz5", 0777 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] openat(AT_FDCWD, "/syzcgroup/net/syz5/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... openat resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] write(3, "1", 1 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... write resumed>)        = 1
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... socket resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... getsockopt resumed>, 0x7f367c2573e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... getsockopt resumed>, 0x7f367c257a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... getsockopt resumed>, 0x7f367c2580e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... socket resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... getsockopt resumed>, 0x7f367c258768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... socket resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... getsockopt resumed>, 0x7f367c25afc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... getsockopt resumed>, 0x7f367c25b688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] getsockopt(3, SOL_IP, IPT_SO_GET_INFO, 0x7f367c25bd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... getsockopt resumed>, 0x7f367c25c408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4111] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... getsockopt resumed>, 0x7f367c25cac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] close(3)                    = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... socket resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... getsockopt resumed>, 0x7f367c258e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... getsockopt resumed>, 0x7f367c2594c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... getsockopt resumed>, 0x7f367c259b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4111] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... getsockopt resumed>, 0x7f367c25a248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... getsockopt resumed>, 0x7f367c25a908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... write resumed>)        = 4
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] close(3 <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... close resumed>)        = 0
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4111] <... socket resumed>)       = 3
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="bridge0" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... socket resumed>)       = 3
[pid  4111] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... socket resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... socket resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4111] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4111] read(249 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f809d8bf000
[pid  4041] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4041] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7f809d8bf000, stack_size=0x9000}, 88/strace: Process 4151 attached
 <unfinished ...>
[pid  4151] rt_sigprocmask(SIG_BLOCK, NULL, ~[KILL STOP], 8) = 0
[pid  4151] setpgid(0, 0)               = 0
[pid  4151] dup2(25, 0)                 = 0
[pid  4151] dup2(29, 1)                 = 1
[pid  4151] dup2(37, 2)                 = 2
[pid  4151] dup2(7, 3)                  = 3
[pid  4151] dup2(8, 4)                  = 4
[pid  4151] close(5)                    = 0
[pid  4151] close(6)                    = 0
[pid  4151] close(7)                    = 0
[pid  4151] close(8)                    = 0
[pid  4151] close(9)                    = 0
[pid  4151] close(10)                   = 0
[pid  4151] close(11)                   = 0
[pid  4151] close(12)                   = 0
[pid  4151] close(13)                   = 0
[pid  4151] close(14)                   = 0
[pid  4151] close(15)                   = 0
[pid  4151] close(16)                   = 0
[pid  4151] close(17)                   = 0
[pid  4151] close(18)                   = 0
[pid  4151] close(19)                   = 0
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4151] close(20 <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4151] <... close resumed>)        = 0
[pid  4058] <... close resumed>)        = 0
[pid  4151] close(21 <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x00\x00\x00\x00"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4151] <... close resumed>)        = 0
[pid  4058] <... sendto resumed>)       = 40
[pid  4151] close(22 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4151] <... close resumed>)        = 0
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 60
[pid  4151] close(23 <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4151] <... close resumed>)        = 0
[pid  4058] <... socket resumed>)       = 5
[pid  4151] close(24 <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="bridge_slave_1" <unfinished ...>
[pid  4151] <... close resumed>)        = 0
[pid  4151] close(25)                   = 0
[pid  4151] close(26)                   = 0
[pid  4151] close(27)                   = 0
[pid  4151] close(28)                   = 0
[pid  4151] close(29)                   = 0
[pid  4151] close(30)                   = 0
[pid  4151] close(31)                   = 0
[pid  4151] close(32)                   = 0
[pid  4151] close(33)                   = 0
[pid  4151] close(34)                   = 0
[pid  4151] close(35)                   = 0
[pid  4151] close(36)                   = 0
[pid  4151] close(37)                   = 0
[pid  4151] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4151] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] close(39)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(40)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4151] close(44 <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4151] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4151] close(45)                   = -1 EBADF (Bad file descriptor)
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4151] close(46)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(47)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(48)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(49)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... socket resumed>)       = 5
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="bridge0" <unfinished ...>
[pid  4151] close(50)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(51)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(52)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(53)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(54)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(55)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(56)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(57)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(58)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(59)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(60)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(61)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(62)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(63)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(64)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(65)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(66)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(67)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(68)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(70)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(71)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(72)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(75)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(76)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(77)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(79)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(80)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(81)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(82)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(84)                   = -1 EBADF (Bad file descriptor)
[pid  4031] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4151] close(85 <unfinished ...>
[pid  4031] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4151] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4031] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4151] close(86)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(87)                   = -1 EBADF (Bad file descriptor)
[pid  4032] <... epoll_pwait resumed>, [], 128, 984, NULL, 0) = 0
[pid  4151] close(88)                   = -1 EBADF (Bad file descriptor)
[pid  4032] futex(0x16a7c918a960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4151] close(89)                   = -1 EBADF (Bad file descriptor)
[pid  4035] <... futex resumed>)        = 0
[pid  4032] <... futex resumed>)        = 1
[pid  4035] epoll_pwait(4 <unfinished ...>
[pid  4151] close(90 <unfinished ...>
[pid  4035] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4151] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4151] close(91 <unfinished ...>
[pid  4035] futex(0x16a7c918a960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4151] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4151] close(92 <unfinished ...>
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=993714592} <unfinished ...>
[pid  4151] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4151] close(93)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(94)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(95)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(96)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(98)                   = -1 EBADF (Bad file descriptor)
[pid  4151] close(99 <unfinished ...>
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4151] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] close(5 <unfinished ...>
[pid  4151] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4151] close(102)                  = -1 EBADF (Bad file descriptor)
[pid  4058] sendto(3, [{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x00\x00\x00\x00"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4151] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... sendto resumed>)       = 40
[pid  4151] close(104 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4151] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 60
[pid  4151] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4058] sendto(3, [{nlmsg_len=136, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x03\x00\x62\x6f\x6e\x64\x5f\x73\x6c\x61\x76\x65\x5f\x30\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00\x03\x00\x76\x65\x74\x68\x30\x5f\x74\x6f\x5f\x62\x6f\x6e"...], 136, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4151] close(106)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(110)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... sendto resumed>)       = 136
[pid  4151] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(118 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4151] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=156, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=136, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x03\x00\x62\x6f\x6e\x64\x5f\x73\x6c\x61\x76\x65\x5f\x30\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00\x03\x00\x76\x65\x74\x68\x30\x5f\x74\x6f\x5f\x62\x6f\x6e"...]}], 4096, 0, NULL, NULL) = 156
[pid  4151] close(119)                  = -1 EBADF (Bad file descriptor)
[pid  4058] sendto(3, [{nlmsg_len=136, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x03\x00\x62\x6f\x6e\x64\x5f\x73\x6c\x61\x76\x65\x5f\x31\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00\x03\x00\x76\x65\x74\x68\x31\x5f\x74\x6f\x5f\x62\x6f\x6e"...], 136, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4151] close(120)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(129)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(130)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(134)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(135)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(142)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(152 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 136
[pid  4151] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4151] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(154 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4151] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=156, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=136, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x03\x00\x62\x6f\x6e\x64\x5f\x73\x6c\x61\x76\x65\x5f\x31\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00\x03\x00\x76\x65\x74\x68\x31\x5f\x74\x6f\x5f\x62\x6f\x6e"...]}], 4096, 0, NULL, NULL) = 156
[pid  4151] close(155 <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="bond_slave_0" <unfinished ...>
[pid  4151] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4151] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(158)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(163)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(164)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(168)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(169)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(182)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(183)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(184)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(185)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(186)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(188)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(189)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(190)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(191)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(194)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(195)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(196)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(200)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(202)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(204)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(205)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(206)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(207)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(208)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(209)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(210)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(211)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(213)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(214)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(215)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(216)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(217)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(218)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(219)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(220)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(223)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(224)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(225)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(228)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(229)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(230)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(231)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(232)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(233)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(234)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(235)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(236)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(237)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(240)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(241)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(244)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(245)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(246)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(247)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(248)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(251)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(252)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(253)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4151] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4151] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4151] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffc25fc6af0 /* 2 vars */ <unfinished ...>
[pid  4041] <... clone3 resumed>)       = 4151
[pid  4041] munmap(0x7f809d8bf000, 36864) = 0
[pid  4041] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4041] fcntl(28, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4041] fcntl(28, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4041] fcntl(35, F_GETFL <unfinished ...>
[pid  4151] <... execve resumed>)       = 0
[pid  4041] <... fcntl resumed>)        = 0 (flags O_RDONLY)
[pid  4041] fcntl(35, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4041] close(25)                   = 0
[pid  4041] close(29)                   = 0
[pid  4041] close(37)                   = 0
[pid  4041] close(10)                   = 0
[pid  4041] close(11)                   = 0
[pid  4041] close(13)                   = 0
[pid  4151] brk(NULL <unfinished ...>
[pid  4041] write(26, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x12\x39\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64 <unfinished ...>
[pid  4151] <... brk resumed>)          = 0x555560a6b000
[pid  4041] <... write resumed>)        = 64
[pid  4041] pselect6(37, [3 16 18 21 23 28 31 33 34 35 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4151] brk(0x555560a6be80 <unfinished ...>
[pid  4041] <... pselect6 resumed>)     = 3 (in [16 21 34], left {tv_sec=0, tv_nsec=999982002})
[pid  4041] read(16, "\x00\x00\x00\x00", 4) = 4
[pid  4041] write(3, "\xdc\x13\x02\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x01\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x14\x00\x00\x00"..., 136160 <unfinished ...>
[pid  4032] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fa8a7c277000002}], 128, 994, NULL, 0) = 1
[pid  4032] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1) = 1
[pid  4032] read(6, "\xdc\x13\x02\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x01\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x14\x00\x00\x00"..., 21347228) = 65483
[pid  4031] <... futex resumed>)        = 0
[pid  4041] <... write resumed>)        = 136160
[pid  4032] read(6 <unfinished ...>
[pid  4041] kill(4052, SIGKILL <unfinished ...>
[pid  4151] <... brk resumed>)          = 0x555560a6be80
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4032] <... read resumed>, "\x87\xff\xff\xff\xff\x85\x1c\x8a\x87\xff\xff\xff\xff\x98\x1c\x8a\x87\xff\xff\xff\xff\xa4\x1b\x8a\x87\xff\xff\xff\xff\x25\x1c\x8a\x87\xff\xff\xff\xff\x43\x1c\x8a\x87\xff\xff\xff\xff\x64\x1c\x8a\x87\xff\xff\xff\xff\x85\x1c\x8a\x87\xff\xff\xff\xff\x98\x1c\x8a\x87\xff\xff\xff\xff\xa4\x1b\x8a\x87\xff\xff\xff\xff\x25\x1c\x8a\x87\xff\xff\xff\xff\x43\x1c\x8a\x87\xff\xff\xff\xff\x64\x1c\x8a\x87\xff\xff\xff"..., 21281745) = 70677
[pid  4058] close(5)                    = 0
[pid  4041] <... kill resumed>)         = 0
[pid  4151] arch_prctl(ARCH_SET_FS, 0x555560a6b500) = 0
[pid  4151] set_tid_address(0x555560a6b7d0) = 4151
[pid  4151] set_robust_list(0x555560a6b7e0, 24) = 0
[pid  4151] prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4151] readlinkat(AT_FDCWD, "/proc/self/exe", "/syz-executor", 4096) = 13
[pid  4031] epoll_pwait(4 <unfinished ...>
[pid  4151] getrandom( <unfinished ...>
[pid  4031] <... epoll_pwait resumed>, [{events=EPOLLOUT, data=0x3fa8a7c277000002}], 128, 0, NULL, 0) = 1
[pid  4151] <... getrandom resumed>"\x6b\x54\x48\x21\x56\xfd\x60\xb2", 8, GRND_NONBLOCK) = 8
[pid  4151] brk(NULL)                   = 0x555560a6be80
[pid  4151] brk(0x555560a8ce80)         = 0x555560a8ce80
[pid  4151] brk(0x555560a8d000)         = 0x555560a8d000
[pid  4151] mprotect(0x7f2e0feb9000, 1236992, PROT_READ <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
[pid  4031] epoll_pwait(4, [], 128, 0, NULL, 0) = 0
[pid  4031] getpid()                    = 4030
[pid  4031] tgkill(4030, 4032, SIGURG <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="bond0" <unfinished ...>
[pid  4031] <... tgkill resumed>)       = 0
[pid  4032] --- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=4030, si_uid=0} ---
[pid  4151] <... mprotect resumed>)     = 0
[pid  4069] <... read resumed> <unfinished ...>) = ?
[pid  4052] +++ killed by SIGKILL +++
[pid  4031] epoll_pwait(4, [], 128, 0, NULL, 0) = 0
[pid  4151] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4041] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4052, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=14 /* 0.14 s */} ---
[pid  4032] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4041] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4031] getpid( <unfinished ...>
[pid  4041] <... rt_sigreturn resumed>) = 4052
[pid  4151] <... prctl resumed>)        = 0
[pid  4031] <... getpid resumed>)       = 4030
[pid  4151] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4031] tgkill(4030, 4032, SIGURG <unfinished ...>
[pid  4151] <... mmap resumed>)         = 0x1ffffffff000
[pid  4031] <... tgkill resumed>)       = 0
[pid  4151] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200000000000
[pid  4041] pipe2( <unfinished ...>
[pid  4151] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200001000000
[pid  4041] <... pipe2 resumed>[10, 11], 0) = 0
[pid  4151] rt_sigaction(SIGCHLD, {sa_handler=0x7f2e0fc50780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f2e0fd3e1d0} <unfinished ...>
[pid  4032] <... rt_sigreturn resumed>) = 24909892334784
[pid  4151] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4041] pipe2( <unfinished ...>
[pid  4151] pkey_alloc(0, PKEY_UNRESTRICTED <unfinished ...>
[pid  4032] --- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=4030, si_uid=0} ---
[pid  4032] rt_sigreturn({mask=[]})     = 24909892334784
[pid  4032] futex(0x16a7c918a960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4031] getpid( <unfinished ...>
[pid  4032] <... futex resumed>)        = 1
[pid  4031] <... getpid resumed>)       = 4030
[pid  4041] <... pipe2 resumed>[13, 25], 0) = 0
[pid  4035] <... futex resumed>)        = 0
[pid  4032] read(6 <unfinished ...>
[pid  4031] tgkill(4030, 4032, SIGURG <unfinished ...>
[pid  4041] pipe2( <unfinished ...>
[pid  4035] epoll_pwait(4 <unfinished ...>
[pid  4031] <... tgkill resumed>)       = 0
[pid  4035] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4031] futex(0x16a7c9157160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4151] <... pkey_alloc resumed>)   = -1 EINVAL (Invalid argument)
[pid  4035] epoll_pwait(4 <unfinished ...>
[pid  4033] <... futex resumed>)        = 0
[pid  4031] <... futex resumed>)        = 1
[pid  4151] getrandom( <unfinished ...>
[pid  4041] <... pipe2 resumed>[29, 37], 0) = 0
[pid  4035] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4035] futex(0x16a7c918a960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4151] <... getrandom resumed>"\xeb\x7b\xc4\xee\x90\x2f\x13\xb6", 8, GRND_NONBLOCK) = 8
[pid  4151] mkdir("./syzkaller.rBkLtT", 0700 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4032] <... read resumed>, 0x16a7cd080000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4151] <... mkdir resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4032] --- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=4030, si_uid=0} ---
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=608353760} <unfinished ...>
[pid  4032] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4032] <... rt_sigreturn resumed>) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4032] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4151] chmod("./syzkaller.rBkLtT", 0777 <unfinished ...>
[pid  4032] <... futex resumed>)        = 1
[pid  4031] <... futex resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4032] futex(0x16a7c9156960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4151] <... chmod resumed>)        = 0
[pid  4151] chdir("./syzkaller.rBkLtT" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... chdir resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=603213572} <unfinished ...>
[pid  4151] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
[pid  4151] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
[pid  4151] rt_sigaction(SIGSEGV, {sa_handler=0x7f2e0fc52b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f2e0fd3e1d0}, NULL, 8) = 0
[pid  4151] rt_sigaction(SIGBUS, {sa_handler=0x7f2e0fc52b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f2e0fd3e1d0}, NULL, 8) = 0
[pid  4151] getpid( <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... getpid resumed>)       = 4151
[pid  4151] mmap(0x1b2f320000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0) = 0x1b2f320000
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] getpid( <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... getpid resumed>)       = 4151
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] mmap(0x1b30324000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... mmap resumed>)         = 0x1b30324000
[pid  4151] close(3)                    = 0
[pid  4151] fcntl(5, F_GETFD)           = -1 EBADF (Bad file descriptor)
[pid  4151] fcntl(6, F_GETFD)           = -1 EBADF (Bad file descriptor)
[pid  4151] dup2(0, 249)                = 249
[pid  4151] dup2(1, 248 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] <... dup2 resumed>)         = 248
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] dup2(2, 1 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] <... dup2 resumed>)         = 1
[pid  4151] dup2(2, 0)                  = 0
[pid  4151] read(249, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x12\x39\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4151] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR) = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] dup2(3, 216)                = 216
[pid  4151] close(3)                    = 0
[pid  4151] ioctl(216, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] <... ioctl resumed>)        = 0
[pid  4151] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] <... mmap resumed>)         = 0x7f2e0f7fe000
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] mmap(0x7f2e0f7ff000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 216, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] <... mmap resumed>)         = 0x7f2e0f7ff000
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... openat resumed>)       = 3
[pid  4151] dup2(3, 217 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] <... dup2 resumed>)         = 217
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] close(3)                    = 0
[pid  4151] ioctl(217, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... ioctl resumed>)        = 0
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] close(5 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] <... mmap resumed>)         = 0x7f2e0f3fc000
[pid  4058] sendto(3, [{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x00\x00\x00\x00"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4151] mmap(0x7f2e0f3fd000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 217, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... mmap resumed>)         = 0x7f2e0f3fd000
[pid  4058] <... sendto resumed>)       = 40
[pid  4151] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 60
[pid  4151] <... openat resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] dup2(3, 218 <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] <... dup2 resumed>)         = 218
[pid  4058] <... socket resumed>)       = 5
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] close(3 <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="bond_slave_1" <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] ioctl(218, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... ioctl resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... mmap resumed>)         = 0x7f2e0effa000
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] mmap(0x7f2e0effb000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 218, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... mmap resumed>)         = 0x7f2e0effb000
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] dup2(3, 219 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... dup2 resumed>)         = 219
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] ioctl(219, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] <... ioctl resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] <... mmap resumed>)         = 0x7f2e0ebf8000
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] mmap(0x7f2e0ebf9000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 219, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] <... mmap resumed>)         = 0x7f2e0ebf9000
[pid  4069] +++ killed by SIGKILL +++
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] dup2(3, 220 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... dup2 resumed>)         = 220
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] ioctl(220, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] <... ioctl resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... mmap resumed>)         = 0x7f2e0e7f6000
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] mmap(0x7f2e0e7f7000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 220, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] <... mmap resumed>)         = 0x7f2e0e7f7000
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] <... openat resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] dup2(3, 221 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... dup2 resumed>)         = 221
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... close resumed>)        = 0
[pid  4151] ioctl(221, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] <... ioctl resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... mmap resumed>)         = 0x7f2e0e3f4000
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] mmap(0x7f2e0e3f5000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 221, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] <... mmap resumed>)         = 0x7f2e0e3f5000
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] close(5)                    = 0
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4151] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="bond0" <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] <... openat resumed>)       = 3
[pid  4151] dup2(3, 215 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4151] <... dup2 resumed>)         = 215
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] close(3)                    = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4151] ioctl(215, KCOV_INIT_TRACE, 0x100000 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f809d8bf000
[pid  4041] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4041] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7f809d8bf000, stack_size=0x9000}, 88/strace: Process 4175 attached
 <unfinished ...>
[pid  4151] <... ioctl resumed>)        = 0
[pid  4175] rt_sigprocmask(SIG_BLOCK, NULL <unfinished ...>
[pid  4151] mmap(NULL, 8396800, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2e0dbf2000
[pid  4151] mmap(0x7f2e0dbf3000, 8388608, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 215, 0 <unfinished ...>
[pid  4175] <... rt_sigprocmask resumed>, ~[KILL STOP], 8) = 0
[pid  4175] setpgid(0, 0)               = 0
[pid  4175] dup2(10, 0)                 = 0
[pid  4175] dup2(25, 1)                 = 1
[pid  4175] dup2(37, 2 <unfinished ...>
[pid  4151] <... mmap resumed>)         = 0x7f2e0dbf3000
[pid  4175] <... dup2 resumed>)         = 2
[pid  4151] ioctl(215, KCOV_REMOTE_ENABLE, 0x7ffd5626e580 <unfinished ...>
[pid  4175] dup2(9, 3 <unfinished ...>
[pid  4151] <... ioctl resumed>)        = 0
[pid  4175] <... dup2 resumed>)         = 3
[pid  4175] dup2(12, 4 <unfinished ...>
[pid  4151] unshare(CLONE_NEWPID <unfinished ...>
[pid  4175] <... dup2 resumed>)         = 4
[pid  4151] <... unshare resumed>)      = 0
[pid  4175] close(5 <unfinished ...>
[pid  4151] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4175] <... close resumed>)        = 0
[pid  4151] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4175] close(6 <unfinished ...>
[pid  4151] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4175] <... close resumed>)        = 0
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4175] close(7)                    = 0
[pid  4058] close(5 <unfinished ...>
[pid  4175] close(8)                    = 0
[pid  4175] close(9)                    = 0
[pid  4175] close(10)                   = 0
[pid  4175] close(11)                   = 0
[pid  4058] <... close resumed>)        = 0
[pid  4175] close(12)                   = 0
[pid  4175] close(13)                   = 0
[pid  4175] close(14 <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x00\x00\x00\x00"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12/strace: Process 4178 attached
 <unfinished ...>
[pid  4175] <... close resumed>)        = 0
[pid  4175] close(15)                   = 0
[pid  4175] close(16)                   = 0
[pid  4175] close(17)                   = 0
[pid  4175] close(18)                   = 0
[pid  4175] close(19)                   = 0
[pid  4175] close(20)                   = 0
[pid  4175] close(21)                   = 0
[pid  4175] close(22)                   = 0
[pid  4175] close(23)                   = 0
[pid  4175] close(24)                   = 0
[pid  4175] close(25)                   = 0
[pid  4175] close(26)                   = 0
[pid  4175] close(27)                   = 0
[pid  4175] close(28)                   = 0
[pid  4175] close(29 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 40
[pid  4175] <... close resumed>)        = 0
[pid  4175] close(30 <unfinished ...>
[pid  4178] set_robust_list(0x555560a6b7e0, 24 <unfinished ...>
[pid  4175] <... close resumed>)        = 0
[pid  4151] <... clone resumed>, child_tidptr=0x555560a6b7d0) = 4178
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4178] <... set_robust_list resumed>) = 0
[pid  4175] close(31)                   = 0
[pid  4175] close(32)                   = 0
[pid  4175] close(33)                   = 0
[pid  4175] close(34)                   = 0
[pid  4175] close(35)                   = 0
[pid  4178] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4175] close(36 <unfinished ...>
[pid  4151] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 60
[pid  4178] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4175] <... close resumed>)        = 0
[pid  4151] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4178] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4175] close(37 <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=136, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x03\x00\x74\x65\x61\x6d\x5f\x73\x6c\x61\x76\x65\x5f\x30\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00\x03\x00\x76\x65\x74\x68\x30\x5f\x74\x6f\x5f\x74\x65\x61"...], 136, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4178] <... prctl resumed>)        = 0
[pid  4175] <... close resumed>)        = 0
[pid  4175] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4178] getppid( <unfinished ...>
[pid  4175] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] <... getppid resumed>)      = 0
[pid  4175] close(39 <unfinished ...>
[pid  4178] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] <... openat resumed>)       = 3
[pid  4175] close(40)                   = -1 EBADF (Bad file descriptor)
[pid  4175] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4175] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4175] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4178] dup2(3, 201 <unfinished ...>
[pid  4175] close(44 <unfinished ...>
[pid  4178] <... dup2 resumed>)         = 201
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] close(3 <unfinished ...>
[pid  4175] close(45 <unfinished ...>
[pid  4178] <... close resumed>)        = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4175] close(46 <unfinished ...>
[pid  4178] <... prlimit64 resumed>, NULL) = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024} <unfinished ...>
[pid  4175] close(47 <unfinished ...>
[pid  4178] <... prlimit64 resumed>, NULL) = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(48 <unfinished ...>
[pid  4178] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4175] close(49 <unfinished ...>
[pid  4178] <... prlimit64 resumed>, NULL) = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} <unfinished ...>
[pid  4175] close(50 <unfinished ...>
[pid  4178] <... prlimit64 resumed>, NULL) = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} <unfinished ...>
[pid  4175] close(51 <unfinished ...>
[pid  4178] <... prlimit64 resumed>, NULL) = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] unshare(CLONE_NEWNS <unfinished ...>
[pid  4175] close(52 <unfinished ...>
[pid  4178] <... unshare resumed>)      = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4175] close(53 <unfinished ...>
[pid  4178] <... mount resumed>)        = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] unshare(CLONE_NEWIPC <unfinished ...>
[pid  4175] close(54 <unfinished ...>
[pid  4178] <... unshare resumed>)      = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(55)                   = -1 EBADF (Bad file descriptor)
[pid  4175] close(56)                   = -1 EBADF (Bad file descriptor)
[pid  4175] close(57)                   = -1 EBADF (Bad file descriptor)
[pid  4175] close(58)                   = -1 EBADF (Bad file descriptor)
[pid  4178] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4175] close(59 <unfinished ...>
[pid  4178] <... unshare resumed>)      = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(60 <unfinished ...>
[pid  4178] unshare(CLONE_NEWUTS <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] <... unshare resumed>)      = 0
[pid  4175] close(61)                   = -1 EBADF (Bad file descriptor)
[pid  4178] unshare(CLONE_SYSVSEM <unfinished ...>
[pid  4175] close(62 <unfinished ...>
[pid  4178] <... unshare resumed>)      = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4175] close(63)                   = -1 EBADF (Bad file descriptor)
[pid  4175] close(64)                   = -1 EBADF (Bad file descriptor)
[pid  4175] close(65)                   = -1 EBADF (Bad file descriptor)
[pid  4175] close(66 <unfinished ...>
[pid  4178] <... openat resumed>)       = 3
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(67)                   = -1 EBADF (Bad file descriptor)
[pid  4175] close(68)                   = -1 EBADF (Bad file descriptor)
[pid  4175] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4175] close(70 <unfinished ...>
[pid  4178] write(3, "16777216", 8 <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] <... write resumed>)        = 8
[pid  4175] close(71 <unfinished ...>
[pid  4178] close(3 <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] <... close resumed>)        = 0
[pid  4175] close(72)                   = -1 EBADF (Bad file descriptor)
[pid  4178] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4175] close(73 <unfinished ...>
[pid  4178] <... openat resumed>)       = 3
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4175] close(75)                   = -1 EBADF (Bad file descriptor)
[pid  4178] write(3, "536870912", 9 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 136
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4178] <... write resumed>)        = 9
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=156, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=136, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x03\x00\x74\x65\x61\x6d\x5f\x73\x6c\x61\x76\x65\x5f\x30\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00\x03\x00\x76\x65\x74\x68\x30\x5f\x74\x6f\x5f\x74\x65\x61"...]}], 4096, 0, NULL, NULL) = 156
[pid  4178] close(3 <unfinished ...>
[pid  4175] close(76 <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=136, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x03\x00\x74\x65\x61\x6d\x5f\x73\x6c\x61\x76\x65\x5f\x31\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00\x03\x00\x76\x65\x74\x68\x31\x5f\x74\x6f\x5f\x74\x65\x61"...], 136, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4178] <... close resumed>)        = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4175] close(77 <unfinished ...>
[pid  4178] <... openat resumed>)       = 3
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] write(3, "1024", 4 <unfinished ...>
[pid  4175] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4178] <... write resumed>)        = 4
[pid  4178] close(3 <unfinished ...>
[pid  4175] close(79)                   = -1 EBADF (Bad file descriptor)
[pid  4178] <... close resumed>)        = 0
[pid  4178] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
[pid  4175] close(80 <unfinished ...>
[pid  4178] write(3, "8192", 4 <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] <... write resumed>)        = 4
[pid  4175] close(81 <unfinished ...>
[pid  4178] close(3 <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] <... close resumed>)        = 0
[pid  4175] close(82 <unfinished ...>
[pid  4178] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4175] close(84)                   = -1 EBADF (Bad file descriptor)
[pid  4175] close(85)                   = -1 EBADF (Bad file descriptor)
[pid  4178] <... openat resumed>)       = 3
[pid  4175] close(86 <unfinished ...>
[pid  4178] write(3, "1024", 4 <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] <... write resumed>)        = 4
[pid  4175] close(87 <unfinished ...>
[pid  4178] close(3 <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] <... close resumed>)        = 0
[pid  4175] close(88 <unfinished ...>
[pid  4178] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(89 <unfinished ...>
[pid  4178] <... openat resumed>)       = 3
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] write(3, "1024", 4 <unfinished ...>
[pid  4175] close(90)                   = -1 EBADF (Bad file descriptor)
[pid  4178] <... write resumed>)        = 4
[pid  4178] close(3 <unfinished ...>
[pid  4175] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4178] <... close resumed>)        = 0
[pid  4175] close(92 <unfinished ...>
[pid  4178] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(93 <unfinished ...>
[pid  4178] <... openat resumed>)       = 3
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] write(3, "1024 1048576 500 1024", 21 <unfinished ...>
[pid  4175] close(94 <unfinished ...>
[pid  4178] <... write resumed>)        = 21
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] close(3 <unfinished ...>
[pid  4175] close(95 <unfinished ...>
[pid  4178] <... close resumed>)        = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] getpid( <unfinished ...>
[pid  4175] close(96 <unfinished ...>
[pid  4178] <... getpid resumed>)       = 1
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4175] close(97 <unfinished ...>
[pid  4178] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4175] close(98 <unfinished ...>
[pid  4178] <... capset resumed>)       = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(99 <unfinished ...>
[pid  4178] unshare(CLONE_NEWNET <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(101 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 136
[pid  4058] recvfrom(3, [{nlmsg_len=156, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=136, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x03\x00\x74\x65\x61\x6d\x5f\x73\x6c\x61\x76\x65\x5f\x31\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00\x03\x00\x76\x65\x74\x68\x31\x5f\x74\x6f\x5f\x74\x65\x61"...]}], 4096, 0, NULL, NULL) = 156
[pid  4178] <... unshare resumed>)      = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(102 <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4178] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... socket resumed>)       = 5
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="team_slave_0" <unfinished ...>
[pid  4175] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4178] <... openat resumed>)       = 3
[pid  4175] close(104)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(105 <unfinished ...>
[pid  4178] write(3, "0 65535", 7 <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(106 <unfinished ...>
[pid  4178] <... write resumed>)        = 7
[pid  4178] close(3 <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] <... close resumed>)        = 0
[pid  4178] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4175] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4178] <... openat resumed>)       = 3
[pid  4175] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4178] write(3, "100000", 6 <unfinished ...>
[pid  4175] close(109 <unfinished ...>
[pid  4178] <... write resumed>)        = 6
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] close(3 <unfinished ...>
[pid  4175] close(110 <unfinished ...>
[pid  4178] <... close resumed>)        = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] mkdirat(AT_FDCWD, "./syz-tmp", 0777 <unfinished ...>
[pid  4175] close(111 <unfinished ...>
[pid  4178] <... mkdirat resumed>)      = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4178] mount("", "./syz-tmp", "tmpfs", 0, NULL <unfinished ...>
[pid  4175] close(118 <unfinished ...>
[pid  4178] <... mount resumed>)        = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(119)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(120)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4178] mkdirat(AT_FDCWD, "./syz-tmp/newroot", 0777 <unfinished ...>
[pid  4175] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4178] <... mkdirat resumed>)      = 0
[pid  4175] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(129 <unfinished ...>
[pid  4178] mkdirat(AT_FDCWD, "./syz-tmp/newroot/dev", 0700) = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(130)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(131 <unfinished ...>
[pid  4178] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4178] <... mount resumed>)        = 0
[pid  4175] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(134 <unfinished ...>
[pid  4178] mkdirat(AT_FDCWD, "./syz-tmp/newroot/proc", 0700) = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid  4175] close(135 <unfinished ...>
[pid  4178] <... mount resumed>)        = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(139 <unfinished ...>
[pid  4178] mkdirat(AT_FDCWD, "./syz-tmp/newroot/selinux", 0700) = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4178] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4175] close(142 <unfinished ...>
[pid  4178] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4178] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4175] close(144 <unfinished ...>
[pid  4178] <... mount resumed>)        = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4178] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700) = 0
[pid  4175] close(148 <unfinished ...>
[pid  4178] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(151 <unfinished ...>
[pid  4178] <... mount resumed>)        = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(154 <unfinished ...>
[pid  4178] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(155)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4178] <... mount resumed>)        = 0
[pid  4175] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4031] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4178] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4175] close(158 <unfinished ...>
[pid  4178] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4175] close(159 <unfinished ...>
[pid  4178] <... mount resumed>)        = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4033] <... epoll_pwait resumed>, [], 128, 612, NULL, 0) = 0
[pid  4031] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4175] close(161 <unfinished ...>
[pid  4033] futex(0x16a7c9156960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4031] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4178] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] <... mkdirat resumed>)      = 0
[pid  4175] close(162 <unfinished ...>
[pid  4033] <... futex resumed>)        = 1
[pid  4032] <... futex resumed>)        = 0
[pid  4178] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4175] close(163 <unfinished ...>
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4032] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4178] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700 <unfinished ...>
[pid  4175] close(164 <unfinished ...>
[pid  4032] futex(0x16a7c9156960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4178] <... mkdirat resumed>)      = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(165 <unfinished ...>
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=993848424} <unfinished ...>
[pid  4178] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] <... mkdirat resumed>)      = 0
[pid  4175] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4178] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700 <unfinished ...>
[pid  4175] close(168 <unfinished ...>
[pid  4178] <... mkdirat resumed>)      = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4175] close(169 <unfinished ...>
[pid  4178] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] close(5 <unfinished ...>
[pid  4178] <... mkdirat resumed>)      = 0
[pid  4175] close(170 <unfinished ...>
[pid  4178] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4178] <... mount resumed>)        = 0
[pid  4175] close(171 <unfinished ...>
[pid  4178] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4178] <... mount resumed>)        = 0
[pid  4178] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  4175] close(172 <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="team0" <unfinished ...>
[pid  4178] <... mkdirat resumed>)      = 0
[pid  4175] close(173 <unfinished ...>
[pid  4178] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] <... pivot_root resumed>)   = 0
[pid  4175] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(180 <unfinished ...>
[pid  4178] chdir("/" <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] <... chdir resumed>)        = 0
[pid  4175] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4178] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4175] close(182)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(183 <unfinished ...>
[pid  4178] <... umount2 resumed>)      = 0
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(184)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(185 <unfinished ...>
[pid  4178] chroot("./newroot" <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] <... chroot resumed>)       = 0
[pid  4175] close(186 <unfinished ...>
[pid  4178] chdir("/" <unfinished ...>
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4178] <... chdir resumed>)        = 0
[pid  4175] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4178] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4175] close(188 <unfinished ...>
[pid  4178] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(189)                  = -1 EBADF (Bad file descriptor)
[pid  4178] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4175] close(190)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(191)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(194)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(195)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(196)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(200)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(202)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(204)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(205)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(206)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(207)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(208)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(209)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(210)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(211)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(213)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(214)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(215)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(216)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(217)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(218)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(219)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(220)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(223)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(224)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(225)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(228)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(229)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(230)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(231)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(232)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(233)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(234)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(235)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(236)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(237)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(240)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(241)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(244)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(245)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(246)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(247)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(248)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(251)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(252)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(253)                  = -1 EBADF (Bad file descriptor)
[pid  4175] close(254 <unfinished ...>
[pid  4178] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4175] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4175] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4178] mkdirat(AT_FDCWD, "/dev/binderfs", 0777 <unfinished ...>
[pid  4175] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4178] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4175] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffc25fc6af0 /* 2 vars */ <unfinished ...>
[pid  4178] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4041] <... clone3 resumed>)       = 4175
[pid  4041] munmap(0x7f809d8bf000, 36864) = 0
[pid  4041] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4041] fcntl(13, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4041] fcntl(13, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4041] fcntl(29, F_GETFL <unfinished ...>
[pid  4175] <... execve resumed>)       = 0
[pid  4041] <... fcntl resumed>)        = 0 (flags O_RDONLY)
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] fcntl(29, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4041] close(10)                   = 0
[pid  4058] close(5 <unfinished ...>
[pid  4041] close(25)                   = 0
[pid  4041] close(37)                   = 0
[pid  4041] close(15)                   = 0
[pid  4041] close(16)                   = 0
[pid  4058] <... close resumed>)        = 0
[pid  4041] close(18 <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x00\x00\x00\x00"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] <... close resumed>)        = 0
[pid  4178] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4175] brk(NULL <unfinished ...>
[pid  4178] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4041] write(11, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x12\x38\x02\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64 <unfinished ...>
[pid  4178] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4041] <... write resumed>)        = 64
[pid  4178] getpid( <unfinished ...>
[pid  4041] read(21 <unfinished ...>
[pid  4178] <... getpid resumed>)       = 1
[pid  4041] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4178] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz0", 0777 <unfinished ...>
[pid  4041] write(3, "\x74\x3c\x01\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x02\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 81016 <unfinished ...>
[pid  4178] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4175] <... brk resumed>)          = 0x555576de1000
[pid  4058] <... sendto resumed>)       = 40
[pid  4041] <... write resumed>)        = 81016
[pid  4178] openat(AT_FDCWD, "/syzcgroup/unified/syz0/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4033] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fa8a7c277000002}], 128, 995, NULL, 0) = 1
[pid  4178] <... openat resumed>)       = 3
[pid  4178] write(3, "32", 2 <unfinished ...>
[pid  4175] brk(0x555576de1e80 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] kill(4053, SIGKILL <unfinished ...>
[pid  4033] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4178] <... write resumed>)        = 2
[pid  4175] <... brk resumed>)          = 0x555576de1e80
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 60
[pid  4041] <... kill resumed>)         = 0
[pid  4033] <... futex resumed>)        = 1
[pid  4031] <... futex resumed>)        = 0
[pid  4178] close(3 <unfinished ...>
[pid  4175] arch_prctl(ARCH_SET_FS, 0x555576de1500 <unfinished ...>
[pid  4033] read(6 <unfinished ...>
[pid  4031] epoll_pwait(4 <unfinished ...>
[pid  4178] <... close resumed>)        = 0
[pid  4175] <... arch_prctl resumed>)   = 0
[pid  4033] <... read resumed>, "\x74\x3c\x01\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x02\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 21347228) = 81016
[pid  4031] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4178] openat(AT_FDCWD, "/syzcgroup/unified/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4175] set_tid_address(0x555576de17d0 <unfinished ...>
[pid  4033] futex(0x16a7c9156960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4178] <... openat resumed>)       = 3
[pid  4175] <... set_tid_address resumed>) = 4175
[pid  4175] set_robust_list(0x555576de17e0, 24 <unfinished ...>
[pid  4178] write(3, "1", 1 <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4175] <... set_robust_list resumed>) = 0
[pid  4058] <... socket resumed>)       = 5
[pid  4175] prlimit64(0, RLIMIT_STACK, NULL <unfinished ...>
[pid  4032] <... futex resumed>)        = 0
[pid  4032] epoll_pwait(4, [], 128, 0, NULL, 0) = 0
[pid  4033] <... futex resumed>)        = 1
[pid  4178] <... write resumed>)        = 1
[pid  4175] <... prlimit64 resumed>, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4033] read(6 <unfinished ...>
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4178] close(3 <unfinished ...>
[pid  4175] readlinkat(AT_FDCWD, "/proc/self/exe" <unfinished ...>
[pid  4033] <... read resumed>, 0x16a7cd080000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4032] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4178] <... close resumed>)        = 0
[pid  4175] <... readlinkat resumed>, "/syz-executor", 4096) = 13
[pid  4033] futex(0x16a7c9157160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4178] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz0", 0777) = -1 EEXIST (File exists)
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=815722960} <unfinished ...>
[pid  4175] getrandom("\x30\xd7\xf3\x13\x59\x10\x59\x37", 8, GRND_NONBLOCK) = 8
[pid  4175] brk(NULL <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="team_slave_1" <unfinished ...>
[pid  4175] <... brk resumed>)          = 0x555576de1e80
[pid  4175] brk(0x555576e02e80 <unfinished ...>
[pid  4178] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4175] <... brk resumed>)          = 0x555576e02e80
[pid  4178] <... openat resumed>)       = 3
[pid  4175] brk(0x555576e03000)         = 0x555576e03000
[pid  4175] mprotect(0x7f66a6e59000, 1236992, PROT_READ <unfinished ...>
[pid  4178] write(3, "1", 1)            = 1
[pid  4175] <... mprotect resumed>)     = 0
[pid  4178] close(3)                    = 0
[pid  4178] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3
[pid  4178] write(3, "313524224", 9)    = 9
[pid  4178] close(3)                    = 0
[pid  4178] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3
[pid  4175] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4053] +++ killed by SIGKILL +++
[pid  4178] write(3, "314572800", 9 <unfinished ...>
[pid  4175] <... prctl resumed>)        = 0
[pid  4175] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4178] <... write resumed>)        = 9
[pid  4068] <... read resumed> <unfinished ...>) = ?
[pid  4178] close(3 <unfinished ...>
[pid  4175] <... mmap resumed>)         = 0x1ffffffff000
[pid  4041] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4053, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=11 /* 0.11 s */} ---
[pid  4041] rt_sigreturn({mask=[]})     = 4053
[pid  4041] pipe2([10, 15], 0)          = 0
[pid  4178] <... close resumed>)        = 0
[pid  4175] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4178] mkdirat(AT_FDCWD, "/syzcgroup/net/syz0", 0777 <unfinished ...>
[pid  4175] <... mmap resumed>)         = 0x200000000000
[pid  4175] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4041] pipe2( <unfinished ...>
[pid  4175] <... mmap resumed>)         = 0x200001000000
[pid  4041] <... pipe2 resumed>[16, 18], 0) = 0
[pid  4175] rt_sigaction(SIGCHLD, {sa_handler=0x7f66a6bf0780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f66a6cde1d0} <unfinished ...>
[pid  4041] pipe2( <unfinished ...>
[pid  4178] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4175] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4041] <... pipe2 resumed>[25, 37], 0) = 0
[pid  4178] openat(AT_FDCWD, "/syzcgroup/net/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4175] pkey_alloc(0, PKEY_UNRESTRICTED <unfinished ...>
[pid  4178] <... openat resumed>)       = 3
[pid  4175] <... pkey_alloc resumed>)   = -1 EINVAL (Invalid argument)
[pid  4178] write(3, "1", 1 <unfinished ...>
[pid  4175] getrandom( <unfinished ...>
[pid  4178] <... write resumed>)        = 1
[pid  4175] <... getrandom resumed>"\x50\xcd\x25\xd2\x53\x77\x58\x49", 8, GRND_NONBLOCK) = 8
[pid  4178] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... close resumed>)        = 0
[pid  4175] mkdir("./syzkaller.MhKVKT", 0700 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... socket resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... getsockopt resumed>, 0x7f2e0ffe73e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... getsockopt resumed>, 0x7f2e0ffe7a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4175] <... mkdir resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] <... getsockopt resumed>, 0x7f2e0ffe80e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4175] chmod("./syzkaller.MhKVKT", 0777 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] close(3 <unfinished ...>
[pid  4175] <... chmod resumed>)        = 0
[pid  4178] <... close resumed>)        = 0
[pid  4175] chdir("./syzkaller.MhKVKT" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4175] <... chdir resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... socket resumed>)       = 3
[pid  4175] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4175] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... getsockopt resumed>, 0x7f2e0ffe8768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4175] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] close(3)                    = 0
[pid  4175] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4175] rt_sigaction(SIGSEGV, {sa_handler=0x7f66a6bf2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f66a6cde1d0} <unfinished ...>
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] close(5 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... socket resumed>)       = 3
[pid  4175] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4058] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] rt_sigaction(SIGBUS, {sa_handler=0x7f66a6bf2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f66a6cde1d0} <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4058] <... socket resumed>)       = 5
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] getpid( <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="team0" <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4175] <... getpid resumed>)       = 4175
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] mmap(0x1b30b20000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] <... mmap resumed>)         = 0x1b30b20000
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] <... getsockopt resumed>, 0x7f2e0ffeafc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4175] getpid( <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] <... getpid resumed>)       = 4175
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4175] mmap(0x1b31b24000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0 <unfinished ...>
[pid  4178] <... getsockopt resumed>, 0x7f2e0ffeb688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4175] <... mmap resumed>)         = 0x1b31b24000
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4175] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] fcntl(5, F_GETFD <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... getsockopt resumed>, 0x7f2e0ffebd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4175] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] fcntl(6, F_GETFD <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4175] dup2(0, 249 <unfinished ...>
[pid  4178] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] <... dup2 resumed>)         = 249
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] dup2(1, 248 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] <... dup2 resumed>)         = 248
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] <... getsockopt resumed>, 0x7f2e0ffec408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4175] dup2(2, 1 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4175] <... dup2 resumed>)         = 1
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] <... getsockopt resumed>, 0x7f2e0ffecac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4175] dup2(2, 0 <unfinished ...>
[pid  4178] close(3 <unfinished ...>
[pid  4175] <... dup2 resumed>)         = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... close resumed>)        = 0
[pid  4175] read(249 <unfinished ...>
[pid  4178] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4175] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x12\x38\x02\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] dup2(3, 216 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... socket resumed>)       = 3
[pid  4175] <... dup2 resumed>)         = 216
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] close(3)                    = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4175] ioctl(216, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... getsockopt resumed>, 0x7f2e0ffe8e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... getsockopt resumed>, 0x7f2e0ffe94c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] <... getsockopt resumed>, 0x7f2e0ffe9b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... getsockopt resumed>, 0x7f2e0ffea248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO, 0x7f2e0ffea908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] <... write resumed>)        = 4
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] openat(AT_FDCWD, "/dev/loop0", O_RDWR <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... openat resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4178] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... socket resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] close(3 <unfinished ...>
[pid  4175] <... ioctl resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4175] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] <... mmap resumed>)         = 0x7f66a6796000
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... socket resumed>)       = 3
[pid  4175] mmap(0x7f66a6797000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 216, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... socket resumed>)       = 3
[pid  4175] <... mmap resumed>)         = 0x7f66a6797000
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] <... close resumed>)        = 0
[pid  4175] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... socket resumed>)       = 3
[pid  4175] dup2(3, 217 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] close(3 <unfinished ...>
[pid  4175] <... dup2 resumed>)         = 217
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... close resumed>)        = 0
[pid  4175] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] ioctl(217, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] read(249 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] <... ioctl resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] <... mmap resumed>)         = 0x7f66a6394000
[pid  4175] mmap(0x7f66a6395000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 217, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] <... mmap resumed>)         = 0x7f66a6395000
[pid  4175] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] <... openat resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] dup2(3, 218 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] <... dup2 resumed>)         = 218
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] ioctl(218, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] <... ioctl resumed>)        = 0
[pid  4175] mmap(NULL, 4202496, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] <... mmap resumed>)         = 0x7f66a5f92000
[pid  4175] mmap(0x7f66a5f93000, 4194304, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 218, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4058] close(5)                    = 0
[pid  4058] sendto(3, [{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x00\x00\x00\x00"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4175] <... mmap resumed>)         = 0x7f66a5f93000
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... sendto resumed>)       = 40
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 60
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=140, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x03\x00\x62\x61\x74\x61\x64\x76\x5f\x73\x6c\x61\x76\x65\x5f\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x03\x00\x76\x65\x74\x68\x30\x5f\x74\x6f"...], 140, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] <... openat resumed>)       = 3
[pid  4068] +++ killed by SIGKILL +++
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] dup2(3, 219 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] <... dup2 resumed>)         = 219
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] ioctl(219, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... sendto resumed>)       = 140
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] <... ioctl resumed>)        = 0
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=160, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=140, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x03\x00\x62\x61\x74\x61\x64\x76\x5f\x73\x6c\x61\x76\x65\x5f\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x03\x00\x76\x65\x74\x68\x30\x5f\x74\x6f"...]}], 4096, 0, NULL, NULL) = 160
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=140, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x03\x00\x62\x61\x74\x61\x64\x76\x5f\x73\x6c\x61\x76\x65\x5f\x31\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x03\x00\x76\x65\x74\x68\x31\x5f\x74\x6f"...], 140, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] <... openat resumed>)       = 3
[pid  4175] dup2(3, 220 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] <... dup2 resumed>)         = 220
[pid  4175] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] <... close resumed>)        = 0
[pid  4175] ioctl(220, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] <... ioctl resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] <... openat resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] dup2(3, 221)                = 221
[pid  4175] close(3)                    = 0
[pid  4175] ioctl(221, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] <... ioctl resumed>)        = 0
[pid  4058] <... sendto resumed>)       = 140
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] <... openat resumed>)       = 3
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=160, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=140, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x03\x00\x62\x61\x74\x61\x64\x76\x5f\x73\x6c\x61\x76\x65\x5f\x31\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x03\x00\x76\x65\x74\x68\x31\x5f\x74\x6f"...]}], 4096, 0, NULL, NULL) = 160
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] dup2(3, 222)                = 222
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] close(3)                    = 0
[pid  4058] <... socket resumed>)       = 5
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] ioctl(222, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="batadv_slave_0" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] <... ioctl resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] <... openat resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] dup2(3, 223 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] <... dup2 resumed>)         = 223
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] ioctl(223, KCOV_INIT_TRACE, 0x80000 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... socket resumed>)       = 5
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="batadv0" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4175] <... ioctl resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] <... openat resumed>)       = 3
[pid  4041] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f809d8bf000
[pid  4175] dup2(3, 215)                = 215
[pid  4041] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4175] close(3)                    = 0
[pid  4041] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4175] ioctl(215, KCOV_INIT_TRACE, 0x100000 <unfinished ...>
[pid  4041] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7f809d8bf000, stack_size=0x9000}, 88/strace: Process 4209 attached
 <unfinished ...>
[pid  4209] rt_sigprocmask(SIG_BLOCK, NULL, ~[KILL STOP], 8) = 0
[pid  4209] setpgid(0, 0)               = 0
[pid  4209] dup2(10, 0)                 = 0
[pid  4209] dup2(18, 1)                 = 1
[pid  4175] <... ioctl resumed>)        = 0
[pid  4209] dup2(37, 2 <unfinished ...>
[pid  4175] mmap(NULL, 8396800, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4209] <... dup2 resumed>)         = 2
[pid  4175] <... mmap resumed>)         = 0x7f66a5790000
[pid  4209] dup2(14, 3)                 = 3
[pid  4209] dup2(17, 4)                 = 4
[pid  4175] mmap(0x7f66a5791000, 8388608, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 215, 0 <unfinished ...>
[pid  4209] close(5)                    = 0
[pid  4175] <... mmap resumed>)         = 0x7f66a5791000
[pid  4209] close(6)                    = 0
[pid  4175] unshare(CLONE_NEWPID <unfinished ...>
[pid  4209] close(7 <unfinished ...>
[pid  4175] <... unshare resumed>)      = 0
[pid  4209] <... close resumed>)        = 0
[pid  4175] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4209] close(8 <unfinished ...>
[pid  4175] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4209] <... close resumed>)        = 0
[pid  4175] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4209] close(9)                    = 0
[pid  4209] close(10)                   = 0
[pid  4209] close(11)                   = 0
[pid  4209] close(12)                   = 0
[pid  4209] close(13)                   = 0
[pid  4209] close(14)                   = 0
[pid  4209] close(15)                   = 0
[pid  4209] close(16)                   = 0
[pid  4209] close(17)                   = 0
[pid  4209] close(18)                   = 0
[pid  4209] close(19)                   = 0
[pid  4209] close(20)                   = 0
[pid  4209] close(21)                   = 0
[pid  4209] close(22)                   = 0
[pid  4209] close(23)                   = 0
[pid  4209] close(24)                   = 0
[pid  4209] close(25)                   = 0
[pid  4209] close(26)                   = 0
[pid  4209] close(27)                   = 0
[pid  4209] close(28)                   = 0
[pid  4209] close(29)                   = 0
[pid  4209] close(30)                   = 0
[pid  4209] close(31)                   = 0
[pid  4209] close(32)                   = 0
[pid  4209] close(33)                   = 0
[pid  4209] close(34)                   = 0
[pid  4209] close(35)                   = 0
[pid  4209] close(36)                   = 0
[pid  4209] close(37)                   = 0
[pid  4209] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4209] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4175] <... clone resumed>, child_tidptr=0x555576de17d0) = 4211
[pid  4175] rt_sigprocmask(SIG_SETMASK, []/strace: Process 4211 attached
 <unfinished ...>
[pid  4209] close(39 <unfinished ...>
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4175] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4211] set_robust_list(0x555576de17e0, 24 <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(40 <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4211] <... set_robust_list resumed>) = 0
[pid  4209] close(41 <unfinished ...>
[pid  4211] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4058] sendto(3, [{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x00\x00\x00\x00"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4211] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4209] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4211] <... prctl resumed>)        = 0
[pid  4211] getppid( <unfinished ...>
[pid  4209] close(43 <unfinished ...>
[pid  4211] <... getppid resumed>)      = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4209] close(44 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 40
[pid  4211] <... openat resumed>)       = 3
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4211] dup2(3, 201 <unfinished ...>
[pid  4209] close(45 <unfinished ...>
[pid  4211] <... dup2 resumed>)         = 201
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 60
[pid  4211] close(3 <unfinished ...>
[pid  4209] close(46 <unfinished ...>
[pid  4211] <... close resumed>)        = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4211] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4209] close(47 <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4211] <... prlimit64 resumed>, NULL) = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(48 <unfinished ...>
[pid  4211] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="batadv_slave_1" <unfinished ...>
[pid  4211] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024} <unfinished ...>
[pid  4209] close(49)                   = -1 EBADF (Bad file descriptor)
[pid  4211] <... prlimit64 resumed>, NULL) = 0
[pid  4209] close(50 <unfinished ...>
[pid  4211] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] <... prlimit64 resumed>, NULL) = 0
[pid  4211] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} <unfinished ...>
[pid  4209] close(51 <unfinished ...>
[pid  4211] <... prlimit64 resumed>, NULL) = 0
[pid  4211] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] <... prlimit64 resumed>, NULL) = 0
[pid  4211] unshare(CLONE_NEWNS <unfinished ...>
[pid  4209] close(52 <unfinished ...>
[pid  4211] <... unshare resumed>)      = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(53)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(54 <unfinished ...>
[pid  4211] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] <... mount resumed>)        = 0
[pid  4211] unshare(CLONE_NEWIPC)       = 0
[pid  4209] close(55 <unfinished ...>
[pid  4211] unshare(CLONE_NEWCGROUP)    = 0
[pid  4211] unshare(CLONE_NEWUTS)       = 0
[pid  4211] unshare(CLONE_SYSVSEM)      = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4209] close(56 <unfinished ...>
[pid  4211] <... openat resumed>)       = 3
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] write(3, "16777216", 8 <unfinished ...>
[pid  4209] close(57 <unfinished ...>
[pid  4211] <... write resumed>)        = 8
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] close(3 <unfinished ...>
[pid  4209] close(58 <unfinished ...>
[pid  4211] <... close resumed>)        = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4209] close(59 <unfinished ...>
[pid  4211] <... openat resumed>)       = 3
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(60 <unfinished ...>
[pid  4211] write(3, "536870912", 9 <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] <... write resumed>)        = 9
[pid  4209] close(61 <unfinished ...>
[pid  4211] close(3 <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] <... close resumed>)        = 0
[pid  4211] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4209] close(62 <unfinished ...>
[pid  4211] <... openat resumed>)       = 3
[pid  4211] write(3, "1024", 4 <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] <... write resumed>)        = 4
[pid  4209] close(63 <unfinished ...>
[pid  4211] close(3)                    = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4209] close(64 <unfinished ...>
[pid  4211] <... openat resumed>)       = 3
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(65)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(66)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(67)                   = -1 EBADF (Bad file descriptor)
[pid  4211] write(3, "8192", 4 <unfinished ...>
[pid  4209] close(68)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(70)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(71)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(72 <unfinished ...>
[pid  4211] <... write resumed>)        = 4
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(75 <unfinished ...>
[pid  4211] close(3)                    = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(76 <unfinished ...>
[pid  4211] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(77)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(79)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(80)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(81 <unfinished ...>
[pid  4211] <... openat resumed>)       = 3
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(82)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(84 <unfinished ...>
[pid  4211] write(3, "1024", 4 <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(85)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(86 <unfinished ...>
[pid  4211] <... write resumed>)        = 4
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(87)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(88)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(89)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(90)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(92)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(93)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(94)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(95)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(96 <unfinished ...>
[pid  4211] close(3 <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] <... close resumed>)        = 0
[pid  4209] close(97 <unfinished ...>
[pid  4211] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(98)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(99)                   = -1 EBADF (Bad file descriptor)
[pid  4209] close(100 <unfinished ...>
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(102)                  = -1 EBADF (Bad file descriptor)
[pid  4058] close(5)                    = 0
[pid  4211] <... openat resumed>)       = 3
[pid  4211] write(3, "1024", 4 <unfinished ...>
[pid  4209] close(103 <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
[pid  4211] <... write resumed>)        = 4
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="batadv0" <unfinished ...>
[pid  4209] close(104)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(106)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(110)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4211] close(3 <unfinished ...>
[pid  4209] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(115 <unfinished ...>
[pid  4211] <... close resumed>)        = 0
[pid  4211] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(118 <unfinished ...>
[pid  4211] <... openat resumed>)       = 3
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(119)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(120)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4211] write(3, "1024 1048576 500 1024", 21 <unfinished ...>
[pid  4209] close(123 <unfinished ...>
[pid  4211] <... write resumed>)        = 21
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] close(3)                    = 0
[pid  4211] getpid()                    = 1
[pid  4209] close(124 <unfinished ...>
[pid  4211] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4211] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4209] close(125 <unfinished ...>
[pid  4211] unshare(CLONE_NEWNET <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(129)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(130)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(134)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(135)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(142)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(154)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(155)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(158)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(163)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(164)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(168)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(169)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(182)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(183)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(184)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(185)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(186)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(188)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(189)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(190)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(191)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(194)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(195)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(196)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(200)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4211] <... unshare resumed>)      = 0
[pid  4209] close(202 <unfinished ...>
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4058] close(5 <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4211] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4209] close(203 <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x00\x00\x00\x00"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4211] <... openat resumed>)       = 3
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... sendto resumed>)       = 40
[pid  4211] write(3, "0 65535", 7 <unfinished ...>
[pid  4209] close(204 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4211] <... write resumed>)        = 7
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] close(3 <unfinished ...>
[pid  4209] close(205 <unfinished ...>
[pid  4211] <... close resumed>)        = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4209] close(206)                  = -1 EBADF (Bad file descriptor)
[pid  4211] <... openat resumed>)       = 3
[pid  4209] close(207)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(208 <unfinished ...>
[pid  4211] write(3, "100000", 6 <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] <... write resumed>)        = 6
[pid  4209] close(209 <unfinished ...>
[pid  4211] close(3 <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 60
[pid  4211] <... close resumed>)        = 0
[pid  4209] close(210 <unfinished ...>
[pid  4032] <... epoll_pwait resumed>, [], 128, 817, NULL, 0) = 0
[pid  4031] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] mkdirat(AT_FDCWD, "./syz-tmp", 0777 <unfinished ...>
[pid  4209] close(211 <unfinished ...>
[pid  4211] <... mkdirat resumed>)      = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] sendto(3, [{nlmsg_len=84, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x09\x00\x03\x00\x78\x66\x72\x6d\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x18\x00\x12\x00\x08\x00\x01\x00\x78\x66\x72\x6d\x0c\x00\x02\x00\x08\x00\x02\x00\x01\x00\x00\x00"], 84, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4031] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4211] mount("", "./syz-tmp", "tmpfs", 0, NULL <unfinished ...>
[pid  4209] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4031] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4211] <... mount resumed>)        = 0
[pid  4209] close(213 <unfinished ...>
[pid  4032] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(214 <unfinished ...>
[pid  4032] futex(0x16a7c9157160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(215)                  = -1 EBADF (Bad file descriptor)
[pid  4033] <... futex resumed>)        = 0
[pid  4032] <... futex resumed>)        = 1
[pid  4211] mkdirat(AT_FDCWD, "./syz-tmp/newroot", 0777 <unfinished ...>
[pid  4209] close(216 <unfinished ...>
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4211] <... mkdirat resumed>)      = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4033] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4209] close(217 <unfinished ...>
[pid  4033] write(5, "\x01\x00\x00\x00\x00\x00\x00\x00", 8 <unfinished ...>
[pid  4211] mkdirat(AT_FDCWD, "./syz-tmp/newroot/dev", 0700 <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(218)                  = -1 EBADF (Bad file descriptor)
[pid  4033] <... write resumed>)        = 8
[pid  4032] <... epoll_pwait resumed>, [{events=EPOLLIN, data=0x33dbe88}], 128, 56983, NULL, 0) = 1
[pid  4211] <... mkdirat resumed>)      = 0
[pid  4209] close(219 <unfinished ...>
[pid  4033] futex(0x16a7c9157160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4032] read(5 <unfinished ...>
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=966999681} <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4032] <... read resumed>, "\x01\x00\x00\x00\x00\x00\x00\x00", 8) = 8
[pid  4211] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4209] close(220 <unfinished ...>
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4211] <... mount resumed>)        = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4032] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4209] close(221 <unfinished ...>
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4211] mkdirat(AT_FDCWD, "./syz-tmp/newroot/proc", 0700 <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] <... mkdirat resumed>)      = 0
[pid  4209] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4211] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid  4209] close(223 <unfinished ...>
[pid  4211] <... mount resumed>)        = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(224)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(225)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(228)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(229)                  = -1 EBADF (Bad file descriptor)
[pid  4211] mkdirat(AT_FDCWD, "./syz-tmp/newroot/selinux", 0700) = 0
[pid  4209] close(230 <unfinished ...>
[pid  4211] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(231)                  = -1 EBADF (Bad file descriptor)
[pid  4211] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4209] close(232 <unfinished ...>
[pid  4211] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(233 <unfinished ...>
[pid  4211] <... mount resumed>)        = 0
[pid  4211] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(234 <unfinished ...>
[pid  4211] <... mkdirat resumed>)      = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(235 <unfinished ...>
[pid  4211] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(236 <unfinished ...>
[pid  4211] <... mount resumed>)        = 0
[pid  4211] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid  4211] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  4209] close(237 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 84
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(240)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(241)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(243 <unfinished ...>
[pid  4211] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(244 <unfinished ...>
[pid  4211] <... mkdirat resumed>)      = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(245)                  = -1 EBADF (Bad file descriptor)
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4209] close(246 <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=104, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=84, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x09\x00\x03\x00\x78\x66\x72\x6d\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x18\x00\x12\x00\x08\x00\x01\x00\x78\x66\x72\x6d\x0c\x00\x02\x00\x08\x00\x02\x00\x01\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 104
[pid  4211] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4209] close(247 <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4211] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700 <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... socket resumed>)       = 5
[pid  4209] close(248 <unfinished ...>
[pid  4211] <... mkdirat resumed>)      = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(249 <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="bridge_slave_0" <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4209] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4211] <... mkdirat resumed>)      = 0
[pid  4209] close(251 <unfinished ...>
[pid  4211] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700) = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4209] close(252 <unfinished ...>
[pid  4211] <... mkdirat resumed>)      = 0
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4209] close(253)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4209] close(255 <unfinished ...>
[pid  4211] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4209] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4211] <... mount resumed>)        = 0
[pid  4209] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4209] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffc25fc6af0 /* 2 vars */ <unfinished ...>
[pid  4211] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  4211] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  4211] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4041] <... clone3 resumed>)       = 4209
[pid  4041] munmap(0x7f809d8bf000, 36864) = 0
[pid  4041] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4211] <... mkdirat resumed>)      = 0
[pid  4209] <... execve resumed>)       = 0
[pid  4041] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4041] fcntl(16, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4211] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4041] fcntl(16, F_SETFL, O_RDONLY|O_NONBLOCK <unfinished ...>
[pid  4211] <... pivot_root resumed>)   = 0
[pid  4041] <... fcntl resumed>)        = 0
[pid  4211] chdir("/" <unfinished ...>
[pid  4041] fcntl(25, F_GETFL <unfinished ...>
[pid  4211] <... chdir resumed>)        = 0
[pid  4041] <... fcntl resumed>)        = 0 (flags O_RDONLY)
[pid  4211] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4041] fcntl(25, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4041] close(10)                   = 0
[pid  4041] close(18)                   = 0
[pid  4041] close(37)                   = 0
[pid  4041] close(20)                   = 0
[pid  4041] close(21)                   = 0
[pid  4041] close(23)                   = 0
[pid  4041] write(15, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\x38\x01\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4041] read(34, "\x00\x00\x00\x00", 4) = 4
[pid  4041] write(3, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x05\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00", 56) = 56
[pid  4032] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fa8a7c277000002}], 128, 965, NULL, 0) = 1
[pid  4032] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1) = 1
[pid  4031] <... futex resumed>)        = 0
[pid  4211] <... umount2 resumed>)      = 0
[pid  4032] read(6 <unfinished ...>
[pid  4031] sched_yield( <unfinished ...>
[pid  4041] write(32, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4211] chroot("./newroot" <unfinished ...>
[pid  4111] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4041] pselect6(37, [3 13 16 25 28 29 31 33 34 35 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4032] <... read resumed>, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x05\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00", 21347228) = 56
[pid  4211] <... chroot resumed>)       = 0
[pid  4111] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4032] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x10\x78\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0f\x00\x00\x00"..., 192 <unfinished ...>
[pid  4041] <... pselect6 resumed>)     = 1 (in [28], left {tv_sec=0, tv_nsec=999976687})
[pid  4211] chdir("/" <unfinished ...>
[pid  4111] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4032] <... write resumed>)        = 192
[pid  4031] <... sched_yield resumed>)  = 0
[pid  4211] <... chdir resumed>)        = 0
[pid  4111] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4041] read(28 <unfinished ...>
[pid  4032] read(6 <unfinished ...>
[pid  4041] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4041] write(3, "\x2c\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x0e\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x00\x00\x06\x00\x0c\x00\x04\x00\x06\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4041] write(26, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4178] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4041] pselect6(37, [3 13 16 25 28 29 31 33 34 35 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8}) = 1 (in [3], left {tv_sec=0, tv_nsec=999976801})
[pid  4032] <... read resumed>, "\x2c\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x0e\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x00\x00\x06\x00\x0c\x00\x04\x00\x06\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00", 21347228) = 48
[pid  4041] read(3 <unfinished ...>
[pid  4178] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4041] <... read resumed>, "\xbc\x00\x00\x00", 4) = 4
[pid  4041] read(3 <unfinished ...>
[pid  4211] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4178] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4041] <... read resumed>, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x10\x78\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4032] write(6, "\x84\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x44\x00\x38\x00\x30\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x40\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00\x02\x00\x00\x00"..., 136 <unfinished ...>
[pid  4178] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4041] pselect6(37, [3 13 16 25 28 29 31 33 34 35 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4211] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4041] <... pselect6 resumed>)     = 1 (in [3], left {tv_sec=0, tv_nsec=997840545})
[pid  4032] <... write resumed>)        = 136
/strace: Process 4225 attached
[pid  4111] <... clone resumed>, child_tidptr=0x55558dae07d0) = 2
[pid  4041] read(3 <unfinished ...>
[pid  4031] epoll_pwait(4 <unfinished ...>
[pid  4225] set_robust_list(0x55558dae07e0, 24 <unfinished ...>
[pid  4111] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4041] <... read resumed>, "\x84\x00\x00\x00", 4) = 4
[pid  4031] <... epoll_pwait resumed>, [{events=EPOLLOUT, data=0x3fa8a7c277000002}], 128, 0, NULL, 0) = 1
[pid  4225] <... set_robust_list resumed>) = 0
[pid  4111] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4041] read(3 <unfinished ...>
[pid  4032] read(6 <unfinished ...>
[pid  4041] <... read resumed>, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x44\x00\x38\x00\x30\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x40\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00"..., 132) = 132
[pid  4032] <... read resumed>, 0x16a7cd080000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4041] pselect6(37, [3 13 16 25 28 29 31 33 34 35 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4211] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4225] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4031] futex(0x16a7c9157160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4032] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4031] <... futex resumed>)        = 1
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4225] chdir("./0" <unfinished ...>
[pid  4033] <... futex resumed>)        = 0
[pid  4033] futex(0x16a7c9157160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=855366434} <unfinished ...>
[pid  4225] <... chdir resumed>)        = 0
[pid  4225] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  4225] setpgid(0, 0)               = 0
[pid  4225] symlinkat("/syzcgroup/unified/syz5", AT_FDCWD, "./cgroup") = 0
[pid  4225] symlinkat("/syzcgroup/cpu/syz5", AT_FDCWD, "./cgroup.cpu") = 0
[pid  4225] symlinkat("/syzcgroup/net/syz5", AT_FDCWD, "./cgroup.net") = 0
[pid  4209] brk(NULL/strace: Process 4227 attached
 <unfinished ...>
[pid  4225] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4209] <... brk resumed>)          = 0x55556b085000
[pid  4227] set_robust_list(0x555560a6b7e0, 24 <unfinished ...>
[pid  4209] brk(0x55556b085e80 <unfinished ...>
[pid  4178] <... clone resumed>, child_tidptr=0x555560a6b7d0) = 2
[pid  4227] <... set_robust_list resumed>) = 0
[pid  4225] <... openat resumed>)       = 3
[pid  4209] <... brk resumed>)          = 0x55556b085e80
[pid  4209] arch_prctl(ARCH_SET_FS, 0x55556b085500) = 0
[pid  4209] set_tid_address(0x55556b0857d0) = 4209
[pid  4209] set_robust_list(0x55556b0857e0, 24) = 0
[pid  4209] prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4178] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4227] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4209] readlinkat(AT_FDCWD, "/proc/self/exe", "/syz-executor", 4096) = 13
[pid  4227] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4178] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4227] chdir("./0" <unfinished ...>
[pid  4225] write(3, "1000", 4 <unfinished ...>
[pid  4209] getrandom( <unfinished ...>
[pid  4227] <... chdir resumed>)        = 0
[pid  4225] <... write resumed>)        = 4
[pid  4209] <... getrandom resumed>"\x43\xa0\x59\xb5\x6d\x74\x29\xc9", 8, GRND_NONBLOCK) = 8
[pid  4227] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4225] close(3 <unfinished ...>
[pid  4227] <... prctl resumed>)        = 0
[pid  4209] brk(NULL <unfinished ...>
[pid  4227] setpgid(0, 0 <unfinished ...>
[pid  4225] <... close resumed>)        = 0
[pid  4209] <... brk resumed>)          = 0x55556b085e80
[pid  4227] <... setpgid resumed>)      = 0
[pid  4209] brk(0x55556b0a6e80 <unfinished ...>
[pid  4227] symlinkat("/syzcgroup/unified/syz0", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4225] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs" <unfinished ...>
[pid  4209] <... brk resumed>)          = 0x55556b0a6e80
[pid  4209] brk(0x55556b0a7000)         = 0x55556b0a7000
[pid  4225] <... symlinkat resumed>)    = 0
[pid  4209] mprotect(0x7f69a1779000, 1236992, PROT_READ <unfinished ...>
[pid  4227] <... symlinkat resumed>)    = 0
[pid  4225] close(249 <unfinished ...>
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4225] <... close resumed>)        = 0
[pid  4225] close(248 <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4225] <... close resumed>)        = 0
[pid  4058] <... close resumed>)        = 0
[pid  4227] symlinkat("/syzcgroup/cpu/syz0", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4225] prctl(PR_SET_NAME, "syz.5.6" <unfinished ...>
[pid  4211] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4209] <... mprotect resumed>)     = 0
[pid  4058] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4227] <... symlinkat resumed>)    = 0
[pid  4225] <... prctl resumed>)        = 0
[pid  4211] mkdirat(AT_FDCWD, "/dev/binderfs", 0777 <unfinished ...>
[pid  4209] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4227] symlinkat("/syzcgroup/net/syz0", AT_FDCWD, "./cgroup.net" <unfinished ...>
[pid  4225] close(4 <unfinished ...>
[pid  4211] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4209] <... prctl resumed>)        = 0
[pid  4058] <... sendto resumed>)       = 32
[pid  4225] <... close resumed>)        = 0
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4227] <... symlinkat resumed>)    = 0
[pid  4225] futex(0x7f367c285fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4211] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4209] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4227] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=52, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 52
[pid  4227] <... openat resumed>)       = 3
[pid  4225] <... futex resumed>)        = 0
[pid  4211] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4209] <... mmap resumed>)         = 0x1ffffffff000
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4227] write(3, "1000", 4 <unfinished ...>
[pid  4225] rt_sigaction(SIGRT_1, {sa_handler=0x7f367c02c3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f367bfae1d0} <unfinished ...>
[pid  4211] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4209] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4227] <... write resumed>)        = 4
[pid  4225] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4211] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4209] <... mmap resumed>)         = 0x200000000000
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="bridge_slave_1" <unfinished ...>
[pid  4227] close(3 <unfinished ...>
[pid  4225] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4211] getpid( <unfinished ...>
[pid  4209] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4225] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4225] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f367be47000
[pid  4225] mprotect(0x7f367be48000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4227] <... close resumed>)        = 0
[pid  4225] <... mprotect resumed>)     = 0
[pid  4211] <... getpid resumed>)       = 1
[pid  4227] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs" <unfinished ...>
[pid  4225] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4211] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz1", 0777 <unfinished ...>
[pid  4225] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4225] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f367be67990, parent_tid=0x7f367be67990, exit_signal=0, stack=0x7f367be47000, stack_size=0x201c0, tls=0x7f367be676c0} <unfinished ...>
[pid  4211] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4227] <... symlinkat resumed>)    = 0
/strace: Process 4232 attached
[pid  4227] close(249 <unfinished ...>
[pid  4211] openat(AT_FDCWD, "/syzcgroup/unified/syz1/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4209] <... mmap resumed>)         = 0x200001000000
[pid  4232] set_robust_list(0x7f367be679a0, 24 <unfinished ...>
[pid  4225] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4232] <... set_robust_list resumed>) = 0
[pid  4225] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4232] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4227] <... close resumed>)        = 0
[pid  4225] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4211] <... openat resumed>)       = 3
[pid  4209] rt_sigaction(SIGCHLD, {sa_handler=0x7f69a1510780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f69a15fe1d0} <unfinished ...>
[pid  4232] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4227] close(248 <unfinished ...>
[pid  4225] futex(0x7f367c285fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4232] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4225] <... futex resumed>)        = 0
[pid  4232] <... mmap resumed>)         = 0x1ffffffff000
[pid  4225] futex(0x7f367c285fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4232] futex(0x7f367c285fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4225] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4232] <... futex resumed>)        = 0
[pid  4225] futex(0x7f367c285fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4232] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4227] <... close resumed>)        = 0
[pid  4225] <... futex resumed>)        = 0
[pid  4211] write(3, "32", 2 <unfinished ...>
[pid  4209] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4232] <... mmap resumed>)         = 0x200000000000
[pid  4227] prctl(PR_SET_NAME, "syz.0.7" <unfinished ...>
[pid  4225] futex(0x7f367c285fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4232] futex(0x7f367c285fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4225] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4232] <... futex resumed>)        = 0
[pid  4225] futex(0x7f367c285fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4227] <... prctl resumed>)        = 0
[pid  4209] pkey_alloc(0, PKEY_UNRESTRICTED <unfinished ...>
[pid  4232] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4211] <... write resumed>)        = 2
[pid  4232] <... mmap resumed>)         = 0x200001000000
[pid  4227] mmap(0x1b30364000, 6029312, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0x40000 <unfinished ...>
[pid  4225] <... futex resumed>)        = 0
[pid  4209] <... pkey_alloc resumed>)   = -1 EINVAL (Invalid argument)
[pid  4211] close(3 <unfinished ...>
[pid  4232] futex(0x7f367c285fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4227] <... mmap resumed>)         = 0x1b30364000
[pid  4225] futex(0x7f367c285fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4211] <... close resumed>)        = 0
[pid  4209] getrandom( <unfinished ...>
[pid  4232] <... futex resumed>)        = 0
[pid  4227] close(4 <unfinished ...>
[pid  4225] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4232] futex(0x7f367c285fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4227] <... close resumed>)        = 0
[pid  4225] close_range(3, 30, 0 <unfinished ...>
[pid  4211] openat(AT_FDCWD, "/syzcgroup/unified/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4209] <... getrandom resumed>"\xf2\x24\x40\x12\xcd\x10\xbe\xa4", 8, GRND_NONBLOCK) = 8
[pid  4225] <... close_range resumed>)  = 0
[pid  4209] mkdir("./syzkaller.IWCoTL", 0700 <unfinished ...>
[pid  4227] futex(0x7f2e10015fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4225] exit_group(0 <unfinished ...>
[pid  4211] <... openat resumed>)       = 3
[pid  4232] <... futex resumed>)        = ?
[pid  4225] <... exit_group resumed>)   = ?
[pid  4232] +++ exited with 0 +++
[pid  4227] <... futex resumed>)        = 0
[pid  4211] write(3, "1", 1 <unfinished ...>
[pid  4209] <... mkdir resumed>)        = 0
[pid  4227] rt_sigaction(SIGRT_1, {sa_handler=0x7f2e0fdbc3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f2e0fd3e1d0}, NULL, 8) = 0
[pid  4209] chmod("./syzkaller.IWCoTL", 0777 <unfinished ...>
[pid  4227] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid  4209] <... chmod resumed>)        = 0
[pid  4227] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4225] +++ exited with 0 +++
[pid  4211] <... write resumed>)        = 1
[pid  4209] chdir("./syzkaller.IWCoTL" <unfinished ...>
[pid  4227] <... mmap resumed>)         = 0x7f2e0dbd1000
[pid  4209] <... chdir resumed>)        = 0
[pid  4227] mprotect(0x7f2e0dbd2000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4209] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
[pid  4209] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4227] <... mprotect resumed>)     = 0
[pid  4211] close(3 <unfinished ...>
[pid  4209] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4227] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4211] <... close resumed>)        = 0
[pid  4111] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
[pid  4111] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4211] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz1", 0777 <unfinished ...>
[pid  4227] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4211] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4209] rt_sigaction(SIGSEGV, {sa_handler=0x7f69a1512b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f69a15fe1d0} <unfinished ...>
[pid  4111] <... rt_sigreturn resumed>) = 0
[pid  4227] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f2e0dbf1990, parent_tid=0x7f2e0dbf1990, exit_signal=0, stack=0x7f2e0dbd1000, stack_size=0x201c0, tls=0x7f2e0dbf16c0} <unfinished ...>
[pid  4211] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3
[pid  4211] write(3, "1", 1/strace: Process 4234 attached
 <unfinished ...>
[pid  4227] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4209] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4234] set_robust_list(0x7f2e0dbf19a0, 24 <unfinished ...>
[pid  4227] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4211] <... write resumed>)        = 1
[pid  4209] rt_sigaction(SIGBUS, {sa_handler=0x7f69a1512b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f69a15fe1d0} <unfinished ...>
[pid  4211] close(3 <unfinished ...>
[pid  4234] <... set_robust_list resumed>) = 0
[pid  4227] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4211] <... close resumed>)        = 0
[pid  4209] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4211] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4234] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4227] futex(0x7f2e10015fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4211] <... openat resumed>)       = 3
[pid  4209] getpid( <unfinished ...>
[pid  4211] write(3, "313524224", 9)    = 9
[pid  4211] close(3 <unfinished ...>
[pid  4234] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4227] <... futex resumed>)        = 0
[pid  4211] <... close resumed>)        = 0
[pid  4209] <... getpid resumed>)       = 4209
[pid  4234] ioctl(216, KCOV_ENABLE, 0 <unfinished ...>
[pid  4211] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3
[pid  4211] write(3, "314572800", 9 <unfinished ...>
[pid  4234] <... ioctl resumed>)        = 0
[pid  4227] futex(0x7f2e10015fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4211] <... write resumed>)        = 9
[pid  4209] mmap(0x1b32d20000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0 <unfinished ...>
[pid  4234] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4211] close(3 <unfinished ...>
[pid  4209] <... mmap resumed>)         = 0x1b32d20000
[pid  4234] <... mmap resumed>)         = 0x1ffffffff000
[pid  4211] <... close resumed>)        = 0
[pid  4209] getpid( <unfinished ...>
[pid  4111] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4234] futex(0x7f2e10015fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4211] mkdirat(AT_FDCWD, "/syzcgroup/net/syz1", 0777 <unfinished ...>
[pid  4209] <... getpid resumed>)       = 4209
[pid  4111] <... write resumed>)        = 4
[pid  4041] <... pselect6 resumed>)     = 1 (in [34], left {tv_sec=0, tv_nsec=811788687})
[pid  4234] <... futex resumed>)        = 1
[pid  4227] <... futex resumed>)        = 0
[pid  4211] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4234] futex(0x7f2e10015fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4211] openat(AT_FDCWD, "/syzcgroup/net/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4209] mmap(0x1b33d24000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0 <unfinished ...>
[pid  4111] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4211] <... openat resumed>)       = 3
[pid  4209] <... mmap resumed>)         = 0x1b33d24000
[pid  4111] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4211] write(3, "1", 1)            = 1
[pid  4227] futex(0x7f2e10015fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4211] close(3 <unfinished ...>
[pid  4209] close(3 <unfinished ...>
[pid  4111] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] read(34 <unfinished ...>
[pid  4209] <... close resumed>)        = 0
[pid  4209] fcntl(5, F_GETFD <unfinished ...>
[pid  4111] <... openat resumed>)       = 3
[pid  4041] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4227] <... futex resumed>)        = 1
[pid  4234] <... futex resumed>)        = 0
[pid  4211] <... close resumed>)        = 0
[pid  4209] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4111] fstat(3 <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4234] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4209] fcntl(6, F_GETFD <unfinished ...>
[pid  4234] <... mmap resumed>)         = 0x200000000000
[pid  4209] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4111] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4058] <... close resumed>)        = 0
[pid  4234] futex(0x7f2e10015fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4211] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4209] dup2(0, 249 <unfinished ...>
[pid  4111] getdents64(3 <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4234] <... futex resumed>)        = 0
[pid  4227] futex(0x7f2e10015fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4211] <... socket resumed>)       = 3
[pid  4209] <... dup2 resumed>)         = 249
[pid  4111] <... getdents64 resumed>, 0x55558daf38c0 /* 6 entries */, 32768) = 176
[pid  4041] write(3, "\xb4\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x05\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 184 <unfinished ...>
[pid  4227] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4234] futex(0x7f2e10015fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4211] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4209] dup2(1, 248 <unfinished ...>
[pid  4111] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4058] <... sendto resumed>)       = 32
[pid  4041] <... write resumed>)        = 184
[pid  4032] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fa8a7c277000002}], 128, 859, NULL, 0) = 1
[pid  4227] futex(0x7f2e10015fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4211] <... getsockopt resumed>, 0x7f66a6f873e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4209] <... dup2 resumed>)         = 248
[pid  4111] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4234] <... futex resumed>)        = 0
[pid  4227] <... futex resumed>)        = 1
[pid  4211] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4209] dup2(2, 1 <unfinished ...>
[pid  4111] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=52, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 52
[pid  4041] kill(4083, SIGKILL <unfinished ...>
[pid  4032] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4234] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4227] futex(0x7f2e10015fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4211] <... getsockopt resumed>, 0x7f66a6f87a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4209] <... dup2 resumed>)         = 1
[pid  4111] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4058] sendto(3, [{nlmsg_len=132, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x03\x00\x68\x73\x72\x5f\x73\x6c\x61\x76\x65\x5f\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x44\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x38\x00\x02\x00\x34\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x03\x00\x76\x65\x74\x68\x30\x5f\x74\x6f\x5f\x68\x73\x72"...], 132, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4234] <... mmap resumed>)         = 0x200001000000
[pid  4211] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4209] dup2(2, 0 <unfinished ...>
[pid  4111] unlink("./0/binderfs" <unfinished ...>
[pid  4041] <... kill resumed>)         = 0
[pid  4032] <... futex resumed>)        = 1
[pid  4031] <... futex resumed>)        = 0
[pid  4234] futex(0x7f2e10015fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4211] <... getsockopt resumed>, 0x7f66a6f880e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4209] <... dup2 resumed>)         = 0
[pid  4111] <... unlink resumed>)       = 0
[pid  4234] <... futex resumed>)        = 1
[pid  4211] close(3 <unfinished ...>
[pid  4209] read(249 <unfinished ...>
[pid  4234] futex(0x7f2e10015fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4211] <... close resumed>)        = 0
[pid  4111] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4209] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\x38\x01\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4211] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4111] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4211] <... socket resumed>)       = 3
[pid  4209] unshare(CLONE_NEWPID <unfinished ...>
[pid  4227] <... futex resumed>)        = 0
[pid  4209] <... unshare resumed>)      = 0
[pid  4111] newfstatat(AT_FDCWD, "./0/cgroup.net" <unfinished ...>
[pid  4031] sched_yield( <unfinished ...>
[pid  4211] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4209] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4111] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4211] <... getsockopt resumed>, 0x7f66a6f88768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4209] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4111] unlink("./0/cgroup.net" <unfinished ...>
[pid  4227] close_range(3, 30, 0 <unfinished ...>
[pid  4211] close(3 <unfinished ...>
[pid  4209] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4111] <... unlink resumed>)       = 0
[pid  4211] <... close resumed>)        = 0
[pid  4227] <... close_range resumed>)  = 0
[pid  4211] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4111] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4032] read(6 <unfinished ...>
[pid  4031] <... sched_yield resumed>)  = 0
[pid  4211] <... socket resumed>)       = 3
[pid  4111] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4032] <... read resumed>, "\xb4\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x05\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 21347228) = 184
[pid  4031] epoll_pwait(4 <unfinished ...>
[pid  4211] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4111] newfstatat(AT_FDCWD, "./0/cgroup.cpu" <unfinished ...>
[pid  4032] futex(0x16a7c9157160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4031] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4083] +++ killed by SIGKILL +++
[pid  4211] <... getsockopt resumed>, 0x7f66a6f8afc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4111] <... newfstatat resumed> <unfinished ...>) = ?
/strace: Process 4239 attached
[pid  4227] exit_group(0 <unfinished ...>
[pid  4211] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4033] <... futex resumed>)        = 0
[pid  4032] <... futex resumed>)        = 1
[pid  4227] <... exit_group resumed>)   = ?
[pid  4211] <... getsockopt resumed>, 0x7f66a6f8b688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4083, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=4 /* 0.04 s */} ---
[pid  4041] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4211] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4041] <... rt_sigreturn resumed>) = 4083
[pid  4032] read(6 <unfinished ...>
[pid  4041] pipe2( <unfinished ...>
[pid  4239] set_robust_list(0x55556b0857e0, 24 <unfinished ...>
[pid  4234] <... futex resumed>)        = ?
[pid  4211] <... getsockopt resumed>, 0x7f66a6f8bd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4209] <... clone resumed>, child_tidptr=0x55556b0857d0) = 4239
[pid  4041] <... pipe2 resumed>[10, 18], 0) = 0
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4032] <... read resumed>, 0x16a7cd080000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4239] <... set_robust_list resumed>) = 0
[pid  4211] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4209] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4041] pipe2( <unfinished ...>
[pid  4033] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4032] futex(0x16a7c9156960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4031] futex(0x16a7c918a960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4239] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4211] <... getsockopt resumed>, 0x7f66a6f8c408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4209] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4041] <... pipe2 resumed>[20, 21], 0) = 0
[pid  4035] <... futex resumed>)        = 0
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4031] <... futex resumed>)        = 1
[pid  4041] pipe2( <unfinished ...>
[pid  4035] epoll_pwait(4 <unfinished ...>
[pid  4033] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4239] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4211] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4041] <... pipe2 resumed>[23, 37], 0) = 0
[pid  4033] futex(0x16a7c9157160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=558365895} <unfinished ...>
[pid  4211] <... getsockopt resumed>, 0x7f66a6f8cac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4211] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] <... prctl resumed>)        = 0
[pid  4211] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] <... socket resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] getppid()                   = 0
[pid  4211] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4211] <... getsockopt resumed>, 0x7f66a6f88e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] <... openat resumed>)       = 3
[pid  4211] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4111] +++ killed by SIGKILL +++
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] <... getsockopt resumed>, 0x7f66a6f894c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4211] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] dup2(3, 201 <unfinished ...>
[pid  4211] <... getsockopt resumed>, 0x7f66a6f89b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] <... dup2 resumed>)         = 201
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] close(3 <unfinished ...>
[pid  4211] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4239] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] <... getsockopt resumed>, 0x7f66a6f8a248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4239] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... prlimit64 resumed>, NULL) = 0
[pid  4211] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4239] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024} <unfinished ...>
[pid  4211] <... getsockopt resumed>, 0x7f66a6f8a908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] <... prlimit64 resumed>, NULL) = 0
[pid  4211] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... prlimit64 resumed>, NULL) = 0
[pid  4211] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] <... write resumed>)        = 4
[pid  4239] <... prlimit64 resumed>, NULL) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} <unfinished ...>
[pid  4211] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4239] <... prlimit64 resumed>, NULL) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} <unfinished ...>
[pid  4211] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] <... prlimit64 resumed>, NULL) = 0
[pid  4211] openat(AT_FDCWD, "/dev/loop1", O_RDWR <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] unshare(CLONE_NEWNS <unfinished ...>
[pid  4211] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] ioctl(3, LOOP_CLR_FD)       = -1 ENXIO (No such device or address)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... unshare resumed>)      = 0
[pid  4211] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... mount resumed>)        = 0
[pid  4239] unshare(CLONE_NEWIPC <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... unshare resumed>)      = 0
[pid  4211] <... socket resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4211] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... unshare resumed>)      = 0
[pid  4211] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] <... socket resumed>)       = 3
[pid  4239] unshare(CLONE_NEWUTS <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... unshare resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] unshare(CLONE_SYSVSEM <unfinished ...>
[pid  4234] +++ exited with 0 +++
[pid  4227] +++ exited with 0 +++
[pid  4211] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} ---
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... unshare resumed>)      = 0
[pid  4178] <... rt_sigreturn resumed>) = -1 EINTR (Interrupted system call)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] <... openat resumed>)       = 3
[pid  4211] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] write(3, "16777216", 8 <unfinished ...>
[pid  4178] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4211] <... close resumed>)        = 0
[pid  4178] <... write resumed>)        = 4
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] <... write resumed>)        = 8
[pid  4178] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4239] close(3 <unfinished ...>
[pid  4211] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4178] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4239] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4211] <... socket resumed>)       = 3
[pid  4178] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] fstat(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... openat resumed>)       = 3
[pid  4211] close(3 <unfinished ...>
[pid  4178] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] write(3, "536870912", 9 <unfinished ...>
[pid  4211] <... close resumed>)        = 0
[pid  4058] <... sendto resumed>)       = 132
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4178] getdents64(3 <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=152, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=132, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x03\x00\x68\x73\x72\x5f\x73\x6c\x61\x76\x65\x5f\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x44\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x38\x00\x02\x00\x34\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x03\x00\x76\x65\x74\x68\x30\x5f\x74\x6f\x5f\x68\x73\x72"...]}], 4096, 0, NULL, NULL) = 152
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] <... write resumed>)        = 9
[pid  4211] read(249 <unfinished ...>
[pid  4178] <... getdents64 resumed>, 0x555560a7e8c0 /* 6 entries */, 32768) = 176
[pid  4058] sendto(3, [{nlmsg_len=132, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x03\x00\x68\x73\x72\x5f\x73\x6c\x61\x76\x65\x5f\x31\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x44\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x38\x00\x02\x00\x34\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x03\x00\x76\x65\x74\x68\x31\x5f\x74\x6f\x5f\x68\x73\x72"...], 132, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4239] close(3 <unfinished ...>
[pid  4178] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4178] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4239] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4178] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] unlink("./0/binderfs" <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] <... openat resumed>)       = 3
[pid  4178] <... unlink resumed>)       = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4178] newfstatat(AT_FDCWD, "./0/cgroup.net" <unfinished ...>
[pid  4239] write(3, "1024", 4 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] <... write resumed>)        = 4
[pid  4178] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] close(3 <unfinished ...>
[pid  4178] unlink("./0/cgroup.net")    = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4178] newfstatat(AT_FDCWD, "./0/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4178] unlink("./0/cgroup.cpu")    = 0
[pid  4178] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4178] newfstatat(AT_FDCWD, "./0/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4239] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] unlink("./0/cgroup" <unfinished ...>
[pid  4239] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] <... openat resumed>)       = 3
[pid  4239] write(3, "8192", 4 <unfinished ...>
[pid  4178] <... unlink resumed>)       = 0
[pid  4058] <... sendto resumed>)       = 132
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... write resumed>)        = 4
[pid  4178] getdents64(3, 0x555560a7e8c0 /* 0 entries */, 32768) = 0
[pid  4058] recvfrom(3, [{nlmsg_len=152, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=132, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x03\x00\x68\x73\x72\x5f\x73\x6c\x61\x76\x65\x5f\x31\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x44\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x38\x00\x02\x00\x34\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x03\x00\x76\x65\x74\x68\x31\x5f\x74\x6f\x5f\x68\x73\x72"...]}], 4096, 0, NULL, NULL) = 152
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] close(3 <unfinished ...>
[pid  4178] close(3 <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] <... close resumed>)        = 0
[pid  4058] <... socket resumed>)       = 5
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] <... close resumed>)        = 0
[pid  4178] unlinkat(AT_FDCWD, "./0", AT_REMOVEDIR <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="hsr_slave_0" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4178] <... unlinkat resumed>)     = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] mkdirat(AT_FDCWD, "./1", 0777 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... openat resumed>)       = 3
[pid  4178] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] write(3, "1024", 4)         = 4
[pid  4178] openat(AT_FDCWD, "/dev/loop0", O_RDWR <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] close(3)                    = 0
[pid  4178] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[pid  4178] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] write(3, "1024", 4 <unfinished ...>
[pid  4178] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] <... write resumed>)        = 4
[pid  4178] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] close(3)                    = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4178] <... close resumed>)        = 0
[pid  4239] <... openat resumed>)       = 3
[pid  4239] write(3, "1024 1048576 500 1024", 21) = 21
[pid  4178] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] close(3 <unfinished ...>
[pid  4178] <... socket resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] getpid( <unfinished ...>
[pid  4178] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4239] <... getpid resumed>)       = 1
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4239] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4178] <... socket resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... capset resumed>)       = 0
[pid  4239] unshare(CLONE_NEWNET <unfinished ...>
[pid  4178] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... socket resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4178] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... socket resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4178] <... close resumed>)        = 0
[pid  4178] read(249 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] <... unshare resumed>)      = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] <... openat resumed>)       = 3
[pid  4058] close(5 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] write(3, "0 65535", 7)      = 7
[pid  4058] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] close(3 <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... close resumed>)        = 0
[pid  4239] openat(AT_FDCWD, "/dev/rfkill", O_RDWR) = 3
[pid  4058] <... socket resumed>)       = 5
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] write(3, "\x00\x00\x00\x00\x00\x03\x00\x00", 8) = 8
[pid  4239] close(3)                    = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="hsr_slave_1" <unfinished ...>
[pid  4239] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3
[pid  4239] sendto(3, [{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... sendto resumed>)       = 40
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] recvfrom(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] <... recvfrom resumed>, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENOENT, msg=[{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00"]}], 4096, 0, NULL, NULL) = 60
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4239] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] <... sendto resumed>)       = 32
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] recvfrom(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... recvfrom resumed>, [{nlmsg_len=2596, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x20\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x6b\x01\x00\x00\x50\x09\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2596
[pid  4058] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] recvfrom(3 <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=88, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x03\x00\x68\x73\x72\x30\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x20\x00\x12\x00\x07\x00\x01\x00\x68\x73\x72\x00\x14\x00\x02\x00\x08\x00\x01\x00\x00\x00\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00"], 88, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... recvfrom resumed>, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] write(2, "SYZFAIL: netlink_query_family_id failed\n", 40 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... write resumed>)        = 40
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] write(2, " (errno 2: No such file or directory)\n", 38 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... write resumed>)        = 38
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4239] exit_group(67 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] <... exit_group resumed>)   = ?
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4239] +++ exited with 67 +++
[pid  4058] <... sendto resumed>)       = 88
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] recvfrom(3, [{nlmsg_len=108, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=88, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x03\x00\x68\x73\x72\x30\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x20\x00\x12\x00\x07\x00\x01\x00\x68\x73\x72\x00\x14\x00\x02\x00\x08\x00\x01\x00\x00\x00\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 108
[pid  4209] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4239, si_uid=0, si_status=67, si_utime=0, si_stime=2 /* 0.02 s */} ---
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4209] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4209] <... rt_sigreturn resumed>) = 4239
[pid  4058] <... socket resumed>)       = 5
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="hsr_slave_0" <unfinished ...>
[pid  4209] write(2, "loop exited with status 67\n", 27 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4209] <... write resumed>)        = 27
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4209] write(248, "\x43\x00\x00\x00", 4 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4209] <... write resumed>)        = 4
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4209] exit_group(67 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4209] <... exit_group resumed>)   = ?
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4209] +++ exited with 67 +++
[pid  4041] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4209, si_uid=0, si_status=67, si_utime=0, si_stime=4 /* 0.04 s */} ---
[pid  4041] rt_sigreturn({mask=[]})     = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4035] <... epoll_pwait resumed>, [], 128, 562, NULL, 0) = 0
[pid  4031] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] epoll_pwait(4 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4035] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] futex(0x16a7c9157160, FUTEX_WAKE_PRIVATE, 1) = 1
[pid  4033] <... futex resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4035] epoll_pwait(4 <unfinished ...>
[pid  4033] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4033] write(5, "\x01\x00\x00\x00\x00\x00\x00\x00", 8 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4033] <... write resumed>)        = 8
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4033] futex(0x16a7c9157160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4035] <... epoll_pwait resumed>, [{events=EPOLLIN, data=0x33dbe88}], 128, 56009, NULL, 0) = 1
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=993852688} <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4035] read(5 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4058] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] <... read resumed>, "\x01\x00\x00\x00\x00\x00\x00\x00", 8) = 8
[pid  4058] <... sendto resumed>)       = 32
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4035] epoll_pwait(4 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=52, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 52
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4035] epoll_pwait(4 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... socket resumed>)       = 5
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="hsr_slave_1" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... sendto resumed>)       = 32
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=52, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 52
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=140, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x03\x00\x76\x65\x74\x68\x30\x5f\x76\x69\x72\x74\x5f\x77\x69\x66\x69\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x03\x00\x76\x65\x74\x68\x31\x5f\x76\x69"...], 140, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f809d8bf000
[pid  4041] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4041] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7f809d8bf000, stack_size=0x9000}, 88/strace: Process 4267 attached
 <unfinished ...>
[pid  4267] rt_sigprocmask(SIG_BLOCK, NULL, ~[KILL STOP], 8) = 0
[pid  4058] <... sendto resumed>)       = 140
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4267] setpgid(0, 0 <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=160, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=140, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x03\x00\x76\x65\x74\x68\x30\x5f\x76\x69\x72\x74\x5f\x77\x69\x66\x69\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x03\x00\x76\x65\x74\x68\x31\x5f\x76\x69"...]}], 4096, 0, NULL, NULL) = 160
[pid  4267] <... setpgid resumed>)      = 0
[pid  4267] dup2(10, 0 <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4267] <... dup2 resumed>)         = 0
[pid  4058] <... socket resumed>)       = 5
[pid  4267] dup2(21, 1)                 = 1
[pid  4267] dup2(37, 2)                 = 2
[pid  4267] dup2(19, 3)                 = 3
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="veth1_virt_wifi" <unfinished ...>
[pid  4267] dup2(22, 4)                 = 4
[pid  4267] close(5)                    = 0
[pid  4267] close(6)                    = 0
[pid  4267] close(7)                    = 0
[pid  4267] close(8)                    = 0
[pid  4267] close(9)                    = 0
[pid  4267] close(10)                   = 0
[pid  4267] close(11)                   = 0
[pid  4267] close(12)                   = 0
[pid  4267] close(13)                   = 0
[pid  4267] close(14)                   = 0
[pid  4267] close(15)                   = 0
[pid  4267] close(16)                   = 0
[pid  4267] close(17)                   = 0
[pid  4267] close(18)                   = 0
[pid  4267] close(19)                   = 0
[pid  4267] close(20)                   = 0
[pid  4267] close(21)                   = 0
[pid  4267] close(22)                   = 0
[pid  4267] close(23)                   = 0
[pid  4267] close(24)                   = 0
[pid  4267] close(25)                   = 0
[pid  4267] close(26)                   = 0
[pid  4267] close(27)                   = 0
[pid  4267] close(28)                   = 0
[pid  4267] close(29)                   = 0
[pid  4267] close(30)                   = 0
[pid  4267] close(31)                   = 0
[pid  4267] close(32)                   = 0
[pid  4267] close(33)                   = 0
[pid  4267] close(34)                   = 0
[pid  4267] close(35)                   = 0
[pid  4267] close(36)                   = 0
[pid  4267] close(37)                   = 0
[pid  4267] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4267] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] close(39)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(40)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(44)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(45)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(46)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(47)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(48)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(49)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(50)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(51)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(52)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(53)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(54)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(55)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(56)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(57)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(58)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(59)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(60)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(61)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(62)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(63)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(64)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(65)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(66)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(67)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(68)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(70)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(71)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(72)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(75)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(76)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(77)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(79)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(80)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(81)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(82)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(84)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(85)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(86)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(87)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(88)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(89)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(90)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(92)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(93)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(94)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(95)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(96)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(98)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(99)                   = -1 EBADF (Bad file descriptor)
[pid  4267] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(102)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(104)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(106)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(110)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(118)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(119)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(120)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(129)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(130)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(134)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(135)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(142)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(154)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(155)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(158)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(163 <unfinished ...>
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4267] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] close(5 <unfinished ...>
[pid  4267] close(164 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4267] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] sendto(3, [{nlmsg_len=92, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00\x03\x00\x76\x69\x72\x74\x5f\x77\x69\x66\x69\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x14\x00\x12\x00\x0d\x00\x01\x00\x76\x69\x72\x74\x5f\x77\x69\x66\x69\x00\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00"], 92, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4267] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(168)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(169)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(182)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(183)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(184)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(185)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(186)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(188)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(189)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(190)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(191)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(194)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(195)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... sendto resumed>)       = 92
[pid  4267] close(196 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4267] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=112, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=92, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00\x03\x00\x76\x69\x72\x74\x5f\x77\x69\x66\x69\x30\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x14\x00\x12\x00\x0d\x00\x01\x00\x76\x69\x72\x74\x5f\x77\x69\x66\x69\x00\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 112
[pid  4267] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4058] sendto(3, [{nlmsg_len=132, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00\x03\x00\x76\x65\x74\x68\x30\x5f\x76\x6c\x61\x6e\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x44\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x38\x00\x02\x00\x34\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00\x03\x00\x76\x65\x74\x68\x31\x5f\x76\x6c\x61\x6e\x00\x00"...], 132, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4267] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(200)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(202)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(204)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(205)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(206)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(207)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(208)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(209)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(210)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(211)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(213)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(214)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(215)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(216)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(217)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(218)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(219)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(220)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(223)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(224)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(225)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(228)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(229)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(230)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(231)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(232)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(233)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(234)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(235)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(236)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(237)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(240)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(241)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(244)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(245)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(246)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(247)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(248)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... sendto resumed>)       = 132
[pid  4267] close(251 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4267] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=152, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=132, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00\x03\x00\x76\x65\x74\x68\x30\x5f\x76\x6c\x61\x6e\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x44\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x38\x00\x02\x00\x34\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00\x03\x00\x76\x65\x74\x68\x31\x5f\x76\x6c\x61\x6e\x00\x00"...]}], 4096, 0, NULL, NULL) = 152
[pid  4267] close(252 <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4267] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... socket resumed>)       = 5
[pid  4267] close(253 <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="veth0_vlan" <unfinished ...>
[pid  4267] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4267] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4267] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4267] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4267] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffc25fc6af0 /* 2 vars */ <unfinished ...>
[pid  4041] <... clone3 resumed>)       = 4267
[pid  4041] munmap(0x7f809d8bf000, 36864 <unfinished ...>
[pid  4267] <... execve resumed>)       = 0
[pid  4041] <... munmap resumed>)       = 0
[pid  4041] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4041] fcntl(20, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4041] fcntl(20, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4041] fcntl(23, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4041] fcntl(23, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4041] close(10)                   = 0
[pid  4041] close(21)                   = 0
[pid  4041] close(37)                   = 0
[pid  4041] close(32)                   = 0
[pid  4041] close(34)                   = 0
[pid  4041] close(36)                   = 0
[pid  4041] write(18, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x80\x38\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4041] pselect6(36, [3 13 16 20 23 25 28 29 31 33 35], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8}) = 4 (in [13 16 25 28], left {tv_sec=0, tv_nsec=999884152})
[pid  4041] read(28, "\x00\x00\x00\x00", 4) = 4
[pid  4041] write(3, "\xa4\xc3\x02\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x18\x00\x0c\x00\x00\x00\x04\x00\x00\x00\x00\x00\x08\x00\x10\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x14\x00\x00\x00\x0c\x00\x00\x00\xc0\xe7\x6e\x52"..., 181160 <unfinished ...>
[pid  4267] brk(NULL <unfinished ...>
[pid  4035] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fa8a7c277000002}], 128, 948, NULL, 0) = 1
[pid  4267] <... brk resumed>)          = 0x55556764b000
[pid  4041] <... write resumed>)        = 181160
[pid  4035] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4267] brk(0x55556764be80 <unfinished ...>
[pid  4035] <... futex resumed>)        = 1
[pid  4035] read(6 <unfinished ...>
[pid  4031] <... futex resumed>)        = 0
[pid  4035] <... read resumed>, "\xa4\xc3\x02\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x18\x00\x0c\x00\x00\x00\x04\x00\x00\x00\x00\x00\x08\x00\x10\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x14\x00\x00\x00\x0c\x00\x00\x00\xc0\xe7\x6e\x52"..., 21347228) = 181160
[pid  4031] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4267] <... brk resumed>)          = 0x55556764be80
[pid  4041] kill(4151, SIGKILL <unfinished ...>
[pid  4031] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4267] arch_prctl(ARCH_SET_FS, 0x55556764b500 <unfinished ...>
[pid  4041] <... kill resumed>)         = 0
[pid  4267] <... arch_prctl resumed>)   = 0
[pid  4267] set_tid_address(0x55556764b7d0) = 4267
[pid  4267] set_robust_list(0x55556764b7e0, 24) = 0
[pid  4267] prlimit64(0, RLIMIT_STACK, NULL <unfinished ...>
[pid  4031] sched_yield( <unfinished ...>
[pid  4267] <... prlimit64 resumed>, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4267] readlinkat(AT_FDCWD, "/proc/self/exe", "/syz-executor", 4096) = 13
[pid  4267] getrandom("\xe2\x85\xe1\xe0\xd0\xf8\xbb\x41", 8, GRND_NONBLOCK) = 8
[pid  4267] brk(NULL)                   = 0x55556764be80
[pid  4267] brk(0x55556766ce80)         = 0x55556766ce80
[pid  4031] <... sched_yield resumed>)  = 0
[pid  4267] brk(0x55556766d000 <unfinished ...>
[pid  4031] futex(0x16a7c9156538, FUTEX_WAIT_PRIVATE, 4294967295, NULL <unfinished ...>
[pid  4267] <... brk resumed>)          = 0x55556766d000
[pid  4267] mprotect(0x7f33ff319000, 1236992, PROT_READ <unfinished ...>
[pid  4035] futex(0x16a7c9156538, FUTEX_WAKE_PRIVATE, 1) = 1
[pid  4031] <... futex resumed>)        = 0
[pid  4035] futex(0x16a7c9157160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4267] <... mprotect resumed>)     = 0
[pid  4035] <... futex resumed>)        = 1
[pid  4031] epoll_pwait(4, [{events=EPOLLOUT, data=0x3fa8a7c277000002}], 128, 0, NULL, 0) = 1
[pid  4035] read(6 <unfinished ...>
[pid  4031] futex(0x16a7c9156960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4035] <... read resumed>, 0x16a7cd080000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4031] <... futex resumed>)        = 1
[pid  4035] futex(0x16a7c918a960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4033] <... futex resumed>)        = 0
[pid  4032] <... futex resumed>)        = 0
[pid  4267] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4267] <... prctl resumed>)        = 0
[pid  4267] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x1ffffffff000
[pid  4032] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4032] futex(0x16a7c9156960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=450348757} <unfinished ...>
[pid  4267] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200000000000
[pid  4267] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200001000000
[pid  4267] rt_sigaction(SIGCHLD, {sa_handler=0x7f33ff0b0780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f33ff19e1d0}, NULL, 8) = 0
[pid  4267] pkey_alloc(0, PKEY_UNRESTRICTED) = -1 EINVAL (Invalid argument)
[pid  4267] getrandom("\xb8\x9a\x04\xe6\x54\x57\xde\x44", 8, GRND_NONBLOCK) = 8
[pid  4267] mkdir("./syzkaller.E1vcC6", 0700) = 0
[pid  4267] chmod("./syzkaller.E1vcC6", 0777) = 0
[pid  4267] chdir("./syzkaller.E1vcC6") = 0
[pid  4267] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
[pid  4267] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
[pid  4267] rt_sigaction(SIGSEGV, {sa_handler=0x7f33ff0b2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f33ff19e1d0}, NULL, 8) = 0
[pid  4267] rt_sigaction(SIGBUS, {sa_handler=0x7f33ff0b2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f33ff19e1d0}, NULL, 8) = 0
[pid  4267] getpid()                    = 4267
[pid  4267] mmap(0x1b2e720000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0 <unfinished ...>
[pid  4178] <... read resumed> <unfinished ...>) = ?
[pid  4151] +++ killed by SIGKILL +++
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4267] <... mmap resumed>)         = 0x1b2e720000
[pid  4267] getpid( <unfinished ...>
[pid  4041] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4151, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=9 /* 0.09 s */} ---
[pid  4267] <... getpid resumed>)       = 4267
[pid  4041] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4267] mmap(0x1b2f724000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0 <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4041] <... rt_sigreturn resumed>) = 4151
[pid  4267] <... mmap resumed>)         = 0x1b2f724000
[pid  4058] <... close resumed>)        = 0
[pid  4041] pipe2( <unfinished ...>
[pid  4267] close(3 <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=100, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x76\x6c\x61\x6e\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x20\x00\x12\x00\x08\x00\x01\x00\x76\x6c\x61\x6e\x14\x00\x02\x00\x06\x00\x01\x00\x00\x00\x00\x00\x06\x00\x05\x00\x81\x00\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00"], 100, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] <... pipe2 resumed>[10, 21], 0) = 0
[pid  4267] <... close resumed>)        = 0
[pid  4267] fcntl(5, F_GETFD <unfinished ...>
[pid  4041] pipe2([32, 34], 0)          = 0
[pid  4041] pipe2( <unfinished ...>
[pid  4267] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4041] <... pipe2 resumed>[36, 37], 0) = 0
[pid  4267] fcntl(6, F_GETFD)           = -1 EBADF (Bad file descriptor)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] dup2(0, 249 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... dup2 resumed>)         = 249
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] dup2(1, 248 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... dup2 resumed>)         = 248
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] dup2(2, 1 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... dup2 resumed>)         = 1
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] dup2(2, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... dup2 resumed>)         = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] read(249 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x80\x38\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... prctl resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] getppid( <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... getppid resumed>)      = 4041
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] dup2(3, 201 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... dup2 resumed>)         = 201
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... prlimit64 resumed>, NULL) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  4267] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... prlimit64 resumed>, NULL) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... prlimit64 resumed>, NULL) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... prlimit64 resumed>, NULL) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] unshare(CLONE_NEWNS <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... unshare resumed>)      = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] unshare(CLONE_NEWIPC <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... unshare resumed>)      = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... unshare resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] unshare(CLONE_NEWUTS)       = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] unshare(CLONE_SYSVSEM <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... unshare resumed>)      = 0
[pid  4267] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] write(3, "16777216", 8 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... write resumed>)        = 8
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] write(3, "536870912", 9 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... write resumed>)        = 9
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... openat resumed>)       = 3
[pid  4058] <... sendto resumed>)       = 100
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=120, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=100, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x76\x6c\x61\x6e\x30\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x20\x00\x12\x00\x08\x00\x01\x00\x76\x6c\x61\x6e\x14\x00\x02\x00\x06\x00\x01\x00\x00\x00\x00\x00\x06\x00\x05\x00\x81\x00\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 120
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] write(3, "1024", 4)         = 4
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... socket resumed>)       = 5
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] close(3 <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="veth0_vlan" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] write(3, "8192", 4 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... write resumed>)        = 4
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] write(3, "1024", 4 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... write resumed>)        = 4
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] write(3, "1024", 4 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... write resumed>)        = 4
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... openat resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] write(3, "1024 1048576 500 1024", 21 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... write resumed>)        = 21
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] getpid( <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... getpid resumed>)       = 4267
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=4267}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=4267}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... capset resumed>)       = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] unshare(CLONE_NEWNET <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... unshare resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... openat resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] write(3, "0 65535", 7 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... write resumed>)        = 7
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... close resumed>)        = 0
[pid  4267] chown(".", 10999, 10999 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... chown resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] setgroups(5, [10999, 3001, 3002, 3003, 9997] <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... setgroups resumed>)    = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] setresgid(10999, 10999, 10999) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] mkdirat(AT_FDCWD, "/dev/binderfs", 0777 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=100, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x76\x6c\x61\x6e\x31\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x20\x00\x12\x00\x08\x00\x01\x00\x76\x6c\x61\x6e\x14\x00\x02\x00\x06\x00\x01\x00\x01\x00\x00\x00\x06\x00\x05\x00\x88\xa8\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00"], 100, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4267] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4178] +++ killed by SIGKILL +++
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, {len=114, filter=0x7fff868895d0} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... prctl resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] setresuid(10999, 10999, 10999 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... setresuid resumed>)    = 0
[pid  4267] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... prctl resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] setxattr(".", "security.selinux", "\x75\x3a\x6f\x62\x6a\x65\x63\x74\x5f\x72\x3a\x61\x70\x70\x5f\x64\x61\x74\x61\x5f\x66\x69\x6c\x65\x3a\x73\x30\x3a\x63\x35\x31\x32\x2c\x63\x37\x36\x38\x00", 38, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... setxattr resumed>)     = -1 EINVAL (Invalid argument)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] write(2, "SYZFAIL: setfilecon: setxattr failed\n", 37 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] <... write resumed>)        = 37
[pid  4267] write(2, " (errno 22: Invalid argument)\n", 30 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... write resumed>)        = 30
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] exit_group(67 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4267] <... exit_group resumed>)   = ?
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... sendto resumed>)       = 100
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4267] +++ exited with 67 +++
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=120, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=100, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x03\x00\x76\x6c\x61\x6e\x31\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x20\x00\x12\x00\x08\x00\x01\x00\x76\x6c\x61\x6e\x14\x00\x02\x00\x06\x00\x01\x00\x01\x00\x00\x00\x06\x00\x05\x00\x88\xa8\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 120
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
[pid  4041] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4267, si_uid=10999, si_status=67, si_utime=0, si_stime=5 /* 0.05 s */} ---
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="veth1_vlan" <unfinished ...>
[pid  4041] rt_sigreturn({mask=[]})     = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f809d8bf000
[pid  4041] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4041] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7f809d8bf000, stack_size=0x9000}, 88/strace: Process 4290 attached
 <unfinished ...>
[pid  4290] rt_sigprocmask(SIG_BLOCK, NULL, ~[KILL STOP], 8) = 0
[pid  4290] setpgid(0, 0)               = 0
[pid  4290] dup2(10, 0)                 = 0
[pid  4290] dup2(34, 1)                 = 1
[pid  4290] dup2(37, 2)                 = 2
[pid  4290] dup2(7, 3)                  = 3
[pid  4290] dup2(8, 4)                  = 4
[pid  4290] close(5)                    = 0
[pid  4290] close(6)                    = 0
[pid  4290] close(7)                    = 0
[pid  4290] close(8)                    = 0
[pid  4290] close(9)                    = 0
[pid  4290] close(10)                   = 0
[pid  4290] close(11)                   = 0
[pid  4290] close(12)                   = 0
[pid  4290] close(13)                   = 0
[pid  4290] close(14)                   = 0
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4290] close(15)                   = 0
[pid  4058] close(5 <unfinished ...>
[pid  4290] close(16 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4290] <... close resumed>)        = 0
[pid  4058] sendto(3, [{nlmsg_len=96, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x03\x00\x6d\x61\x63\x76\x6c\x61\x6e\x30\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x1c\x00\x12\x00\x0b\x00\x01\x00\x6d\x61\x63\x76\x6c\x61\x6e\x00\x0c\x00\x02\x00\x08\x00\x01\x00\x04\x00\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00"], 96, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4290] close(17 <unfinished ...>
[pid  4033] <... epoll_pwait resumed>, [], 128, 451, NULL, 0) = 0
[pid  4031] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4290] <... close resumed>)        = 0
[pid  4290] close(18)                   = 0
[pid  4290] close(19 <unfinished ...>
[pid  4033] futex(0x16a7c9156960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4290] <... close resumed>)        = 0
[pid  4290] close(20)                   = 0
[pid  4033] <... futex resumed>)        = 1
[pid  4032] <... futex resumed>)        = 0
[pid  4032] epoll_pwait(4, [], 128, 0, NULL, 0) = 0
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4033] futex(0x16a7c9157160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4290] close(21)                   = 0
[pid  4290] close(22 <unfinished ...>
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=988944081} <unfinished ...>
[pid  4290] <... close resumed>)        = 0
[pid  4290] close(23)                   = 0
[pid  4290] close(24)                   = 0
[pid  4290] close(25)                   = 0
[pid  4290] close(26)                   = 0
[pid  4290] close(27)                   = 0
[pid  4290] close(28)                   = 0
[pid  4290] close(29)                   = 0
[pid  4290] close(30)                   = 0
[pid  4290] close(31)                   = 0
[pid  4290] close(32)                   = 0
[pid  4290] close(33)                   = 0
[pid  4290] close(34)                   = 0
[pid  4290] close(35)                   = 0
[pid  4290] close(36)                   = 0
[pid  4290] close(37)                   = 0
[pid  4290] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4290] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4290] close(39)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(40)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(44)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(45)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(46)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(47)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(48)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(49)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(50)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(51)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(52)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(53)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(54)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(55)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(56)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(57)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(58)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(59)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(60)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(61)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(62)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(63)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(64)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(65)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(66)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(67)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(68)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(70)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(71)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(72)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(75)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(76)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(77)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(79)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(80)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(81)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(82)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(84)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(85)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(86)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(87)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... sendto resumed>)       = 96
[pid  4290] close(88 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4290] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4290] close(89)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(90)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(92)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(93)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(94 <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=116, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=96, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x03\x00\x6d\x61\x63\x76\x6c\x61\x6e\x30\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x1c\x00\x12\x00\x0b\x00\x01\x00\x6d\x61\x63\x76\x6c\x61\x6e\x00\x0c\x00\x02\x00\x08\x00\x01\x00\x04\x00\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 116
[pid  4290] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4290] close(95)                   = -1 EBADF (Bad file descriptor)
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4290] close(96)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(98 <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4290] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4290] close(99)                   = -1 EBADF (Bad file descriptor)
[pid  4290] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="veth1_vlan" <unfinished ...>
[pid  4290] close(102)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(104)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(106)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(110)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(118)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(119)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(120)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4290] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4058] close(5 <unfinished ...>
[pid  4290] close(129)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(130)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4290] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4058] sendto(3, [{nlmsg_len=96, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x03\x00\x6d\x61\x63\x76\x6c\x61\x6e\x31\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x1c\x00\x12\x00\x0b\x00\x01\x00\x6d\x61\x63\x76\x6c\x61\x6e\x00\x0c\x00\x02\x00\x08\x00\x01\x00\x04\x00\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00"], 96, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4290] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(134)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(135)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(142)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(154)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(155 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 96
[pid  4290] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4290] close(156 <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=116, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=96, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x03\x00\x6d\x61\x63\x76\x6c\x61\x6e\x31\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x1c\x00\x12\x00\x0b\x00\x01\x00\x6d\x61\x63\x76\x6c\x61\x6e\x00\x0c\x00\x02\x00\x08\x00\x01\x00\x04\x00\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 116
[pid  4290] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4290] close(157 <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4290] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4290] close(158 <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4290] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4290] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="veth0_vlan" <unfinished ...>
[pid  4290] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(163)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(164)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(168)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(169)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(182)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(183)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(184)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(185)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(186)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(188)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(189)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(190)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(191)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(194)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(195)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(196)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(200)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(202)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(204)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(205)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(206)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(207)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(208)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(209)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(210)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(211)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(213)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(214)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(215)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(216)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(217)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(218)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(219)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(220)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(223)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(224)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(225)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(226 <unfinished ...>
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4290] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4290] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4058] close(5 <unfinished ...>
[pid  4290] close(228)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(229)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(230 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4290] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4290] close(231 <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=104, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x03\x00\x69\x70\x76\x6c\x61\x6e\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x24\x00\x12\x00\x0a\x00\x01\x00\x69\x70\x76\x6c\x61\x6e\x00\x00\x14\x00\x02\x00\x06\x00\x01\x00\x00\x00\x00\x00\x06\x00\x02\x00\x00\x00\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00"], 104, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4290] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4290] close(232)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(233)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(234)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(235)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(236)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(237)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(240)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(241)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(244)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(245)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(246)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(247)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(248)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(251)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(252)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(253)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4290] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4290] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4290] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffc25fc6af0 /* 2 vars */ <unfinished ...>
[pid  4041] <... clone3 resumed>)       = 4290
[pid  4041] munmap(0x7f809d8bf000, 36864) = 0
[pid  4041] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4041] fcntl(32, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4041] fcntl(32, F_SETFL, O_RDONLY|O_NONBLOCK <unfinished ...>
[pid  4290] <... execve resumed>)       = 0
[pid  4041] <... fcntl resumed>)        = 0
[pid  4041] fcntl(36, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4041] fcntl(36, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4041] close(10)                   = 0
[pid  4041] close(34)                   = 0
[pid  4041] close(37)                   = 0
[pid  4041] close(26)                   = 0
[pid  4041] close(28)                   = 0
[pid  4041] close(35)                   = 0
[pid  4041] write(21, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\x38\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4041] read(13, "\x00\x00\x00\x00", 4) = 4
[pid  4041] write(3, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x01\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00", 56) = 56
[pid  4032] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fa8a7c277000002}], 128, 989, NULL, 0) = 1
[pid  4032] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1) = 1
[pid  4058] <... sendto resumed>)       = 104
[pid  4032] read(6 <unfinished ...>
[pid  4031] <... futex resumed>)        = 0
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] write(11, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=124, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=104, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x03\x00\x69\x70\x76\x6c\x61\x6e\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x24\x00\x12\x00\x0a\x00\x01\x00\x69\x70\x76\x6c\x61\x6e\x00\x00\x14\x00\x02\x00\x06\x00\x01\x00\x00\x00\x00\x00\x06\x00\x02\x00\x00\x00\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 124
[pid  4041] <... write resumed>)        = 48
[pid  4032] <... read resumed>, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x01\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00", 21347228) = 56
[pid  4290] brk(NULL <unfinished ...>
[pid  4211] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4041] read(25 <unfinished ...>
[pid  4032] read(6 <unfinished ...>
[pid  4290] <... brk resumed>)          = 0x555579e1c000
[pid  4211] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4041] <... read resumed>, "SYZFAIL: netlink_query_family_id failed\n (errno 2: No such file or directory)\nloop exited with statu"..., 1024) = 105
[pid  4032] <... read resumed>, 0x16a7cd080000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4211] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4031] epoll_pwait(4 <unfinished ...>
[pid  4211] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4032] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4290] brk(0x555579e1ce80 <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="veth0_vlan" <unfinished ...>
[pid  4041] read(16 <unfinished ...>
[pid  4031] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4290] <... brk resumed>)          = 0x555579e1ce80
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4290] arch_prctl(ARCH_SET_FS, 0x555579e1c500 <unfinished ...>
[pid  4041] <... read resumed>, "\x43\x00\x00\x00", 4) = 4
[pid  4041] write(3, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x02\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00", 56 <unfinished ...>
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=606443104} <unfinished ...>
[pid  4290] <... arch_prctl resumed>)   = 0
[pid  4041] <... write resumed>)        = 56
[pid  4032] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fa8a7c277000002}], 128, 610, NULL, 0) = 1
[pid  4290] set_tid_address(0x555579e1c7d0 <unfinished ...>
[pid  4032] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1) = 1
[pid  4031] <... futex resumed>)        = 0
[pid  4290] <... set_tid_address resumed>) = 4290
[pid  4031] sched_yield( <unfinished ...>
[pid  4290] set_robust_list(0x555579e1c7e0, 24 <unfinished ...>
[pid  4041] write(15, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4032] read(6 <unfinished ...>
[pid  4290] <... set_robust_list resumed>) = 0
[pid  4041] <... write resumed>)        = -1 EPIPE (Broken pipe)
[pid  4290] prlimit64(0, RLIMIT_STACK, NULL <unfinished ...>
[pid  4041] --- SIGPIPE {si_signo=SIGPIPE, si_code=SI_USER, si_pid=4041, si_uid=0} ---
[pid  4290] <... prlimit64 resumed>, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4041] kill(4209, SIGKILL <unfinished ...>
[pid  4290] readlinkat(AT_FDCWD, "/proc/self/exe" <unfinished ...>
[pid  4041] <... kill resumed>)         = 0
[pid  4290] <... readlinkat resumed>, "/syz-executor", 4096) = 13
[pid  4032] <... read resumed>, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x02\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00", 21347228) = 56
[pid  4032] read(6 <unfinished ...>
[pid  4041] read(25 <unfinished ...>
[pid  4290] getrandom( <unfinished ...>
[pid  4041] <... read resumed>, "", 1024) = 0
[pid  4032] <... read resumed>, 0x16a7cd080000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4290] <... getrandom resumed>"\xde\x36\xa6\xf7\x8d\xdd\x23\xc8", 8, GRND_NONBLOCK) = 8
/strace: Process 4305 attached
[pid  4290] brk(NULL <unfinished ...>
[pid  4041] write(3, "\x34\x01\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x20\x00\x18\x00\x08\x00\x0c\x00\x07\x00\x10\x00\x14\x00\x10\x00\x00\x00\x00\x00\x00\x01\x02\x00\x00\x00\x14\x00\x00\x00\x9c\x00\x00\x00\xb8\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00\x88\x00\x00\x00\x53\x59\x5a\x46\x41\x49\x4c\x3a\x20\x6e\x65\x74\x6c\x69\x6e\x6b"..., 312 <unfinished ...>
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4031] <... sched_yield resumed>)  = 0
[pid  4290] <... brk resumed>)          = 0x555579e1ce80
[pid  4290] brk(0x555579e3de80 <unfinished ...>
[pid  4032] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4290] <... brk resumed>)          = 0x555579e3de80
[pid  4290] brk(0x555579e3e000)         = 0x555579e3e000
[pid  4305] set_robust_list(0x555576de17e0, 24 <unfinished ...>
[pid  4290] mprotect(0x7f46a0d89000, 1236992, PROT_READ <unfinished ...>
[pid  4305] <... set_robust_list resumed>) = 0
[pid  4290] <... mprotect resumed>)     = 0
[pid  4211] <... clone resumed>, child_tidptr=0x555576de17d0) = 2
[pid  4041] <... write resumed>)        = 312
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4031] epoll_pwait(4 <unfinished ...>
[pid  4290] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  4290] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x1ffffffff000
[pid  4290] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200000000000
[pid  4290] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200001000000
[pid  4290] rt_sigaction(SIGCHLD, {sa_handler=0x7f46a0b20780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f46a0c0e1d0} <unfinished ...>
[pid  4031] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fa8a7c277000002}], 128, 0, NULL, 0) = 1
[pid  4031] futex(0x16a7c9157160, FUTEX_WAKE_PRIVATE, 1) = 1
[pid  4033] <... futex resumed>)        = 0
[pid  4290] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4305] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4290] pkey_alloc(0, PKEY_UNRESTRICTED <unfinished ...>
[pid  4211] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4041] pipe2( <unfinished ...>
[pid  4033] read(6 <unfinished ...>
[pid  4305] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4290] <... pkey_alloc resumed>)   = -1 EINVAL (Invalid argument)
[pid  4211] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4041] <... pipe2 resumed>[10, 26], 0) = 0
[pid  4033] <... read resumed>, "\x34\x01\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x20\x00\x18\x00\x08\x00\x0c\x00\x07\x00\x10\x00\x14\x00\x10\x00\x00\x00\x00\x00\x00\x01\x02\x00\x00\x00\x14\x00\x00\x00\x9c\x00\x00\x00\xb8\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00\x88\x00\x00\x00\x53\x59\x5a\x46\x41\x49\x4c\x3a\x20\x6e\x65\x74\x6c\x69\x6e\x6b"..., 21347228) = 312
[pid  4305] chdir("./0" <unfinished ...>
[pid  4290] getrandom( <unfinished ...>
[pid  4305] <... chdir resumed>)        = 0
[pid  4033] futex(0x16a7c918a960, FUTEX_WAKE_PRIVATE, 1) = 1
[pid  4033] read(6 <unfinished ...>
[pid  4305] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4290] <... getrandom resumed>"\x5f\xf7\xf7\x82\x66\xfc\xf0\xcf", 8, GRND_NONBLOCK) = 8
[pid  4041] pipe2( <unfinished ...>
[pid  4035] <... futex resumed>)        = 0
[pid  4033] <... read resumed>, 0x16a7cd080000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4290] mkdir("./syzkaller.nd6MEK", 0700 <unfinished ...>
[pid  4035] futex(0x16a7c918a960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4041] <... pipe2 resumed>[28, 34], 0) = 0
[pid  4033] futex(0x16a7c9157160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4305] <... prctl resumed>)        = 0
[pid  4290] <... mkdir resumed>)        = 0
[pid  4041] pipe2( <unfinished ...>
[pid  4305] setpgid(0, 0 <unfinished ...>
[pid  4041] <... pipe2 resumed>[35, 37], 0) = 0
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=573867835} <unfinished ...>
[pid  4305] <... setpgid resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4305] symlinkat("/syzcgroup/unified/syz1", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4305] <... symlinkat resumed>)    = 0
[pid  4290] chmod("./syzkaller.nd6MEK", 0777 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4290] <... chmod resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4290] chdir("./syzkaller.nd6MEK" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4290] <... chdir resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4290] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4290] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4305] symlinkat("/syzcgroup/cpu/syz1", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4290] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4305] <... symlinkat resumed>)    = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4305] symlinkat("/syzcgroup/net/syz1", AT_FDCWD, "./cgroup.net" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4305] <... symlinkat resumed>)    = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4305] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4290] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4305] <... openat resumed>)       = 3
[pid  4290] rt_sigaction(SIGSEGV, {sa_handler=0x7f46a0b22b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f46a0c0e1d0} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4290] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4305] write(3, "1000", 4 <unfinished ...>
[pid  4290] rt_sigaction(SIGBUS, {sa_handler=0x7f46a0b22b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f46a0c0e1d0} <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4305] <... write resumed>)        = 4
[pid  4290] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4305] close(3 <unfinished ...>
[pid  4290] getpid( <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4305] <... close resumed>)        = 0
[pid  4290] <... getpid resumed>)       = 4290
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4305] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs" <unfinished ...>
[pid  4290] mmap(0x1b2fe20000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4305] <... symlinkat resumed>)    = 0
[pid  4290] <... mmap resumed>)         = 0x1b2fe20000
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4290] getpid()                    = 4290
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4290] mmap(0x1b30e24000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4305] close(249 <unfinished ...>
[pid  4290] <... mmap resumed>)         = 0x1b30e24000
[pid  4305] <... close resumed>)        = 0
[pid  4290] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4305] close(248 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4305] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4305] prctl(PR_SET_NAME, "syz.1.8" <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4290] <... close resumed>)        = 0
[pid  4305] <... prctl resumed>)        = 0
[pid  4290] fcntl(5, F_GETFD <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4290] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4290] fcntl(6, F_GETFD <unfinished ...>
[pid  4305] mmap(0x1b31b64000, 6029312, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0x40000 <unfinished ...>
[pid  4290] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4290] dup2(0, 249 <unfinished ...>
[pid  4305] <... mmap resumed>)         = 0x1b31b64000
[pid  4290] <... dup2 resumed>)         = 249
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4290] dup2(1, 248)                = 248
[pid  4290] dup2(2, 1)                  = 1
[pid  4290] dup2(2, 0)                  = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4305] close(4 <unfinished ...>
[pid  4290] read(249, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\x38\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4290] unshare(CLONE_NEWPID <unfinished ...>
[pid  4305] <... close resumed>)        = 0
[pid  4290] <... unshare resumed>)      = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4290] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4290] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4305] futex(0x7f66a6fb5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4305] <... futex resumed>)        = 0
/strace: Process 4307 attached
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] close(5 <unfinished ...>
[pid  4307] set_robust_list(0x555579e1c7e0, 24 <unfinished ...>
[pid  4305] rt_sigaction(SIGRT_1, {sa_handler=0x7f66a6d5c3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f66a6cde1d0} <unfinished ...>
[pid  4290] <... clone resumed>, child_tidptr=0x555579e1c7d0) = 4307
[pid  4058] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... set_robust_list resumed>) = 0
[pid  4305] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4058] sendto(3, [{nlmsg_len=104, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x03\x00\x69\x70\x76\x6c\x61\x6e\x31\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x24\x00\x12\x00\x0a\x00\x01\x00\x69\x70\x76\x6c\x61\x6e\x00\x00\x14\x00\x02\x00\x06\x00\x01\x00\x02\x00\x00\x00\x06\x00\x02\x00\x02\x00\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00"], 104, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4307] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4305] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4290] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4305] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4290] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4307] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4305] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... prctl resumed>)        = 0
[pid  4305] <... mmap resumed>)         = 0x7f66a576f000
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] getppid( <unfinished ...>
[pid  4305] mprotect(0x7f66a5770000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... getppid resumed>)      = 0
[pid  4305] <... mprotect resumed>)     = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4305] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4305] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4305] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f66a578f990, parent_tid=0x7f66a578f990, exit_signal=0, stack=0x7f66a576f000, stack_size=0x201c0, tls=0x7f66a578f6c0}/strace: Process 4310 attached
 <unfinished ...>
[pid  4307] <... openat resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4310] set_robust_list(0x7f66a578f9a0, 24 <unfinished ...>
[pid  4307] dup2(3, 201 <unfinished ...>
[pid  4305] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... dup2 resumed>)         = 201
[pid  4305] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4310] <... set_robust_list resumed>) = 0
[pid  4307] close(3 <unfinished ...>
[pid  4305] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... close resumed>)        = 0
[pid  4305] futex(0x7f66a6fb5fa8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid  4307] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024}, NULL) = 0
[pid  4307] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  4307] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024} <unfinished ...>
[pid  4305] futex(0x7f66a6fb5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4307] <... prlimit64 resumed>, NULL) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... prlimit64 resumed>, NULL) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4310] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4307] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} <unfinished ...>
[pid  4310] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4307] <... prlimit64 resumed>, NULL) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4310] ioctl(216, KCOV_ENABLE, 0 <unfinished ...>
[pid  4307] <... prlimit64 resumed>, NULL) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4310] <... ioctl resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4310] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4310] <... mmap resumed>)         = 0x1ffffffff000
[pid  4307] unshare(CLONE_NEWNS <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4310] futex(0x7f66a6fb5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4310] <... futex resumed>)        = 1
[pid  4310] futex(0x7f66a6fb5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4307] <... unshare resumed>)      = 0
[pid  4305] <... futex resumed>)        = 0
[pid  4058] <... sendto resumed>)       = 104
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] recvfrom(3, [{nlmsg_len=124, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=104, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x03\x00\x69\x70\x76\x6c\x61\x6e\x31\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x24\x00\x12\x00\x0a\x00\x01\x00\x69\x70\x76\x6c\x61\x6e\x00\x00\x14\x00\x02\x00\x06\x00\x01\x00\x02\x00\x00\x00\x06\x00\x02\x00\x02\x00\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 124
[pid  4307] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4305] futex(0x7f66a6fb5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4310] <... futex resumed>)        = 0
[pid  4307] <... mount resumed>)        = 0
[pid  4305] <... futex resumed>)        = 1
[pid  4058] sendto(3, [{nlmsg_len=140, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00\x03\x00\x76\x65\x74\x68\x30\x5f\x6d\x61\x63\x76\x74\x61\x70\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00\x03\x00\x76\x65\x74\x68\x31\x5f\x6d\x61"...], 140, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4310] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4307] unshare(CLONE_NEWIPC <unfinished ...>
[pid  4305] futex(0x7f66a6fb5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4310] <... mmap resumed>)         = 0x200000000000
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4310] futex(0x7f66a6fb5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4310] <... futex resumed>)        = 0
[pid  4310] futex(0x7f66a6fb5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... unshare resumed>)      = 0
[pid  4305] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4307] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... unshare resumed>)      = 0
[pid  4305] futex(0x7f66a6fb5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] unshare(CLONE_NEWUTS <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... unshare resumed>)      = 0
[pid  4310] <... futex resumed>)        = 0
[pid  4307] unshare(CLONE_SYSVSEM <unfinished ...>
[pid  4305] <... futex resumed>)        = 1
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... unshare resumed>)      = 0
[pid  4310] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4305] futex(0x7f66a6fb5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4310] <... mmap resumed>)         = 0x200001000000
[pid  4307] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4310] futex(0x7f66a6fb5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4310] <... futex resumed>)        = 1
[pid  4305] <... futex resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4310] futex(0x7f66a6fb5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] write(3, "16777216", 8 <unfinished ...>
[pid  4305] close_range(3, 30, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... write resumed>)        = 8
[pid  4305] <... close_range resumed>)  = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] close(3 <unfinished ...>
[pid  4305] exit_group(0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4310] <... futex resumed>)        = ?
[pid  4305] <... exit_group resumed>)   = ?
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4310] +++ exited with 0 +++
[pid  4307] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] write(3, "536870912", 9 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... write resumed>)        = 9
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... openat resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] write(3, "1024", 4 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... write resumed>)        = 4
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... openat resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] write(3, "8192", 4 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... write resumed>)        = 4
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... openat resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] write(3, "1024", 4 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... write resumed>)        = 4
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] write(3, "1024", 4 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... write resumed>)        = 4
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4305] +++ exited with 0 +++
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... openat resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] write(3, "1024 1048576 500 1024", 21) = 21
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] getpid( <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] <... rt_sigreturn resumed>) = -1 EINTR (Interrupted system call)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... getpid resumed>)       = 1
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] <... write resumed>)        = 4
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4211] fstat(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4211] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... capset resumed>)       = 0
[pid  4211] getdents64(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] unshare(CLONE_NEWNET <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] <... getdents64 resumed>, 0x555576df48c0 /* 6 entries */, 32768) = 176
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] unlink("./0/binderfs" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] <... unlink resumed>)       = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] newfstatat(AT_FDCWD, "./0/cgroup.net" <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4211] unlink("./0/cgroup.net" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] <... unlink resumed>)       = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] newfstatat(AT_FDCWD, "./0/cgroup.cpu" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] unlink("./0/cgroup.cpu" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] <... unlink resumed>)       = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4058] <... sendto resumed>)       = 140
[pid  4058] recvfrom(3, [{nlmsg_len=160, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=140, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00\x03\x00\x76\x65\x74\x68\x30\x5f\x6d\x61\x63\x76\x74\x61\x70\x00\x00\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x48\x00\x12\x00\x08\x00\x01\x00\x76\x65\x74\x68\x3c\x00\x02\x00\x38\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00\x03\x00\x76\x65\x74\x68\x31\x5f\x6d\x61"...]}], 4096, 0, NULL, NULL) = 160
[pid  4307] <... unshare resumed>)      = 0
[pid  4211] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] newfstatat(AT_FDCWD, "./0/cgroup" <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4058] <... socket resumed>)       = 5
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] unlink("./0/cgroup" <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="veth0_macvtap" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4211] <... unlink resumed>)       = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... openat resumed>)       = 3
[pid  4211] getdents64(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] <... getdents64 resumed>, 0x555576df48c0 /* 0 entries */, 32768) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] write(3, "0 65535", 7 <unfinished ...>
[pid  4211] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... write resumed>)        = 7
[pid  4211] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] close(3 <unfinished ...>
[pid  4211] unlinkat(AT_FDCWD, "./0", AT_REMOVEDIR <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... close resumed>)        = 0
[pid  4211] <... unlinkat resumed>)     = 0
[pid  4211] mkdirat(AT_FDCWD, "./1", 0777 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] write(3, "100000", 6 <unfinished ...>
[pid  4211] openat(AT_FDCWD, "/dev/loop1", O_RDWR <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... write resumed>)        = 6
[pid  4211] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] close(3 <unfinished ...>
[pid  4211] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... close resumed>)        = 0
[pid  4211] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] mkdirat(AT_FDCWD, "./syz-tmp", 0777 <unfinished ...>
[pid  4211] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... mkdirat resumed>)      = 0
[pid  4211] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] <... socket resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] mount("", "./syz-tmp", "tmpfs", 0, NULL <unfinished ...>
[pid  4211] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... mount resumed>)        = 0
[pid  4211] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] mkdirat(AT_FDCWD, "./syz-tmp/newroot", 0777 <unfinished ...>
[pid  4211] <... socket resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... mkdirat resumed>)      = 0
[pid  4211] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] mkdirat(AT_FDCWD, "./syz-tmp/newroot/dev", 0700 <unfinished ...>
[pid  4211] <... socket resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... mkdirat resumed>)      = 0
[pid  4307] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4211] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... mount resumed>)        = 0
[pid  4211] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] <... socket resumed>)       = 3
[pid  4307] mkdirat(AT_FDCWD, "./syz-tmp/newroot/proc", 0700 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4211] close(3)                    = 0
[pid  4211] read(249 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... mount resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] mkdirat(AT_FDCWD, "./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... mount resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... mkdirat resumed>)      = 0
[pid  4307] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... mount resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] close(5 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4307] <... mount resumed>)        = 0
[pid  4058] sendto(3, [{nlmsg_len=84, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x03\x00\x6d\x61\x63\x76\x74\x61\x70\x30\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x0b\x00\x01\x00\x6d\x61\x63\x76\x74\x61\x70\x00\x08\x00\x05\x00\x00\x00\x00\x00"], 84, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid  4307] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... mount resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... mkdirat resumed>)      = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... mkdirat resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... mkdirat resumed>)      = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... mount resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... mount resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... mount resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... mkdirat resumed>)      = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... pivot_root resumed>)   = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] chdir("/" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... chdir resumed>)        = 0
[pid  4307] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... umount2 resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] chroot("./newroot" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... chroot resumed>)       = 0
[pid  4307] chdir("/" <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... chdir resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4307] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... sendto resumed>)       = 84
[pid  4058] recvfrom(3, [{nlmsg_len=104, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=84, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x03\x00\x6d\x61\x63\x76\x74\x61\x70\x30\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x0b\x00\x01\x00\x6d\x61\x63\x76\x74\x61\x70\x00\x08\x00\x05\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 104
[pid  4307] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] mkdirat(AT_FDCWD, "/dev/binderfs", 0777 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4307] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="veth1_macvtap" <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f809d8bf000
[pid  4041] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4041] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7f809d8bf000, stack_size=0x9000}, 88/strace: Process 4323 attached
 <unfinished ...>
[pid  4323] rt_sigprocmask(SIG_BLOCK, NULL, ~[KILL STOP], 8) = 0
[pid  4323] setpgid(0, 0)               = 0
[pid  4323] dup2(10, 0 <unfinished ...>
[pid  4307] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4323] <... dup2 resumed>)         = 0
[pid  4307] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 ENOENT (No such file or directory)
[pid  4323] dup2(34, 1 <unfinished ...>
[pid  4307] getpid()                    = 1
[pid  4307] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz0", 0777) = -1 EEXIST (File exists)
[pid  4323] <... dup2 resumed>)         = 1
[pid  4307] openat(AT_FDCWD, "/syzcgroup/unified/syz0/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4323] dup2(37, 2 <unfinished ...>
[pid  4307] <... openat resumed>)       = 3
[pid  4307] write(3, "32", 2)           = 2
[pid  4323] <... dup2 resumed>)         = 2
[pid  4307] close(3)                    = 0
[pid  4307] openat(AT_FDCWD, "/syzcgroup/unified/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3
[pid  4307] write(3, "1", 1 <unfinished ...>
[pid  4323] dup2(14, 3)                 = 3
[pid  4323] dup2(17, 4 <unfinished ...>
[pid  4307] <... write resumed>)        = 1
[pid  4323] <... dup2 resumed>)         = 4
[pid  4307] close(3 <unfinished ...>
[pid  4323] close(5)                    = 0
[pid  4307] <... close resumed>)        = 0
[pid  4323] close(6 <unfinished ...>
[pid  4307] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz0", 0777 <unfinished ...>
[pid  4323] <... close resumed>)        = 0
[pid  4323] close(7 <unfinished ...>
[pid  4307] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4323] <... close resumed>)        = 0
[pid  4307] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4323] close(8 <unfinished ...>
[pid  4307] <... openat resumed>)       = 3
[pid  4307] write(3, "1", 1 <unfinished ...>
[pid  4323] <... close resumed>)        = 0
[pid  4307] <... write resumed>)        = 1
[pid  4323] close(9 <unfinished ...>
[pid  4307] close(3 <unfinished ...>
[pid  4323] <... close resumed>)        = 0
[pid  4307] <... close resumed>)        = 0
[pid  4307] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4323] close(10)                   = 0
[pid  4307] <... openat resumed>)       = 3
[pid  4323] close(11 <unfinished ...>
[pid  4307] write(3, "313524224", 9 <unfinished ...>
[pid  4323] <... close resumed>)        = 0
[pid  4323] close(12 <unfinished ...>
[pid  4307] <... write resumed>)        = 9
[pid  4307] close(3)                    = 0
[pid  4307] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4323] <... close resumed>)        = 0
[pid  4307] <... openat resumed>)       = 3
[pid  4323] close(13 <unfinished ...>
[pid  4307] write(3, "314572800", 9)    = 9
[pid  4307] close(3 <unfinished ...>
[pid  4323] <... close resumed>)        = 0
[pid  4307] <... close resumed>)        = 0
[pid  4307] mkdirat(AT_FDCWD, "/syzcgroup/net/syz0", 0777) = -1 EEXIST (File exists)
[pid  4307] openat(AT_FDCWD, "/syzcgroup/net/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3
[pid  4307] write(3, "1", 1)            = 1
[pid  4307] close(3 <unfinished ...>
[pid  4323] close(14 <unfinished ...>
[pid  4307] <... close resumed>)        = 0
[pid  4307] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4323] <... close resumed>)        = 0
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4323] close(15 <unfinished ...>
[pid  4307] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4323] <... close resumed>)        = 0
[pid  4307] <... getsockopt resumed>, 0x7f46a0eb73e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] <... close resumed>)        = 0
[pid  4323] close(16 <unfinished ...>
[pid  4307] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=84, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x03\x00\x6d\x61\x63\x73\x65\x63\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x0a\x00\x01\x00\x6d\x61\x63\x73\x65\x63\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00"], 84, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4323] <... close resumed>)        = 0
[pid  4307] <... getsockopt resumed>, 0x7f46a0eb7a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4032] <... epoll_pwait resumed>, [], 128, 596, NULL, 0) = 0
[pid  4031] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4323] close(17 <unfinished ...>
[pid  4307] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4032] futex(0x16a7c9157160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4031] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4323] <... close resumed>)        = 0
[pid  4033] <... futex resumed>)        = 0
[pid  4032] <... futex resumed>)        = 1
[pid  4031] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4323] close(18 <unfinished ...>
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4323] <... close resumed>)        = 0
[pid  4307] <... getsockopt resumed>, 0x7f46a0eb80e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4033] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4323] close(19 <unfinished ...>
[pid  4307] close(3 <unfinished ...>
[pid  4033] futex(0x16a7c9157160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4323] <... close resumed>)        = 0
[pid  4307] <... close resumed>)        = 0
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=982422250} <unfinished ...>
[pid  4323] close(20 <unfinished ...>
[pid  4307] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4323] <... close resumed>)        = 0
[pid  4307] <... socket resumed>)       = 3
[pid  4323] close(21 <unfinished ...>
[pid  4307] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4323] <... close resumed>)        = 0
[pid  4307] <... getsockopt resumed>, 0x7f46a0eb8768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4323] close(22 <unfinished ...>
[pid  4307] close(3 <unfinished ...>
[pid  4323] <... close resumed>)        = 0
[pid  4307] <... close resumed>)        = 0
[pid  4323] close(23)                   = 0
[pid  4323] close(24)                   = 0
[pid  4323] close(25)                   = 0
[pid  4307] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4323] close(26 <unfinished ...>
[pid  4307] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4323] <... close resumed>)        = 0
[pid  4307] <... getsockopt resumed>, 0x7f46a0ebafc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4323] close(27 <unfinished ...>
[pid  4307] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4323] <... close resumed>)        = 0
[pid  4323] close(28)                   = 0
[pid  4307] <... getsockopt resumed>, 0x7f46a0ebb688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4323] close(29 <unfinished ...>
[pid  4307] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4323] <... close resumed>)        = 0
[pid  4307] <... getsockopt resumed>, 0x7f46a0ebbd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4323] close(30 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 84
[pid  4323] <... close resumed>)        = 0
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4307] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4323] close(31 <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=104, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=84, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x03\x00\x6d\x61\x63\x73\x65\x63\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x10\x00\x12\x00\x0a\x00\x01\x00\x6d\x61\x63\x73\x65\x63\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 104
[pid  4323] <... close resumed>)        = 0
[pid  4307] <... getsockopt resumed>, 0x7f46a0ebc408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4323] close(32)                   = 0
[pid  4323] close(33)                   = 0
[pid  4323] close(34)                   = 0
[pid  4323] close(35)                   = 0
[pid  4323] close(36)                   = 0
[pid  4323] close(37)                   = 0
[pid  4323] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4323] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4323] close(39)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(40)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(44)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(45)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(46)                   = -1 EBADF (Bad file descriptor)
[pid  4307] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=96, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x03\x00\x67\x65\x6e\x65\x76\x65\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x24\x00\x12\x00\x0a\x00\x01\x00\x67\x65\x6e\x65\x76\x65\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x00\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\x18"], 96, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4323] close(47 <unfinished ...>
[pid  4307] <... getsockopt resumed>, 0x7f46a0ebcac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4307] close(3 <unfinished ...>
[pid  4323] close(48 <unfinished ...>
[pid  4307] <... close resumed>)        = 0
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4307] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4323] close(49)                   = -1 EBADF (Bad file descriptor)
[pid  4307] <... socket resumed>)       = 3
[pid  4323] close(50 <unfinished ...>
[pid  4307] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4307] <... getsockopt resumed>, 0x7f46a0eb8e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4323] close(51 <unfinished ...>
[pid  4307] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4307] <... getsockopt resumed>, 0x7f46a0eb94c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4323] close(52 <unfinished ...>
[pid  4307] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4307] <... getsockopt resumed>, 0x7f46a0eb9b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4323] close(53 <unfinished ...>
[pid  4307] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4307] <... getsockopt resumed>, 0x7f46a0eba248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4323] close(54 <unfinished ...>
[pid  4307] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO, 0x7f46a0eba908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(55 <unfinished ...>
[pid  4307] close(3 <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4307] <... close resumed>)        = 0
[pid  4323] close(56 <unfinished ...>
[pid  4307] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(57)                   = -1 EBADF (Bad file descriptor)
[pid  4307] <... write resumed>)        = 4
[pid  4323] close(58 <unfinished ...>
[pid  4307] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4307] <... mkdirat resumed>)      = 0
[pid  4323] close(59)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(60)                   = -1 EBADF (Bad file descriptor)
[pid  4307] openat(AT_FDCWD, "/dev/loop0", O_RDWR <unfinished ...>
[pid  4323] close(61 <unfinished ...>
[pid  4307] <... openat resumed>)       = 3
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4307] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4323] close(62)                   = -1 EBADF (Bad file descriptor)
[pid  4307] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4323] close(63 <unfinished ...>
[pid  4307] close(3 <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4307] <... close resumed>)        = 0
[pid  4323] close(64)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(65)                   = -1 EBADF (Bad file descriptor)
[pid  4307] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4323] close(66 <unfinished ...>
[pid  4307] <... socket resumed>)       = 3
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(67)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(68)                   = -1 EBADF (Bad file descriptor)
[pid  4307] close(3 <unfinished ...>
[pid  4323] close(69 <unfinished ...>
[pid  4307] <... close resumed>)        = 0
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4307] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4323] close(70 <unfinished ...>
[pid  4307] <... socket resumed>)       = 3
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(71)                   = -1 EBADF (Bad file descriptor)
[pid  4307] close(3 <unfinished ...>
[pid  4323] close(72)                   = -1 EBADF (Bad file descriptor)
[pid  4307] <... close resumed>)        = 0
[pid  4323] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(75)                   = -1 EBADF (Bad file descriptor)
[pid  4307] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4323] close(76 <unfinished ...>
[pid  4307] <... socket resumed>)       = 3
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4307] close(3 <unfinished ...>
[pid  4323] close(77 <unfinished ...>
[pid  4307] <... close resumed>)        = 0
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4307] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4323] close(78 <unfinished ...>
[pid  4307] <... socket resumed>)       = 3
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4307] close(3 <unfinished ...>
[pid  4323] close(79 <unfinished ...>
[pid  4307] <... close resumed>)        = 0
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4307] read(249 <unfinished ...>
[pid  4323] close(80)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(81)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(82)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(84)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(85)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(86)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(87)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(88)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(89)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(90)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(92)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(93)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(94)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(95)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(96)                   = -1 EBADF (Bad file descriptor)
[pid  4323] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... sendto resumed>)       = 96
[pid  4323] close(98 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(99 <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=116, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=96, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x03\x00\x67\x65\x6e\x65\x76\x65\x30\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x24\x00\x12\x00\x0a\x00\x01\x00\x67\x65\x6e\x65\x76\x65\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x00\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\x18"]}], 4096, 0, NULL, NULL) = 116
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(100 <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=108, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x03\x00\x67\x65\x6e\x65\x76\x65\x31\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x30\x00\x12\x00\x0a\x00\x01\x00\x67\x65\x6e\x65\x76\x65\x00\x00\x20\x00\x02\x00\x08\x00\x01\x00\x01\x00\x00\x00\x14\x00\x07\x00\xfc\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01"], 108, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(102)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(104)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(106)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(110)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... sendto resumed>)       = 108
[pid  4323] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4058] recvfrom(3, [{nlmsg_len=128, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=108, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x03\x00\x67\x65\x6e\x65\x76\x65\x31\x00\x08\x00\x1f\x00\x02\x00\x00\x00\x08\x00\x20\x00\x02\x00\x00\x00\x30\x00\x12\x00\x0a\x00\x01\x00\x67\x65\x6e\x65\x76\x65\x00\x00\x20\x00\x02\x00\x08\x00\x01\x00\x01\x00\x00\x00\x14\x00\x07\x00\xfc\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01"]}], 4096, 0, NULL, NULL) = 128
[pid  4323] close(118 <unfinished ...>
[pid  4058] openat(AT_FDCWD, "/sys/bus/netdevsim/del_device", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid  4323] close(119 <unfinished ...>
[pid  4058] openat(AT_FDCWD, "/sys/bus/netdevsim/new_device", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(120 <unfinished ...>
[pid  4058] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid  4058] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(121 <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] sendto(5, [{nlmsg_len=36, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0e\x00\x02\x00\x77\x69\x72\x65\x67\x75\x61\x72\x64\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4323] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(127 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 36
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(129)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(130 <unfinished ...>
[pid  4058] recvfrom(5 <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=56, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENOENT, msg=[{nlmsg_len=36, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0e\x00\x02\x00\x77\x69\x72\x65\x67\x75\x61\x72\x64\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 56
[pid  4323] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(134)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(135)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(142)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4058] close(5 <unfinished ...>
[pid  4323] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(154 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(155 <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(157 <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(158 <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="lo" <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(159 <unfinished ...>
[pid  4058] <... ioctl resumed>, ifr_ifindex=1}) = 0
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4058] close(5 <unfinished ...>
[pid  4323] close(163)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4323] close(164 <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x01\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\x0a\x08\x00\x01\x00\xac\x14\x14\x0a"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... sendto resumed>)       = 40
[pid  4323] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4323] close(168 <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4323] close(169 <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="lo" <unfinished ...>
[pid  4323] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... ioctl resumed>, ifr_ifindex=1}) = 0
[pid  4323] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4058] close(5 <unfinished ...>
[pid  4323] close(173 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x01\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4323] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(178 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 64
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4323] close(179 <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(180 <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... socket resumed>)       = 5
[pid  4323] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="lo" <unfinished ...>
[pid  4323] close(182)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... ioctl resumed>, ifr_ifindex=1}) = 0
[pid  4323] close(183 <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(184 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(185)                  = -1 EBADF (Bad file descriptor)
[pid  4058] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\x0a\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4323] close(186)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(188)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... sendto resumed>)       = 44
[pid  4323] close(189 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(190 <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(191)                  = -1 EBADF (Bad file descriptor)
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4323] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... socket resumed>)       = 5
[pid  4323] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(194)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(195)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(196 <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="sit0" <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... ioctl resumed>, ifr_ifindex=2}) = 0
[pid  4323] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4058] close(5 <unfinished ...>
[pid  4323] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(200)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4323] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4058] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x02\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\x0b\x08\x00\x01\x00\xac\x14\x14\x0b"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4323] close(202)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... sendto resumed>)       = 40
[pid  4323] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4323] close(204 <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4323] close(205 <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(206)                  = -1 EBADF (Bad file descriptor)
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="sit0" <unfinished ...>
[pid  4323] close(207 <unfinished ...>
[pid  4058] <... ioctl resumed>, ifr_ifindex=2}) = 0
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(208 <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4323] close(209)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(210)                  = -1 EBADF (Bad file descriptor)
[pid  4058] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x02\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4323] close(211)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(213)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(214 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 64
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(215 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(216 <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4323] close(217 <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(218 <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="sit0" <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... ioctl resumed>, ifr_ifindex=2}) = 0
[pid  4323] close(219)                  = -1 EBADF (Bad file descriptor)
[pid  4058] close(5 <unfinished ...>
[pid  4323] close(220 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(223 <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x02\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(224 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 32
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(225 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  4323] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4323] close(227 <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(228 <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="bridge0" <unfinished ...>
[pid  4323] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4323] close(229)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(230)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(231)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(232)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(233)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(234)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(235)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(236)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(237)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(240)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(241)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(244)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(245)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(246)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(247)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(248)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(251)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(252)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(253)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4323] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4323] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4323] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffc25fc6ad0 /* 2 vars */ <unfinished ...>
[pid  4041] <... clone3 resumed>)       = 4323
[pid  4041] munmap(0x7f809d8bf000, 36864 <unfinished ...>
[pid  4323] <... execve resumed>)       = 0
[pid  4041] <... munmap resumed>)       = 0
[pid  4041] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4041] fcntl(28, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4041] fcntl(28, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4041] fcntl(35, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4041] fcntl(35, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4041] close(10)                   = 0
[pid  4041] close(34)                   = 0
[pid  4041] close(37)                   = 0
[pid  4041] close(15)                   = 0
[pid  4041] close(16)                   = 0
[pid  4041] close(25)                   = 0
[pid  4041] write(26, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\xb8\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4041] pselect6(37, [3 13 20 23 28 29 31 32 33 35 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8}) = 4 (in [13 20 23 32], left {tv_sec=0, tv_nsec=999981611})
[pid  4041] read(32, "\x00\x00\x00\x00", 4) = 4
[pid  4041] write(3, "\x2c\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x0e\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x00\x00\x06\x00\x0c\x00\x04\x00\x06\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4323] brk(NULL <unfinished ...>
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] write(21, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4032] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fa8a7c277000002}], 128, 983, NULL, 0) = 1
[pid  4323] <... brk resumed>)          = 0x5555862f6000
[pid  4307] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4041] <... write resumed>)        = 48
[pid  4323] brk(0x5555862f6e80 <unfinished ...>
[pid  4307] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4041] read(13 <unfinished ...>
[pid  4323] <... brk resumed>)          = 0x5555862f6e80
[pid  4307] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4041] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4323] arch_prctl(ARCH_SET_FS, 0x5555862f6500 <unfinished ...>
[pid  4307] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4041] write(3, "\xe4\x4f\x02\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x01\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x14\x00\x00\x00"..., 151528 <unfinished ...>
[pid  4032] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4323] <... arch_prctl resumed>)   = 0
[pid  4031] <... futex resumed>)        = 0
[pid  4032] <... futex resumed>)        = 1
[pid  4323] set_tid_address(0x5555862f67d0 <unfinished ...>
[pid  4031] sched_yield( <unfinished ...>
[pid  4032] read(6 <unfinished ...>
[pid  4323] <... set_tid_address resumed>) = 4323
[pid  4058] <... close resumed>)        = 0
[pid  4041] <... write resumed>)        = 151528
[pid  4032] <... read resumed>, "\x2c\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x0e\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x00\x00\x06\x00\x0c\x00\x04\x00\x06\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00", 21347228) = 48
[pid  4031] <... sched_yield resumed>)  = 0
[pid  4058] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x00\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\x0c\x08\x00\x01\x00\xac\x14\x14\x0c"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12/strace: Process 4352 attached
 <unfinished ...>
[pid  4323] set_robust_list(0x5555862f67e0, 24 <unfinished ...>
[pid  4041] kill(4175, SIGKILL <unfinished ...>
[pid  4032] read(6 <unfinished ...>
[pid  4352] set_robust_list(0x555579e1c7e0, 24 <unfinished ...>
[pid  4323] <... set_robust_list resumed>) = 0
[pid  4307] <... clone resumed>, child_tidptr=0x555579e1c7d0) = 2
[pid  4058] <... sendto resumed>)       = 40
[pid  4041] <... kill resumed>)         = 0
[pid  4352] <... set_robust_list resumed>) = 0
[pid  4323] prlimit64(0, RLIMIT_STACK, NULL <unfinished ...>
[pid  4307] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4032] <... read resumed>, "\xe4\x4f\x02\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x01\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x14\x00\x00\x00"..., 21347228) = 151528
[pid  4323] <... prlimit64 resumed>, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4031] epoll_pwait(4 <unfinished ...>
[pid  4323] readlinkat(AT_FDCWD, "/proc/self/exe" <unfinished ...>
[pid  4031] <... epoll_pwait resumed>, [{events=EPOLLOUT, data=0x3fa8a7c277000002}], 128, 0, NULL, 0) = 1
[pid  4352] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4323] <... readlinkat resumed>, "/syz-executor", 4096) = 13
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4032] futex(0x16a7c9157160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4031] getpid( <unfinished ...>
[pid  4323] getrandom("\x78\x4e\x3e\x23\xfc\x9c\xd9\x2d", 8, GRND_NONBLOCK) = 8
[pid  4307] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4323] brk(NULL <unfinished ...>
[pid  4031] <... getpid resumed>)       = 4030
[pid  4352] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x00\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\x0c\x08\x00\x01\x00\xac\x14\x14\x0c"]}], 4096, 0, NULL, NULL) = 60
[pid  4033] <... futex resumed>)        = 0
[pid  4032] <... futex resumed>)        = 1
[pid  4352] chdir("./0" <unfinished ...>
[pid  4323] <... brk resumed>)          = 0x5555862f6e80
[pid  4211] <... read resumed> <unfinished ...>) = ?
[pid  4175] +++ killed by SIGKILL +++
[pid  4031] tgkill(4030, 4032, SIGURG <unfinished ...>
[pid  4352] <... chdir resumed>)        = 0
[pid  4323] brk(0x555586317e80 <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4323] <... brk resumed>)          = 0x555586317e80
[pid  4041] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4175, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=10 /* 0.10 s */} ---
[pid  4323] brk(0x555586318000 <unfinished ...>
[pid  4041] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4352] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4323] <... brk resumed>)          = 0x555586318000
[pid  4058] <... socket resumed>)       = 5
[pid  4041] <... rt_sigreturn resumed>) = 4175
[pid  4032] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4031] <... tgkill resumed>)       = 0
[pid  4352] <... prctl resumed>)        = 0
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="bridge0" <unfinished ...>
[pid  4032] --- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=4030, si_uid=0} ---
[pid  4352] setpgid(0, 0 <unfinished ...>
[pid  4323] mprotect(0x7f6a980e9000, 1236992, PROT_READ <unfinished ...>
[pid  4041] pipe2( <unfinished ...>
[pid  4033] read(6 <unfinished ...>
[pid  4323] <... mprotect resumed>)     = 0
[pid  4041] <... pipe2 resumed>[10, 15], 0) = 0
[pid  4041] pipe2([16, 25], 0)          = 0
[pid  4041] pipe2([34, 37], 0)          = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4352] <... setpgid resumed>)      = 0
[pid  4323] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4032] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4352] symlinkat("/syzcgroup/unified/syz0", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4032] <... rt_sigreturn resumed>) = 0
[pid  4323] <... prctl resumed>)        = 0
[pid  4323] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4033] <... read resumed>, 0x16a7cd080000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4031] epoll_pwait(4 <unfinished ...>
[pid  4352] <... symlinkat resumed>)    = 0
[pid  4323] <... mmap resumed>)         = 0x1ffffffff000
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4352] symlinkat("/syzcgroup/cpu/syz0", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4323] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4032] futex(0x16a7c9156960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4031] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4323] <... mmap resumed>)         = 0x200000000000
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4352] <... symlinkat resumed>)    = 0
[pid  4323] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4352] symlinkat("/syzcgroup/net/syz0", AT_FDCWD, "./cgroup.net" <unfinished ...>
[pid  4323] <... mmap resumed>)         = 0x200001000000
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4323] rt_sigaction(SIGCHLD, {sa_handler=0x7f6a97e80780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f6a97f6e1d0} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=9373968} <unfinished ...>
[pid  4323] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4323] pkey_alloc(0, PKEY_UNRESTRICTED <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4323] <... pkey_alloc resumed>)   = -1 EINVAL (Invalid argument)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4323] getrandom( <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4323] <... getrandom resumed>"\xb2\xf9\x51\xfb\xdb\x3f\x14\x36", 8, GRND_NONBLOCK) = 8
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4352] <... symlinkat resumed>)    = 0
[pid  4323] mkdir("./syzkaller.wyd2XN", 0700 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4323] <... mkdir resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4352] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4352] <... openat resumed>)       = 3
[pid  4323] chmod("./syzkaller.wyd2XN", 0777 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4323] <... chmod resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4323] chdir("./syzkaller.wyd2XN" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4352] write(3, "1000", 4 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4352] <... write resumed>)        = 4
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4352] close(3 <unfinished ...>
[pid  4323] <... chdir resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4352] <... close resumed>)        = 0
[pid  4323] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4352] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs" <unfinished ...>
[pid  4323] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4033] <... epoll_pwait resumed>, [], 128, 12, NULL, 0) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4323] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4323] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4352] <... symlinkat resumed>)    = 0
[pid  4031] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4323] rt_sigaction(SIGSEGV, {sa_handler=0x7f6a97e82b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f6a97f6e1d0} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4323] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4323] rt_sigaction(SIGBUS, {sa_handler=0x7f6a97e82b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f6a97f6e1d0} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4352] close(249 <unfinished ...>
[pid  4323] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4352] <... close resumed>)        = 0
[pid  4323] getpid( <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4352] close(248 <unfinished ...>
[pid  4323] <... getpid resumed>)       = 4323
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4352] <... close resumed>)        = 0
[pid  4323] mmap(0x1b31f20000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4323] <... mmap resumed>)         = 0x1b31f20000
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4323] getpid( <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4323] <... getpid resumed>)       = 4323
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4323] mmap(0x1b32f24000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4352] prctl(PR_SET_NAME, "syz.0.11" <unfinished ...>
[pid  4323] <... mmap resumed>)         = 0x1b32f24000
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4033] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4352] <... prctl resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4352] close(4 <unfinished ...>
[pid  4323] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4033] futex(0x16a7c9156960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4352] <... close resumed>)        = 0
[pid  4323] <... close resumed>)        = 0
[pid  4323] fcntl(5, F_GETFD <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4323] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4323] fcntl(6, F_GETFD <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4323] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4323] dup2(0, 249 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4323] <... dup2 resumed>)         = 249
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4323] dup2(1, 248 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4323] <... dup2 resumed>)         = 248
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4323] dup2(2, 1 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4323] <... dup2 resumed>)         = 1
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4323] dup2(2, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4323] <... dup2 resumed>)         = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4323] read(249 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4323] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\xb8\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4323] unshare(CLONE_NEWPID <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4352] futex(0x7f46a0ee5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4323] <... unshare resumed>)      = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4033] <... futex resumed>)        = 1
[pid  4032] <... futex resumed>)        = 0
[pid  4352] <... futex resumed>)        = 0
[pid  4323] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4352] rt_sigaction(SIGRT_1, {sa_handler=0x7f46a0c8c3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f46a0c0e1d0} <unfinished ...>
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4352] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4323] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4032] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4352] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4323] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4352] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4032] write(5, "\x01\x00\x00\x00\x00\x00\x00\x00", 8/strace: Process 4355 attached
 <unfinished ...>
[pid  4352] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4033] <... epoll_pwait resumed>, [{events=EPOLLIN, data=0x33dbe88}], 128, 53002, NULL, 0) = 1
[pid  4032] <... write resumed>)        = 8
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=983814115} <unfinished ...>
[pid  4352] <... mmap resumed>)         = 0x7f46a0aa7000
[pid  4032] futex(0x16a7c9156960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4033] read(5 <unfinished ...>
[pid  4352] mprotect(0x7f46a0aa8000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4355] set_robust_list(0x5555862f67e0, 24 <unfinished ...>
[pid  4352] <... mprotect resumed>)     = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4033] <... read resumed>, "\x01\x00\x00\x00\x00\x00\x00\x00", 8) = 8
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4352] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4352] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4323] <... clone resumed>, child_tidptr=0x5555862f67d0) = 4355
[pid  4033] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4352] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f46a0ac7990, parent_tid=0x7f46a0ac7990, exit_signal=0, stack=0x7f46a0aa7000, stack_size=0x201c0, tls=0x7f46a0ac76c0} <unfinished ...>
[pid  4323] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL/strace: Process 4356 attached
 <unfinished ...>
[pid  4323] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4355] <... set_robust_list resumed>) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4355] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4355] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4355] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4355] <... socket resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4355] openat(AT_FDCWD, "/dev/vhci", O_RDWR <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4355] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4356] set_robust_list(0x7f46a0ac79a0, 24 <unfinished ...>
[pid  4355] write(2, "SYZFAIL: open /dev/vhci failed\n", 31 <unfinished ...>
[pid  4352] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4355] <... write resumed>)        = 31
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4355] write(2, " (errno 2: No such file or directory)\n", 38 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4355] <... write resumed>)        = 38
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4352] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4356] <... set_robust_list resumed>) = 0
[pid  4355] exit_group(67 <unfinished ...>
[pid  4352] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4356] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4355] <... exit_group resumed>)   = ?
[pid  4356] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4352] futex(0x7f46a0ee5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4356] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4352] <... futex resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4352] futex(0x7f46a0ee5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4356] <... mmap resumed>)         = 0x1ffffffff000
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4355] +++ exited with 67 +++
[pid  4356] futex(0x7f46a0ee5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4323] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4355, si_uid=0, si_status=67, si_utime=0, si_stime=0} ---
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4323] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4352] <... futex resumed>)        = 0
[pid  4356] <... futex resumed>)        = 1
[pid  4323] <... rt_sigreturn resumed>) = 4355
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4323] write(2, "loop exited with status 67\n", 27) = 27
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4323] write(248, "\x43\x00\x00\x00", 4 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4323] <... write resumed>)        = 4
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4356] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4352] futex(0x7f46a0ee5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4323] exit_group(67 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4356] <... mmap resumed>)         = 0x200000000000
[pid  4352] <... futex resumed>)        = 0
[pid  4323] <... exit_group resumed>)   = ?
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4356] futex(0x7f46a0ee5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4352] futex(0x7f46a0ee5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4356] <... futex resumed>)        = 0
[pid  4352] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4356] futex(0x7f46a0ee5fa8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4352] futex(0x7f46a0ee5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4356] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4352] <... futex resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4356] <... mmap resumed>)         = 0x200001000000
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4352] futex(0x7f46a0ee5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4356] futex(0x7f46a0ee5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4352] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4356] <... futex resumed>)        = 0
[pid  4352] close_range(3, 30, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4356] futex(0x7f46a0ee5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4352] <... close_range resumed>)  = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4352] exit_group(0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4356] <... futex resumed>)        = ?
[pid  4352] <... exit_group resumed>)   = ?
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4356] +++ exited with 0 +++
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4352] +++ exited with 0 +++
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... rt_sigreturn resumed>) = -1 EINTR (Interrupted system call)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... write resumed>)        = 4
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4323] +++ exited with 67 +++
[pid  4307] <... openat resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] fstat(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4041] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4323, si_uid=0, si_status=67, si_utime=0, si_stime=4 /* 0.04 s */} ---
[pid  4307] getdents64(3 <unfinished ...>
[pid  4041] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4307] <... getdents64 resumed>, 0x555579e2f8c0 /* 6 entries */, 32768) = 176
[pid  4041] <... rt_sigreturn resumed>) = 0
[pid  4307] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] unlink("./0/binderfs")      = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] newfstatat(AT_FDCWD, "./0/cgroup.net" <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] unlink("./0/cgroup.net" <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... unlink resumed>)       = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4307] newfstatat(AT_FDCWD, "./0/cgroup.cpu" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] unlink("./0/cgroup.cpu" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... unlink resumed>)       = 0
[pid  4307] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4307] newfstatat(AT_FDCWD, "./0/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] unlink("./0/cgroup" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... unlink resumed>)       = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] getdents64(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... getdents64 resumed>, 0x555579e2f8c0 /* 0 entries */, 32768) = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] unlinkat(AT_FDCWD, "./0", AT_REMOVEDIR <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... unlinkat resumed>)     = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] mkdirat(AT_FDCWD, "./1", 0777 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... mkdirat resumed>)      = 0
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] openat(AT_FDCWD, "/dev/loop0", O_RDWR <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... openat resumed>)       = 3
[pid  4058] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x00\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... socket resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] close(3 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 64
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... socket resumed>)       = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] close(3 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=84, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x00\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c"]}], 4096, 0, NULL, NULL) = 84
[pid  4307] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... socket resumed>)       = 3
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] close(3 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] <... close resumed>)        = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... socket resumed>)       = 3
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] close(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4307] <... close resumed>)        = 0
[pid  4058] <... socket resumed>)       = 5
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="bridge0" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4307] read(249 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4211] +++ killed by SIGKILL +++
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] close(5 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\x0c\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... sendto resumed>)       = 44
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] recvfrom(3, [{nlmsg_len=64, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\x0c\x00\x00"]}], 4096, 0, NULL, NULL) = 64
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="vcan0" <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f809d8bf000
[pid  4041] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4041] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7f809d8bf000, stack_size=0x9000}, 88/strace: Process 4366 attached
 <unfinished ...>
[pid  4366] rt_sigprocmask(SIG_BLOCK, NULL, ~[KILL STOP], 8) = 0
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4366] setpgid(0, 0)               = 0
[pid  4058] close(5 <unfinished ...>
[pid  4366] dup2(10, 0)                 = 0
[pid  4366] dup2(25, 1 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4366] <... dup2 resumed>)         = 1
[pid  4366] dup2(37, 2)                 = 2
[pid  4366] dup2(9, 3)                  = 3
[pid  4366] dup2(12, 4)                 = 4
[pid  4366] close(5)                    = 0
[pid  4366] close(6)                    = 0
[pid  4366] close(7)                    = 0
[pid  4058] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x00\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\x0d\x08\x00\x01\x00\xac\x14\x14\x0d"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4366] close(8)                    = 0
[pid  4058] <... sendto resumed>)       = 40
[pid  4366] close(9 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4366] <... close resumed>)        = 0
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x00\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\x0d\x08\x00\x01\x00\xac\x14\x14\x0d"]}], 4096, 0, NULL, NULL) = 60
[pid  4366] close(10 <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
[pid  4366] <... close resumed>)        = 0
[pid  4366] close(11 <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="vcan0" <unfinished ...>
[pid  4366] <... close resumed>)        = 0
[pid  4366] close(12)                   = 0
[pid  4366] close(13)                   = 0
[pid  4366] close(14)                   = 0
[pid  4366] close(15)                   = 0
[pid  4366] close(16)                   = 0
[pid  4366] close(17)                   = 0
[pid  4366] close(18)                   = 0
[pid  4366] close(19)                   = 0
[pid  4366] close(20)                   = 0
[pid  4366] close(21)                   = 0
[pid  4366] close(22)                   = 0
[pid  4366] close(23)                   = 0
[pid  4366] close(24)                   = 0
[pid  4366] close(25)                   = 0
[pid  4366] close(26)                   = 0
[pid  4366] close(27)                   = 0
[pid  4366] close(28)                   = 0
[pid  4366] close(29)                   = 0
[pid  4366] close(30)                   = 0
[pid  4366] close(31)                   = 0
[pid  4366] close(32)                   = 0
[pid  4366] close(33)                   = 0
[pid  4366] close(34)                   = 0
[pid  4366] close(35)                   = 0
[pid  4366] close(36)                   = 0
[pid  4366] close(37)                   = 0
[pid  4366] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4366] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4366] close(39)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(40)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(44)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(45)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(46)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(47)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(48)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(49)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(50)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(51)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(52)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(53)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(54)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(55)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(56)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(57)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(58)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(59)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(60)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(61)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(62)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(63)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(64)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(65)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(66)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(67)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(68)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(70)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(71)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(72)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(75)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(76)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(77)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(79)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(80)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(81)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(82)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(84)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(85)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(86)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(87)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(88)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(89)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(90)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(92)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(93)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(94)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(95)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(96)                   = -1 EBADF (Bad file descriptor)
[pid  4366] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4366] close(98 <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4366] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4366] close(99)                   = -1 EBADF (Bad file descriptor)
[pid  4058] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4366] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(101 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 32
[pid  4366] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4366] close(102)                  = -1 EBADF (Bad file descriptor)
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4366] close(103 <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=52, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 52
[pid  4366] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4366] close(104 <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4366] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4366] close(105 <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4366] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4366] close(106)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(108 <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="tunl0" <unfinished ...>
[pid  4366] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4366] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(110)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(118)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(119)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(120)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(129)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(130)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(134)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(135)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(142)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(154)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(155)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(158)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(163)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(164)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(168)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4366] close(169)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4058] close(5 <unfinished ...>
[pid  4366] close(172 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4366] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4366] close(173 <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x00\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\x0e\x08\x00\x01\x00\xac\x14\x14\x0e"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4366] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4366] close(174 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 40
[pid  4366] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4366] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x00\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\x0e\x08\x00\x01\x00\xac\x14\x14\x0e"]}], 4096, 0, NULL, NULL) = 60
[pid  4366] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4366] close(177 <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4366] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4366] close(178 <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="tunl0" <unfinished ...>
[pid  4366] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4366] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(182)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(183)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(184)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(185)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(186)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(188)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(189)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(190)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(191)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(194)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(195)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(196)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(200)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(202 <unfinished ...>
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4366] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4366] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(204)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(205 <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4366] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4366] close(206 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4366] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4366] close(207)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(208)                  = -1 EBADF (Bad file descriptor)
[pid  4058] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x00\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4366] close(209)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... sendto resumed>)       = 64
[pid  4366] close(210)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(211 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4366] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=84, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x00\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e"]}], 4096, 0, NULL, NULL) = 84
[pid  4366] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4366] close(213)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... socket resumed>)       = 5
[pid  4366] close(214 <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="tunl0" <unfinished ...>
[pid  4366] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4366] close(215)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(216)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(217)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(218)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(219)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(220)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(223)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(224)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(225)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(228)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(229)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(230)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(231)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(232)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(233)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(234)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(235)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(236)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(237)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(240)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(241)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(244)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(245)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(246)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(247)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(248)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(251)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(252)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(253)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4366] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4366] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4366] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffc25fc6af0 /* 2 vars */ <unfinished ...>
[pid  4041] <... clone3 resumed>)       = 4366
[pid  4041] munmap(0x7f809d8bf000, 36864) = 0
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4058] close(5 <unfinished ...>
[pid  4041] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4041] fcntl(16, F_GETFL <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4366] <... execve resumed>)       = 0
[pid  4058] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4041] <... fcntl resumed>)        = 0 (flags O_RDONLY)
[pid  4366] brk(NULL <unfinished ...>
[pid  4058] <... sendto resumed>)       = 32
[pid  4366] <... brk resumed>)          = 0x55555d388000
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4366] brk(0x55555d388e80 <unfinished ...>
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=52, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 52
[pid  4366] <... brk resumed>)          = 0x55555d388e80
[pid  4041] fcntl(16, F_SETFL, O_RDONLY|O_NONBLOCK <unfinished ...>
[pid  4366] arch_prctl(ARCH_SET_FS, 0x55555d388500 <unfinished ...>
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4366] <... arch_prctl resumed>)   = 0
[pid  4058] <... socket resumed>)       = 5
[pid  4366] set_tid_address(0x55555d3887d0 <unfinished ...>
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="gre0" <unfinished ...>
[pid  4366] <... set_tid_address resumed>) = 4366
[pid  4366] set_robust_list(0x55555d3887e0, 24) = 0
[pid  4366] prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4041] <... fcntl resumed>)        = 0
[pid  4366] readlinkat(AT_FDCWD, "/proc/self/exe", "/syz-executor", 4096) = 13
[pid  4041] fcntl(34, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4366] getrandom( <unfinished ...>
[pid  4041] fcntl(34, F_SETFL, O_RDONLY|O_NONBLOCK <unfinished ...>
[pid  4366] <... getrandom resumed>"\xda\x81\x65\x2a\x2d\xe0\x25\x0e", 8, GRND_NONBLOCK) = 8
[pid  4041] <... fcntl resumed>)        = 0
[pid  4366] brk(NULL <unfinished ...>
[pid  4041] close(10 <unfinished ...>
[pid  4366] <... brk resumed>)          = 0x55555d388e80
[pid  4366] brk(0x55555d3a9e80)         = 0x55555d3a9e80
[pid  4366] brk(0x55555d3aa000)         = 0x55555d3aa000
[pid  4366] mprotect(0x7f8833579000, 1236992, PROT_READ <unfinished ...>
[pid  4041] <... close resumed>)        = 0
[pid  4366] <... mprotect resumed>)     = 0
[pid  4041] close(25)                   = 0
[pid  4041] close(37)                   = 0
[pid  4366] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4041] close(11 <unfinished ...>
[pid  4366] <... prctl resumed>)        = 0
[pid  4366] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x1ffffffff000
[pid  4366] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200000000000
[pid  4366] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200001000000
[pid  4366] rt_sigaction(SIGCHLD, {sa_handler=0x7f8833310780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f88333fe1d0}, NULL, 8) = 0
[pid  4366] pkey_alloc(0, PKEY_UNRESTRICTED) = -1 EINVAL (Invalid argument)
[pid  4366] getrandom("\x8e\x07\xcd\xd2\xcb\xdc\x57\x63", 8, GRND_NONBLOCK) = 8
[pid  4366] mkdir("./syzkaller.e1H8pH", 0700 <unfinished ...>
[pid  4041] <... close resumed>)        = 0
[pid  4366] <... mkdir resumed>)        = 0
[pid  4041] close(13)                   = 0
[pid  4366] chmod("./syzkaller.e1H8pH", 0777) = 0
[pid  4041] close(29 <unfinished ...>
[pid  4366] chdir("./syzkaller.e1H8pH") = 0
[pid  4041] <... close resumed>)        = 0
[pid  4366] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4041] write(15, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x20\x38\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64 <unfinished ...>
[pid  4366] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4041] <... write resumed>)        = 64
[pid  4366] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
[pid  4366] rt_sigaction(SIGSEGV, {sa_handler=0x7f8833312b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f88333fe1d0}, NULL, 8) = 0
[pid  4366] rt_sigaction(SIGBUS, {sa_handler=0x7f8833312b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f88333fe1d0}, NULL, 8) = 0
[pid  4366] getpid()                    = 4366
[pid  4366] mmap(0x1b2ca20000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0) = 0x1b2ca20000
[pid  4366] getpid()                    = 4366
[pid  4366] mmap(0x1b2da24000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0) = 0x1b2da24000
[pid  4041] read(23 <unfinished ...>
[pid  4366] close(3 <unfinished ...>
[pid  4041] <... read resumed>, "SYZFAIL: setfilecon: setxattr failed\n (errno 22: Invalid argument)\n", 1024) = 67
[pid  4366] <... close resumed>)        = 0
[pid  4366] fcntl(5, F_GETFD)           = -1 EBADF (Bad file descriptor)
[pid  4366] fcntl(6, F_GETFD <unfinished ...>
[pid  4041] read(20 <unfinished ...>
[pid  4366] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4366] dup2(0, 249)                = 249
[pid  4366] dup2(1, 248)                = 248
[pid  4041] <... read resumed>, "", 4)  = 0
[pid  4366] dup2(2, 1 <unfinished ...>
[pid  4041] kill(4267, SIGKILL <unfinished ...>
[pid  4366] <... dup2 resumed>)         = 1
[pid  4366] dup2(2, 0)                  = 0
[pid  4041] <... kill resumed>)         = 0
[pid  4366] read(249, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x20\x38\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4366] unshare(CLONE_NEWPID)       = 0
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4058] close(5 <unfinished ...>
[pid  4366] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4366] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4058] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x00\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\x0f\x08\x00\x01\x00\xac\x14\x14\x0f"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4366] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4041] read(23 <unfinished ...>
[pid  4058] <... sendto resumed>)       = 40
[pid  4041] <... read resumed>, "", 1024) = 0
[pid  4058] recvfrom(3, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x00\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\x0f\x08\x00\x01\x00\xac\x14\x14\x0f"]}], 4096, 0, NULL, NULL) = 60
/strace: Process 4389 attached
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4041] write(3, "\x0c\x01\x00\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x20\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x10\x00\x10\x00\x00\x00\x05\x00\x00\x00\x18\x00\x00\x00\x7c\x00\x00\x00\x98\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x62\x00\x00\x00\x53\x59\x5a\x46\x41\x49\x4c\x3a\x20\x73\x65\x74\x66\x69\x6c\x65\x63\x6f\x6e\x3a"..., 272 <unfinished ...>
[pid  4033] <... epoll_pwait resumed>, [], 128, 979, NULL, 0) = 0
[pid  4031] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4389] set_robust_list(0x55555d3887e0, 24 <unfinished ...>
[pid  4366] <... clone resumed>, child_tidptr=0x55555d3887d0) = 4389
[pid  4058] <... socket resumed>)       = 5
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="gre0" <unfinished ...>
[pid  4031] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4366] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4041] <... write resumed>)        = 272
[pid  4033] futex(0x16a7c9156960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4389] <... set_robust_list resumed>) = 0
[pid  4041] pipe2( <unfinished ...>
[pid  4033] <... futex resumed>)        = 1
[pid  4032] <... futex resumed>)        = 0
[pid  4031] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4389] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4389] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4366] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4389] <... prctl resumed>)        = 0
[pid  4389] getppid()                   = 0
[pid  4389] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4041] <... pipe2 resumed>[10, 11], 0) = 0
[pid  4033] epoll_pwait(4 <unfinished ...>
[pid  4032] epoll_pwait(4 <unfinished ...>
[pid  4389] <... openat resumed>)       = 3
[pid  4041] pipe2( <unfinished ...>
[pid  4032] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3fa8a7c277000002}], 128, 0, NULL, 0) = 1
[pid  4389] dup2(3, 201)                = 201
[pid  4389] close(3)                    = 0
[pid  4389] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4032] futex(0x16a7c918a960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4389] <... prlimit64 resumed>, NULL) = 0
[pid  4041] <... pipe2 resumed>[13, 25], 0) = 0
[pid  4389] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024} <unfinished ...>
[pid  4035] <... futex resumed>)        = 0
[pid  4032] <... futex resumed>)        = 1
[pid  4389] <... prlimit64 resumed>, NULL) = 0
[pid  4035] futex(0x16a7c918a960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4389] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024} <unfinished ...>
[pid  4041] pipe2( <unfinished ...>
[pid  4032] read(6, "\x0c\x01\x00\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x20\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x10\x00\x10\x00\x00\x00\x05\x00\x00\x00\x18\x00\x00\x00\x7c\x00\x00\x00\x98\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x62\x00\x00\x00\x53\x59\x5a\x46\x41\x49\x4c\x3a\x20\x73\x65\x74\x66\x69\x6c\x65\x63\x6f\x6e\x3a"..., 21347228) = 272
[pid  4389] <... prlimit64 resumed>, NULL) = 0
[pid  4389] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4032] futex(0x16a7c918a960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4041] <... pipe2 resumed>[29, 37], 0) = 0
[pid  4035] <... futex resumed>)        = 0
[pid  4032] <... futex resumed>)        = 1
[pid  4389] <... prlimit64 resumed>, NULL) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4032] read(6 <unfinished ...>
[pid  4389] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} <unfinished ...>
[pid  4035] futex(0x16a7c918a960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4389] <... prlimit64 resumed>, NULL) = 0
[pid  4389] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4389] <... prlimit64 resumed>, NULL) = 0
[pid  4032] <... read resumed>, 0x16a7cd080000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4389] unshare(CLONE_NEWNS <unfinished ...>
[pid  4032] futex(0x16a7c9156960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4389] <... unshare resumed>)      = 0
[pid  4031] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=965167413} <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4389] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4389] <... mount resumed>)        = 0
[pid  4389] unshare(CLONE_NEWIPC)       = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4389] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4389] <... unshare resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4389] unshare(CLONE_NEWUTS <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4389] <... unshare resumed>)      = 0
[pid  4389] unshare(CLONE_SYSVSEM <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4389] <... unshare resumed>)      = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4389] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4389] <... openat resumed>)       = 3
[pid  4389] write(3, "16777216", 8)     = 8
[pid  4389] close(3)                    = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4389] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  4389] write(3, "536870912", 9)    = 9
[pid  4389] close(3)                    = 0
[pid  4389] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3
[pid  4389] write(3, "1024", 4)         = 4
[pid  4389] close(3)                    = 0
[pid  4389] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4389] write(3, "8192", 4)         = 4
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4389] close(3)                    = 0
[pid  4389] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4389] write(3, "1024", 4 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4389] <... write resumed>)        = 4
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4389] close(3)                    = 0
[pid  4389] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[pid  4389] write(3, "1024", 4 <unfinished ...>
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4389] <... write resumed>)        = 4
[pid  4058] close(5 <unfinished ...>
[pid  4389] close(3 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4389] <... close resumed>)        = 0
[pid  4058] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x00\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4389] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4389] <... openat resumed>)       = 3
[pid  4058] <... sendto resumed>)       = 64
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4389] write(3, "1024 1048576 500 1024", 21 <unfinished ...>
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4389] <... write resumed>)        = 21
[pid  4058] <... recvfrom resumed>, [{nlmsg_len=84, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x00\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f"]}], 4096, 0, NULL, NULL) = 84
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4389] close(3)                    = 0
[pid  4058] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4389] unshare(CLONE_NEWNET <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... socket resumed>)       = 5
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] ioctl(5, SIOCGIFINDEX, {ifr_name="gre0" <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4389] <... unshare resumed>)      = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4389] mkdirat(AT_FDCWD, "/dev/binderfs", 0777 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4389] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4389] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4389] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4389] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4389] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4058] <... ioctl resumed>})       = -1 ENODEV (No such device)
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] close(5 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4389] setgroups(0, NULL <unfinished ...>
[pid  4058] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4389] <... setgroups resumed>)    = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4389] setresgid(65534, 65534, 65534 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4389] <... setresgid resumed>)    = 0
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4389] setresuid(65534, 65534, 65534 <unfinished ...>
[pid  4041] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... sendto resumed>)       = 32
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4389] <... setresuid resumed>)    = 0
[pid  4058] recvfrom(3 <unfinished ...>
[pid  4041] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4389] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
] ReproducedBugTitle:SYZFAIL: setfilecon: setxattr failed\n", NUM <unfinished ...> ReproducedCrashReport:[pid  4051] <... mkdirat resumed>)      = 0
[pid  4050] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4047] <... setxattr resumed>)     = -1 EINVAL (Invalid argument)
[pid  4050] <... mount resumed>)        = 0
[pid  4047] write(2, "SYZFAIL: setfilecon: setxattr failed\n", 37 <unfinished ...>
[pid  4050] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4047] <... write resumed>)        = 37
[pid  4035] <... pselect6 resumed>)     = 1 (in [23], left {tv_sec=0, tv_nsec=779508080})
[pid  4051] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700 <unfinished ...>
[pid  4050] <... mount resumed>)        = 0
[pid  4047] write(2, " (errno 22: Invalid argument)\n", 30 <unfinished ...>
[pid  4051] <... mkdirat resumed>)      = 0
[pid  4035] read(23, "SYZFAIL: setfilecon: setxattr failed\n", 1024) = 37
[pid  4035] pselect6(34, [3 11 13 16 18 21 23 26 28 31 33], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4047] <... write resumed>)        = 30
[pid  4035] <... pselect6 resumed>)     = 1 (in [23], left {tv_sec=0, tv_nsec=999739390})
[pid  4035] read(23, " (errno 22: Invalid argument)\n", 1024) = 30
[pid  4035] pselect6(34, [3 11 13 16 18 21 23 26 28 31 33], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4050] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777) = 0
[pid  4051] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700) = 0
[pid  4047] exit_group(67)              = ?
[pid  4051] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4050] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4049] <... ioctl resumed>)        = 0
[pid  4050] <... pivot_root resumed>)   = 0
[pid  4050] chdir("/")                  = 0
[pid  4050] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4049] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR) = 3
[pid  4049] dup2(3, 215)                = 215
[pid  4049] close(3)                    = 0
[pid  4049] ioctl(215, KCOV_INIT_TRACE, 0x100000 <unfinished ...>
[pid  4051] <... mount resumed>)        = 0
/strace: Process 4054 attached
[pid  4050] <... umount2 resumed>)      = 0
[pid  4047] +++ exited with 67 +++
[pid  4035] <... pselect6 resumed>)     = 2 (in [21 23], left {tv_sec=0, tv_nsec=983078996})
[pid  4050] chroot("./newroot" <unfinished ...>
[pid  4045] <... clone resumed>, child_tidptr=0x555557b8d7d0) = 4054
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4047, si_uid=10999, si_status=67, si_utime=0, si_stime=4 /* 0.04 s */} ---
[pid  4050] <... chroot resumed>)       = 0
[pid  4035] rt_sigreturn({mask=[]})     = 2
[pid  4035] read(23 <unfinished ...>
[pid  4051] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] <... read resumed>, "", 1024) = 0
[pid  4051] <... mount resumed>)        = 0
[pid  4045] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] kill(4047, SIGKILL <unfinished ...>
[pid  4051] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4050] chdir("/" <unfinished ...>
[pid  4035] <... kill resumed>)         = 0
[pid  4054] set_robust_list(0x555557b8d7e0, 24 <unfinished ...>
[pid  4051] <... mount resumed>)        = 0
[pid  4050] <... chdir resumed>)        = 0
[pid  4045] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4054] <... set_robust_list resumed>) = 0
[pid  4051] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4050] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4049] <... ioctl resumed>)        = 0
[pid  4054] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] read(23 <unfinished ...>
[pid  4050] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] <... read resumed>, "", 1024) = 0
[pid  4050] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4054] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4051] <... mkdirat resumed>)      = 0
[pid  4049] mmap(NULL, 8396800, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4054] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4051] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4049] <... mmap resumed>)         = 0x7fbcc5b70000
[pid  4054] <... prctl resumed>)        = 0
[pid  4054] getppid( <unfinished ...>
[pid  4051] <... pivot_root resumed>)   = 0
[pid  4049] mmap(0x7fbcc5b71000, 8388608, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 215, 0 <unfinished ...>
[pid  4054] <... getppid resumed>)      = 0
[pid  4054] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4051] chdir("/" <unfinished ...>
[pid  4054] <... openat resumed>)       = 3
[pid  4051] <... chdir resumed>)        = 0
[pid  4054] dup2(3, 201 <unfinished ...>
[pid  4051] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4054] <... dup2 resumed>)         = 201
[pid  4054] close(3)                    = 0
[pid  4054] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4051] <... umount2 resumed>)      = 0
[pid  4054] <... prlimit64 resumed>, NULL) = 0
[pid  4051] chroot("./newroot" <unfinished ...>
[pid  4054] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  4051] <... chroot resumed>)       = 0
[pid  4054] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024} <unfinished ...>
[pid  4051] chdir("/" <unfinished ...>
[pid  4054] <... prlimit64 resumed>, NULL) = 0
[pid  4054] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4051] <... chdir resumed>)        = 0
[pid  4054] <... prlimit64 resumed>, NULL) = 0
[pid  4051] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4054] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} <unfinished ...>
[pid  4051] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4054] <... prlimit64 resumed>, NULL) = 0
[pid  4054] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} <unfinished ...>
[pid  4051] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4049] <... mmap resumed>)         = 0x7fbcc5b71000
[pid  4054] <... prlimit64 resumed>, NULL) = 0
[pid  4054] unshare(CLONE_NEWNS)        = 0
[pid  4049] unshare(CLONE_NEWPID)       = 0
[pid  4049] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4049] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4054] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid  4054] unshare(CLONE_NEWIPC)       = 0
[pid  4054] unshare(CLONE_NEWCGROUP)    = 0
[pid  4054] unshare(CLONE_NEWUTS)       = 0
[pid  4054] unshare(CLONE_SYSVSEM)      = 0
[pid  4054] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  4054] write(3, "16777216", 8)     = 8
[pid  4054] close(3)                    = 0
[pid  4054] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  4054] write(3, "536870912", 9)    = 9
[pid  4054] close(3)                    = 0
[pid  4054] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4050] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4054] <... openat resumed>)       = 3
[pid  4050] mkdirat(AT_FDCWD, "/dev/binderfs", 0777 <unfinished ...>
[pid  4054] write(3, "1024", 4)         = 4
[pid  4050] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4054] close(3 <unfinished ...>
[pid  4050] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4054] <... close resumed>)        = 0
[pid  4054] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
/strace: Process 4058 attached
[pid  4054] write(3, "8192", 4 <unfinished ...>
[pid  4049] <... clone resumed>, child_tidptr=0x5555860de7d0) = 4058
[pid  4054] <... write resumed>)        = 4
[pid  4054] close(3 <unfinished ...>
[pid  4049] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4058] set_robust_list(0x5555860de7e0, 24 <unfinished ...>
[pid  4054] <... close resumed>)        = 0
[pid  4049] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4058] <... set_robust_list resumed>) = 0
[pid  4054] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4058] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4054] <... openat resumed>)       = 3
[pid  4058] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  4054] write(3, "1024", 4 <unfinished ...>
[pid  4058] getppid( <unfinished ...>
[pid  4054] <... write resumed>)        = 4
[pid  4058] <... getppid resumed>)      = 0
[pid  4058] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  4058] dup2(3, 201)                = 201
[pid  4058] close(3)                    = 0
[pid  4058] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024}, NULL) = 0
[pid  4058] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  4058] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  4058] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4054] close(3 <unfinished ...>
[pid  4058] <... prlimit64 resumed>, NULL) = 0
[pid  4054] <... close resumed>)        = 0
[pid  4058] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  4058] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  4058] unshare(CLONE_NEWNS)        = 0
[pid  4054] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4058] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4054] <... openat resumed>)       = 3
[pid  4051] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4058] <... mount resumed>)        = 0
[pid  4058] unshare(CLONE_NEWIPC)       = 0
[pid  4054] write(3, "1024", 4 <unfinished ...>
[pid  4051] mkdirat(AT_FDCWD, "/dev/binderfs", 0777 <unfinished ...>
[pid  4058] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4054] <... write resumed>)        = 4
[pid  4054] close(3 <unfinished ...>
[pid  4051] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4058] <... unshare resumed>)      = 0
[pid  4054] <... close resumed>)        = 0
[pid  4051] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4054] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4058] unshare(CLONE_NEWUTS)       = 0
[pid  4058] unshare(CLONE_SYSVSEM)      = 0
[pid  4058] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  4054] <... openat resumed>)       = 3
[pid  4058] write(3, "16777216", 8 <unfinished ...>
[pid  4054] write(3, "1024 1048576 500 1024", 21 <unfinished ...>
[pid  4058] <... write resumed>)        = 8
[pid  4058] close(3)                    = 0
[pid  4058] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  4054] <... write resumed>)        = 21
[pid  4058] write(3, "536870912", 9 <unfinished ...>
[pid  4054] close(3 <unfinished ...>
[pid  4058] <... write resumed>)        = 9
[pid  4054] <... close resumed>)        = 0
[pid  4058] close(3 <unfinished ...>
[pid  4054] getpid( <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4054] <... getpid resumed>)       = 1
[pid  4058] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4054] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4058] <... openat resumed>)       = 3
[pid  4054] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4050] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4058] write(3, "1024", 4 <unfinished ...>
[pid  4054] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4050] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4058] <... write resumed>)        = 4
[pid  4058] close(3)                    = 0
[pid  4058] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
[pid  4054] <... capset resumed>)       = 0
[pid  4050] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4058] write(3, "8192", 4)         = 4
[pid  4050] getpid( <unfinished ...>
[pid  4054] unshare(CLONE_NEWNET <unfinished ...>
[pid  4058] close(3)                    = 0
[pid  4058] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  4058] write(3, "1024", 4)         = 4
[pid  4058] close(3)                    = 0
[pid  4058] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4050] <... getpid resumed>)       = 1
[pid  4058] <... openat resumed>)       = 3
[pid  4050] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4058] write(3, "1024", 4 <unfinished ...>
[pid  4050] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4058] <... write resumed>)        = 4
[pid  4050] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4050] <... capset resumed>)       = 0
[pid  4058] <... close resumed>)        = 0
[pid  4050] getpid( <unfinished ...>
[pid  4058] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3
[pid  4050] <... getpid resumed>)       = 1
[pid  4050] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz1", 0777 <unfinished ...>
[pid  4058] write(3, "1024 1048576 500 1024", 21) = 21
[pid  4058] close(3)                    = 0
[pid  4058] getpid()                    = 1
[pid  4058] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4058] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4058] unshare(CLONE_NEWNET <unfinished ...>
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4050] openat(AT_FDCWD, "/syzcgroup/unified/syz1/pids.max", O_WRONLY|O_CLOEXEC) = 3
[pid  4050] write(3, "32", 2)           = 2
[pid  4050] close(3)                    = 0
[pid  4050] openat(AT_FDCWD, "/syzcgroup/unified/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3
[pid  4050] write(3, "1", 1)            = 1
[pid  4050] close(3)                    = 0
[pid  4050] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz1", 0777 <unfinished ...>
[pid  4054] <... unshare resumed>)      = 0
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4051] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4050] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4051] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4050] <... openat resumed>)       = 3
[pid  4051] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4050] write(3, "1", 1)            = 1
[pid  4051] getpid( <unfinished ...>
[pid  4050] close(3 <unfinished ...>
[pid  4051] <... getpid resumed>)       = 1
[pid  4050] <... close resumed>)        = 0
[pid  4051] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz3", 0777 <unfinished ...>
[pid  4050] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4054] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4051] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4050] <... openat resumed>)       = 3
[pid  4054] <... openat resumed>)       = 3
[pid  4051] openat(AT_FDCWD, "/syzcgroup/unified/syz3/pids.max", O_WRONLY|O_CLOEXEC) = 3
[pid  4050] write(3, "313524224", 9 <unfinished ...>
[pid  4051] write(3, "32", 2 <unfinished ...>
[pid  4050] <... write resumed>)        = 9
[pid  4054] write(3, "0 65535", 7 <unfinished ...>
[pid  4051] <... write resumed>)        = 2
[pid  4050] close(3 <unfinished ...>
[pid  4054] <... write resumed>)        = 7
[pid  4051] close(3 <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4051] <... close resumed>)        = 0
[pid  4050] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4054] close(3 <unfinished ...>
[pid  4051] openat(AT_FDCWD, "/syzcgroup/unified/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4050] <... openat resumed>)       = 3
[pid  4054] <... close resumed>)        = 0
[pid  4051] <... openat resumed>)       = 3
[pid  4050] write(3, "314572800", 9 <unfinished ...>
[pid  4054] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4051] write(3, "1", 1 <unfinished ...>
[pid  4050] <... write resumed>)        = 9
[pid  4050] close(3)                    = 0
[pid  4050] mkdirat(AT_FDCWD, "/syzcgroup/net/syz1", 0777 <unfinished ...>
[pid  4054] <... openat resumed>)       = 3
[pid  4054] write(3, "100000", 6)       = 6
[pid  4051] <... write resumed>)        = 1
[pid  4054] close(3 <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4054] <... close resumed>)        = 0
[pid  4051] <... close resumed>)        = 0
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp", 0777) = 0
[pid  4051] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz3", 0777) = -1 EEXIST (File exists)
[pid  4051] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3
[pid  4051] write(3, "1", 1 <unfinished ...>
[pid  4054] mount("", "./syz-tmp", "tmpfs", 0, NULL) = 0
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot", 0777) = 0
[pid  4058] <... unshare resumed>)      = 0
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot/dev", 0700 <unfinished ...>
[pid  4051] <... write resumed>)        = 1
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4027] <... epoll_pwait resumed>, [], 128, 996, NULL, 0) = 0
[pid  4058] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] close(3 <unfinished ...>
[pid  4058] <... openat resumed>)       = 3
[pid  4054] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4050] openat(AT_FDCWD, "/syzcgroup/net/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4027] futex(0x17678927f960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4054] <... mount resumed>)        = 0
[pid  4051] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4050] <... openat resumed>)       = 3
[pid  4029] <... futex resumed>)        = 0
[pid  4027] <... futex resumed>)        = 1
[pid  4058] write(3, "0 65535", 7 <unfinished ...>
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot/proc", 0700 <unfinished ...>
[pid  4051] <... openat resumed>)       = 3
[pid  4050] write(3, "1", 1 <unfinished ...>
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4058] <... write resumed>)        = 7
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] write(3, "313524224", 9 <unfinished ...>
[pid  4050] <... write resumed>)        = 1
[pid  4029] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4058] close(3 <unfinished ...>
[pid  4054] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid  4051] <... write resumed>)        = 9
[pid  4050] close(3 <unfinished ...>
[pid  4029] futex(0x17678927f960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4058] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4058] <... openat resumed>)       = 3
[pid  4051] close(3 <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4025] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4025] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4058] write(3, "100000", 6 <unfinished ...>
[pid  4051] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4058] <... write resumed>)        = 6
[pid  4051] <... openat resumed>)       = 3
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4051] write(3, "314572800", 9 <unfinished ...>
[pid  4050] <... socket resumed>)       = 3
[pid  4058] <... close resumed>)        = 0
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp", 0777 <unfinished ...>
[pid  4054] <... mount resumed>)        = 0
[pid  4051] <... write resumed>)        = 9
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4050] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] <... close resumed>)        = 0
[pid  4051] mkdirat(AT_FDCWD, "/syzcgroup/net/syz3", 0777 <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7f6358ab73e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4054] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4050] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4058] mount("", "./syz-tmp", "tmpfs", 0, NULL <unfinished ...>
[pid  4054] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4051] openat(AT_FDCWD, "/syzcgroup/net/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7f6358ab7a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] <... mount resumed>)        = 0
[pid  4054] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... openat resumed>)       = 3
[pid  4050] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO, 0x7f6358ab80e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] close(3 <unfinished ...>
[pid  4054] <... mount resumed>)        = 0
[pid  4051] write(3, "1", 1 <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4051] <... write resumed>)        = 1
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot", 0777 <unfinished ...>
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] <... close resumed>)        = 0
[pid  4050] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot/dev", 0700 <unfinished ...>
[pid  4054] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7f6358ab8768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4054] <... mount resumed>)        = 0
[pid  4051] <... socket resumed>)       = 3
[pid  4050] close(3 <unfinished ...>
[pid  4058] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4054] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4058] <... mount resumed>)        = 0
[pid  4054] <... mount resumed>)        = 0
[pid  4051] <... getsockopt resumed>, 0x7f0fc97573e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot/proc", 0700 <unfinished ...>
[pid  4054] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4050] <... socket resumed>)       = 3
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4054] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4051] <... getsockopt resumed>, 0x7f0fc9757a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=975972050} <unfinished ...>
[pid  4058] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid  4054] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7f6358abafc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] <... mount resumed>)        = 0
[pid  4054] <... mount resumed>)        = 0
[pid  4051] <... getsockopt resumed>, 0x7f0fc97580e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4051] close(3)                    = 0
[pid  4050] <... getsockopt resumed>, 0x7f6358abb688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4051] <... socket resumed>)       = 3
[pid  4050] <... getsockopt resumed>, 0x7f6358abbd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4050] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] <... getsockopt resumed>, 0x7f0fc9758768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] <... getsockopt resumed>, 0x7f6358abc408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7f6358abcac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4054] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4050] close(3 <unfinished ...>
[pid  4058] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4054] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4050] <... close resumed>)        = 0
[pid  4058] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700 <unfinished ...>
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4058] <... mount resumed>)        = 0
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] <... socket resumed>)       = 3
[pid  4051] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4050] <... socket resumed>)       = 3
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid  4051] <... getsockopt resumed>, 0x7f0fc975afc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4050] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] <... getsockopt resumed>, 0x7f0fc975b688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700 <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7f6358ab8e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] <... mount resumed>)        = 0
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] <... getsockopt resumed>, 0x7f0fc975bd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7f6358ab94c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4051] <... getsockopt resumed>, 0x7f0fc975c408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] <... getsockopt resumed>, 0x7f6358ab9b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4050] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4058] <... mount resumed>)        = 0
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] <... getsockopt resumed>, 0x7f0fc975cac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] <... getsockopt resumed>, 0x7f6358aba248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4054] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4050] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4058] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4054] <... mount resumed>)        = 0
[pid  4051] <... close resumed>)        = 0
[pid  4058] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7f6358aba908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] <... mount resumed>)        = 0
[pid  4054] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... socket resumed>)       = 3
[pid  4050] close(3 <unfinished ...>
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4054] <... mount resumed>)        = 0
[pid  4050] <... close resumed>)        = 0
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4051] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4058] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4054] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... getsockopt resumed>, 0x7f0fc9758e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4058] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4054] <... mount resumed>)        = 0
[pid  4051] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4050] <... write resumed>)        = 4
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700) = 0
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4051] <... getsockopt resumed>, 0x7f0fc97594c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700) = 0
[pid  4051] <... getsockopt resumed>, 0x7f0fc9759b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4054] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4051] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4050] openat(AT_FDCWD, "/dev/loop1", O_RDWR <unfinished ...>
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4054] <... pivot_root resumed>)   = 0
[pid  4051] <... getsockopt resumed>, 0x7f0fc975a248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] <... openat resumed>)       = 3
[pid  4058] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4058] <... mount resumed>)        = 0
[pid  4054] chdir("/" <unfinished ...>
[pid  4051] <... getsockopt resumed>, 0x7f0fc975a908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] ioctl(3, LOOP_CLR_FD)       = -1 ENXIO (No such device or address)
[pid  4051] close(3 <unfinished ...>
[pid  4054] <... chdir resumed>)        = 0
[pid  4050] close(3 <unfinished ...>
[pid  4054] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4050] <... close resumed>)        = 0
[pid  4058] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4058] <... mount resumed>)        = 0
[pid  4051] <... write resumed>)        = 4
[pid  4050] <... socket resumed>)       = 3
[pid  4051] mkdirat(AT_FDCWD, "./0", 0777) = 0
[pid  4058] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4050] close(3 <unfinished ...>
[pid  4058] <... mount resumed>)        = 0
[pid  4051] openat(AT_FDCWD, "/dev/loop3", O_RDWR <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4051] <... openat resumed>)       = 3
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4054] <... umount2 resumed>)      = 0
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4054] chroot("./newroot" <unfinished ...>
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4054] <... chroot resumed>)       = 0
[pid  4050] <... socket resumed>)       = 3
[pid  4054] chdir("/" <unfinished ...>
[pid  4035] write(3, "\x0c\x01\x00\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x20\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x10\x00\x10\x00\x00\x00\x02\x00\x00\x00\x18\x00\x00\x00\x7c\x00\x00\x00\x98\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x62\x00\x00\x00\x53\x59\x5a\x46\x41\x49\x4c\x3a\x20\x73\x65\x74\x66\x69\x6c\x65\x63\x6f\x6e\x3a"..., 272 <unfinished ...>
[pid  4051] ioctl(3, LOOP_CLR_FD)       = -1 ENXIO (No such device or address)
[pid  4054] <... chdir resumed>)        = 0
[pid  4051] close(3 <unfinished ...>
[pid  4054] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4050] close(3 <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4058] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4054] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4058] <... pivot_root resumed>)   = 0
[pid  4054] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4035] <... write resumed>)        = 272
[pid  4051] <... socket resumed>)       = 3
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4050] <... socket resumed>)       = 3
[pid  4051] <... close resumed>)        = 0
[pid  4050] close(3 <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3f9a33f30c000002}], 128, 992, NULL, 0) = 1
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4027] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4051] <... socket resumed>)       = 3
[pid  4050] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4027] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4058] chdir("/" <unfinished ...>
[pid  4027] read(6 <unfinished ...>
[pid  4058] <... chdir resumed>)        = 0
[pid  4050] <... socket resumed>)       = 3
[pid  4035] pipe2( <unfinished ...>
[pid  4027] <... read resumed>, "\x0c\x01\x00\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x20\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x10\x00\x10\x00\x00\x00\x02\x00\x00\x00\x18\x00\x00\x00\x7c\x00\x00\x00\x98\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x62\x00\x00\x00\x53\x59\x5a\x46\x41\x49\x4c\x3a\x20\x73\x65\x74\x66\x69\x6c\x65\x63\x6f\x6e\x3a"..., 21347228) = 272
[pid  4058] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4050] close(3 <unfinished ...>
[pid  4035] <... pipe2 resumed>[29, 32], 0) = 0
[pid  4027] futex(0x17678927f960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4050] <... close resumed>)        = 0
[pid  4050] read(249 <unfinished ...>
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4035] pipe2( <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4035] <... pipe2 resumed>[34, 35], 0) = 0
[pid  4029] <... futex resumed>)        = 0
[pid  4027] <... futex resumed>)        = 1
[pid  4058] <... umount2 resumed>)      = 0
[pid  4051] <... close resumed>)        = 0
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4035] pipe2( <unfinished ...>
[pid  4029] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4027] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x12\x38\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0b\x00\x00\x00"..., 192 <unfinished ...>
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4035] <... pipe2 resumed>[36, 37], 0) = 0
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4051] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4029] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4058] chroot("./newroot" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4027] <... write resumed>)        = 192
[pid  4058] <... chroot resumed>)       = 0
[pid  4051] <... socket resumed>)       = 3
[pid  4058] chdir("/" <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... chdir resumed>)        = 0
[pid  4051] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4027] read(6 <unfinished ...>
[pid  4058] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4027] <... read resumed>, 0x17678d500000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4058] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] read(249 <unfinished ...>
[pid  4027] futex(0x17678927f160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4058] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=915275030} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4054] mkdirat(AT_FDCWD, "/dev/binderfs", 0777) = -1 EEXIST (File exists)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4058] mkdirat(AT_FDCWD, "/dev/binderfs", 0777) = -1 EEXIST (File exists)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] getpid( <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... getpid resumed>)       = 1
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz0", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4054] openat(AT_FDCWD, "/syzcgroup/unified/syz0/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] write(3, "32", 2 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... write resumed>)        = 2
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] openat(AT_FDCWD, "/syzcgroup/unified/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] write(3, "1", 1 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... write resumed>)        = 1
[pid  4054] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz0", 0777) = -1 EEXIST (File exists)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... openat resumed>)       = 3
[pid  4054] write(3, "1", 1 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... write resumed>)        = 1
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] write(3, "313524224", 9)    = 9
[pid  4054] close(3)                    = 0
[pid  4054] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] write(3, "314572800", 9 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... write resumed>)        = 9
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] mkdirat(AT_FDCWD, "/syzcgroup/net/syz0", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] openat(AT_FDCWD, "/syzcgroup/net/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] write(3, "1", 1 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... write resumed>)        = 1
[pid  4054] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5d73e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO, 0x7fcb3b5d7a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5d80e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... socket resumed>)       = 3
[pid  4054] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5d8768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5dafc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5db688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5dbd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5dc408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5dcac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... close resumed>)        = 0
[pid  4058] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 ENOENT (No such file or directory)
[pid  4054] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4058] getpid( <unfinished ...>
[pid  4054] <... socket resumed>)       = 3
[pid  4058] <... getpid resumed>)       = 1
[pid  4054] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz4", 0777 <unfinished ...>
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5d8e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4058] openat(AT_FDCWD, "/syzcgroup/unified/syz4/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5d94c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5d9b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5da248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5da908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] openat(AT_FDCWD, "/dev/loop0", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] write(3, "32", 2 <unfinished ...>
[pid  4054] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... write resumed>)        = 2
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4054] <... close resumed>)        = 0
[pid  4054] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe0c2aaf000
[pid  4058] <... close resumed>)        = 0
[pid  4035] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4058] openat(AT_FDCWD, "/syzcgroup/unified/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4054] <... socket resumed>)       = 3
[pid  4035] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7fe0c2aaf000, stack_size=0x9000}, 88/strace: Process 4065 attached
 <unfinished ...>
[pid  4054] close(3 <unfinished ...>
[pid  4058] <... openat resumed>)       = 3
[pid  4054] <... close resumed>)        = 0
[pid  4065] rt_sigprocmask(SIG_BLOCK, NULL <unfinished ...>
[pid  4054] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4058] write(3, "1", 1 <unfinished ...>
[pid  4065] <... rt_sigprocmask resumed>, ~[KILL STOP], 8) = 0
[pid  4054] close(3 <unfinished ...>
[pid  4065] setpgid(0, 0 <unfinished ...>
[pid  4054] <... close resumed>)        = 0
[pid  4058] <... write resumed>)        = 1
[pid  4065] <... setpgid resumed>)      = 0
[pid  4058] close(3 <unfinished ...>
[pid  4054] read(249 <unfinished ...>
[pid  4065] dup2(29, 0 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4065] <... dup2 resumed>)         = 0
[pid  4058] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz4", 0777 <unfinished ...>
[pid  4065] dup2(35, 1)                 = 1
[pid  4065] dup2(37, 2)                 = 2
[pid  4065] dup2(14, 3)                 = 3
[pid  4065] dup2(17, 4)                 = 4
[pid  4065] close(5)                    = 0
[pid  4065] close(6)                    = 0
[pid  4065] close(7)                    = 0
[pid  4065] close(8)                    = 0
[pid  4065] close(9)                    = 0
[pid  4065] close(10)                   = 0
[pid  4065] close(11)                   = 0
[pid  4065] close(12 <unfinished ...>
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4065] <... close resumed>)        = 0
[pid  4058] openat(AT_FDCWD, "/syzcgroup/cpu/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4065] close(13)                   = 0
[pid  4065] close(14)                   = 0
[pid  4065] close(15)                   = 0
[pid  4065] close(16 <unfinished ...>
[pid  4058] <... openat resumed>)       = 3
[pid  4065] <... close resumed>)        = 0
[pid  4065] close(17)                   = 0
[pid  4065] close(18)                   = 0
[pid  4065] close(19)                   = 0
[pid  4065] close(20)                   = 0
[pid  4065] close(21)                   = 0
[pid  4065] close(22)                   = 0
[pid  4065] close(23)                   = 0
[pid  4058] write(3, "1", 1 <unfinished ...>
[pid  4065] close(24)                   = 0
[pid  4065] close(25)                   = 0
[pid  4065] close(26 <unfinished ...>
[pid  4058] <... write resumed>)        = 1
[pid  4065] <... close resumed>)        = 0
[pid  4065] close(27)                   = 0
[pid  4065] close(28)                   = 0
[pid  4065] close(29 <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4065] <... close resumed>)        = 0
[pid  4065] close(30)                   = 0
[pid  4065] close(31)                   = 0
[pid  4058] <... close resumed>)        = 0
[pid  4065] close(32)                   = 0
[pid  4065] close(33)                   = 0
[pid  4065] close(34 <unfinished ...>
[pid  4058] openat(AT_FDCWD, "/syzcgroup/cpu/syz4/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4065] <... close resumed>)        = 0
[pid  4065] close(35)                   = 0
[pid  4065] close(36)                   = 0
[pid  4065] close(37)                   = 0
[pid  4065] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... openat resumed>)       = 3
[pid  4065] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4065] close(39)                   = -1 EBADF (Bad file descriptor)
[pid  4065] close(40 <unfinished ...>
[pid  4058] write(3, "313524224", 9 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4065] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4065] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4065] close(44)                   = -1 EBADF (Bad file descriptor)
[pid  4065] close(45 <unfinished ...>
[pid  4058] <... write resumed>)        = 9
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(46)                   = -1 EBADF (Bad file descriptor)
[pid  4065] close(47)                   = -1 EBADF (Bad file descriptor)
[pid  4065] close(48)                   = -1 EBADF (Bad file descriptor)
[pid  4058] close(3 <unfinished ...>
[pid  4065] close(49 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] openat(AT_FDCWD, "/syzcgroup/cpu/syz4/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4065] close(50)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... openat resumed>)       = 3
[pid  4065] close(51 <unfinished ...>
[pid  4058] write(3, "314572800", 9 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... write resumed>)        = 9
[pid  4065] close(52 <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(53 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] mkdirat(AT_FDCWD, "/syzcgroup/net/syz4", 0777 <unfinished ...>
[pid  4065] close(54 <unfinished ...>
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] openat(AT_FDCWD, "/syzcgroup/net/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4065] close(55)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... openat resumed>)       = 3
[pid  4065] close(56 <unfinished ...>
[pid  4058] write(3, "1", 1 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(57)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... write resumed>)        = 1
[pid  4065] close(58 <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4065] close(59 <unfinished ...>
[pid  4058] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(60 <unfinished ...>
[pid  4058] <... socket resumed>)       = 3
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4065] close(61 <unfinished ...>
[pid  4058] <... getsockopt resumed>, 0x7fbcc73673e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4065] close(62)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... getsockopt resumed>, 0x7fbcc7367a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] close(63)                   = -1 EBADF (Bad file descriptor)
[pid  4058] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4065] close(64 <unfinished ...>
[pid  4058] <... getsockopt resumed>, 0x7fbcc73680e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] close(3 <unfinished ...>
[pid  4065] close(65 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4065] close(66)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... socket resumed>)       = 3
[pid  4065] close(67 <unfinished ...>
[pid  4058] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(68 <unfinished ...>
[pid  4058] <... getsockopt resumed>, 0x7fbcc7368768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] close(3 <unfinished ...>
[pid  4065] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4065] close(70 <unfinished ...>
[pid  4058] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(71)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... socket resumed>)       = 3
[pid  4065] close(72)                   = -1 EBADF (Bad file descriptor)
[pid  4058] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4065] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... getsockopt resumed>, 0x7fbcc736afc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4058] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4065] close(75 <unfinished ...>
[pid  4058] <... getsockopt resumed>, 0x7fbcc736b688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(76 <unfinished ...>
[pid  4058] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... getsockopt resumed>, 0x7fbcc736bd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] close(77 <unfinished ...>
[pid  4058] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... getsockopt resumed>, 0x7fbcc736c408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4058] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4065] close(79 <unfinished ...>
[pid  4058] <... getsockopt resumed>, 0x7fbcc736cac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] close(3 <unfinished ...>
[pid  4065] close(80)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4065] close(81 <unfinished ...>
[pid  4058] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(82 <unfinished ...>
[pid  4058] <... socket resumed>)       = 3
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4065] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... getsockopt resumed>, 0x7fbcc7368e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4065] close(84 <unfinished ...>
[pid  4058] <... getsockopt resumed>, 0x7fbcc73694c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4065] close(85 <unfinished ...>
[pid  4058] <... getsockopt resumed>, 0x7fbcc7369b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4065] close(86 <unfinished ...>
[pid  4058] <... getsockopt resumed>, 0x7fbcc736a248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(87 <unfinished ...>
[pid  4058] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... getsockopt resumed>, 0x7fbcc736a908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] close(88 <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(89 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4065] close(90)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... write resumed>)        = 4
[pid  4065] close(91 <unfinished ...>
[pid  4058] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4065] close(92 <unfinished ...>
[pid  4058] openat(AT_FDCWD, "/dev/loop4", O_RDWR <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(93 <unfinished ...>
[pid  4058] <... openat resumed>)       = 3
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4065] close(94 <unfinished ...>
[pid  4058] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] close(3 <unfinished ...>
[pid  4065] close(95)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4065] close(96 <unfinished ...>
[pid  4058] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4065] close(98 <unfinished ...>
[pid  4058] <... socket resumed>)       = 3
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] close(3 <unfinished ...>
[pid  4065] close(99)                   = -1 EBADF (Bad file descriptor)
[pid  4065] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(102 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4065] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... socket resumed>)       = 3
[pid  4065] close(104 <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4065] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4058] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4065] close(106 <unfinished ...>
[pid  4058] <... socket resumed>)       = 3
[pid  4058] close(3 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4058] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4065] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... socket resumed>)       = 3
[pid  4065] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4058] close(3 <unfinished ...>
[pid  4065] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4065] close(110 <unfinished ...>
[pid  4058] read(249 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(118)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(119)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(120)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(129)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(130)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(134)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(135)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(142)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(154)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(155)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(158)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(163)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(164)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(168)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(169)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(182)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(183)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(184)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(185)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(186)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(188)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(189)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(190)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(191)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(194)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(195)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(196)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(200)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(202)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(204)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(205)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(206)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(207)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(208)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(209)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(210)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(211)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(213)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(214)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(215)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(216)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(217)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(218)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(219)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(220)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(223)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(224)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(225)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(228)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(229)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(230)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(231)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(232)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(233)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(234)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(235)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(236)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(237)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(240 <unfinished ...>
[pid  4029] <... epoll_pwait resumed>, [], 128, 921, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(241 <unfinished ...>
[pid  4029] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4029] futex(0x17678927f160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4065] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(244 <unfinished ...>
[pid  4029] <... futex resumed>)        = 1
[pid  4027] <... futex resumed>)        = 0
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(245 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(246 <unfinished ...>
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4025] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(247 <unfinished ...>
[pid  4027] futex(0x17678927f160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4025] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(248)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(251)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(252 <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=901693125} <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(253)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4065] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4065] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffedff15900 /* 2 vars */ <unfinished ...>
[pid  4035] <... clone3 resumed>)       = 4065
[pid  4035] munmap(0x7fe0c2aaf000, 36864) = 0
[pid  4035] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4035] fcntl(34, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(34, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] fcntl(36, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(36, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] close(29)                   = 0
[pid  4035] close(35)                   = 0
[pid  4035] close(37)                   = 0
[pid  4035] close(20)                   = 0
[pid  4065] <... execve resumed>)       = 0
[pid  4035] close(21)                   = 0
[pid  4065] brk(NULL <unfinished ...>
[pid  4035] close(23)                   = 0
[pid  4065] <... brk resumed>)          = 0x55557fef9000
[pid  4035] write(32, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\x78\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4065] brk(0x55557fef9e80 <unfinished ...>
[pid  4035] pselect6(37, [3 11 13 16 18 26 28 31 33 34 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8}) = 5 (in [3 11 16 26 31], left {tv_sec=0, tv_nsec=999983824})
[pid  4065] <... brk resumed>)          = 0x55557fef9e80
[pid  4035] read(3, "\xbc\x00\x00\x00", 4) = 4
[pid  4035] read(3, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x12\x38\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4065] arch_prctl(ARCH_SET_FS, 0x55557fef9500 <unfinished ...>
[pid  4035] read(11, "\x00\x00\x00\x00", 4) = 4
[pid  4065] <... arch_prctl resumed>)   = 0
[pid  4035] write(3, "\x2c\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x0e\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x00\x00\x06\x00\x0c\x00\x04\x00\x06\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4065] set_tid_address(0x55557fef97d0 <unfinished ...>
[pid  4035] <... write resumed>)        = 48
[pid  4029] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3f9a33f30c000002}], 128, 905, NULL, 0) = 1
[pid  4065] <... set_tid_address resumed>) = 4065
[pid  4029] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4065] set_robust_list(0x55557fef97e0, 24) = 0
[pid  4029] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4065] prlimit64(0, RLIMIT_STACK, NULL <unfinished ...>
[pid  4029] read(6 <unfinished ...>
[pid  4025] sched_yield( <unfinished ...>
[pid  4029] <... read resumed>, "\x2c\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x0e\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x00\x00\x06\x00\x0c\x00\x04\x00\x06\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 21347228) = 48
[pid  4065] <... prlimit64 resumed>, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4029] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x12\x39\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0c\x00\x00\x00"..., 192 <unfinished ...>
[pid  4065] readlinkat(AT_FDCWD, "/proc/self/exe" <unfinished ...>
[pid  4029] <... write resumed>)        = 192
[pid  4065] <... readlinkat resumed>, "/syz-executor", 4096) = 13
[pid  4025] <... sched_yield resumed>)  = 0
[pid  4029] read(6 <unfinished ...>
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4029] <... read resumed>, 0x17678d500000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4065] getrandom( <unfinished ...>
[pid  4029] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4065] <... getrandom resumed>"\x18\x50\xce\xd1\xb6\xdc\x4b\x0e", 8, GRND_NONBLOCK) = 8
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4065] brk(NULL)                   = 0x55557fef9e80
[pid  4065] brk(0x55557ff1ae80)         = 0x55557ff1ae80
[pid  4065] brk(0x55557ff1b000)         = 0x55557ff1b000
[pid  4065] mprotect(0x7f187cb59000, 1236992, PROT_READ) = 0
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=788105153} <unfinished ...>
[pid  4065] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  4035] write(10, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4065] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4054] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4035] <... write resumed>)        = 48
[pid  4065] <... mmap resumed>)         = 0x1ffffffff000
[pid  4054] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] read(16 <unfinished ...>
[pid  4065] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4054] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4065] <... mmap resumed>)         = 0x200000000000
[pid  4054] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4035] write(3, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00", 56 <unfinished ...>
[pid  4065] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200001000000
[pid  4029] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3f9a33f30c000002}], 128, 790, NULL, 0) = 1
[pid  4065] rt_sigaction(SIGCHLD, {sa_handler=0x7f187c8f0780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f187c9de1d0}, NULL, 8) = 0
[pid  4035] <... write resumed>)        = 56
[pid  4065] pkey_alloc(0, PKEY_UNRESTRICTED <unfinished ...>
[pid  4029] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4065] <... pkey_alloc resumed>)   = -1 EINVAL (Invalid argument)
[pid  4029] <... futex resumed>)        = 1
[pid  4065] getrandom( <unfinished ...>
[pid  4029] read(6 <unfinished ...>
[pid  4025] <... futex resumed>)        = 0
[pid  4065] <... getrandom resumed>"\x8f\x0b\x12\x62\xea\xc8\x3e\x14", 8, GRND_NONBLOCK) = 8
[pid  4065] mkdir("./syzkaller.JYwfCX", 0700 <unfinished ...>
[pid  4029] <... read resumed>, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00", 21347228) = 56
[pid  4029] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x14\x38\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0d\x00\x00\x00"..., 192) = 192
[pid  4029] read(6, 0x17678d500000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4029] epoll_pwait(4, [], 128, 0, NULL, 0) = 0
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=750791128} <unfinished ...>
[pid  4065] <... mkdir resumed>)        = 0
[pid  4065] chmod("./syzkaller.JYwfCX", 0777) = 0
[pid  4065] chdir("./syzkaller.JYwfCX") = 0
[pid  4065] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
[pid  4065] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
[pid  4065] rt_sigaction(SIGSEGV, {sa_handler=0x7f187c8f2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f187c9de1d0}, NULL, 8) = 0
[pid  4065] rt_sigaction(SIGBUS, {sa_handler=0x7f187c8f2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f187c9de1d0}, NULL, 8) = 0
[pid  4065] getpid()                    = 4065
[pid  4065] mmap(0x1b31d20000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0) = 0x1b31d20000
[pid  4065] getpid()                    = 4065
[pid  4065] mmap(0x1b32d24000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0) = 0x1b32d24000
[pid  4065] close(3)                    = 0
[pid  4065] fcntl(5, F_GETFD)           = -1 EBADF (Bad file descriptor)
[pid  4065] fcntl(6, F_GETFD)           = -1 EBADF (Bad file descriptor)
[pid  4065] dup2(0, 249)                = 249
[pid  4065] dup2(1, 248)                = 248
[pid  4065] dup2(2, 1/strace: Process 4066 attached
)                  = 1
[pid  4065] dup2(2, 0)                  = 0
[pid  4065] read(249 <unfinished ...>
[pid  4054] <... clone resumed>, child_tidptr=0x555557b8d7d0) = 2
[pid  4066] set_robust_list(0x555557b8d7e0, 24 <unfinished ...>
[pid  4065] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\x78\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4054] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4066] <... set_robust_list resumed>) = 0
[pid  4065] unshare(CLONE_NEWPID <unfinished ...>
[pid  4054] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4066] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4065] <... unshare resumed>)      = 0
[pid  4065] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4065] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 4067 attached
 <unfinished ...>
[pid  4066] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4067] set_robust_list(0x55557fef97e0, 24 <unfinished ...>
[pid  4066] chdir("./0" <unfinished ...>
[pid  4065] <... clone resumed>, child_tidptr=0x55557fef97d0) = 4067
[pid  4067] <... set_robust_list resumed>) = 0
[pid  4065] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4067] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4066] <... chdir resumed>)        = 0
[pid  4065] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4067] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4066] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4067] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  4066] <... prctl resumed>)        = 0
[pid  4035] write(15, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4067] getppid()                   = 0
[pid  4066] setpgid(0, 0 <unfinished ...>
[pid  4050] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4035] <... write resumed>)        = 48
[pid  4067] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4035] read(26 <unfinished ...>
[pid  4067] <... openat resumed>)       = 3
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4050] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4067] dup2(3, 201 <unfinished ...>
[pid  4035] write(3, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x03\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00", 56 <unfinished ...>
[pid  4067] <... dup2 resumed>)         = 201
[pid  4067] close(3 <unfinished ...>
[pid  4050] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4067] <... close resumed>)        = 0
[pid  4050] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4067] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4035] <... write resumed>)        = 56
[pid  4029] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3f9a33f30c000002}], 128, 751, NULL, 0) = 1
/strace: Process 4068 attached
[pid  4067] <... prlimit64 resumed>, NULL) = 0
[pid  4066] <... setpgid resumed>)      = 0
[pid  4029] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4068] set_robust_list(0x55557ab1b7e0, 24 <unfinished ...>
[pid  4067] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024} <unfinished ...>
[pid  4068] <... set_robust_list resumed>) = 0
[pid  4067] <... prlimit64 resumed>, NULL) = 0
[pid  4029] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4067] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024} <unfinished ...>
[pid  4025] sched_yield( <unfinished ...>
[pid  4067] <... prlimit64 resumed>, NULL) = 0
[pid  4050] <... clone resumed>, child_tidptr=0x55557ab1b7d0) = 2
[pid  4067] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4050] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4068] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4067] <... prlimit64 resumed>, NULL) = 0
[pid  4029] read(6 <unfinished ...>
[pid  4068] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4067] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  4029] <... read resumed>, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x03\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00", 21347228) = 56
[pid  4067] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  4050] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4068] chdir("./0" <unfinished ...>
[pid  4067] unshare(CLONE_NEWNS <unfinished ...>
[pid  4029] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x20\x38\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0e\x00\x00\x00"..., 192 <unfinished ...>
[pid  4067] <... unshare resumed>)      = 0
[pid  4068] <... chdir resumed>)        = 0
[pid  4067] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4066] symlinkat("/syzcgroup/unified/syz0", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4029] <... write resumed>)        = 192
[pid  4067] <... mount resumed>)        = 0
[pid  4025] <... sched_yield resumed>)  = 0
[pid  4067] unshare(CLONE_NEWIPC <unfinished ...>
[pid  4068] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4067] <... unshare resumed>)      = 0
[pid  4029] read(6 <unfinished ...>
[pid  4068] <... prctl resumed>)        = 0
[pid  4029] <... read resumed>, 0x17678d500000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4068] setpgid(0, 0 <unfinished ...>
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4068] <... setpgid resumed>)      = 0
[pid  4067] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4029] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4068] symlinkat("/syzcgroup/unified/syz1", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4067] <... unshare resumed>)      = 0
[pid  4066] <... symlinkat resumed>)    = 0
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=678707460} <unfinished ...>
[pid  4067] unshare(CLONE_NEWUTS)       = 0
[pid  4068] <... symlinkat resumed>)    = 0
[pid  4068] symlinkat("/syzcgroup/cpu/syz1", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4066] symlinkat("/syzcgroup/cpu/syz0", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4067] unshare(CLONE_SYSVSEM)      = 0
[pid  4067] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  4067] write(3, "16777216", 8)     = 8
[pid  4067] close(3)                    = 0
[pid  4067] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  4067] write(3, "536870912", 9)    = 9
[pid  4067] close(3)                    = 0
[pid  4067] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4068] <... symlinkat resumed>)    = 0
[pid  4068] symlinkat("/syzcgroup/net/syz1", AT_FDCWD, "./cgroup.net" <unfinished ...>
[pid  4067] <... openat resumed>)       = 3
[pid  4066] <... symlinkat resumed>)    = 0
[pid  4067] write(3, "1024", 4 <unfinished ...>
[pid  4068] <... symlinkat resumed>)    = 0
[pid  4068] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4067] <... write resumed>)        = 4
[pid  4067] close(3)                    = 0
[pid  4067] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4068] <... openat resumed>)       = 3
[pid  4067] <... openat resumed>)       = 3
[pid  4067] write(3, "8192", 4)         = 4
[pid  4067] close(3)                    = 0
[pid  4067] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  4067] write(3, "1024", 4)         = 4
[pid  4067] close(3)                    = 0
[pid  4067] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[pid  4068] write(3, "1000", 4 <unfinished ...>
[pid  4066] symlinkat("/syzcgroup/net/syz0", AT_FDCWD, "./cgroup.net" <unfinished ...>
[pid  4035] write(25, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4068] <... write resumed>)        = 4
[pid  4066] <... symlinkat resumed>)    = 0
[pid  4067] write(3, "1024", 4 <unfinished ...>
[pid  4066] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4068] close(3 <unfinished ...>
[pid  4067] <... write resumed>)        = 4
[pid  4066] <... openat resumed>)       = 3
[pid  4067] close(3 <unfinished ...>
[pid  4066] write(3, "1000", 4 <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4067] <... close resumed>)        = 0
[pid  4051] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4035] <... write resumed>)        = 48
[pid  4068] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs" <unfinished ...>
[pid  4051] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] read(31 <unfinished ...>
[pid  4051] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4051] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4068] <... symlinkat resumed>)    = 0
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4067] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] write(3, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x04\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00", 56 <unfinished ...>
[pid  4068] close(249 <unfinished ...>
[pid  4067] <... openat resumed>)       = 3
[pid  4066] <... write resumed>)        = 4
[pid  4066] close(3)                    = 0
[pid  4067] write(3, "1024 1048576 500 1024", 21 <unfinished ...>
[pid  4066] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs" <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4067] <... write resumed>)        = 21
[pid  4066] <... symlinkat resumed>)    = 0
[pid  4035] <... write resumed>)        = 56
[pid  4029] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3f9a33f30c000002}], 128, 691, NULL, 0) = 1
[pid  4067] close(3 <unfinished ...>
[pid  4066] close(249 <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4066] <... close resumed>)        = 0
[pid  4067] getpid( <unfinished ...>
[pid  4066] close(248 <unfinished ...>
[pid  4067] <... getpid resumed>)       = 1
[pid  4068] close(248 <unfinished ...>
[pid  4066] <... close resumed>)        = 0
[pid  4029] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4067] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4066] prctl(PR_SET_NAME, "syz.0.1" <unfinished ...>
[pid  4029] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4068] prctl(PR_SET_NAME, "syz.1.2" <unfinished ...>
[pid  4067] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4066] <... prctl resumed>)        = 0
[pid  4068] <... prctl resumed>)        = 0
[pid  4067] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4066] mmap(0x1b31964000, 6029312, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0x40000 <unfinished ...>
[pid  4025] sched_yield(/strace: Process 4069 attached
 <unfinished ...>
[pid  4068] close(4 <unfinished ...>
[pid  4067] <... capset resumed>)       = 0
[pid  4029] read(6 <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4067] unshare(CLONE_NEWNET <unfinished ...>
[pid  4066] <... mmap resumed>)         = 0x1b31964000
[pid  4069] set_robust_list(0x5555805a97e0, 24 <unfinished ...>
[pid  4066] close(4 <unfinished ...>
[pid  4029] <... read resumed>, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x04\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00", 21347228) = 56
[pid  4066] <... close resumed>)        = 0
[pid  4069] <... set_robust_list resumed>) = 0
[pid  4066] futex(0x7fcb3b605fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4029] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x10\x38\x04\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0f\x00\x00\x00"..., 192 <unfinished ...>
[pid  4066] <... futex resumed>)        = 0
[pid  4069] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4066] rt_sigaction(SIGRT_1, {sa_handler=0x7fcb3b3ac3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fcb3b32e1d0}, NULL, 8) = 0
[pid  4051] <... clone resumed>, child_tidptr=0x5555805a97d0) = 2
[pid  4025] <... sched_yield resumed>)  = 0
[pid  4069] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4066] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4051] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4029] <... write resumed>)        = 192
[pid  4069] chdir("./0" <unfinished ...>
[pid  4066] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4051] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4066] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4029] read(6 <unfinished ...>
[pid  4066] <... mmap resumed>)         = 0x7fcb391c1000
[pid  4066] mprotect(0x7fcb391c2000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4069] <... chdir resumed>)        = 0
[pid  4066] <... mprotect resumed>)     = 0
[pid  4029] <... read resumed>, 0x17678d500000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4069] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4066] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4069] <... prctl resumed>)        = 0
[pid  4029] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4069] setpgid(0, 0 <unfinished ...>
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4069] <... setpgid resumed>)      = 0
[pid  4069] symlinkat("/syzcgroup/unified/syz3", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4066] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4066] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fcb391e1990, parent_tid=0x7fcb391e1990, exit_signal=0, stack=0x7fcb391c1000, stack_size=0x201c0, tls=0x7fcb391e16c0} <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=639342225}/strace: Process 4070 attached
 <unfinished ...>
[pid  4069] <... symlinkat resumed>)    = 0
[pid  4070] set_robust_list(0x7fcb391e19a0, 24 <unfinished ...>
[pid  4069] symlinkat("/syzcgroup/cpu/syz3", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4066] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4070] <... set_robust_list resumed>) = 0
[pid  4066] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4070] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4066] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4070] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4066] futex(0x7fcb3b605fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4070] ioctl(216, KCOV_ENABLE, 0 <unfinished ...>
[pid  4066] <... futex resumed>)        = 0
[pid  4070] <... ioctl resumed>)        = 0
[pid  4066] futex(0x7fcb3b605fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4070] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
[pid  4069] <... symlinkat resumed>)    = 0
[pid  4070] futex(0x7fcb3b605fac, FUTEX_WAKE_PRIVATE, 1000000) = 1
[pid  4066] <... futex resumed>)        = 0
[pid  4070] futex(0x7fcb3b605fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4069] symlinkat("/syzcgroup/net/syz3", AT_FDCWD, "./cgroup.net") = 0
[pid  4069] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  4069] write(3, "1000", 4)         = 4
[pid  4069] close(3)                    = 0
[pid  4069] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs") = 0
[pid  4067] <... unshare resumed>)      = 0
[pid  4066] futex(0x7fcb3b605fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4035] write(30, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4070] <... futex resumed>)        = 0
[pid  4066] <... futex resumed>)        = 1
[pid  4070] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4066] futex(0x7fcb3b605fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4070] <... mmap resumed>)         = 0x200000000000
[pid  4070] futex(0x7fcb3b605fac, FUTEX_WAKE_PRIVATE, 1000000) = 1
[pid  4066] <... futex resumed>)        = 0
[pid  4070] futex(0x7fcb3b605fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4069] close(249 <unfinished ...>
[pid  4066] futex(0x7fcb3b605fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4035] <... write resumed>)        = 48
[pid  4069] <... close resumed>)        = 0
[pid  4069] close(248 <unfinished ...>
[pid  4058] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4069] <... close resumed>)        = 0
[pid  4058] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4058] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4070] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4069] prctl(PR_SET_NAME, "syz.3.4" <unfinished ...>
[pid  4067] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4066] <... futex resumed>)        = 0
[pid  4035] pselect6(37, [3 11 13 16 18 26 28 31 33 34 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4069] <... prctl resumed>)        = 0
[pid  4067] <... openat resumed>)       = 3
[pid  4035] <... pselect6 resumed>)     = 1 (in [3], left {tv_sec=0, tv_nsec=999982856})
[pid  4070] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4066] futex(0x7fcb3b605fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4069] close(4 <unfinished ...>
[pid  4035] read(3 <unfinished ...>
[pid  4070] <... mmap resumed>)         = 0x200001000000
[pid  4069] <... close resumed>)        = 0
[pid  4067] write(3, "0 65535", 7 <unfinished ...>
[pid  4035] <... read resumed>, "\xbc\x00\x00\x00", 4) = 4
[pid  4067] <... write resumed>)        = 7
[pid  4035] read(3 <unfinished ...>
[pid  4067] close(3)                    = 0
[pid  4070] futex(0x7fcb3b605fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4067] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4070] <... futex resumed>)        = 1
[pid  4067] <... openat resumed>)       = 3
[pid  4066] <... futex resumed>)        = 0
[pid  4035] <... read resumed>, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x12\x39\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4070] futex(0x7fcb3b605fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4067] setns(201, 0 <unfinished ...>
[pid  4066] close_range(3, 30, 0 <unfinished ...>
[pid  4035] pselect6(37, [3 11 13 16 18 26 28 31 33 34 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4066] <... close_range resumed>)  = 0
[pid  4035] <... pselect6 resumed>)     = 1 (in [3], left {tv_sec=0, tv_nsec=999984760})
[pid  4067] <... setns resumed>)        = 0
[pid  4035] read(3 <unfinished ...>
[pid  4067] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 5
[pid  4066] exit_group(0 <unfinished ...>
[pid  4035] <... read resumed>, "\xbc\x00\x00\x00", 4) = 4
[pid  4070] <... futex resumed>)        = ?
[pid  4067] sendto(5, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x64\x65\x76\x6c\x69\x6e\x6b\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4066] <... exit_group resumed>)   = ?
/strace: Process 4072 attached
[pid  4070] +++ exited with 0 +++
[pid  4069] futex(0x7f0fc9785fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4068] futex(0x7f6358ae5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4067] <... sendto resumed>)       = 32
[pid  4035] read(3 <unfinished ...>
[pid  4072] set_robust_list(0x5555860de7e0, 24 <unfinished ...>
[pid  4058] <... clone resumed>, child_tidptr=0x5555860de7d0) = 2
[pid  4035] <... read resumed>, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x14\x38\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0d\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4072] <... set_robust_list resumed>) = 0
[pid  4069] <... futex resumed>)        = 0
[pid  4068] <... futex resumed>)        = 0
[pid  4067] recvfrom(5 <unfinished ...>
[pid  4058] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] pselect6(37, [3 11 13 16 18 26 28 31 33 34 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4072] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4067] <... recvfrom resumed>, [{nlmsg_len=1236, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x64\x65\x76\x6c\x69\x6e\x6b\x00\x06\x00\x01\x00\x16\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00\x78\x04\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x05\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 1236
[pid  4058] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] <... pselect6 resumed>)     = 1 (in [3], left {tv_sec=0, tv_nsec=999984555})
[pid  4072] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4069] rt_sigaction(SIGRT_1, {sa_handler=0x7f0fc952c3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0fc94ae1d0} <unfinished ...>
[pid  4068] rt_sigaction(SIGRT_1, {sa_handler=0x7f635888c3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f635880e1d0} <unfinished ...>
[pid  4066] +++ exited with 0 +++
[pid  4035] read(3 <unfinished ...>
[pid  4069] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4068] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4067] recvfrom(5 <unfinished ...>
[pid  4054] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
[pid  4035] <... read resumed>, "\xbc\x00\x00\x00", 4) = 4
[pid  4072] chdir("./0" <unfinished ...>
[pid  4069] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4068] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4067] <... recvfrom resumed>, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  4054] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4035] read(3 <unfinished ...>
[pid  4072] <... chdir resumed>)        = 0
[pid  4069] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4068] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4067] sendto(5, [{nlmsg_len=56, nlmsg_type=0x16 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x25\x00\x00\x00\x08\x00\x01\x00\x70\x63\x69\x00\x11\x00\x02\x00\x30\x30\x30\x30\x3a\x30\x30\x3a\x31\x30\x2e\x30\x00\x00\x00\x00\x08\x00\x8a\x00\x03\x00\x00\x00"], 56, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4072] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4069] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4068] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4054] <... rt_sigreturn resumed>) = 0
[pid  4035] <... read resumed>, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x20\x38\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4069] <... mmap resumed>)         = 0x7f0fc9347000
[pid  4068] <... mmap resumed>)         = 0x7f63586a7000
[pid  4067] <... sendto resumed>)       = 56
[pid  4035] pselect6(37, [3 11 13 16 18 26 28 31 33 34 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4072] <... prctl resumed>)        = 0
[pid  4069] mprotect(0x7f0fc9348000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4068] mprotect(0x7f63586a8000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4035] <... pselect6 resumed>)     = 1 (in [3], left {tv_sec=0, tv_nsec=999979865})
[pid  4072] setpgid(0, 0 <unfinished ...>
[pid  4069] <... mprotect resumed>)     = 0
[pid  4068] <... mprotect resumed>)     = 0
[pid  4035] read(3 <unfinished ...>
[pid  4072] <... setpgid resumed>)      = 0
[pid  4069] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4068] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] <... read resumed>, "\xbc\x00\x00\x00", 4) = 4
[pid  4072] symlinkat("/syzcgroup/unified/syz4", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4069] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4068] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] read(3, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x10\x38\x04\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4069] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0fc9367990, parent_tid=0x7f0fc9367990, exit_signal=0, stack=0x7f0fc9347000, stack_size=0x201c0, tls=0x7f0fc93676c0} <unfinished ...>
[pid  4035] pselect6(37, [3 11 13 16 18 26 28 31 33 34 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4068] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f63586c7990, parent_tid=0x7f63586c7990, exit_signal=0, stack=0x7f63586a7000, stack_size=0x201c0, tls=0x7f63586c76c0}/strace: Process 4076 attached
 <unfinished ...>
[pid  4069] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4067] recvfrom(5 <unfinished ...>
[pid  4054] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4076] set_robust_list(0x7f0fc93679a0, 24 <unfinished ...>
[pid  4072] <... symlinkat resumed>)    = 0
[pid  4069] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4067] <... recvfrom resumed>, [{nlmsg_len=76, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=56, nlmsg_type=0x16 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x25\x00\x00\x00\x08\x00\x01\x00\x70\x63\x69\x00\x11\x00\x02\x00\x30\x30\x30\x30\x3a\x30\x30\x3a\x31\x30\x2e\x30\x00\x00\x00\x00\x08\x00\x8a\x00\x03\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 76
[pid  4054] <... write resumed>)        = 4
[pid  4035] <... pselect6 resumed>)     = 1 (in [11], left {tv_sec=0, tv_nsec=997325780})
/strace: Process 4077 attached
[pid  4076] <... set_robust_list resumed>) = 0
[pid  4072] symlinkat("/syzcgroup/cpu/syz4", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4069] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4054] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] read(11 <unfinished ...>
[pid  4077] set_robust_list(0x7f63586c79a0, 24 <unfinished ...>
[pid  4076] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4067] close(5 <unfinished ...>
[pid  4054] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4077] <... set_robust_list resumed>) = 0
[pid  4076] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4069] futex(0x7f0fc9785fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4068] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4067] <... close resumed>)        = 0
[pid  4054] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4077] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4072] <... symlinkat resumed>)    = 0
[pid  4069] <... futex resumed>)        = 0
[pid  4068] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4067] setns(3, 0 <unfinished ...>
[pid  4054] <... openat resumed>)       = 3
[pid  4077] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4072] symlinkat("/syzcgroup/net/syz4", AT_FDCWD, "./cgroup.net" <unfinished ...>
[pid  4069] futex(0x7f0fc9785fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4068] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4067] <... setns resumed>)        = 0
[pid  4054] fstat(3 <unfinished ...>
[pid  4035] write(3, "\x24\x15\x02\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x18\x00\x0c\x00\x00\x00\x04\x00\x00\x00\x00\x00\x08\x00\x10\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x14\x00\x00\x00\x0c\x00\x00\x00\x40\x5a\x0a\x15"..., 136488 <unfinished ...>
[pid  4076] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4067] close(3)                    = 0
[pid  4054] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4067] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC <unfinished ...>
[pid  4054] getdents64(3 <unfinished ...>
[pid  4077] futex(0x7f6358ae5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4076] <... mmap resumed>)         = 0x1ffffffff000
[pid  4067] <... socket resumed>)       = 3
[pid  4054] <... getdents64 resumed>, 0x555557ba08c0 /* 6 entries */, 32768) = 176
[pid  4035] <... write resumed>)        = 136488
[pid  4029] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3f9a33f30c000002}], 128, 643, NULL, 0) = 1
[pid  4076] futex(0x7f0fc9785fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4067] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE <unfinished ...>
[pid  4068] futex(0x7f6358ae5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4077] <... futex resumed>)        = 0
[pid  4076] <... futex resumed>)        = 1
[pid  4072] <... symlinkat resumed>)    = 0
[pid  4068] <... futex resumed>)        = 1
[pid  4067] <... socket resumed>)       = 5
[pid  4054] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4077] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4076] futex(0x7f0fc9785fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4072] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4069] <... futex resumed>)        = 0
[pid  4068] futex(0x7f6358ae5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4067] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x64\x65\x76\x6c\x69\x6e\x6b\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4054] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] kill(4045, SIGKILL <unfinished ...>
[pid  4029] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4077] <... mmap resumed>)         = 0x1ffffffff000
[pid  4072] <... openat resumed>)       = 3
[pid  4069] futex(0x7f0fc9785fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4067] <... sendto resumed>)       = 32
[pid  4054] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4067] recvfrom(3 <unfinished ...>
[pid  4054] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4067] <... recvfrom resumed>, [{nlmsg_len=1236, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x64\x65\x76\x6c\x69\x6e\x6b\x00\x06\x00\x01\x00\x16\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00\x78\x04\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x05\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 1236
[pid  4077] futex(0x7f6358ae5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4076] <... futex resumed>)        = 0
[pid  4072] write(3, "1000", 4 <unfinished ...>
[pid  4069] <... futex resumed>)        = 1
[pid  4054] unlink("./0/binderfs" <unfinished ...>
[pid  4035] <... kill resumed>)         = 0
[pid  4029] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4077] <... futex resumed>)        = 1
[pid  4076] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4072] <... write resumed>)        = 4
[pid  4069] futex(0x7f0fc9785fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4068] <... futex resumed>)        = 0
[pid  4067] recvfrom(3 <unfinished ...>
[pid  4054] <... unlink resumed>)       = 0
[pid  4025] sched_yield( <unfinished ...>
[pid  4067] <... recvfrom resumed>, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  4054] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4077] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4076] <... mmap resumed>)         = 0x200000000000
[pid  4072] close(3 <unfinished ...>
[pid  4068] futex(0x7f6358ae5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4067] sendto(3, [{nlmsg_len=48, nlmsg_type=0x16 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x300, nlmsg_seq=0, nlmsg_pid=0}, "\x05\x00\x00\x00\x08\x00\x01\x00\x70\x63\x69\x00\x11\x00\x02\x00\x30\x30\x30\x30\x3a\x30\x30\x3a\x31\x30\x2e\x30\x00\x00\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4045] +++ killed by SIGKILL +++
[pid  4029] read(6 <unfinished ...>
[pid  4025] <... sched_yield resumed>)  = 0
[pid  4077] <... mmap resumed>)         = 0x200000000000
[pid  4076] futex(0x7f0fc9785fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4072] <... close resumed>)        = 0
[pid  4068] <... futex resumed>)        = 0
[pid  4067] <... sendto resumed>)       = 48
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4067] recvfrom(3 <unfinished ...>
[pid  4029] <... read resumed>, "\x24\x15\x02\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x18\x00\x0c\x00\x00\x00\x04\x00\x00\x00\x00\x00\x08\x00\x10\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x14\x00\x00\x00\x0c\x00\x00\x00\x40\x5a\x0a\x15"..., 21347228) = 136488
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4077] futex(0x7f6358ae5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4072] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs" <unfinished ...>
[pid  4068] futex(0x7f6358ae5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4067] <... recvfrom resumed>, [{nlmsg_len=20, nlmsg_type=NLMSG_DONE, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=0, nlmsg_pid=1}, -19], 4096, 0, NULL, NULL) = 20
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4045, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=13 /* 0.13 s */} ---
[pid  4077] <... futex resumed>)        = 0
[pid  4076] <... futex resumed>)        = 1
[pid  4072] <... symlinkat resumed>)    = 0
[pid  4069] <... futex resumed>)        = 0
[pid  4068] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4067] close(5 <unfinished ...>
[pid  4035] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4029] futex(0x17678927f160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4077] futex(0x7f6358ae5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4076] futex(0x7f0fc9785fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4072] close(249 <unfinished ...>
[pid  4069] futex(0x7f0fc9785fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4068] futex(0x7f6358ae5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4025] epoll_pwait(4, [], 128, 0, NULL, 0) = 0
[pid  4025] getpid( <unfinished ...>
[pid  4067] close(3 <unfinished ...>
[pid  4025] <... getpid resumed>)       = 4024
[pid  4025] tgkill(4024, 4029, SIGURG)  = 0
[pid  4077] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4072] <... close resumed>)        = 0
[pid  4069] <... futex resumed>)        = 0
[pid  4068] <... futex resumed>)        = 0
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... rt_sigreturn resumed>) = 4045
[pid  4077] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4076] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4072] close(248 <unfinished ...>
[pid  4069] futex(0x7f0fc9785fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4067] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4029] <... futex resumed>)        = 1
[pid  4027] <... futex resumed>)        = 0
[pid  4077] <... mmap resumed>)         = 0x200001000000
[pid  4072] <... close resumed>)        = 0
[pid  4068] futex(0x7f6358ae5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4067] <... openat resumed>)       = 3
[pid  4076] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4029] --- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=4024, si_uid=0} ---
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4072] prctl(PR_SET_NAME, "syz.4.5" <unfinished ...>
[pid  4067] write(3, "100000", 6 <unfinished ...>
[pid  4035] pipe2( <unfinished ...>
[pid  4029] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4076] <... mmap resumed>)         = 0x200001000000
[pid  4072] <... prctl resumed>)        = 0
[pid  4067] <... write resumed>)        = 6
[pid  4025] getpid( <unfinished ...>
[pid  4067] close(3 <unfinished ...>
[pid  4025] <... getpid resumed>)       = 4024
[pid  4025] tgkill(4024, 4029, SIGURG <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4025] <... tgkill resumed>)       = 0
[pid  4067] <... close resumed>)        = 0
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp", 0777 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4035] <... pipe2 resumed>[20, 21], 0) = 0
[pid  4077] futex(0x7f6358ae5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4076] futex(0x7f0fc9785fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4072] mmap(0x1b31d64000, 6029312, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0x40000 <unfinished ...>
[pid  4068] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4029] <... rt_sigreturn resumed>) = 1
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4077] <... futex resumed>)        = 0
[pid  4076] <... futex resumed>)        = 1
[pid  4072] <... mmap resumed>)         = 0x1b31d64000
[pid  4069] <... futex resumed>)        = 0
[pid  4068] close_range(3, 30, 0 <unfinished ...>
[pid  4035] pipe2( <unfinished ...>
[pid  4029] --- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=4024, si_uid=0} ---
[pid  4077] futex(0x7f6358ae5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4072] close(4 <unfinished ...>
[pid  4068] <... close_range resumed>)  = 0
[pid  4067] mount("", "./syz-tmp", "tmpfs", 0, NULL <unfinished ...>
[pid  4029] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4076] futex(0x7f0fc9785fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4072] <... close resumed>)        = 0
[pid  4069] close_range(3, 30, 0 <unfinished ...>
[pid  4068] exit_group(0 <unfinished ...>
[pid  4067] <... mount resumed>)        = 0
[pid  4035] <... pipe2 resumed>[23, 29], 0) = 0
[pid  4029] <... rt_sigreturn resumed>) = 1
[pid  4077] <... futex resumed>)        = ?
[pid  4072] futex(0x7fbcc7395fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4069] <... close_range resumed>)  = 0
[pid  4068] <... exit_group resumed>)   = ?
[pid  4035] pipe2( <unfinished ...>
[pid  4077] +++ exited with 0 +++
[pid  4072] <... futex resumed>)        = 0
[pid  4069] exit_group(0 <unfinished ...>
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot", 0777 <unfinished ...>
[pid  4029] futex(0x17678927e960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4076] <... futex resumed>)        = ?
[pid  4069] <... exit_group resumed>)   = ?
[pid  4072] rt_sigaction(SIGRT_1, {sa_handler=0x7fbcc713c3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fbcc70be1d0} <unfinished ...>
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4035] <... pipe2 resumed>[35, 37], 0) = 0
[pid  4072] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4072] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot/dev", 0700 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4029] <... futex resumed>)        = 1
[pid  4026] <... futex resumed>)        = 0
[pid  4076] +++ exited with 0 +++
[pid  4072] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4068] +++ exited with 0 +++
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4029] futex(0x17678927f960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4026] read(6 <unfinished ...>
[pid  4072] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4067] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4072] <... mmap resumed>)         = 0x7fbcc5b4f000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4026] <... read resumed>, 0x17678d500000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4072] mprotect(0x7fbcc5b50000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4067] <... mount resumed>)        = 0
[pid  4072] <... mprotect resumed>)     = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4026] futex(0x17678927e960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot/proc", 0700 <unfinished ...>
[pid  4069] +++ exited with 0 +++
[pid  4072] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4072] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4072] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fbcc5b6f990, parent_tid=0x7fbcc5b6f990, exit_signal=0, stack=0x7fbcc5b4f000, stack_size=0x201c0, tls=0x7fbcc5b6f6c0} <unfinished ...>
[pid  4050] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
[pid  4067] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=257683233}/strace: Process 4084 attached
 <unfinished ...>
[pid  4051] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
[pid  4050] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4084] set_robust_list(0x7fbcc5b6f9a0, 24 <unfinished ...>
[pid  4072] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4051] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4050] <... rt_sigreturn resumed>) = -1 EINTR (Interrupted system call)
[pid  4084] <... set_robust_list resumed>) = 0
[pid  4072] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4067] <... mount resumed>)        = 0
[pid  4051] <... rt_sigreturn resumed>) = -1 EINTR (Interrupted system call)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4084] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4072] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4084] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4072] futex(0x7fbcc7395fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4051] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4050] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4084] ioctl(216, KCOV_ENABLE, 0 <unfinished ...>
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4051] <... write resumed>)        = 4
[pid  4050] <... write resumed>)        = 4
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4084] <... ioctl resumed>)        = 0
[pid  4072] <... futex resumed>)        = 0
[pid  4067] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4084] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4072] futex(0x7fbcc7395fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4067] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4051] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4050] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4084] <... mmap resumed>)         = 0x1ffffffff000
[pid  4051] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4050] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4084] futex(0x7fbcc7395fac, FUTEX_WAKE_PRIVATE, 1000000) = 1
[pid  4072] <... futex resumed>)        = 0
[pid  4067] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... openat resumed>)       = 3
[pid  4050] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4084] futex(0x7fbcc7395fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... mount resumed>)        = 0
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700) = 0
[pid  4051] fstat(3 <unfinished ...>
[pid  4050] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4050] fstat(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4067] <... mount resumed>)        = 0
[pid  4050] getdents64(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] getdents64(3 <unfinished ...>
[pid  4050] <... getdents64 resumed>, 0x55557ab2e8c0 /* 6 entries */, 32768) = 176
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... getdents64 resumed>, 0x5555805bc8c0 /* 6 entries */, 32768) = 176
[pid  4050] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... mount resumed>)        = 0
[pid  4051] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4050] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] unlink("./0/binderfs" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] <... unlink resumed>)       = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4050] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4050] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4072] futex(0x7fbcc7395fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4051] unlink("./0/binderfs" <unfinished ...>
[pid  4050] newfstatat(AT_FDCWD, "./0/cgroup.net" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... unlink resumed>)       = 0
[pid  4050] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4067] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4051] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4050] unlink("./0/cgroup.net" <unfinished ...>
[pid  4067] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4050] <... unlink resumed>)       = 0
[pid  4051] newfstatat(AT_FDCWD, "./0/cgroup.net" <unfinished ...>
[pid  4050] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4050] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4084] <... futex resumed>)        = 0
[pid  4072] <... futex resumed>)        = 1
[pid  4067] <... mount resumed>)        = 0
[pid  4051] unlink("./0/cgroup.net" <unfinished ...>
[pid  4050] newfstatat(AT_FDCWD, "./0/cgroup.cpu" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4084] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4051] <... unlink resumed>)       = 0
[pid  4050] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4084] <... mmap resumed>)         = 0x200000000000
[pid  4072] futex(0x7fbcc7395fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4051] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4050] unlink("./0/cgroup.cpu" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4084] futex(0x7fbcc7395fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4067] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4084] <... futex resumed>)        = 0
[pid  4084] futex(0x7fbcc7395fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4067] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4050] <... unlink resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] newfstatat(AT_FDCWD, "./0/cgroup.cpu" <unfinished ...>
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700 <unfinished ...>
[pid  4051] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4050] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] unlink("./0/cgroup.cpu" <unfinished ...>
[pid  4050] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4072] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4051] <... unlink resumed>)       = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4072] futex(0x7fbcc7395fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4051] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4050] newfstatat(AT_FDCWD, "./0/cgroup" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4084] <... futex resumed>)        = 0
[pid  4072] <... futex resumed>)        = 1
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4051] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4084] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700 <unfinished ...>
[pid  4051] newfstatat(AT_FDCWD, "./0/cgroup" <unfinished ...>
[pid  4050] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4050] unlink("./0/cgroup" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] unlink("./0/cgroup" <unfinished ...>
[pid  4050] <... unlink resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4072] futex(0x7fbcc7395fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4084] <... mmap resumed>)         = 0x200001000000
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4051] <... unlink resumed>)       = 0
[pid  4050] getdents64(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] <... getdents64 resumed>, 0x55557ab2e8c0 /* 0 entries */, 32768) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4084] futex(0x7fbcc7395fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4072] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4051] getdents64(3 <unfinished ...>
[pid  4050] close(3 <unfinished ...>
[pid  4084] <... futex resumed>)        = 0
[pid  4067] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4051] <... getdents64 resumed>, 0x5555805bc8c0 /* 0 entries */, 32768) = 0
[pid  4050] unlinkat(AT_FDCWD, "./0", AT_REMOVEDIR <unfinished ...>
[pid  4067] <... mount resumed>)        = 0
[pid  4051] close(3 <unfinished ...>
[pid  4050] <... unlinkat resumed>)     = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4084] futex(0x7fbcc7395fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4067] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4050] mkdirat(AT_FDCWD, "./1", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] unlinkat(AT_FDCWD, "./0", AT_REMOVEDIR <unfinished ...>
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4072] close_range(3, 30, 0 <unfinished ...>
[pid  4067] <... mount resumed>)        = 0
[pid  4051] <... unlinkat resumed>)     = 0
[pid  4067] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] mkdirat(AT_FDCWD, "./1", 0777 <unfinished ...>
[pid  4072] <... close_range resumed>)  = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4072] exit_group(0 <unfinished ...>
[pid  4067] <... mount resumed>)        = 0
[pid  4051] <... mkdirat resumed>)      = 0
[pid  4084] <... futex resumed>)        = ?
[pid  4072] <... exit_group resumed>)   = ?
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4084] +++ exited with 0 +++
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] openat(AT_FDCWD, "/dev/loop3", O_RDWR <unfinished ...>
[pid  4050] openat(AT_FDCWD, "/dev/loop1", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4051] <... openat resumed>)       = 3
[pid  4050] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4051] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] close(3 <unfinished ...>
[pid  4050] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... pivot_root resumed>)   = 0
[pid  4051] <... close resumed>)        = 0
[pid  4067] chdir("/" <unfinished ...>
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... chdir resumed>)        = 0
[pid  4067] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4051] <... socket resumed>)       = 3
[pid  4050] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... close resumed>)        = 0
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... socket resumed>)       = 3
[pid  4050] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... umount2 resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] chroot("./newroot" <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4050] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... chroot resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] chdir("/" <unfinished ...>
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... chdir resumed>)        = 0
[pid  4051] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... close resumed>)        = 0
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4050] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4051] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] close(3 <unfinished ...>
[pid  4067] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4051] <... socket resumed>)       = 3
[pid  4050] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] +++ killed by SIGKILL +++
[pid  4051] close(3 <unfinished ...>
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... close resumed>)        = 0
[pid  4050] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] read(249 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] <... close resumed>)        = 0
[pid  4050] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] read(249 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4072] +++ exited with 0 +++
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=1 /* 0.01 s */, si_stime=3 /* 0.03 s */} ---
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... rt_sigreturn resumed>) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4058] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
[pid  4058] fstat(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] getdents64(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... getdents64 resumed>, 0x5555860f18c0 /* 6 entries */, 32768) = 176
[pid  4058] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4058] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] unlink("./0/binderfs" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... unlink resumed>)       = 0
[pid  4058] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4058] newfstatat(AT_FDCWD, "./0/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4058] unlink("./0/cgroup.net" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... unlink resumed>)       = 0
[pid  4058] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4058] newfstatat(AT_FDCWD, "./0/cgroup.cpu" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4058] unlink("./0/cgroup.cpu")    = 0
[pid  4058] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4058] newfstatat(AT_FDCWD, "./0/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4058] unlink("./0/cgroup" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... unlink resumed>)       = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] getdents64(3, 0x5555860f18c0 /* 0 entries */, 32768) = 0
[pid  4058] close(3)                    = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] unlinkat(AT_FDCWD, "./0", AT_REMOVEDIR) = 0
[pid  4067] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4058] mkdirat(AT_FDCWD, "./1", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] mkdirat(AT_FDCWD, "/dev/binderfs", 0777) = -1 EEXIST (File exists)
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4067] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4058] openat(AT_FDCWD, "/dev/loop4", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... openat resumed>)       = 3
[pid  4058] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4058] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] read(249 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] getpid( <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getpid resumed>)       = 1
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz2", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] openat(AT_FDCWD, "/syzcgroup/unified/syz2/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] write(3, "32", 2 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... write resumed>)        = 2
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] openat(AT_FDCWD, "/syzcgroup/unified/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] write(3, "1", 1 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... write resumed>)        = 1
[pid  4067] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz2", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... openat resumed>)       = 3
[pid  4067] write(3, "1", 1 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... write resumed>)        = 1
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4067] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] write(3, "313524224", 9 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... write resumed>)        = 9
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] write(3, "314572800", 9 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... write resumed>)        = 9
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] mkdirat(AT_FDCWD, "/syzcgroup/net/syz2", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4067] openat(AT_FDCWD, "/syzcgroup/net/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] write(3, "1", 1 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... write resumed>)        = 1
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4027] <... epoll_pwait resumed>, [], 128, 295, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4067] <... getsockopt resumed>, 0x7f187cc873e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4067] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4027] futex(0x17678927e960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc87a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4027] <... futex resumed>)        = 1
[pid  4026] <... futex resumed>)        = 0
[pid  4067] <... getsockopt resumed>, 0x7f187cc880e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4067] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4026] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4026] write(5, "\x01\x00\x00\x00\x00\x00\x00\x00", 8 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4026] <... write resumed>)        = 8
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=54069954} <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN, data=0x33dbe88}], 128, 9991, NULL, 0) = 1
[pid  4067] <... close resumed>)        = 0
[pid  4026] futex(0x17678927e960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4027] read(5 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4027] <... read resumed>, "\x01\x00\x00\x00\x00\x00\x00\x00", 8) = 8
[pid  4067] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4067] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc88768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc8afc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc8b688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4067] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... getsockopt resumed>, 0x7f187cc8bd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc8c408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc8cac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4067] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... socket resumed>)       = 3
[pid  4067] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc88e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... getsockopt resumed>, 0x7f187cc894c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc89b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc8a248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc8a908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 51, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4027] futex(0x17678927e960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4027] <... futex resumed>)        = 1
[pid  4026] <... futex resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4027] futex(0x17678927f160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=993749557} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] openat(AT_FDCWD, "/dev/loop2", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... socket resumed>)       = 3
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] read(249 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe0c2aaf000
[pid  4035] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4035] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7fe0c2aaf000, stack_size=0x9000}, 88/strace: Process 4087 attached
 <unfinished ...>
[pid  4087] rt_sigprocmask(SIG_BLOCK, NULL, ~[KILL STOP], 8) = 0
[pid  4087] setpgid(0, 0)               = 0
[pid  4087] dup2(20, 0)                 = 0
[pid  4087] dup2(29, 1)                 = 1
[pid  4087] dup2(37, 2)                 = 2
[pid  4087] dup2(7, 3)                  = 3
[pid  4087] dup2(8, 4)                  = 4
[pid  4087] close(5)                    = 0
[pid  4087] close(6)                    = 0
[pid  4087] close(7)                    = 0
[pid  4087] close(8)                    = 0
[pid  4087] close(9)                    = 0
[pid  4087] close(10)                   = 0
[pid  4087] close(11)                   = 0
[pid  4087] close(12)                   = 0
[pid  4087] close(13)                   = 0
[pid  4087] close(14)                   = 0
[pid  4087] close(15)                   = 0
[pid  4087] close(16)                   = 0
[pid  4087] close(17)                   = 0
[pid  4087] close(18)                   = 0
[pid  4087] close(19)                   = 0
[pid  4087] close(20)                   = 0
[pid  4087] close(21)                   = 0
[pid  4087] close(22)                   = 0
[pid  4087] close(23)                   = 0
[pid  4087] close(24)                   = 0
[pid  4087] close(25)                   = 0
[pid  4087] close(26)                   = 0
[pid  4087] close(27)                   = 0
[pid  4087] close(28)                   = 0
[pid  4087] close(29)                   = 0
[pid  4087] close(30)                   = 0
[pid  4087] close(31)                   = 0
[pid  4087] close(32)                   = 0
[pid  4087] close(33)                   = 0
[pid  4087] close(34)                   = 0
[pid  4087] close(35)                   = 0
[pid  4087] close(36)                   = 0
[pid  4087] close(37)                   = 0
[pid  4087] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4087] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] close(39)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(40)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(44)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(45)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(46)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(47)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(48)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(49)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(50)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(51)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(52)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(53)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(54)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(55)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(56)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(57)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(58)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(59)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(60)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(61)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(62)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(63 <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 994, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4026] futex(0x17678927f160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] <... futex resumed>)        = 0
[pid  4026] <... futex resumed>)        = 1
[pid  4025] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4087] close(64 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4025] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4087] close(65 <unfinished ...>
[pid  4027] futex(0x17678927f160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4087] close(66 <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=988542420} <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4087] close(67)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(68)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(70)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(71)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(72)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(75)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(76)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(77)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(79)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(80)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(81)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(82)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(84)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(85)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(86)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(87)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(88)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(89)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(90)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(92)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(93)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(94)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(95)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(96)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(98)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(99)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(102)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(104)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(106)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(110)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(118)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(119)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(120)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(129)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(130)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(134)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(135)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(142)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(154)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(155)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(158)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(163)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(164)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(168)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(169)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(182 <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 989, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4087] close(183 <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4087] close(184 <unfinished ...>
[pid  4026] futex(0x17678927f160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] <... futex resumed>)        = 0
[pid  4026] <... futex resumed>)        = 1
[pid  4087] close(185)                  = -1 EBADF (Bad file descriptor)
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4087] close(186 <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4026] futex(0x17678927e960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4087] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=989255961} <unfinished ...>
[pid  4087] close(188)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(189)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(190)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(191)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(194)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(195)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(196)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(200)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(202)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(204)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(205)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(206)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(207)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(208)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(209)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(210)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(211)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(213)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(214)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(215)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(216)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(217)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(218)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(219)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(220)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(223)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(224)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(225)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(228)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(229)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(230)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(231)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(232)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(233)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(234)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(235)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(236)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(237)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(240)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(241)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(244)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(245)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(246)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(247)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(248)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(251)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(252)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(253)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4087] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4087] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffedff15880 /* 2 vars */ <unfinished ...>
[pid  4035] <... clone3 resumed>)       = 4087
[pid  4035] munmap(0x7fe0c2aaf000, 36864 <unfinished ...>
[pid  4087] <... execve resumed>)       = 0
[pid  4035] <... munmap resumed>)       = 0
[pid  4035] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4035] fcntl(23, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(23, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] fcntl(35, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(35, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] close(20)                   = 0
[pid  4035] close(29)                   = 0
[pid  4035] close(37)                   = 0
[pid  4035] close(10)                   = 0
[pid  4087] brk(NULL <unfinished ...>
[pid  4035] close(11 <unfinished ...>
[pid  4087] <... brk resumed>)          = 0x55558d566000
[pid  4087] brk(0x55558d566e80)         = 0x55558d566e80
[pid  4035] <... close resumed>)        = 0
[pid  4087] arch_prctl(ARCH_SET_FS, 0x55558d566500 <unfinished ...>
[pid  4035] close(13 <unfinished ...>
[pid  4087] <... arch_prctl resumed>)   = 0
[pid  4035] <... close resumed>)        = 0
[pid  4035] write(21, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\xb8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64 <unfinished ...>
[pid  4087] set_tid_address(0x55558d5667d0) = 4087
[pid  4035] <... write resumed>)        = 64
[pid  4035] pselect6(37, [3 16 18 23 26 28 31 33 34 35 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8}) = 4 (in [16 26 31 34], left {tv_sec=0, tv_nsec=999979701})
[pid  4035] read(16 <unfinished ...>
[pid  4087] set_robust_list(0x55558d5667e0, 24 <unfinished ...>
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4087] <... set_robust_list resumed>) = 0
[pid  4035] write(3, "\xb4\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x01\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 184 <unfinished ...>
[pid  4087] prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3f9a33f30c000002}], 128, 990, NULL, 0) = 1
[pid  4087] readlinkat(AT_FDCWD, "/proc/self/exe" <unfinished ...>
[pid  4035] <... write resumed>)        = 184
[pid  4027] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4087] <... readlinkat resumed>, "/syz-executor", 4096) = 13
[pid  4035] kill(4046, SIGKILL)         = 0
[pid  4087] getrandom( <unfinished ...>
[pid  4027] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4087] <... getrandom resumed>"\x26\x2f\x92\x88\xa0\xdc\x9e\x28", 8, GRND_NONBLOCK) = 8
[pid  4087] brk(NULL)                   = 0x55558d566e80
[pid  4087] brk(0x55558d587e80 <unfinished ...>
[pid  4025] sched_yield( <unfinished ...>
[pid  4087] <... brk resumed>)          = 0x55558d587e80
[pid  4087] brk(0x55558d588000)         = 0x55558d588000
[pid  4027] read(6 <unfinished ...>
[pid  4087] mprotect(0x7f0c2b159000, 1236992, PROT_READ <unfinished ...>
[pid  4027] <... read resumed>, "\xb4\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x01\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 21347228) = 184
[pid  4027] futex(0x17678927e960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4087] <... mprotect resumed>)     = 0
[pid  4027] <... futex resumed>)        = 1
[pid  4027] read(6 <unfinished ...>
[pid  4026] <... futex resumed>)        = 0
[pid  4046] +++ killed by SIGKILL +++
[pid  4027] <... read resumed>, 0x17678d500000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4026] write(5, "\x01\x00\x00\x00\x00\x00\x00\x00", 8 <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN, data=0x33dbe88}], 128, 7244, NULL, 0) = 1
[pid  4026] <... write resumed>)        = 8
[pid  4050] <... read resumed> <unfinished ...>) = ?
[pid  4027] read(5 <unfinished ...>
[pid  4026] futex(0x17678927e960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4087] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4046, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=2 /* 0.02 s */} ---
[pid  4027] <... read resumed>, "\x01\x00\x00\x00\x00\x00\x00\x00", 8) = 8
[pid  4025] <... sched_yield resumed>)  = 0
[pid  4035] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4087] <... prctl resumed>)        = 0
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4087] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4087] <... mmap resumed>)         = 0x1ffffffff000
[pid  4087] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200000000000
[pid  4035] <... rt_sigreturn resumed>) = 4046
[pid  4025] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4087] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4035] pipe2( <unfinished ...>
[pid  4025] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4087] <... mmap resumed>)         = 0x200001000000
[pid  4087] rt_sigaction(SIGCHLD, {sa_handler=0x7f0c2aef0780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f0c2afde1d0}, NULL, 8) = 0
[pid  4087] pkey_alloc(0, PKEY_UNRESTRICTED) = -1 EINVAL (Invalid argument)
[pid  4087] getrandom( <unfinished ...>
[pid  4035] <... pipe2 resumed>[10, 11], 0) = 0
[pid  4087] <... getrandom resumed>"\x1c\x7e\xdc\xba\x57\x99\x15\x1a", 8, GRND_NONBLOCK) = 8
[pid  4087] mkdir("./syzkaller.6xqM0E", 0700) = 0
[pid  4035] pipe2( <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=313797104} <unfinished ...>
[pid  4087] chmod("./syzkaller.6xqM0E", 0777 <unfinished ...>
[pid  4035] <... pipe2 resumed>[13, 20], 0) = 0
[pid  4087] <... chmod resumed>)        = 0
[pid  4035] pipe2( <unfinished ...>
[pid  4087] chdir("./syzkaller.6xqM0E" <unfinished ...>
[pid  4035] <... pipe2 resumed>[29, 37], 0) = 0
[pid  4087] <... chdir resumed>)        = 0
[pid  4087] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4087] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] +++ killed by SIGKILL +++
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] rt_sigaction(SIGSEGV, {sa_handler=0x7f0c2aef2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f0c2afde1d0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] rt_sigaction(SIGBUS, {sa_handler=0x7f0c2aef2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f0c2afde1d0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4087] getpid( <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... getpid resumed>)       = 4087
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] mmap(0x1b33320000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... mmap resumed>)         = 0x1b33320000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] getpid( <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... getpid resumed>)       = 4087
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] mmap(0x1b34324000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... mmap resumed>)         = 0x1b34324000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] fcntl(5, F_GETFD <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] fcntl(6, F_GETFD <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] dup2(0, 249 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... dup2 resumed>)         = 249
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] dup2(1, 248 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... dup2 resumed>)         = 248
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] dup2(2, 1 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... dup2 resumed>)         = 1
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] dup2(2, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... dup2 resumed>)         = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] read(249 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\xb8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] unshare(CLONE_NEWPID <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... unshare resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
/strace: Process 4088 attached
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] set_robust_list(0x55558d5667e0, 24 <unfinished ...>
[pid  4087] <... clone resumed>, child_tidptr=0x55558d5667d0) = 4088
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4088] <... set_robust_list resumed>) = 0
[pid  4087] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] openat(AT_FDCWD, "/dev/vhci", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] write(2, "SYZFAIL: open /dev/vhci failed\n", 31 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... write resumed>)        = 31
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] write(2, " (errno 2: No such file or directory)\n", 38 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... write resumed>)        = 38
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] exit_group(67 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... exit_group resumed>)   = ?
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] +++ exited with 67 +++
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4088, si_uid=0, si_status=67, si_utime=0, si_stime=1 /* 0.01 s */} ---
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... rt_sigreturn resumed>) = 4088
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] write(2, "loop exited with status 67\n", 27 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... write resumed>)        = 27
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] write(248, "\x43\x00\x00\x00", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] exit_group(67 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... exit_group resumed>)   = ?
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] +++ exited with 67 +++
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4087, si_uid=0, si_status=67, si_utime=0, si_stime=3 /* 0.03 s */} ---
[pid  4035] rt_sigreturn({mask=[]})     = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 317, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4027] futex(0x17678927e960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4026] <... futex resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4027] <... futex resumed>)        = 1
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4026] futex(0x17678927e960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=978955122} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4035] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 979, NULL, 0) = 0
[pid  4025] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4035] <... mmap resumed>)         = 0x7fe0c2aaf000
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4025] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4035] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4035] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4027] futex(0x17678927e960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4035] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7fe0c2aaf000, stack_size=0x9000}, 88 <unfinished ...>
[pid  4027] <... futex resumed>)        = 1
[pid  4026] <... futex resumed>)        = 0
[pid  4026] epoll_pwait(4/strace: Process 4089 attached
 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4089] rt_sigprocmask(SIG_BLOCK, NULL <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4026] write(5, "\x01\x00\x00\x00\x00\x00\x00\x00", 8 <unfinished ...>
[pid  4089] <... rt_sigprocmask resumed>, ~[KILL STOP], 8) = 0
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN, data=0x33dbe88}], 128, 5922, NULL, 0) = 1
[pid  4026] <... write resumed>)        = 8
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=996547390} <unfinished ...>
[pid  4089] setpgid(0, 0 <unfinished ...>
[pid  4027] read(5 <unfinished ...>
[pid  4026] futex(0x17678927e960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4089] <... setpgid resumed>)      = 0
[pid  4027] <... read resumed>, "\x01\x00\x00\x00\x00\x00\x00\x00", 8) = 8
[pid  4089] dup2(10, 0 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4089] <... dup2 resumed>)         = 0
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4089] dup2(20, 1)                 = 1
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4089] dup2(37, 2)                 = 2
[pid  4089] dup2(9, 3)                  = 3
[pid  4089] dup2(12, 4)                 = 4
[pid  4089] close(5)                    = 0
[pid  4089] close(6)                    = 0
[pid  4089] close(7)                    = 0
[pid  4089] close(8)                    = 0
[pid  4089] close(9)                    = 0
[pid  4089] close(10)                   = 0
[pid  4089] close(11)                   = 0
[pid  4089] close(12)                   = 0
[pid  4089] close(13)                   = 0
[pid  4089] close(14)                   = 0
[pid  4089] close(15)                   = 0
[pid  4089] close(16)                   = 0
[pid  4089] close(17)                   = 0
[pid  4089] close(18)                   = 0
[pid  4089] close(19)                   = 0
[pid  4089] close(20)                   = 0
[pid  4089] close(21)                   = 0
[pid  4089] close(22)                   = 0
[pid  4089] close(23)                   = 0
[pid  4089] close(24)                   = 0
[pid  4089] close(25)                   = 0
[pid  4089] close(26)                   = 0
[pid  4089] close(27)                   = 0
[pid  4089] close(28)                   = 0
[pid  4089] close(29)                   = 0
[pid  4089] close(30)                   = 0
[pid  4089] close(31)                   = 0
[pid  4089] close(32)                   = 0
[pid  4089] close(33)                   = 0
[pid  4089] close(34)                   = 0
[pid  4089] close(35)                   = 0
[pid  4089] close(36)                   = 0
[pid  4089] close(37)                   = 0
[pid  4089] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4089] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] close(39)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(40)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(44)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(45)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(46)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(47)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(48)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(49)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(50)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(51)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(52)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(53)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(54)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(55)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(56)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(57)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(58)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(59)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(60)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(61)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(62)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(63)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(64)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(65)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(66)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(67)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(68)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(70)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(71)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(72)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(75)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(76)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(77)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(79)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(80)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(81)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(82)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(84)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(85)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(86)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(87)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(88)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(89)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(90)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(92)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(93)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(94)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(95)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(96)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(98)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(99)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(102)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(104)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(106)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(110)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(118 <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 996, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4025] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4089] close(119 <unfinished ...>
[pid  4027] futex(0x17678927e960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4025] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(120 <unfinished ...>
[pid  4027] <... futex resumed>)        = 1
[pid  4026] <... futex resumed>)        = 0
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4089] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4089] close(122 <unfinished ...>
[pid  4027] futex(0x17678927f160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=988260759} <unfinished ...>
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(129)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(130)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(134)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(135)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(142)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(154)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(155)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(158)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(163)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(164)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(168)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(169)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(182)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(183)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(184)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(185)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(186)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(188)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(189)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(190)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(191)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(194)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(195)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(196)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(200)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(202)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(204)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(205)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(206)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(207)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(208)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(209)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(210)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(211)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(213)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(214)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(215)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(216)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(217)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(218)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(219)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(220)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(223)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(224)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(225)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(228)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(229)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(230)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(231)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(232)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(233)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(234)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(235)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(236)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(237)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(240)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(241)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(244)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(245)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(246)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(247)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(248)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(251)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(252)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(253)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4089] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4089] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffedff15880 /* 2 vars */ <unfinished ...>
[pid  4035] <... clone3 resumed>)       = 4089
[pid  4089] <... execve resumed>)       = 0
[pid  4035] munmap(0x7fe0c2aaf000, 36864) = 0
[pid  4035] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4035] fcntl(13, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(13, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] fcntl(29, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(29, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] close(10)                   = 0
[pid  4035] close(20)                   = 0
[pid  4035] close(37)                   = 0
[pid  4035] close(15)                   = 0
[pid  4035] close(16)                   = 0
[pid  4035] close(18)                   = 0
[pid  4089] brk(NULL <unfinished ...>
[pid  4035] write(11, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\x3a\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64 <unfinished ...>
[pid  4089] <... brk resumed>)          = 0x555578548000
[pid  4035] <... write resumed>)        = 64
[pid  4089] brk(0x555578548e80 <unfinished ...>
[pid  4035] read(34, "\x00\x00\x00\x00", 4) = 4
[pid  4089] <... brk resumed>)          = 0x555578548e80
[pid  4035] write(3, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x02\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00", 56) = 56
[pid  4089] arch_prctl(ARCH_SET_FS, 0x555578548500 <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3f9a33f30c000002}], 128, 988, NULL, 0) = 1
[pid  4089] <... arch_prctl resumed>)   = 0
[pid  4089] set_tid_address(0x5555785487d0 <unfinished ...>
[pid  4026] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4089] <... set_tid_address resumed>) = 4089
[pid  4026] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4089] set_robust_list(0x5555785487e0, 24 <unfinished ...>
[pid  4026] read(6 <unfinished ...>
[pid  4025] sched_yield( <unfinished ...>
[pid  4089] <... set_robust_list resumed>) = 0
[pid  4026] <... read resumed>, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x02\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00", 21347228) = 56
[pid  4026] write(6, "\x84\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x44\x00\x38\x00\x30\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x40\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00\x02\x00\x00\x00"..., 136 <unfinished ...>
[pid  4025] <... sched_yield resumed>)  = 0
[pid  4089] prlimit64(0, RLIMIT_STACK, NULL <unfinished ...>
[pid  4026] <... write resumed>)        = 136
[pid  4089] <... prlimit64 resumed>, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4026] read(6 <unfinished ...>
[pid  4089] readlinkat(AT_FDCWD, "/proc/self/exe" <unfinished ...>
[pid  4026] <... read resumed>, 0x17678d500000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4089] <... readlinkat resumed>, "/syz-executor", 4096) = 13
[pid  4026] epoll_pwait(4, [], 128, 0, NULL, 0) = 0
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4089] getrandom("\x90\xdd\x37\xb6\x90\xe3\x0a\x0c", 8, GRND_NONBLOCK) = 8
[pid  4089] brk(NULL <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=89773009} <unfinished ...>
[pid  4089] <... brk resumed>)          = 0x555578548e80
[pid  4089] brk(0x555578569e80)         = 0x555578569e80
[pid  4089] brk(0x55557856a000)         = 0x55557856a000
[pid  4089] mprotect(0x7f1418469000, 1236992, PROT_READ) = 0
[pid  4089] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  4089] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x1ffffffff000
[pid  4089] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200000000000
[pid  4089] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200001000000
[pid  4089] rt_sigaction(SIGCHLD, {sa_handler=0x7f1418200780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f14182ee1d0}, NULL, 8) = 0
[pid  4089] pkey_alloc(0, PKEY_UNRESTRICTED) = -1 EINVAL (Invalid argument)
[pid  4089] getrandom("\x81\xf8\xcb\xa5\x65\xaa\xca\x2b", 8, GRND_NONBLOCK) = 8
[pid  4089] mkdir("./syzkaller.50io8K", 0700) = 0
[pid  4089] chmod("./syzkaller.50io8K", 0777 <unfinished ...>
[pid  4035] write(32, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4067] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4035] <... write resumed>)        = 48
[pid  4067] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] read(26 <unfinished ...>
[pid  4089] <... chmod resumed>)        = 0
[pid  4067] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4067] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4089] chdir("./syzkaller.50io8K") = 0
[pid  4089] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4035] write(3, "\xb4\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x03\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 184 <unfinished ...>
[pid  4089] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4089] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
[pid  4089] rt_sigaction(SIGSEGV, {sa_handler=0x7f1418202b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f14182ee1d0}, NULL, 8) = 0
[pid  4089] rt_sigaction(SIGBUS, {sa_handler=0x7f1418202b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f14182ee1d0}, NULL, 8) = 0
[pid  4089] getpid()                    = 4089
[pid  4089] mmap(0x1b33520000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0) = 0x1b33520000
[pid  4089] getpid(/strace: Process 4090 attached
 <unfinished ...>
[pid  4035] <... write resumed>)        = 184
[pid  4026] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3f9a33f30c000002}], 128, 101, NULL, 0) = 1
[pid  4090] set_robust_list(0x55557fef97e0, 24 <unfinished ...>
[pid  4089] <... getpid resumed>)       = 4089
[pid  4067] <... clone resumed>, child_tidptr=0x55557fef97d0) = 2
[pid  4035] kill(4048, SIGKILL <unfinished ...>
[pid  4026] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4090] <... set_robust_list resumed>) = 0
[pid  4089] mmap(0x1b34524000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0 <unfinished ...>
[pid  4067] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] <... kill resumed>)         = 0
[pid  4026] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4090] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4089] <... mmap resumed>)         = 0x1b34524000
[pid  4067] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4026] read(6 <unfinished ...>
[pid  4090] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4089] close(3 <unfinished ...>
[pid  4051] <... read resumed> <unfinished ...>) = ?
[pid  4048] +++ killed by SIGKILL +++
[pid  4026] <... read resumed>, "\xb4\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x03\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 21347228) = 184
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4090] chdir("./0" <unfinished ...>
[pid  4089] <... close resumed>)        = 0
[pid  4026] futex(0x17678927f160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4025] epoll_pwait(4, [], 128, 0, NULL, 0) = 0
[pid  4025] getpid()                    = 4024
[pid  4025] tgkill(4024, 4026, SIGURG)  = 0
[pid  4090] <... chdir resumed>)        = 0
[pid  4089] fcntl(5, F_GETFD <unfinished ...>
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4048, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=3 /* 0.03 s */} ---
[pid  4027] <... futex resumed>)        = 0
[pid  4026] <... futex resumed>)        = 1
[pid  4089] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] --- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=4024, si_uid=0} ---
[pid  4089] fcntl(6, F_GETFD <unfinished ...>
[pid  4035] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4090] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4089] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4026] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4090] <... prctl resumed>)        = 0
[pid  4089] dup2(0, 249 <unfinished ...>
[pid  4035] <... rt_sigreturn resumed>) = 4048
[pid  4026] <... rt_sigreturn resumed>) = 1
[pid  4089] <... dup2 resumed>)         = 249
[pid  4035] pipe2( <unfinished ...>
[pid  4090] setpgid(0, 0 <unfinished ...>
[pid  4089] dup2(1, 248 <unfinished ...>
[pid  4035] <... pipe2 resumed>[10, 15], 0) = 0
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] read(6 <unfinished ...>
[pid  4090] <... setpgid resumed>)      = 0
[pid  4026] <... read resumed>, 0x17678d500000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4089] <... dup2 resumed>)         = 248
[pid  4035] pipe2( <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4035] <... pipe2 resumed>[16, 18], 0) = 0
[pid  4089] dup2(2, 1 <unfinished ...>
[pid  4027] futex(0x17678927f160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=15615518} <unfinished ...>
[pid  4089] <... dup2 resumed>)         = 1
[pid  4089] dup2(2, 0 <unfinished ...>
[pid  4035] pipe2( <unfinished ...>
[pid  4089] <... dup2 resumed>)         = 0
[pid  4090] symlinkat("/syzcgroup/unified/syz2", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4089] read(249 <unfinished ...>
[pid  4035] <... pipe2 resumed>[20, 37], 0) = 0
[pid  4090] <... symlinkat resumed>)    = 0
[pid  4089] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\x3a\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] symlinkat("/syzcgroup/cpu/syz2", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] <... symlinkat resumed>)    = 0
[pid  4089] unshare(CLONE_NEWPID <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] symlinkat("/syzcgroup/net/syz2", AT_FDCWD, "./cgroup.net") = 0
[pid  4089] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4089] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] <... openat resumed>)       = 3
[pid  4089] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] write(3, "1000", 4 <unfinished ...>
[pid  4089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4090] <... write resumed>)        = 4
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs") = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] close(249 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] <... close resumed>)        = 0
[pid  4090] close(248 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] prctl(PR_SET_NAME, "syz.2.6" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
/strace: Process 4091 attached
[pid  4090] <... prctl resumed>)        = 0
[pid  4089] <... clone resumed>, child_tidptr=0x5555785487d0) = 4091
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] set_robust_list(0x5555785487e0, 24 <unfinished ...>
[pid  4090] close(4)                    = 0
[pid  4089] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] futex(0x7f187ccb5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4089] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4051] +++ killed by SIGKILL +++
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 15, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4091] <... set_robust_list resumed>) = 0
[pid  4091] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4090] <... futex resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4091] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4090] rt_sigaction(SIGRT_1, {sa_handler=0x7f187ca5c3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f187c9de1d0} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4091] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  4091] getppid()                   = 0
[pid  4091] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  4090] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4026] futex(0x17678927f160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4090] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4091] dup2(3, 201 <unfinished ...>
[pid  4090] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4027] <... futex resumed>)        = 0
[pid  4026] <... futex resumed>)        = 1
[pid  4091] <... dup2 resumed>)         = 201
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4091] close(3 <unfinished ...>
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4091] <... close resumed>)        = 0
[pid  4025] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4091] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4025] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4091] <... prlimit64 resumed>, NULL) = 0
[pid  4091] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  4091] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  4091] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid  4091] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  4091] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} <unfinished ...>
[pid  4090] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4091] <... prlimit64 resumed>, NULL) = 0
[pid  4090] <... mmap resumed>)         = 0x7f187c877000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4091] unshare(CLONE_NEWNS <unfinished ...>
[pid  4090] mprotect(0x7f187c878000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4026] futex(0x17678927e960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=956883279} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] <... mprotect resumed>)     = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4091] <... unshare resumed>)      = 0
[pid  4090] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4090] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f187c897990, parent_tid=0x7f187c897990, exit_signal=0, stack=0x7f187c877000, stack_size=0x201c0, tls=0x7f187c8976c0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
/strace: Process 4092 attached
[pid  4091] <... mount resumed>)        = 0
[pid  4090] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4091] unshare(CLONE_NEWIPC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4092] set_robust_list(0x7f187c8979a0, 24 <unfinished ...>
[pid  4091] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... set_robust_list resumed>) = 0
[pid  4090] futex(0x7f187ccb5fa8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid  4090] futex(0x7f187ccb5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4092] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4091] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4091] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
[pid  4091] unshare(CLONE_NEWUTS <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] futex(0x7f187ccb5fac, FUTEX_WAKE_PRIVATE, 1000000) = 1
[pid  4092] futex(0x7f187ccb5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4091] <... unshare resumed>)      = 0
[pid  4090] <... futex resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] futex(0x7f187ccb5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4091] unshare(CLONE_SYSVSEM <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... unshare resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] write(3, "16777216", 8 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... write resumed>)        = 8
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] <... futex resumed>)        = 1
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] <... futex resumed>)        = 0
[pid  4091] write(3, "536870912", 9 <unfinished ...>
[pid  4090] futex(0x7f187ccb5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4091] <... write resumed>)        = 9
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... mmap resumed>)         = 0x200000000000
[pid  4091] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] futex(0x7f187ccb5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4091] <... close resumed>)        = 0
[pid  4092] <... futex resumed>)        = 1
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4090] <... futex resumed>)        = 0
[pid  4092] futex(0x7f187ccb5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4091] <... openat resumed>)       = 3
[pid  4090] futex(0x7f187ccb5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4091] write(3, "1024", 4 <unfinished ...>
[pid  4090] <... futex resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] <... mmap resumed>)         = 0x200001000000
[pid  4091] <... write resumed>)        = 4
[pid  4090] futex(0x7f187ccb5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] futex(0x7f187ccb5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4091] close(3 <unfinished ...>
[pid  4090] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4092] <... futex resumed>)        = 0
[pid  4091] <... close resumed>)        = 0
[pid  4090] close_range(3, 30, 0 <unfinished ...>
[pid  4092] futex(0x7f187ccb5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4091] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] <... close_range resumed>)  = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... openat resumed>)       = 3
[pid  4090] exit_group(0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] write(3, "8192", 4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... futex resumed>)        = ?
[pid  4091] <... write resumed>)        = 4
[pid  4090] <... exit_group resumed>)   = ?
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] +++ exited with 0 +++
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... close resumed>)        = 0
[pid  4090] +++ exited with 0 +++
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4067] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... rt_sigreturn resumed>) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] write(3, "1024", 4 <unfinished ...>
[pid  4067] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... write resumed>)        = 4
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] close(3 <unfinished ...>
[pid  4067] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4067] fstat(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4067] getdents64(3, 0x55557ff0c900 /* 6 entries */, 32768) = 176
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... openat resumed>)       = 3
[pid  4067] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] write(3, "1024", 4 <unfinished ...>
[pid  4067] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... write resumed>)        = 4
[pid  4067] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] close(3 <unfinished ...>
[pid  4067] unlink("./0/binderfs" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... close resumed>)        = 0
[pid  4067] <... unlink resumed>)       = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4067] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] write(3, "1024 1048576 500 1024", 21 <unfinished ...>
[pid  4067] newfstatat(AT_FDCWD, "./0/cgroup.net" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... write resumed>)        = 21
[pid  4067] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] close(3 <unfinished ...>
[pid  4067] unlink("./0/cgroup.net" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... close resumed>)        = 0
[pid  4067] <... unlink resumed>)       = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] getpid( <unfinished ...>
[pid  4067] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... getpid resumed>)       = 1
[pid  4067] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4067] newfstatat(AT_FDCWD, "./0/cgroup.cpu" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4067] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... capset resumed>)       = 0
[pid  4067] unlink("./0/cgroup.cpu" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] unshare(CLONE_NEWNET <unfinished ...>
[pid  4067] <... unlink resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4067] newfstatat(AT_FDCWD, "./0/cgroup" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] unlink("./0/cgroup" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... unshare resumed>)      = 0
[pid  4067] <... unlink resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4067] getdents64(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... getdents64 resumed>, 0x55557ff0c900 /* 0 entries */, 32768) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] unlinkat(AT_FDCWD, "./0", AT_REMOVEDIR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... unlinkat resumed>)     = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... openat resumed>)       = 3
[pid  4067] mkdirat(AT_FDCWD, "./1", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] write(3, "0 65535", 7 <unfinished ...>
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... write resumed>)        = 7
[pid  4067] openat(AT_FDCWD, "/dev/loop2", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] close(3 <unfinished ...>
[pid  4067] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... close resumed>)        = 0
[pid  4067] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] newfstatat(AT_FDCWD, "/dev/net/tun" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... close resumed>)        = 0
[pid  4091] <... newfstatat resumed>, {st_mode=S_IFCHR|0666, st_rdev=makedev(0xa, 0xc8), ...}, 0) = 0
[pid  4067] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4091] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] read(249 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... openat resumed>)       = -1 ENODEV (No such device)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] write(2, "SYZFAIL: tun: can't open /dev/net/tun\n", 38) = 38
[pid  4091] write(2, " (errno 19: No such device)\n", 28) = 28
[pid  4091] exit_group(67)              = ?
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] +++ exited with 67 +++
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4091, si_uid=0, si_status=67, si_utime=0, si_stime=3 /* 0.03 s */} ---
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] <... rt_sigreturn resumed>) = 4091
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] write(2, "loop exited with status 67\n", 27 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] <... write resumed>)        = 27
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] write(248, "\x43\x00\x00\x00", 4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] exit_group(67 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] <... exit_group resumed>)   = ?
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] +++ exited with 67 +++
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4089, si_uid=0, si_status=67, si_utime=0, si_stime=5 /* 0.05 s */} ---
[pid  4035] rt_sigreturn({mask=[]})     = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe0c2aaf000
[pid  4035] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4035] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7fe0c2aaf000, stack_size=0x9000}, 88/strace: Process 4095 attached
 <unfinished ...>
[pid  4095] rt_sigprocmask(SIG_BLOCK, NULL, ~[KILL STOP], 8) = 0
[pid  4095] setpgid(0, 0)               = 0
[pid  4095] dup2(10, 0)                 = 0
[pid  4095] dup2(18, 1)                 = 1
[pid  4095] dup2(37, 2)                 = 2
[pid  4095] dup2(19, 3)                 = 3
[pid  4095] dup2(22, 4)                 = 4
[pid  4095] close(5)                    = 0
[pid  4095] close(6)                    = 0
[pid  4095] close(7)                    = 0
[pid  4095] close(8)                    = 0
[pid  4095] close(9)                    = 0
[pid  4095] close(10)                   = 0
[pid  4095] close(11)                   = 0
[pid  4095] close(12)                   = 0
[pid  4095] close(13)                   = 0
[pid  4095] close(14)                   = 0
[pid  4095] close(15)                   = 0
[pid  4095] close(16)                   = 0
[pid  4095] close(17)                   = 0
[pid  4095] close(18)                   = 0
[pid  4095] close(19)                   = 0
[pid  4095] close(20)                   = 0
[pid  4095] close(21)                   = 0
[pid  4095] close(22)                   = 0
[pid  4095] close(23)                   = 0
[pid  4095] close(24)                   = 0
[pid  4095] close(25)                   = 0
[pid  4095] close(26)                   = 0
[pid  4095] close(27)                   = 0
[pid  4095] close(28)                   = 0
[pid  4095] close(29)                   = 0
[pid  4095] close(30)                   = 0
[pid  4095] close(31)                   = 0
[pid  4095] close(32)                   = 0
[pid  4095] close(33)                   = 0
[pid  4095] close(34)                   = 0
[pid  4095] close(35)                   = 0
[pid  4095] close(36)                   = 0
[pid  4095] close(37)                   = 0
[pid  4095] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4095] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] close(39)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(40)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(44)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(45)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(46)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(47)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(48)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(49)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(50)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(51)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(52)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(53)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(54)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(55)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(56)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(57)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(58)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(59)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(60)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(61)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(62)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(63)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(64)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(65)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(66)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(67)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(68)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(70)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(71)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(72)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(75)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(76)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(77)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(79)                   = -1 EBADF (Bad file descriptor)
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4095] close(80)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(81)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(82)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(84)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(85)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(86)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(87)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(88)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(89)                   = -1 EBADF (Bad file descriptor)
[pid  4027] <... epoll_pwait resumed>, [], 128, 970, NULL, 0) = 0
[pid  4095] close(90 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4095] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4027] futex(0x17678927e960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4095] close(92 <unfinished ...>
[pid  4027] <... futex resumed>)        = 1
[pid  4026] <... futex resumed>)        = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4095] close(93 <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4026] write(5, "\x01\x00\x00\x00\x00\x00\x00\x00", 8 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN, data=0x33dbe88}], 128, 2905, NULL, 0) = 1
[pid  4026] <... write resumed>)        = 8
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=979530869} <unfinished ...>
[pid  4095] close(94 <unfinished ...>
[pid  4027] read(5 <unfinished ...>
[pid  4026] futex(0x17678927e960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] <... read resumed>, "\x01\x00\x00\x00\x00\x00\x00\x00", 8) = 8
[pid  4095] close(95 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4095] close(96 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(98)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(99)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(102)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(104)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(106)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(110)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(118)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(119)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(120)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(129)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(130)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(134)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(135)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(142)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(154)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(155)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(158)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(163)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(164)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(168)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(169)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(182)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(183)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(184)                  = -1 EBADF (Bad file descriptor)
 ReproducedFaultInjection:]

map[Index:codesearch-index]

gemini-3.1-pro-preview

You are an experienced Linux kernel developer tasked with debugging a kernel crash root cause.
You need to provide a detailed explanation of the root cause for another developer to be
able to write a fix for the bug based on your explanation. Include all relevant details
into the response: function/struct/field/etc names, code snippets, line numbers,
macro/enum values, etc.



Prefer calling several tools at the same time to save round-trips.

The crash is:

[pid  4051] <... mkdirat resumed>)      = 0
[pid  4050] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4047] <... setxattr resumed>)     = -1 EINVAL (Invalid argument)
[pid  4050] <... mount resumed>)        = 0
[pid  4047] write(2, "SYZFAIL: setfilecon: setxattr failed\n", 37 <unfinished ...>
[pid  4050] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4047] <... write resumed>)        = 37
[pid  4035] <... pselect6 resumed>)     = 1 (in [23], left {tv_sec=0, tv_nsec=779508080})
[pid  4051] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700 <unfinished ...>
[pid  4050] <... mount resumed>)        = 0
[pid  4047] write(2, " (errno 22: Invalid argument)\n", 30 <unfinished ...>
[pid  4051] <... mkdirat resumed>)      = 0
[pid  4035] read(23, "SYZFAIL: setfilecon: setxattr failed\n", 1024) = 37
[pid  4035] pselect6(34, [3 11 13 16 18 21 23 26 28 31 33], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4047] <... write resumed>)        = 30
[pid  4035] <... pselect6 resumed>)     = 1 (in [23], left {tv_sec=0, tv_nsec=999739390})
[pid  4035] read(23, " (errno 22: Invalid argument)\n", 1024) = 30
[pid  4035] pselect6(34, [3 11 13 16 18 21 23 26 28 31 33], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4050] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777) = 0
[pid  4051] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700) = 0
[pid  4047] exit_group(67)              = ?
[pid  4051] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4050] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4049] <... ioctl resumed>)        = 0
[pid  4050] <... pivot_root resumed>)   = 0
[pid  4050] chdir("/")                  = 0
[pid  4050] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4049] openat(AT_FDCWD, "/sys/kernel/debug/kcov", O_RDWR) = 3
[pid  4049] dup2(3, 215)                = 215
[pid  4049] close(3)                    = 0
[pid  4049] ioctl(215, KCOV_INIT_TRACE, 0x100000 <unfinished ...>
[pid  4051] <... mount resumed>)        = 0
/strace: Process 4054 attached
[pid  4050] <... umount2 resumed>)      = 0
[pid  4047] +++ exited with 67 +++
[pid  4035] <... pselect6 resumed>)     = 2 (in [21 23], left {tv_sec=0, tv_nsec=983078996})
[pid  4050] chroot("./newroot" <unfinished ...>
[pid  4045] <... clone resumed>, child_tidptr=0x555557b8d7d0) = 4054
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4047, si_uid=10999, si_status=67, si_utime=0, si_stime=4 /* 0.04 s */} ---
[pid  4050] <... chroot resumed>)       = 0
[pid  4035] rt_sigreturn({mask=[]})     = 2
[pid  4035] read(23 <unfinished ...>
[pid  4051] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] <... read resumed>, "", 1024) = 0
[pid  4051] <... mount resumed>)        = 0
[pid  4045] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] kill(4047, SIGKILL <unfinished ...>
[pid  4051] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4050] chdir("/" <unfinished ...>
[pid  4035] <... kill resumed>)         = 0
[pid  4054] set_robust_list(0x555557b8d7e0, 24 <unfinished ...>
[pid  4051] <... mount resumed>)        = 0
[pid  4050] <... chdir resumed>)        = 0
[pid  4045] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4054] <... set_robust_list resumed>) = 0
[pid  4051] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4050] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4049] <... ioctl resumed>)        = 0
[pid  4054] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] read(23 <unfinished ...>
[pid  4050] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] <... read resumed>, "", 1024) = 0
[pid  4050] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4054] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4051] <... mkdirat resumed>)      = 0
[pid  4049] mmap(NULL, 8396800, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4054] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4051] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4049] <... mmap resumed>)         = 0x7fbcc5b70000
[pid  4054] <... prctl resumed>)        = 0
[pid  4054] getppid( <unfinished ...>
[pid  4051] <... pivot_root resumed>)   = 0
[pid  4049] mmap(0x7fbcc5b71000, 8388608, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 215, 0 <unfinished ...>
[pid  4054] <... getppid resumed>)      = 0
[pid  4054] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4051] chdir("/" <unfinished ...>
[pid  4054] <... openat resumed>)       = 3
[pid  4051] <... chdir resumed>)        = 0
[pid  4054] dup2(3, 201 <unfinished ...>
[pid  4051] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4054] <... dup2 resumed>)         = 201
[pid  4054] close(3)                    = 0
[pid  4054] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4051] <... umount2 resumed>)      = 0
[pid  4054] <... prlimit64 resumed>, NULL) = 0
[pid  4051] chroot("./newroot" <unfinished ...>
[pid  4054] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  4051] <... chroot resumed>)       = 0
[pid  4054] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024} <unfinished ...>
[pid  4051] chdir("/" <unfinished ...>
[pid  4054] <... prlimit64 resumed>, NULL) = 0
[pid  4054] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4051] <... chdir resumed>)        = 0
[pid  4054] <... prlimit64 resumed>, NULL) = 0
[pid  4051] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4054] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} <unfinished ...>
[pid  4051] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4054] <... prlimit64 resumed>, NULL) = 0
[pid  4054] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} <unfinished ...>
[pid  4051] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4049] <... mmap resumed>)         = 0x7fbcc5b71000
[pid  4054] <... prlimit64 resumed>, NULL) = 0
[pid  4054] unshare(CLONE_NEWNS)        = 0
[pid  4049] unshare(CLONE_NEWPID)       = 0
[pid  4049] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4049] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4054] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid  4054] unshare(CLONE_NEWIPC)       = 0
[pid  4054] unshare(CLONE_NEWCGROUP)    = 0
[pid  4054] unshare(CLONE_NEWUTS)       = 0
[pid  4054] unshare(CLONE_SYSVSEM)      = 0
[pid  4054] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  4054] write(3, "16777216", 8)     = 8
[pid  4054] close(3)                    = 0
[pid  4054] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  4054] write(3, "536870912", 9)    = 9
[pid  4054] close(3)                    = 0
[pid  4054] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4050] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4054] <... openat resumed>)       = 3
[pid  4050] mkdirat(AT_FDCWD, "/dev/binderfs", 0777 <unfinished ...>
[pid  4054] write(3, "1024", 4)         = 4
[pid  4050] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4054] close(3 <unfinished ...>
[pid  4050] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4054] <... close resumed>)        = 0
[pid  4054] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
/strace: Process 4058 attached
[pid  4054] write(3, "8192", 4 <unfinished ...>
[pid  4049] <... clone resumed>, child_tidptr=0x5555860de7d0) = 4058
[pid  4054] <... write resumed>)        = 4
[pid  4054] close(3 <unfinished ...>
[pid  4049] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4058] set_robust_list(0x5555860de7e0, 24 <unfinished ...>
[pid  4054] <... close resumed>)        = 0
[pid  4049] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4058] <... set_robust_list resumed>) = 0
[pid  4054] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4058] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4054] <... openat resumed>)       = 3
[pid  4058] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  4054] write(3, "1024", 4 <unfinished ...>
[pid  4058] getppid( <unfinished ...>
[pid  4054] <... write resumed>)        = 4
[pid  4058] <... getppid resumed>)      = 0
[pid  4058] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  4058] dup2(3, 201)                = 201
[pid  4058] close(3)                    = 0
[pid  4058] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024}, NULL) = 0
[pid  4058] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  4058] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  4058] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4054] close(3 <unfinished ...>
[pid  4058] <... prlimit64 resumed>, NULL) = 0
[pid  4054] <... close resumed>)        = 0
[pid  4058] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  4058] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  4058] unshare(CLONE_NEWNS)        = 0
[pid  4054] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4058] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4054] <... openat resumed>)       = 3
[pid  4051] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4058] <... mount resumed>)        = 0
[pid  4058] unshare(CLONE_NEWIPC)       = 0
[pid  4054] write(3, "1024", 4 <unfinished ...>
[pid  4051] mkdirat(AT_FDCWD, "/dev/binderfs", 0777 <unfinished ...>
[pid  4058] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4054] <... write resumed>)        = 4
[pid  4054] close(3 <unfinished ...>
[pid  4051] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4058] <... unshare resumed>)      = 0
[pid  4054] <... close resumed>)        = 0
[pid  4051] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4054] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4058] unshare(CLONE_NEWUTS)       = 0
[pid  4058] unshare(CLONE_SYSVSEM)      = 0
[pid  4058] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  4054] <... openat resumed>)       = 3
[pid  4058] write(3, "16777216", 8 <unfinished ...>
[pid  4054] write(3, "1024 1048576 500 1024", 21 <unfinished ...>
[pid  4058] <... write resumed>)        = 8
[pid  4058] close(3)                    = 0
[pid  4058] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  4054] <... write resumed>)        = 21
[pid  4058] write(3, "536870912", 9 <unfinished ...>
[pid  4054] close(3 <unfinished ...>
[pid  4058] <... write resumed>)        = 9
[pid  4054] <... close resumed>)        = 0
[pid  4058] close(3 <unfinished ...>
[pid  4054] getpid( <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4054] <... getpid resumed>)       = 1
[pid  4058] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4054] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4058] <... openat resumed>)       = 3
[pid  4054] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4050] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4058] write(3, "1024", 4 <unfinished ...>
[pid  4054] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4050] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4058] <... write resumed>)        = 4
[pid  4058] close(3)                    = 0
[pid  4058] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
[pid  4054] <... capset resumed>)       = 0
[pid  4050] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4058] write(3, "8192", 4)         = 4
[pid  4050] getpid( <unfinished ...>
[pid  4054] unshare(CLONE_NEWNET <unfinished ...>
[pid  4058] close(3)                    = 0
[pid  4058] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  4058] write(3, "1024", 4)         = 4
[pid  4058] close(3)                    = 0
[pid  4058] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4050] <... getpid resumed>)       = 1
[pid  4058] <... openat resumed>)       = 3
[pid  4050] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4058] write(3, "1024", 4 <unfinished ...>
[pid  4050] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4058] <... write resumed>)        = 4
[pid  4050] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4050] <... capset resumed>)       = 0
[pid  4058] <... close resumed>)        = 0
[pid  4050] getpid( <unfinished ...>
[pid  4058] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3
[pid  4050] <... getpid resumed>)       = 1
[pid  4050] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz1", 0777 <unfinished ...>
[pid  4058] write(3, "1024 1048576 500 1024", 21) = 21
[pid  4058] close(3)                    = 0
[pid  4058] getpid()                    = 1
[pid  4058] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4058] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4058] unshare(CLONE_NEWNET <unfinished ...>
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4050] openat(AT_FDCWD, "/syzcgroup/unified/syz1/pids.max", O_WRONLY|O_CLOEXEC) = 3
[pid  4050] write(3, "32", 2)           = 2
[pid  4050] close(3)                    = 0
[pid  4050] openat(AT_FDCWD, "/syzcgroup/unified/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3
[pid  4050] write(3, "1", 1)            = 1
[pid  4050] close(3)                    = 0
[pid  4050] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz1", 0777 <unfinished ...>
[pid  4054] <... unshare resumed>)      = 0
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4051] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4050] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4051] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4050] <... openat resumed>)       = 3
[pid  4051] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4050] write(3, "1", 1)            = 1
[pid  4051] getpid( <unfinished ...>
[pid  4050] close(3 <unfinished ...>
[pid  4051] <... getpid resumed>)       = 1
[pid  4050] <... close resumed>)        = 0
[pid  4051] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz3", 0777 <unfinished ...>
[pid  4050] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4054] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4051] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4050] <... openat resumed>)       = 3
[pid  4054] <... openat resumed>)       = 3
[pid  4051] openat(AT_FDCWD, "/syzcgroup/unified/syz3/pids.max", O_WRONLY|O_CLOEXEC) = 3
[pid  4050] write(3, "313524224", 9 <unfinished ...>
[pid  4051] write(3, "32", 2 <unfinished ...>
[pid  4050] <... write resumed>)        = 9
[pid  4054] write(3, "0 65535", 7 <unfinished ...>
[pid  4051] <... write resumed>)        = 2
[pid  4050] close(3 <unfinished ...>
[pid  4054] <... write resumed>)        = 7
[pid  4051] close(3 <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4051] <... close resumed>)        = 0
[pid  4050] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4054] close(3 <unfinished ...>
[pid  4051] openat(AT_FDCWD, "/syzcgroup/unified/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4050] <... openat resumed>)       = 3
[pid  4054] <... close resumed>)        = 0
[pid  4051] <... openat resumed>)       = 3
[pid  4050] write(3, "314572800", 9 <unfinished ...>
[pid  4054] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4051] write(3, "1", 1 <unfinished ...>
[pid  4050] <... write resumed>)        = 9
[pid  4050] close(3)                    = 0
[pid  4050] mkdirat(AT_FDCWD, "/syzcgroup/net/syz1", 0777 <unfinished ...>
[pid  4054] <... openat resumed>)       = 3
[pid  4054] write(3, "100000", 6)       = 6
[pid  4051] <... write resumed>)        = 1
[pid  4054] close(3 <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4054] <... close resumed>)        = 0
[pid  4051] <... close resumed>)        = 0
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp", 0777) = 0
[pid  4051] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz3", 0777) = -1 EEXIST (File exists)
[pid  4051] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3
[pid  4051] write(3, "1", 1 <unfinished ...>
[pid  4054] mount("", "./syz-tmp", "tmpfs", 0, NULL) = 0
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot", 0777) = 0
[pid  4058] <... unshare resumed>)      = 0
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot/dev", 0700 <unfinished ...>
[pid  4051] <... write resumed>)        = 1
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4027] <... epoll_pwait resumed>, [], 128, 996, NULL, 0) = 0
[pid  4058] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] close(3 <unfinished ...>
[pid  4058] <... openat resumed>)       = 3
[pid  4054] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4050] openat(AT_FDCWD, "/syzcgroup/net/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4027] futex(0x17678927f960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4054] <... mount resumed>)        = 0
[pid  4051] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4050] <... openat resumed>)       = 3
[pid  4029] <... futex resumed>)        = 0
[pid  4027] <... futex resumed>)        = 1
[pid  4058] write(3, "0 65535", 7 <unfinished ...>
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot/proc", 0700 <unfinished ...>
[pid  4051] <... openat resumed>)       = 3
[pid  4050] write(3, "1", 1 <unfinished ...>
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4058] <... write resumed>)        = 7
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] write(3, "313524224", 9 <unfinished ...>
[pid  4050] <... write resumed>)        = 1
[pid  4029] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4058] close(3 <unfinished ...>
[pid  4054] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid  4051] <... write resumed>)        = 9
[pid  4050] close(3 <unfinished ...>
[pid  4029] futex(0x17678927f960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4058] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4058] <... openat resumed>)       = 3
[pid  4051] close(3 <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4025] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4025] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4058] write(3, "100000", 6 <unfinished ...>
[pid  4051] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4058] <... write resumed>)        = 6
[pid  4051] <... openat resumed>)       = 3
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4051] write(3, "314572800", 9 <unfinished ...>
[pid  4050] <... socket resumed>)       = 3
[pid  4058] <... close resumed>)        = 0
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp", 0777 <unfinished ...>
[pid  4054] <... mount resumed>)        = 0
[pid  4051] <... write resumed>)        = 9
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4050] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] <... close resumed>)        = 0
[pid  4051] mkdirat(AT_FDCWD, "/syzcgroup/net/syz3", 0777 <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7f6358ab73e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4054] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4050] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4058] mount("", "./syz-tmp", "tmpfs", 0, NULL <unfinished ...>
[pid  4054] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4051] openat(AT_FDCWD, "/syzcgroup/net/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7f6358ab7a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] <... mount resumed>)        = 0
[pid  4054] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... openat resumed>)       = 3
[pid  4050] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO, 0x7f6358ab80e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] close(3 <unfinished ...>
[pid  4054] <... mount resumed>)        = 0
[pid  4051] write(3, "1", 1 <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4051] <... write resumed>)        = 1
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot", 0777 <unfinished ...>
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] <... close resumed>)        = 0
[pid  4050] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot/dev", 0700 <unfinished ...>
[pid  4054] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7f6358ab8768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4054] <... mount resumed>)        = 0
[pid  4051] <... socket resumed>)       = 3
[pid  4050] close(3 <unfinished ...>
[pid  4058] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4054] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4058] <... mount resumed>)        = 0
[pid  4054] <... mount resumed>)        = 0
[pid  4051] <... getsockopt resumed>, 0x7f0fc97573e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot/proc", 0700 <unfinished ...>
[pid  4054] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4050] <... socket resumed>)       = 3
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4054] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4051] <... getsockopt resumed>, 0x7f0fc9757a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=975972050} <unfinished ...>
[pid  4058] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid  4054] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7f6358abafc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] <... mount resumed>)        = 0
[pid  4054] <... mount resumed>)        = 0
[pid  4051] <... getsockopt resumed>, 0x7f0fc97580e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4051] close(3)                    = 0
[pid  4050] <... getsockopt resumed>, 0x7f6358abb688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4051] <... socket resumed>)       = 3
[pid  4050] <... getsockopt resumed>, 0x7f6358abbd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4050] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] <... getsockopt resumed>, 0x7f0fc9758768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] <... getsockopt resumed>, 0x7f6358abc408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7f6358abcac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4054] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4050] close(3 <unfinished ...>
[pid  4058] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4054] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4050] <... close resumed>)        = 0
[pid  4058] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700 <unfinished ...>
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4058] <... mount resumed>)        = 0
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] <... socket resumed>)       = 3
[pid  4051] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4050] <... socket resumed>)       = 3
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid  4051] <... getsockopt resumed>, 0x7f0fc975afc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4050] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] <... getsockopt resumed>, 0x7f0fc975b688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700 <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7f6358ab8e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] <... mount resumed>)        = 0
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] <... getsockopt resumed>, 0x7f0fc975bd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7f6358ab94c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4051] <... getsockopt resumed>, 0x7f0fc975c408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] <... getsockopt resumed>, 0x7f6358ab9b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4051] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4050] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4058] <... mount resumed>)        = 0
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] <... getsockopt resumed>, 0x7f0fc975cac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] <... getsockopt resumed>, 0x7f6358aba248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4054] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4050] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4058] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4054] <... mount resumed>)        = 0
[pid  4051] <... close resumed>)        = 0
[pid  4058] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] <... getsockopt resumed>, 0x7f6358aba908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] <... mount resumed>)        = 0
[pid  4054] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... socket resumed>)       = 3
[pid  4050] close(3 <unfinished ...>
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4054] <... mount resumed>)        = 0
[pid  4050] <... close resumed>)        = 0
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4051] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4058] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4054] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... getsockopt resumed>, 0x7f0fc9758e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4058] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4054] <... mount resumed>)        = 0
[pid  4051] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4050] <... write resumed>)        = 4
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700) = 0
[pid  4054] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4051] <... getsockopt resumed>, 0x7f0fc97594c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4051] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700) = 0
[pid  4051] <... getsockopt resumed>, 0x7f0fc9759b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4054] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4051] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4050] openat(AT_FDCWD, "/dev/loop1", O_RDWR <unfinished ...>
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4054] <... pivot_root resumed>)   = 0
[pid  4051] <... getsockopt resumed>, 0x7f0fc975a248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] <... openat resumed>)       = 3
[pid  4058] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4058] <... mount resumed>)        = 0
[pid  4054] chdir("/" <unfinished ...>
[pid  4051] <... getsockopt resumed>, 0x7f0fc975a908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4050] ioctl(3, LOOP_CLR_FD)       = -1 ENXIO (No such device or address)
[pid  4051] close(3 <unfinished ...>
[pid  4054] <... chdir resumed>)        = 0
[pid  4050] close(3 <unfinished ...>
[pid  4054] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4050] <... close resumed>)        = 0
[pid  4058] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4058] <... mount resumed>)        = 0
[pid  4051] <... write resumed>)        = 4
[pid  4050] <... socket resumed>)       = 3
[pid  4051] mkdirat(AT_FDCWD, "./0", 0777) = 0
[pid  4058] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4050] close(3 <unfinished ...>
[pid  4058] <... mount resumed>)        = 0
[pid  4051] openat(AT_FDCWD, "/dev/loop3", O_RDWR <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4051] <... openat resumed>)       = 3
[pid  4058] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4054] <... umount2 resumed>)      = 0
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4054] chroot("./newroot" <unfinished ...>
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4054] <... chroot resumed>)       = 0
[pid  4050] <... socket resumed>)       = 3
[pid  4054] chdir("/" <unfinished ...>
[pid  4035] write(3, "\x0c\x01\x00\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x20\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x10\x00\x10\x00\x00\x00\x02\x00\x00\x00\x18\x00\x00\x00\x7c\x00\x00\x00\x98\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x62\x00\x00\x00\x53\x59\x5a\x46\x41\x49\x4c\x3a\x20\x73\x65\x74\x66\x69\x6c\x65\x63\x6f\x6e\x3a"..., 272 <unfinished ...>
[pid  4051] ioctl(3, LOOP_CLR_FD)       = -1 ENXIO (No such device or address)
[pid  4054] <... chdir resumed>)        = 0
[pid  4051] close(3 <unfinished ...>
[pid  4054] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4050] close(3 <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4058] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4054] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4058] <... pivot_root resumed>)   = 0
[pid  4054] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4035] <... write resumed>)        = 272
[pid  4051] <... socket resumed>)       = 3
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4050] <... socket resumed>)       = 3
[pid  4051] <... close resumed>)        = 0
[pid  4050] close(3 <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3f9a33f30c000002}], 128, 992, NULL, 0) = 1
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4027] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4051] <... socket resumed>)       = 3
[pid  4050] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4027] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4058] chdir("/" <unfinished ...>
[pid  4027] read(6 <unfinished ...>
[pid  4058] <... chdir resumed>)        = 0
[pid  4050] <... socket resumed>)       = 3
[pid  4035] pipe2( <unfinished ...>
[pid  4027] <... read resumed>, "\x0c\x01\x00\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x20\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x10\x00\x10\x00\x00\x00\x02\x00\x00\x00\x18\x00\x00\x00\x7c\x00\x00\x00\x98\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x62\x00\x00\x00\x53\x59\x5a\x46\x41\x49\x4c\x3a\x20\x73\x65\x74\x66\x69\x6c\x65\x63\x6f\x6e\x3a"..., 21347228) = 272
[pid  4058] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4050] close(3 <unfinished ...>
[pid  4035] <... pipe2 resumed>[29, 32], 0) = 0
[pid  4027] futex(0x17678927f960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4050] <... close resumed>)        = 0
[pid  4050] read(249 <unfinished ...>
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4035] pipe2( <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4035] <... pipe2 resumed>[34, 35], 0) = 0
[pid  4029] <... futex resumed>)        = 0
[pid  4027] <... futex resumed>)        = 1
[pid  4058] <... umount2 resumed>)      = 0
[pid  4051] <... close resumed>)        = 0
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4035] pipe2( <unfinished ...>
[pid  4029] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4027] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x12\x38\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0b\x00\x00\x00"..., 192 <unfinished ...>
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4035] <... pipe2 resumed>[36, 37], 0) = 0
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4051] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4029] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4058] chroot("./newroot" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4027] <... write resumed>)        = 192
[pid  4058] <... chroot resumed>)       = 0
[pid  4051] <... socket resumed>)       = 3
[pid  4058] chdir("/" <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... chdir resumed>)        = 0
[pid  4051] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4027] read(6 <unfinished ...>
[pid  4058] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4027] <... read resumed>, 0x17678d500000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4058] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] read(249 <unfinished ...>
[pid  4027] futex(0x17678927f160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4058] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=915275030} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4054] mkdirat(AT_FDCWD, "/dev/binderfs", 0777) = -1 EEXIST (File exists)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4058] mkdirat(AT_FDCWD, "/dev/binderfs", 0777) = -1 EEXIST (File exists)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] getpid( <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... getpid resumed>)       = 1
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz0", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4054] openat(AT_FDCWD, "/syzcgroup/unified/syz0/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] write(3, "32", 2 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... write resumed>)        = 2
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] openat(AT_FDCWD, "/syzcgroup/unified/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] write(3, "1", 1 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... write resumed>)        = 1
[pid  4054] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz0", 0777) = -1 EEXIST (File exists)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... openat resumed>)       = 3
[pid  4054] write(3, "1", 1 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... write resumed>)        = 1
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] write(3, "313524224", 9)    = 9
[pid  4054] close(3)                    = 0
[pid  4054] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] write(3, "314572800", 9 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... write resumed>)        = 9
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] mkdirat(AT_FDCWD, "/syzcgroup/net/syz0", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] openat(AT_FDCWD, "/syzcgroup/net/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] write(3, "1", 1 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... write resumed>)        = 1
[pid  4054] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5d73e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO, 0x7fcb3b5d7a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5d80e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... socket resumed>)       = 3
[pid  4054] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5d8768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5dafc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5db688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5dbd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5dc408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5dcac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... close resumed>)        = 0
[pid  4058] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 ENOENT (No such file or directory)
[pid  4054] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4058] getpid( <unfinished ...>
[pid  4054] <... socket resumed>)       = 3
[pid  4058] <... getpid resumed>)       = 1
[pid  4054] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz4", 0777 <unfinished ...>
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5d8e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4058] openat(AT_FDCWD, "/syzcgroup/unified/syz4/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5d94c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5d9b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5da248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... getsockopt resumed>, 0x7fcb3b5da908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] openat(AT_FDCWD, "/dev/loop0", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] write(3, "32", 2 <unfinished ...>
[pid  4054] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... write resumed>)        = 2
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4054] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4054] <... close resumed>)        = 0
[pid  4054] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe0c2aaf000
[pid  4058] <... close resumed>)        = 0
[pid  4035] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4058] openat(AT_FDCWD, "/syzcgroup/unified/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4054] <... socket resumed>)       = 3
[pid  4035] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7fe0c2aaf000, stack_size=0x9000}, 88/strace: Process 4065 attached
 <unfinished ...>
[pid  4054] close(3 <unfinished ...>
[pid  4058] <... openat resumed>)       = 3
[pid  4054] <... close resumed>)        = 0
[pid  4065] rt_sigprocmask(SIG_BLOCK, NULL <unfinished ...>
[pid  4054] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4058] write(3, "1", 1 <unfinished ...>
[pid  4065] <... rt_sigprocmask resumed>, ~[KILL STOP], 8) = 0
[pid  4054] close(3 <unfinished ...>
[pid  4065] setpgid(0, 0 <unfinished ...>
[pid  4054] <... close resumed>)        = 0
[pid  4058] <... write resumed>)        = 1
[pid  4065] <... setpgid resumed>)      = 0
[pid  4058] close(3 <unfinished ...>
[pid  4054] read(249 <unfinished ...>
[pid  4065] dup2(29, 0 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4065] <... dup2 resumed>)         = 0
[pid  4058] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz4", 0777 <unfinished ...>
[pid  4065] dup2(35, 1)                 = 1
[pid  4065] dup2(37, 2)                 = 2
[pid  4065] dup2(14, 3)                 = 3
[pid  4065] dup2(17, 4)                 = 4
[pid  4065] close(5)                    = 0
[pid  4065] close(6)                    = 0
[pid  4065] close(7)                    = 0
[pid  4065] close(8)                    = 0
[pid  4065] close(9)                    = 0
[pid  4065] close(10)                   = 0
[pid  4065] close(11)                   = 0
[pid  4065] close(12 <unfinished ...>
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4065] <... close resumed>)        = 0
[pid  4058] openat(AT_FDCWD, "/syzcgroup/cpu/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4065] close(13)                   = 0
[pid  4065] close(14)                   = 0
[pid  4065] close(15)                   = 0
[pid  4065] close(16 <unfinished ...>
[pid  4058] <... openat resumed>)       = 3
[pid  4065] <... close resumed>)        = 0
[pid  4065] close(17)                   = 0
[pid  4065] close(18)                   = 0
[pid  4065] close(19)                   = 0
[pid  4065] close(20)                   = 0
[pid  4065] close(21)                   = 0
[pid  4065] close(22)                   = 0
[pid  4065] close(23)                   = 0
[pid  4058] write(3, "1", 1 <unfinished ...>
[pid  4065] close(24)                   = 0
[pid  4065] close(25)                   = 0
[pid  4065] close(26 <unfinished ...>
[pid  4058] <... write resumed>)        = 1
[pid  4065] <... close resumed>)        = 0
[pid  4065] close(27)                   = 0
[pid  4065] close(28)                   = 0
[pid  4065] close(29 <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4065] <... close resumed>)        = 0
[pid  4065] close(30)                   = 0
[pid  4065] close(31)                   = 0
[pid  4058] <... close resumed>)        = 0
[pid  4065] close(32)                   = 0
[pid  4065] close(33)                   = 0
[pid  4065] close(34 <unfinished ...>
[pid  4058] openat(AT_FDCWD, "/syzcgroup/cpu/syz4/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4065] <... close resumed>)        = 0
[pid  4065] close(35)                   = 0
[pid  4065] close(36)                   = 0
[pid  4065] close(37)                   = 0
[pid  4065] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... openat resumed>)       = 3
[pid  4065] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4065] close(39)                   = -1 EBADF (Bad file descriptor)
[pid  4065] close(40 <unfinished ...>
[pid  4058] write(3, "313524224", 9 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4065] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4065] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4065] close(44)                   = -1 EBADF (Bad file descriptor)
[pid  4065] close(45 <unfinished ...>
[pid  4058] <... write resumed>)        = 9
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(46)                   = -1 EBADF (Bad file descriptor)
[pid  4065] close(47)                   = -1 EBADF (Bad file descriptor)
[pid  4065] close(48)                   = -1 EBADF (Bad file descriptor)
[pid  4058] close(3 <unfinished ...>
[pid  4065] close(49 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] openat(AT_FDCWD, "/syzcgroup/cpu/syz4/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4065] close(50)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... openat resumed>)       = 3
[pid  4065] close(51 <unfinished ...>
[pid  4058] write(3, "314572800", 9 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... write resumed>)        = 9
[pid  4065] close(52 <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(53 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] mkdirat(AT_FDCWD, "/syzcgroup/net/syz4", 0777 <unfinished ...>
[pid  4065] close(54 <unfinished ...>
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] openat(AT_FDCWD, "/syzcgroup/net/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4065] close(55)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... openat resumed>)       = 3
[pid  4065] close(56 <unfinished ...>
[pid  4058] write(3, "1", 1 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(57)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... write resumed>)        = 1
[pid  4065] close(58 <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4065] close(59 <unfinished ...>
[pid  4058] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(60 <unfinished ...>
[pid  4058] <... socket resumed>)       = 3
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4065] close(61 <unfinished ...>
[pid  4058] <... getsockopt resumed>, 0x7fbcc73673e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4065] close(62)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... getsockopt resumed>, 0x7fbcc7367a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] close(63)                   = -1 EBADF (Bad file descriptor)
[pid  4058] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4065] close(64 <unfinished ...>
[pid  4058] <... getsockopt resumed>, 0x7fbcc73680e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] close(3 <unfinished ...>
[pid  4065] close(65 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4065] close(66)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... socket resumed>)       = 3
[pid  4065] close(67 <unfinished ...>
[pid  4058] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(68 <unfinished ...>
[pid  4058] <... getsockopt resumed>, 0x7fbcc7368768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] close(3 <unfinished ...>
[pid  4065] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4065] close(70 <unfinished ...>
[pid  4058] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(71)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... socket resumed>)       = 3
[pid  4065] close(72)                   = -1 EBADF (Bad file descriptor)
[pid  4058] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4065] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... getsockopt resumed>, 0x7fbcc736afc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4058] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4065] close(75 <unfinished ...>
[pid  4058] <... getsockopt resumed>, 0x7fbcc736b688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(76 <unfinished ...>
[pid  4058] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... getsockopt resumed>, 0x7fbcc736bd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] close(77 <unfinished ...>
[pid  4058] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... getsockopt resumed>, 0x7fbcc736c408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4058] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4065] close(79 <unfinished ...>
[pid  4058] <... getsockopt resumed>, 0x7fbcc736cac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] close(3 <unfinished ...>
[pid  4065] close(80)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4065] close(81 <unfinished ...>
[pid  4058] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(82 <unfinished ...>
[pid  4058] <... socket resumed>)       = 3
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4065] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... getsockopt resumed>, 0x7fbcc7368e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4058] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4065] close(84 <unfinished ...>
[pid  4058] <... getsockopt resumed>, 0x7fbcc73694c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4065] close(85 <unfinished ...>
[pid  4058] <... getsockopt resumed>, 0x7fbcc7369b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4065] close(86 <unfinished ...>
[pid  4058] <... getsockopt resumed>, 0x7fbcc736a248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(87 <unfinished ...>
[pid  4058] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... getsockopt resumed>, 0x7fbcc736a908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4065] close(88 <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(89 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4065] close(90)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... write resumed>)        = 4
[pid  4065] close(91 <unfinished ...>
[pid  4058] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4065] close(92 <unfinished ...>
[pid  4058] openat(AT_FDCWD, "/dev/loop4", O_RDWR <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(93 <unfinished ...>
[pid  4058] <... openat resumed>)       = 3
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4065] close(94 <unfinished ...>
[pid  4058] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] close(3 <unfinished ...>
[pid  4065] close(95)                   = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4065] close(96 <unfinished ...>
[pid  4058] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4065] close(98 <unfinished ...>
[pid  4058] <... socket resumed>)       = 3
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] close(3 <unfinished ...>
[pid  4065] close(99)                   = -1 EBADF (Bad file descriptor)
[pid  4065] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(102 <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4065] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... socket resumed>)       = 3
[pid  4065] close(104 <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4065] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4058] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4065] close(106 <unfinished ...>
[pid  4058] <... socket resumed>)       = 3
[pid  4058] close(3 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4058] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4065] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... socket resumed>)       = 3
[pid  4065] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4058] close(3 <unfinished ...>
[pid  4065] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4058] <... close resumed>)        = 0
[pid  4065] close(110 <unfinished ...>
[pid  4058] read(249 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(118)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(119)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(120)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(129)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(130)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(134)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(135)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(142)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(154)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(155)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(158)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(163)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(164)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(168)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(169)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(182)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(183)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(184)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(185)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(186)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(188)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(189)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(190)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(191)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(194)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(195)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(196)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(200)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(202)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(204)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(205)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(206)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(207)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(208)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(209)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(210)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(211)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(213)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(214)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(215)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(216)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(217)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(218)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(219)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(220)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(223)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(224)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(225)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(228)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(229)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(230)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(231)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(232)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(233)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(234)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(235)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(236)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(237)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(240 <unfinished ...>
[pid  4029] <... epoll_pwait resumed>, [], 128, 921, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(241 <unfinished ...>
[pid  4029] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4029] futex(0x17678927f160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4065] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(244 <unfinished ...>
[pid  4029] <... futex resumed>)        = 1
[pid  4027] <... futex resumed>)        = 0
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(245 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(246 <unfinished ...>
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4025] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(247 <unfinished ...>
[pid  4027] futex(0x17678927f160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4025] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(248)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(251)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(252 <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=901693125} <unfinished ...>
[pid  4065] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4065] close(253)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4065] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4065] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4065] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffedff15900 /* 2 vars */ <unfinished ...>
[pid  4035] <... clone3 resumed>)       = 4065
[pid  4035] munmap(0x7fe0c2aaf000, 36864) = 0
[pid  4035] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4035] fcntl(34, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(34, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] fcntl(36, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(36, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] close(29)                   = 0
[pid  4035] close(35)                   = 0
[pid  4035] close(37)                   = 0
[pid  4035] close(20)                   = 0
[pid  4065] <... execve resumed>)       = 0
[pid  4035] close(21)                   = 0
[pid  4065] brk(NULL <unfinished ...>
[pid  4035] close(23)                   = 0
[pid  4065] <... brk resumed>)          = 0x55557fef9000
[pid  4035] write(32, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\x78\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4065] brk(0x55557fef9e80 <unfinished ...>
[pid  4035] pselect6(37, [3 11 13 16 18 26 28 31 33 34 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8}) = 5 (in [3 11 16 26 31], left {tv_sec=0, tv_nsec=999983824})
[pid  4065] <... brk resumed>)          = 0x55557fef9e80
[pid  4035] read(3, "\xbc\x00\x00\x00", 4) = 4
[pid  4035] read(3, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x12\x38\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4065] arch_prctl(ARCH_SET_FS, 0x55557fef9500 <unfinished ...>
[pid  4035] read(11, "\x00\x00\x00\x00", 4) = 4
[pid  4065] <... arch_prctl resumed>)   = 0
[pid  4035] write(3, "\x2c\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x0e\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x00\x00\x06\x00\x0c\x00\x04\x00\x06\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4065] set_tid_address(0x55557fef97d0 <unfinished ...>
[pid  4035] <... write resumed>)        = 48
[pid  4029] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3f9a33f30c000002}], 128, 905, NULL, 0) = 1
[pid  4065] <... set_tid_address resumed>) = 4065
[pid  4029] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4065] set_robust_list(0x55557fef97e0, 24) = 0
[pid  4029] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4065] prlimit64(0, RLIMIT_STACK, NULL <unfinished ...>
[pid  4029] read(6 <unfinished ...>
[pid  4025] sched_yield( <unfinished ...>
[pid  4029] <... read resumed>, "\x2c\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x0e\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x00\x00\x06\x00\x0c\x00\x04\x00\x06\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 21347228) = 48
[pid  4065] <... prlimit64 resumed>, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4029] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x12\x39\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0c\x00\x00\x00"..., 192 <unfinished ...>
[pid  4065] readlinkat(AT_FDCWD, "/proc/self/exe" <unfinished ...>
[pid  4029] <... write resumed>)        = 192
[pid  4065] <... readlinkat resumed>, "/syz-executor", 4096) = 13
[pid  4025] <... sched_yield resumed>)  = 0
[pid  4029] read(6 <unfinished ...>
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4029] <... read resumed>, 0x17678d500000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4065] getrandom( <unfinished ...>
[pid  4029] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4065] <... getrandom resumed>"\x18\x50\xce\xd1\xb6\xdc\x4b\x0e", 8, GRND_NONBLOCK) = 8
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4065] brk(NULL)                   = 0x55557fef9e80
[pid  4065] brk(0x55557ff1ae80)         = 0x55557ff1ae80
[pid  4065] brk(0x55557ff1b000)         = 0x55557ff1b000
[pid  4065] mprotect(0x7f187cb59000, 1236992, PROT_READ) = 0
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=788105153} <unfinished ...>
[pid  4065] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  4035] write(10, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4065] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4054] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4035] <... write resumed>)        = 48
[pid  4065] <... mmap resumed>)         = 0x1ffffffff000
[pid  4054] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] read(16 <unfinished ...>
[pid  4065] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4054] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4065] <... mmap resumed>)         = 0x200000000000
[pid  4054] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4035] write(3, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00", 56 <unfinished ...>
[pid  4065] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200001000000
[pid  4029] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3f9a33f30c000002}], 128, 790, NULL, 0) = 1
[pid  4065] rt_sigaction(SIGCHLD, {sa_handler=0x7f187c8f0780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f187c9de1d0}, NULL, 8) = 0
[pid  4035] <... write resumed>)        = 56
[pid  4065] pkey_alloc(0, PKEY_UNRESTRICTED <unfinished ...>
[pid  4029] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4065] <... pkey_alloc resumed>)   = -1 EINVAL (Invalid argument)
[pid  4029] <... futex resumed>)        = 1
[pid  4065] getrandom( <unfinished ...>
[pid  4029] read(6 <unfinished ...>
[pid  4025] <... futex resumed>)        = 0
[pid  4065] <... getrandom resumed>"\x8f\x0b\x12\x62\xea\xc8\x3e\x14", 8, GRND_NONBLOCK) = 8
[pid  4065] mkdir("./syzkaller.JYwfCX", 0700 <unfinished ...>
[pid  4029] <... read resumed>, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00", 21347228) = 56
[pid  4029] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x14\x38\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0d\x00\x00\x00"..., 192) = 192
[pid  4029] read(6, 0x17678d500000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4029] epoll_pwait(4, [], 128, 0, NULL, 0) = 0
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=750791128} <unfinished ...>
[pid  4065] <... mkdir resumed>)        = 0
[pid  4065] chmod("./syzkaller.JYwfCX", 0777) = 0
[pid  4065] chdir("./syzkaller.JYwfCX") = 0
[pid  4065] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
[pid  4065] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
[pid  4065] rt_sigaction(SIGSEGV, {sa_handler=0x7f187c8f2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f187c9de1d0}, NULL, 8) = 0
[pid  4065] rt_sigaction(SIGBUS, {sa_handler=0x7f187c8f2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f187c9de1d0}, NULL, 8) = 0
[pid  4065] getpid()                    = 4065
[pid  4065] mmap(0x1b31d20000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0) = 0x1b31d20000
[pid  4065] getpid()                    = 4065
[pid  4065] mmap(0x1b32d24000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0) = 0x1b32d24000
[pid  4065] close(3)                    = 0
[pid  4065] fcntl(5, F_GETFD)           = -1 EBADF (Bad file descriptor)
[pid  4065] fcntl(6, F_GETFD)           = -1 EBADF (Bad file descriptor)
[pid  4065] dup2(0, 249)                = 249
[pid  4065] dup2(1, 248)                = 248
[pid  4065] dup2(2, 1/strace: Process 4066 attached
)                  = 1
[pid  4065] dup2(2, 0)                  = 0
[pid  4065] read(249 <unfinished ...>
[pid  4054] <... clone resumed>, child_tidptr=0x555557b8d7d0) = 2
[pid  4066] set_robust_list(0x555557b8d7e0, 24 <unfinished ...>
[pid  4065] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\x78\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4054] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4066] <... set_robust_list resumed>) = 0
[pid  4065] unshare(CLONE_NEWPID <unfinished ...>
[pid  4054] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4066] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4065] <... unshare resumed>)      = 0
[pid  4065] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4065] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 4067 attached
 <unfinished ...>
[pid  4066] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4067] set_robust_list(0x55557fef97e0, 24 <unfinished ...>
[pid  4066] chdir("./0" <unfinished ...>
[pid  4065] <... clone resumed>, child_tidptr=0x55557fef97d0) = 4067
[pid  4067] <... set_robust_list resumed>) = 0
[pid  4065] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4067] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4066] <... chdir resumed>)        = 0
[pid  4065] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4067] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4066] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4067] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  4066] <... prctl resumed>)        = 0
[pid  4035] write(15, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4067] getppid()                   = 0
[pid  4066] setpgid(0, 0 <unfinished ...>
[pid  4050] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4035] <... write resumed>)        = 48
[pid  4067] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4035] read(26 <unfinished ...>
[pid  4067] <... openat resumed>)       = 3
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4050] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4067] dup2(3, 201 <unfinished ...>
[pid  4035] write(3, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x03\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00", 56 <unfinished ...>
[pid  4067] <... dup2 resumed>)         = 201
[pid  4067] close(3 <unfinished ...>
[pid  4050] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4067] <... close resumed>)        = 0
[pid  4050] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4067] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4035] <... write resumed>)        = 56
[pid  4029] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3f9a33f30c000002}], 128, 751, NULL, 0) = 1
/strace: Process 4068 attached
[pid  4067] <... prlimit64 resumed>, NULL) = 0
[pid  4066] <... setpgid resumed>)      = 0
[pid  4029] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4068] set_robust_list(0x55557ab1b7e0, 24 <unfinished ...>
[pid  4067] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024} <unfinished ...>
[pid  4068] <... set_robust_list resumed>) = 0
[pid  4067] <... prlimit64 resumed>, NULL) = 0
[pid  4029] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4067] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024} <unfinished ...>
[pid  4025] sched_yield( <unfinished ...>
[pid  4067] <... prlimit64 resumed>, NULL) = 0
[pid  4050] <... clone resumed>, child_tidptr=0x55557ab1b7d0) = 2
[pid  4067] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} <unfinished ...>
[pid  4050] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4068] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4067] <... prlimit64 resumed>, NULL) = 0
[pid  4029] read(6 <unfinished ...>
[pid  4068] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4067] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  4029] <... read resumed>, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x03\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00", 21347228) = 56
[pid  4067] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  4050] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4068] chdir("./0" <unfinished ...>
[pid  4067] unshare(CLONE_NEWNS <unfinished ...>
[pid  4029] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x20\x38\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0e\x00\x00\x00"..., 192 <unfinished ...>
[pid  4067] <... unshare resumed>)      = 0
[pid  4068] <... chdir resumed>)        = 0
[pid  4067] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4066] symlinkat("/syzcgroup/unified/syz0", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4029] <... write resumed>)        = 192
[pid  4067] <... mount resumed>)        = 0
[pid  4025] <... sched_yield resumed>)  = 0
[pid  4067] unshare(CLONE_NEWIPC <unfinished ...>
[pid  4068] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4067] <... unshare resumed>)      = 0
[pid  4029] read(6 <unfinished ...>
[pid  4068] <... prctl resumed>)        = 0
[pid  4029] <... read resumed>, 0x17678d500000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4068] setpgid(0, 0 <unfinished ...>
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4068] <... setpgid resumed>)      = 0
[pid  4067] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4029] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4068] symlinkat("/syzcgroup/unified/syz1", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4067] <... unshare resumed>)      = 0
[pid  4066] <... symlinkat resumed>)    = 0
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=678707460} <unfinished ...>
[pid  4067] unshare(CLONE_NEWUTS)       = 0
[pid  4068] <... symlinkat resumed>)    = 0
[pid  4068] symlinkat("/syzcgroup/cpu/syz1", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4066] symlinkat("/syzcgroup/cpu/syz0", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4067] unshare(CLONE_SYSVSEM)      = 0
[pid  4067] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  4067] write(3, "16777216", 8)     = 8
[pid  4067] close(3)                    = 0
[pid  4067] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  4067] write(3, "536870912", 9)    = 9
[pid  4067] close(3)                    = 0
[pid  4067] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4068] <... symlinkat resumed>)    = 0
[pid  4068] symlinkat("/syzcgroup/net/syz1", AT_FDCWD, "./cgroup.net" <unfinished ...>
[pid  4067] <... openat resumed>)       = 3
[pid  4066] <... symlinkat resumed>)    = 0
[pid  4067] write(3, "1024", 4 <unfinished ...>
[pid  4068] <... symlinkat resumed>)    = 0
[pid  4068] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4067] <... write resumed>)        = 4
[pid  4067] close(3)                    = 0
[pid  4067] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4068] <... openat resumed>)       = 3
[pid  4067] <... openat resumed>)       = 3
[pid  4067] write(3, "8192", 4)         = 4
[pid  4067] close(3)                    = 0
[pid  4067] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  4067] write(3, "1024", 4)         = 4
[pid  4067] close(3)                    = 0
[pid  4067] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[pid  4068] write(3, "1000", 4 <unfinished ...>
[pid  4066] symlinkat("/syzcgroup/net/syz0", AT_FDCWD, "./cgroup.net" <unfinished ...>
[pid  4035] write(25, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4068] <... write resumed>)        = 4
[pid  4066] <... symlinkat resumed>)    = 0
[pid  4067] write(3, "1024", 4 <unfinished ...>
[pid  4066] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4068] close(3 <unfinished ...>
[pid  4067] <... write resumed>)        = 4
[pid  4066] <... openat resumed>)       = 3
[pid  4067] close(3 <unfinished ...>
[pid  4066] write(3, "1000", 4 <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4067] <... close resumed>)        = 0
[pid  4051] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4035] <... write resumed>)        = 48
[pid  4068] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs" <unfinished ...>
[pid  4051] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] read(31 <unfinished ...>
[pid  4051] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4051] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4068] <... symlinkat resumed>)    = 0
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4067] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] write(3, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x04\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00", 56 <unfinished ...>
[pid  4068] close(249 <unfinished ...>
[pid  4067] <... openat resumed>)       = 3
[pid  4066] <... write resumed>)        = 4
[pid  4066] close(3)                    = 0
[pid  4067] write(3, "1024 1048576 500 1024", 21 <unfinished ...>
[pid  4066] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs" <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4067] <... write resumed>)        = 21
[pid  4066] <... symlinkat resumed>)    = 0
[pid  4035] <... write resumed>)        = 56
[pid  4029] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3f9a33f30c000002}], 128, 691, NULL, 0) = 1
[pid  4067] close(3 <unfinished ...>
[pid  4066] close(249 <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4066] <... close resumed>)        = 0
[pid  4067] getpid( <unfinished ...>
[pid  4066] close(248 <unfinished ...>
[pid  4067] <... getpid resumed>)       = 1
[pid  4068] close(248 <unfinished ...>
[pid  4066] <... close resumed>)        = 0
[pid  4029] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4067] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4066] prctl(PR_SET_NAME, "syz.0.1" <unfinished ...>
[pid  4029] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4068] prctl(PR_SET_NAME, "syz.1.2" <unfinished ...>
[pid  4067] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4066] <... prctl resumed>)        = 0
[pid  4068] <... prctl resumed>)        = 0
[pid  4067] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4066] mmap(0x1b31964000, 6029312, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0x40000 <unfinished ...>
[pid  4025] sched_yield(/strace: Process 4069 attached
 <unfinished ...>
[pid  4068] close(4 <unfinished ...>
[pid  4067] <... capset resumed>)       = 0
[pid  4029] read(6 <unfinished ...>
[pid  4068] <... close resumed>)        = 0
[pid  4067] unshare(CLONE_NEWNET <unfinished ...>
[pid  4066] <... mmap resumed>)         = 0x1b31964000
[pid  4069] set_robust_list(0x5555805a97e0, 24 <unfinished ...>
[pid  4066] close(4 <unfinished ...>
[pid  4029] <... read resumed>, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x04\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00", 21347228) = 56
[pid  4066] <... close resumed>)        = 0
[pid  4069] <... set_robust_list resumed>) = 0
[pid  4066] futex(0x7fcb3b605fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4029] write(6, "\xbc\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x10\x38\x04\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0f\x00\x00\x00"..., 192 <unfinished ...>
[pid  4066] <... futex resumed>)        = 0
[pid  4069] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4066] rt_sigaction(SIGRT_1, {sa_handler=0x7fcb3b3ac3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fcb3b32e1d0}, NULL, 8) = 0
[pid  4051] <... clone resumed>, child_tidptr=0x5555805a97d0) = 2
[pid  4025] <... sched_yield resumed>)  = 0
[pid  4069] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4066] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4051] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4029] <... write resumed>)        = 192
[pid  4069] chdir("./0" <unfinished ...>
[pid  4066] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4051] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4066] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4029] read(6 <unfinished ...>
[pid  4066] <... mmap resumed>)         = 0x7fcb391c1000
[pid  4066] mprotect(0x7fcb391c2000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4069] <... chdir resumed>)        = 0
[pid  4066] <... mprotect resumed>)     = 0
[pid  4029] <... read resumed>, 0x17678d500000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4069] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4066] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4069] <... prctl resumed>)        = 0
[pid  4029] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4069] setpgid(0, 0 <unfinished ...>
[pid  4029] epoll_pwait(4 <unfinished ...>
[pid  4069] <... setpgid resumed>)      = 0
[pid  4069] symlinkat("/syzcgroup/unified/syz3", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4066] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4066] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fcb391e1990, parent_tid=0x7fcb391e1990, exit_signal=0, stack=0x7fcb391c1000, stack_size=0x201c0, tls=0x7fcb391e16c0} <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=639342225}/strace: Process 4070 attached
 <unfinished ...>
[pid  4069] <... symlinkat resumed>)    = 0
[pid  4070] set_robust_list(0x7fcb391e19a0, 24 <unfinished ...>
[pid  4069] symlinkat("/syzcgroup/cpu/syz3", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4066] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4070] <... set_robust_list resumed>) = 0
[pid  4066] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4070] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4066] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4070] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4066] futex(0x7fcb3b605fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4070] ioctl(216, KCOV_ENABLE, 0 <unfinished ...>
[pid  4066] <... futex resumed>)        = 0
[pid  4070] <... ioctl resumed>)        = 0
[pid  4066] futex(0x7fcb3b605fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4070] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
[pid  4069] <... symlinkat resumed>)    = 0
[pid  4070] futex(0x7fcb3b605fac, FUTEX_WAKE_PRIVATE, 1000000) = 1
[pid  4066] <... futex resumed>)        = 0
[pid  4070] futex(0x7fcb3b605fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4069] symlinkat("/syzcgroup/net/syz3", AT_FDCWD, "./cgroup.net") = 0
[pid  4069] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  4069] write(3, "1000", 4)         = 4
[pid  4069] close(3)                    = 0
[pid  4069] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs") = 0
[pid  4067] <... unshare resumed>)      = 0
[pid  4066] futex(0x7fcb3b605fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4035] write(30, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4070] <... futex resumed>)        = 0
[pid  4066] <... futex resumed>)        = 1
[pid  4070] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4066] futex(0x7fcb3b605fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4070] <... mmap resumed>)         = 0x200000000000
[pid  4070] futex(0x7fcb3b605fac, FUTEX_WAKE_PRIVATE, 1000000) = 1
[pid  4066] <... futex resumed>)        = 0
[pid  4070] futex(0x7fcb3b605fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4069] close(249 <unfinished ...>
[pid  4066] futex(0x7fcb3b605fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4035] <... write resumed>)        = 48
[pid  4069] <... close resumed>)        = 0
[pid  4069] close(248 <unfinished ...>
[pid  4058] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4069] <... close resumed>)        = 0
[pid  4058] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4058] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4070] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4069] prctl(PR_SET_NAME, "syz.3.4" <unfinished ...>
[pid  4067] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4066] <... futex resumed>)        = 0
[pid  4035] pselect6(37, [3 11 13 16 18 26 28 31 33 34 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4069] <... prctl resumed>)        = 0
[pid  4067] <... openat resumed>)       = 3
[pid  4035] <... pselect6 resumed>)     = 1 (in [3], left {tv_sec=0, tv_nsec=999982856})
[pid  4070] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4066] futex(0x7fcb3b605fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4069] close(4 <unfinished ...>
[pid  4035] read(3 <unfinished ...>
[pid  4070] <... mmap resumed>)         = 0x200001000000
[pid  4069] <... close resumed>)        = 0
[pid  4067] write(3, "0 65535", 7 <unfinished ...>
[pid  4035] <... read resumed>, "\xbc\x00\x00\x00", 4) = 4
[pid  4067] <... write resumed>)        = 7
[pid  4035] read(3 <unfinished ...>
[pid  4067] close(3)                    = 0
[pid  4070] futex(0x7fcb3b605fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4067] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid  4070] <... futex resumed>)        = 1
[pid  4067] <... openat resumed>)       = 3
[pid  4066] <... futex resumed>)        = 0
[pid  4035] <... read resumed>, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x12\x39\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4070] futex(0x7fcb3b605fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4067] setns(201, 0 <unfinished ...>
[pid  4066] close_range(3, 30, 0 <unfinished ...>
[pid  4035] pselect6(37, [3 11 13 16 18 26 28 31 33 34 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4066] <... close_range resumed>)  = 0
[pid  4035] <... pselect6 resumed>)     = 1 (in [3], left {tv_sec=0, tv_nsec=999984760})
[pid  4067] <... setns resumed>)        = 0
[pid  4035] read(3 <unfinished ...>
[pid  4067] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 5
[pid  4066] exit_group(0 <unfinished ...>
[pid  4035] <... read resumed>, "\xbc\x00\x00\x00", 4) = 4
[pid  4070] <... futex resumed>)        = ?
[pid  4067] sendto(5, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x64\x65\x76\x6c\x69\x6e\x6b\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4066] <... exit_group resumed>)   = ?
/strace: Process 4072 attached
[pid  4070] +++ exited with 0 +++
[pid  4069] futex(0x7f0fc9785fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4068] futex(0x7f6358ae5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4067] <... sendto resumed>)       = 32
[pid  4035] read(3 <unfinished ...>
[pid  4072] set_robust_list(0x5555860de7e0, 24 <unfinished ...>
[pid  4058] <... clone resumed>, child_tidptr=0x5555860de7d0) = 2
[pid  4035] <... read resumed>, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x14\x38\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0d\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4072] <... set_robust_list resumed>) = 0
[pid  4069] <... futex resumed>)        = 0
[pid  4068] <... futex resumed>)        = 0
[pid  4067] recvfrom(5 <unfinished ...>
[pid  4058] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] pselect6(37, [3 11 13 16 18 26 28 31 33 34 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4072] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4067] <... recvfrom resumed>, [{nlmsg_len=1236, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x64\x65\x76\x6c\x69\x6e\x6b\x00\x06\x00\x01\x00\x16\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00\x78\x04\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x05\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 1236
[pid  4058] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] <... pselect6 resumed>)     = 1 (in [3], left {tv_sec=0, tv_nsec=999984555})
[pid  4072] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4069] rt_sigaction(SIGRT_1, {sa_handler=0x7f0fc952c3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0fc94ae1d0} <unfinished ...>
[pid  4068] rt_sigaction(SIGRT_1, {sa_handler=0x7f635888c3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f635880e1d0} <unfinished ...>
[pid  4066] +++ exited with 0 +++
[pid  4035] read(3 <unfinished ...>
[pid  4069] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4068] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4067] recvfrom(5 <unfinished ...>
[pid  4054] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
[pid  4035] <... read resumed>, "\xbc\x00\x00\x00", 4) = 4
[pid  4072] chdir("./0" <unfinished ...>
[pid  4069] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4068] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4067] <... recvfrom resumed>, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  4054] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4035] read(3 <unfinished ...>
[pid  4072] <... chdir resumed>)        = 0
[pid  4069] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4068] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4067] sendto(5, [{nlmsg_len=56, nlmsg_type=0x16 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x25\x00\x00\x00\x08\x00\x01\x00\x70\x63\x69\x00\x11\x00\x02\x00\x30\x30\x30\x30\x3a\x30\x30\x3a\x31\x30\x2e\x30\x00\x00\x00\x00\x08\x00\x8a\x00\x03\x00\x00\x00"], 56, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4072] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4069] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4068] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4054] <... rt_sigreturn resumed>) = 0
[pid  4035] <... read resumed>, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x20\x38\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4069] <... mmap resumed>)         = 0x7f0fc9347000
[pid  4068] <... mmap resumed>)         = 0x7f63586a7000
[pid  4067] <... sendto resumed>)       = 56
[pid  4035] pselect6(37, [3 11 13 16 18 26 28 31 33 34 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4072] <... prctl resumed>)        = 0
[pid  4069] mprotect(0x7f0fc9348000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4068] mprotect(0x7f63586a8000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4035] <... pselect6 resumed>)     = 1 (in [3], left {tv_sec=0, tv_nsec=999979865})
[pid  4072] setpgid(0, 0 <unfinished ...>
[pid  4069] <... mprotect resumed>)     = 0
[pid  4068] <... mprotect resumed>)     = 0
[pid  4035] read(3 <unfinished ...>
[pid  4072] <... setpgid resumed>)      = 0
[pid  4069] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4068] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] <... read resumed>, "\xbc\x00\x00\x00", 4) = 4
[pid  4072] symlinkat("/syzcgroup/unified/syz4", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4069] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4068] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] read(3, "\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x3c\x00\x30\x00\x00\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x38\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x10\x38\x04\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x00\x00"..., 188) = 188
[pid  4069] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0fc9367990, parent_tid=0x7f0fc9367990, exit_signal=0, stack=0x7f0fc9347000, stack_size=0x201c0, tls=0x7f0fc93676c0} <unfinished ...>
[pid  4035] pselect6(37, [3 11 13 16 18 26 28 31 33 34 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8} <unfinished ...>
[pid  4068] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f63586c7990, parent_tid=0x7f63586c7990, exit_signal=0, stack=0x7f63586a7000, stack_size=0x201c0, tls=0x7f63586c76c0}/strace: Process 4076 attached
 <unfinished ...>
[pid  4069] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4067] recvfrom(5 <unfinished ...>
[pid  4054] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4076] set_robust_list(0x7f0fc93679a0, 24 <unfinished ...>
[pid  4072] <... symlinkat resumed>)    = 0
[pid  4069] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4067] <... recvfrom resumed>, [{nlmsg_len=76, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=56, nlmsg_type=0x16 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x25\x00\x00\x00\x08\x00\x01\x00\x70\x63\x69\x00\x11\x00\x02\x00\x30\x30\x30\x30\x3a\x30\x30\x3a\x31\x30\x2e\x30\x00\x00\x00\x00\x08\x00\x8a\x00\x03\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 76
[pid  4054] <... write resumed>)        = 4
[pid  4035] <... pselect6 resumed>)     = 1 (in [11], left {tv_sec=0, tv_nsec=997325780})
/strace: Process 4077 attached
[pid  4076] <... set_robust_list resumed>) = 0
[pid  4072] symlinkat("/syzcgroup/cpu/syz4", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4069] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4054] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] read(11 <unfinished ...>
[pid  4077] set_robust_list(0x7f63586c79a0, 24 <unfinished ...>
[pid  4076] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4067] close(5 <unfinished ...>
[pid  4054] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4077] <... set_robust_list resumed>) = 0
[pid  4076] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4069] futex(0x7f0fc9785fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4068] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4067] <... close resumed>)        = 0
[pid  4054] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4077] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4072] <... symlinkat resumed>)    = 0
[pid  4069] <... futex resumed>)        = 0
[pid  4068] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4067] setns(3, 0 <unfinished ...>
[pid  4054] <... openat resumed>)       = 3
[pid  4077] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4072] symlinkat("/syzcgroup/net/syz4", AT_FDCWD, "./cgroup.net" <unfinished ...>
[pid  4069] futex(0x7f0fc9785fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4068] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4067] <... setns resumed>)        = 0
[pid  4054] fstat(3 <unfinished ...>
[pid  4035] write(3, "\x24\x15\x02\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x18\x00\x0c\x00\x00\x00\x04\x00\x00\x00\x00\x00\x08\x00\x10\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x14\x00\x00\x00\x0c\x00\x00\x00\x40\x5a\x0a\x15"..., 136488 <unfinished ...>
[pid  4076] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4067] close(3)                    = 0
[pid  4054] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4067] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC <unfinished ...>
[pid  4054] getdents64(3 <unfinished ...>
[pid  4077] futex(0x7f6358ae5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4076] <... mmap resumed>)         = 0x1ffffffff000
[pid  4067] <... socket resumed>)       = 3
[pid  4054] <... getdents64 resumed>, 0x555557ba08c0 /* 6 entries */, 32768) = 176
[pid  4035] <... write resumed>)        = 136488
[pid  4029] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3f9a33f30c000002}], 128, 643, NULL, 0) = 1
[pid  4076] futex(0x7f0fc9785fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4067] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE <unfinished ...>
[pid  4068] futex(0x7f6358ae5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4077] <... futex resumed>)        = 0
[pid  4076] <... futex resumed>)        = 1
[pid  4072] <... symlinkat resumed>)    = 0
[pid  4068] <... futex resumed>)        = 1
[pid  4067] <... socket resumed>)       = 5
[pid  4054] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4077] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4076] futex(0x7f0fc9785fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4072] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4069] <... futex resumed>)        = 0
[pid  4068] futex(0x7f6358ae5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4067] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x64\x65\x76\x6c\x69\x6e\x6b\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4054] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] kill(4045, SIGKILL <unfinished ...>
[pid  4029] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4077] <... mmap resumed>)         = 0x1ffffffff000
[pid  4072] <... openat resumed>)       = 3
[pid  4069] futex(0x7f0fc9785fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4067] <... sendto resumed>)       = 32
[pid  4054] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4067] recvfrom(3 <unfinished ...>
[pid  4054] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4067] <... recvfrom resumed>, [{nlmsg_len=1236, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x64\x65\x76\x6c\x69\x6e\x6b\x00\x06\x00\x01\x00\x16\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x00\x00\x00\x00\x78\x04\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x05\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 1236
[pid  4077] futex(0x7f6358ae5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4076] <... futex resumed>)        = 0
[pid  4072] write(3, "1000", 4 <unfinished ...>
[pid  4069] <... futex resumed>)        = 1
[pid  4054] unlink("./0/binderfs" <unfinished ...>
[pid  4035] <... kill resumed>)         = 0
[pid  4029] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4077] <... futex resumed>)        = 1
[pid  4076] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4072] <... write resumed>)        = 4
[pid  4069] futex(0x7f0fc9785fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4068] <... futex resumed>)        = 0
[pid  4067] recvfrom(3 <unfinished ...>
[pid  4054] <... unlink resumed>)       = 0
[pid  4025] sched_yield( <unfinished ...>
[pid  4067] <... recvfrom resumed>, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  4054] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4077] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4076] <... mmap resumed>)         = 0x200000000000
[pid  4072] close(3 <unfinished ...>
[pid  4068] futex(0x7f6358ae5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4067] sendto(3, [{nlmsg_len=48, nlmsg_type=0x16 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x300, nlmsg_seq=0, nlmsg_pid=0}, "\x05\x00\x00\x00\x08\x00\x01\x00\x70\x63\x69\x00\x11\x00\x02\x00\x30\x30\x30\x30\x3a\x30\x30\x3a\x31\x30\x2e\x30\x00\x00\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid  4045] +++ killed by SIGKILL +++
[pid  4029] read(6 <unfinished ...>
[pid  4025] <... sched_yield resumed>)  = 0
[pid  4077] <... mmap resumed>)         = 0x200000000000
[pid  4076] futex(0x7f0fc9785fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4072] <... close resumed>)        = 0
[pid  4068] <... futex resumed>)        = 0
[pid  4067] <... sendto resumed>)       = 48
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4067] recvfrom(3 <unfinished ...>
[pid  4029] <... read resumed>, "\x24\x15\x02\x00\x0c\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x18\x00\x0c\x00\x00\x00\x04\x00\x00\x00\x00\x00\x08\x00\x10\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x14\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x14\x00\x00\x00\x0c\x00\x00\x00\x40\x5a\x0a\x15"..., 21347228) = 136488
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4077] futex(0x7f6358ae5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4072] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs" <unfinished ...>
[pid  4068] futex(0x7f6358ae5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4067] <... recvfrom resumed>, [{nlmsg_len=20, nlmsg_type=NLMSG_DONE, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=0, nlmsg_pid=1}, -19], 4096, 0, NULL, NULL) = 20
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4045, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=13 /* 0.13 s */} ---
[pid  4077] <... futex resumed>)        = 0
[pid  4076] <... futex resumed>)        = 1
[pid  4072] <... symlinkat resumed>)    = 0
[pid  4069] <... futex resumed>)        = 0
[pid  4068] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4067] close(5 <unfinished ...>
[pid  4035] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4029] futex(0x17678927f160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4077] futex(0x7f6358ae5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4076] futex(0x7f0fc9785fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4072] close(249 <unfinished ...>
[pid  4069] futex(0x7f0fc9785fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4068] futex(0x7f6358ae5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4025] epoll_pwait(4, [], 128, 0, NULL, 0) = 0
[pid  4025] getpid( <unfinished ...>
[pid  4067] close(3 <unfinished ...>
[pid  4025] <... getpid resumed>)       = 4024
[pid  4025] tgkill(4024, 4029, SIGURG)  = 0
[pid  4077] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4072] <... close resumed>)        = 0
[pid  4069] <... futex resumed>)        = 0
[pid  4068] <... futex resumed>)        = 0
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... rt_sigreturn resumed>) = 4045
[pid  4077] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4076] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4072] close(248 <unfinished ...>
[pid  4069] futex(0x7f0fc9785fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4067] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4029] <... futex resumed>)        = 1
[pid  4027] <... futex resumed>)        = 0
[pid  4077] <... mmap resumed>)         = 0x200001000000
[pid  4072] <... close resumed>)        = 0
[pid  4068] futex(0x7f6358ae5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4067] <... openat resumed>)       = 3
[pid  4076] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4029] --- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=4024, si_uid=0} ---
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4072] prctl(PR_SET_NAME, "syz.4.5" <unfinished ...>
[pid  4067] write(3, "100000", 6 <unfinished ...>
[pid  4035] pipe2( <unfinished ...>
[pid  4029] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4076] <... mmap resumed>)         = 0x200001000000
[pid  4072] <... prctl resumed>)        = 0
[pid  4067] <... write resumed>)        = 6
[pid  4025] getpid( <unfinished ...>
[pid  4067] close(3 <unfinished ...>
[pid  4025] <... getpid resumed>)       = 4024
[pid  4025] tgkill(4024, 4029, SIGURG <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4025] <... tgkill resumed>)       = 0
[pid  4067] <... close resumed>)        = 0
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp", 0777 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4035] <... pipe2 resumed>[20, 21], 0) = 0
[pid  4077] futex(0x7f6358ae5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4076] futex(0x7f0fc9785fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4072] mmap(0x1b31d64000, 6029312, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0x40000 <unfinished ...>
[pid  4068] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4029] <... rt_sigreturn resumed>) = 1
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4077] <... futex resumed>)        = 0
[pid  4076] <... futex resumed>)        = 1
[pid  4072] <... mmap resumed>)         = 0x1b31d64000
[pid  4069] <... futex resumed>)        = 0
[pid  4068] close_range(3, 30, 0 <unfinished ...>
[pid  4035] pipe2( <unfinished ...>
[pid  4029] --- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=4024, si_uid=0} ---
[pid  4077] futex(0x7f6358ae5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4072] close(4 <unfinished ...>
[pid  4068] <... close_range resumed>)  = 0
[pid  4067] mount("", "./syz-tmp", "tmpfs", 0, NULL <unfinished ...>
[pid  4029] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4076] futex(0x7f0fc9785fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4072] <... close resumed>)        = 0
[pid  4069] close_range(3, 30, 0 <unfinished ...>
[pid  4068] exit_group(0 <unfinished ...>
[pid  4067] <... mount resumed>)        = 0
[pid  4035] <... pipe2 resumed>[23, 29], 0) = 0
[pid  4029] <... rt_sigreturn resumed>) = 1
[pid  4077] <... futex resumed>)        = ?
[pid  4072] futex(0x7fbcc7395fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4069] <... close_range resumed>)  = 0
[pid  4068] <... exit_group resumed>)   = ?
[pid  4035] pipe2( <unfinished ...>
[pid  4077] +++ exited with 0 +++
[pid  4072] <... futex resumed>)        = 0
[pid  4069] exit_group(0 <unfinished ...>
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot", 0777 <unfinished ...>
[pid  4029] futex(0x17678927e960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4076] <... futex resumed>)        = ?
[pid  4069] <... exit_group resumed>)   = ?
[pid  4072] rt_sigaction(SIGRT_1, {sa_handler=0x7fbcc713c3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fbcc70be1d0} <unfinished ...>
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4035] <... pipe2 resumed>[35, 37], 0) = 0
[pid  4072] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4072] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot/dev", 0700 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4029] <... futex resumed>)        = 1
[pid  4026] <... futex resumed>)        = 0
[pid  4076] +++ exited with 0 +++
[pid  4072] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4068] +++ exited with 0 +++
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4029] futex(0x17678927f960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4026] read(6 <unfinished ...>
[pid  4072] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4067] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4072] <... mmap resumed>)         = 0x7fbcc5b4f000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4026] <... read resumed>, 0x17678d500000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4072] mprotect(0x7fbcc5b50000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4067] <... mount resumed>)        = 0
[pid  4072] <... mprotect resumed>)     = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4026] futex(0x17678927e960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot/proc", 0700 <unfinished ...>
[pid  4069] +++ exited with 0 +++
[pid  4072] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4072] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4072] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fbcc5b6f990, parent_tid=0x7fbcc5b6f990, exit_signal=0, stack=0x7fbcc5b4f000, stack_size=0x201c0, tls=0x7fbcc5b6f6c0} <unfinished ...>
[pid  4050] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
[pid  4067] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=257683233}/strace: Process 4084 attached
 <unfinished ...>
[pid  4051] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
[pid  4050] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4084] set_robust_list(0x7fbcc5b6f9a0, 24 <unfinished ...>
[pid  4072] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4051] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4050] <... rt_sigreturn resumed>) = -1 EINTR (Interrupted system call)
[pid  4084] <... set_robust_list resumed>) = 0
[pid  4072] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4067] <... mount resumed>)        = 0
[pid  4051] <... rt_sigreturn resumed>) = -1 EINTR (Interrupted system call)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4084] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4072] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4084] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4072] futex(0x7fbcc7395fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4051] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4050] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4084] ioctl(216, KCOV_ENABLE, 0 <unfinished ...>
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4051] <... write resumed>)        = 4
[pid  4050] <... write resumed>)        = 4
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4084] <... ioctl resumed>)        = 0
[pid  4072] <... futex resumed>)        = 0
[pid  4067] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4084] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4072] futex(0x7fbcc7395fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4067] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4051] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4050] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4084] <... mmap resumed>)         = 0x1ffffffff000
[pid  4051] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4050] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4084] futex(0x7fbcc7395fac, FUTEX_WAKE_PRIVATE, 1000000) = 1
[pid  4072] <... futex resumed>)        = 0
[pid  4067] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... openat resumed>)       = 3
[pid  4050] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4084] futex(0x7fbcc7395fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... mount resumed>)        = 0
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot/sys", 0700) = 0
[pid  4051] fstat(3 <unfinished ...>
[pid  4050] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4050] fstat(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4067] <... mount resumed>)        = 0
[pid  4050] getdents64(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] getdents64(3 <unfinished ...>
[pid  4050] <... getdents64 resumed>, 0x55557ab2e8c0 /* 6 entries */, 32768) = 176
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... getdents64 resumed>, 0x5555805bc8c0 /* 6 entries */, 32768) = 176
[pid  4050] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... mount resumed>)        = 0
[pid  4051] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4050] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] unlink("./0/binderfs" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] <... unlink resumed>)       = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4050] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4050] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4072] futex(0x7fbcc7395fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4051] unlink("./0/binderfs" <unfinished ...>
[pid  4050] newfstatat(AT_FDCWD, "./0/cgroup.net" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... unlink resumed>)       = 0
[pid  4050] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4067] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4051] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4050] unlink("./0/cgroup.net" <unfinished ...>
[pid  4067] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4050] <... unlink resumed>)       = 0
[pid  4051] newfstatat(AT_FDCWD, "./0/cgroup.net" <unfinished ...>
[pid  4050] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4050] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4084] <... futex resumed>)        = 0
[pid  4072] <... futex resumed>)        = 1
[pid  4067] <... mount resumed>)        = 0
[pid  4051] unlink("./0/cgroup.net" <unfinished ...>
[pid  4050] newfstatat(AT_FDCWD, "./0/cgroup.cpu" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4084] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid  4051] <... unlink resumed>)       = 0
[pid  4050] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4084] <... mmap resumed>)         = 0x200000000000
[pid  4072] futex(0x7fbcc7395fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4051] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4050] unlink("./0/cgroup.cpu" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4084] futex(0x7fbcc7395fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4067] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4084] <... futex resumed>)        = 0
[pid  4084] futex(0x7fbcc7395fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4067] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4050] <... unlink resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] newfstatat(AT_FDCWD, "./0/cgroup.cpu" <unfinished ...>
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup", 0700 <unfinished ...>
[pid  4051] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4050] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] unlink("./0/cgroup.cpu" <unfinished ...>
[pid  4050] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4072] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4051] <... unlink resumed>)       = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4072] futex(0x7fbcc7395fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/unified", 0700 <unfinished ...>
[pid  4051] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4050] newfstatat(AT_FDCWD, "./0/cgroup" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4084] <... futex resumed>)        = 0
[pid  4072] <... futex resumed>)        = 1
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4051] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4084] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/cpu", 0700 <unfinished ...>
[pid  4051] newfstatat(AT_FDCWD, "./0/cgroup" <unfinished ...>
[pid  4050] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4050] unlink("./0/cgroup" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] unlink("./0/cgroup" <unfinished ...>
[pid  4050] <... unlink resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4072] futex(0x7fbcc7395fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4084] <... mmap resumed>)         = 0x200001000000
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/newroot/syzcgroup/net", 0700 <unfinished ...>
[pid  4051] <... unlink resumed>)       = 0
[pid  4050] getdents64(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] <... getdents64 resumed>, 0x55557ab2e8c0 /* 0 entries */, 32768) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4084] futex(0x7fbcc7395fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4072] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4051] getdents64(3 <unfinished ...>
[pid  4050] close(3 <unfinished ...>
[pid  4084] <... futex resumed>)        = 0
[pid  4067] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4051] <... getdents64 resumed>, 0x5555805bc8c0 /* 0 entries */, 32768) = 0
[pid  4050] unlinkat(AT_FDCWD, "./0", AT_REMOVEDIR <unfinished ...>
[pid  4067] <... mount resumed>)        = 0
[pid  4051] close(3 <unfinished ...>
[pid  4050] <... unlinkat resumed>)     = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4084] futex(0x7fbcc7395fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4067] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4050] mkdirat(AT_FDCWD, "./1", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] unlinkat(AT_FDCWD, "./0", AT_REMOVEDIR <unfinished ...>
[pid  4050] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4072] close_range(3, 30, 0 <unfinished ...>
[pid  4067] <... mount resumed>)        = 0
[pid  4051] <... unlinkat resumed>)     = 0
[pid  4067] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4051] mkdirat(AT_FDCWD, "./1", 0777 <unfinished ...>
[pid  4072] <... close_range resumed>)  = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4072] exit_group(0 <unfinished ...>
[pid  4067] <... mount resumed>)        = 0
[pid  4051] <... mkdirat resumed>)      = 0
[pid  4084] <... futex resumed>)        = ?
[pid  4072] <... exit_group resumed>)   = ?
[pid  4067] mkdirat(AT_FDCWD, "./syz-tmp/pivot", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4084] +++ exited with 0 +++
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] openat(AT_FDCWD, "/dev/loop3", O_RDWR <unfinished ...>
[pid  4050] openat(AT_FDCWD, "/dev/loop1", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4051] <... openat resumed>)       = 3
[pid  4050] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid  4051] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] close(3 <unfinished ...>
[pid  4050] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... pivot_root resumed>)   = 0
[pid  4051] <... close resumed>)        = 0
[pid  4067] chdir("/" <unfinished ...>
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... chdir resumed>)        = 0
[pid  4067] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid  4051] <... socket resumed>)       = 3
[pid  4050] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... close resumed>)        = 0
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... socket resumed>)       = 3
[pid  4050] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... umount2 resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] chroot("./newroot" <unfinished ...>
[pid  4051] <... close resumed>)        = 0
[pid  4050] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... chroot resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] chdir("/" <unfinished ...>
[pid  4051] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... chdir resumed>)        = 0
[pid  4051] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4051] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... close resumed>)        = 0
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] mkdirat(AT_FDCWD, "/dev/gadgetfs", 0777 <unfinished ...>
[pid  4050] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4051] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4050] close(3 <unfinished ...>
[pid  4067] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid  4051] <... socket resumed>)       = 3
[pid  4050] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4054] +++ killed by SIGKILL +++
[pid  4051] close(3 <unfinished ...>
[pid  4050] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] <... close resumed>)        = 0
[pid  4050] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4051] read(249 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] <... close resumed>)        = 0
[pid  4050] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4050] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] read(249 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4072] +++ exited with 0 +++
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=1 /* 0.01 s */, si_stime=3 /* 0.03 s */} ---
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... rt_sigreturn resumed>) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4058] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
[pid  4058] fstat(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] getdents64(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... getdents64 resumed>, 0x5555860f18c0 /* 6 entries */, 32768) = 176
[pid  4058] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4058] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] unlink("./0/binderfs" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... unlink resumed>)       = 0
[pid  4058] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4058] newfstatat(AT_FDCWD, "./0/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4058] unlink("./0/cgroup.net" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... unlink resumed>)       = 0
[pid  4058] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4058] newfstatat(AT_FDCWD, "./0/cgroup.cpu" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4058] unlink("./0/cgroup.cpu")    = 0
[pid  4058] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4058] newfstatat(AT_FDCWD, "./0/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4058] unlink("./0/cgroup" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... unlink resumed>)       = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] getdents64(3, 0x5555860f18c0 /* 0 entries */, 32768) = 0
[pid  4058] close(3)                    = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] unlinkat(AT_FDCWD, "./0", AT_REMOVEDIR) = 0
[pid  4067] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4058] mkdirat(AT_FDCWD, "./1", 0777 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] mkdirat(AT_FDCWD, "/dev/binderfs", 0777) = -1 EEXIST (File exists)
[pid  4058] <... mkdirat resumed>)      = 0
[pid  4067] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid  4058] openat(AT_FDCWD, "/dev/loop4", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... openat resumed>)       = 3
[pid  4058] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... close resumed>)        = 0
[pid  4058] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4058] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4058] read(249 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... mount resumed>)        = -1 ENODEV (No such device)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] getpid( <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getpid resumed>)       = 1
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] mkdirat(AT_FDCWD, "/syzcgroup/unified/syz2", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] openat(AT_FDCWD, "/syzcgroup/unified/syz2/pids.max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] write(3, "32", 2 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... write resumed>)        = 2
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] openat(AT_FDCWD, "/syzcgroup/unified/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] write(3, "1", 1 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... write resumed>)        = 1
[pid  4067] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] mkdirat(AT_FDCWD, "/syzcgroup/cpu/syz2", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... openat resumed>)       = 3
[pid  4067] write(3, "1", 1 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... write resumed>)        = 1
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4067] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] write(3, "313524224", 9 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... write resumed>)        = 9
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] write(3, "314572800", 9 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... write resumed>)        = 9
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] mkdirat(AT_FDCWD, "/syzcgroup/net/syz2", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... mkdirat resumed>)      = -1 EEXIST (File exists)
[pid  4067] openat(AT_FDCWD, "/syzcgroup/net/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] write(3, "1", 1 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... write resumed>)        = 1
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4027] <... epoll_pwait resumed>, [], 128, 295, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4067] <... getsockopt resumed>, 0x7f187cc873e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4067] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4027] futex(0x17678927e960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc87a68, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] getsockopt(3, SOL_IP, EBT_SO_GET_INIT_INFO <unfinished ...>
[pid  4027] <... futex resumed>)        = 1
[pid  4026] <... futex resumed>)        = 0
[pid  4067] <... getsockopt resumed>, 0x7f187cc880e8, [120]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4067] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4026] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4026] write(5, "\x01\x00\x00\x00\x00\x00\x00\x00", 8 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4026] <... write resumed>)        = 8
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=54069954} <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN, data=0x33dbe88}], 128, 9991, NULL, 0) = 1
[pid  4067] <... close resumed>)        = 0
[pid  4026] futex(0x17678927e960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4027] read(5 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4027] <... read resumed>, "\x01\x00\x00\x00\x00\x00\x00\x00", 8) = 8
[pid  4067] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4067] getsockopt(3, SOL_IP, ARPT_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc88768, [68]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc8afc8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc8b688, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4067] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... getsockopt resumed>, 0x7f187cc8bd48, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc8c408, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] getsockopt(3, SOL_IP, IPT_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc8cac8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4067] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... socket resumed>)       = 3
[pid  4067] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc88e08, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... getsockopt resumed>, 0x7f187cc894c8, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc89b88, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc8a248, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] getsockopt(3, SOL_IPV6, IP6T_SO_GET_INFO <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... getsockopt resumed>, 0x7f187cc8a908, [84]) = -1 ENOPROTOOPT (Protocol not available)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] mkdirat(AT_FDCWD, "./0", 0777 <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 51, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4027] futex(0x17678927e960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4027] <... futex resumed>)        = 1
[pid  4026] <... futex resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4027] futex(0x17678927f160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=993749557} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] openat(AT_FDCWD, "/dev/loop2", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... socket resumed>)       = 3
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] read(249 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe0c2aaf000
[pid  4035] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4035] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7fe0c2aaf000, stack_size=0x9000}, 88/strace: Process 4087 attached
 <unfinished ...>
[pid  4087] rt_sigprocmask(SIG_BLOCK, NULL, ~[KILL STOP], 8) = 0
[pid  4087] setpgid(0, 0)               = 0
[pid  4087] dup2(20, 0)                 = 0
[pid  4087] dup2(29, 1)                 = 1
[pid  4087] dup2(37, 2)                 = 2
[pid  4087] dup2(7, 3)                  = 3
[pid  4087] dup2(8, 4)                  = 4
[pid  4087] close(5)                    = 0
[pid  4087] close(6)                    = 0
[pid  4087] close(7)                    = 0
[pid  4087] close(8)                    = 0
[pid  4087] close(9)                    = 0
[pid  4087] close(10)                   = 0
[pid  4087] close(11)                   = 0
[pid  4087] close(12)                   = 0
[pid  4087] close(13)                   = 0
[pid  4087] close(14)                   = 0
[pid  4087] close(15)                   = 0
[pid  4087] close(16)                   = 0
[pid  4087] close(17)                   = 0
[pid  4087] close(18)                   = 0
[pid  4087] close(19)                   = 0
[pid  4087] close(20)                   = 0
[pid  4087] close(21)                   = 0
[pid  4087] close(22)                   = 0
[pid  4087] close(23)                   = 0
[pid  4087] close(24)                   = 0
[pid  4087] close(25)                   = 0
[pid  4087] close(26)                   = 0
[pid  4087] close(27)                   = 0
[pid  4087] close(28)                   = 0
[pid  4087] close(29)                   = 0
[pid  4087] close(30)                   = 0
[pid  4087] close(31)                   = 0
[pid  4087] close(32)                   = 0
[pid  4087] close(33)                   = 0
[pid  4087] close(34)                   = 0
[pid  4087] close(35)                   = 0
[pid  4087] close(36)                   = 0
[pid  4087] close(37)                   = 0
[pid  4087] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4087] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] close(39)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(40)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(44)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(45)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(46)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(47)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(48)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(49)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(50)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(51)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(52)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(53)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(54)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(55)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(56)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(57)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(58)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(59)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(60)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(61)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(62)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(63 <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 994, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4026] futex(0x17678927f160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] <... futex resumed>)        = 0
[pid  4026] <... futex resumed>)        = 1
[pid  4025] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4087] close(64 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4025] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4087] close(65 <unfinished ...>
[pid  4027] futex(0x17678927f160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4087] close(66 <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=988542420} <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4087] close(67)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(68)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(70)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(71)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(72)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(75)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(76)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(77)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(79)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(80)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(81)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(82)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(84)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(85)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(86)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(87)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(88)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(89)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(90)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(92)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(93)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(94)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(95)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(96)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(98)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(99)                   = -1 EBADF (Bad file descriptor)
[pid  4087] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(102)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(104)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(106)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(110)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(118)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(119)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(120)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(129)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(130)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(134)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(135)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(142)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(154)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(155)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(158)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(163)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(164)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(168)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(169)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(182 <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 989, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4087] close(183 <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4087] close(184 <unfinished ...>
[pid  4026] futex(0x17678927f160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] <... futex resumed>)        = 0
[pid  4026] <... futex resumed>)        = 1
[pid  4087] close(185)                  = -1 EBADF (Bad file descriptor)
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4087] close(186 <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4087] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4026] futex(0x17678927e960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4087] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=989255961} <unfinished ...>
[pid  4087] close(188)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(189)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(190)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(191)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(194)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(195)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(196)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(200)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(202)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(204)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(205)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(206)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(207)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(208)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(209)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(210)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(211)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(213)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(214)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(215)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(216)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(217)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(218)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(219)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(220)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(223)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(224)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(225)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(228)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(229)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(230)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(231)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(232)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(233)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(234)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(235)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(236)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(237)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(240)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(241)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(244)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(245)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(246)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(247)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(248)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(251)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(252)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(253)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4087] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4087] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4087] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffedff15880 /* 2 vars */ <unfinished ...>
[pid  4035] <... clone3 resumed>)       = 4087
[pid  4035] munmap(0x7fe0c2aaf000, 36864 <unfinished ...>
[pid  4087] <... execve resumed>)       = 0
[pid  4035] <... munmap resumed>)       = 0
[pid  4035] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4035] fcntl(23, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(23, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] fcntl(35, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(35, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] close(20)                   = 0
[pid  4035] close(29)                   = 0
[pid  4035] close(37)                   = 0
[pid  4035] close(10)                   = 0
[pid  4087] brk(NULL <unfinished ...>
[pid  4035] close(11 <unfinished ...>
[pid  4087] <... brk resumed>)          = 0x55558d566000
[pid  4087] brk(0x55558d566e80)         = 0x55558d566e80
[pid  4035] <... close resumed>)        = 0
[pid  4087] arch_prctl(ARCH_SET_FS, 0x55558d566500 <unfinished ...>
[pid  4035] close(13 <unfinished ...>
[pid  4087] <... arch_prctl resumed>)   = 0
[pid  4035] <... close resumed>)        = 0
[pid  4035] write(21, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\xb8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64 <unfinished ...>
[pid  4087] set_tid_address(0x55558d5667d0) = 4087
[pid  4035] <... write resumed>)        = 64
[pid  4035] pselect6(37, [3 16 18 23 26 28 31 33 34 35 36], NULL, NULL, {tv_sec=1, tv_nsec=0}, {sigmask=NULL, sigsetsize=8}) = 4 (in [16 26 31 34], left {tv_sec=0, tv_nsec=999979701})
[pid  4035] read(16 <unfinished ...>
[pid  4087] set_robust_list(0x55558d5667e0, 24 <unfinished ...>
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4087] <... set_robust_list resumed>) = 0
[pid  4035] write(3, "\xb4\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x01\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 184 <unfinished ...>
[pid  4087] prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3f9a33f30c000002}], 128, 990, NULL, 0) = 1
[pid  4087] readlinkat(AT_FDCWD, "/proc/self/exe" <unfinished ...>
[pid  4035] <... write resumed>)        = 184
[pid  4027] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4087] <... readlinkat resumed>, "/syz-executor", 4096) = 13
[pid  4035] kill(4046, SIGKILL)         = 0
[pid  4087] getrandom( <unfinished ...>
[pid  4027] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4087] <... getrandom resumed>"\x26\x2f\x92\x88\xa0\xdc\x9e\x28", 8, GRND_NONBLOCK) = 8
[pid  4087] brk(NULL)                   = 0x55558d566e80
[pid  4087] brk(0x55558d587e80 <unfinished ...>
[pid  4025] sched_yield( <unfinished ...>
[pid  4087] <... brk resumed>)          = 0x55558d587e80
[pid  4087] brk(0x55558d588000)         = 0x55558d588000
[pid  4027] read(6 <unfinished ...>
[pid  4087] mprotect(0x7f0c2b159000, 1236992, PROT_READ <unfinished ...>
[pid  4027] <... read resumed>, "\xb4\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x01\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 21347228) = 184
[pid  4027] futex(0x17678927e960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4087] <... mprotect resumed>)     = 0
[pid  4027] <... futex resumed>)        = 1
[pid  4027] read(6 <unfinished ...>
[pid  4026] <... futex resumed>)        = 0
[pid  4046] +++ killed by SIGKILL +++
[pid  4027] <... read resumed>, 0x17678d500000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4026] write(5, "\x01\x00\x00\x00\x00\x00\x00\x00", 8 <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN, data=0x33dbe88}], 128, 7244, NULL, 0) = 1
[pid  4026] <... write resumed>)        = 8
[pid  4050] <... read resumed> <unfinished ...>) = ?
[pid  4027] read(5 <unfinished ...>
[pid  4026] futex(0x17678927e960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4087] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4046, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=2 /* 0.02 s */} ---
[pid  4027] <... read resumed>, "\x01\x00\x00\x00\x00\x00\x00\x00", 8) = 8
[pid  4025] <... sched_yield resumed>)  = 0
[pid  4035] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4087] <... prctl resumed>)        = 0
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4087] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4087] <... mmap resumed>)         = 0x1ffffffff000
[pid  4087] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200000000000
[pid  4035] <... rt_sigreturn resumed>) = 4046
[pid  4025] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4087] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0 <unfinished ...>
[pid  4035] pipe2( <unfinished ...>
[pid  4025] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4087] <... mmap resumed>)         = 0x200001000000
[pid  4087] rt_sigaction(SIGCHLD, {sa_handler=0x7f0c2aef0780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f0c2afde1d0}, NULL, 8) = 0
[pid  4087] pkey_alloc(0, PKEY_UNRESTRICTED) = -1 EINVAL (Invalid argument)
[pid  4087] getrandom( <unfinished ...>
[pid  4035] <... pipe2 resumed>[10, 11], 0) = 0
[pid  4087] <... getrandom resumed>"\x1c\x7e\xdc\xba\x57\x99\x15\x1a", 8, GRND_NONBLOCK) = 8
[pid  4087] mkdir("./syzkaller.6xqM0E", 0700) = 0
[pid  4035] pipe2( <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=313797104} <unfinished ...>
[pid  4087] chmod("./syzkaller.6xqM0E", 0777 <unfinished ...>
[pid  4035] <... pipe2 resumed>[13, 20], 0) = 0
[pid  4087] <... chmod resumed>)        = 0
[pid  4035] pipe2( <unfinished ...>
[pid  4087] chdir("./syzkaller.6xqM0E" <unfinished ...>
[pid  4035] <... pipe2 resumed>[29, 37], 0) = 0
[pid  4087] <... chdir resumed>)        = 0
[pid  4087] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4087] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4050] +++ killed by SIGKILL +++
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] rt_sigaction(SIGSEGV, {sa_handler=0x7f0c2aef2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f0c2afde1d0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] rt_sigaction(SIGBUS, {sa_handler=0x7f0c2aef2b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f0c2afde1d0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4087] getpid( <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... getpid resumed>)       = 4087
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] mmap(0x1b33320000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... mmap resumed>)         = 0x1b33320000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] getpid( <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... getpid resumed>)       = 4087
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] mmap(0x1b34324000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... mmap resumed>)         = 0x1b34324000
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] fcntl(5, F_GETFD <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] fcntl(6, F_GETFD <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] dup2(0, 249 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... dup2 resumed>)         = 249
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] dup2(1, 248 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... dup2 resumed>)         = 248
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] dup2(2, 1 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... dup2 resumed>)         = 1
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] dup2(2, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... dup2 resumed>)         = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] read(249 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\xb8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] unshare(CLONE_NEWPID <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... unshare resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
/strace: Process 4088 attached
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] set_robust_list(0x55558d5667e0, 24 <unfinished ...>
[pid  4087] <... clone resumed>, child_tidptr=0x55558d5667d0) = 4088
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4088] <... set_robust_list resumed>) = 0
[pid  4087] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] openat(AT_FDCWD, "/dev/vhci", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] write(2, "SYZFAIL: open /dev/vhci failed\n", 31 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... write resumed>)        = 31
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] write(2, " (errno 2: No such file or directory)\n", 38 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4088] <... write resumed>)        = 38
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] exit_group(67 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] <... exit_group resumed>)   = ?
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4088] +++ exited with 67 +++
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4088, si_uid=0, si_status=67, si_utime=0, si_stime=1 /* 0.01 s */} ---
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... rt_sigreturn resumed>) = 4088
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] write(2, "loop exited with status 67\n", 27 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... write resumed>)        = 27
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] write(248, "\x43\x00\x00\x00", 4 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] exit_group(67 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4087] <... exit_group resumed>)   = ?
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4087] +++ exited with 67 +++
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4087, si_uid=0, si_status=67, si_utime=0, si_stime=3 /* 0.03 s */} ---
[pid  4035] rt_sigreturn({mask=[]})     = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 317, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4027] futex(0x17678927e960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4026] <... futex resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4027] <... futex resumed>)        = 1
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4026] futex(0x17678927e960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=978955122} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4035] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 979, NULL, 0) = 0
[pid  4025] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4035] <... mmap resumed>)         = 0x7fe0c2aaf000
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4025] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4035] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4035] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4027] futex(0x17678927e960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4035] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7fe0c2aaf000, stack_size=0x9000}, 88 <unfinished ...>
[pid  4027] <... futex resumed>)        = 1
[pid  4026] <... futex resumed>)        = 0
[pid  4026] epoll_pwait(4/strace: Process 4089 attached
 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4089] rt_sigprocmask(SIG_BLOCK, NULL <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4026] write(5, "\x01\x00\x00\x00\x00\x00\x00\x00", 8 <unfinished ...>
[pid  4089] <... rt_sigprocmask resumed>, ~[KILL STOP], 8) = 0
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN, data=0x33dbe88}], 128, 5922, NULL, 0) = 1
[pid  4026] <... write resumed>)        = 8
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=996547390} <unfinished ...>
[pid  4089] setpgid(0, 0 <unfinished ...>
[pid  4027] read(5 <unfinished ...>
[pid  4026] futex(0x17678927e960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4089] <... setpgid resumed>)      = 0
[pid  4027] <... read resumed>, "\x01\x00\x00\x00\x00\x00\x00\x00", 8) = 8
[pid  4089] dup2(10, 0 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4089] <... dup2 resumed>)         = 0
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4089] dup2(20, 1)                 = 1
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4089] dup2(37, 2)                 = 2
[pid  4089] dup2(9, 3)                  = 3
[pid  4089] dup2(12, 4)                 = 4
[pid  4089] close(5)                    = 0
[pid  4089] close(6)                    = 0
[pid  4089] close(7)                    = 0
[pid  4089] close(8)                    = 0
[pid  4089] close(9)                    = 0
[pid  4089] close(10)                   = 0
[pid  4089] close(11)                   = 0
[pid  4089] close(12)                   = 0
[pid  4089] close(13)                   = 0
[pid  4089] close(14)                   = 0
[pid  4089] close(15)                   = 0
[pid  4089] close(16)                   = 0
[pid  4089] close(17)                   = 0
[pid  4089] close(18)                   = 0
[pid  4089] close(19)                   = 0
[pid  4089] close(20)                   = 0
[pid  4089] close(21)                   = 0
[pid  4089] close(22)                   = 0
[pid  4089] close(23)                   = 0
[pid  4089] close(24)                   = 0
[pid  4089] close(25)                   = 0
[pid  4089] close(26)                   = 0
[pid  4089] close(27)                   = 0
[pid  4089] close(28)                   = 0
[pid  4089] close(29)                   = 0
[pid  4089] close(30)                   = 0
[pid  4089] close(31)                   = 0
[pid  4089] close(32)                   = 0
[pid  4089] close(33)                   = 0
[pid  4089] close(34)                   = 0
[pid  4089] close(35)                   = 0
[pid  4089] close(36)                   = 0
[pid  4089] close(37)                   = 0
[pid  4089] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4089] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] close(39)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(40)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(44)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(45)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(46)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(47)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(48)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(49)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(50)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(51)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(52)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(53)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(54)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(55)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(56)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(57)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(58)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(59)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(60)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(61)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(62)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(63)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(64)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(65)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(66)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(67)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(68)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(70)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(71)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(72)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(75)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(76)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(77)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(79)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(80)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(81)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(82)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(84)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(85)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(86)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(87)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(88)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(89)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(90)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(92)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(93)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(94)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(95)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(96)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(98)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(99)                   = -1 EBADF (Bad file descriptor)
[pid  4089] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(102)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(104)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(106)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(110)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(118 <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 996, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4025] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4089] close(119 <unfinished ...>
[pid  4027] futex(0x17678927e960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4025] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(120 <unfinished ...>
[pid  4027] <... futex resumed>)        = 1
[pid  4026] <... futex resumed>)        = 0
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4089] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4089] close(122 <unfinished ...>
[pid  4027] futex(0x17678927f160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=988260759} <unfinished ...>
[pid  4089] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4089] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(129)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(130)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(134)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(135)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(142)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(154)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(155)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(158)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(163)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(164)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(168)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(169)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(182)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(183)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(184)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(185)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(186)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(187)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(188)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(189)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(190)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(191)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(192)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(193)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(194)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(195)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(196)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(197)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(198)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(199)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(200)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(201)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(202)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(203)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(204)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(205)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(206)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(207)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(208)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(209)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(210)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(211)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(212)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(213)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(214)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(215)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(216)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(217)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(218)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(219)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(220)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(221)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(222)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(223)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(224)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(225)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(226)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(227)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(228)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(229)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(230)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(231)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(232)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(233)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(234)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(235)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(236)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(237)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(238)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(239)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(240)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(241)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(242)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(243)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(244)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(245)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(246)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(247)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(248)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(249)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(250)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(251)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(252)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(253)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(254)                  = -1 EBADF (Bad file descriptor)
[pid  4089] close(255)                  = -1 EBADF (Bad file descriptor)
[pid  4089] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4089] execve("/syz-executor", ["/syz-executor", "exec"], 0x7ffedff15880 /* 2 vars */ <unfinished ...>
[pid  4035] <... clone3 resumed>)       = 4089
[pid  4089] <... execve resumed>)       = 0
[pid  4035] munmap(0x7fe0c2aaf000, 36864) = 0
[pid  4035] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4035] fcntl(13, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(13, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] fcntl(29, F_GETFL)          = 0 (flags O_RDONLY)
[pid  4035] fcntl(29, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
[pid  4035] close(10)                   = 0
[pid  4035] close(20)                   = 0
[pid  4035] close(37)                   = 0
[pid  4035] close(15)                   = 0
[pid  4035] close(16)                   = 0
[pid  4035] close(18)                   = 0
[pid  4089] brk(NULL <unfinished ...>
[pid  4035] write(11, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\x3a\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64 <unfinished ...>
[pid  4089] <... brk resumed>)          = 0x555578548000
[pid  4035] <... write resumed>)        = 64
[pid  4089] brk(0x555578548e80 <unfinished ...>
[pid  4035] read(34, "\x00\x00\x00\x00", 4) = 4
[pid  4089] <... brk resumed>)          = 0x555578548e80
[pid  4035] write(3, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x02\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00", 56) = 56
[pid  4089] arch_prctl(ARCH_SET_FS, 0x555578548500 <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3f9a33f30c000002}], 128, 988, NULL, 0) = 1
[pid  4089] <... arch_prctl resumed>)   = 0
[pid  4089] set_tid_address(0x5555785487d0 <unfinished ...>
[pid  4026] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4089] <... set_tid_address resumed>) = 4089
[pid  4026] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4089] set_robust_list(0x5555785487e0, 24 <unfinished ...>
[pid  4026] read(6 <unfinished ...>
[pid  4025] sched_yield( <unfinished ...>
[pid  4089] <... set_robust_list resumed>) = 0
[pid  4026] <... read resumed>, "\x34\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x02\x0c\x00\x00\x00\x08\x00\x10\x00\x08\x00\x04\x00\x08\x00\x00\x00\x02\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00", 21347228) = 56
[pid  4026] write(6, "\x84\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0a\x00\x09\x00\x04\x00\x08\x00\x00\x00\x18\x00\x00\x00\x00\x01\x12\x00\x44\x00\x38\x00\x30\x00\x00\x00\x2c\x00\x10\x00\x08\x00\x04\x00\x12\x00\x00\x00\x40\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00\x02\x00\x00\x00"..., 136 <unfinished ...>
[pid  4025] <... sched_yield resumed>)  = 0
[pid  4089] prlimit64(0, RLIMIT_STACK, NULL <unfinished ...>
[pid  4026] <... write resumed>)        = 136
[pid  4089] <... prlimit64 resumed>, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
[pid  4026] read(6 <unfinished ...>
[pid  4089] readlinkat(AT_FDCWD, "/proc/self/exe" <unfinished ...>
[pid  4026] <... read resumed>, 0x17678d500000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4089] <... readlinkat resumed>, "/syz-executor", 4096) = 13
[pid  4026] epoll_pwait(4, [], 128, 0, NULL, 0) = 0
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4089] getrandom("\x90\xdd\x37\xb6\x90\xe3\x0a\x0c", 8, GRND_NONBLOCK) = 8
[pid  4089] brk(NULL <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=89773009} <unfinished ...>
[pid  4089] <... brk resumed>)          = 0x555578548e80
[pid  4089] brk(0x555578569e80)         = 0x555578569e80
[pid  4089] brk(0x55557856a000)         = 0x55557856a000
[pid  4089] mprotect(0x7f1418469000, 1236992, PROT_READ) = 0
[pid  4089] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  4089] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x1ffffffff000
[pid  4089] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200000000000
[pid  4089] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED_NOREPLACE, -1, 0) = 0x200001000000
[pid  4089] rt_sigaction(SIGCHLD, {sa_handler=0x7f1418200780, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f14182ee1d0}, NULL, 8) = 0
[pid  4089] pkey_alloc(0, PKEY_UNRESTRICTED) = -1 EINVAL (Invalid argument)
[pid  4089] getrandom("\x81\xf8\xcb\xa5\x65\xaa\xca\x2b", 8, GRND_NONBLOCK) = 8
[pid  4089] mkdir("./syzkaller.50io8K", 0700) = 0
[pid  4089] chmod("./syzkaller.50io8K", 0777 <unfinished ...>
[pid  4035] write(32, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48 <unfinished ...>
[pid  4067] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 48) = 48
[pid  4035] <... write resumed>)        = 48
[pid  4067] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] read(26 <unfinished ...>
[pid  4089] <... chmod resumed>)        = 0
[pid  4067] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] <... read resumed>, "\x00\x00\x00\x00", 4) = 4
[pid  4067] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4089] chdir("./syzkaller.50io8K") = 0
[pid  4089] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0} <unfinished ...>
[pid  4035] write(3, "\xb4\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x03\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 184 <unfinished ...>
[pid  4089] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4089] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
[pid  4089] rt_sigaction(SIGSEGV, {sa_handler=0x7f1418202b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f14182ee1d0}, NULL, 8) = 0
[pid  4089] rt_sigaction(SIGBUS, {sa_handler=0x7f1418202b20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f14182ee1d0}, NULL, 8) = 0
[pid  4089] getpid()                    = 4089
[pid  4089] mmap(0x1b33520000, 4194304, PROT_READ, MAP_SHARED|MAP_FIXED_NOREPLACE, 3, 0) = 0x1b33520000
[pid  4089] getpid(/strace: Process 4090 attached
 <unfinished ...>
[pid  4035] <... write resumed>)        = 184
[pid  4026] <... epoll_pwait resumed>, [{events=EPOLLIN|EPOLLOUT, data=0x3f9a33f30c000002}], 128, 101, NULL, 0) = 1
[pid  4090] set_robust_list(0x55557fef97e0, 24 <unfinished ...>
[pid  4089] <... getpid resumed>)       = 4089
[pid  4067] <... clone resumed>, child_tidptr=0x55557fef97d0) = 2
[pid  4035] kill(4048, SIGKILL <unfinished ...>
[pid  4026] futex(0x33bd380, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4090] <... set_robust_list resumed>) = 0
[pid  4089] mmap(0x1b34524000, 262144, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED_NOREPLACE, 4, 0 <unfinished ...>
[pid  4067] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] <... kill resumed>)         = 0
[pid  4026] <... futex resumed>)        = 1
[pid  4025] <... futex resumed>)        = 0
[pid  4090] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4089] <... mmap resumed>)         = 0x1b34524000
[pid  4067] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4026] read(6 <unfinished ...>
[pid  4090] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4089] close(3 <unfinished ...>
[pid  4051] <... read resumed> <unfinished ...>) = ?
[pid  4048] +++ killed by SIGKILL +++
[pid  4026] <... read resumed>, "\xb4\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x08\x00\x0c\x00\x07\x00\x08\x00\x08\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x10\x00\x1c\x00\x10\x00\x04\x00\x08\x00\x00\x00\x00\x00\x0c\x00\x10\x00\x00\x00\x03\x00\x00\x00\x14\x00\x00\x00\x20\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x18\x00\x04\x00\x08\x00\x00\x00\x0c\x00\x0c\x00\x00\x00\x18\x00\x00\x00"..., 21347228) = 184
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4090] chdir("./0" <unfinished ...>
[pid  4089] <... close resumed>)        = 0
[pid  4026] futex(0x17678927f160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4025] epoll_pwait(4, [], 128, 0, NULL, 0) = 0
[pid  4025] getpid()                    = 4024
[pid  4025] tgkill(4024, 4026, SIGURG)  = 0
[pid  4090] <... chdir resumed>)        = 0
[pid  4089] fcntl(5, F_GETFD <unfinished ...>
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4048, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=3 /* 0.03 s */} ---
[pid  4027] <... futex resumed>)        = 0
[pid  4026] <... futex resumed>)        = 1
[pid  4089] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] --- SIGURG {si_signo=SIGURG, si_code=SI_TKILL, si_pid=4024, si_uid=0} ---
[pid  4089] fcntl(6, F_GETFD <unfinished ...>
[pid  4035] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4090] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  4089] <... fcntl resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4026] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4090] <... prctl resumed>)        = 0
[pid  4089] dup2(0, 249 <unfinished ...>
[pid  4035] <... rt_sigreturn resumed>) = 4048
[pid  4026] <... rt_sigreturn resumed>) = 1
[pid  4089] <... dup2 resumed>)         = 249
[pid  4035] pipe2( <unfinished ...>
[pid  4090] setpgid(0, 0 <unfinished ...>
[pid  4089] dup2(1, 248 <unfinished ...>
[pid  4035] <... pipe2 resumed>[10, 15], 0) = 0
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] read(6 <unfinished ...>
[pid  4090] <... setpgid resumed>)      = 0
[pid  4026] <... read resumed>, 0x17678d500000, 21347228) = -1 EAGAIN (Resource temporarily unavailable)
[pid  4089] <... dup2 resumed>)         = 248
[pid  4035] pipe2( <unfinished ...>
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4035] <... pipe2 resumed>[16, 18], 0) = 0
[pid  4089] dup2(2, 1 <unfinished ...>
[pid  4027] futex(0x17678927f160, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=15615518} <unfinished ...>
[pid  4089] <... dup2 resumed>)         = 1
[pid  4089] dup2(2, 0 <unfinished ...>
[pid  4035] pipe2( <unfinished ...>
[pid  4089] <... dup2 resumed>)         = 0
[pid  4090] symlinkat("/syzcgroup/unified/syz2", AT_FDCWD, "./cgroup" <unfinished ...>
[pid  4089] read(249 <unfinished ...>
[pid  4035] <... pipe2 resumed>[20, 37], 0) = 0
[pid  4090] <... symlinkat resumed>)    = 0
[pid  4089] <... read resumed>, "\xce\xfa\xad\xeb\xfe\x0f\xdc\xba\x01\x01\x00\x00\x00\x00\x00\x00\x10\x3a\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 64) = 64
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] symlinkat("/syzcgroup/cpu/syz2", AT_FDCWD, "./cgroup.cpu" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] <... symlinkat resumed>)    = 0
[pid  4089] unshare(CLONE_NEWPID <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] symlinkat("/syzcgroup/net/syz2", AT_FDCWD, "./cgroup.net") = 0
[pid  4089] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4089] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] <... openat resumed>)       = 3
[pid  4089] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] write(3, "1000", 4 <unfinished ...>
[pid  4089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  4090] <... write resumed>)        = 4
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] symlinkat("/dev/binderfs", AT_FDCWD, "./binderfs") = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] close(249 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] <... close resumed>)        = 0
[pid  4090] close(248 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] prctl(PR_SET_NAME, "syz.2.6" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
/strace: Process 4091 attached
[pid  4090] <... prctl resumed>)        = 0
[pid  4089] <... clone resumed>, child_tidptr=0x5555785487d0) = 4091
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] set_robust_list(0x5555785487e0, 24 <unfinished ...>
[pid  4090] close(4)                    = 0
[pid  4089] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] futex(0x7f187ccb5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4089] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4051] +++ killed by SIGKILL +++
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 15, NULL, 0) = 0
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4091] <... set_robust_list resumed>) = 0
[pid  4091] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4090] <... futex resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4091] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4090] rt_sigaction(SIGRT_1, {sa_handler=0x7f187ca5c3d0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f187c9de1d0} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4091] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  4091] getppid()                   = 0
[pid  4091] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid  4090] <... rt_sigaction resumed>, NULL, 8) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4026] futex(0x17678927f160, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4090] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] <unfinished ...>
[pid  4091] dup2(3, 201 <unfinished ...>
[pid  4090] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4027] <... futex resumed>)        = 0
[pid  4026] <... futex resumed>)        = 1
[pid  4091] <... dup2 resumed>)         = 201
[pid  4025] epoll_pwait(4 <unfinished ...>
[pid  4091] close(3 <unfinished ...>
[pid  4025] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4091] <... close resumed>)        = 0
[pid  4025] sched_getaffinity(0, 8192 <unfinished ...>
[pid  4091] prlimit64(0, RLIMIT_AS, {rlim_cur=344064*1024, rlim_max=344064*1024} <unfinished ...>
[pid  4025] <... sched_getaffinity resumed>, [0 1]) = 8
[pid  4091] <... prlimit64 resumed>, NULL) = 0
[pid  4091] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  4091] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  4091] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid  4091] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  4091] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} <unfinished ...>
[pid  4090] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4091] <... prlimit64 resumed>, NULL) = 0
[pid  4090] <... mmap resumed>)         = 0x7f187c877000
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4091] unshare(CLONE_NEWNS <unfinished ...>
[pid  4090] mprotect(0x7f187c878000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4026] futex(0x17678927e960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=956883279} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] <... mprotect resumed>)     = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  4091] <... unshare resumed>)      = 0
[pid  4090] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid  4090] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f187c897990, parent_tid=0x7f187c897990, exit_signal=0, stack=0x7f187c877000, stack_size=0x201c0, tls=0x7f187c8976c0} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
/strace: Process 4092 attached
[pid  4091] <... mount resumed>)        = 0
[pid  4090] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid  4091] unshare(CLONE_NEWIPC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  4092] set_robust_list(0x7f187c8979a0, 24 <unfinished ...>
[pid  4091] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... set_robust_list resumed>) = 0
[pid  4090] futex(0x7f187ccb5fa8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid  4090] futex(0x7f187ccb5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4092] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  4091] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  4091] <... unshare resumed>)      = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
[pid  4091] unshare(CLONE_NEWUTS <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] futex(0x7f187ccb5fac, FUTEX_WAKE_PRIVATE, 1000000) = 1
[pid  4092] futex(0x7f187ccb5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4091] <... unshare resumed>)      = 0
[pid  4090] <... futex resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] futex(0x7f187ccb5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4091] unshare(CLONE_SYSVSEM <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... unshare resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] write(3, "16777216", 8 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... write resumed>)        = 8
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4090] <... futex resumed>)        = 1
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] <... futex resumed>)        = 0
[pid  4091] write(3, "536870912", 9 <unfinished ...>
[pid  4090] futex(0x7f187ccb5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4091] <... write resumed>)        = 9
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... mmap resumed>)         = 0x200000000000
[pid  4091] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] futex(0x7f187ccb5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4091] <... close resumed>)        = 0
[pid  4092] <... futex resumed>)        = 1
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4090] <... futex resumed>)        = 0
[pid  4092] futex(0x7f187ccb5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4091] <... openat resumed>)       = 3
[pid  4090] futex(0x7f187ccb5fa8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  4091] write(3, "1024", 4 <unfinished ...>
[pid  4090] <... futex resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4092] <... mmap resumed>)         = 0x200001000000
[pid  4091] <... write resumed>)        = 4
[pid  4090] futex(0x7f187ccb5fac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] futex(0x7f187ccb5fac, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid  4091] close(3 <unfinished ...>
[pid  4090] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid  4092] <... futex resumed>)        = 0
[pid  4091] <... close resumed>)        = 0
[pid  4090] close_range(3, 30, 0 <unfinished ...>
[pid  4092] futex(0x7f187ccb5fa8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4091] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4090] <... close_range resumed>)  = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... openat resumed>)       = 3
[pid  4090] exit_group(0 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] write(3, "8192", 4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] <... futex resumed>)        = ?
[pid  4091] <... write resumed>)        = 4
[pid  4090] <... exit_group resumed>)   = ?
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4092] +++ exited with 0 +++
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... close resumed>)        = 0
[pid  4090] +++ exited with 0 +++
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4067] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... rt_sigreturn resumed>) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] write(3, "1024", 4 <unfinished ...>
[pid  4067] write(248, "\x00\x00\x00\x00", 4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... write resumed>)        = 4
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] close(3 <unfinished ...>
[pid  4067] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4067] fstat(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=120, ...}) = 0
[pid  4067] getdents64(3, 0x55557ff0c900 /* 6 entries */, 32768) = 176
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... openat resumed>)       = 3
[pid  4067] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] write(3, "1024", 4 <unfinished ...>
[pid  4067] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... write resumed>)        = 4
[pid  4067] newfstatat(AT_FDCWD, "./0/binderfs" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] close(3 <unfinished ...>
[pid  4067] unlink("./0/binderfs" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... close resumed>)        = 0
[pid  4067] <... unlink resumed>)       = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4067] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... openat resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] write(3, "1024 1048576 500 1024", 21 <unfinished ...>
[pid  4067] newfstatat(AT_FDCWD, "./0/cgroup.net" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... write resumed>)        = 21
[pid  4067] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] close(3 <unfinished ...>
[pid  4067] unlink("./0/cgroup.net" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... close resumed>)        = 0
[pid  4067] <... unlink resumed>)       = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] getpid( <unfinished ...>
[pid  4067] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... getpid resumed>)       = 1
[pid  4067] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} <unfinished ...>
[pid  4067] newfstatat(AT_FDCWD, "./0/cgroup.cpu" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... capget resumed>, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid  4067] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] <... capset resumed>)       = 0
[pid  4067] unlink("./0/cgroup.cpu" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] unshare(CLONE_NEWNET <unfinished ...>
[pid  4067] <... unlink resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  4067] newfstatat(AT_FDCWD, "./0/cgroup" <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] unlink("./0/cgroup" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... unshare resumed>)      = 0
[pid  4067] <... unlink resumed>)       = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4067] getdents64(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... getdents64 resumed>, 0x55557ff0c900 /* 0 entries */, 32768) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] unlinkat(AT_FDCWD, "./0", AT_REMOVEDIR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... unlinkat resumed>)     = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... openat resumed>)       = 3
[pid  4067] mkdirat(AT_FDCWD, "./1", 0777 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] write(3, "0 65535", 7 <unfinished ...>
[pid  4067] <... mkdirat resumed>)      = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... write resumed>)        = 7
[pid  4067] openat(AT_FDCWD, "/dev/loop2", O_RDWR <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] close(3 <unfinished ...>
[pid  4067] <... openat resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... close resumed>)        = 0
[pid  4067] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] newfstatat(AT_FDCWD, "/dev/net/tun" <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... close resumed>)        = 0
[pid  4091] <... newfstatat resumed>, {st_mode=S_IFCHR|0666, st_rdev=makedev(0xa, 0xc8), ...}, 0) = 0
[pid  4067] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4091] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] close(3 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... close resumed>)        = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] socket(AF_INET, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] <... socket resumed>)       = 3
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... socket resumed>)       = 3
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4067] close(3 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] <... close resumed>)        = 0
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4067] read(249 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] <... openat resumed>)       = -1 ENODEV (No such device)
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4091] write(2, "SYZFAIL: tun: can't open /dev/net/tun\n", 38) = 38
[pid  4091] write(2, " (errno 19: No such device)\n", 28) = 28
[pid  4091] exit_group(67)              = ?
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4091] +++ exited with 67 +++
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4091, si_uid=0, si_status=67, si_utime=0, si_stime=3 /* 0.03 s */} ---
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] rt_sigreturn({mask=[]} <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] <... rt_sigreturn resumed>) = 4091
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] write(2, "loop exited with status 67\n", 27 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] <... write resumed>)        = 27
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] write(248, "\x43\x00\x00\x00", 4 <unfinished ...>
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] <... write resumed>)        = 4
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4089] exit_group(67 <unfinished ...>
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] <... exit_group resumed>)   = ?
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL <unfinished ...>
[pid  4089] +++ exited with 67 +++
[pid  4035] <... prlimit64 resumed>, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4089, si_uid=0, si_status=67, si_utime=0, si_stime=5 /* 0.05 s */} ---
[pid  4035] rt_sigreturn({mask=[]})     = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4035] mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe0c2aaf000
[pid  4035] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  4035] clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7fe0c2aaf000, stack_size=0x9000}, 88/strace: Process 4095 attached
 <unfinished ...>
[pid  4095] rt_sigprocmask(SIG_BLOCK, NULL, ~[KILL STOP], 8) = 0
[pid  4095] setpgid(0, 0)               = 0
[pid  4095] dup2(10, 0)                 = 0
[pid  4095] dup2(18, 1)                 = 1
[pid  4095] dup2(37, 2)                 = 2
[pid  4095] dup2(19, 3)                 = 3
[pid  4095] dup2(22, 4)                 = 4
[pid  4095] close(5)                    = 0
[pid  4095] close(6)                    = 0
[pid  4095] close(7)                    = 0
[pid  4095] close(8)                    = 0
[pid  4095] close(9)                    = 0
[pid  4095] close(10)                   = 0
[pid  4095] close(11)                   = 0
[pid  4095] close(12)                   = 0
[pid  4095] close(13)                   = 0
[pid  4095] close(14)                   = 0
[pid  4095] close(15)                   = 0
[pid  4095] close(16)                   = 0
[pid  4095] close(17)                   = 0
[pid  4095] close(18)                   = 0
[pid  4095] close(19)                   = 0
[pid  4095] close(20)                   = 0
[pid  4095] close(21)                   = 0
[pid  4095] close(22)                   = 0
[pid  4095] close(23)                   = 0
[pid  4095] close(24)                   = 0
[pid  4095] close(25)                   = 0
[pid  4095] close(26)                   = 0
[pid  4095] close(27)                   = 0
[pid  4095] close(28)                   = 0
[pid  4095] close(29)                   = 0
[pid  4095] close(30)                   = 0
[pid  4095] close(31)                   = 0
[pid  4095] close(32)                   = 0
[pid  4095] close(33)                   = 0
[pid  4095] close(34)                   = 0
[pid  4095] close(35)                   = 0
[pid  4095] close(36)                   = 0
[pid  4095] close(37)                   = 0
[pid  4095] close(38)                   = -1 EBADF (Bad file descriptor)
[pid  4095] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=256, rlim_max=256}) = 0
[pid  4095] close(39)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(40)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(41)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(42)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(43)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(44)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(45)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(46)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(47)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(48)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(49)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(50)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(51)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(52)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(53)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(54)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(55)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(56)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(57)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(58)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(59)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(60)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(61)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(62)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(63)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(64)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(65)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(66)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(67)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(68)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(69)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(70)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(71)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(72)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(73)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(74)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(75)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(76)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(77)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(78)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(79)                   = -1 EBADF (Bad file descriptor)
[pid  4025] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid  4095] close(80)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(81)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(82)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(83)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(84)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(85)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(86)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(87)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(88)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(89)                   = -1 EBADF (Bad file descriptor)
[pid  4027] <... epoll_pwait resumed>, [], 128, 970, NULL, 0) = 0
[pid  4095] close(90 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4095] close(91)                   = -1 EBADF (Bad file descriptor)
[pid  4027] futex(0x17678927e960, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  4095] close(92 <unfinished ...>
[pid  4027] <... futex resumed>)        = 1
[pid  4026] <... futex resumed>)        = 0
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4026] epoll_pwait(4 <unfinished ...>
[pid  4095] close(93 <unfinished ...>
[pid  4026] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4026] write(5, "\x01\x00\x00\x00\x00\x00\x00\x00", 8 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] <... epoll_pwait resumed>, [{events=EPOLLIN, data=0x33dbe88}], 128, 2905, NULL, 0) = 1
[pid  4026] <... write resumed>)        = 8
[pid  4025] futex(0x33bd380, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=979530869} <unfinished ...>
[pid  4095] close(94 <unfinished ...>
[pid  4027] read(5 <unfinished ...>
[pid  4026] futex(0x17678927e960, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] <... read resumed>, "\x01\x00\x00\x00\x00\x00\x00\x00", 8) = 8
[pid  4095] close(95 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4027] <... epoll_pwait resumed>, [], 128, 0, NULL, 0) = 0
[pid  4095] close(96 <unfinished ...>
[pid  4027] epoll_pwait(4 <unfinished ...>
[pid  4095] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid  4095] close(97)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(98)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(99)                   = -1 EBADF (Bad file descriptor)
[pid  4095] close(100)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(101)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(102)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(103)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(104)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(105)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(106)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(107)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(108)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(109)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(110)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(111)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(112)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(113)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(114)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(115)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(116)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(117)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(118)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(119)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(120)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(121)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(122)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(123)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(124)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(125)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(126)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(127)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(128)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(129)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(130)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(131)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(132)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(133)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(134)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(135)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(136)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(137)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(138)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(139)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(140)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(141)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(142)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(143)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(144)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(145)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(146)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(147)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(148)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(149)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(150)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(151)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(152)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(153)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(154)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(155)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(156)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(157)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(158)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(159)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(160)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(161)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(162)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(163)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(164)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(165)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(166)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(167)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(168)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(169)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(170)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(171)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(172)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(173)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(174)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(175)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(176)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(177)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(178)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(179)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(180)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(181)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(182)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(183)                  = -1 EBADF (Bad file descriptor)
[pid  4095] close(184)                  = -1 EBADF (Bad file descriptor)


The following C code is a draft of the vulnerable syscall sequence. Keep in mind that
it may lack the precise threading, sandboxing, and some arguments of a working reproducer:

// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE 

#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#include <linux/usb/ch9.h>

static unsigned long long procid;

static void sleep_ms(uint64_t ms)
{
	usleep(ms * 1000);
}

#define MAX_FDS 30

#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32
#define USB_MAX_FDS 6

struct usb_endpoint_index {
	struct usb_endpoint_descriptor desc;
	int handle;
};

struct usb_iface_index {
	struct usb_interface_descriptor* iface;
	uint8_t bInterfaceNumber;
	uint8_t bAlternateSetting;
	uint8_t bInterfaceClass;
	struct usb_endpoint_index eps[USB_MAX_EP_NUM];
	int eps_num;
};

struct usb_device_index {
	struct usb_device_descriptor* dev;
	struct usb_config_descriptor* config;
	uint8_t bDeviceClass;
	uint8_t bMaxPower;
	int config_length;
	struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
	int ifaces_num;
	int iface_cur;
};

struct usb_info {
	int fd;
	struct usb_device_index index;
};

static struct usb_info usb_devices[USB_MAX_FDS];

static struct usb_device_index* lookup_usb_index(int fd)
{
	for (int i = 0; i < USB_MAX_FDS; i++) {
		if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd)
			return &usb_devices[i].index;
	}
	return NULL;
}

static int usb_devices_num;

static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index)
{
	if (length < sizeof(*index->dev) + sizeof(*index->config))
		return false;
	memset(index, 0, sizeof(*index));
	index->dev = (struct usb_device_descriptor*)buffer;
	index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
	index->bDeviceClass = index->dev->bDeviceClass;
	index->bMaxPower = index->config->bMaxPower;
	index->config_length = length - sizeof(*index->dev);
	index->iface_cur = -1;
	size_t offset = 0;
	while (true) {
		if (offset + 1 >= length)
			break;
		uint8_t desc_length = buffer[offset];
		uint8_t desc_type = buffer[offset + 1];
		if (desc_length <= 2)
			break;
		if (offset + desc_length > length)
			break;
		if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) {
			struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset);
			index->ifaces[index->ifaces_num].iface = iface;
			index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber;
			index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting;
			index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass;
			index->ifaces_num++;
		}
		if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
			struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
			if (iface->eps_num < USB_MAX_EP_NUM) {
				memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc));
				iface->eps_num++;
			}
		}
		offset += desc_length;
	}
	return true;
}

static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len)
{
	int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED);
	if (i >= USB_MAX_FDS)
		return NULL;
	if (!parse_usb_descriptor(dev, dev_len, &usb_devices[i].index))
		return NULL;
	__atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE);
	return &usb_devices[i].index;
}

struct vusb_connect_string_descriptor {
	uint32_t len;
	char* str;
} __attribute__((packed));

struct vusb_connect_descriptors {
	uint32_t qual_len;
	char* qual;
	uint32_t bos_len;
	char* bos;
	uint32_t strs_len;
	struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));

static const char default_string[] = {
    8, USB_DT_STRING,
    's', 0, 'y', 0, 'z', 0
};

static const char default_lang_id[] = {
    4, USB_DT_STRING,
    0x09, 0x04
};

static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs,
				       const struct usb_ctrlrequest* ctrl,
				       struct usb_qualifier_descriptor* qual,
				       char** response_data, uint32_t* response_length)
{
	struct usb_device_index* index = lookup_usb_index(fd);
	uint8_t str_idx;
	if (!index)
		return false;
	switch (ctrl->bRequestType & USB_TYPE_MASK) {
	case USB_TYPE_STANDARD:
		switch (ctrl->bRequest) {
		case USB_REQ_GET_DESCRIPTOR:
			switch (ctrl->wValue >> 8) {
			case USB_DT_DEVICE:
				*response_data = (char*)index->dev;
				*response_length = sizeof(*index->dev);
				return true;
			case USB_DT_CONFIG:
				*response_data = (char*)index->config;
				*response_length = index->config_length;
				return true;
			case USB_DT_STRING:
				str_idx = (uint8_t)ctrl->wValue;
				if (descs && str_idx < descs->strs_len) {
					*response_data = descs->strs[str_idx].str;
					*response_length = descs->strs[str_idx].len;
					return true;
				}
				if (str_idx == 0) {
					*response_data = (char*)&default_lang_id[0];
					*response_length = default_lang_id[0];
					return true;
				}
				*response_data = (char*)&default_string[0];
				*response_length = default_string[0];
				return true;
			case USB_DT_BOS:
				*response_data = descs->bos;
				*response_length = descs->bos_len;
				return true;
			case USB_DT_DEVICE_QUALIFIER:
				if (!descs->qual) {
					qual->bLength = sizeof(*qual);
					qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
					qual->bcdUSB = index->dev->bcdUSB;
					qual->bDeviceClass = index->dev->bDeviceClass;
					qual->bDeviceSubClass = index->dev->bDeviceSubClass;
					qual->bDeviceProtocol = index->dev->bDeviceProtocol;
					qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
					qual->bNumConfigurations = index->dev->bNumConfigurations;
					qual->bRESERVED = 0;
					*response_data = (char*)qual;
					*response_length = sizeof(*qual);
					return true;
				}
				*response_data = descs->qual;
				*response_length = descs->qual_len;
				return true;
			default:
				break;
			}
			break;
		default:
			break;
		}
		break;
	default:
		break;
	}
	return false;
}

typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs,
					      const struct usb_ctrlrequest* ctrl, bool* done);

static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs,
						const struct usb_ctrlrequest* ctrl, bool* done)
{
	switch (ctrl->bRequestType & USB_TYPE_MASK) {
	case USB_TYPE_STANDARD:
		switch (ctrl->bRequest) {
		case USB_REQ_SET_CONFIGURATION:
			*done = true;
			return true;
		default:
			break;
		}
		break;
	}
	return false;
}

struct vusb_descriptor {
	uint8_t req_type;
	uint8_t desc_type;
	uint32_t len;
	char data[0];
} __attribute__((packed));

struct vusb_descriptors {
	uint32_t len;
	struct vusb_descriptor* generic;
	struct vusb_descriptor* descs[0];
} __attribute__((packed));

struct vusb_response {
	uint8_t type;
	uint8_t req;
	uint32_t len;
	char data[0];
} __attribute__((packed));

struct vusb_responses {
	uint32_t len;
	struct vusb_response* generic;
	struct vusb_response* resps[0];
} __attribute__((packed));

static bool lookup_control_response(const struct vusb_descriptors* descs, const struct vusb_responses* resps,
				    struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length)
{
	int descs_num = 0;
	int resps_num = 0;
	if (descs)
		descs_num = (descs->len - offsetof(struct vusb_descriptors, descs)) / sizeof(descs->descs[0]);
	if (resps)
		resps_num = (resps->len - offsetof(struct vusb_responses, resps)) / sizeof(resps->resps[0]);
	uint8_t req = ctrl->bRequest;
	uint8_t req_type = ctrl->bRequestType & USB_TYPE_MASK;
	uint8_t desc_type = ctrl->wValue >> 8;
	if (req == USB_REQ_GET_DESCRIPTOR) {
		int i;
		for (i = 0; i < descs_num; i++) {
			struct vusb_descriptor* desc = descs->descs[i];
			if (!desc)
				continue;
			if (desc->req_type == req_type && desc->desc_type == desc_type) {
				*response_length = desc->len;
				if (*response_length != 0)
					*response_data = &desc->data[0];
				else
					*response_data = NULL;
				return true;
			}
		}
		if (descs && descs->generic) {
			*response_data = &descs->generic->data[0];
			*response_length = descs->generic->len;
			return true;
		}
	} else {
		int i;
		for (i = 0; i < resps_num; i++) {
			struct vusb_response* resp = resps->resps[i];
			if (!resp)
				continue;
			if (resp->type == req_type && resp->req == req) {
				*response_length = resp->len;
				if (*response_length != 0)
					*response_data = &resp->data[0];
				else
					*response_data = NULL;
				return true;
			}
		}
		if (resps && resps->generic) {
			*response_data = &resps->generic->data[0];
			*response_length = resps->generic->len;
			return true;
		}
	}
	return false;
}

#define UDC_NAME_LENGTH_MAX 128

struct usb_raw_init {
	__u8 driver_name[UDC_NAME_LENGTH_MAX];
	__u8 device_name[UDC_NAME_LENGTH_MAX];
	__u8 speed;
};

enum usb_raw_event_type {
	USB_RAW_EVENT_INVALID = 0,
	USB_RAW_EVENT_CONNECT = 1,
	USB_RAW_EVENT_CONTROL = 2,
};

struct usb_raw_event {
	__u32 type;
	__u32 length;
	__u8 data[0];
};

struct usb_raw_ep_io {
	__u16 ep;
	__u16 flags;
	__u32 length;
	__u8 data[0];
};

#define USB_RAW_EPS_NUM_MAX 30
#define USB_RAW_EP_NAME_MAX 16
#define USB_RAW_EP_ADDR_ANY 0xff

struct usb_raw_ep_caps {
	__u32 type_control : 1;
	__u32 type_iso : 1;
	__u32 type_bulk : 1;
	__u32 type_int : 1;
	__u32 dir_in : 1;
	__u32 dir_out : 1;
};

struct usb_raw_ep_limits {
	__u16 maxpacket_limit;
	__u16 max_streams;
	__u32 reserved;
};

struct usb_raw_ep_info {
	__u8 name[USB_RAW_EP_NAME_MAX];
	__u32 addr;
	struct usb_raw_ep_caps caps;
	struct usb_raw_ep_limits limits;
};

struct usb_raw_eps_info {
	struct usb_raw_ep_info eps[USB_RAW_EPS_NUM_MAX];
};

#define USB_RAW_IOCTL_INIT _IOW('U', 0, struct usb_raw_init)
#define USB_RAW_IOCTL_RUN _IO('U', 1)
#define USB_RAW_IOCTL_EVENT_FETCH _IOR('U', 2, struct usb_raw_event)
#define USB_RAW_IOCTL_EP0_WRITE _IOW('U', 3, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP0_READ _IOWR('U', 4, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP_ENABLE _IOW('U', 5, struct usb_endpoint_descriptor)
#define USB_RAW_IOCTL_EP_DISABLE _IOW('U', 6, __u32)
#define USB_RAW_IOCTL_EP_WRITE _IOW('U', 7, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP_READ _IOWR('U', 8, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_CONFIGURE _IO('U', 9)
#define USB_RAW_IOCTL_VBUS_DRAW _IOW('U', 10, __u32)
#define USB_RAW_IOCTL_EPS_INFO _IOR('U', 11, struct usb_raw_eps_info)
#define USB_RAW_IOCTL_EP0_STALL _IO('U', 12)
#define USB_RAW_IOCTL_EP_SET_HALT _IOW('U', 13, __u32)
#define USB_RAW_IOCTL_EP_CLEAR_HALT _IOW('U', 14, __u32)
#define USB_RAW_IOCTL_EP_SET_WEDGE _IOW('U', 15, __u32)

static int usb_raw_open()
{
	return open("/dev/raw-gadget", O_RDWR);
}

static int usb_raw_init(int fd, uint32_t speed, const char* driver, const char* device)
{
	struct usb_raw_init arg;
	strncpy((char*)&arg.driver_name[0], driver, sizeof(arg.driver_name));
	strncpy((char*)&arg.device_name[0], device, sizeof(arg.device_name));
	arg.speed = speed;
	return ioctl(fd, USB_RAW_IOCTL_INIT, &arg);
}

static int usb_raw_run(int fd)
{
	return ioctl(fd, USB_RAW_IOCTL_RUN, 0);
}

static int usb_raw_ep_write(int fd, struct usb_raw_ep_io* io)
{
	return ioctl(fd, USB_RAW_IOCTL_EP_WRITE, io);
}

static int usb_raw_configure(int fd)
{
	return ioctl(fd, USB_RAW_IOCTL_CONFIGURE, 0);
}

static int usb_raw_vbus_draw(int fd, uint32_t power)
{
	return ioctl(fd, USB_RAW_IOCTL_VBUS_DRAW, power);
}

static int usb_raw_ep0_write(int fd, struct usb_raw_ep_io* io)
{
	return ioctl(fd, USB_RAW_IOCTL_EP0_WRITE, io);
}

static int usb_raw_ep0_read(int fd, struct usb_raw_ep_io* io)
{
	return ioctl(fd, USB_RAW_IOCTL_EP0_READ, io);
}

static int usb_raw_event_fetch(int fd, struct usb_raw_event* event)
{
	return ioctl(fd, USB_RAW_IOCTL_EVENT_FETCH, event);
}

static int usb_raw_ep_enable(int fd, struct usb_endpoint_descriptor* desc)
{
	return ioctl(fd, USB_RAW_IOCTL_EP_ENABLE, desc);
}

static int usb_raw_ep_disable(int fd, int ep)
{
	return ioctl(fd, USB_RAW_IOCTL_EP_DISABLE, ep);
}

static int usb_raw_ep0_stall(int fd)
{
	return ioctl(fd, USB_RAW_IOCTL_EP0_STALL, 0);
}

static int lookup_interface(int fd, uint8_t bInterfaceNumber, uint8_t bAlternateSetting)
{
	struct usb_device_index* index = lookup_usb_index(fd);
	if (!index)
		return -1;
	for (int i = 0; i < index->ifaces_num; i++) {
		if (index->ifaces[i].bInterfaceNumber == bInterfaceNumber &&
		    index->ifaces[i].bAlternateSetting == bAlternateSetting)
			return i;
	}
	return -1;
}

static int lookup_endpoint(int fd, uint8_t bEndpointAddress)
{
	struct usb_device_index* index = lookup_usb_index(fd);
	if (!index)
		return -1;
	if (index->iface_cur < 0)
		return -1;
	for (int ep = 0; ep < index->ifaces[index->iface_cur].eps_num; ep++)
		if (index->ifaces[index->iface_cur].eps[ep].desc.bEndpointAddress == bEndpointAddress)
			return index->ifaces[index->iface_cur].eps[ep].handle;
	return -1;
}

#define USB_MAX_PACKET_SIZE 4096

struct usb_raw_control_event {
	struct usb_raw_event inner;
	struct usb_ctrlrequest ctrl;
	char data[USB_MAX_PACKET_SIZE];
};

struct usb_raw_ep_io_data {
	struct usb_raw_ep_io inner;
	char data[USB_MAX_PACKET_SIZE];
};

static void set_interface(int fd, int n)
{
	struct usb_device_index* index = lookup_usb_index(fd);
	if (!index)
		return;
	if (index->iface_cur >= 0 && index->iface_cur < index->ifaces_num) {
		for (int ep = 0; ep < index->ifaces[index->iface_cur].eps_num; ep++) {
			int rv = usb_raw_ep_disable(fd, index->ifaces[index->iface_cur].eps[ep].handle);
			if (rv < 0) {
			} else {
			}
		}
	}
	if (n >= 0 && n < index->ifaces_num) {
		for (int ep = 0; ep < index->ifaces[n].eps_num; ep++) {
			int rv = usb_raw_ep_enable(fd, &index->ifaces[n].eps[ep].desc);
			if (rv < 0) {
			} else {
				index->ifaces[n].eps[ep].handle = rv;
			}
		}
		index->iface_cur = n;
	}
}

static int configure_device(int fd)
{
	struct usb_device_index* index = lookup_usb_index(fd);
	if (!index)
		return -1;
	int rv = usb_raw_vbus_draw(fd, index->bMaxPower);
	if (rv < 0) {
		return rv;
	}
	rv = usb_raw_configure(fd);
	if (rv < 0) {
		return rv;
	}
	set_interface(fd, 0);
	return 0;
}

static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev,
					  const struct vusb_connect_descriptors* descs,
					  lookup_connect_out_response_t lookup_connect_response_out)
{
	if (!dev) {
		return -1;
	}
	int fd = usb_raw_open();
	if (fd < 0) {
		return fd;
	}
	if (fd >= MAX_FDS) {
		close(fd);
		return -1;
	}
	struct usb_device_index* index = add_usb_index(fd, dev, dev_len);
	if (!index) {
		return -1;
	}
	char device[32];
	sprintf(&device[0], "dummy_udc.%llu", procid);
	int rv = usb_raw_init(fd, speed, "dummy_udc", &device[0]);
	if (rv < 0) {
		return rv;
	}
	rv = usb_raw_run(fd);
	if (rv < 0) {
		return rv;
	}
	bool done = false;
	while (!done) {
		struct usb_raw_control_event event;
		event.inner.type = 0;
		event.inner.length = sizeof(event.ctrl);
		rv = usb_raw_event_fetch(fd, (struct usb_raw_event*)&event);
		if (rv < 0) {
			return rv;
		}
		if (event.inner.type != USB_RAW_EVENT_CONTROL)
			continue;
		char* response_data = NULL;
		uint32_t response_length = 0;
		struct usb_qualifier_descriptor qual;
		if (event.ctrl.bRequestType & USB_DIR_IN) {
			if (!lookup_connect_response_in(fd, descs, &event.ctrl, &qual, &response_data, &response_length)) {
				usb_raw_ep0_stall(fd);
				continue;
			}
		} else {
			if (!lookup_connect_response_out(fd, descs, &event.ctrl, &done)) {
				usb_raw_ep0_stall(fd);
				continue;
			}
			response_data = NULL;
			response_length = event.ctrl.wLength;
		}
		if ((event.ctrl.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD &&
		    event.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
			rv = configure_device(fd);
			if (rv < 0) {
				return rv;
			}
		}
		struct usb_raw_ep_io_data response;
		response.inner.ep = 0;
		response.inner.flags = 0;
		if (response_length > sizeof(response.data))
			response_length = 0;
		if (event.ctrl.wLength < response_length)
			response_length = event.ctrl.wLength;
		response.inner.length = response_length;
		if (response_data)
			memcpy(&response.data[0], response_data, response_length);
		else
			memset(&response.data[0], 0, response_length);
		if (event.ctrl.bRequestType & USB_DIR_IN) {
			rv = usb_raw_ep0_write(fd, (struct usb_raw_ep_io*)&response);
		} else {
			rv = usb_raw_ep0_read(fd, (struct usb_raw_ep_io*)&response);
		}
		if (rv < 0) {
			return rv;
		}
	}
	sleep_ms(200);
	return fd;
}

static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3)
{
	uint64_t speed = a0;
	uint64_t dev_len = a1;
	const char* dev = (const char*)a2;
	const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3;
	return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic);
}

static volatile long syz_usb_control_io(volatile long a0, volatile long a1, volatile long a2)
{
	int fd = a0;
	const struct vusb_descriptors* descs = (const struct vusb_descriptors*)a1;
	const struct vusb_responses* resps = (const struct vusb_responses*)a2;
	struct usb_raw_control_event event;
	event.inner.type = 0;
	event.inner.length = USB_MAX_PACKET_SIZE;
	int rv = usb_raw_event_fetch(fd, (struct usb_raw_event*)&event);
	if (rv < 0) {
		return rv;
	}
	if (event.inner.type != USB_RAW_EVENT_CONTROL) {
		return -1;
	}
	char* response_data = NULL;
	uint32_t response_length = 0;
	if ((event.ctrl.bRequestType & USB_DIR_IN) && event.ctrl.wLength) {
		if (!lookup_control_response(descs, resps, &event.ctrl, &response_data, &response_length)) {
			usb_raw_ep0_stall(fd);
			return -1;
		}
	} else {
		if ((event.ctrl.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD ||
		    event.ctrl.bRequest == USB_REQ_SET_INTERFACE) {
			int iface_num = event.ctrl.wIndex;
			int alt_set = event.ctrl.wValue;
			int iface_index = lookup_interface(fd, iface_num, alt_set);
			if (iface_index < 0) {
			} else {
				set_interface(fd, iface_index);
			}
		}
		response_length = event.ctrl.wLength;
	}
	struct usb_raw_ep_io_data response;
	response.inner.ep = 0;
	response.inner.flags = 0;
	if (response_length > sizeof(response.data))
		response_length = 0;
	if (event.ctrl.wLength < response_length)
		response_length = event.ctrl.wLength;
	if ((event.ctrl.bRequestType & USB_DIR_IN) && !event.ctrl.wLength) {
		response_length = USB_MAX_PACKET_SIZE;
	}
	response.inner.length = response_length;
	if (response_data)
		memcpy(&response.data[0], response_data, response_length);
	else
		memset(&response.data[0], 0, response_length);
	if ((event.ctrl.bRequestType & USB_DIR_IN) && event.ctrl.wLength) {
		rv = usb_raw_ep0_write(fd, (struct usb_raw_ep_io*)&response);
	} else {
		rv = usb_raw_ep0_read(fd, (struct usb_raw_ep_io*)&response);
	}
	if (rv < 0) {
		return rv;
	}
	sleep_ms(200);
	return 0;
}

static volatile long syz_usb_ep_write(volatile long a0, volatile long a1, volatile long a2, volatile long a3)
{
	int fd = a0;
	uint8_t ep = a1;
	uint32_t len = a2;
	char* data = (char*)a3;
	int ep_handle = lookup_endpoint(fd, ep);
	if (ep_handle < 0) {
		return -1;
	}
	struct usb_raw_ep_io_data io_data;
	io_data.inner.ep = ep_handle;
	io_data.inner.flags = 0;
	if (len > sizeof(io_data.data))
		len = sizeof(io_data.data);
	io_data.inner.length = len;
	memcpy(&io_data.data[0], data, len);
	int rv = usb_raw_ep_write(fd, (struct usb_raw_ep_io*)&io_data);
	if (rv < 0) {
		return rv;
	}
	sleep_ms(200);
	return 0;
}

static volatile long syz_usb_disconnect(volatile long a0)
{
	int fd = a0;
	int rv = close(fd);
	sleep_ms(200);
	return rv;
}

uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};

int main(void)
{
		syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	const char* reason;
	(void)reason;
				intptr_t res = 0;
	if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
//  syz_usb_connect arguments: [
//    speed: usb_device_speed = 0x3 (8 bytes)
//    dev_len: len = 0x24 (8 bytes)
//    dev: ptr[in, usb_device_descriptor] {
//      usb_device_descriptor {
//        inner: usb_device_descriptor_verbose_t[flags[usb_versions, int16], 0, 0, 0, flags[usb_device_max_packet_sizes, int8], 0, 0, 0, array[usb_config_descriptor, 1]] {
//          bLength: const = 0x12 (1 bytes)
//          bDescriptorType: const = 0x1 (1 bytes)
//          bcdUSB: usb_versions = 0x250 (2 bytes)
//          bDeviceClass: const = 0x54 (1 bytes)
//          bDeviceSubClass: const = 0x30 (1 bytes)
//          bDeviceProtocol: const = 0x5 (1 bytes)
//          bMaxPacketSize0: usb_device_max_packet_sizes = 0x10 (1 bytes)
//          idVendor: const = 0xdb0 (2 bytes)
//          idProduct: const = 0x6869 (2 bytes)
//          bcdDevice: const = 0x73b3 (2 bytes)
//          iManufacturer: const = 0x1 (1 bytes)
//          iProduct: const = 0x2 (1 bytes)
//          iSerialNumber: const = 0x3 (1 bytes)
//          bNumConfigurations: len = 0x1 (1 bytes)
//          configs: array[usb_config_descriptor] {
//            usb_config_descriptor {
//              inner: usb_config_descriptor_verbose_t[int8, len[interfaces, int8], int8, flags[usb_config_attributes, int8], int8, void, array[usb_interface_descriptor, 1:4]] {
//                bLength: const = 0x9 (1 bytes)
//                bDescriptorType: const = 0x2 (1 bytes)
//                wTotalLength: len = 0x12 (2 bytes)
//                bNumInterfaces: len = 0x1 (1 bytes)
//                bConfigurationValue: int8 = 0x0 (1 bytes)
//                iConfiguration: int8 = 0x0 (1 bytes)
//                bmAttributes: usb_config_attributes = 0x0 (1 bytes)
//                bMaxPower: int8 = 0x0 (1 bytes)
//                extra: buffer: {} (length 0x0)
//                interfaces: array[usb_interface_descriptor] {
//                }
//              }
//            }
//          }
//        }
//      }
//    }
//    conn_descs: ptr[in, vusb_connect_descriptors] {
//      vusb_connect_descriptors {
//        qual_len: len = 0x0 (4 bytes)
//        qual: nil
//        bos_len: len = 0x0 (4 bytes)
//        bos: nil
//        strs_len: len = 0x0 (4 bytes)
//        strs: array[vusb_connect_string_descriptor] {
//        }
//      }
//    }
//  ]
//  returns fd_usb
*(uint8_t*)0x200000000100 = 0x12;
*(uint8_t*)0x200000000101 = 1;
*(uint16_t*)0x200000000102 = 0x250;
*(uint8_t*)0x200000000104 = 0x54;
*(uint8_t*)0x200000000105 = 0x30;
*(uint8_t*)0x200000000106 = 5;
*(uint8_t*)0x200000000107 = 0x10;
*(uint16_t*)0x200000000108 = 0xdb0;
*(uint16_t*)0x20000000010a = 0x6869;
*(uint16_t*)0x20000000010c = 0x73b3;
*(uint8_t*)0x20000000010e = 1;
*(uint8_t*)0x20000000010f = 2;
*(uint8_t*)0x200000000110 = 3;
*(uint8_t*)0x200000000111 = 1;
*(uint8_t*)0x200000000112 = 9;
*(uint8_t*)0x200000000113 = 2;
*(uint16_t*)0x200000000114 = 0x12;
*(uint8_t*)0x200000000116 = 1;
*(uint8_t*)0x200000000117 = 0;
*(uint8_t*)0x200000000118 = 0;
*(uint8_t*)0x200000000119 = 0;
*(uint8_t*)0x20000000011a = 0;
*(uint32_t*)0x200000000080 = 0;
*(uint64_t*)0x200000000084 = 0;
*(uint32_t*)0x20000000008c = 0;
*(uint64_t*)0x200000000090 = 0;
*(uint32_t*)0x200000000098 = 0;
	res = -1;
res = syz_usb_connect(/*speed=USB_SPEED_HIGH*/3, /*dev_len=*/0x24, /*dev=*/0x200000000100, /*conn_descs=*/0x200000000080);
	if (res != -1)
		r[0] = res;
//  syz_usb_disconnect arguments: [
//    fd: fd_usb (resource)
//  ]
syz_usb_disconnect(/*fd=*/r[0]);
//  syz_usb_connect arguments: [
//    speed: usb_device_speed = 0x0 (8 bytes)
//    dev_len: len = 0x24 (8 bytes)
//    dev: ptr[inout, array[ANYUNION]] {
//      array[ANYUNION] {
//      }
//    }
//    conn_descs: ptr[in, vusb_connect_descriptors] {
//      vusb_connect_descriptors {
//        qual_len: len = 0x0 (4 bytes)
//        qual: nil
//        bos_len: len = 0x0 (4 bytes)
//        bos: nil
//        strs_len: len = 0x0 (4 bytes)
//        strs: array[vusb_connect_string_descriptor] {
//        }
//      }
//    }
//  ]
//  returns fd_usb
*(uint32_t*)0x200000001000 = 0;
*(uint64_t*)0x200000001004 = 0;
*(uint32_t*)0x20000000100c = 0;
*(uint64_t*)0x200000001010 = 0;
*(uint32_t*)0x200000001018 = 0;
	res = -1;
res = syz_usb_connect(/*speed=*/0, /*dev_len=*/0x24, /*dev=*/0x200000000b40, /*conn_descs=*/0x200000001000);
	if (res != -1)
		r[1] = res;
//  syz_usb_control_io$printer arguments: [
//    fd: fd_usb_printer (resource)
//    descs: nil
//    resps: ptr[in, vusb_responses_printer] {
//      vusb_responses_printer {
//        len: len = 0x34 (4 bytes)
//        generic: ptr[in, vusb_response_generic] {
//          vusb_response_generic {
//            type: usb_request_types = 0x40 (1 bytes)
//            req: usb_requests = 0x13 (1 bytes)
//            len: bytesize = 0x85 (4 bytes)
//            data: buffer: {d3 f3 4d 70 ec 2d af d9 06 dd 1b 81 bf 70 fc b8 f6 4b 98 b2 c9 40 3d 2c ba 44 cd 3d 6f 8d 0b 6c ee b6 7d 32 a0 de 29 e2 c0 8f c8 06 33 e7 89 e4 e9 63 aa ad 3d 76 3f d4 3d 62 0a 33 db 2b 97 30 5a f8 8c 7d 00 d0 7c f0 eb 98 ba d1 a6 86 64 56 b6 1d bd ee 6e 55 3f cd 6d bf ac 7e 61 ab 8b ff 4a 8e 06 dc ac 8d ca 6b 9f a9 25 64 6a be ec e0 c1 1f 1f 04 9c 77 c9 2f 52 f3 20 d1 f0 8f c4 a7 ad 67 c2 14 59} (length 0x85)
//          }
//        }
//        USB_REQ_GET_INTERFACE: nil
//        USB_REQ_GET_CONFIGURATION: nil
//        USBLP_REQ_GET_ID: nil
//        USBLP_REQ_GET_STATUS: nil
//        USBLP_REQ_HP_CHANNEL_CHANGE_REQUEST: nil
//      }
//    }
//  ]
*(uint32_t*)0x200000000540 = 0x34;
*(uint64_t*)0x200000000544 = 0x2000000001c0;
*(uint8_t*)0x2000000001c0 = 0x40;
*(uint8_t*)0x2000000001c1 = 0x13;
*(uint32_t*)0x2000000001c2 = 0x85;
memcpy((void*)0x2000000001c6, "... [truncated large byte array] ...", 133);
*(uint64_t*)0x20000000054c = 0;
*(uint64_t*)0x200000000554 = 0;
*(uint64_t*)0x20000000055c = 0;
*(uint64_t*)0x200000000564 = 0;
*(uint64_t*)0x20000000056c = 0;
syz_usb_control_io(/*fd=*/r[1], /*descs=*/0, /*resps=*/0x200000000540);
//  syz_usb_disconnect arguments: [
//    fd: fd_usb (resource)
//  ]
syz_usb_disconnect(/*fd=*/-1);
//  syz_usb_connect arguments: [
//    speed: usb_device_speed = 0x2 (8 bytes)
//    dev_len: len = 0x24 (8 bytes)
//    dev: ptr[in, usb_device_descriptor] {
//      usb_device_descriptor {
//        inner: usb_device_descriptor_verbose_t[flags[usb_versions, int16], 0, 0, 0, flags[usb_device_max_packet_sizes, int8], 0, 0, 0, array[usb_config_descriptor, 1]] {
//          bLength: const = 0x12 (1 bytes)
//          bDescriptorType: const = 0x1 (1 bytes)
//          bcdUSB: usb_versions = 0x110 (2 bytes)
//          bDeviceClass: const = 0x2d (1 bytes)
//          bDeviceSubClass: const = 0x83 (1 bytes)
//          bDeviceProtocol: const = 0x57 (1 bytes)
//          bMaxPacketSize0: usb_device_max_packet_sizes = 0x20 (1 bytes)
//          idVendor: const = 0xbda (2 bytes)
//          idProduct: const = 0x5088 (2 bytes)
//          bcdDevice: const = 0xd380 (2 bytes)
//          iManufacturer: const = 0x1 (1 bytes)
//          iProduct: const = 0x2 (1 bytes)
//          iSerialNumber: const = 0x3 (1 bytes)
//          bNumConfigurations: len = 0x1 (1 bytes)
//          configs: array[usb_config_descriptor] {
//            usb_config_descriptor {
//              inner: usb_config_descriptor_verbose_t[int8, len[interfaces, int8], int8, flags[usb_config_attributes, int8], int8, void, array[usb_interface_descriptor, 1:4]] {
//                bLength: const = 0x9 (1 bytes)
//                bDescriptorType: const = 0x2 (1 bytes)
//                wTotalLength: len = 0x12 (2 bytes)
//                bNumInterfaces: len = 0x1 (1 bytes)
//                bConfigurationValue: int8 = 0xa (1 bytes)
//                iConfiguration: int8 = 0x3 (1 bytes)
//                bmAttributes: usb_config_attributes = 0x40 (1 bytes)
//                bMaxPower: int8 = 0x8 (1 bytes)
//                extra: buffer: {} (length 0x0)
//                interfaces: array[usb_interface_descriptor] {
//                }
//              }
//            }
//          }
//        }
//      }
//    }
//    conn_descs: nil
//  ]
//  returns fd_usb
*(uint8_t*)0x200000000000 = 0x12;
*(uint8_t*)0x200000000001 = 1;
*(uint16_t*)0x200000000002 = 0x110;
*(uint8_t*)0x200000000004 = 0x2d;
*(uint8_t*)0x200000000005 = 0x83;
*(uint8_t*)0x200000000006 = 0x57;
*(uint8_t*)0x200000000007 = 0x20;
*(uint16_t*)0x200000000008 = 0xbda;
*(uint16_t*)0x20000000000a = 0x5088;
*(uint16_t*)0x20000000000c = 0xd380;
*(uint8_t*)0x20000000000e = 1;
*(uint8_t*)0x20000000000f = 2;
*(uint8_t*)0x200000000010 = 3;
*(uint8_t*)0x200000000011 = 1;
*(uint8_t*)0x200000000012 = 9;
*(uint8_t*)0x200000000013 = 2;
*(uint16_t*)0x200000000014 = 0x12;
*(uint8_t*)0x200000000016 = 1;
*(uint8_t*)0x200000000017 = 0xa;
*(uint8_t*)0x200000000018 = 3;
*(uint8_t*)0x200000000019 = 0x40;
*(uint8_t*)0x20000000001a = 8;
syz_usb_connect(/*speed=USB_SPEED_FULL*/2, /*dev_len=*/0x24, /*dev=*/0x200000000000, /*conn_descs=*/0);
//  syz_usb_control_io$uac1 arguments: [
//    fd: fd_usb_uac1 (resource)
//    descs: nil
//    resps: nil
//  ]
syz_usb_control_io(/*fd=*/r[1], /*descs=*/0, /*resps=*/0);
//  syz_usb_control_io arguments: [
//    fd: fd_usb (resource)
//    descs: nil
//    resps: ptr[in, vusb_responses] {
//      vusb_responses {
//        len: len = 0x84 (4 bytes)
//        generic: nil
//        get_interface: nil
//        get_configuration: nil
//        hub_USB_REQ_GET_STATUS_hub: nil
//        hub_USB_REQ_GET_STATUS_port: nil
//        asix_AX_CMD_READ_MII_REG: ptr[in, vusb_response_t[USB_TYPE_VENDOR, AX_CMD_READ_MII_REG, int16]] {
//          vusb_response_t[USB_TYPE_VENDOR, AX_CMD_READ_MII_REG, int16] {
//            type: const = 0x40 (1 bytes)
//            req: const = 0x7 (1 bytes)
//            len: bytesize = 0x2 (4 bytes)
//            data: int16 = 0x1 (2 bytes)
//          }
//        }
//        asix_AX_CMD_STATMNGSTS_REG: nil
//        asix_AX_CMD_READ_EEPROM: nil
//        asix_AX_CMD_READ_RX_CTL: nil
//        asix_AX_CMD_READ_NODE_ID: nil
//        asix_AX88172_CMD_READ_NODE_ID: nil
//        asix_AX_CMD_READ_PHY_ID: nil
//        asix_AX_CMD_READ_MEDIUM_STATUS: nil
//        asix_AX_CMD_READ_MONITOR_MODE: nil
//        asix_AX_CMD_READ_GPIOS: nil
//        asix_AX_CMD_SW_PHY_STATUS: nil
//      }
//    }
//  ]
*(uint32_t*)0x200000000ec0 = 0x84;
*(uint64_t*)0x200000000ec4 = 0;
*(uint64_t*)0x200000000ecc = 0;
*(uint64_t*)0x200000000ed4 = 0;
*(uint64_t*)0x200000000edc = 0;
*(uint64_t*)0x200000000ee4 = 0;
*(uint64_t*)0x200000000eec = 0x200000000a00;
*(uint8_t*)0x200000000a00 = 0x40;
*(uint8_t*)0x200000000a01 = 7;
*(uint32_t*)0x200000000a02 = 2;
*(uint16_t*)0x200000000a06 = 1;
*(uint64_t*)0x200000000ef4 = 0;
*(uint64_t*)0x200000000efc = 0;
*(uint64_t*)0x200000000f04 = 0;
*(uint64_t*)0x200000000f0c = 0;
*(uint64_t*)0x200000000f14 = 0;
*(uint64_t*)0x200000000f1c = 0;
*(uint64_t*)0x200000000f24 = 0;
*(uint64_t*)0x200000000f2c = 0;
*(uint64_t*)0x200000000f34 = 0;
*(uint64_t*)0x200000000f3c = 0;
syz_usb_control_io(/*fd=*/r[1], /*descs=*/0, /*resps=*/0x200000000ec0);
//  syz_usb_connect arguments: [
//    speed: usb_device_speed = 0x0 (8 bytes)
//    dev_len: len = 0x6b (8 bytes)
//    dev: nil
//    conn_descs: nil
//  ]
//  returns fd_usb
syz_usb_connect(/*speed=*/0, /*dev_len=*/0x6b, /*dev=*/0, /*conn_descs=*/0);
//  syz_usb_connect$hid arguments: [
//    speed: usb_device_speed = 0x0 (8 bytes)
//    dev_len: len = 0x36 (8 bytes)
//    dev: nil
//    conn_descs: nil
//  ]
//  returns fd_usb_hid
	res = -1;
res = syz_usb_connect(/*speed=*/0, /*dev_len=*/0x36, /*dev=*/0, /*conn_descs=*/0);
	if (res != -1)
		r[2] = res;
//  syz_usb_ep_write arguments: [
//    fd: fd_usb (resource)
//    ep: int8 = 0x81 (1 bytes)
//    len: len = 0x0 (8 bytes)
//    data: ptr[in, buffer] {
//      buffer: {} (length 0x0)
//    }
//  ]
syz_usb_ep_write(/*fd=*/r[2], /*ep=*/0x81, /*len=*/0, /*data=*/0x200000000300);
	return 0;
}

Based on the provided strace, reproducer, and the investigation summary, here is a detailed explanation of the root cause of the kernel crash.

### Root Cause Summary
The crash is a **NULL pointer dereference** in `rt2x00usb_disconnect()`. It occurs because the driver calls `usb_reset_device()` very early in its probe function. If the reset triggers an asynchronous disconnect and the probe subsequently fails (clearing the interface data), the disconnect handler is invoked with `NULL` interface data. The disconnect handler unconditionally dereferences this `NULL` pointer, leading to a kernel panic.

### Detailed Analysis

1. **Device Simulation and Driver Matching:**
   The syzkaller reproducer simulates a malicious USB device with the Vendor ID `0x0db0` and Product ID `0x6869`. These IDs correspond to the Ralink `rt2500usb` wireless driver, which relies on the common `rt2x00usb` framework.

2. **Early USB Reset in Probe:**
   When the device is connected, the USB core binds the interface to the driver, invoking `rt2x00usb_probe()` in `drivers/net/wireless/ralink/rt2x00/rt2x00usb.c`. 
   Very early in this function, the driver attempts to reset the USB device:
   ```c
   797: int rt2x00usb_probe(struct usb_interface *usb_intf,
   798: 		    const struct rt2x00_ops *ops)
   799: {
   800: 	struct usb_device *usb_dev = interface_to_usbdev(usb_intf);
   ...
   805: 	usb_reset_device(usb_dev); // <-- Triggers asynchronous disconnect on failure
   ```
   If `usb_reset_device()` fails or detects an unexpected device state change (which is common with malicious or rapidly disconnecting simulated devices), the USB core (`hub_wq`) schedules a logical disconnect for the device.

3. **Probe Failure and Cleanup:**
   Following the reset, the probe function continues to allocate hardware and register the device. If any of these subsequent steps fail (e.g., `rt2x00usb_alloc_reg()` or `rt2x00lib_probe_dev()` returns an error), the driver jumps to its error handling path:
   ```c
   850: exit_free_device:
   851: 	ieee80211_free_hw(hw);
   852: 	usb_set_intfdata(usb_intf, NULL); // <-- Interface data is cleared to NULL
   853: 
   854: 	return retval;
   855: }
   ```
   At this point, the probe has failed, and the interface data (`intfdata`) is explicitly set to `NULL`.

4. **The Unconditional Dereference in Disconnect:**
   Normally, the driver core prevents a driver's `disconnect` callback from running if the `probe` failed. However, the early `usb_reset_device()` call creates a complex edge case. The asynchronous disconnect scheduled by the reset can race with the probe failure, causing `rt2x00usb_disconnect()` to be invoked even though `intfdata` has been cleared.

   When `rt2x00usb_disconnect()` is called, it fetches the `intfdata` and immediately dereferences it without checking if it is `NULL`:
   ```c
   858: void rt2x00usb_disconnect(struct usb_interface *usb_intf)
   859: {
   860: 	struct ieee80211_hw *hw = usb_get_intfdata(usb_intf);
   861: 	struct rt2x00_dev *rt2x00dev = hw->priv; // <-- NULL pointer dereference here
   ...
   ```
   Because `hw` is `NULL` (cleared by the failed probe), `hw->priv` causes the kernel crash.

### Proposed Fix
To fix this bug, the disconnect handler must verify that the interface data is valid before attempting to clean up the hardware. A simple `NULL` check at the beginning of `rt2x00usb_disconnect()` is sufficient:

```c
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
@@ -858,6 +858,9 @@ void rt2x00usb_disconnect(struct usb_interface *usb_intf)
 {
 	struct ieee80211_hw *hw = usb_get_intfdata(usb_intf);
+
+	if (!hw)
+		return;
+
 	struct rt2x00_dev *rt2x00dev = hw->priv;
 
 	/*
```
*(Note: Ensure variable declarations remain at the top of the block depending on the kernel version's C standard requirements, e.g., declaring `rt2x00dev` after the check or initializing it after the check).*

gemini-3.1-pro-preview

							input: 199705
							output: 39
							thoughts: 1063
						

**Initial Assessment and Debugging Steps**

Okay, I've got a crash log and a C reproducer – that's a good start. The log immediately flags a couple of `SYZFAIL` messages: "setfilecon: setxattr failed" and "open /dev/vhci failed". Hmm, and at the end of the log there's also an error message about `/dev/net/tun` not being accessible. Wait, is this a *kernel* crash, or just a failure in syzkaller's setup? Right, the prompt states it's a kernel crash, and I'm supposed to debug it, so let's focus.

First, let's confirm. I'll check the strace output to see if it provides any useful clues. Just confirming here that the strace reports the same "SYZFAIL: tun: can't open /dev/net/tun" and "SYZFAIL: open /dev/vhci failed" messages. Okay, that just looks like the execution of the syz-executor; it's not a kernel-level strace, and so nothing conclusive is there.

Now, let's dive into the C reproducer. It's using USB-related syzcall functions: `syz_usb_connect`, `syz_usb_disconnect`, `syz_usb_control_io`, and `syz_usb_ep_write`. That's interesting, it seems USB-related. Looking at the device descriptor that's embedded in the reproducer, I need to get the vendor and product ID.  I can see the following:
*   Vendor ID: `0x0db0`
*   Product ID: `0x6869`

Okay, time to search the kernel source using these identifiers. I'll search for the vendor and product ID and see what devices show up. I'll search the kernel to find related drivers. I'm going to quickly check for RTL drivers.

map[Expression:0x0db0.*0x6869|0x6869.*0x0db0]

map[Output:drivers/net/wireless/ralink/rt2x00/rt2500usb.c=1908=static const struct usb_device_id rt2500usb_device_table[] = {
--
drivers/net/wireless/ralink/rt2x00/rt2500usb.c-1936-	{ USB_DEVICE(0x0db0, 0x6865) },
drivers/net/wireless/ralink/rt2x00/rt2500usb.c:1937:	{ USB_DEVICE(0x0db0, 0x6869) },
drivers/net/wireless/ralink/rt2x00/rt2500usb.c-1938-	/* Ralink */
]

gemini-3.1-pro-preview

							input: 201437
							output: 39
							thoughts: 330
						

**Diving into the rt2500usb Driver – Second Device Check**

Okay, so I'm looking at the `rt2500usb` driver code, specifically the device initialization routine, I assume. Let's see... what's going on with the second device instance? Right, looks like it's trying to write some initial values to specific memory-mapped registers. I'm seeing a series of direct memory accesses via pointer dereferencing; standard stuff for hardware interaction.

Let's break down these writes. Looks like we are setting these registers:
-   0x200000000000 gets 0x12
-   0x200000000001 gets 1
-   0x200000000002 gets 0x110 (a uint16_t)
-   0x200000000004 gets 0x2d
-   0x200000000005 gets 0x83
-   0x200000000006 gets 0x57
-   0x200000000007 gets 0x20
-   0x200000000008 gets 0xbda (a uint16_t)
-   0x20000000000a gets 0x5088 (a uint16_t)
-   0x20000000000c gets 0xd380 (a uint16_t)

From the looks of it, it looks like a register setting for a USB device with vendor ID of 0x0bda and product ID of 0x5088. This could be useful if I need to diagnose an initialization failure. Knowing the vendor and product IDs is key here. I'll make a mental note of those, as I might need them to correlate to a specific device datasheet or driver documentation later.

map[Expression:0x0bda.*0x5088|0x5088.*0x0bda]

map[Output:drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c=252=static const struct usb_device_id rtl8192c_usb_ids[] = {
--
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c-297-	{RTL_USB_DEVICE(0x0b05, 0x17ba, rtl92cu_hal_cfg)}, /*ASUS-Edimax*/
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c:298:	{RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c-299-	{RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
]

gemini-3.1-pro-preview

							input: 202549
							output: 28
							thoughts: 3603
						

**Root Cause Analysis of Potential USB Crash**

Okay, here's the breakdown as I see it, piece by piece. The reproducer sequence appears to trigger a race or corruption related to USB device initialization and control transfers, likely involving the `rtl8192cu` driver. Let's dig in.

The reproducer attempts a series of `syz_usb_connect` and `syz_usb_control_io` calls, manipulating different devices. The key problem lies in the interaction between a zeroed "dummy" device and the `rtl8192cu` device, with a probable data race.

1.  **Initial Device Connection and Disconnection:** We start with an `rt2500usb` device, then disconnect it using `syz_usb_disconnect`. This part seems standard, setting the stage for what comes next.

2.  **Zeroed Device:** A `syz_usb_connect` call attempts to connect with an *uninitialized* USB device descriptor. The relevant C code in the reproducer sets the device to be at `0x200000000b40`, and `dev` is `0x200000000b40` in the function call. In the syzkaller log, `ANYUNION` is present, which implies this area is filled with zeroes.

3.  **Printer Control Transfer:** Next, `syz_usb_control_io` is performed on this zeroed device. We're using the file descriptor `r[1]` to refer to the zeroed device. This is probably to set up the driver, for example.

4.  **`rtl8192cu` Connection:**  We disconnect the "dummy" device with a disconnect on -1, which does nothing. Then, a `syz_usb_connect` is called to connect the `rtl8192cu` device. This overwrites the device that was previously at `r[1]`. The `dev` is initialized to the location of the `rtl8192cu` descriptor at `0x200000000000`. This will likely be important.

5.  **Control Transfers on the Second Device:** We see subsequent `syz_usb_control_io` calls on file descriptor `r[1]`. Because we previously overwrote the device at `r[1]` with `rtl8192cu`, the subsequent calls *should* be directed to the `rtl8192cu`.

6.  **Potential Crash Point:**  The issue is that the `syz_usb_control_io` calls, especially those targeting the `rtl8192cu` device (the second one), may be operating on an *inconsistently initialized device state*. Specifically, the descriptors passed to the device during initialization.

7.  **Descriptor Analysis:** The most important point: The `rtl8192cu` descriptor provided is malformed. The `dev_len` is 0x24 (36 bytes). However, only bytes up to 0x1a are initialized. The config descriptor is provided, but no interface descriptors are. The length of the descriptor is specified as `0x12`, and the configuration length is specified as `0x12`, which *should* mean only the configuration is given. However, there are no interface descriptors.

In the case that no interfaces are given, then this may trigger an issue in the driver when trying to enumerate endpoints.

8. **Epilogue:**
    A few more connections, and an ep write. This could be where the corruption is triggered.

**Hypothesis:**

*   The bug stems from inconsistent initialization and missing interface descriptors. By connecting a zeroed device, we mess with internal driver state. By providing an incomplete device descriptor, we introduce the conditions where a race or unhandled condition can be triggered. When the control transfer is issued for the zeroed or `rtl8192cu` device, the kernel can crash due to an invalid descriptor.
*   The `rtl8192cu` driver likely has an error path for incomplete descriptors or zeroed fields, and the reproducer is exercising it.

**Debugging Steps if a Crash Log Were Available:**

1.  **Stack Trace Analysis:**  Examine the stack trace for the crash. Look for functions within the `rtl8192cu` driver or USB core functions that are handling descriptor parsing or endpoint configuration.
2.  **Descriptor Inspection:** Dump the device descriptor in the kernel context (if possible). Confirm that the descriptors match what the reproducer is providing and highlight the missing or zeroed fields.
3.  **Race Detection:** If the crash is intermittent, consider lock contention in the USB core

map[Name:rtl8192c_usb_ids]

map[References:<nil> TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 207222
							output: 28
							thoughts: 42
						

Okay, here's my interpretation of that thought process, tailored for an expert audience:

**Kernel Module ID Discovery**

Hmm, interesting. Just scanning through the codebase, and *bingo!* I've located the `rtl8192c_usb_ids` structure. That's a good find! Specifically, it's nestled right there in `drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c`. This strongly suggests it's the identifier table, the device IDs, for that particular Realtek 8192CU USB WiFi adapter that the kernel utilizes. This table is precisely what I need to check against if I'm troubleshooting USB enumeration issues or looking for a way to modify how the driver interacts with certain revisions of the hardware. The fact that it's in the `sw.c` file is also indicative of firmware/software aspects of device initialization; often, these ID tables are used as part of the initial probe and setup routines. My attention is now honed; this single find immediately directs my attention towards those low-level initialization functions.

map[Name:rtl8192c_usb_ids]

map[References:<nil> TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 207545
							output: 24
							thoughts: 16
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Investigating `rtl8192c_usb_ids`**

Okay, so I need to find something. The initial thought is to go straight for a `grep` on `rtl8192c_usb_ids`. That seems like the most direct approach. I'm assuming that string likely holds the key, or at least a significant clue, related to whatever I'm trying to locate. This suggests I'm likely dealing with some driver or USB device identification. Given the naming convention, it's probably related to a Realtek RTL8192C chipset, and specifically the USB variant. Let's see what pops up. I'm expecting this to lead me either to a definition in a driver source file, or potentially some relevant configuration data, or maybe even usage examples within a larger codebase. The goal is to understand how this identifier is used. It could be in a `usb_device_id` structure, or as part of a vendor/product ID lookup. I'm anticipating that this search will guide my next steps.

map[Expression:rtl8192c_usb_ids]

map[Output:drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c=159=static const struct rtl_hal_cfg rtl92cu_hal_cfg = {
--
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c-251-/* 2010-10-19 DID_USB_V3.4 */
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c:252:static const struct usb_device_id rtl8192c_usb_ids[] = {
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c-253-
--
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c-362-
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c:363:MODULE_DEVICE_TABLE(usb, rtl8192c_usb_ids);
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c-364-
--
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c=371=static struct usb_driver rtl8192cu_driver = {
--
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c-374-	.disconnect = rtl_usb_disconnect,
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c:375:	.id_table = rtl8192c_usb_ids,
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c-376-
]

gemini-3.1-pro-preview

							input: 208286
							output: 50
							thoughts: 52
						

Okay, here's my interpretation of those thoughts, crafted with the perspective of someone deeply familiar with driver development, particularly in the Realtek wireless space:

**Driver Deep Dive: rtl8192cu**

Alright, so the driver in question is `rtl8192cu_driver`. My first instinct is to immediately start tracing its initialization path. Okay, it seems we're dealing with a USB device based on the context, and it looks like `rtl_usb_probe` is key here. Hang on... let me just double-check that location. Yeah, confirmed - `rtl_usb_probe` is housed within `drivers/net/wireless/realtek/rtlwifi/usb.c`. That's where the USB-specific initialization likely resides for this Realtek device. That makes sense, given the driver name. So, `rtl_usb_probe` will likely be responsible for handling the USB device's connection, identifying it correctly, performing any initial hardware setup specific to the 8192cu chipset, and preparing it for network operation. It's the critical entry point when a compatible device is plugged in.

map[ContextFile:drivers/net/wireless/realtek/rtlwifi/usb.c IncludeLines:true Name:rtl_usb_probe]

map[SourceCode: 951:	int rtl_usb_probe(struct usb_interface *intf,
 952:			  const struct usb_device_id *id,
 953:			  const struct rtl_hal_cfg *rtl_hal_cfg)
 954:	{
 955:		int err;
 956:		struct ieee80211_hw *hw = NULL;
 957:		struct rtl_priv *rtlpriv = NULL;
 958:		struct usb_device	*udev;
 959:		struct rtl_usb_priv *usb_priv;
 960:	
 961:		hw = ieee80211_alloc_hw(sizeof(struct rtl_priv) +
 962:					sizeof(struct rtl_usb_priv), &rtl_ops);
 963:		if (!hw) {
 964:			pr_warn("rtl_usb: ieee80211 alloc failed\n");
 965:			return -ENOMEM;
 966:		}
 967:		rtlpriv = hw->priv;
 968:		rtlpriv->hw = hw;
 969:		rtlpriv->usb_data = kcalloc(RTL_USB_MAX_RX_COUNT, sizeof(u32),
 970:					    GFP_KERNEL);
 971:		if (!rtlpriv->usb_data) {
 972:			ieee80211_free_hw(hw);
 973:			return -ENOMEM;
 974:		}
 975:	
 976:		/* this spin lock must be initialized early */
 977:		spin_lock_init(&rtlpriv->locks.usb_lock);
 978:		INIT_WORK(&rtlpriv->works.fill_h2c_cmd,
 979:			  rtl_fill_h2c_cmd_work_callback);
 980:		INIT_WORK(&rtlpriv->works.lps_change_work,
 981:			  rtl_lps_change_work_callback);
 982:		INIT_WORK(&rtlpriv->works.update_beacon_work,
 983:			  rtl_update_beacon_work_callback);
 984:	
 985:		rtlpriv->usb_data_index = 0;
 986:		init_completion(&rtlpriv->firmware_loading_complete);
 987:		SET_IEEE80211_DEV(hw, &intf->dev);
 988:		udev = interface_to_usbdev(intf);
 989:		usb_priv = rtl_usbpriv(hw);
 990:		memset(usb_priv, 0, sizeof(*usb_priv));
 991:		usb_priv->dev.intf = intf;
 992:		usb_priv->dev.udev = udev;
 993:		usb_set_intfdata(intf, hw);
 994:		/* For dual MAC RTL8192DU, which has two interfaces. */
 995:		rtlpriv->rtlhal.interfaceindex =
 996:			intf->altsetting[0].desc.bInterfaceNumber;
 997:		/* init cfg & intf_ops */
 998:		rtlpriv->rtlhal.interface = INTF_USB;
 999:		rtlpriv->cfg = rtl_hal_cfg;
1000:		rtlpriv->intf_ops = &rtl_usb_ops;
1001:		/* Init IO handler */
1002:		_rtl_usb_io_handler_init(&udev->dev, hw);
1003:		rtlpriv->cfg->ops->read_chip_version(hw);
1004:		/*like read eeprom and so on */
1005:		rtlpriv->cfg->ops->read_eeprom_info(hw);
1006:		err = _rtl_usb_init(hw);
1007:		if (err)
1008:			goto error_out2;
1009:		rtl_usb_init_sw(hw);
1010:		/* Init mac80211 sw */
1011:		err = rtl_init_core(hw);
1012:		if (err) {
1013:			pr_err("Can't allocate sw for mac80211\n");
1014:			goto error_out2;
1015:		}
1016:		if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
1017:			pr_err("Can't init_sw_vars\n");
1018:			goto error_out;
1019:		}
1020:		rtl_init_sw_leds(hw);
1021:	
1022:		err = ieee80211_register_hw(hw);
1023:		if (err) {
1024:			pr_err("Can't register mac80211 hw.\n");
1025:			goto error_init_vars;
1026:		}
1027:		rtlpriv->mac80211.mac80211_registered = 1;
1028:	
1029:		set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status);
1030:		return 0;
1031:	
1032:	error_init_vars:
1033:		wait_for_completion(&rtlpriv->firmware_loading_complete);
1034:		rtlpriv->cfg->ops->deinit_sw_vars(hw);
1035:	error_out:
1036:		rtl_usb_deinit(hw);
1037:		rtl_deinit_core(hw);
1038:	error_out2:
1039:		_rtl_usb_io_handler_release(hw);
1040:		kfree(rtlpriv->usb_data);
1041:		ieee80211_free_hw(hw);
1042:		return -ENODEV;
1043:	}
 SourceFile:drivers/net/wireless/realtek/rtlwifi/usb.c]

gemini-3.1-pro-preview

							input: 210268
							output: 51
							thoughts: 148
						

**Analyzing a Potential Vulnerability in `rtl_usb_probe`**

Okay, so I'm looking at this `rtl_usb_probe` function, specifically line 996. It's accessing `intf->altsetting[0].desc.bInterfaceNumber`. My initial thought is, "Hang on, what if `intf->altsetting` is NULL or `intf->num_altsetting` is 0?" That would lead to a segmentation fault, right? But then I remember the USB core's guarantees – it *should* allocate `intf->altsetting` and ensure `intf->num_altsetting` is at least 1. So, that specific check might be unnecessary.

However, a new concern arises: What if the entire interface descriptor itself is comprised of zeroes? In this scenario, `intf->altsetting[0].desc.bInterfaceNumber` would simply evaluate to 0, which isn't inherently problematic, but might indicate an issue with device initialization or configuration, depending on how this value is used later. I should probably dig a bit deeper into the initialization path to see how this value is employed. Let's see... Let's check `_rtl_usb_init(hw)`.

map[ContextFile:drivers/net/wireless/realtek/rtlwifi/usb.c IncludeLines:true Name:_rtl_usb_init]

map[SourceCode: 236:	static int _rtl_usb_init(struct ieee80211_hw *hw)
 237:	{
 238:		struct rtl_priv *rtlpriv = rtl_priv(hw);
 239:		struct rtl_usb_priv *usb_priv = rtl_usbpriv(hw);
 240:		struct rtl_usb *rtlusb = rtl_usbdev(usb_priv);
 241:		int err;
 242:		u8 epidx;
 243:		struct usb_interface	*usb_intf = rtlusb->intf;
 244:		u8 epnums = usb_intf->cur_altsetting->desc.bNumEndpoints;
 245:	
 246:		rtlusb->out_ep_nums = rtlusb->in_ep_nums = 0;
 247:		for (epidx = 0; epidx < epnums; epidx++) {
 248:			struct usb_endpoint_descriptor *pep_desc;
 249:	
 250:			pep_desc = &usb_intf->cur_altsetting->endpoint[epidx].desc;
 251:	
 252:			if (usb_endpoint_dir_in(pep_desc)) {
 253:				if (usb_endpoint_xfer_bulk(pep_desc)) {
 254:					/* The vendor drivers assume there is only one
 255:					 * bulk in ep and that it's the first in ep.
 256:					 */
 257:					if (rtlusb->in_ep_nums == 0)
 258:						rtlusb->in_ep = usb_endpoint_num(pep_desc);
 259:					else
 260:						pr_warn("%s: bulk in endpoint is not the first in endpoint\n",
 261:							__func__);
 262:				}
 263:	
 264:				rtlusb->in_ep_nums++;
 265:			} else if (usb_endpoint_dir_out(pep_desc)) {
 266:				if (rtlusb->out_ep_nums < RTL_USB_MAX_BULKOUT_NUM) {
 267:					if (usb_endpoint_xfer_bulk(pep_desc))
 268:						rtlusb->out_eps[rtlusb->out_ep_nums] =
 269:								usb_endpoint_num(pep_desc);
 270:				} else {
 271:					pr_warn("%s: found more bulk out endpoints than the expected %d\n",
 272:						__func__, RTL_USB_MAX_BULKOUT_NUM);
 273:				}
 274:	
 275:				rtlusb->out_ep_nums++;
 276:			}
 277:	
 278:			rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
 279:				"USB EP(0x%02x), MaxPacketSize=%d, Interval=%d\n",
 280:				pep_desc->bEndpointAddress, pep_desc->wMaxPacketSize,
 281:				pep_desc->bInterval);
 282:		}
 283:	
 284:		if (rtlusb->out_ep_nums == 0) {
 285:			pr_err("No output end points found\n");
 286:			return -EINVAL;
 287:		}
 288:		/* usb endpoint mapping */
 289:		err = rtlpriv->cfg->usb_interface_cfg->usb_endpoint_mapping(hw);
 290:		if (err)
 291:			return err;
 292:	
 293:		rtlusb->usb_mq_to_hwq = rtlpriv->cfg->usb_interface_cfg->usb_mq_to_hwq;
 294:	
 295:		err = _rtl_usb_init_tx(hw);
 296:		if (err)
 297:			return err;
 298:	
 299:		err = _rtl_usb_init_rx(hw);
 300:		if (err)
 301:			goto err_out;
 302:	
 303:		return 0;
 304:	
 305:	err_out:
 306:		_rtl_usb_cleanup_tx(hw);
 307:		return err;
 308:	}
 SourceFile:drivers/net/wireless/realtek/rtlwifi/usb.c]

gemini-3.1-pro-preview

							input: 211972
							output: 53
							thoughts: 115
						

**USB Initialization Oversight**

Okay, hold on a second. I'm reviewing this `_rtl_usb_init` function, and something's not sitting right. It checks `rtlusb->out_ep_nums` against zero and returns `-EINVAL` if it is, which seems reasonable for output endpoints. But I'm not seeing a corresponding check for `rtlusb->in_ep_nums`. That's a potential vulnerability.

If `rtlusb->in_ep_nums` *is* zero, then the corresponding `rtlusb->in_ep` pointer remains uninitialized. It's essentially a null pointer. That's a problem, isn't it? That could lead to a crash later down the line if we try to use it.

Right, I'm going to jump into `_rtl_usb_init_rx(hw)` and see how that is handled and if there is further processing of `in_ep`.

map[ContextFile:drivers/net/wireless/realtek/rtlwifi/usb.c IncludeLines:true Name:_rtl_usb_init_rx]

map[SourceCode: 213:	static int _rtl_usb_init_rx(struct ieee80211_hw *hw)
 214:	{
 215:		struct rtl_priv *rtlpriv = rtl_priv(hw);
 216:		struct rtl_usb_priv *usb_priv = rtl_usbpriv(hw);
 217:		struct rtl_usb *rtlusb = rtl_usbdev(usb_priv);
 218:	
 219:		rtlusb->rx_max_size = rtlpriv->cfg->usb_interface_cfg->rx_max_size;
 220:		rtlusb->rx_urb_num = rtlpriv->cfg->usb_interface_cfg->rx_urb_num;
 221:		rtlusb->usb_rx_hdl = rtlpriv->cfg->usb_interface_cfg->usb_rx_hdl;
 222:		rtlusb->usb_rx_segregate_hdl =
 223:			rtlpriv->cfg->usb_interface_cfg->usb_rx_segregate_hdl;
 224:	
 225:		pr_info("rx_max_size %d, rx_urb_num %d, in_ep %d\n",
 226:			rtlusb->rx_max_size, rtlusb->rx_urb_num, rtlusb->in_ep);
 227:		init_usb_anchor(&rtlusb->rx_submitted);
 228:		init_usb_anchor(&rtlusb->rx_cleanup_urbs);
 229:	
 230:		skb_queue_head_init(&rtlusb->rx_queue);
 231:		tasklet_setup(&rtlusb->rx_work_tasklet, _rtl_rx_work);
 232:	
 233:		return 0;
 234:	}
 SourceFile:drivers/net/wireless/realtek/rtlwifi/usb.c]

gemini-3.1-pro-preview

							input: 212864
							output: 52
							thoughts: 38
						

Here's my analysis of the provided snippet, as if it were my thought process:

**Diving into the USB RX Initialization**

Okay, so I'm looking at this `_rtl_usb_init_rx` function. It seems pretty straightforward—just setting up some variables. Nothing too complex going on here, just getting things ready. My immediate thought is, "Where's the actual submission of the Receive URB happening?". I'm betting that crucial action is being handled in `rtl_usb_start_rx`. That would be the logical place to kick off the data reception process. I need to trace my code deeper into that direction.

log-in to see details

map[ContextFile:drivers/net/wireless/realtek/rtlwifi/usb.c IncludeLines:true Name:rtl_usb_start_rx]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 213113
							output: 19
							thoughts: 30
						

Okay, here's my thought process on that:

**Investigating URB Submission in `rtlwifi/usb.c`**

Alright, let's dive in. My immediate goal is to pinpoint every instance within the `rtlwifi/usb.c` file – specifically located in the `drivers/net/wireless/realtek/rtlwifi/` directory – where URBs (USB Request Blocks) are being submitted. This is a common method for understanding USB device communication in a driver. I need to identify the functions responsible for initiating data transfers or control operations over the USB bus. This understanding is key to figuring out how the Realtek wireless device interacts with the host. Knowing *which* functions handle the submission will greatly assist in further investigations into throughput, error recovery, or power management. I'll be looking for those calls, and then examining those routines and their call flows.

map[Expression:usb_submit_urb]

map[Output:
Full output is too long, showing 500 out of 5329 lines.
Use more precise expression if possible.

[Documentation/driver-api/usb/URB.rst=24=called USB Request Block, or URB for short.
 --
 Documentation/driver-api/usb/URB.rst-29-- Execution of an URB is inherently an asynchronous operation, i.e. the
 Documentation/driver-api/usb/URB.rst:30:  :c:func:`usb_submit_urb` call returns immediately after it has successfully
 Documentation/driver-api/usb/URB.rst-31-  queued the requested action.
 --
 Documentation/driver-api/usb/URB.rst=134=How to submit an URB?
 --
 Documentation/driver-api/usb/URB.rst-136-
 Documentation/driver-api/usb/URB.rst:137:Just call :c:func:`usb_submit_urb`::
 Documentation/driver-api/usb/URB.rst-138-
 Documentation/driver-api/usb/URB.rst:139:	int usb_submit_urb(struct urb *urb, int mem_flags)
 Documentation/driver-api/usb/URB.rst-140-
 --
 Documentation/driver-api/usb/URB.rst=251=each packet you want to schedule.
 Documentation/driver-api/usb/URB.rst-252-
 Documentation/driver-api/usb/URB.rst:253:The :c:func:`usb_submit_urb` call modifies ``urb->interval`` to the implemented
 Documentation/driver-api/usb/URB.rst-254-interval value that is less than or equal to the requested interval value.  If
 --
 Documentation/driver-api/usb/URB.rst=281=You can use the :c:func:`usb_fill_int_urb` macro to fill INT transfer fields.
 Documentation/driver-api/usb/URB.rst-282-
 Documentation/driver-api/usb/URB.rst:283:The :c:func:`usb_submit_urb` call modifies ``urb->interval`` to the implemented
 Documentation/driver-api/usb/URB.rst-284-interval value that is less than or equal to the requested interval value.
 --
 Documentation/driver-api/usb/error-codes.rst=14=way certain faults are reported.
 --
 Documentation/driver-api/usb/error-codes.rst-16-
 Documentation/driver-api/usb/error-codes.rst:17:Error codes returned by :c:func:`usb_submit_urb`
 Documentation/driver-api/usb/error-codes.rst-18-================================================
 --
 Documentation/driver-api/usb/writing_usb_driver.rst=188=subsystem. This can be seen in the following code::
 --
 Documentation/driver-api/usb/writing_usb_driver.rst-205-    /* send the data out the bulk port */
 Documentation/driver-api/usb/writing_usb_driver.rst:206:    retval = usb_submit_urb(urb, GFP_KERNEL);
 Documentation/driver-api/usb/writing_usb_driver.rst-207-    if (retval) {
 --
 drivers/bluetooth/bcm203x.c=63=static void bcm203x_complete(struct urb *urb)
 --
 drivers/bluetooth/bcm203x.c-95-
 drivers/bluetooth/bcm203x.c:96:		if (usb_submit_urb(data->urb, GFP_ATOMIC) < 0)
 drivers/bluetooth/bcm203x.c-97-			BT_ERR("Can't submit URB");
 --
 drivers/bluetooth/bcm203x.c-123-
 drivers/bluetooth/bcm203x.c:124:		if (usb_submit_urb(data->urb, GFP_ATOMIC) < 0)
 drivers/bluetooth/bcm203x.c-125-			BT_ERR("Can't submit URB");
 --
 drivers/bluetooth/bcm203x.c=140=static void bcm203x_work(struct work_struct *work)
 --
 drivers/bluetooth/bcm203x.c-147-
 drivers/bluetooth/bcm203x.c:148:	if (usb_submit_urb(data->urb, GFP_KERNEL) < 0)
 drivers/bluetooth/bcm203x.c-149-		BT_ERR("Can't submit URB");
 --
 drivers/bluetooth/bfusb.c=111=static int bfusb_send_bulk(struct bfusb_data *data, struct sk_buff *skb)
 --
 drivers/bluetooth/bfusb.c-133-
 drivers/bluetooth/bfusb.c:134:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/bfusb.c-135-	if (err) {
 --
 drivers/bluetooth/bfusb.c=201=static int bfusb_rx_submit(struct bfusb_data *data, struct urb *urb)
 --
 drivers/bluetooth/bfusb.c-232-
 drivers/bluetooth/bfusb.c:233:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/bfusb.c-234-	if (err) {
 --
 drivers/bluetooth/bfusb.c=333=static void bfusb_rx_complete(struct urb *urb)
 --
 drivers/bluetooth/bfusb.c-389-
 drivers/bluetooth/bfusb.c:390:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/bfusb.c-391-	if (err) {
 --
 drivers/bluetooth/bpa10x.c=85=static void bpa10x_rx_complete(struct urb *urb)
 --
 drivers/bluetooth/bpa10x.c-113-
 drivers/bluetooth/bpa10x.c:114:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/bpa10x.c-115-	if (err < 0) {
 --
 drivers/bluetooth/bpa10x.c=121=static inline int bpa10x_submit_intr_urb(struct hci_dev *hdev)
 --
 drivers/bluetooth/bpa10x.c-149-
 drivers/bluetooth/bpa10x.c:150:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/bpa10x.c-151-	if (err < 0) {
 --
 drivers/bluetooth/bpa10x.c=161=static inline int bpa10x_submit_bulk_urb(struct hci_dev *hdev)
 --
 drivers/bluetooth/bpa10x.c-189-
 drivers/bluetooth/bpa10x.c:190:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/bpa10x.c-191-	if (err < 0) {
 --
 drivers/bluetooth/bpa10x.c=266=static int bpa10x_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
 --
 drivers/bluetooth/bpa10x.c-331-
 drivers/bluetooth/bpa10x.c:332:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/bpa10x.c-333-	if (err < 0) {
 --
 drivers/bluetooth/btmtk.c=486=static void btmtk_usb_wmt_recv(struct urb *urb)
 --
 drivers/bluetooth/btmtk.c-554-	usb_anchor_urb(urb, data->ctrl_anchor);
 drivers/bluetooth/btmtk.c:555:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btmtk.c-556-	if (err < 0) {
 --
 drivers/bluetooth/btmtk.c=568=static int btmtk_usb_submit_wmt_recv_urb(struct hci_dev *hdev)
 --
 drivers/bluetooth/btmtk.c-607-	usb_anchor_urb(urb, data->ctrl_anchor);
 drivers/bluetooth/btmtk.c:608:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/btmtk.c-609-	if (err < 0) {
 --
 drivers/bluetooth/btmtk.c=1150=static void btmtk_intr_complete(struct urb *urb)
 --
 drivers/bluetooth/btmtk.c-1180-
 drivers/bluetooth/btmtk.c:1181:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btmtk.c-1182-	if (err < 0) {
 --
 drivers/bluetooth/btmtk.c=1195=static int btmtk_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btmtk.c-1230-
 drivers/bluetooth/btmtk.c:1231:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btmtk.c-1232-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1456=static void btusb_intr_complete(struct urb *urb)
 --
 drivers/bluetooth/btusb.c-1486-
 drivers/bluetooth/btusb.c:1487:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-1488-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1501=static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btusb.c-1542-
 drivers/bluetooth/btusb.c:1543:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btusb.c-1544-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1580=static void btusb_bulk_complete(struct urb *urb)
 --
 drivers/bluetooth/btusb.c-1610-
 drivers/bluetooth/btusb.c:1611:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-1612-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1623=static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btusb.c-1655-
 drivers/bluetooth/btusb.c:1656:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btusb.c-1657-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1669=static void btusb_isoc_complete(struct urb *urb)
 --
 drivers/bluetooth/btusb.c-1706-
 drivers/bluetooth/btusb.c:1707:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-1708-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1783=static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btusb.c-1820-
 drivers/bluetooth/btusb.c:1821:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btusb.c-1822-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1834=static void btusb_diag_complete(struct urb *urb)
 --
 drivers/bluetooth/btusb.c-1862-
 drivers/bluetooth/btusb.c:1863:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-1864-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1875=static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btusb.c-1907-
 drivers/bluetooth/btusb.c:1908:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btusb.c-1909-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=2180=static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
 --
 drivers/bluetooth/btusb.c-2186-
 drivers/bluetooth/btusb.c:2187:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/btusb.c-2188-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=4528=static void play_deferred(struct btusb_data *data)
 --
 drivers/bluetooth/btusb.c-4535-
 drivers/bluetooth/btusb.c:4536:		err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-4537-		if (err < 0) {
 --
 drivers/char/xillybus/xillyusb.c=697=static void try_queue_bulk_in(struct xillyusb_endpoint *ep)
 --
 drivers/char/xillybus/xillyusb.c-737-
 drivers/char/xillybus/xillyusb.c:738:		rc = usb_submit_urb(urb, GFP_KERNEL);
 drivers/char/xillybus/xillyusb.c-739-
 --
 drivers/char/xillybus/xillyusb.c=763=static void try_queue_bulk_out(struct xillyusb_endpoint *ep)
 --
 drivers/char/xillybus/xillyusb.c-841-
 drivers/char/xillybus/xillyusb.c:842:		rc = usb_submit_urb(urb, GFP_KERNEL);
 drivers/char/xillybus/xillyusb.c-843-
 --
 drivers/comedi/drivers/usbdux.c=238=static void usbduxsub_ai_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbdux.c-273-		urb->dev = comedi_to_usb_dev(dev);
 drivers/comedi/drivers/usbdux.c:274:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-275-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbdux.c=366=static void usbduxsub_ao_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbdux.c-420-		urb->iso_frame_desc[0].status = 0;
 drivers/comedi/drivers/usbdux.c:421:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-422-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbdux.c=477=static int usbdux_submit_urbs(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbdux.c-498-
 drivers/comedi/drivers/usbdux.c:499:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-500-		if (ret)
 --
 drivers/comedi/drivers/usbdux.c=1149=static void usbduxsub_pwm_irq(struct urb *urb)
 --
 drivers/comedi/drivers/usbdux.c-1191-	if (devpriv->pwm_cmd_running) {
 drivers/comedi/drivers/usbdux.c:1192:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-1193-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbdux.c=1207=static int usbduxsub_submit_pwm_urbs(struct comedi_device *dev)
 --
 drivers/comedi/drivers/usbdux.c-1219-
 drivers/comedi/drivers/usbdux.c:1220:	return usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-1221-}
 --
 drivers/comedi/drivers/usbduxfast.c=223=static void usbduxfast_ai_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbduxfast.c-249-		urb->status = 0;
 drivers/comedi/drivers/usbduxfast.c:250:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxfast.c-251-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbduxfast.c=301=static int usbduxfast_submit_urb(struct comedi_device *dev)
 --
 drivers/comedi/drivers/usbduxfast.c-310-
 drivers/comedi/drivers/usbduxfast.c:311:	ret = usb_submit_urb(devpriv->urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxfast.c-312-	if (ret) {
 drivers/comedi/drivers/usbduxfast.c:313:		dev_err(dev->class_dev, "usb_submit_urb error %d\n", ret);
 drivers/comedi/drivers/usbduxfast.c-314-		return ret;
 --
 drivers/comedi/drivers/usbduxsigma.c=200=static void usbduxsigma_ai_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbduxsigma.c-236-		urb->dev = comedi_to_usb_dev(dev);
 drivers/comedi/drivers/usbduxsigma.c:237:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-238-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbduxsigma.c=326=static void usbduxsigma_ao_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbduxsigma.c-375-		urb->iso_frame_desc[0].status = 0;
 drivers/comedi/drivers/usbduxsigma.c:376:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-377-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbduxsigma.c=430=static int usbduxsigma_submit_urbs(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbduxsigma.c-450-
 drivers/comedi/drivers/usbduxsigma.c:451:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-452-		if (ret)
 --
 drivers/comedi/drivers/usbduxsigma.c=1011=static void usbduxsigma_pwm_urb_complete(struct urb *urb)
 --
 drivers/comedi/drivers/usbduxsigma.c-1046-	urb->status = 0;
 drivers/comedi/drivers/usbduxsigma.c:1047:	ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-1048-	if (ret < 0) {
 --
 drivers/comedi/drivers/usbduxsigma.c=1057=static int usbduxsigma_submit_pwm_urb(struct comedi_device *dev)
 --
 drivers/comedi/drivers/usbduxsigma.c-1067-
 drivers/comedi/drivers/usbduxsigma.c:1068:	return usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-1069-}
 --
 drivers/gnss/usb.c=33=static void gnss_usb_rx_complete(struct urb *urb)
 --
 drivers/gnss/usb.c-64-resubmit:
 drivers/gnss/usb.c:65:	ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/gnss/usb.c-66-	if (ret && ret != -EPERM && ret != -ENODEV)
 --
 drivers/gnss/usb.c=70=static int gnss_usb_open(struct gnss_device *gdev)
 --
 drivers/gnss/usb.c-74-
 drivers/gnss/usb.c:75:	ret = usb_submit_urb(gusb->read_urb, GFP_KERNEL);
 drivers/gnss/usb.c-76-	if (ret) {
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=50=static int agilent_82357a_send_bulk_msg(struct agilent_82357a_priv *a_priv, void *data,
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-85-
 drivers/gpib/agilent_82357a/agilent_82357a.c:86:	retval = usb_submit_urb(a_priv->bulk_urb, GFP_KERNEL);
 drivers/gpib/agilent_82357a/agilent_82357a.c-87-	if (retval) {
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=118=static int agilent_82357a_receive_bulk_msg(struct agilent_82357a_priv *a_priv, void *data,
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-153-
 drivers/gpib/agilent_82357a/agilent_82357a.c:154:	retval = usb_submit_urb(a_priv->bulk_urb, GFP_KERNEL);
 drivers/gpib/agilent_82357a/agilent_82357a.c-155-	if (retval) {
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=1091=static void agilent_82357a_interrupt_complete(struct urb *urb)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-1109-	default: /* other error, resubmit */
 drivers/gpib/agilent_82357a/agilent_82357a.c:1110:		retval = usb_submit_urb(a_priv->interrupt_urb, GFP_ATOMIC);
 drivers/gpib/agilent_82357a/agilent_82357a.c-1111-		if (retval)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-1125-
 drivers/gpib/agilent_82357a/agilent_82357a.c:1126:	retval = usb_submit_urb(a_priv->interrupt_urb, GFP_ATOMIC);
 drivers/gpib/agilent_82357a/agilent_82357a.c-1127-	if (retval)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=1131=static int agilent_82357a_setup_urbs(struct gpib_board *board)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-1159-			 INTERRUPT_BUF_LEN, &agilent_82357a_interrupt_complete, board, 1);
 drivers/gpib/agilent_82357a/agilent_82357a.c:1160:	retval = usb_submit_urb(a_priv->interrupt_urb, GFP_KERNEL);
 drivers/gpib/agilent_82357a/agilent_82357a.c-1161-	if (retval) {
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=1586=static int agilent_82357a_driver_resume(struct usb_interface *interface)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-1610-			mutex_lock(&a_priv->interrupt_alloc_lock);
 drivers/gpib/agilent_82357a/agilent_82357a.c:1611:			retval = usb_submit_urb(a_priv->interrupt_urb, GFP_KERNEL);
 drivers/gpib/agilent_82357a/agilent_82357a.c-1612-			if (retval) {
 --
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c=1369=static int lpvo_do_read_io(struct lpvo *dev, size_t count)
 --
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c-1391-	/* do it */
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c:1392:	rv = usb_submit_urb(dev->bulk_in_urb, GFP_KERNEL);
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c-1393-	if (rv < 0) {
 --
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c=1586=static ssize_t lpvo_do_write(struct lpvo *dev, const char *buffer, size_t count)
 --
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c-1658-	/* send the data out the bulk port */
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c:1659:	retval = usb_submit_urb(urb, GFP_KERNEL);
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c-1660-	mutex_unlock(&dev->io_mutex);
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=105=static int ni_usb_nonblocking_send_bulk_msg(struct ni_usb_priv *ni_priv, void *data,
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-138-
 drivers/gpib/ni_usb/ni_usb_gpib.c:139:	retval = usb_submit_urb(ni_priv->bulk_urb, GFP_KERNEL);
 drivers/gpib/ni_usb/ni_usb_gpib.c-140-	if (retval) {
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=190=static int ni_usb_nonblocking_receive_bulk_msg(struct ni_usb_priv *ni_priv,
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-224-
 drivers/gpib/ni_usb/ni_usb_gpib.c:225:	retval = usb_submit_urb(ni_priv->bulk_urb, GFP_KERNEL);
 drivers/gpib/ni_usb/ni_usb_gpib.c-226-	if (retval) {
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=1816=static void ni_usb_interrupt_complete(struct urb *urb)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-1834-	default: /* other error, resubmit */
 drivers/gpib/ni_usb/ni_usb_gpib.c:1835:		retval = usb_submit_urb(ni_priv->interrupt_urb, GFP_ATOMIC);
 drivers/gpib/ni_usb/ni_usb_gpib.c-1836-		if (retval)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-1848-
 drivers/gpib/ni_usb/ni_usb_gpib.c:1849:	retval = usb_submit_urb(ni_priv->interrupt_urb, GFP_ATOMIC);
 drivers/gpib/ni_usb/ni_usb_gpib.c-1850-	if (retval)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=1885=static int ni_usb_setup_urbs(struct gpib_board *board)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-1908-			 sizeof(ni_priv->interrupt_buffer), &ni_usb_interrupt_complete, board, 1);
 drivers/gpib/ni_usb/ni_usb_gpib.c:1909:	retval = usb_submit_urb(ni_priv->interrupt_urb, GFP_KERNEL);
 drivers/gpib/ni_usb/ni_usb_gpib.c-1910-	mutex_unlock(&ni_priv->interrupt_transfer_lock);
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=2534=static int ni_usb_driver_resume(struct usb_interface *interface)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-2559-			mutex_lock(&ni_priv->interrupt_transfer_lock);
 drivers/gpib/ni_usb/ni_usb_gpib.c:2560:			retval = usb_submit_urb(ni_priv->interrupt_urb, GFP_KERNEL);
 drivers/gpib/ni_usb/ni_usb_gpib.c-2561-			if (retval) {
 --
 drivers/gpu/drm/udl/udl_main.c=298=int udl_submit_urb(struct udl_device *udl, struct urb *urb, size_t len)
 --
 drivers/gpu/drm/udl/udl_main.c-306-	urb->transfer_buffer_length = len; /* set to actual payload len */
 drivers/gpu/drm/udl/udl_main.c:307:	ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/gpu/drm/udl/udl_main.c-308- error:
 --
 drivers/gpu/drm/udl/udl_main.c-310-		udl_urb_completion(urb); /* because no one else will */
 drivers/gpu/drm/udl/udl_main.c:311:		DRM_ERROR("usb_submit_urb error %x\n", ret);
 drivers/gpu/drm/udl/udl_main.c-312-	}
 --
 drivers/greybus/es2.c=179=static int output_async(struct es2_ap_dev *es2, void *req, u16 size, u8 cmd)
 --
 drivers/greybus/es2.c-208-			     ap_urb_complete, dr);
 drivers/greybus/es2.c:209:	retval = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/greybus/es2.c-210-	if (retval) {
 --
 drivers/greybus/es2.c=228=static int es2_cport_in_enable(struct es2_ap_dev *es2,
 --
 drivers/greybus/es2.c-237-
 drivers/greybus/es2.c:238:		ret = usb_submit_urb(urb, GFP_KERNEL);
 drivers/greybus/es2.c-239-		if (ret) {
 --
 drivers/greybus/es2.c=269=static int es2_arpc_in_enable(struct es2_ap_dev *es2)
 --
 drivers/greybus/es2.c-277-
 drivers/greybus/es2.c:278:		ret = usb_submit_urb(urb, GFP_KERNEL);
 drivers/greybus/es2.c-279-		if (ret) {
 --
 drivers/greybus/es2.c=390=static int message_send(struct gb_host_device *hd, u16 cport_id,
 --
 drivers/greybus/es2.c-432-
 drivers/greybus/es2.c:433:	retval = usb_submit_urb(urb, gfp_mask);
 drivers/greybus/es2.c-434-	if (retval) {
 --
 drivers/greybus/es2.c=809=static void cport_in_callback(struct urb *urb)
 --
 drivers/greybus/es2.c-846-	/* put our urb back in the request pool */
 drivers/greybus/es2.c:847:	retval = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/greybus/es2.c-848-	if (retval)
 --
 drivers/greybus/es2.c=1020=static void arpc_in_callback(struct urb *urb)
 --
 drivers/greybus/es2.c-1063-	/* put our urb back in the request pool */
 drivers/greybus/es2.c:1064:	retval = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/greybus/es2.c-1065-	if (retval)
 --
 drivers/hid/hid-sony.c=594=static void ghl_magic_poke(struct timer_list *t)
 --
 drivers/hid/hid-sony.c-598-
 drivers/hid/hid-sony.c:599:	ret = usb_submit_urb(sc->ghl_urb, GFP_ATOMIC);
 drivers/hid/hid-sony.c-600-	if (ret < 0)
 drivers/hid/hid-sony.c:601:		hid_err(sc->hdev, "usb_submit_urb failed: %d", ret);
 drivers/hid/hid-sony.c-602-}
 --
 drivers/hid/hid-thrustmaster.c=220=static void thrustmaster_model_handler(struct urb *urb)
 --
 drivers/hid/hid-thrustmaster.c-263-
 drivers/hid/hid-thrustmaster.c:264:	ret = usb_submit_urb(tm_wheel->urb, GFP_ATOMIC);
 drivers/hid/hid-thrustmaster.c-265-	if (ret)
 --
 drivers/hid/hid-thrustmaster.c=290=static int thrustmaster_probe(struct hid_device *hdev, const struct hid_device_id *id)
 --
 drivers/hid/hid-thrustmaster.c-360-
 drivers/hid/hid-thrustmaster.c:361:	ret = usb_submit_urb(tm_wheel->urb, GFP_ATOMIC);
 drivers/hid/hid-thrustmaster.c-362-	if (ret) {
 --
 drivers/hid/hid-u2fzero.c=125=static int u2fzero_recv(struct u2fzero_device *dev,
 --
 drivers/hid/hid-u2fzero.c-139-
 drivers/hid/hid-u2fzero.c:140:	ret = usb_submit_urb(dev->urb, GFP_NOIO);
 drivers/hid/hid-u2fzero.c-141-	if (unlikely(ret)) {
 drivers/hid/hid-u2fzero.c:142:		hid_err(hdev, "usb_submit_urb failed: %d", ret);
 drivers/hid/hid-u2fzero.c-143-		goto err;
 --
 drivers/hid/usbhid/hid-core.c=82=static int hid_start_in(struct hid_device *hid)
 --
 drivers/hid/usbhid/hid-core.c-92-	    !test_and_set_bit(HID_IN_RUNNING, &usbhid->iofl)) {
 drivers/hid/usbhid/hid-core.c:93:		rc = usb_submit_urb(usbhid->urbin, GFP_ATOMIC);
 drivers/hid/usbhid/hid-core.c-94-		if (rc != 0) {
 --
 drivers/hid/usbhid/hid-core.c=273=static void hid_irq_in(struct urb *urb)
 --
 drivers/hid/usbhid/hid-core.c-323-
 drivers/hid/usbhid/hid-core.c:324:	status = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/hid/usbhid/hid-core.c-325-	if (status) {
 --
 drivers/hid/usbhid/hid-core.c=337=static int hid_submit_out(struct hid_device *hid)
 --
 drivers/hid/usbhid/hid-core.c-357-
 drivers/hid/usbhid/hid-core.c:358:	r = usb_submit_urb(usbhid->urbout, GFP_ATOMIC);
 drivers/hid/usbhid/hid-core.c-359-	if (r < 0) {
 drivers/hid/usbhid/hid-core.c:360:		hid_err(hid, "usb_submit_urb(out) failed: %d\n", r);
 drivers/hid/usbhid/hid-core.c-361-		return r;
 --
 drivers/hid/usbhid/hid-core.c=367=static int hid_submit_ctrl(struct hid_device *hid)
 --
 drivers/hid/usbhid/hid-core.c-413-
 drivers/hid/usbhid/hid-core.c:414:	r = usb_submit_urb(usbhid->urbctrl, GFP_ATOMIC);
 drivers/hid/usbhid/hid-core.c-415-	if (r < 0) {
 drivers/hid/usbhid/hid-core.c:416:		hid_err(hid, "usb_submit_urb(ctrl) failed: %d\n", r);
 drivers/hid/usbhid/hid-core.c-417-		return r;
 --
 drivers/hid/usbhid/usbkbd.c=100=static void usb_kbd_irq(struct urb *urb)
 --
 drivers/hid/usbhid/usbkbd.c-145-resubmit:
 drivers/hid/usbhid/usbkbd.c:146:	i = usb_submit_urb (urb, GFP_ATOMIC);
 drivers/hid/usbhid/usbkbd.c-147-	if (i)
 --
 drivers/hid/usbhid/usbkbd.c=153=static int usb_kbd_event(struct input_dev *dev, unsigned int type,
 --
 drivers/hid/usbhid/usbkbd.c-179-	kbd->led->dev = kbd->usbdev;
 drivers/hid/usbhid/usbkbd.c:180:	if (usb_submit_urb(kbd->led, GFP_ATOMIC))
 drivers/hid/usbhid/usbkbd.c:181:		pr_err("usb_submit_urb(leds) failed\n");
 drivers/hid/usbhid/usbkbd.c-182-	else
 --
 drivers/hid/usbhid/usbkbd.c=190=static void usb_kbd_led(struct urb *urb)
 --
 drivers/hid/usbhid/usbkbd.c-209-	kbd->led->dev = kbd->usbdev;
 drivers/hid/usbhid/usbkbd.c:210:	if (usb_submit_urb(kbd->led, GFP_ATOMIC)){
 drivers/hid/usbhid/usbkbd.c:211:		hid_err(urb->dev, "usb_submit_urb(leds) failed\n");
 drivers/hid/usbhid/usbkbd.c-212-		kbd->led_urb_submitted = false;
 --
 drivers/hid/usbhid/usbkbd.c=218=static int usb_kbd_open(struct input_dev *dev)
 --
 drivers/hid/usbhid/usbkbd.c-222-	kbd->irq->dev = kbd->usbdev;
 drivers/hid/usbhid/usbkbd.c:223:	if (usb_submit_urb(kbd->irq, GFP_KERNEL))
 drivers/hid/usbhid/usbkbd.c-224-		return -EIO;
 --
 drivers/hid/usbhid/usbmouse.c=49=static void usb_mouse_irq(struct urb *urb)
 --
 drivers/hid/usbhid/usbmouse.c-79-resubmit:
 drivers/hid/usbhid/usbmouse.c:80:	status = usb_submit_urb (urb, GFP_ATOMIC);
 drivers/hid/usbhid/usbmouse.c-81-	if (status)
 --
 drivers/hid/usbhid/usbmouse.c=88=static int usb_mouse_open(struct input_dev *dev)
 --
 drivers/hid/usbhid/usbmouse.c-92-	mouse->irq->dev = mouse->usbdev;
 drivers/hid/usbhid/usbmouse.c:93:	if (usb_submit_urb(mouse->irq, GFP_KERNEL))
 drivers/hid/usbhid/usbmouse.c-94-		return -EIO;
 --
 drivers/hwmon/powerz.c=96=static void powerz_usb_cmd_complete(struct urb *urb)
 --
 drivers/hwmon/powerz.c-104-
 drivers/hwmon/powerz.c:105:	priv->status = usb_submit_urb(urb, GFP_ATOMIC);
]
]

gemini-3.1-pro-preview

							input: 224299
							output: 51
							thoughts: 41
						

Okay, here's my interpretation of those thoughts, tailored for an expert audience, presented in the first person:

**Navigating the Rtl88x2bu USB Driver**

Hold on a second. I was *certain* I was using a function called `rtl_usb_start_rx`. Now that I'm trying to implement my new technique... it's not showing up.  That's a bit perplexing.  Time to double-check my assumptions and delve back into the source code of the rtl88x2bu driver, specifically focusing on the USB implementation. I need to be absolutely certain I haven't misremembered the function name or its location. Back to `drivers/net/wireless/realtek/rtlwifi/usb.c` to see if there's an equivalent or, heaven forbid, if my understanding of the driver's structure is flawed in some way. I have to make sure my logic is sound before progressing.

map[ContextFile:drivers/net/wireless/realtek/rtlwifi/usb.c IncludeLines:true Name:_rtl_rx_work]

map[SourceCode: 480:	static void _rtl_rx_work(struct tasklet_struct *t)
 481:	{
 482:		struct rtl_usb *rtlusb = from_tasklet(rtlusb, t, rx_work_tasklet);
 483:		struct ieee80211_hw *hw = usb_get_intfdata(rtlusb->intf);
 484:		struct sk_buff *skb;
 485:	
 486:		while ((skb = skb_dequeue(&rtlusb->rx_queue))) {
 487:			if (unlikely(IS_USB_STOP(rtlusb))) {
 488:				dev_kfree_skb_any(skb);
 489:				continue;
 490:			}
 491:	
 492:			if (likely(!rtlusb->usb_rx_segregate_hdl)) {
 493:				_rtl_usb_rx_process_noagg(hw, skb);
 494:			} else {
 495:				/* TO DO */
 496:				_rtl_rx_pre_process(hw, skb);
 497:				pr_err("rx agg not supported\n");
 498:			}
 499:		}
 500:	}
 SourceFile:drivers/net/wireless/realtek/rtlwifi/usb.c]

gemini-3.1-pro-preview

							input: 224982
							output: 36
							thoughts: 61
						

Okay, here's my thought process as I'm digging into this:

**Hunting Down USB URB Submission in the RTLWIFI Driver**

Alright, I need to understand how the USB URBs are being handled in this Realtek Wi-Fi driver. My initial instinct was to check the `_rtl_usb_rx_process_noagg` function, but that's not quite what I'm looking for; I need to find the point where the URBs are *submitted* to the USB bus. Since I'm working with a Realtek driver, my next move is to go straight to the relevant file within the kernel source. I know I'm looking at USB interactions for the Realtek wireless, so I'll zero in on `drivers/net/wireless/realtek/rtlwifi/usb.c`. Now, I'll use `grep` to quickly find all instances of `usb_submit_urb` within that specific file. That should give me a solid list of potential entry points where these URBs are being kicked off, and then I can dive deeper into the code around those calls. This should quickly give me an overview of the key functions that submit the URBs.

log-in to see details

map[Expression:usb_submit_urb.*drivers/net/wireless/realtek/rtlwifi/usb.c]

map[Output:]

gemini-3.1-pro-preview

							input: 225347
							output: 19
							thoughts: 8
						

Here's a summary of my thinking process, rendered as requested:

**Debugging the Grep**

Okay, so I'm looking at this output, and something's not quite right. After a moment, it clicks. The results I'm seeing don't align with what I was expecting. It has to be the `grep` expression. Something in the regex is off, it's not filtering the way I intended. Time to go back and really scrutinize that search pattern. It's frustrating to have a seemingly simple command yield unexpected results, especially when it's something I do so often. This isn't producing the output that I had envisioned and I need to figure out why.

map[Expression:usb_submit_urb]

map[Output:
Full output is too long, showing 500 out of 5329 lines.
Use more precise expression if possible.

[Documentation/driver-api/usb/URB.rst=24=called USB Request Block, or URB for short.
 --
 Documentation/driver-api/usb/URB.rst-29-- Execution of an URB is inherently an asynchronous operation, i.e. the
 Documentation/driver-api/usb/URB.rst:30:  :c:func:`usb_submit_urb` call returns immediately after it has successfully
 Documentation/driver-api/usb/URB.rst-31-  queued the requested action.
 --
 Documentation/driver-api/usb/URB.rst=134=How to submit an URB?
 --
 Documentation/driver-api/usb/URB.rst-136-
 Documentation/driver-api/usb/URB.rst:137:Just call :c:func:`usb_submit_urb`::
 Documentation/driver-api/usb/URB.rst-138-
 Documentation/driver-api/usb/URB.rst:139:	int usb_submit_urb(struct urb *urb, int mem_flags)
 Documentation/driver-api/usb/URB.rst-140-
 --
 Documentation/driver-api/usb/URB.rst=251=each packet you want to schedule.
 Documentation/driver-api/usb/URB.rst-252-
 Documentation/driver-api/usb/URB.rst:253:The :c:func:`usb_submit_urb` call modifies ``urb->interval`` to the implemented
 Documentation/driver-api/usb/URB.rst-254-interval value that is less than or equal to the requested interval value.  If
 --
 Documentation/driver-api/usb/URB.rst=281=You can use the :c:func:`usb_fill_int_urb` macro to fill INT transfer fields.
 Documentation/driver-api/usb/URB.rst-282-
 Documentation/driver-api/usb/URB.rst:283:The :c:func:`usb_submit_urb` call modifies ``urb->interval`` to the implemented
 Documentation/driver-api/usb/URB.rst-284-interval value that is less than or equal to the requested interval value.
 --
 Documentation/driver-api/usb/error-codes.rst=14=way certain faults are reported.
 --
 Documentation/driver-api/usb/error-codes.rst-16-
 Documentation/driver-api/usb/error-codes.rst:17:Error codes returned by :c:func:`usb_submit_urb`
 Documentation/driver-api/usb/error-codes.rst-18-================================================
 --
 Documentation/driver-api/usb/writing_usb_driver.rst=188=subsystem. This can be seen in the following code::
 --
 Documentation/driver-api/usb/writing_usb_driver.rst-205-    /* send the data out the bulk port */
 Documentation/driver-api/usb/writing_usb_driver.rst:206:    retval = usb_submit_urb(urb, GFP_KERNEL);
 Documentation/driver-api/usb/writing_usb_driver.rst-207-    if (retval) {
 --
 drivers/bluetooth/bcm203x.c=63=static void bcm203x_complete(struct urb *urb)
 --
 drivers/bluetooth/bcm203x.c-95-
 drivers/bluetooth/bcm203x.c:96:		if (usb_submit_urb(data->urb, GFP_ATOMIC) < 0)
 drivers/bluetooth/bcm203x.c-97-			BT_ERR("Can't submit URB");
 --
 drivers/bluetooth/bcm203x.c-123-
 drivers/bluetooth/bcm203x.c:124:		if (usb_submit_urb(data->urb, GFP_ATOMIC) < 0)
 drivers/bluetooth/bcm203x.c-125-			BT_ERR("Can't submit URB");
 --
 drivers/bluetooth/bcm203x.c=140=static void bcm203x_work(struct work_struct *work)
 --
 drivers/bluetooth/bcm203x.c-147-
 drivers/bluetooth/bcm203x.c:148:	if (usb_submit_urb(data->urb, GFP_KERNEL) < 0)
 drivers/bluetooth/bcm203x.c-149-		BT_ERR("Can't submit URB");
 --
 drivers/bluetooth/bfusb.c=111=static int bfusb_send_bulk(struct bfusb_data *data, struct sk_buff *skb)
 --
 drivers/bluetooth/bfusb.c-133-
 drivers/bluetooth/bfusb.c:134:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/bfusb.c-135-	if (err) {
 --
 drivers/bluetooth/bfusb.c=201=static int bfusb_rx_submit(struct bfusb_data *data, struct urb *urb)
 --
 drivers/bluetooth/bfusb.c-232-
 drivers/bluetooth/bfusb.c:233:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/bfusb.c-234-	if (err) {
 --
 drivers/bluetooth/bfusb.c=333=static void bfusb_rx_complete(struct urb *urb)
 --
 drivers/bluetooth/bfusb.c-389-
 drivers/bluetooth/bfusb.c:390:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/bfusb.c-391-	if (err) {
 --
 drivers/bluetooth/bpa10x.c=85=static void bpa10x_rx_complete(struct urb *urb)
 --
 drivers/bluetooth/bpa10x.c-113-
 drivers/bluetooth/bpa10x.c:114:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/bpa10x.c-115-	if (err < 0) {
 --
 drivers/bluetooth/bpa10x.c=121=static inline int bpa10x_submit_intr_urb(struct hci_dev *hdev)
 --
 drivers/bluetooth/bpa10x.c-149-
 drivers/bluetooth/bpa10x.c:150:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/bpa10x.c-151-	if (err < 0) {
 --
 drivers/bluetooth/bpa10x.c=161=static inline int bpa10x_submit_bulk_urb(struct hci_dev *hdev)
 --
 drivers/bluetooth/bpa10x.c-189-
 drivers/bluetooth/bpa10x.c:190:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/bpa10x.c-191-	if (err < 0) {
 --
 drivers/bluetooth/bpa10x.c=266=static int bpa10x_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
 --
 drivers/bluetooth/bpa10x.c-331-
 drivers/bluetooth/bpa10x.c:332:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/bpa10x.c-333-	if (err < 0) {
 --
 drivers/bluetooth/btmtk.c=486=static void btmtk_usb_wmt_recv(struct urb *urb)
 --
 drivers/bluetooth/btmtk.c-554-	usb_anchor_urb(urb, data->ctrl_anchor);
 drivers/bluetooth/btmtk.c:555:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btmtk.c-556-	if (err < 0) {
 --
 drivers/bluetooth/btmtk.c=568=static int btmtk_usb_submit_wmt_recv_urb(struct hci_dev *hdev)
 --
 drivers/bluetooth/btmtk.c-607-	usb_anchor_urb(urb, data->ctrl_anchor);
 drivers/bluetooth/btmtk.c:608:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/btmtk.c-609-	if (err < 0) {
 --
 drivers/bluetooth/btmtk.c=1150=static void btmtk_intr_complete(struct urb *urb)
 --
 drivers/bluetooth/btmtk.c-1180-
 drivers/bluetooth/btmtk.c:1181:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btmtk.c-1182-	if (err < 0) {
 --
 drivers/bluetooth/btmtk.c=1195=static int btmtk_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btmtk.c-1230-
 drivers/bluetooth/btmtk.c:1231:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btmtk.c-1232-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1456=static void btusb_intr_complete(struct urb *urb)
 --
 drivers/bluetooth/btusb.c-1486-
 drivers/bluetooth/btusb.c:1487:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-1488-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1501=static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btusb.c-1542-
 drivers/bluetooth/btusb.c:1543:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btusb.c-1544-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1580=static void btusb_bulk_complete(struct urb *urb)
 --
 drivers/bluetooth/btusb.c-1610-
 drivers/bluetooth/btusb.c:1611:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-1612-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1623=static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btusb.c-1655-
 drivers/bluetooth/btusb.c:1656:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btusb.c-1657-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1669=static void btusb_isoc_complete(struct urb *urb)
 --
 drivers/bluetooth/btusb.c-1706-
 drivers/bluetooth/btusb.c:1707:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-1708-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1783=static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btusb.c-1820-
 drivers/bluetooth/btusb.c:1821:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btusb.c-1822-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1834=static void btusb_diag_complete(struct urb *urb)
 --
 drivers/bluetooth/btusb.c-1862-
 drivers/bluetooth/btusb.c:1863:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-1864-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1875=static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btusb.c-1907-
 drivers/bluetooth/btusb.c:1908:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btusb.c-1909-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=2180=static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
 --
 drivers/bluetooth/btusb.c-2186-
 drivers/bluetooth/btusb.c:2187:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/btusb.c-2188-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=4528=static void play_deferred(struct btusb_data *data)
 --
 drivers/bluetooth/btusb.c-4535-
 drivers/bluetooth/btusb.c:4536:		err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-4537-		if (err < 0) {
 --
 drivers/char/xillybus/xillyusb.c=697=static void try_queue_bulk_in(struct xillyusb_endpoint *ep)
 --
 drivers/char/xillybus/xillyusb.c-737-
 drivers/char/xillybus/xillyusb.c:738:		rc = usb_submit_urb(urb, GFP_KERNEL);
 drivers/char/xillybus/xillyusb.c-739-
 --
 drivers/char/xillybus/xillyusb.c=763=static void try_queue_bulk_out(struct xillyusb_endpoint *ep)
 --
 drivers/char/xillybus/xillyusb.c-841-
 drivers/char/xillybus/xillyusb.c:842:		rc = usb_submit_urb(urb, GFP_KERNEL);
 drivers/char/xillybus/xillyusb.c-843-
 --
 drivers/comedi/drivers/usbdux.c=238=static void usbduxsub_ai_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbdux.c-273-		urb->dev = comedi_to_usb_dev(dev);
 drivers/comedi/drivers/usbdux.c:274:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-275-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbdux.c=366=static void usbduxsub_ao_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbdux.c-420-		urb->iso_frame_desc[0].status = 0;
 drivers/comedi/drivers/usbdux.c:421:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-422-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbdux.c=477=static int usbdux_submit_urbs(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbdux.c-498-
 drivers/comedi/drivers/usbdux.c:499:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-500-		if (ret)
 --
 drivers/comedi/drivers/usbdux.c=1149=static void usbduxsub_pwm_irq(struct urb *urb)
 --
 drivers/comedi/drivers/usbdux.c-1191-	if (devpriv->pwm_cmd_running) {
 drivers/comedi/drivers/usbdux.c:1192:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-1193-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbdux.c=1207=static int usbduxsub_submit_pwm_urbs(struct comedi_device *dev)
 --
 drivers/comedi/drivers/usbdux.c-1219-
 drivers/comedi/drivers/usbdux.c:1220:	return usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-1221-}
 --
 drivers/comedi/drivers/usbduxfast.c=223=static void usbduxfast_ai_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbduxfast.c-249-		urb->status = 0;
 drivers/comedi/drivers/usbduxfast.c:250:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxfast.c-251-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbduxfast.c=301=static int usbduxfast_submit_urb(struct comedi_device *dev)
 --
 drivers/comedi/drivers/usbduxfast.c-310-
 drivers/comedi/drivers/usbduxfast.c:311:	ret = usb_submit_urb(devpriv->urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxfast.c-312-	if (ret) {
 drivers/comedi/drivers/usbduxfast.c:313:		dev_err(dev->class_dev, "usb_submit_urb error %d\n", ret);
 drivers/comedi/drivers/usbduxfast.c-314-		return ret;
 --
 drivers/comedi/drivers/usbduxsigma.c=200=static void usbduxsigma_ai_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbduxsigma.c-236-		urb->dev = comedi_to_usb_dev(dev);
 drivers/comedi/drivers/usbduxsigma.c:237:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-238-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbduxsigma.c=326=static void usbduxsigma_ao_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbduxsigma.c-375-		urb->iso_frame_desc[0].status = 0;
 drivers/comedi/drivers/usbduxsigma.c:376:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-377-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbduxsigma.c=430=static int usbduxsigma_submit_urbs(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbduxsigma.c-450-
 drivers/comedi/drivers/usbduxsigma.c:451:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-452-		if (ret)
 --
 drivers/comedi/drivers/usbduxsigma.c=1011=static void usbduxsigma_pwm_urb_complete(struct urb *urb)
 --
 drivers/comedi/drivers/usbduxsigma.c-1046-	urb->status = 0;
 drivers/comedi/drivers/usbduxsigma.c:1047:	ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-1048-	if (ret < 0) {
 --
 drivers/comedi/drivers/usbduxsigma.c=1057=static int usbduxsigma_submit_pwm_urb(struct comedi_device *dev)
 --
 drivers/comedi/drivers/usbduxsigma.c-1067-
 drivers/comedi/drivers/usbduxsigma.c:1068:	return usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-1069-}
 --
 drivers/gnss/usb.c=33=static void gnss_usb_rx_complete(struct urb *urb)
 --
 drivers/gnss/usb.c-64-resubmit:
 drivers/gnss/usb.c:65:	ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/gnss/usb.c-66-	if (ret && ret != -EPERM && ret != -ENODEV)
 --
 drivers/gnss/usb.c=70=static int gnss_usb_open(struct gnss_device *gdev)
 --
 drivers/gnss/usb.c-74-
 drivers/gnss/usb.c:75:	ret = usb_submit_urb(gusb->read_urb, GFP_KERNEL);
 drivers/gnss/usb.c-76-	if (ret) {
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=50=static int agilent_82357a_send_bulk_msg(struct agilent_82357a_priv *a_priv, void *data,
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-85-
 drivers/gpib/agilent_82357a/agilent_82357a.c:86:	retval = usb_submit_urb(a_priv->bulk_urb, GFP_KERNEL);
 drivers/gpib/agilent_82357a/agilent_82357a.c-87-	if (retval) {
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=118=static int agilent_82357a_receive_bulk_msg(struct agilent_82357a_priv *a_priv, void *data,
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-153-
 drivers/gpib/agilent_82357a/agilent_82357a.c:154:	retval = usb_submit_urb(a_priv->bulk_urb, GFP_KERNEL);
 drivers/gpib/agilent_82357a/agilent_82357a.c-155-	if (retval) {
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=1091=static void agilent_82357a_interrupt_complete(struct urb *urb)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-1109-	default: /* other error, resubmit */
 drivers/gpib/agilent_82357a/agilent_82357a.c:1110:		retval = usb_submit_urb(a_priv->interrupt_urb, GFP_ATOMIC);
 drivers/gpib/agilent_82357a/agilent_82357a.c-1111-		if (retval)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-1125-
 drivers/gpib/agilent_82357a/agilent_82357a.c:1126:	retval = usb_submit_urb(a_priv->interrupt_urb, GFP_ATOMIC);
 drivers/gpib/agilent_82357a/agilent_82357a.c-1127-	if (retval)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=1131=static int agilent_82357a_setup_urbs(struct gpib_board *board)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-1159-			 INTERRUPT_BUF_LEN, &agilent_82357a_interrupt_complete, board, 1);
 drivers/gpib/agilent_82357a/agilent_82357a.c:1160:	retval = usb_submit_urb(a_priv->interrupt_urb, GFP_KERNEL);
 drivers/gpib/agilent_82357a/agilent_82357a.c-1161-	if (retval) {
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=1586=static int agilent_82357a_driver_resume(struct usb_interface *interface)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-1610-			mutex_lock(&a_priv->interrupt_alloc_lock);
 drivers/gpib/agilent_82357a/agilent_82357a.c:1611:			retval = usb_submit_urb(a_priv->interrupt_urb, GFP_KERNEL);
 drivers/gpib/agilent_82357a/agilent_82357a.c-1612-			if (retval) {
 --
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c=1369=static int lpvo_do_read_io(struct lpvo *dev, size_t count)
 --
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c-1391-	/* do it */
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c:1392:	rv = usb_submit_urb(dev->bulk_in_urb, GFP_KERNEL);
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c-1393-	if (rv < 0) {
 --
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c=1586=static ssize_t lpvo_do_write(struct lpvo *dev, const char *buffer, size_t count)
 --
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c-1658-	/* send the data out the bulk port */
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c:1659:	retval = usb_submit_urb(urb, GFP_KERNEL);
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c-1660-	mutex_unlock(&dev->io_mutex);
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=105=static int ni_usb_nonblocking_send_bulk_msg(struct ni_usb_priv *ni_priv, void *data,
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-138-
 drivers/gpib/ni_usb/ni_usb_gpib.c:139:	retval = usb_submit_urb(ni_priv->bulk_urb, GFP_KERNEL);
 drivers/gpib/ni_usb/ni_usb_gpib.c-140-	if (retval) {
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=190=static int ni_usb_nonblocking_receive_bulk_msg(struct ni_usb_priv *ni_priv,
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-224-
 drivers/gpib/ni_usb/ni_usb_gpib.c:225:	retval = usb_submit_urb(ni_priv->bulk_urb, GFP_KERNEL);
 drivers/gpib/ni_usb/ni_usb_gpib.c-226-	if (retval) {
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=1816=static void ni_usb_interrupt_complete(struct urb *urb)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-1834-	default: /* other error, resubmit */
 drivers/gpib/ni_usb/ni_usb_gpib.c:1835:		retval = usb_submit_urb(ni_priv->interrupt_urb, GFP_ATOMIC);
 drivers/gpib/ni_usb/ni_usb_gpib.c-1836-		if (retval)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-1848-
 drivers/gpib/ni_usb/ni_usb_gpib.c:1849:	retval = usb_submit_urb(ni_priv->interrupt_urb, GFP_ATOMIC);
 drivers/gpib/ni_usb/ni_usb_gpib.c-1850-	if (retval)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=1885=static int ni_usb_setup_urbs(struct gpib_board *board)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-1908-			 sizeof(ni_priv->interrupt_buffer), &ni_usb_interrupt_complete, board, 1);
 drivers/gpib/ni_usb/ni_usb_gpib.c:1909:	retval = usb_submit_urb(ni_priv->interrupt_urb, GFP_KERNEL);
 drivers/gpib/ni_usb/ni_usb_gpib.c-1910-	mutex_unlock(&ni_priv->interrupt_transfer_lock);
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=2534=static int ni_usb_driver_resume(struct usb_interface *interface)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-2559-			mutex_lock(&ni_priv->interrupt_transfer_lock);
 drivers/gpib/ni_usb/ni_usb_gpib.c:2560:			retval = usb_submit_urb(ni_priv->interrupt_urb, GFP_KERNEL);
 drivers/gpib/ni_usb/ni_usb_gpib.c-2561-			if (retval) {
 --
 drivers/gpu/drm/udl/udl_main.c=298=int udl_submit_urb(struct udl_device *udl, struct urb *urb, size_t len)
 --
 drivers/gpu/drm/udl/udl_main.c-306-	urb->transfer_buffer_length = len; /* set to actual payload len */
 drivers/gpu/drm/udl/udl_main.c:307:	ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/gpu/drm/udl/udl_main.c-308- error:
 --
 drivers/gpu/drm/udl/udl_main.c-310-		udl_urb_completion(urb); /* because no one else will */
 drivers/gpu/drm/udl/udl_main.c:311:		DRM_ERROR("usb_submit_urb error %x\n", ret);
 drivers/gpu/drm/udl/udl_main.c-312-	}
 --
 drivers/greybus/es2.c=179=static int output_async(struct es2_ap_dev *es2, void *req, u16 size, u8 cmd)
 --
 drivers/greybus/es2.c-208-			     ap_urb_complete, dr);
 drivers/greybus/es2.c:209:	retval = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/greybus/es2.c-210-	if (retval) {
 --
 drivers/greybus/es2.c=228=static int es2_cport_in_enable(struct es2_ap_dev *es2,
 --
 drivers/greybus/es2.c-237-
 drivers/greybus/es2.c:238:		ret = usb_submit_urb(urb, GFP_KERNEL);
 drivers/greybus/es2.c-239-		if (ret) {
 --
 drivers/greybus/es2.c=269=static int es2_arpc_in_enable(struct es2_ap_dev *es2)
 --
 drivers/greybus/es2.c-277-
 drivers/greybus/es2.c:278:		ret = usb_submit_urb(urb, GFP_KERNEL);
 drivers/greybus/es2.c-279-		if (ret) {
 --
 drivers/greybus/es2.c=390=static int message_send(struct gb_host_device *hd, u16 cport_id,
 --
 drivers/greybus/es2.c-432-
 drivers/greybus/es2.c:433:	retval = usb_submit_urb(urb, gfp_mask);
 drivers/greybus/es2.c-434-	if (retval) {
 --
 drivers/greybus/es2.c=809=static void cport_in_callback(struct urb *urb)
 --
 drivers/greybus/es2.c-846-	/* put our urb back in the request pool */
 drivers/greybus/es2.c:847:	retval = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/greybus/es2.c-848-	if (retval)
 --
 drivers/greybus/es2.c=1020=static void arpc_in_callback(struct urb *urb)
 --
 drivers/greybus/es2.c-1063-	/* put our urb back in the request pool */
 drivers/greybus/es2.c:1064:	retval = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/greybus/es2.c-1065-	if (retval)
 --
 drivers/hid/hid-sony.c=594=static void ghl_magic_poke(struct timer_list *t)
 --
 drivers/hid/hid-sony.c-598-
 drivers/hid/hid-sony.c:599:	ret = usb_submit_urb(sc->ghl_urb, GFP_ATOMIC);
 drivers/hid/hid-sony.c-600-	if (ret < 0)
 drivers/hid/hid-sony.c:601:		hid_err(sc->hdev, "usb_submit_urb failed: %d", ret);
 drivers/hid/hid-sony.c-602-}
 --
 drivers/hid/hid-thrustmaster.c=220=static void thrustmaster_model_handler(struct urb *urb)
 --
 drivers/hid/hid-thrustmaster.c-263-
 drivers/hid/hid-thrustmaster.c:264:	ret = usb_submit_urb(tm_wheel->urb, GFP_ATOMIC);
 drivers/hid/hid-thrustmaster.c-265-	if (ret)
 --
 drivers/hid/hid-thrustmaster.c=290=static int thrustmaster_probe(struct hid_device *hdev, const struct hid_device_id *id)
 --
 drivers/hid/hid-thrustmaster.c-360-
 drivers/hid/hid-thrustmaster.c:361:	ret = usb_submit_urb(tm_wheel->urb, GFP_ATOMIC);
 drivers/hid/hid-thrustmaster.c-362-	if (ret) {
 --
 drivers/hid/hid-u2fzero.c=125=static int u2fzero_recv(struct u2fzero_device *dev,
 --
 drivers/hid/hid-u2fzero.c-139-
 drivers/hid/hid-u2fzero.c:140:	ret = usb_submit_urb(dev->urb, GFP_NOIO);
 drivers/hid/hid-u2fzero.c-141-	if (unlikely(ret)) {
 drivers/hid/hid-u2fzero.c:142:		hid_err(hdev, "usb_submit_urb failed: %d", ret);
 drivers/hid/hid-u2fzero.c-143-		goto err;
 --
 drivers/hid/usbhid/hid-core.c=82=static int hid_start_in(struct hid_device *hid)
 --
 drivers/hid/usbhid/hid-core.c-92-	    !test_and_set_bit(HID_IN_RUNNING, &usbhid->iofl)) {
 drivers/hid/usbhid/hid-core.c:93:		rc = usb_submit_urb(usbhid->urbin, GFP_ATOMIC);
 drivers/hid/usbhid/hid-core.c-94-		if (rc != 0) {
 --
 drivers/hid/usbhid/hid-core.c=273=static void hid_irq_in(struct urb *urb)
 --
 drivers/hid/usbhid/hid-core.c-323-
 drivers/hid/usbhid/hid-core.c:324:	status = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/hid/usbhid/hid-core.c-325-	if (status) {
 --
 drivers/hid/usbhid/hid-core.c=337=static int hid_submit_out(struct hid_device *hid)
 --
 drivers/hid/usbhid/hid-core.c-357-
 drivers/hid/usbhid/hid-core.c:358:	r = usb_submit_urb(usbhid->urbout, GFP_ATOMIC);
 drivers/hid/usbhid/hid-core.c-359-	if (r < 0) {
 drivers/hid/usbhid/hid-core.c:360:		hid_err(hid, "usb_submit_urb(out) failed: %d\n", r);
 drivers/hid/usbhid/hid-core.c-361-		return r;
 --
 drivers/hid/usbhid/hid-core.c=367=static int hid_submit_ctrl(struct hid_device *hid)
 --
 drivers/hid/usbhid/hid-core.c-413-
 drivers/hid/usbhid/hid-core.c:414:	r = usb_submit_urb(usbhid->urbctrl, GFP_ATOMIC);
 drivers/hid/usbhid/hid-core.c-415-	if (r < 0) {
 drivers/hid/usbhid/hid-core.c:416:		hid_err(hid, "usb_submit_urb(ctrl) failed: %d\n", r);
 drivers/hid/usbhid/hid-core.c-417-		return r;
 --
 drivers/hid/usbhid/usbkbd.c=100=static void usb_kbd_irq(struct urb *urb)
 --
 drivers/hid/usbhid/usbkbd.c-145-resubmit:
 drivers/hid/usbhid/usbkbd.c:146:	i = usb_submit_urb (urb, GFP_ATOMIC);
 drivers/hid/usbhid/usbkbd.c-147-	if (i)
 --
 drivers/hid/usbhid/usbkbd.c=153=static int usb_kbd_event(struct input_dev *dev, unsigned int type,
 --
 drivers/hid/usbhid/usbkbd.c-179-	kbd->led->dev = kbd->usbdev;
 drivers/hid/usbhid/usbkbd.c:180:	if (usb_submit_urb(kbd->led, GFP_ATOMIC))
 drivers/hid/usbhid/usbkbd.c:181:		pr_err("usb_submit_urb(leds) failed\n");
 drivers/hid/usbhid/usbkbd.c-182-	else
 --
 drivers/hid/usbhid/usbkbd.c=190=static void usb_kbd_led(struct urb *urb)
 --
 drivers/hid/usbhid/usbkbd.c-209-	kbd->led->dev = kbd->usbdev;
 drivers/hid/usbhid/usbkbd.c:210:	if (usb_submit_urb(kbd->led, GFP_ATOMIC)){
 drivers/hid/usbhid/usbkbd.c:211:		hid_err(urb->dev, "usb_submit_urb(leds) failed\n");
 drivers/hid/usbhid/usbkbd.c-212-		kbd->led_urb_submitted = false;
 --
 drivers/hid/usbhid/usbkbd.c=218=static int usb_kbd_open(struct input_dev *dev)
 --
 drivers/hid/usbhid/usbkbd.c-222-	kbd->irq->dev = kbd->usbdev;
 drivers/hid/usbhid/usbkbd.c:223:	if (usb_submit_urb(kbd->irq, GFP_KERNEL))
 drivers/hid/usbhid/usbkbd.c-224-		return -EIO;
 --
 drivers/hid/usbhid/usbmouse.c=49=static void usb_mouse_irq(struct urb *urb)
 --
 drivers/hid/usbhid/usbmouse.c-79-resubmit:
 drivers/hid/usbhid/usbmouse.c:80:	status = usb_submit_urb (urb, GFP_ATOMIC);
 drivers/hid/usbhid/usbmouse.c-81-	if (status)
 --
 drivers/hid/usbhid/usbmouse.c=88=static int usb_mouse_open(struct input_dev *dev)
 --
 drivers/hid/usbhid/usbmouse.c-92-	mouse->irq->dev = mouse->usbdev;
 drivers/hid/usbhid/usbmouse.c:93:	if (usb_submit_urb(mouse->irq, GFP_KERNEL))
 drivers/hid/usbhid/usbmouse.c-94-		return -EIO;
 --
 drivers/hwmon/powerz.c=96=static void powerz_usb_cmd_complete(struct urb *urb)
 --
 drivers/hwmon/powerz.c-104-
 drivers/hwmon/powerz.c:105:	priv->status = usb_submit_urb(urb, GFP_ATOMIC);
]
]

gemini-3.1-pro-preview

							input: 236472
							output: 23
							thoughts: 47
						

Okay, let's see... I'm looking at this code and something's immediately off. Where's `rtl_usb_start_rx`? That function name just isn't registering with me. Hmm, perhaps it's a typo, or maybe it's been deprecated.

Right, time to check the source code for the Realtek USB WiFi driver. I need to get to the bottom of this. I know where the driver is located, so let's navigate to `drivers/net/wireless/realtek/rtlwifi/usb.c`. I need to verify that `usb_submit_urb` is being called correctly. That seems to be the logical entry point for the USB function, from what I understand, and it has to be the most relevant call.

log-in to see details

map[Expression:usb_submit_urb.*rtlwifi]

map[Output:]

gemini-3.1-pro-preview

							input: 236723
							output: 32
							thoughts: 30
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Navigating the USB Network Device Driver Landscape**

Right, let me see... I'm looking at the code, and I need to track down how this USB network device is submitting its URBs. Okay, let's see, that's `usb_submit_urb`, that's the kernel function I'm after, and... ah, bingo. It looks like the Realtek RTLWiFi driver is doing that. Specifically, the function is located within `drivers/net/wireless/realtek/rtlwifi/usb.c`. That's not entirely surprising, but it's good to confirm it's in the USB-specific code. That helps narrow down the scope and, assuming the code hasn't been significantly refactored, the function within the driver that initiates USB transactions for Realtek's USB wireless devices. Now I can start tracing its execution path. I'll need to see how the URB is built and then how it's submitted for data transfer. It also gives me the module name that I need to look at if I need to run specific debuggers. Excellent.

log-in to see details

map[Expression:usb_submit_urb.*drivers/net/wireless/realtek/rtlwifi]

map[Output:]

gemini-3.1-pro-preview

							input: 237058
							output: 19
							thoughts: 30
						

Okay, here's my interpretation of that thought process, assuming I'm an expert in embedded systems/Linux kernel network drivers:

**USB Submissions in rtlwifi: Let's Check Those First**

Alright, before I dive too deep into the issue, let's take a focused approach. My immediate thought is to zero in on the USB side of things, specifically the Realtek wireless driver within the Linux kernel. I know that `rtlwifi` is the relevant module. Let's start with a specific function call that's crucial to USB communication – `usb_submit_urb`. This function is fundamental for submitting USB Request Blocks (URBs) for data transfer. I'll grep for that within the `drivers/net/wireless/realtek/rtlwifi/` directory. That seems like the most logical first step – checking the URB submissions and what's happening around that. Narrow focus first, then broader inspection.

map[Expression:usb_submit_urb]

map[Output:
Full output is too long, showing 500 out of 5329 lines.
Use more precise expression if possible.

[Documentation/driver-api/usb/URB.rst=24=called USB Request Block, or URB for short.
 --
 Documentation/driver-api/usb/URB.rst-29-- Execution of an URB is inherently an asynchronous operation, i.e. the
 Documentation/driver-api/usb/URB.rst:30:  :c:func:`usb_submit_urb` call returns immediately after it has successfully
 Documentation/driver-api/usb/URB.rst-31-  queued the requested action.
 --
 Documentation/driver-api/usb/URB.rst=134=How to submit an URB?
 --
 Documentation/driver-api/usb/URB.rst-136-
 Documentation/driver-api/usb/URB.rst:137:Just call :c:func:`usb_submit_urb`::
 Documentation/driver-api/usb/URB.rst-138-
 Documentation/driver-api/usb/URB.rst:139:	int usb_submit_urb(struct urb *urb, int mem_flags)
 Documentation/driver-api/usb/URB.rst-140-
 --
 Documentation/driver-api/usb/URB.rst=251=each packet you want to schedule.
 Documentation/driver-api/usb/URB.rst-252-
 Documentation/driver-api/usb/URB.rst:253:The :c:func:`usb_submit_urb` call modifies ``urb->interval`` to the implemented
 Documentation/driver-api/usb/URB.rst-254-interval value that is less than or equal to the requested interval value.  If
 --
 Documentation/driver-api/usb/URB.rst=281=You can use the :c:func:`usb_fill_int_urb` macro to fill INT transfer fields.
 Documentation/driver-api/usb/URB.rst-282-
 Documentation/driver-api/usb/URB.rst:283:The :c:func:`usb_submit_urb` call modifies ``urb->interval`` to the implemented
 Documentation/driver-api/usb/URB.rst-284-interval value that is less than or equal to the requested interval value.
 --
 Documentation/driver-api/usb/error-codes.rst=14=way certain faults are reported.
 --
 Documentation/driver-api/usb/error-codes.rst-16-
 Documentation/driver-api/usb/error-codes.rst:17:Error codes returned by :c:func:`usb_submit_urb`
 Documentation/driver-api/usb/error-codes.rst-18-================================================
 --
 Documentation/driver-api/usb/writing_usb_driver.rst=188=subsystem. This can be seen in the following code::
 --
 Documentation/driver-api/usb/writing_usb_driver.rst-205-    /* send the data out the bulk port */
 Documentation/driver-api/usb/writing_usb_driver.rst:206:    retval = usb_submit_urb(urb, GFP_KERNEL);
 Documentation/driver-api/usb/writing_usb_driver.rst-207-    if (retval) {
 --
 drivers/bluetooth/bcm203x.c=63=static void bcm203x_complete(struct urb *urb)
 --
 drivers/bluetooth/bcm203x.c-95-
 drivers/bluetooth/bcm203x.c:96:		if (usb_submit_urb(data->urb, GFP_ATOMIC) < 0)
 drivers/bluetooth/bcm203x.c-97-			BT_ERR("Can't submit URB");
 --
 drivers/bluetooth/bcm203x.c-123-
 drivers/bluetooth/bcm203x.c:124:		if (usb_submit_urb(data->urb, GFP_ATOMIC) < 0)
 drivers/bluetooth/bcm203x.c-125-			BT_ERR("Can't submit URB");
 --
 drivers/bluetooth/bcm203x.c=140=static void bcm203x_work(struct work_struct *work)
 --
 drivers/bluetooth/bcm203x.c-147-
 drivers/bluetooth/bcm203x.c:148:	if (usb_submit_urb(data->urb, GFP_KERNEL) < 0)
 drivers/bluetooth/bcm203x.c-149-		BT_ERR("Can't submit URB");
 --
 drivers/bluetooth/bfusb.c=111=static int bfusb_send_bulk(struct bfusb_data *data, struct sk_buff *skb)
 --
 drivers/bluetooth/bfusb.c-133-
 drivers/bluetooth/bfusb.c:134:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/bfusb.c-135-	if (err) {
 --
 drivers/bluetooth/bfusb.c=201=static int bfusb_rx_submit(struct bfusb_data *data, struct urb *urb)
 --
 drivers/bluetooth/bfusb.c-232-
 drivers/bluetooth/bfusb.c:233:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/bfusb.c-234-	if (err) {
 --
 drivers/bluetooth/bfusb.c=333=static void bfusb_rx_complete(struct urb *urb)
 --
 drivers/bluetooth/bfusb.c-389-
 drivers/bluetooth/bfusb.c:390:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/bfusb.c-391-	if (err) {
 --
 drivers/bluetooth/bpa10x.c=85=static void bpa10x_rx_complete(struct urb *urb)
 --
 drivers/bluetooth/bpa10x.c-113-
 drivers/bluetooth/bpa10x.c:114:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/bpa10x.c-115-	if (err < 0) {
 --
 drivers/bluetooth/bpa10x.c=121=static inline int bpa10x_submit_intr_urb(struct hci_dev *hdev)
 --
 drivers/bluetooth/bpa10x.c-149-
 drivers/bluetooth/bpa10x.c:150:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/bpa10x.c-151-	if (err < 0) {
 --
 drivers/bluetooth/bpa10x.c=161=static inline int bpa10x_submit_bulk_urb(struct hci_dev *hdev)
 --
 drivers/bluetooth/bpa10x.c-189-
 drivers/bluetooth/bpa10x.c:190:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/bpa10x.c-191-	if (err < 0) {
 --
 drivers/bluetooth/bpa10x.c=266=static int bpa10x_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
 --
 drivers/bluetooth/bpa10x.c-331-
 drivers/bluetooth/bpa10x.c:332:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/bpa10x.c-333-	if (err < 0) {
 --
 drivers/bluetooth/btmtk.c=486=static void btmtk_usb_wmt_recv(struct urb *urb)
 --
 drivers/bluetooth/btmtk.c-554-	usb_anchor_urb(urb, data->ctrl_anchor);
 drivers/bluetooth/btmtk.c:555:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btmtk.c-556-	if (err < 0) {
 --
 drivers/bluetooth/btmtk.c=568=static int btmtk_usb_submit_wmt_recv_urb(struct hci_dev *hdev)
 --
 drivers/bluetooth/btmtk.c-607-	usb_anchor_urb(urb, data->ctrl_anchor);
 drivers/bluetooth/btmtk.c:608:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/btmtk.c-609-	if (err < 0) {
 --
 drivers/bluetooth/btmtk.c=1150=static void btmtk_intr_complete(struct urb *urb)
 --
 drivers/bluetooth/btmtk.c-1180-
 drivers/bluetooth/btmtk.c:1181:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btmtk.c-1182-	if (err < 0) {
 --
 drivers/bluetooth/btmtk.c=1195=static int btmtk_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btmtk.c-1230-
 drivers/bluetooth/btmtk.c:1231:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btmtk.c-1232-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1456=static void btusb_intr_complete(struct urb *urb)
 --
 drivers/bluetooth/btusb.c-1486-
 drivers/bluetooth/btusb.c:1487:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-1488-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1501=static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btusb.c-1542-
 drivers/bluetooth/btusb.c:1543:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btusb.c-1544-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1580=static void btusb_bulk_complete(struct urb *urb)
 --
 drivers/bluetooth/btusb.c-1610-
 drivers/bluetooth/btusb.c:1611:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-1612-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1623=static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btusb.c-1655-
 drivers/bluetooth/btusb.c:1656:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btusb.c-1657-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1669=static void btusb_isoc_complete(struct urb *urb)
 --
 drivers/bluetooth/btusb.c-1706-
 drivers/bluetooth/btusb.c:1707:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-1708-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1783=static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btusb.c-1820-
 drivers/bluetooth/btusb.c:1821:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btusb.c-1822-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1834=static void btusb_diag_complete(struct urb *urb)
 --
 drivers/bluetooth/btusb.c-1862-
 drivers/bluetooth/btusb.c:1863:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-1864-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1875=static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btusb.c-1907-
 drivers/bluetooth/btusb.c:1908:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btusb.c-1909-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=2180=static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
 --
 drivers/bluetooth/btusb.c-2186-
 drivers/bluetooth/btusb.c:2187:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/btusb.c-2188-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=4528=static void play_deferred(struct btusb_data *data)
 --
 drivers/bluetooth/btusb.c-4535-
 drivers/bluetooth/btusb.c:4536:		err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-4537-		if (err < 0) {
 --
 drivers/char/xillybus/xillyusb.c=697=static void try_queue_bulk_in(struct xillyusb_endpoint *ep)
 --
 drivers/char/xillybus/xillyusb.c-737-
 drivers/char/xillybus/xillyusb.c:738:		rc = usb_submit_urb(urb, GFP_KERNEL);
 drivers/char/xillybus/xillyusb.c-739-
 --
 drivers/char/xillybus/xillyusb.c=763=static void try_queue_bulk_out(struct xillyusb_endpoint *ep)
 --
 drivers/char/xillybus/xillyusb.c-841-
 drivers/char/xillybus/xillyusb.c:842:		rc = usb_submit_urb(urb, GFP_KERNEL);
 drivers/char/xillybus/xillyusb.c-843-
 --
 drivers/comedi/drivers/usbdux.c=238=static void usbduxsub_ai_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbdux.c-273-		urb->dev = comedi_to_usb_dev(dev);
 drivers/comedi/drivers/usbdux.c:274:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-275-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbdux.c=366=static void usbduxsub_ao_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbdux.c-420-		urb->iso_frame_desc[0].status = 0;
 drivers/comedi/drivers/usbdux.c:421:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-422-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbdux.c=477=static int usbdux_submit_urbs(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbdux.c-498-
 drivers/comedi/drivers/usbdux.c:499:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-500-		if (ret)
 --
 drivers/comedi/drivers/usbdux.c=1149=static void usbduxsub_pwm_irq(struct urb *urb)
 --
 drivers/comedi/drivers/usbdux.c-1191-	if (devpriv->pwm_cmd_running) {
 drivers/comedi/drivers/usbdux.c:1192:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-1193-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbdux.c=1207=static int usbduxsub_submit_pwm_urbs(struct comedi_device *dev)
 --
 drivers/comedi/drivers/usbdux.c-1219-
 drivers/comedi/drivers/usbdux.c:1220:	return usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-1221-}
 --
 drivers/comedi/drivers/usbduxfast.c=223=static void usbduxfast_ai_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbduxfast.c-249-		urb->status = 0;
 drivers/comedi/drivers/usbduxfast.c:250:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxfast.c-251-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbduxfast.c=301=static int usbduxfast_submit_urb(struct comedi_device *dev)
 --
 drivers/comedi/drivers/usbduxfast.c-310-
 drivers/comedi/drivers/usbduxfast.c:311:	ret = usb_submit_urb(devpriv->urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxfast.c-312-	if (ret) {
 drivers/comedi/drivers/usbduxfast.c:313:		dev_err(dev->class_dev, "usb_submit_urb error %d\n", ret);
 drivers/comedi/drivers/usbduxfast.c-314-		return ret;
 --
 drivers/comedi/drivers/usbduxsigma.c=200=static void usbduxsigma_ai_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbduxsigma.c-236-		urb->dev = comedi_to_usb_dev(dev);
 drivers/comedi/drivers/usbduxsigma.c:237:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-238-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbduxsigma.c=326=static void usbduxsigma_ao_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbduxsigma.c-375-		urb->iso_frame_desc[0].status = 0;
 drivers/comedi/drivers/usbduxsigma.c:376:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-377-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbduxsigma.c=430=static int usbduxsigma_submit_urbs(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbduxsigma.c-450-
 drivers/comedi/drivers/usbduxsigma.c:451:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-452-		if (ret)
 --
 drivers/comedi/drivers/usbduxsigma.c=1011=static void usbduxsigma_pwm_urb_complete(struct urb *urb)
 --
 drivers/comedi/drivers/usbduxsigma.c-1046-	urb->status = 0;
 drivers/comedi/drivers/usbduxsigma.c:1047:	ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-1048-	if (ret < 0) {
 --
 drivers/comedi/drivers/usbduxsigma.c=1057=static int usbduxsigma_submit_pwm_urb(struct comedi_device *dev)
 --
 drivers/comedi/drivers/usbduxsigma.c-1067-
 drivers/comedi/drivers/usbduxsigma.c:1068:	return usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-1069-}
 --
 drivers/gnss/usb.c=33=static void gnss_usb_rx_complete(struct urb *urb)
 --
 drivers/gnss/usb.c-64-resubmit:
 drivers/gnss/usb.c:65:	ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/gnss/usb.c-66-	if (ret && ret != -EPERM && ret != -ENODEV)
 --
 drivers/gnss/usb.c=70=static int gnss_usb_open(struct gnss_device *gdev)
 --
 drivers/gnss/usb.c-74-
 drivers/gnss/usb.c:75:	ret = usb_submit_urb(gusb->read_urb, GFP_KERNEL);
 drivers/gnss/usb.c-76-	if (ret) {
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=50=static int agilent_82357a_send_bulk_msg(struct agilent_82357a_priv *a_priv, void *data,
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-85-
 drivers/gpib/agilent_82357a/agilent_82357a.c:86:	retval = usb_submit_urb(a_priv->bulk_urb, GFP_KERNEL);
 drivers/gpib/agilent_82357a/agilent_82357a.c-87-	if (retval) {
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=118=static int agilent_82357a_receive_bulk_msg(struct agilent_82357a_priv *a_priv, void *data,
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-153-
 drivers/gpib/agilent_82357a/agilent_82357a.c:154:	retval = usb_submit_urb(a_priv->bulk_urb, GFP_KERNEL);
 drivers/gpib/agilent_82357a/agilent_82357a.c-155-	if (retval) {
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=1091=static void agilent_82357a_interrupt_complete(struct urb *urb)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-1109-	default: /* other error, resubmit */
 drivers/gpib/agilent_82357a/agilent_82357a.c:1110:		retval = usb_submit_urb(a_priv->interrupt_urb, GFP_ATOMIC);
 drivers/gpib/agilent_82357a/agilent_82357a.c-1111-		if (retval)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-1125-
 drivers/gpib/agilent_82357a/agilent_82357a.c:1126:	retval = usb_submit_urb(a_priv->interrupt_urb, GFP_ATOMIC);
 drivers/gpib/agilent_82357a/agilent_82357a.c-1127-	if (retval)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=1131=static int agilent_82357a_setup_urbs(struct gpib_board *board)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-1159-			 INTERRUPT_BUF_LEN, &agilent_82357a_interrupt_complete, board, 1);
 drivers/gpib/agilent_82357a/agilent_82357a.c:1160:	retval = usb_submit_urb(a_priv->interrupt_urb, GFP_KERNEL);
 drivers/gpib/agilent_82357a/agilent_82357a.c-1161-	if (retval) {
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=1586=static int agilent_82357a_driver_resume(struct usb_interface *interface)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-1610-			mutex_lock(&a_priv->interrupt_alloc_lock);
 drivers/gpib/agilent_82357a/agilent_82357a.c:1611:			retval = usb_submit_urb(a_priv->interrupt_urb, GFP_KERNEL);
 drivers/gpib/agilent_82357a/agilent_82357a.c-1612-			if (retval) {
 --
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c=1369=static int lpvo_do_read_io(struct lpvo *dev, size_t count)
 --
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c-1391-	/* do it */
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c:1392:	rv = usb_submit_urb(dev->bulk_in_urb, GFP_KERNEL);
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c-1393-	if (rv < 0) {
 --
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c=1586=static ssize_t lpvo_do_write(struct lpvo *dev, const char *buffer, size_t count)
 --
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c-1658-	/* send the data out the bulk port */
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c:1659:	retval = usb_submit_urb(urb, GFP_KERNEL);
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c-1660-	mutex_unlock(&dev->io_mutex);
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=105=static int ni_usb_nonblocking_send_bulk_msg(struct ni_usb_priv *ni_priv, void *data,
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-138-
 drivers/gpib/ni_usb/ni_usb_gpib.c:139:	retval = usb_submit_urb(ni_priv->bulk_urb, GFP_KERNEL);
 drivers/gpib/ni_usb/ni_usb_gpib.c-140-	if (retval) {
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=190=static int ni_usb_nonblocking_receive_bulk_msg(struct ni_usb_priv *ni_priv,
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-224-
 drivers/gpib/ni_usb/ni_usb_gpib.c:225:	retval = usb_submit_urb(ni_priv->bulk_urb, GFP_KERNEL);
 drivers/gpib/ni_usb/ni_usb_gpib.c-226-	if (retval) {
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=1816=static void ni_usb_interrupt_complete(struct urb *urb)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-1834-	default: /* other error, resubmit */
 drivers/gpib/ni_usb/ni_usb_gpib.c:1835:		retval = usb_submit_urb(ni_priv->interrupt_urb, GFP_ATOMIC);
 drivers/gpib/ni_usb/ni_usb_gpib.c-1836-		if (retval)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-1848-
 drivers/gpib/ni_usb/ni_usb_gpib.c:1849:	retval = usb_submit_urb(ni_priv->interrupt_urb, GFP_ATOMIC);
 drivers/gpib/ni_usb/ni_usb_gpib.c-1850-	if (retval)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=1885=static int ni_usb_setup_urbs(struct gpib_board *board)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-1908-			 sizeof(ni_priv->interrupt_buffer), &ni_usb_interrupt_complete, board, 1);
 drivers/gpib/ni_usb/ni_usb_gpib.c:1909:	retval = usb_submit_urb(ni_priv->interrupt_urb, GFP_KERNEL);
 drivers/gpib/ni_usb/ni_usb_gpib.c-1910-	mutex_unlock(&ni_priv->interrupt_transfer_lock);
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=2534=static int ni_usb_driver_resume(struct usb_interface *interface)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-2559-			mutex_lock(&ni_priv->interrupt_transfer_lock);
 drivers/gpib/ni_usb/ni_usb_gpib.c:2560:			retval = usb_submit_urb(ni_priv->interrupt_urb, GFP_KERNEL);
 drivers/gpib/ni_usb/ni_usb_gpib.c-2561-			if (retval) {
 --
 drivers/gpu/drm/udl/udl_main.c=298=int udl_submit_urb(struct udl_device *udl, struct urb *urb, size_t len)
 --
 drivers/gpu/drm/udl/udl_main.c-306-	urb->transfer_buffer_length = len; /* set to actual payload len */
 drivers/gpu/drm/udl/udl_main.c:307:	ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/gpu/drm/udl/udl_main.c-308- error:
 --
 drivers/gpu/drm/udl/udl_main.c-310-		udl_urb_completion(urb); /* because no one else will */
 drivers/gpu/drm/udl/udl_main.c:311:		DRM_ERROR("usb_submit_urb error %x\n", ret);
 drivers/gpu/drm/udl/udl_main.c-312-	}
 --
 drivers/greybus/es2.c=179=static int output_async(struct es2_ap_dev *es2, void *req, u16 size, u8 cmd)
 --
 drivers/greybus/es2.c-208-			     ap_urb_complete, dr);
 drivers/greybus/es2.c:209:	retval = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/greybus/es2.c-210-	if (retval) {
 --
 drivers/greybus/es2.c=228=static int es2_cport_in_enable(struct es2_ap_dev *es2,
 --
 drivers/greybus/es2.c-237-
 drivers/greybus/es2.c:238:		ret = usb_submit_urb(urb, GFP_KERNEL);
 drivers/greybus/es2.c-239-		if (ret) {
 --
 drivers/greybus/es2.c=269=static int es2_arpc_in_enable(struct es2_ap_dev *es2)
 --
 drivers/greybus/es2.c-277-
 drivers/greybus/es2.c:278:		ret = usb_submit_urb(urb, GFP_KERNEL);
 drivers/greybus/es2.c-279-		if (ret) {
 --
 drivers/greybus/es2.c=390=static int message_send(struct gb_host_device *hd, u16 cport_id,
 --
 drivers/greybus/es2.c-432-
 drivers/greybus/es2.c:433:	retval = usb_submit_urb(urb, gfp_mask);
 drivers/greybus/es2.c-434-	if (retval) {
 --
 drivers/greybus/es2.c=809=static void cport_in_callback(struct urb *urb)
 --
 drivers/greybus/es2.c-846-	/* put our urb back in the request pool */
 drivers/greybus/es2.c:847:	retval = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/greybus/es2.c-848-	if (retval)
 --
 drivers/greybus/es2.c=1020=static void arpc_in_callback(struct urb *urb)
 --
 drivers/greybus/es2.c-1063-	/* put our urb back in the request pool */
 drivers/greybus/es2.c:1064:	retval = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/greybus/es2.c-1065-	if (retval)
 --
 drivers/hid/hid-sony.c=594=static void ghl_magic_poke(struct timer_list *t)
 --
 drivers/hid/hid-sony.c-598-
 drivers/hid/hid-sony.c:599:	ret = usb_submit_urb(sc->ghl_urb, GFP_ATOMIC);
 drivers/hid/hid-sony.c-600-	if (ret < 0)
 drivers/hid/hid-sony.c:601:		hid_err(sc->hdev, "usb_submit_urb failed: %d", ret);
 drivers/hid/hid-sony.c-602-}
 --
 drivers/hid/hid-thrustmaster.c=220=static void thrustmaster_model_handler(struct urb *urb)
 --
 drivers/hid/hid-thrustmaster.c-263-
 drivers/hid/hid-thrustmaster.c:264:	ret = usb_submit_urb(tm_wheel->urb, GFP_ATOMIC);
 drivers/hid/hid-thrustmaster.c-265-	if (ret)
 --
 drivers/hid/hid-thrustmaster.c=290=static int thrustmaster_probe(struct hid_device *hdev, const struct hid_device_id *id)
 --
 drivers/hid/hid-thrustmaster.c-360-
 drivers/hid/hid-thrustmaster.c:361:	ret = usb_submit_urb(tm_wheel->urb, GFP_ATOMIC);
 drivers/hid/hid-thrustmaster.c-362-	if (ret) {
 --
 drivers/hid/hid-u2fzero.c=125=static int u2fzero_recv(struct u2fzero_device *dev,
 --
 drivers/hid/hid-u2fzero.c-139-
 drivers/hid/hid-u2fzero.c:140:	ret = usb_submit_urb(dev->urb, GFP_NOIO);
 drivers/hid/hid-u2fzero.c-141-	if (unlikely(ret)) {
 drivers/hid/hid-u2fzero.c:142:		hid_err(hdev, "usb_submit_urb failed: %d", ret);
 drivers/hid/hid-u2fzero.c-143-		goto err;
 --
 drivers/hid/usbhid/hid-core.c=82=static int hid_start_in(struct hid_device *hid)
 --
 drivers/hid/usbhid/hid-core.c-92-	    !test_and_set_bit(HID_IN_RUNNING, &usbhid->iofl)) {
 drivers/hid/usbhid/hid-core.c:93:		rc = usb_submit_urb(usbhid->urbin, GFP_ATOMIC);
 drivers/hid/usbhid/hid-core.c-94-		if (rc != 0) {
 --
 drivers/hid/usbhid/hid-core.c=273=static void hid_irq_in(struct urb *urb)
 --
 drivers/hid/usbhid/hid-core.c-323-
 drivers/hid/usbhid/hid-core.c:324:	status = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/hid/usbhid/hid-core.c-325-	if (status) {
 --
 drivers/hid/usbhid/hid-core.c=337=static int hid_submit_out(struct hid_device *hid)
 --
 drivers/hid/usbhid/hid-core.c-357-
 drivers/hid/usbhid/hid-core.c:358:	r = usb_submit_urb(usbhid->urbout, GFP_ATOMIC);
 drivers/hid/usbhid/hid-core.c-359-	if (r < 0) {
 drivers/hid/usbhid/hid-core.c:360:		hid_err(hid, "usb_submit_urb(out) failed: %d\n", r);
 drivers/hid/usbhid/hid-core.c-361-		return r;
 --
 drivers/hid/usbhid/hid-core.c=367=static int hid_submit_ctrl(struct hid_device *hid)
 --
 drivers/hid/usbhid/hid-core.c-413-
 drivers/hid/usbhid/hid-core.c:414:	r = usb_submit_urb(usbhid->urbctrl, GFP_ATOMIC);
 drivers/hid/usbhid/hid-core.c-415-	if (r < 0) {
 drivers/hid/usbhid/hid-core.c:416:		hid_err(hid, "usb_submit_urb(ctrl) failed: %d\n", r);
 drivers/hid/usbhid/hid-core.c-417-		return r;
 --
 drivers/hid/usbhid/usbkbd.c=100=static void usb_kbd_irq(struct urb *urb)
 --
 drivers/hid/usbhid/usbkbd.c-145-resubmit:
 drivers/hid/usbhid/usbkbd.c:146:	i = usb_submit_urb (urb, GFP_ATOMIC);
 drivers/hid/usbhid/usbkbd.c-147-	if (i)
 --
 drivers/hid/usbhid/usbkbd.c=153=static int usb_kbd_event(struct input_dev *dev, unsigned int type,
 --
 drivers/hid/usbhid/usbkbd.c-179-	kbd->led->dev = kbd->usbdev;
 drivers/hid/usbhid/usbkbd.c:180:	if (usb_submit_urb(kbd->led, GFP_ATOMIC))
 drivers/hid/usbhid/usbkbd.c:181:		pr_err("usb_submit_urb(leds) failed\n");
 drivers/hid/usbhid/usbkbd.c-182-	else
 --
 drivers/hid/usbhid/usbkbd.c=190=static void usb_kbd_led(struct urb *urb)
 --
 drivers/hid/usbhid/usbkbd.c-209-	kbd->led->dev = kbd->usbdev;
 drivers/hid/usbhid/usbkbd.c:210:	if (usb_submit_urb(kbd->led, GFP_ATOMIC)){
 drivers/hid/usbhid/usbkbd.c:211:		hid_err(urb->dev, "usb_submit_urb(leds) failed\n");
 drivers/hid/usbhid/usbkbd.c-212-		kbd->led_urb_submitted = false;
 --
 drivers/hid/usbhid/usbkbd.c=218=static int usb_kbd_open(struct input_dev *dev)
 --
 drivers/hid/usbhid/usbkbd.c-222-	kbd->irq->dev = kbd->usbdev;
 drivers/hid/usbhid/usbkbd.c:223:	if (usb_submit_urb(kbd->irq, GFP_KERNEL))
 drivers/hid/usbhid/usbkbd.c-224-		return -EIO;
 --
 drivers/hid/usbhid/usbmouse.c=49=static void usb_mouse_irq(struct urb *urb)
 --
 drivers/hid/usbhid/usbmouse.c-79-resubmit:
 drivers/hid/usbhid/usbmouse.c:80:	status = usb_submit_urb (urb, GFP_ATOMIC);
 drivers/hid/usbhid/usbmouse.c-81-	if (status)
 --
 drivers/hid/usbhid/usbmouse.c=88=static int usb_mouse_open(struct input_dev *dev)
 --
 drivers/hid/usbhid/usbmouse.c-92-	mouse->irq->dev = mouse->usbdev;
 drivers/hid/usbhid/usbmouse.c:93:	if (usb_submit_urb(mouse->irq, GFP_KERNEL))
 drivers/hid/usbhid/usbmouse.c-94-		return -EIO;
 --
 drivers/hwmon/powerz.c=96=static void powerz_usb_cmd_complete(struct urb *urb)
 --
 drivers/hwmon/powerz.c-104-
 drivers/hwmon/powerz.c:105:	priv->status = usb_submit_urb(urb, GFP_ATOMIC);
]
]

gemini-3.1-pro-preview

							input: 248255
							output: 36
							thoughts: 65
						

Here's my take on those thoughts:

**Investigating the RTL-SDR USB Receive Initialization**

Okay, hold on a second. I was under the impression that `rtl_usb_start_rx` was a standard function, but it's not showing up. That's a bit odd. It makes me wonder if I'm barking up the wrong tree entirely, and it's not the primary entry point for USB receive operations. Perhaps `_rtl_usb_init_rx` isn't the only function at play here.

Right, I'm going to shift gears. Let's delve into `drivers/net/wireless/realtek/rtlwifi/usb.c`. That's where the realtek USB driver logic is going to reside, and `usb_submit_urb` is a common kernel function for submitting URBs – it's practically the heartbeat of USB communication in the kernel space. I'll bet I can find what I need in there. Time to dig in and see what's actually going on in that driver.

log-in to see details

map[Expression:usb_submit_urb.*drivers/net/wireless/realtek/rtlwifi/usb.c]

map[Output:]

gemini-3.1-pro-preview

							input: 248596
							output: 20
							thoughts: 18
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Grep Frustration and Git Awareness**

Right, let's see. This `grep` expression... it's just not hitting the mark. This is an all-too-familiar feeling of the wrong tool for the job. Honestly, I should've realized this sooner, given the context. I'm working in a Git repository, and it's practically screaming at me to use `git grep` instead. The pathing is the killer; regular `grep` just doesn't know the repository context as well. It's causing me to lose time, as usual! This is a simple mistake, but one I need to be more conscious of in the future. Better to be efficient at the start, than to scramble at the finish.

map[Expression:usb_submit_urb.*]

map[Output:
Full output is too long, showing 500 out of 5329 lines.
Use more precise expression if possible.

[Documentation/driver-api/usb/URB.rst=24=called USB Request Block, or URB for short.
 --
 Documentation/driver-api/usb/URB.rst-29-- Execution of an URB is inherently an asynchronous operation, i.e. the
 Documentation/driver-api/usb/URB.rst:30:  :c:func:`usb_submit_urb` call returns immediately after it has successfully
 Documentation/driver-api/usb/URB.rst-31-  queued the requested action.
 --
 Documentation/driver-api/usb/URB.rst=134=How to submit an URB?
 --
 Documentation/driver-api/usb/URB.rst-136-
 Documentation/driver-api/usb/URB.rst:137:Just call :c:func:`usb_submit_urb`::
 Documentation/driver-api/usb/URB.rst-138-
 Documentation/driver-api/usb/URB.rst:139:	int usb_submit_urb(struct urb *urb, int mem_flags)
 Documentation/driver-api/usb/URB.rst-140-
 --
 Documentation/driver-api/usb/URB.rst=251=each packet you want to schedule.
 Documentation/driver-api/usb/URB.rst-252-
 Documentation/driver-api/usb/URB.rst:253:The :c:func:`usb_submit_urb` call modifies ``urb->interval`` to the implemented
 Documentation/driver-api/usb/URB.rst-254-interval value that is less than or equal to the requested interval value.  If
 --
 Documentation/driver-api/usb/URB.rst=281=You can use the :c:func:`usb_fill_int_urb` macro to fill INT transfer fields.
 Documentation/driver-api/usb/URB.rst-282-
 Documentation/driver-api/usb/URB.rst:283:The :c:func:`usb_submit_urb` call modifies ``urb->interval`` to the implemented
 Documentation/driver-api/usb/URB.rst-284-interval value that is less than or equal to the requested interval value.
 --
 Documentation/driver-api/usb/error-codes.rst=14=way certain faults are reported.
 --
 Documentation/driver-api/usb/error-codes.rst-16-
 Documentation/driver-api/usb/error-codes.rst:17:Error codes returned by :c:func:`usb_submit_urb`
 Documentation/driver-api/usb/error-codes.rst-18-================================================
 --
 Documentation/driver-api/usb/writing_usb_driver.rst=188=subsystem. This can be seen in the following code::
 --
 Documentation/driver-api/usb/writing_usb_driver.rst-205-    /* send the data out the bulk port */
 Documentation/driver-api/usb/writing_usb_driver.rst:206:    retval = usb_submit_urb(urb, GFP_KERNEL);
 Documentation/driver-api/usb/writing_usb_driver.rst-207-    if (retval) {
 --
 drivers/bluetooth/bcm203x.c=63=static void bcm203x_complete(struct urb *urb)
 --
 drivers/bluetooth/bcm203x.c-95-
 drivers/bluetooth/bcm203x.c:96:		if (usb_submit_urb(data->urb, GFP_ATOMIC) < 0)
 drivers/bluetooth/bcm203x.c-97-			BT_ERR("Can't submit URB");
 --
 drivers/bluetooth/bcm203x.c-123-
 drivers/bluetooth/bcm203x.c:124:		if (usb_submit_urb(data->urb, GFP_ATOMIC) < 0)
 drivers/bluetooth/bcm203x.c-125-			BT_ERR("Can't submit URB");
 --
 drivers/bluetooth/bcm203x.c=140=static void bcm203x_work(struct work_struct *work)
 --
 drivers/bluetooth/bcm203x.c-147-
 drivers/bluetooth/bcm203x.c:148:	if (usb_submit_urb(data->urb, GFP_KERNEL) < 0)
 drivers/bluetooth/bcm203x.c-149-		BT_ERR("Can't submit URB");
 --
 drivers/bluetooth/bfusb.c=111=static int bfusb_send_bulk(struct bfusb_data *data, struct sk_buff *skb)
 --
 drivers/bluetooth/bfusb.c-133-
 drivers/bluetooth/bfusb.c:134:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/bfusb.c-135-	if (err) {
 --
 drivers/bluetooth/bfusb.c=201=static int bfusb_rx_submit(struct bfusb_data *data, struct urb *urb)
 --
 drivers/bluetooth/bfusb.c-232-
 drivers/bluetooth/bfusb.c:233:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/bfusb.c-234-	if (err) {
 --
 drivers/bluetooth/bfusb.c=333=static void bfusb_rx_complete(struct urb *urb)
 --
 drivers/bluetooth/bfusb.c-389-
 drivers/bluetooth/bfusb.c:390:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/bfusb.c-391-	if (err) {
 --
 drivers/bluetooth/bpa10x.c=85=static void bpa10x_rx_complete(struct urb *urb)
 --
 drivers/bluetooth/bpa10x.c-113-
 drivers/bluetooth/bpa10x.c:114:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/bpa10x.c-115-	if (err < 0) {
 --
 drivers/bluetooth/bpa10x.c=121=static inline int bpa10x_submit_intr_urb(struct hci_dev *hdev)
 --
 drivers/bluetooth/bpa10x.c-149-
 drivers/bluetooth/bpa10x.c:150:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/bpa10x.c-151-	if (err < 0) {
 --
 drivers/bluetooth/bpa10x.c=161=static inline int bpa10x_submit_bulk_urb(struct hci_dev *hdev)
 --
 drivers/bluetooth/bpa10x.c-189-
 drivers/bluetooth/bpa10x.c:190:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/bpa10x.c-191-	if (err < 0) {
 --
 drivers/bluetooth/bpa10x.c=266=static int bpa10x_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
 --
 drivers/bluetooth/bpa10x.c-331-
 drivers/bluetooth/bpa10x.c:332:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/bpa10x.c-333-	if (err < 0) {
 --
 drivers/bluetooth/btmtk.c=486=static void btmtk_usb_wmt_recv(struct urb *urb)
 --
 drivers/bluetooth/btmtk.c-554-	usb_anchor_urb(urb, data->ctrl_anchor);
 drivers/bluetooth/btmtk.c:555:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btmtk.c-556-	if (err < 0) {
 --
 drivers/bluetooth/btmtk.c=568=static int btmtk_usb_submit_wmt_recv_urb(struct hci_dev *hdev)
 --
 drivers/bluetooth/btmtk.c-607-	usb_anchor_urb(urb, data->ctrl_anchor);
 drivers/bluetooth/btmtk.c:608:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/btmtk.c-609-	if (err < 0) {
 --
 drivers/bluetooth/btmtk.c=1150=static void btmtk_intr_complete(struct urb *urb)
 --
 drivers/bluetooth/btmtk.c-1180-
 drivers/bluetooth/btmtk.c:1181:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btmtk.c-1182-	if (err < 0) {
 --
 drivers/bluetooth/btmtk.c=1195=static int btmtk_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btmtk.c-1230-
 drivers/bluetooth/btmtk.c:1231:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btmtk.c-1232-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1456=static void btusb_intr_complete(struct urb *urb)
 --
 drivers/bluetooth/btusb.c-1486-
 drivers/bluetooth/btusb.c:1487:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-1488-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1501=static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btusb.c-1542-
 drivers/bluetooth/btusb.c:1543:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btusb.c-1544-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1580=static void btusb_bulk_complete(struct urb *urb)
 --
 drivers/bluetooth/btusb.c-1610-
 drivers/bluetooth/btusb.c:1611:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-1612-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1623=static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btusb.c-1655-
 drivers/bluetooth/btusb.c:1656:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btusb.c-1657-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1669=static void btusb_isoc_complete(struct urb *urb)
 --
 drivers/bluetooth/btusb.c-1706-
 drivers/bluetooth/btusb.c:1707:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-1708-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1783=static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btusb.c-1820-
 drivers/bluetooth/btusb.c:1821:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btusb.c-1822-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1834=static void btusb_diag_complete(struct urb *urb)
 --
 drivers/bluetooth/btusb.c-1862-
 drivers/bluetooth/btusb.c:1863:	err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-1864-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=1875=static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags)
 --
 drivers/bluetooth/btusb.c-1907-
 drivers/bluetooth/btusb.c:1908:	err = usb_submit_urb(urb, mem_flags);
 drivers/bluetooth/btusb.c-1909-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=2180=static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
 --
 drivers/bluetooth/btusb.c-2186-
 drivers/bluetooth/btusb.c:2187:	err = usb_submit_urb(urb, GFP_KERNEL);
 drivers/bluetooth/btusb.c-2188-	if (err < 0) {
 --
 drivers/bluetooth/btusb.c=4528=static void play_deferred(struct btusb_data *data)
 --
 drivers/bluetooth/btusb.c-4535-
 drivers/bluetooth/btusb.c:4536:		err = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/bluetooth/btusb.c-4537-		if (err < 0) {
 --
 drivers/char/xillybus/xillyusb.c=697=static void try_queue_bulk_in(struct xillyusb_endpoint *ep)
 --
 drivers/char/xillybus/xillyusb.c-737-
 drivers/char/xillybus/xillyusb.c:738:		rc = usb_submit_urb(urb, GFP_KERNEL);
 drivers/char/xillybus/xillyusb.c-739-
 --
 drivers/char/xillybus/xillyusb.c=763=static void try_queue_bulk_out(struct xillyusb_endpoint *ep)
 --
 drivers/char/xillybus/xillyusb.c-841-
 drivers/char/xillybus/xillyusb.c:842:		rc = usb_submit_urb(urb, GFP_KERNEL);
 drivers/char/xillybus/xillyusb.c-843-
 --
 drivers/comedi/drivers/usbdux.c=238=static void usbduxsub_ai_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbdux.c-273-		urb->dev = comedi_to_usb_dev(dev);
 drivers/comedi/drivers/usbdux.c:274:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-275-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbdux.c=366=static void usbduxsub_ao_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbdux.c-420-		urb->iso_frame_desc[0].status = 0;
 drivers/comedi/drivers/usbdux.c:421:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-422-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbdux.c=477=static int usbdux_submit_urbs(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbdux.c-498-
 drivers/comedi/drivers/usbdux.c:499:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-500-		if (ret)
 --
 drivers/comedi/drivers/usbdux.c=1149=static void usbduxsub_pwm_irq(struct urb *urb)
 --
 drivers/comedi/drivers/usbdux.c-1191-	if (devpriv->pwm_cmd_running) {
 drivers/comedi/drivers/usbdux.c:1192:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-1193-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbdux.c=1207=static int usbduxsub_submit_pwm_urbs(struct comedi_device *dev)
 --
 drivers/comedi/drivers/usbdux.c-1219-
 drivers/comedi/drivers/usbdux.c:1220:	return usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbdux.c-1221-}
 --
 drivers/comedi/drivers/usbduxfast.c=223=static void usbduxfast_ai_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbduxfast.c-249-		urb->status = 0;
 drivers/comedi/drivers/usbduxfast.c:250:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxfast.c-251-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbduxfast.c=301=static int usbduxfast_submit_urb(struct comedi_device *dev)
 --
 drivers/comedi/drivers/usbduxfast.c-310-
 drivers/comedi/drivers/usbduxfast.c:311:	ret = usb_submit_urb(devpriv->urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxfast.c-312-	if (ret) {
 drivers/comedi/drivers/usbduxfast.c:313:		dev_err(dev->class_dev, "usb_submit_urb error %d\n", ret);
 drivers/comedi/drivers/usbduxfast.c-314-		return ret;
 --
 drivers/comedi/drivers/usbduxsigma.c=200=static void usbduxsigma_ai_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbduxsigma.c-236-		urb->dev = comedi_to_usb_dev(dev);
 drivers/comedi/drivers/usbduxsigma.c:237:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-238-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbduxsigma.c=326=static void usbduxsigma_ao_handle_urb(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbduxsigma.c-375-		urb->iso_frame_desc[0].status = 0;
 drivers/comedi/drivers/usbduxsigma.c:376:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-377-		if (ret < 0) {
 --
 drivers/comedi/drivers/usbduxsigma.c=430=static int usbduxsigma_submit_urbs(struct comedi_device *dev,
 --
 drivers/comedi/drivers/usbduxsigma.c-450-
 drivers/comedi/drivers/usbduxsigma.c:451:		ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-452-		if (ret)
 --
 drivers/comedi/drivers/usbduxsigma.c=1011=static void usbduxsigma_pwm_urb_complete(struct urb *urb)
 --
 drivers/comedi/drivers/usbduxsigma.c-1046-	urb->status = 0;
 drivers/comedi/drivers/usbduxsigma.c:1047:	ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-1048-	if (ret < 0) {
 --
 drivers/comedi/drivers/usbduxsigma.c=1057=static int usbduxsigma_submit_pwm_urb(struct comedi_device *dev)
 --
 drivers/comedi/drivers/usbduxsigma.c-1067-
 drivers/comedi/drivers/usbduxsigma.c:1068:	return usb_submit_urb(urb, GFP_ATOMIC);
 drivers/comedi/drivers/usbduxsigma.c-1069-}
 --
 drivers/gnss/usb.c=33=static void gnss_usb_rx_complete(struct urb *urb)
 --
 drivers/gnss/usb.c-64-resubmit:
 drivers/gnss/usb.c:65:	ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/gnss/usb.c-66-	if (ret && ret != -EPERM && ret != -ENODEV)
 --
 drivers/gnss/usb.c=70=static int gnss_usb_open(struct gnss_device *gdev)
 --
 drivers/gnss/usb.c-74-
 drivers/gnss/usb.c:75:	ret = usb_submit_urb(gusb->read_urb, GFP_KERNEL);
 drivers/gnss/usb.c-76-	if (ret) {
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=50=static int agilent_82357a_send_bulk_msg(struct agilent_82357a_priv *a_priv, void *data,
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-85-
 drivers/gpib/agilent_82357a/agilent_82357a.c:86:	retval = usb_submit_urb(a_priv->bulk_urb, GFP_KERNEL);
 drivers/gpib/agilent_82357a/agilent_82357a.c-87-	if (retval) {
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=118=static int agilent_82357a_receive_bulk_msg(struct agilent_82357a_priv *a_priv, void *data,
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-153-
 drivers/gpib/agilent_82357a/agilent_82357a.c:154:	retval = usb_submit_urb(a_priv->bulk_urb, GFP_KERNEL);
 drivers/gpib/agilent_82357a/agilent_82357a.c-155-	if (retval) {
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=1091=static void agilent_82357a_interrupt_complete(struct urb *urb)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-1109-	default: /* other error, resubmit */
 drivers/gpib/agilent_82357a/agilent_82357a.c:1110:		retval = usb_submit_urb(a_priv->interrupt_urb, GFP_ATOMIC);
 drivers/gpib/agilent_82357a/agilent_82357a.c-1111-		if (retval)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-1125-
 drivers/gpib/agilent_82357a/agilent_82357a.c:1126:	retval = usb_submit_urb(a_priv->interrupt_urb, GFP_ATOMIC);
 drivers/gpib/agilent_82357a/agilent_82357a.c-1127-	if (retval)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=1131=static int agilent_82357a_setup_urbs(struct gpib_board *board)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-1159-			 INTERRUPT_BUF_LEN, &agilent_82357a_interrupt_complete, board, 1);
 drivers/gpib/agilent_82357a/agilent_82357a.c:1160:	retval = usb_submit_urb(a_priv->interrupt_urb, GFP_KERNEL);
 drivers/gpib/agilent_82357a/agilent_82357a.c-1161-	if (retval) {
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c=1586=static int agilent_82357a_driver_resume(struct usb_interface *interface)
 --
 drivers/gpib/agilent_82357a/agilent_82357a.c-1610-			mutex_lock(&a_priv->interrupt_alloc_lock);
 drivers/gpib/agilent_82357a/agilent_82357a.c:1611:			retval = usb_submit_urb(a_priv->interrupt_urb, GFP_KERNEL);
 drivers/gpib/agilent_82357a/agilent_82357a.c-1612-			if (retval) {
 --
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c=1369=static int lpvo_do_read_io(struct lpvo *dev, size_t count)
 --
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c-1391-	/* do it */
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c:1392:	rv = usb_submit_urb(dev->bulk_in_urb, GFP_KERNEL);
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c-1393-	if (rv < 0) {
 --
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c=1586=static ssize_t lpvo_do_write(struct lpvo *dev, const char *buffer, size_t count)
 --
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c-1658-	/* send the data out the bulk port */
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c:1659:	retval = usb_submit_urb(urb, GFP_KERNEL);
 drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c-1660-	mutex_unlock(&dev->io_mutex);
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=105=static int ni_usb_nonblocking_send_bulk_msg(struct ni_usb_priv *ni_priv, void *data,
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-138-
 drivers/gpib/ni_usb/ni_usb_gpib.c:139:	retval = usb_submit_urb(ni_priv->bulk_urb, GFP_KERNEL);
 drivers/gpib/ni_usb/ni_usb_gpib.c-140-	if (retval) {
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=190=static int ni_usb_nonblocking_receive_bulk_msg(struct ni_usb_priv *ni_priv,
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-224-
 drivers/gpib/ni_usb/ni_usb_gpib.c:225:	retval = usb_submit_urb(ni_priv->bulk_urb, GFP_KERNEL);
 drivers/gpib/ni_usb/ni_usb_gpib.c-226-	if (retval) {
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=1816=static void ni_usb_interrupt_complete(struct urb *urb)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-1834-	default: /* other error, resubmit */
 drivers/gpib/ni_usb/ni_usb_gpib.c:1835:		retval = usb_submit_urb(ni_priv->interrupt_urb, GFP_ATOMIC);
 drivers/gpib/ni_usb/ni_usb_gpib.c-1836-		if (retval)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-1848-
 drivers/gpib/ni_usb/ni_usb_gpib.c:1849:	retval = usb_submit_urb(ni_priv->interrupt_urb, GFP_ATOMIC);
 drivers/gpib/ni_usb/ni_usb_gpib.c-1850-	if (retval)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=1885=static int ni_usb_setup_urbs(struct gpib_board *board)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-1908-			 sizeof(ni_priv->interrupt_buffer), &ni_usb_interrupt_complete, board, 1);
 drivers/gpib/ni_usb/ni_usb_gpib.c:1909:	retval = usb_submit_urb(ni_priv->interrupt_urb, GFP_KERNEL);
 drivers/gpib/ni_usb/ni_usb_gpib.c-1910-	mutex_unlock(&ni_priv->interrupt_transfer_lock);
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c=2534=static int ni_usb_driver_resume(struct usb_interface *interface)
 --
 drivers/gpib/ni_usb/ni_usb_gpib.c-2559-			mutex_lock(&ni_priv->interrupt_transfer_lock);
 drivers/gpib/ni_usb/ni_usb_gpib.c:2560:			retval = usb_submit_urb(ni_priv->interrupt_urb, GFP_KERNEL);
 drivers/gpib/ni_usb/ni_usb_gpib.c-2561-			if (retval) {
 --
 drivers/gpu/drm/udl/udl_main.c=298=int udl_submit_urb(struct udl_device *udl, struct urb *urb, size_t len)
 --
 drivers/gpu/drm/udl/udl_main.c-306-	urb->transfer_buffer_length = len; /* set to actual payload len */
 drivers/gpu/drm/udl/udl_main.c:307:	ret = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/gpu/drm/udl/udl_main.c-308- error:
 --
 drivers/gpu/drm/udl/udl_main.c-310-		udl_urb_completion(urb); /* because no one else will */
 drivers/gpu/drm/udl/udl_main.c:311:		DRM_ERROR("usb_submit_urb error %x\n", ret);
 drivers/gpu/drm/udl/udl_main.c-312-	}
 --
 drivers/greybus/es2.c=179=static int output_async(struct es2_ap_dev *es2, void *req, u16 size, u8 cmd)
 --
 drivers/greybus/es2.c-208-			     ap_urb_complete, dr);
 drivers/greybus/es2.c:209:	retval = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/greybus/es2.c-210-	if (retval) {
 --
 drivers/greybus/es2.c=228=static int es2_cport_in_enable(struct es2_ap_dev *es2,
 --
 drivers/greybus/es2.c-237-
 drivers/greybus/es2.c:238:		ret = usb_submit_urb(urb, GFP_KERNEL);
 drivers/greybus/es2.c-239-		if (ret) {
 --
 drivers/greybus/es2.c=269=static int es2_arpc_in_enable(struct es2_ap_dev *es2)
 --
 drivers/greybus/es2.c-277-
 drivers/greybus/es2.c:278:		ret = usb_submit_urb(urb, GFP_KERNEL);
 drivers/greybus/es2.c-279-		if (ret) {
 --
 drivers/greybus/es2.c=390=static int message_send(struct gb_host_device *hd, u16 cport_id,
 --
 drivers/greybus/es2.c-432-
 drivers/greybus/es2.c:433:	retval = usb_submit_urb(urb, gfp_mask);
 drivers/greybus/es2.c-434-	if (retval) {
 --
 drivers/greybus/es2.c=809=static void cport_in_callback(struct urb *urb)
 --
 drivers/greybus/es2.c-846-	/* put our urb back in the request pool */
 drivers/greybus/es2.c:847:	retval = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/greybus/es2.c-848-	if (retval)
 --
 drivers/greybus/es2.c=1020=static void arpc_in_callback(struct urb *urb)
 --
 drivers/greybus/es2.c-1063-	/* put our urb back in the request pool */
 drivers/greybus/es2.c:1064:	retval = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/greybus/es2.c-1065-	if (retval)
 --
 drivers/hid/hid-sony.c=594=static void ghl_magic_poke(struct timer_list *t)
 --
 drivers/hid/hid-sony.c-598-
 drivers/hid/hid-sony.c:599:	ret = usb_submit_urb(sc->ghl_urb, GFP_ATOMIC);
 drivers/hid/hid-sony.c-600-	if (ret < 0)
 drivers/hid/hid-sony.c:601:		hid_err(sc->hdev, "usb_submit_urb failed: %d", ret);
 drivers/hid/hid-sony.c-602-}
 --
 drivers/hid/hid-thrustmaster.c=220=static void thrustmaster_model_handler(struct urb *urb)
 --
 drivers/hid/hid-thrustmaster.c-263-
 drivers/hid/hid-thrustmaster.c:264:	ret = usb_submit_urb(tm_wheel->urb, GFP_ATOMIC);
 drivers/hid/hid-thrustmaster.c-265-	if (ret)
 --
 drivers/hid/hid-thrustmaster.c=290=static int thrustmaster_probe(struct hid_device *hdev, const struct hid_device_id *id)
 --
 drivers/hid/hid-thrustmaster.c-360-
 drivers/hid/hid-thrustmaster.c:361:	ret = usb_submit_urb(tm_wheel->urb, GFP_ATOMIC);
 drivers/hid/hid-thrustmaster.c-362-	if (ret) {
 --
 drivers/hid/hid-u2fzero.c=125=static int u2fzero_recv(struct u2fzero_device *dev,
 --
 drivers/hid/hid-u2fzero.c-139-
 drivers/hid/hid-u2fzero.c:140:	ret = usb_submit_urb(dev->urb, GFP_NOIO);
 drivers/hid/hid-u2fzero.c-141-	if (unlikely(ret)) {
 drivers/hid/hid-u2fzero.c:142:		hid_err(hdev, "usb_submit_urb failed: %d", ret);
 drivers/hid/hid-u2fzero.c-143-		goto err;
 --
 drivers/hid/usbhid/hid-core.c=82=static int hid_start_in(struct hid_device *hid)
 --
 drivers/hid/usbhid/hid-core.c-92-	    !test_and_set_bit(HID_IN_RUNNING, &usbhid->iofl)) {
 drivers/hid/usbhid/hid-core.c:93:		rc = usb_submit_urb(usbhid->urbin, GFP_ATOMIC);
 drivers/hid/usbhid/hid-core.c-94-		if (rc != 0) {
 --
 drivers/hid/usbhid/hid-core.c=273=static void hid_irq_in(struct urb *urb)
 --
 drivers/hid/usbhid/hid-core.c-323-
 drivers/hid/usbhid/hid-core.c:324:	status = usb_submit_urb(urb, GFP_ATOMIC);
 drivers/hid/usbhid/hid-core.c-325-	if (status) {
 --
 drivers/hid/usbhid/hid-core.c=337=static int hid_submit_out(struct hid_device *hid)
 --
 drivers/hid/usbhid/hid-core.c-357-
 drivers/hid/usbhid/hid-core.c:358:	r = usb_submit_urb(usbhid->urbout, GFP_ATOMIC);
 drivers/hid/usbhid/hid-core.c-359-	if (r < 0) {
 drivers/hid/usbhid/hid-core.c:360:		hid_err(hid, "usb_submit_urb(out) failed: %d\n", r);
 drivers/hid/usbhid/hid-core.c-361-		return r;
 --
 drivers/hid/usbhid/hid-core.c=367=static int hid_submit_ctrl(struct hid_device *hid)
 --
 drivers/hid/usbhid/hid-core.c-413-
 drivers/hid/usbhid/hid-core.c:414:	r = usb_submit_urb(usbhid->urbctrl, GFP_ATOMIC);
 drivers/hid/usbhid/hid-core.c-415-	if (r < 0) {
 drivers/hid/usbhid/hid-core.c:416:		hid_err(hid, "usb_submit_urb(ctrl) failed: %d\n", r);
 drivers/hid/usbhid/hid-core.c-417-		return r;
 --
 drivers/hid/usbhid/usbkbd.c=100=static void usb_kbd_irq(struct urb *urb)
 --
 drivers/hid/usbhid/usbkbd.c-145-resubmit:
 drivers/hid/usbhid/usbkbd.c:146:	i = usb_submit_urb (urb, GFP_ATOMIC);
 drivers/hid/usbhid/usbkbd.c-147-	if (i)
 --
 drivers/hid/usbhid/usbkbd.c=153=static int usb_kbd_event(struct input_dev *dev, unsigned int type,
 --
 drivers/hid/usbhid/usbkbd.c-179-	kbd->led->dev = kbd->usbdev;
 drivers/hid/usbhid/usbkbd.c:180:	if (usb_submit_urb(kbd->led, GFP_ATOMIC))
 drivers/hid/usbhid/usbkbd.c:181:		pr_err("usb_submit_urb(leds) failed\n");
 drivers/hid/usbhid/usbkbd.c-182-	else
 --
 drivers/hid/usbhid/usbkbd.c=190=static void usb_kbd_led(struct urb *urb)
 --
 drivers/hid/usbhid/usbkbd.c-209-	kbd->led->dev = kbd->usbdev;
 drivers/hid/usbhid/usbkbd.c:210:	if (usb_submit_urb(kbd->led, GFP_ATOMIC)){
 drivers/hid/usbhid/usbkbd.c:211:		hid_err(urb->dev, "usb_submit_urb(leds) failed\n");
 drivers/hid/usbhid/usbkbd.c-212-		kbd->led_urb_submitted = false;
 --
 drivers/hid/usbhid/usbkbd.c=218=static int usb_kbd_open(struct input_dev *dev)
 --
 drivers/hid/usbhid/usbkbd.c-222-	kbd->irq->dev = kbd->usbdev;
 drivers/hid/usbhid/usbkbd.c:223:	if (usb_submit_urb(kbd->irq, GFP_KERNEL))
 drivers/hid/usbhid/usbkbd.c-224-		return -EIO;
 --
 drivers/hid/usbhid/usbmouse.c=49=static void usb_mouse_irq(struct urb *urb)
 --
 drivers/hid/usbhid/usbmouse.c-79-resubmit:
 drivers/hid/usbhid/usbmouse.c:80:	status = usb_submit_urb (urb, GFP_ATOMIC);
 drivers/hid/usbhid/usbmouse.c-81-	if (status)
 --
 drivers/hid/usbhid/usbmouse.c=88=static int usb_mouse_open(struct input_dev *dev)
 --
 drivers/hid/usbhid/usbmouse.c-92-	mouse->irq->dev = mouse->usbdev;
 drivers/hid/usbhid/usbmouse.c:93:	if (usb_submit_urb(mouse->irq, GFP_KERNEL))
 drivers/hid/usbhid/usbmouse.c-94-		return -EIO;
 --
 drivers/hwmon/powerz.c=96=static void powerz_usb_cmd_complete(struct urb *urb)
 --
 drivers/hwmon/powerz.c-104-
 drivers/hwmon/powerz.c:105:	priv->status = usb_submit_urb(urb, GFP_ATOMIC);
]
]

gemini-3.1-pro-preview

							input: 259759
							output: 36
							thoughts: 57
						

**Debugging the Missing Function**

Okay, hold on a second. I was expecting `rtl_usb_start_rx` to be available, but it seems it's not. That's a problem. Let me quickly check the Realtek RTL8192CU USB driver file – I'm pretty sure it's under `drivers/net/wireless/realtek/rtlwifi/usb.c`. I need to confirm if it has the `usb_submit_urb` function at least; I will use `git grep` with the file path to verify. This will help me narrow down the cause of the missing function.

log-in to see details

map[Expression:usb_submit_urb.*drivers/net/wireless/realtek/rtlwifi/usb.c]

map[Output:]

gemini-3.1-pro-preview

							input: 260001
							output: 19
							thoughts: 78
						

Okay, here's my take on those thoughts, framed as my own:

**Working Through a USB Driver Code Search**

Right, so `git grep` isn't cooperating as I'd hoped. Specifically, it seems I can't pass the path directly within the search expression itself. I was hoping to use `default_api:grepper` alongside `usb_submit_urb`, but the path specification is throwing a wrench in the works.

Okay, no problem. I can bypass that limitation. The path I need is `drivers/net/wireless/realtek/rtlwifi/usb.c`, so I'll just open that file directly and do a straight text search for `usb_submit_urb`. It'll be a manual search, but it's often faster to just look anyway, given the precise context I'm seeking.

log-in to see details

map[Expression:usb_submit_urb]

gemini-3.1-pro-preview

							input: 260317
							output: 35
							thoughts: 32
						

Okay, here's my interpretation of that thought process, tailored for an expert audience:

**Leveraging the Index**

Hold on a second. I think I can significantly speed things up here. I've been meaning to dive into the Realtek USB WiFi driver code in the kernel for a while now. Instead of sifting through everything manually, I can likely leverage the `codesearch-file-index` tool to pinpoint the specific functions or areas I'm interested in within `drivers/net/wireless/realtek/rtlwifi/usb.c`. That file's rather substantial, and I could use `codesearch-file-index` to narrow my focus and jump directly to relevant sections faster, instead of doing it by brute force. That should save me a lot of time.

map[SourceFile:drivers/net/wireless/realtek/rtlwifi/usb.c]

map[Entities:[map[Kind:function Name:_none_usb_tx_aggregate_hdl] map[Kind:function Name:_rtl_prep_rx_urb] map[Kind:function Name:_rtl_rx_completed] map[Kind:function Name:_rtl_rx_get_padding] map[Kind:function Name:_rtl_rx_pre_process] map[Kind:function Name:_rtl_rx_work] map[Kind:function Name:_rtl_submit_tx_urb] map[Kind:function Name:_rtl_tx_complete] map[Kind:function Name:_rtl_usb_cleanup_rx] map[Kind:function Name:_rtl_usb_cleanup_tx] map[Kind:function Name:_rtl_usb_init] map[Kind:function Name:_rtl_usb_init_rx] map[Kind:function Name:_rtl_usb_init_tx] map[Kind:function Name:_rtl_usb_io_handler_init] map[Kind:function Name:_rtl_usb_io_handler_release] map[Kind:function Name:_rtl_usb_receive] map[Kind:function Name:_rtl_usb_rx_process_agg] map[Kind:function Name:_rtl_usb_rx_process_noagg] map[Kind:function Name:_rtl_usb_transmit] map[Kind:function Name:_rtl_usb_tx_preprocess] map[Kind:function Name:_rtl_usb_tx_urb_setup] map[Kind:function Name:_usb_read16_sync] map[Kind:function Name:_usb_read32_sync] map[Kind:function Name:_usb_read8_sync] map[Kind:function Name:_usb_read_sync] map[Kind:function Name:_usb_tx_post] map[Kind:function Name:_usb_write16_sync] map[Kind:function Name:_usb_write32_sync] map[Kind:function Name:_usb_write8_sync] map[Kind:function Name:_usb_write_chunk_sync] map[Kind:function Name:_usb_write_sync] map[Kind:function Name:_usbctrl_vendorreq_sync] map[Kind:function Name:rtl_fill_h2c_cmd_work_callback] map[Kind:function Name:rtl_usb_cleanup] map[Kind:function Name:rtl_usb_deinit] map[Kind:function Name:rtl_usb_disconnect] map[Kind:function Name:rtl_usb_init_sw] map[Kind:function Name:rtl_usb_probe] map[Kind:function Name:rtl_usb_start] map[Kind:function Name:rtl_usb_stop] map[Kind:function Name:rtl_usb_tx] map[Kind:function Name:rtl_usb_tx_chk_waitq_insert] map[Kind:global_variable Name:__UNIQUE_ID_addressable_rtl_usb_disconnect_1256] map[Kind:global_variable Name:__UNIQUE_ID_addressable_rtl_usb_probe_1255] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_1237] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_1238] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_1239] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_1240] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_1241] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_1242] map[Kind:global_variable Name:rtl_usb_ops]]]

gemini-3.1-pro-preview

							input: 261574
							output: 51
							thoughts: 12
						

Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to a fellow expert:

**Diving into the USB Receive Function**

Alright, time to dig into this. My initial instinct is to go straight to `_rtl_usb_receive`. Let's see what's going on in there. I'm expecting to find the core of the USB receive logic, which is obviously crucial for understanding the data flow. Hopefully, the code is well-structured and commented. I'll be looking for things like buffer management, interrupt handling, error checking, and the actual process of reading data from the USB controller. Knowing the specific chip architecture, I can probably infer a lot about its internal registers and control mechanisms just from the function's name and intended purpose. Let's get to it.

map[ContextFile:drivers/net/wireless/realtek/rtlwifi/usb.c IncludeLines:true Name:_rtl_usb_receive]

map[SourceCode: 641:	static int _rtl_usb_receive(struct ieee80211_hw *hw)
 642:	{
 643:		struct urb *urb;
 644:		int err;
 645:		int i;
 646:		struct rtl_usb *rtlusb = rtl_usbdev(rtl_usbpriv(hw));
 647:	
 648:		WARN_ON(0 == rtlusb->rx_urb_num);
 649:		/* 1600 == 1514 + max WLAN header + rtk info */
 650:		WARN_ON(rtlusb->rx_max_size < 1600);
 651:	
 652:		for (i = 0; i < rtlusb->rx_urb_num; i++) {
 653:			err = -ENOMEM;
 654:			urb = usb_alloc_urb(0, GFP_KERNEL);
 655:			if (!urb)
 656:				goto err_out;
 657:	
 658:			err = _rtl_prep_rx_urb(hw, rtlusb, urb, GFP_KERNEL);
 659:			if (err < 0) {
 660:				pr_err("Failed to prep_rx_urb!!\n");
 661:				usb_free_urb(urb);
 662:				goto err_out;
 663:			}
 664:	
 665:			usb_anchor_urb(urb, &rtlusb->rx_submitted);
 666:			err = usb_submit_urb(urb, GFP_KERNEL);
 667:			if (err) {
 668:				usb_unanchor_urb(urb);
 669:				usb_free_urb(urb);
 670:				goto err_out;
 671:			}
 672:			usb_free_urb(urb);
 673:		}
 674:		return 0;
 675:	
 676:	err_out:
 677:		usb_kill_anchored_urbs(&rtlusb->rx_submitted);
 678:		return err;
 679:	}
 SourceFile:drivers/net/wireless/realtek/rtlwifi/usb.c]

gemini-3.1-pro-preview

							input: 262442
							output: 53
							thoughts: 22
						

Here's my thought process, as if I were considering this code:

**Analyzing the USB Receive Preparation**

Okay, let me break this down. My focus here is on understanding how this USB driver prepares for incoming data, specifically the `_rtl_prep_rx_urb` function. It looks like this function is directly interacting with the USB transport layer's receive operation, which is a key process for network connectivity. The core issue I'm considering is how the driver is configured to process the received data.

Alright, the critical piece here is the use of `rtlusb->in_ep`. This suggests that the driver is associating the incoming data with a specific *endpoint* defined in the `rtlusb` structure. The `in_ep` member likely refers to the "input endpoint" or the endpoint designated for receiving data from the USB device (presumably the wireless adapter in this instance). This endpoint is likely configured for bulk or interrupt transfer based on how the driver handles different kinds of data flows. Therefore, `_rtl_prep_rx_urb` probably configures the receive URB (USB Request Block) using that endpoint. It makes sense, as the USB host needs to know which endpoint to listen on.

map[ContextFile:drivers/net/wireless/realtek/rtlwifi/usb.c IncludeLines:true Name:_rtl_prep_rx_urb]

map[SourceCode: 349:	static int _rtl_prep_rx_urb(struct ieee80211_hw *hw, struct rtl_usb *rtlusb,
 350:				      struct urb *urb, gfp_t gfp_mask)
 351:	{
 352:		void *buf;
 353:	
 354:		buf = usb_alloc_coherent(rtlusb->udev, rtlusb->rx_max_size, gfp_mask,
 355:					 &urb->transfer_dma);
 356:		if (!buf) {
 357:			pr_err("Failed to usb_alloc_coherent!!\n");
 358:			return -ENOMEM;
 359:		}
 360:	
 361:		usb_fill_bulk_urb(urb, rtlusb->udev,
 362:				  usb_rcvbulkpipe(rtlusb->udev, rtlusb->in_ep),
 363:				  buf, rtlusb->rx_max_size, _rtl_rx_completed, rtlusb);
 364:		urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
 365:	
 366:		return 0;
 367:	}
 SourceFile:drivers/net/wireless/realtek/rtlwifi/usb.c]

gemini-3.1-pro-preview

							input: 263141
							output: 50
							thoughts: 329
						

**Analyzing a Potential Bug in USB Communication**

Okay, let's break this down. If the `rtlusb->in_ep_nums` variable is zero, then the `rtlusb->in_ep` pointer is also, logically, zero. This seems straightforward. Then, the code calls `usb_rcvbulkpipe(rtlusb->udev, 0)`, which, as I understand it, attempts to create a pipe for endpoint 0. But wait a second... endpoint 0 is the *control* endpoint, isn't it? My mind just made that connection. 

Now, the code proceeds to use `usb_fill_bulk_urb` with this same endpoint 0. This already seems wrong! We're trying to set up a bulk transfer on a control endpoint, and the system is designed so that a control endpoint is a *control* endpoint, not a bulk endpoint. This means that when `usb_submit_urb` is eventually called with a bulk URB (USB Request Block) on endpoint 0, something should go wrong. 

Let me think… I recall there's a check in `usb_submit_urb` within the kernel for this exact mismatch. I remember seeing something like this, a verification:
```c
	if (usb_pipetype(urb->pipe) != pipetypes[usb_endpoint_type(&ep->desc)])
```

Yes, that's it! It will check if the pipe type of the urb matches the endpoint type. This confirms my concerns. The `usb_submit_urb` function will return an error, likely `-EPIPE` or something similar, when the pipetype doesn't match the endpoint type.

But... hang on. If `rtlusb->in_ep` is zero, and `usb_rcvbulkpipe` *somehow* creates a bulk pipe for endpoint 0 (which is itself the control endpoint), then `usb_submit_urb` will see the conflict and reject it, returning an error. Makes sense. 

If this error is returned, then the function `_rtl_usb_receive` will call `usb_kill_anchored_urbs(&rtlusb->rx_submitted);` and return that error, correct. And then? Ah, right, `_rtl_usb_receive` is called from `rtl_usb_start`. So, we're likely going to see an error at startup or during the initialization phase if this condition triggers, right? This is an important clue for debugging. I need to make sure this code path is well-tested.

map[ContextFile:drivers/net/wireless/realtek/rtlwifi/usb.c IncludeLines:true Name:rtl_usb_start]

map[SourceCode: 681:	static int rtl_usb_start(struct ieee80211_hw *hw)
 682:	{
 683:		int err;
 684:		struct rtl_priv *rtlpriv = rtl_priv(hw);
 685:		struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
 686:		struct rtl_usb *rtlusb = rtl_usbdev(rtl_usbpriv(hw));
 687:	
 688:		err = rtlpriv->cfg->ops->hw_init(hw);
 689:		if (!err) {
 690:			rtl_init_rx_config(hw);
 691:	
 692:			/* Enable software */
 693:			SET_USB_START(rtlusb);
 694:			/* should after adapter start and interrupt enable. */
 695:			set_hal_start(rtlhal);
 696:	
 697:			/* Start bulk IN */
 698:			err = _rtl_usb_receive(hw);
 699:		}
 700:	
 701:		return err;
 702:	}
 SourceFile:drivers/net/wireless/realtek/rtlwifi/usb.c]

gemini-3.1-pro-preview

							input: 264427
							output: 26
							thoughts: 191
						

**Analyzing a Potential Driver Failure**

Okay, so I'm looking at this code and something's bugging me. If `_rtl_usb_receive` throws an error, that means `rtl_usb_start` will also return an error, right? And if *that* happens, then `mac80211` is going to fail to initialize the device. Hmm, is there a crash potential here? It's a quick sequence, so I need to make sure I understand all the angles.

Wait a minute... what if `rtlusb->rx_urb_num` is zero? Because if it is, that's going to trigger a `WARN_ON(0 == rtlusb->rx_urb_num);`. Is `rx_urb_num` actually initialized? Let's trace it back. Okay, I see it's initialized in `_rtl_usb_init_rx`: `rtlusb->rx_urb_num = rtlpriv->cfg->usb_interface_cfg->rx_urb_num;`. Now, for a device like `rtl8192cu`, the probability of `rx_urb_num` being zero is practically nil. But I need to verify that; let me check the configuration specifically for `rtl8192cu`'s `usb_interface_cfg` just to be absolutely sure.

map[Name:rtl92cu_hal_cfg]

map[References:<nil> TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 264954
							output: 60
							thoughts: 39
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Investigating rtl92cu_hal_cfg's Location**

Okay, hold on a second. I need to pinpoint the location of `rtl92cu_hal_cfg`. Let's see... a quick mental search... right, that function is going to be in the Realtek RTL8192CU driver. Specifically, it should be within the `drivers/net/wireless/realtek/rtlwifi/rtl8192cu/` directory, which indicates it is a WiFi driver. Aha, found it! It's nestled within `sw.c`. Now that I know where it is, I can delve into its implementation and understand its purpose within the broader driver context.

map[ContextFile:drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c IncludeLines:true Name:rtl92cu_hal_cfg]

map[SourceCode: 159:	static const struct rtl_hal_cfg rtl92cu_hal_cfg = {
 160:		.name = "rtl92c_usb",
 161:		.alt_fw_name = "rtlwifi/rtl8192cufw.bin",
 162:		.ops = &rtl8192cu_hal_ops,
 163:		.mod_params = &rtl92cu_mod_params,
 164:		.usb_interface_cfg = &rtl92cu_interface_cfg,
 165:	
 166:		.maps[SYS_ISO_CTRL] = REG_SYS_ISO_CTRL,
 167:		.maps[SYS_FUNC_EN] = REG_SYS_FUNC_EN,
 168:		.maps[SYS_CLK] = REG_SYS_CLKR,
 169:		.maps[MAC_RCR_AM] = AM,
 170:		.maps[MAC_RCR_AB] = AB,
 171:		.maps[MAC_RCR_ACRC32] = ACRC32,
 172:		.maps[MAC_RCR_ACF] = ACF,
 173:		.maps[MAC_RCR_AAP] = AAP,
 174:	
 175:		.maps[EFUSE_TEST] = REG_EFUSE_TEST,
 176:		.maps[EFUSE_CTRL] = REG_EFUSE_CTRL,
 177:		.maps[EFUSE_CLK] = 0,
 178:		.maps[EFUSE_CLK_CTRL] = REG_EFUSE_CTRL,
 179:		.maps[EFUSE_PWC_EV12V] = PWC_EV12V,
 180:		.maps[EFUSE_FEN_ELDR] = FEN_ELDR,
 181:		.maps[EFUSE_LOADER_CLK_EN] = LOADER_CLK_EN,
 182:		.maps[EFUSE_ANA8M] = EFUSE_ANA8M,
 183:		.maps[EFUSE_HWSET_MAX_SIZE] = HWSET_MAX_SIZE,
 184:		.maps[EFUSE_MAX_SECTION_MAP] = EFUSE_MAX_SECTION,
 185:		.maps[EFUSE_REAL_CONTENT_SIZE] = EFUSE_REAL_CONTENT_LEN,
 186:	
 187:		.maps[RWCAM] = REG_CAMCMD,
 188:		.maps[WCAMI] = REG_CAMWRITE,
 189:		.maps[RCAMO] = REG_CAMREAD,
 190:		.maps[CAMDBG] = REG_CAMDBG,
 191:		.maps[SECR] = REG_SECCFG,
 192:		.maps[SEC_CAM_NONE] = CAM_NONE,
 193:		.maps[SEC_CAM_WEP40] = CAM_WEP40,
 194:		.maps[SEC_CAM_TKIP] = CAM_TKIP,
 195:		.maps[SEC_CAM_AES] = CAM_AES,
 196:		.maps[SEC_CAM_WEP104] = CAM_WEP104,
 197:	
 198:		.maps[RTL_IMR_BCNDMAINT6] = IMR_BCNDMAINT6,
 199:		.maps[RTL_IMR_BCNDMAINT5] = IMR_BCNDMAINT5,
 200:		.maps[RTL_IMR_BCNDMAINT4] = IMR_BCNDMAINT4,
 201:		.maps[RTL_IMR_BCNDMAINT3] = IMR_BCNDMAINT3,
 202:		.maps[RTL_IMR_BCNDMAINT2] = IMR_BCNDMAINT2,
 203:		.maps[RTL_IMR_BCNDMAINT1] = IMR_BCNDMAINT1,
 204:		.maps[RTL_IMR_BCNDOK8] = IMR_BCNDOK8,
 205:		.maps[RTL_IMR_BCNDOK7] = IMR_BCNDOK7,
 206:		.maps[RTL_IMR_BCNDOK6] = IMR_BCNDOK6,
 207:		.maps[RTL_IMR_BCNDOK5] = IMR_BCNDOK5,
 208:		.maps[RTL_IMR_BCNDOK4] = IMR_BCNDOK4,
 209:		.maps[RTL_IMR_BCNDOK3] = IMR_BCNDOK3,
 210:		.maps[RTL_IMR_BCNDOK2] = IMR_BCNDOK2,
 211:		.maps[RTL_IMR_BCNDOK1] = IMR_BCNDOK1,
 212:		.maps[RTL_IMR_TIMEOUT2] = IMR_TIMEOUT2,
 213:		.maps[RTL_IMR_TIMEOUT1] = IMR_TIMEOUT1,
 214:	
 215:		.maps[RTL_IMR_TXFOVW] = IMR_TXFOVW,
 216:		.maps[RTL_IMR_PSTIMEOUT] = IMR_PSTIMEOUT,
 217:		.maps[RTL_IMR_BCNINT] = IMR_BCNINT,
 218:		.maps[RTL_IMR_RXFOVW] = IMR_RXFOVW,
 219:		.maps[RTL_IMR_RDU] = IMR_RDU,
 220:		.maps[RTL_IMR_ATIMEND] = IMR_ATIMEND,
 221:		.maps[RTL_IMR_BDOK] = IMR_BDOK,
 222:		.maps[RTL_IMR_MGNTDOK] = IMR_MGNTDOK,
 223:		.maps[RTL_IMR_TBDER] = IMR_TBDER,
 224:		.maps[RTL_IMR_HIGHDOK] = IMR_HIGHDOK,
 225:		.maps[RTL_IMR_TBDOK] = IMR_TBDOK,
 226:		.maps[RTL_IMR_BKDOK] = IMR_BKDOK,
 227:		.maps[RTL_IMR_BEDOK] = IMR_BEDOK,
 228:		.maps[RTL_IMR_VIDOK] = IMR_VIDOK,
 229:		.maps[RTL_IMR_VODOK] = IMR_VODOK,
 230:		.maps[RTL_IMR_ROK] = IMR_ROK,
 231:		.maps[RTL_IBSS_INT_MASKS] = (IMR_BCNINT | IMR_TBDOK | IMR_TBDER),
 232:	
 233:		.maps[RTL_RC_CCK_RATE1M] = DESC_RATE1M,
 234:		.maps[RTL_RC_CCK_RATE2M] = DESC_RATE2M,
 235:		.maps[RTL_RC_CCK_RATE5_5M] = DESC_RATE5_5M,
 236:		.maps[RTL_RC_CCK_RATE11M] = DESC_RATE11M,
 237:		.maps[RTL_RC_OFDM_RATE6M] = DESC_RATE6M,
 238:		.maps[RTL_RC_OFDM_RATE9M] = DESC_RATE9M,
 239:		.maps[RTL_RC_OFDM_RATE12M] = DESC_RATE12M,
 240:		.maps[RTL_RC_OFDM_RATE18M] = DESC_RATE18M,
 241:		.maps[RTL_RC_OFDM_RATE24M] = DESC_RATE24M,
 242:		.maps[RTL_RC_OFDM_RATE36M] = DESC_RATE36M,
 243:		.maps[RTL_RC_OFDM_RATE48M] = DESC_RATE48M,
 244:		.maps[RTL_RC_OFDM_RATE54M] = DESC_RATE54M,
 245:		.maps[RTL_RC_HT_RATEMCS7] = DESC_RATEMCS7,
 246:		.maps[RTL_RC_HT_RATEMCS15] = DESC_RATEMCS15,
 247:	};
 SourceFile:drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c]

gemini-3.1-pro-preview

							input: 267534
							output: 60
							thoughts: 27
						

Here's a summary of my thought process, as requested:

**Deconstructing a Configuration Variable**

Okay, hold on a second. I need to clarify something quickly. I see this `rtl92cu_interface_cfg` variable, and it's hitting a bell. It seems like it's actually referencing the `usb_interface_cfg`, right? I'm pretty sure I've seen that relationship before. Let me just confirm that connection and make sure I'm not missing something subtle. I need to go back and cross-reference, just to be absolutely certain before I proceed. I'll take a look at the relevant definitions and dependencies. Gotta double-check this before it causes problems downstream.

map[ContextFile:drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c IncludeLines:true Name:rtl92cu_interface_cfg]

map[SourceCode: 144:	static struct rtl_hal_usbint_cfg rtl92cu_interface_cfg = {
 145:		/* rx */
 146:		.rx_urb_num = RTL92C_NUM_RX_URBS,
 147:		.rx_max_size = RTL92C_SIZE_MAX_RX_BUFFER,
 148:		.usb_rx_hdl = rtl8192cu_rx_hdl,
 149:		.usb_rx_segregate_hdl = NULL,
 150:		/* tx */
 151:		.usb_tx_cleanup = rtl8192c_tx_cleanup,
 152:		.usb_tx_post_hdl = rtl8192c_tx_post_hdl,
 153:		.usb_tx_aggregate_hdl = rtl8192c_tx_aggregate_hdl,
 154:		/* endpoint mapping */
 155:		.usb_endpoint_mapping = rtl8192cu_endpoint_mapping,
 156:		.usb_mq_to_hwq = rtl8192cu_mq_to_hwq,
 157:	};
 SourceFile:drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c]

gemini-3.1-pro-preview

							input: 268127
							output: 62
							thoughts: 31
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Analyzing the USB Endpoint Mapping in rtl8192cu**

Right, so `rtl8192cu_endpoint_mapping` is clearly a critical function, as it's directly invoked within `_rtl_usb_init`. That immediately piques my interest. It means this mapping is fundamental to how the RTL8192CU driver configures and interacts with the USB interface upon initialization. I need to dig in and understand this function's logic. I suspect it's responsible for assigning specific USB endpoints to their corresponding logical functions within the driver – things like control transfers, bulk IN/OUT for data, interrupt pipes for status updates, etc. The precise details of the mapping are going to be crucial for performance and stability. Any misconfiguration here, and we're looking at potential bandwidth bottlenecks, dropped packets, or even outright device failures. I'll be looking for clues about the endpoint descriptors, pipe assignments, and any error handling or retry mechanisms. I need to verify how it deals with the various endpoint types that are specified in the device's USB configuration.

map[ContextFile:drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c IncludeLines:true Name:rtl8192cu_endpoint_mapping]

map[SourceCode: 187:	/* endpoint mapping */
 188:	int  rtl8192cu_endpoint_mapping(struct ieee80211_hw *hw)
 189:	{
 190:		struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
 191:		int error = 0;
 192:	
 193:		if (likely(IS_NORMAL_CHIP(rtlhal->version)))
 194:			error = configvernoutep(hw);
 195:		else
 196:			error = configvertoutep(hw);
 197:		if (error)
 198:			goto err_out;
 199:		error = _out_ep_mapping(hw);
 200:		if (error)
 201:			goto err_out;
 202:	err_out:
 203:		return error;
 204:	}
 SourceFile:drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c]

gemini-3.1-pro-preview

							input: 268762
							output: 56
							thoughts: 19
						

Here's my thought process, summarized as if I were considering this myself:

**Endpoint Configuration and Verification**

Okay, let me think this through. Hang on... right. It just clicked. That's it! *configvernoutep* and *configvertoutep* are specifically designed to perform endpoint checks. That's the key. They aren't just for general configuration; they're the components responsible for the endpoint verification, the validation of our established connections. I should have seen that immediately. That clarifies everything.

map[ContextFile:drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c IncludeLines:true Name:configvernoutep]

map[SourceCode:  50:	static int configvernoutep(struct ieee80211_hw *hw)
  51:	{
  52:		u8 ep_cfg;
  53:		u8 ep_nums = 0;
  54:	
  55:		struct rtl_priv *rtlpriv = rtl_priv(hw);
  56:		struct rtl_usb_priv *usb_priv = rtl_usbpriv(hw);
  57:		struct rtl_usb *rtlusb = rtl_usbdev(usb_priv);
  58:	
  59:		rtlusb->out_queue_sel = 0;
  60:		/* Normal and High queue */
  61:		ep_cfg =  rtl_read_byte(rtlpriv, (REG_NORMAL_SIE_EP + 1));
  62:		if (ep_cfg & USB_NORMAL_SIE_EP_MASK) {
  63:			rtlusb->out_queue_sel |= TX_SELE_HQ;
  64:			ep_nums++;
  65:		}
  66:		if ((ep_cfg >> USB_NORMAL_SIE_EP_SHIFT) & USB_NORMAL_SIE_EP_MASK) {
  67:			rtlusb->out_queue_sel |= TX_SELE_NQ;
  68:			ep_nums++;
  69:		}
  70:		/* Low queue */
  71:		ep_cfg =  rtl_read_byte(rtlpriv, (REG_NORMAL_SIE_EP + 2));
  72:		if (ep_cfg & USB_NORMAL_SIE_EP_MASK) {
  73:			rtlusb->out_queue_sel |= TX_SELE_LQ;
  74:			ep_nums++;
  75:		}
  76:		return (rtlusb->out_ep_nums == ep_nums) ? 0 : -EINVAL;
  77:	}
 SourceFile:drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c]

gemini-3.1-pro-preview

							input: 269478
							output: 43
							thoughts: 369
						

**My Analysis of a Potential USB Driver Flaw**

Okay, so I'm looking at this `configvernoutep` function, and it's grabbing data directly from hardware registers, which is always a bit dicey. But the real issue is what happens if `rtlusb->in_ep_nums` is, somehow, zero. Now, I remember in `_rtl_usb_init`, it *does* check `rtlusb->out_ep_nums == 0` and bails with `-EINVAL`, which is good defensive programming, but it completely misses checking `rtlusb->in_ep_nums == 0`.

If `rtlusb->in_ep_nums` is indeed zero, then `rtlusb->in_ep` is going to be 0. That's where things get interesting. Later on, `_rtl_prep_rx_urb` uses `usb_rcvbulkpipe(rtlusb->udev, rtlusb->in_ep)`. Since `rtlusb->in_ep` is zero, we're effectively creating a bulk pipe on endpoint 0 with `usb_rcvbulkpipe(udev, 0)`.

That's a red flag. Because then, `usb_submit_urb` gets called with this URB. Endpoint 0 is almost universally a control endpoint, and we've constructed a bulk pipe. My immediate assumption is that `usb_submit_urb` should reject this outright because the pipe type and endpoint type don't match. 

But *does* it? I have to remember that function better. My memory suggests there's some nuance... I think `usb_submit_urb` checks the endpoint type and pipe type:

```c
	xfertype = usb_endpoint_type(&ep->desc);
	if (usb_pipetype(urb->pipe) != pipetypes[xfertype])
		if (usb_pipeisoc(urb->pipe) || usb_pipeint(urb->pipe))
			return -EINVAL;
```

It seems like maybe, *just maybe*, it might let it go if it's bulk vs control, although I'm not 100% sure. I'm going to jump into the `drivers/usb/core/urb.c` source code and verify the exact behavior of `usb_submit_urb`. I need to be absolutely sure that this won't slip through. I suspect an error code will be returned based on the structure of the code, but I need confirmation.

map[ContextFile:drivers/usb/core/urb.c IncludeLines:true Name:usb_submit_urb]

map[SourceCode: 230:	/**
 231:	 * usb_submit_urb - issue an asynchronous transfer request for an endpoint
 232:	 * @urb: pointer to the urb describing the request
 233:	 * @mem_flags: the type of memory to allocate, see kmalloc() for a list
 234:	 *	of valid options for this.
 235:	 *
 236:	 * This submits a transfer request, and transfers control of the URB
 237:	 * describing that request to the USB subsystem.  Request completion will
 238:	 * be indicated later, asynchronously, by calling the completion handler.
 239:	 * The three types of completion are success, error, and unlink
 240:	 * (a software-induced fault, also called "request cancellation").
 241:	 *
 242:	 * URBs may be submitted in interrupt context.
 243:	 *
 244:	 * The caller must have correctly initialized the URB before submitting
 245:	 * it.  Functions such as usb_fill_bulk_urb() and usb_fill_control_urb() are
 246:	 * available to ensure that most fields are correctly initialized, for
 247:	 * the particular kind of transfer, although they will not initialize
 248:	 * any transfer flags.
 249:	 *
 250:	 * If the submission is successful, the complete() callback from the URB
 251:	 * will be called exactly once, when the USB core and Host Controller Driver
 252:	 * (HCD) are finished with the URB.  When the completion function is called,
 253:	 * control of the URB is returned to the device driver which issued the
 254:	 * request.  The completion handler may then immediately free or reuse that
 255:	 * URB.
 256:	 *
 257:	 * With few exceptions, USB device drivers should never access URB fields
 258:	 * provided by usbcore or the HCD until its complete() is called.
 259:	 * The exceptions relate to periodic transfer scheduling.  For both
 260:	 * interrupt and isochronous urbs, as part of successful URB submission
 261:	 * urb->interval is modified to reflect the actual transfer period used
 262:	 * (normally some power of two units).  And for isochronous urbs,
 263:	 * urb->start_frame is modified to reflect when the URB's transfers were
 264:	 * scheduled to start.
 265:	 *
 266:	 * Not all isochronous transfer scheduling policies will work, but most
 267:	 * host controller drivers should easily handle ISO queues going from now
 268:	 * until 10-200 msec into the future.  Drivers should try to keep at
 269:	 * least one or two msec of data in the queue; many controllers require
 270:	 * that new transfers start at least 1 msec in the future when they are
 271:	 * added.  If the driver is unable to keep up and the queue empties out,
 272:	 * the behavior for new submissions is governed by the URB_ISO_ASAP flag.
 273:	 * If the flag is set, or if the queue is idle, then the URB is always
 274:	 * assigned to the first available (and not yet expired) slot in the
 275:	 * endpoint's schedule.  If the flag is not set and the queue is active
 276:	 * then the URB is always assigned to the next slot in the schedule
 277:	 * following the end of the endpoint's previous URB, even if that slot is
 278:	 * in the past.  When a packet is assigned in this way to a slot that has
 279:	 * already expired, the packet is not transmitted and the corresponding
 280:	 * usb_iso_packet_descriptor's status field will return -EXDEV.  If this
 281:	 * would happen to all the packets in the URB, submission fails with a
 282:	 * -EXDEV error code.
 283:	 *
 284:	 * For control endpoints, the synchronous usb_control_msg() call is
 285:	 * often used (in non-interrupt context) instead of this call.
 286:	 * That is often used through convenience wrappers, for the requests
 287:	 * that are standardized in the USB 2.0 specification.  For bulk
 288:	 * endpoints, a synchronous usb_bulk_msg() call is available.
 289:	 *
 290:	 * Return:
 291:	 * 0 on successful submissions. A negative error number otherwise.
 292:	 *
 293:	 * Request Queuing:
 294:	 *
 295:	 * URBs may be submitted to endpoints before previous ones complete, to
 296:	 * minimize the impact of interrupt latencies and system overhead on data
 297:	 * throughput.  With that queuing policy, an endpoint's queue would never
 298:	 * be empty.  This is required for continuous isochronous data streams,
 299:	 * and may also be required for some kinds of interrupt transfers. Such
 300:	 * queuing also maximizes bandwidth utilization by letting USB controllers
 301:	 * start work on later requests before driver software has finished the
 302:	 * completion processing for earlier (successful) requests.
 303:	 *
 304:	 * As of Linux 2.6, all USB endpoint transfer queues support depths greater
 305:	 * than one.  This was previously a HCD-specific behavior, except for ISO
 306:	 * transfers.  Non-isochronous endpoint queues are inactive during cleanup
 307:	 * after faults (transfer errors or cancellation).
 308:	 *
 309:	 * Reserved Bandwidth Transfers:
 310:	 *
 311:	 * Periodic transfers (interrupt or isochronous) are performed repeatedly,
 312:	 * using the interval specified in the urb.  Submitting the first urb to
 313:	 * the endpoint reserves the bandwidth necessary to make those transfers.
 314:	 * If the USB subsystem can't allocate sufficient bandwidth to perform
 315:	 * the periodic request, submitting such a periodic request should fail.
 316:	 *
 317:	 * For devices under xHCI, the bandwidth is reserved at configuration time, or
 318:	 * when the alt setting is selected.  If there is not enough bus bandwidth, the
 319:	 * configuration/alt setting request will fail.  Therefore, submissions to
 320:	 * periodic endpoints on devices under xHCI should never fail due to bandwidth
 321:	 * constraints.
 322:	 *
 323:	 * Device drivers must explicitly request that repetition, by ensuring that
 324:	 * some URB is always on the endpoint's queue (except possibly for short
 325:	 * periods during completion callbacks).  When there is no longer an urb
 326:	 * queued, the endpoint's bandwidth reservation is canceled.  This means
 327:	 * drivers can use their completion handlers to ensure they keep bandwidth
 328:	 * they need, by reinitializing and resubmitting the just-completed urb
 329:	 * until the driver longer needs that periodic bandwidth.
 330:	 *
 331:	 * Memory Flags:
 332:	 *
 333:	 * The general rules for how to decide which mem_flags to use
 334:	 * are the same as for kmalloc.  There are four
 335:	 * different possible values; GFP_KERNEL, GFP_NOFS, GFP_NOIO and
 336:	 * GFP_ATOMIC.
 337:	 *
 338:	 * GFP_NOFS is not ever used, as it has not been implemented yet.
 339:	 *
 340:	 * GFP_ATOMIC is used when
 341:	 *   (a) you are inside a completion handler, an interrupt, bottom half,
 342:	 *       tasklet or timer, or
 343:	 *   (b) you are holding a spinlock or rwlock (does not apply to
 344:	 *       semaphores), or
 345:	 *   (c) current->state != TASK_RUNNING, this is the case only after
 346:	 *       you've changed it.
 347:	 *
 348:	 * GFP_NOIO is used in the block io path and error handling of storage
 349:	 * devices.
 350:	 *
 351:	 * All other situations use GFP_KERNEL.
 352:	 *
 353:	 * Some more specific rules for mem_flags can be inferred, such as
 354:	 *  (1) start_xmit, timeout, and receive methods of network drivers must
 355:	 *      use GFP_ATOMIC (they are called with a spinlock held);
 356:	 *  (2) queuecommand methods of scsi drivers must use GFP_ATOMIC (also
 357:	 *      called with a spinlock held);
 358:	 *  (3) If you use a kernel thread with a network driver you must use
 359:	 *      GFP_NOIO, unless (b) or (c) apply;
 360:	 *  (4) after you have done a down() you can use GFP_KERNEL, unless (b) or (c)
 361:	 *      apply or your are in a storage driver's block io path;
 362:	 *  (5) USB probe and disconnect can use GFP_KERNEL unless (b) or (c) apply; and
 363:	 *  (6) changing firmware on a running storage or net device uses
 364:	 *      GFP_NOIO, unless b) or c) apply
 365:	 *
 366:	 */
 367:	int usb_submit_urb(struct urb *urb, gfp_t mem_flags)
 368:	{
 369:		int				xfertype, max;
 370:		struct usb_device		*dev;
 371:		struct usb_host_endpoint	*ep;
 372:		int				is_out;
 373:		unsigned int			allowed;
 374:		bool				is_eusb2_isoch_double;
 375:	
 376:		if (!urb || !urb->complete)
 377:			return -EINVAL;
 378:		if (urb->hcpriv) {
 379:			WARN_ONCE(1, "URB %p submitted while active\n", urb);
 380:			return -EBUSY;
 381:		}
 382:	
 383:		dev = urb->dev;
 384:		if ((!dev) || (dev->state < USB_STATE_UNAUTHENTICATED))
 385:			return -ENODEV;
 386:	
 387:		/* For now, get the endpoint from the pipe.  Eventually drivers
 388:		 * will be required to set urb->ep directly and we will eliminate
 389:		 * urb->pipe.
 390:		 */
 391:		ep = usb_pipe_endpoint(dev, urb->pipe);
 392:		if (!ep)
 393:			return -ENOENT;
 394:	
 395:		urb->ep = ep;
 396:		urb->status = -EINPROGRESS;
 397:		urb->actual_length = 0;
 398:	
 399:		/* Lots of sanity checks, so HCDs can rely on clean data
 400:		 * and don't need to duplicate tests
 401:		 */
 402:		xfertype = usb_endpoint_type(&ep->desc);
 403:		if (xfertype == USB_ENDPOINT_XFER_CONTROL) {
 404:			struct usb_ctrlrequest *setup =
 405:					(struct usb_ctrlrequest *) urb->setup_packet;
 406:	
 407:			if (!setup)
 408:				return -ENOEXEC;
 409:			is_out = !(setup->bRequestType & USB_DIR_IN) ||
 410:					!setup->wLength;
 411:			dev_WARN_ONCE(&dev->dev, (usb_pipeout(urb->pipe) != is_out),
 412:					"BOGUS control dir, pipe %x doesn't match bRequestType %x\n",
 413:					urb->pipe, setup->bRequestType);
 414:			if (le16_to_cpu(setup->wLength) != urb->transfer_buffer_length) {
 415:				dev_dbg(&dev->dev, "BOGUS control len %d doesn't match transfer length %d\n",
 416:						le16_to_cpu(setup->wLength),
 417:						urb->transfer_buffer_length);
 418:				return -EBADR;
 419:			}
 420:		} else {
 421:			is_out = usb_endpoint_dir_out(&ep->desc);
 422:		}
 423:	
 424:		/* Clear the internal flags and cache the direction for later use */
 425:		urb->transfer_flags &= ~(URB_DIR_MASK | URB_DMA_MAP_SINGLE |
 426:				URB_DMA_MAP_PAGE | URB_DMA_MAP_SG | URB_MAP_LOCAL |
 427:				URB_SETUP_MAP_SINGLE | URB_SETUP_MAP_LOCAL |
 428:				URB_DMA_SG_COMBINED);
 429:		urb->transfer_flags |= (is_out ? URB_DIR_OUT : URB_DIR_IN);
 430:		kmsan_handle_urb(urb, is_out);
 431:	
 432:		if (xfertype != USB_ENDPOINT_XFER_CONTROL &&
 433:				dev->state < USB_STATE_CONFIGURED)
 434:			return -ENODEV;
 435:	
 436:		max = usb_endpoint_maxp(&ep->desc);
 437:		is_eusb2_isoch_double = usb_endpoint_is_hs_isoc_double(dev, ep);
 438:		if (!max && !is_eusb2_isoch_double) {
 439:			dev_dbg(&dev->dev,
 440:				"bogus endpoint ep%d%s in %s (bad maxpacket %d)\n",
 441:				usb_endpoint_num(&ep->desc), is_out ? "out" : "in",
 442:				__func__, max);
 443:			return -EMSGSIZE;
 444:		}
 445:	
 446:		/* periodic transfers limit size per frame/uframe,
 447:		 * but drivers only control those sizes for ISO.
 448:		 * while we're checking, initialize return status.
 449:		 */
 450:		if (xfertype == USB_ENDPOINT_XFER_ISOC) {
 451:			int	n, len;
 452:	
 453:			/* SuperSpeed isoc endpoints have up to 16 bursts of up to
 454:			 * 3 packets each
 455:			 */
 456:			if (dev->speed >= USB_SPEED_SUPER) {
 457:				int     burst = 1 + ep->ss_ep_comp.bMaxBurst;
 458:				int     mult = USB_SS_MULT(ep->ss_ep_comp.bmAttributes);
 459:				max *= burst;
 460:				max *= mult;
 461:			}
 462:	
 463:			if (dev->speed == USB_SPEED_SUPER_PLUS &&
 464:			    USB_SS_SSP_ISOC_COMP(ep->ss_ep_comp.bmAttributes)) {
 465:				struct usb_ssp_isoc_ep_comp_descriptor *isoc_ep_comp;
 466:	
 467:				isoc_ep_comp = &ep->ssp_isoc_ep_comp;
 468:				max = le32_to_cpu(isoc_ep_comp->dwBytesPerInterval);
 469:			}
 470:	
 471:			/* High speed, 1-3 packets/uframe, max 6 for eUSB2 double bw */
 472:			if (dev->speed == USB_SPEED_HIGH) {
 473:				if (is_eusb2_isoch_double)
 474:					max = le32_to_cpu(ep->eusb2_isoc_ep_comp.dwBytesPerInterval);
 475:				else
 476:					max *= usb_endpoint_maxp_mult(&ep->desc);
 477:			}
 478:	
 479:			if (urb->number_of_packets <= 0)
 480:				return -EINVAL;
 481:			for (n = 0; n < urb->number_of_packets; n++) {
 482:				len = urb->iso_frame_desc[n].length;
 483:				if (len < 0 || len > max)
 484:					return -EMSGSIZE;
 485:				urb->iso_frame_desc[n].status = -EXDEV;
 486:				urb->iso_frame_desc[n].actual_length = 0;
 487:			}
 488:		} else if (urb->num_sgs && !urb->dev->bus->no_sg_constraint) {
 489:			struct scatterlist *sg;
 490:			int i;
 491:	
 492:			for_each_sg(urb->sg, sg, urb->num_sgs - 1, i)
 493:				if (sg->length % max)
 494:					return -EINVAL;
 495:		}
 496:	
 497:		/* the I/O buffer must be mapped/unmapped, except when length=0 */
 498:		if (urb->transfer_buffer_length > INT_MAX)
 499:			return -EMSGSIZE;
 500:	
 501:		/*
 502:		 * stuff that drivers shouldn't do, but which shouldn't
 503:		 * cause problems in HCDs if they get it wrong.
 504:		 */
 505:	
 506:		/* Check that the pipe's type matches the endpoint's type */
 507:		if (usb_pipe_type_check(urb->dev, urb->pipe))
 508:			dev_warn_once(&dev->dev, "BOGUS urb xfer, pipe %x != type %x\n",
 509:				usb_pipetype(urb->pipe), pipetypes[xfertype]);
 510:	
 511:		/* Check against a simple/standard policy */
 512:		allowed = (URB_NO_TRANSFER_DMA_MAP | URB_NO_INTERRUPT | URB_DIR_MASK |
 513:				URB_FREE_BUFFER);
 514:		switch (xfertype) {
 515:		case USB_ENDPOINT_XFER_BULK:
 516:		case USB_ENDPOINT_XFER_INT:
 517:			if (is_out)
 518:				allowed |= URB_ZERO_PACKET;
 519:			fallthrough;
 520:		default:			/* all non-iso endpoints */
 521:			if (!is_out)
 522:				allowed |= URB_SHORT_NOT_OK;
 523:			break;
 524:		case USB_ENDPOINT_XFER_ISOC:
 525:			allowed |= URB_ISO_ASAP;
 526:			break;
 527:		}
 528:		allowed &= urb->transfer_flags;
 529:	
 530:		/* warn if submitter gave bogus flags */
 531:		if (allowed != urb->transfer_flags)
 532:			dev_WARN(&dev->dev, "BOGUS urb flags, %x --> %x\n",
 533:				urb->transfer_flags, allowed);
 534:	
 535:		/*
 536:		 * Force periodic transfer intervals to be legal values that are
 537:		 * a power of two (so HCDs don't need to).
 538:		 *
 539:		 * FIXME want bus->{intr,iso}_sched_horizon values here.  Each HC
 540:		 * supports different values... this uses EHCI/UHCI defaults (and
 541:		 * EHCI can use smaller non-default values).
 542:		 */
 543:		switch (xfertype) {
 544:		case USB_ENDPOINT_XFER_ISOC:
 545:		case USB_ENDPOINT_XFER_INT:
 546:			/* too small? */
 547:			if (urb->interval <= 0)
 548:				return -EINVAL;
 549:	
 550:			/* too big? */
 551:			switch (dev->speed) {
 552:			case USB_SPEED_SUPER_PLUS:
 553:			case USB_SPEED_SUPER:	/* units are 125us */
 554:				/* Handle up to 2^(16-1) microframes */
 555:				if (urb->interval > (1 << 15))
 556:					return -EINVAL;
 557:				max = 1 << 15;
 558:				break;
 559:			case USB_SPEED_HIGH:	/* units are microframes */
 560:				/* NOTE usb handles 2^15 */
 561:				if (urb->interval > (1024 * 8))
 562:					urb->interval = 1024 * 8;
 563:				max = 1024 * 8;
 564:				break;
 565:			case USB_SPEED_FULL:	/* units are frames/msec */
 566:			case USB_SPEED_LOW:
 567:				if (xfertype == USB_ENDPOINT_XFER_INT) {
 568:					if (urb->interval > 255)
 569:						return -EINVAL;
 570:					/* NOTE ohci only handles up to 32 */
 571:					max = 128;
 572:				} else {
 573:					if (urb->interval > 1024)
 574:						urb->interval = 1024;
 575:					/* NOTE usb and ohci handle up to 2^15 */
 576:					max = 1024;
 577:				}
 578:				break;
 579:			default:
 580:				return -EINVAL;
 581:			}
 582:			/* Round down to a power of 2, no more than max */
 583:			urb->interval = min(max, 1 << ilog2(urb->interval));
 584:		}
 585:	
 586:		return usb_hcd_submit_urb(urb, mem_flags);
 587:	}
 SourceFile:drivers/usb/core/urb.c]

gemini-3.1-pro-preview

							input: 276673
							output: 60
							thoughts: 1772
						

**Analyzing the USB Driver's Behavior**

Okay, let's break this down. First, this `usb_pipe_type_check` function... it seems backwards. It *returns true* if the pipe and endpoint types *don't match*. And it's only a warning! So, a mismatched URB submission is allowed, which means we can submit a bulk URB to a control endpoint. Let's trace it. It seems we'll end up with an attempt to execute on setup packet. Since we use `usb_fill_bulk_urb` which set setup packet to `NULL`, `usb_submit_urb` will return `-ENOEXEC`. The consequence of this is that the `rtl_usb_start` will fail to start the device.

But hang on, `rtl_usb_start` is *not* called directly from `rtl_usb_probe`. It's brought up by `mac80211`, so a failure there means the interface won't initialize. Okay, not a crash. Let's re-examine `_rtl_usb_receive`. It allocates, prepares, and submits URBs. If the `usb_submit_urb` call fails, it unanchors and frees the URB, and then bails out. So, it's safe.

Now, let's look closer at those endpoints. If `rtlusb->in_ep_nums` is zero, we get a zero `rtlusb->in_ep`. If it's *not* zero, but we pick the wrong endpoint... Hmm, the reproducer uses `rtl8192cu`. Let's grab the descriptor. No interface descriptor. If there is no interface descriptor, `intf->altsetting` will have zero endpoints. `usb_intf->cur_altsetting->desc.bNumEndpoints` will be zero. `epnums` will be zero. Therefore, both `rtlusb->in_ep_nums` and `rtlusb->out_ep_nums` will be zero. But, the init function checks, and bails out if it doesn't find at least one output endpoint, returning `-EINVAL`. This means `rtl_usb_probe` will fail, with `-ENODEV`, and the device won't even *probe* successfully!

Wait, let's double-check the reproducer, again. The first device is `rt2500usb`. Same story - no interface descriptor. So, same outcome. The device won't probe correctly. 

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c IncludeLines:true Name:rt2500usb_probe]

map[SourceCode:1967:	static int rt2500usb_probe(struct usb_interface *usb_intf,
1968:				   const struct usb_device_id *id)
1969:	{
1970:		return rt2x00usb_probe(usb_intf, &rt2500usb_ops);
1971:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c]

gemini-3.1-pro-preview

							input: 279190
							output: 60
							thoughts: 14
						

Okay, here's my take on those thoughts, tailored for an expert audience, presented in the first person:

**Diving into `rt2x00usb_probe`**

Alright, let's get down to brass tacks. I need to refresh my memory and dissect the `rt2x00usb_probe` function. This is where the magic (or the misery!) begins, the entry point for handling this specific USB-connected wireless adapter. I'm going to start by tracing the execution flow here; it will allow me to refresh on what's handled at the driver level. I need to ensure the correct hardware initialization sequence is in place. Is it doing the USB device enumeration correctly? Power cycling in the appropriate manner?

I’ll pay close attention to the resource allocation – interrupt requests, DMA channels, and memory. I need to be sure everything is being requested, acquired, and released properly, looking for any potential race conditions or resource leaks. Are the USB descriptors being parsed correctly? Any potential off-by-one errors in buffer sizing? Are we handling the control transfers (configuration, etc.) appropriately, including error handling?

I'll be mindful of the different chips that it's designed to support, is there a specific conditional path for a particular rev? What's the error handling like in this function? Any potential for buffer overflows? What about the device's specific quirks; are they accounted for correctly and properly handled? I need to ascertain that the device is correctly identified, configured, and ready to go before we return. This is the foundation; a shaky `probe` means a flaky driver, and I can't let that happen!

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_probe]

map[SourceCode: 797:	int rt2x00usb_probe(struct usb_interface *usb_intf,
 798:			    const struct rt2x00_ops *ops)
 799:	{
 800:		struct usb_device *usb_dev = interface_to_usbdev(usb_intf);
 801:		struct ieee80211_hw *hw;
 802:		struct rt2x00_dev *rt2x00dev;
 803:		int retval;
 804:	
 805:		usb_reset_device(usb_dev);
 806:	
 807:		hw = ieee80211_alloc_hw(sizeof(struct rt2x00_dev), ops->hw);
 808:		if (!hw) {
 809:			rt2x00_probe_err("Failed to allocate hardware\n");
 810:			return -ENOMEM;
 811:		}
 812:	
 813:		usb_set_intfdata(usb_intf, hw);
 814:	
 815:		rt2x00dev = hw->priv;
 816:		rt2x00dev->dev = &usb_intf->dev;
 817:		rt2x00dev->ops = ops;
 818:		rt2x00dev->hw = hw;
 819:	
 820:		rt2x00_set_chip_intf(rt2x00dev, RT2X00_CHIP_INTF_USB);
 821:	
 822:		INIT_WORK(&rt2x00dev->rxdone_work, rt2x00usb_work_rxdone);
 823:		INIT_WORK(&rt2x00dev->txdone_work, rt2x00usb_work_txdone);
 824:	
 825:		retval = rt2x00usb_alloc_reg(rt2x00dev);
 826:		if (retval)
 827:			goto exit_free_device;
 828:	
 829:		rt2x00dev->anchor = devm_kmalloc(&usb_intf->dev,
 830:						sizeof(struct usb_anchor),
 831:						GFP_KERNEL);
 832:		if (!rt2x00dev->anchor) {
 833:			retval = -ENOMEM;
 834:			goto exit_free_reg;
 835:		}
 836:		init_usb_anchor(rt2x00dev->anchor);
 837:	
 838:		retval = rt2x00lib_probe_dev(rt2x00dev);
 839:		if (retval)
 840:			goto exit_free_anchor;
 841:	
 842:		return 0;
 843:	
 844:	exit_free_anchor:
 845:		usb_kill_anchored_urbs(rt2x00dev->anchor);
 846:	
 847:	exit_free_reg:
 848:		rt2x00usb_free_reg(rt2x00dev);
 849:	
 850:	exit_free_device:
 851:		ieee80211_free_hw(hw);
 852:		usb_set_intfdata(usb_intf, NULL);
 853:	
 854:		return retval;
 855:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3.1-pro-preview

							input: 280613
							output: 62
							thoughts: 35
						

Okay, here's my interpretation of those thoughts, framed as my own:

**Digging into rt2x00usb_probe**

Hold on a second...something feels off here. I was just looking at `rt2x00usb_probe`, and it doesn't seem to have any explicit checks for the device endpoints. That's unusual, and potentially problematic. It's a critical oversight if that's the case.

Okay, instead of getting hung up on that function, let's take a step back. I should probably focus on `rt2x00lib_probe_dev`. That looks like the more general, underlying function that is used for these kinds of device probes. That's likely where the real meat of the endpoint checks, or at least the setup to perform them, would be. Better to investigate the core library function. I will check there and see what is actually going on.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00lib_probe_dev]

map[SourceCode:1371:	/*
1372:	 * driver allocation handlers.
1373:	 */
1374:	int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
1375:	{
1376:		int retval = -ENOMEM;
1377:	
1378:		/*
1379:		 * Set possible interface combinations.
1380:		 */
1381:		rt2x00lib_set_if_combinations(rt2x00dev);
1382:	
1383:		/*
1384:		 * Allocate the driver data memory, if necessary.
1385:		 */
1386:		if (rt2x00dev->ops->drv_data_size > 0) {
1387:			rt2x00dev->drv_data = kzalloc(rt2x00dev->ops->drv_data_size,
1388:				                      GFP_KERNEL);
1389:			if (!rt2x00dev->drv_data) {
1390:				retval = -ENOMEM;
1391:				goto exit;
1392:			}
1393:		}
1394:	
1395:		spin_lock_init(&rt2x00dev->irqmask_lock);
1396:		mutex_init(&rt2x00dev->csr_mutex);
1397:		mutex_init(&rt2x00dev->conf_mutex);
1398:		INIT_LIST_HEAD(&rt2x00dev->bar_list);
1399:		spin_lock_init(&rt2x00dev->bar_list_lock);
1400:		hrtimer_setup(&rt2x00dev->txstatus_timer, hrtimer_dummy_timeout, CLOCK_MONOTONIC,
1401:			      HRTIMER_MODE_REL);
1402:	
1403:		set_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
1404:	
1405:		/*
1406:		 * Make room for rt2x00_intf inside the per-interface
1407:		 * structure ieee80211_vif.
1408:		 */
1409:		rt2x00dev->hw->vif_data_size = sizeof(struct rt2x00_intf);
1410:	
1411:		/*
1412:		 * rt2x00 devices can only use the last n bits of the MAC address
1413:		 * for virtual interfaces.
1414:		 */
1415:		rt2x00dev->hw->wiphy->addr_mask[ETH_ALEN - 1] =
1416:			(rt2x00dev->ops->max_ap_intf - 1);
1417:	
1418:		/*
1419:		 * Initialize work.
1420:		 */
1421:		rt2x00dev->workqueue =
1422:		    alloc_ordered_workqueue("%s", 0, wiphy_name(rt2x00dev->hw->wiphy));
1423:		if (!rt2x00dev->workqueue) {
1424:			retval = -ENOMEM;
1425:			goto exit;
1426:		}
1427:	
1428:		INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled);
1429:		INIT_DELAYED_WORK(&rt2x00dev->autowakeup_work, rt2x00lib_autowakeup);
1430:		INIT_WORK(&rt2x00dev->sleep_work, rt2x00lib_sleep);
1431:	
1432:		/*
1433:		 * Let the driver probe the device to detect the capabilities.
1434:		 */
1435:		retval = rt2x00dev->ops->lib->probe_hw(rt2x00dev);
1436:		if (retval) {
1437:			rt2x00_err(rt2x00dev, "Failed to allocate device\n");
1438:			goto exit;
1439:		}
1440:	
1441:		/*
1442:		 * Allocate queue array.
1443:		 */
1444:		retval = rt2x00queue_allocate(rt2x00dev);
1445:		if (retval)
1446:			goto exit;
1447:	
1448:		/* Cache TX headroom value */
1449:		rt2x00dev->extra_tx_headroom = rt2x00dev_extra_tx_headroom(rt2x00dev);
1450:	
1451:		/*
1452:		 * Determine which operating modes are supported, all modes
1453:		 * which require beaconing, depend on the availability of
1454:		 * beacon entries.
1455:		 */
1456:		rt2x00dev->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
1457:		if (rt2x00dev->bcn->limit > 0)
1458:			rt2x00dev->hw->wiphy->interface_modes |=
1459:			    BIT(NL80211_IFTYPE_ADHOC) |
1460:	#ifdef CONFIG_MAC80211_MESH
1461:			    BIT(NL80211_IFTYPE_MESH_POINT) |
1462:	#endif
1463:			    BIT(NL80211_IFTYPE_AP);
1464:	
1465:		rt2x00dev->hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
1466:	
1467:		wiphy_ext_feature_set(rt2x00dev->hw->wiphy,
1468:				      NL80211_EXT_FEATURE_CQM_RSSI_LIST);
1469:	
1470:		/*
1471:		 * Initialize ieee80211 structure.
1472:		 */
1473:		retval = rt2x00lib_probe_hw(rt2x00dev);
1474:		if (retval) {
1475:			rt2x00_err(rt2x00dev, "Failed to initialize hw\n");
1476:			goto exit;
1477:		}
1478:	
1479:		/*
1480:		 * Register extra components.
1481:		 */
1482:		rt2x00link_register(rt2x00dev);
1483:		rt2x00leds_register(rt2x00dev);
1484:		rt2x00debug_register(rt2x00dev);
1485:	
1486:		/*
1487:		 * Start rfkill polling.
1488:		 */
1489:		if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
1490:			rt2x00rfkill_register(rt2x00dev);
1491:	
1492:		return 0;
1493:	
1494:	exit:
1495:		rt2x00lib_remove_dev(rt2x00dev);
1496:	
1497:		return retval;
1498:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c]

gemini-3.1-pro-preview

							input: 283010
							output: 60
							thoughts: 42
						

Okay, let me think this through.

**Endpoint Conundrum**

Hmm, hold on a second. I'm revisiting the `rt2x00usb_probe` function. It seems like a crucial point was missed in its implementation. It doesn't appear to be checking the number of endpoints being used by the device during the probe. That’s a potential problem, if indeed the driver requires or expects specific endpoints. It’s certainly something I'd expect to see, particularly for USB drivers.

Does the driver *actually* use endpoints in a way that necessitates this check? That’s the next logical step in my thought process. If it doesn't utilize endpoints, this oversight might not be significant. If it *does* use them, then we have a potential vulnerability.

Let's quickly check `rt2x00queue_allocate` to see how queues and endpoints interact. It's likely where the allocation and configuration, therefore dependency, on specific endpoints would occur if they are indeed in use. I'll need to confirm if it makes assumptions about endpoints and if this is a possible bug in the implementation of probe.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00queue.c IncludeLines:true Name:rt2x00queue_allocate]

map[SourceCode:1231:	int rt2x00queue_allocate(struct rt2x00_dev *rt2x00dev)
1232:	{
1233:		struct data_queue *queue;
1234:		enum data_queue_qid qid;
1235:		unsigned int req_atim =
1236:		    rt2x00_has_cap_flag(rt2x00dev, REQUIRE_ATIM_QUEUE);
1237:	
1238:		/*
1239:		 * We need the following queues:
1240:		 * RX: 1
1241:		 * TX: ops->tx_queues
1242:		 * Beacon: 1
1243:		 * Atim: 1 (if required)
1244:		 */
1245:		rt2x00dev->data_queues = 2 + rt2x00dev->ops->tx_queues + req_atim;
1246:	
1247:		queue = kzalloc_objs(*queue, rt2x00dev->data_queues);
1248:		if (!queue)
1249:			return -ENOMEM;
1250:	
1251:		/*
1252:		 * Initialize pointers
1253:		 */
1254:		rt2x00dev->rx = queue;
1255:		rt2x00dev->tx = &queue[1];
1256:		rt2x00dev->bcn = &queue[1 + rt2x00dev->ops->tx_queues];
1257:		rt2x00dev->atim = req_atim ? &queue[2 + rt2x00dev->ops->tx_queues] : NULL;
1258:	
1259:		/*
1260:		 * Initialize queue parameters.
1261:		 * RX: qid = QID_RX
1262:		 * TX: qid = QID_AC_VO + index
1263:		 * TX: cw_min: 2^5 = 32.
1264:		 * TX: cw_max: 2^10 = 1024.
1265:		 * BCN: qid = QID_BEACON
1266:		 * ATIM: qid = QID_ATIM
1267:		 */
1268:		rt2x00queue_init(rt2x00dev, rt2x00dev->rx, QID_RX);
1269:	
1270:		qid = QID_AC_VO;
1271:		tx_queue_for_each(rt2x00dev, queue)
1272:			rt2x00queue_init(rt2x00dev, queue, qid++);
1273:	
1274:		rt2x00queue_init(rt2x00dev, rt2x00dev->bcn, QID_BEACON);
1275:		if (req_atim)
1276:			rt2x00queue_init(rt2x00dev, rt2x00dev->atim, QID_ATIM);
1277:	
1278:		return 0;
1279:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00queue.c]

gemini-3.1-pro-preview

							input: 284255
							output: 60
							thoughts: 37
						

Okay, let's break this down.

**Initial Assessment of Queue Initialization**

Hmm, the name `rt2x00queue_init` strongly suggests this function is responsible for initializing the queue. The question that immediately springs to mind, given the context, is: does this initialization *also* involve allocating USB Request Blocks (URBs)? That's the crux of this. My gut says it probably does, but I need to confirm. Let's get into the code and see exactly what `rt2x00queue_init` is doing. I need to examine its implementation to understand how it's handling URB allocation, if at all. Time to dive in.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00queue.c IncludeLines:true Name:rt2x00queue_init]

map[SourceCode:1212:	static void rt2x00queue_init(struct rt2x00_dev *rt2x00dev,
1213:				     struct data_queue *queue, enum data_queue_qid qid)
1214:	{
1215:		mutex_init(&queue->status_lock);
1216:		spin_lock_init(&queue->tx_lock);
1217:		spin_lock_init(&queue->index_lock);
1218:	
1219:		queue->rt2x00dev = rt2x00dev;
1220:		queue->qid = qid;
1221:		queue->txop = 0;
1222:		queue->aifs = 2;
1223:		queue->cw_min = 5;
1224:		queue->cw_max = 10;
1225:	
1226:		rt2x00dev->ops->queue_init(queue);
1227:	
1228:		queue->threshold = DIV_ROUND_UP(queue->limit, 10);
1229:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00queue.c]

gemini-3.1-pro-preview

							input: 284839
							output: 62
							thoughts: 29
						

Here's my summary, as the thought process unfolds:

**Digging into the Wireless Driver Initialization**

Okay, so I'm looking at the initialization sequence here, specifically within this wireless driver. It seems we have a call to `rt2x00dev->ops->queue_init(queue)`. The `->ops` pointer is definitely pointing to a function table, and this `queue_init` entry is what's being invoked. Alright, let's see where that takes us...Ah, here it is, the implementation is `rt2500usb_queue_init`. That's the specific USB-related queue initialization routine for this particular chip. So, we're diving into the USB-specific details now, getting those data transfer queues setup and ready to go for the device.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c IncludeLines:true Name:rt2500usb_queue_init]

map[SourceCode:1851:	static void rt2500usb_queue_init(struct data_queue *queue)
1852:	{
1853:		switch (queue->qid) {
1854:		case QID_RX:
1855:			queue->limit = 32;
1856:			queue->data_size = DATA_FRAME_SIZE;
1857:			queue->desc_size = RXD_DESC_SIZE;
1858:			queue->priv_size = sizeof(struct queue_entry_priv_usb);
1859:			break;
1860:	
1861:		case QID_AC_VO:
1862:		case QID_AC_VI:
1863:		case QID_AC_BE:
1864:		case QID_AC_BK:
1865:			queue->limit = 32;
1866:			queue->data_size = DATA_FRAME_SIZE;
1867:			queue->desc_size = TXD_DESC_SIZE;
1868:			queue->priv_size = sizeof(struct queue_entry_priv_usb);
1869:			break;
1870:	
1871:		case QID_BEACON:
1872:			queue->limit = 1;
1873:			queue->data_size = MGMT_FRAME_SIZE;
1874:			queue->desc_size = TXD_DESC_SIZE;
1875:			queue->priv_size = sizeof(struct queue_entry_priv_usb_bcn);
1876:			break;
1877:	
1878:		case QID_ATIM:
1879:			queue->limit = 8;
1880:			queue->data_size = DATA_FRAME_SIZE;
1881:			queue->desc_size = TXD_DESC_SIZE;
1882:			queue->priv_size = sizeof(struct queue_entry_priv_usb);
1883:			break;
1884:	
1885:		default:
1886:			BUG();
1887:			break;
1888:		}
1889:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c]

gemini-3.1-pro-preview

							input: 285719
							output: 62
							thoughts: 43
						

Okay, here's my interpretation of those thoughts, presented as my own mental process, with the assumed expertise in the field:

**Digging into the rt2x00usb Driver**

Right, so I was looking at the `rt2x00usb_probe` function and realized something immediately off: I can't see the URBs being allocated there. That's a key function for initialization, so it *should* handle the URB allocation, or at least call something which does. I'm sure I'm missing something, perhaps I'm forgetting something obvious.

This is a problem; if the URBs aren't allocated at probe, where are they? It's not allocated at the probe which is supposed to be the "setup" phase of the driver.

Okay, let's back up a step and see what `rt2x00lib_probe_hw` is doing. It's the logical next place to check within the rt2x00 driver architecture. I'm betting that's where the allocation is taking place. That's a good starting point to trace the call. Let's see if that's the place that manages all of the URBs.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00lib_probe_hw]

map[SourceCode:1117:	static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
1118:	{
1119:		struct hw_mode_spec *spec = &rt2x00dev->spec;
1120:		int status;
1121:	
1122:		if (test_bit(DEVICE_STATE_REGISTERED_HW, &rt2x00dev->flags))
1123:			return 0;
1124:	
1125:		/*
1126:		 * Initialize HW modes.
1127:		 */
1128:		status = rt2x00lib_probe_hw_modes(rt2x00dev, spec);
1129:		if (status)
1130:			return status;
1131:	
1132:		/*
1133:		 * Initialize HW fields.
1134:		 */
1135:		rt2x00dev->hw->queues = rt2x00dev->ops->tx_queues;
1136:	
1137:		/*
1138:		 * Initialize extra TX headroom required.
1139:		 */
1140:		rt2x00dev->hw->extra_tx_headroom =
1141:			max_t(unsigned int, IEEE80211_TX_STATUS_HEADROOM,
1142:			      rt2x00dev->extra_tx_headroom);
1143:	
1144:		/*
1145:		 * Take TX headroom required for alignment into account.
1146:		 */
1147:		if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_L2PAD))
1148:			rt2x00dev->hw->extra_tx_headroom += RT2X00_L2PAD_SIZE;
1149:		else if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DMA))
1150:			rt2x00dev->hw->extra_tx_headroom += RT2X00_ALIGN_SIZE;
1151:	
1152:		/*
1153:		 * Tell mac80211 about the size of our private STA structure.
1154:		 */
1155:		rt2x00dev->hw->sta_data_size = sizeof(struct rt2x00_sta);
1156:	
1157:		/*
1158:		 * Allocate tx status FIFO for driver use.
1159:		 */
1160:		if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_TXSTATUS_FIFO)) {
1161:			/*
1162:			 * Allocate the txstatus fifo. In the worst case the tx
1163:			 * status fifo has to hold the tx status of all entries
1164:			 * in all tx queues. Hence, calculate the kfifo size as
1165:			 * tx_queues * entry_num and round up to the nearest
1166:			 * power of 2.
1167:			 */
1168:			int kfifo_size =
1169:				roundup_pow_of_two(rt2x00dev->ops->tx_queues *
1170:						   rt2x00dev->tx->limit *
1171:						   sizeof(u32));
1172:	
1173:			status = kfifo_alloc(&rt2x00dev->txstatus_fifo, kfifo_size,
1174:					     GFP_KERNEL);
1175:			if (status)
1176:				return status;
1177:		}
1178:	
1179:		/*
1180:		 * Initialize tasklets if used by the driver. Tasklets are
1181:		 * disabled until the interrupts are turned on. The driver
1182:		 * has to handle that.
1183:		 */
1184:	#define RT2X00_TASKLET_INIT(taskletname) \
1185:		if (rt2x00dev->ops->lib->taskletname) { \
1186:			tasklet_setup(&rt2x00dev->taskletname, \
1187:				     rt2x00dev->ops->lib->taskletname); \
1188:		}
1189:	
1190:		RT2X00_TASKLET_INIT(txstatus_tasklet);
1191:		RT2X00_TASKLET_INIT(pretbtt_tasklet);
1192:		RT2X00_TASKLET_INIT(tbtt_tasklet);
1193:		RT2X00_TASKLET_INIT(rxdone_tasklet);
1194:		RT2X00_TASKLET_INIT(autowake_tasklet);
1195:	
1196:	#undef RT2X00_TASKLET_INIT
1197:	
1198:		ieee80211_create_tpt_led_trigger(rt2x00dev->hw,
1199:						 IEEE80211_TPT_LEDTRIG_FL_RADIO,
1200:						 rt2x00_tpt_blink,
1201:						 ARRAY_SIZE(rt2x00_tpt_blink));
1202:	
1203:		/*
1204:		 * Register HW.
1205:		 */
1206:		status = ieee80211_register_hw(rt2x00dev->hw);
1207:		if (status)
1208:			return status;
1209:	
1210:		set_bit(DEVICE_STATE_REGISTERED_HW, &rt2x00dev->flags);
1211:	
1212:		return 0;
1213:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c]

gemini-3.1-pro-preview

							input: 287709
							output: 60
							thoughts: 45
						

**Analyzing the USB Initialization Sequence**

Okay, hold on a second. It seems my initial assumption about `rt2x00usb_probe` allocating the USB Request Blocks (URBs) is incorrect. I distinctly remember that's not where they get set up. URB allocation happens later, during interface bring-up. That makes more sense; the probe function should be focused on basic device detection and setup, not resource allocation, which would be better handled during the active connection phase.

Alright, if URBs aren't allocated in `rt2x00usb_probe`, then the initialization process must be deferred. The logical next step is to examine `rt2x00usb_initialize`. I'll have to delve into that function to understand precisely how and when those URBs are allocated, what their purpose is in this context, and what data structures they're associated with. Let's see what `rt2x00usb_initialize` reveals. That should provide the missing piece of the puzzle.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_initialize]

map[SourceCode: 714:	int rt2x00usb_initialize(struct rt2x00_dev *rt2x00dev)
 715:	{
 716:		struct data_queue *queue;
 717:		int status;
 718:	
 719:		/*
 720:		 * Find endpoints for each queue
 721:		 */
 722:		status = rt2x00usb_find_endpoints(rt2x00dev);
 723:		if (status)
 724:			goto exit;
 725:	
 726:		/*
 727:		 * Allocate DMA
 728:		 */
 729:		queue_for_each(rt2x00dev, queue) {
 730:			status = rt2x00usb_alloc_entries(queue);
 731:			if (status)
 732:				goto exit;
 733:		}
 734:	
 735:		return 0;
 736:	
 737:	exit:
 738:		rt2x00usb_uninitialize(rt2x00dev);
 739:	
 740:		return status;
 741:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3.1-pro-preview

							input: 288413
							output: 62
							thoughts: 15
						

Okay, here's my attempt at summarizing that thought process, tailored for an expert user and in the first person:

**Endpoint Discovery: rt2x00usb_find_endpoints**

Alright, *rt2x00usb_find_endpoints*… let's see. This is where we're going to nail down the specific endpoints the driver needs to talk to the hardware, right? Gotta get those pipe handles straight so we can actually move data. I'm thinking, this function likely iterates through the device descriptor, maybe checking for specific interface configurations, and then matching them to the endpoints we're interested in: the bulk IN/OUT for data transfer, interrupt IN, control pipe… the usual suspects for a USB network adapter. Depending on the device's setup, there might be some conditional logic in here based on the device ID or interface number to handle different revisions or models of the RT2x00 chipset. I hope it's well-commented because endpoint selection can get pretty hairy with some of these obscure devices! Gotta make sure we're getting the right endpoints and not just some generic control endpoint.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_find_endpoints]

map[SourceCode: 599:	static int rt2x00usb_find_endpoints(struct rt2x00_dev *rt2x00dev)
 600:	{
 601:		struct usb_interface *intf = to_usb_interface(rt2x00dev->dev);
 602:		struct usb_host_interface *intf_desc = intf->cur_altsetting;
 603:		struct usb_endpoint_descriptor *ep_desc;
 604:		struct data_queue *queue = rt2x00dev->tx;
 605:		struct usb_endpoint_descriptor *tx_ep_desc = NULL;
 606:		unsigned int i;
 607:	
 608:		/*
 609:		 * Walk through all available endpoints to search for "bulk in"
 610:		 * and "bulk out" endpoints. When we find such endpoints collect
 611:		 * the information we need from the descriptor and assign it
 612:		 * to the queue.
 613:		 */
 614:		for (i = 0; i < intf_desc->desc.bNumEndpoints; i++) {
 615:			ep_desc = &intf_desc->endpoint[i].desc;
 616:	
 617:			if (usb_endpoint_is_bulk_in(ep_desc)) {
 618:				rt2x00usb_assign_endpoint(rt2x00dev->rx, ep_desc);
 619:			} else if (usb_endpoint_is_bulk_out(ep_desc) &&
 620:				   (queue != queue_end(rt2x00dev))) {
 621:				rt2x00usb_assign_endpoint(queue, ep_desc);
 622:				queue = queue_next(queue);
 623:	
 624:				tx_ep_desc = ep_desc;
 625:			}
 626:		}
 627:	
 628:		/*
 629:		 * At least 1 endpoint for RX and 1 endpoint for TX must be available.
 630:		 */
 631:		if (!rt2x00dev->rx->usb_endpoint || !rt2x00dev->tx->usb_endpoint) {
 632:			rt2x00_err(rt2x00dev, "Bulk-in/Bulk-out endpoints not found\n");
 633:			return -EPIPE;
 634:		}
 635:	
 636:		/*
 637:		 * It might be possible not all queues have a dedicated endpoint.
 638:		 * Loop through all TX queues and copy the endpoint information
 639:		 * which we have gathered from already assigned endpoints.
 640:		 */
 641:		txall_queue_for_each(rt2x00dev, queue) {
 642:			if (!queue->usb_endpoint)
 643:				rt2x00usb_assign_endpoint(queue, tx_ep_desc);
 644:		}
 645:	
 646:		return 0;
 647:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3.1-pro-preview

							input: 289605
							output: 62
							thoughts: 169
						

**Analyzing the Initialization Flow**

Okay, so I'm looking at this `rt2x00usb_find_endpoints` function. I see it specifically checks if `rt2x00dev->rx->usb_endpoint` is NULL, which makes sense. Then I see that if `intf_desc->desc.bNumEndpoints` is 0, it'll return `-EPIPE`. That's a classic USB error, so far, so good.

Right, so that error propagates back up. If it does indeed return `-EPIPE`, it means `rt2x00usb_initialize` will fail. Now I have to backtrack a bit. When *is* `rt2x00usb_initialize` called? Let me refresh my memory of the call stack. Hmm, is it from `rt2x00lib_probe_dev`? No, no, that's not quite right. `rt2x00lib_probe_dev` actually calls `rt2x00dev->ops->lib->probe_hw(rt2x00dev)` which I believe is specific to the hardware. OK, so I guess the `probe_hw` function is what I need to look at. Ah, yes, it seems to be `rt2500usb_probe_hw` in this particular case. So, now I know the error path.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c IncludeLines:true Name:rt2500usb_probe_hw]

map[SourceCode:1745:	static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev)
1746:	{
1747:		int retval;
1748:		u16 reg;
1749:	
1750:		/*
1751:		 * Allocate eeprom data.
1752:		 */
1753:		retval = rt2500usb_validate_eeprom(rt2x00dev);
1754:		if (retval)
1755:			return retval;
1756:	
1757:		retval = rt2500usb_init_eeprom(rt2x00dev);
1758:		if (retval)
1759:			return retval;
1760:	
1761:		/*
1762:		 * Enable rfkill polling by setting GPIO direction of the
1763:		 * rfkill switch GPIO pin correctly.
1764:		 */
1765:		reg = rt2500usb_register_read(rt2x00dev, MAC_CSR19);
1766:		rt2x00_set_field16(&reg, MAC_CSR19_DIR0, 0);
1767:		rt2500usb_register_write(rt2x00dev, MAC_CSR19, reg);
1768:	
1769:		/*
1770:		 * Initialize hw specifications.
1771:		 */
1772:		retval = rt2500usb_probe_hw_mode(rt2x00dev);
1773:		if (retval)
1774:			return retval;
1775:	
1776:		/*
1777:		 * This device requires the atim queue
1778:		 */
1779:		__set_bit(REQUIRE_ATIM_QUEUE, &rt2x00dev->cap_flags);
1780:		__set_bit(REQUIRE_BEACON_GUARD, &rt2x00dev->cap_flags);
1781:		if (!modparam_nohwcrypt) {
1782:			__set_bit(CAPABILITY_HW_CRYPTO, &rt2x00dev->cap_flags);
1783:			__set_bit(REQUIRE_COPY_IV, &rt2x00dev->cap_flags);
1784:		}
1785:		__set_bit(REQUIRE_SW_SEQNO, &rt2x00dev->cap_flags);
1786:		__set_bit(REQUIRE_PS_AUTOWAKE, &rt2x00dev->cap_flags);
1787:	
1788:		/*
1789:		 * Set the rssi offset.
1790:		 */
1791:		rt2x00dev->rssi_offset = DEFAULT_RSSI_OFFSET;
1792:	
1793:		return 0;
1794:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c]

gemini-3.1-pro-preview

							input: 290966
							output: 26
							thoughts: 37
						

Okay, here's my interpretation of those thoughts, framed as my own:

**Investigating the USB Initialization in RT2x00USB**

Right, something's not quite right. I was expecting `rt2x00usb_initialize` to be invoked directly from `probe_hw`, but that doesn't seem to be the case when I trace it. Hmm... where *is* this function being called from? It has to be getting initialized somewhere, or the USB interface wouldn't be working at all. I need to trace the call paths to determine the actual entry point for `rt2x00usb_initialize` within the driver's initialization sequence. I'm going to have to dig through the source code and find the missing link in the chain. Is there a wrapper function or a different initialization routine that sets things up before `rt2x00usb_initialize` is finally called? Let me get cracking.

map[Name:rt2x00usb_initialize]

map[References:<nil> TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 291245
							output: 26
							thoughts: 45
						

Here's my take on the thought process:

**Diving into the rt2x00usb Initialization**

Okay, so I'm trying to trace the initialization sequence, and it's nagging at me that `rt2x00usb_initialize` seems to be called indirectly, probably through `rt2x00lib_start` or a similar function. That's the feeling I'm getting anyway. Let's not rely on memory though, it's time to verify this and get a clear picture of the call chain. I'll need to confirm exactly *where* that initialization function is being invoked. Let's start by methodically searching for references to `rt2x00usb_initialize`. That should illuminate the calling context and reveal the true initialization sequence.

map[Name:rt2x00usb_initialize]

map[References:<nil> TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 291501
							output: 22
							thoughts: 57
						

**Debugging a Stubborn Reference Search**

Okay, so `codesearch-find-references` drew a blank. That's not what I expected. Time to dive deeper. Let me see... I'll check the `rt2x00usb_initialize` function, specifically in `drivers/net/wireless/ralink/rt2x00/rt2x00usb.c`. That should be the right place to start looking for why the initial search failed. Let's see what's actually going on there. I'm sure there's a reason, and a good look at this should provide some insight.

map[Expression:rt2x00usb_initialize]

map[Output:drivers/net/wireless/ralink/rt2x00/rt2500usb.c=1824=static const struct rt2x00lib_ops rt2500usb_rt2x00_ops = {
drivers/net/wireless/ralink/rt2x00/rt2500usb.c-1825-	.probe_hw		= rt2500usb_probe_hw,
drivers/net/wireless/ralink/rt2x00/rt2500usb.c:1826:	.initialize		= rt2x00usb_initialize,
drivers/net/wireless/ralink/rt2x00/rt2500usb.c-1827-	.uninitialize		= rt2x00usb_uninitialize,
--
drivers/net/wireless/ralink/rt2x00/rt2800usb.c=681=static const struct rt2x00lib_ops rt2800usb_rt2x00_ops = {
--
drivers/net/wireless/ralink/rt2x00/rt2800usb.c-685-	.load_firmware		= rt2800_load_firmware,
drivers/net/wireless/ralink/rt2x00/rt2800usb.c:686:	.initialize		= rt2x00usb_initialize,
drivers/net/wireless/ralink/rt2x00/rt2800usb.c-687-	.uninitialize		= rt2x00usb_uninitialize,
--
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c=682=static void rt2x00usb_free_entries(struct data_queue *queue)
--
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c-713-
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c:714:int rt2x00usb_initialize(struct rt2x00_dev *rt2x00dev)
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c-715-{
--
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c-741-}
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c:742:EXPORT_SYMBOL_GPL(rt2x00usb_initialize);
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c-743-
--
drivers/net/wireless/ralink/rt2x00/rt2x00usb.h=391=void rt2x00usb_clear_entry(struct queue_entry *entry);
drivers/net/wireless/ralink/rt2x00/rt2x00usb.h:392:int rt2x00usb_initialize(struct rt2x00_dev *rt2x00dev);
drivers/net/wireless/ralink/rt2x00/rt2x00usb.h-393-void rt2x00usb_uninitialize(struct rt2x00_dev *rt2x00dev);
--
drivers/net/wireless/ralink/rt2x00/rt73usb.c=2322=static const struct rt2x00lib_ops rt73usb_rt2x00_ops = {
--
drivers/net/wireless/ralink/rt2x00/rt73usb.c-2326-	.load_firmware		= rt73usb_load_firmware,
drivers/net/wireless/ralink/rt2x00/rt73usb.c:2327:	.initialize		= rt2x00usb_initialize,
drivers/net/wireless/ralink/rt2x00/rt73usb.c-2328-	.uninitialize		= rt2x00usb_uninitialize,
]

gemini-3.1-pro-preview

							input: 292739
							output: 16
							thoughts: 36
						

Okay, here's my interpretation of that thought process, from an expert's perspective:

**Deconstructing the RT2x00USB Initialization Flow**

Alright, let's break this down. We've got `rt2x00usb_initialize` being invoked as `rt2x00dev->ops->lib->initialize`. That's standard driver structure, makes sense. It's a method call, probably a function pointer, assigned within some earlier setup phase. Now, the key question becomes *when* does this initialization actually get triggered? I need to understand the lifecycle of this driver to trace back the call stack and identify the specific event or process that leads to `initialize` being executed. Is it during device probe? Perhaps after firmware loading? Or is it something more nuanced, tied to power management or interface bring-up? Understanding the call context is crucial for understanding its intended behavior and potential issues. I need to dig deeper into the code that sets up `rt2x00dev->ops->lib`, look for the code responsible for the device probe, or similar events, and see where the actual `initialize` method is getting called.

map[Expression:\.initialize]

map[Output:
Full output is too long, showing 500 out of 1511 lines.
Use more precise expression if possible.

[arch/arm64/kvm/vgic/vgic-debug.c=234=static int vgic_debug_show(struct seq_file *s, void *v)
 --
 arch/arm64/kvm/vgic/vgic-debug.c-246-
 arch/arm64/kvm/vgic/vgic-debug.c:247:	if (!kvm->arch.vgic.initialized)
 arch/arm64/kvm/vgic/vgic-debug.c-248-		return 0;
 --
 arch/m68k/kernel/setup_mm.c=593=const struct nvram_ops arch_nvram_ops = {
 --
 arch/m68k/kernel/setup_mm.c-601-	.set_checksum   = m68k_nvram_set_checksum,
 arch/m68k/kernel/setup_mm.c:602:	.initialize     = m68k_nvram_initialize,
 arch/m68k/kernel/setup_mm.c-603-#endif
 --
 arch/riscv/include/asm/kvm_aia.h=62=struct kvm_vcpu_aia {
 --
 arch/riscv/include/asm/kvm_aia.h-77-
 arch/riscv/include/asm/kvm_aia.h:78:#define kvm_riscv_aia_initialized(k)	((k)->arch.aia.initialized)
 arch/riscv/include/asm/kvm_aia.h-79-
 --
 arch/riscv/kvm/aia_device.c=226=static int aia_init(struct kvm *kvm)
 --
 arch/riscv/kvm/aia_device.c-284-	/* Set the initialized flag */
 arch/riscv/kvm/aia_device.c:285:	kvm->arch.aia.initialized = true;
 arch/riscv/kvm/aia_device.c-286-
 --
 arch/x86/kernel/cpu/mce/core.c=1554=noinstr void do_machine_check(struct pt_regs *regs)
 --
 arch/x86/kernel/cpu/mce/core.c-1567-		return winchip_machine_check(regs);
 arch/x86/kernel/cpu/mce/core.c:1568:	else if (unlikely(!mca_cfg.initialized))
 arch/x86/kernel/cpu/mce/core.c-1569-		return unexpected_machine_check(regs);
 --
 arch/x86/kernel/cpu/mce/core.c=2134=static __always_inline void exc_machine_check_kernel(struct pt_regs *regs)
 --
 arch/x86/kernel/cpu/mce/core.c-2143-	 */
 arch/x86/kernel/cpu/mce/core.c:2144:	if (mca_cfg.initialized && mce_check_crashing_cpu())
 arch/x86/kernel/cpu/mce/core.c-2145-		return;
 --
 arch/x86/kernel/cpu/mce/core.c=2274=void mcheck_cpu_init(struct cpuinfo_x86 *c)
 --
 arch/x86/kernel/cpu/mce/core.c-2292-
 arch/x86/kernel/cpu/mce/core.c:2293:	mca_cfg.initialized = 1;
 arch/x86/kernel/cpu/mce/core.c-2294-
 --
 arch/x86/kvm/svm/nested.c=1089=int nested_svm_vmrun(struct kvm_vcpu *vcpu)
 --
 arch/x86/kvm/svm/nested.c-1112-
 arch/x86/kvm/svm/nested.c:1113:	if (WARN_ON_ONCE(!svm->nested.initialized))
 arch/x86/kvm/svm/nested.c-1114-		return -EINVAL;
 --
 arch/x86/kvm/svm/nested.c=1448=int svm_allocate_nested(struct vcpu_svm *svm)
 --
 arch/x86/kvm/svm/nested.c-1451-
 arch/x86/kvm/svm/nested.c:1452:	if (svm->nested.initialized)
 arch/x86/kvm/svm/nested.c-1453-		return 0;
 --
 arch/x86/kvm/svm/nested.c-1464-
 arch/x86/kvm/svm/nested.c:1465:	svm->nested.initialized = true;
 arch/x86/kvm/svm/nested.c-1466-	return 0;
 --
 arch/x86/kvm/svm/nested.c=1473=void svm_free_nested(struct vcpu_svm *svm)
 arch/x86/kvm/svm/nested.c-1474-{
 arch/x86/kvm/svm/nested.c:1475:	if (!svm->nested.initialized)
 arch/x86/kvm/svm/nested.c-1476-		return;
 --
 arch/x86/kvm/svm/nested.c-1495-
 arch/x86/kvm/svm/nested.c:1496:	svm->nested.initialized = false;
 arch/x86/kvm/svm/nested.c-1497-}
 --
 drivers/acpi/device_pm.c=307=int acpi_bus_init_power(struct acpi_device *device)
 --
 drivers/acpi/device_pm.c-316-	if (!acpi_device_is_present(device)) {
 drivers/acpi/device_pm.c:317:		device->flags.initialized = false;
 drivers/acpi/device_pm.c-318-		return -ENXIO;
 --
 drivers/acpi/pci_link.c=526=static int acpi_pci_link_allocate(struct acpi_pci_link *link)
 --
 drivers/acpi/pci_link.c-531-
 drivers/acpi/pci_link.c:532:	if (link->irq.initialized) {
 drivers/acpi/pci_link.c-533-		if (link->refcnt == 0)
 --
 drivers/acpi/pci_link.c-594-
 drivers/acpi/pci_link.c:595:	link->irq.initialized = 1;
 drivers/acpi/pci_link.c-596-	return 0;
 --
 drivers/acpi/pci_link.c=666=int acpi_pci_link_free_irq(acpi_handle handle)
 --
 drivers/acpi/pci_link.c-682-	mutex_lock(&acpi_link_lock);
 drivers/acpi/pci_link.c:683:	if (!link->irq.initialized) {
 drivers/acpi/pci_link.c-684-		mutex_unlock(&acpi_link_lock);
 --
 drivers/acpi/pci_link.c=763=static int acpi_pci_link_resume(struct acpi_pci_link *link)
 drivers/acpi/pci_link.c-764-{
 drivers/acpi/pci_link.c:765:	if (link->refcnt && link->irq.active && link->irq.initialized)
 drivers/acpi/pci_link.c-766-		return (acpi_pci_link_set(link, link->irq.active));
 --
 drivers/acpi/scan.c=253=static int acpi_scan_check_and_detach(struct acpi_device *adev, void *p)
 --
 drivers/acpi/scan.c-287-	acpi_device_set_power(adev, ACPI_STATE_D3_COLD);
 drivers/acpi/scan.c:288:	adev->flags.initialized = false;
 drivers/acpi/scan.c-289-
 --
 drivers/acpi/scan.c=1804=void acpi_init_device_object(struct acpi_device *device, acpi_handle handle,
 --
 drivers/acpi/scan.c-1822-	device->flags.match_driver = false;
 drivers/acpi/scan.c:1823:	device->flags.initialized = true;
 drivers/acpi/scan.c-1824-	device->flags.enumeration_by_parent =
 --
 drivers/acpi/scan.c=2336=static int acpi_bus_attach(struct acpi_device *device, void *first_pass)
 --
 drivers/acpi/scan.c-2350-	if (!acpi_dev_ready_for_enumeration(device)) {
 drivers/acpi/scan.c:2351:		device->flags.initialized = false;
 drivers/acpi/scan.c-2352-		acpi_device_clear_enumerated(device);
 --
 drivers/acpi/scan.c-2360-
 drivers/acpi/scan.c:2361:	if (!device->flags.initialized) {
 drivers/acpi/scan.c-2362-		device->flags.power_manageable =
 --
 drivers/acpi/scan.c-2366-
 drivers/acpi/scan.c:2367:		device->flags.initialized = true;
 drivers/acpi/scan.c-2368-	} else if (device->flags.visited) {
 --
 drivers/android/binder/range_alloc/tree.rs=149=    pub(crate) fn reserve_new(
 --
 drivers/android/binder/range_alloc/tree.rs-177-                let new_desc = Descriptor::new(found_offset + size, found_size - size);
 drivers/android/binder/range_alloc/tree.rs:178:                let (tree_node, free_tree_node, desc_node_res) = alloc.initialize(new_desc);
 drivers/android/binder/range_alloc/tree.rs-179-
 --
 drivers/auxdisplay/panel.c=829=static void lcd_init(void)
 --
 drivers/auxdisplay/panel.c-1010-	lcd.charlcd = charlcd;
 drivers/auxdisplay/panel.c:1011:	lcd.initialized = true;
 drivers/auxdisplay/panel.c-1012-}
 --
 drivers/auxdisplay/panel.c=1336=static void panel_scan_timer(struct timer_list *unused)
 --
 drivers/auxdisplay/panel.c-1349-
 drivers/auxdisplay/panel.c:1350:	if (keypressed && lcd.enabled && lcd.initialized)
 drivers/auxdisplay/panel.c-1351-		charlcd_poke(lcd.charlcd);
 --
 drivers/auxdisplay/panel.c=1667=static void panel_detach(struct parport *port)
 --
 drivers/auxdisplay/panel.c-1686-		charlcd_unregister(lcd.charlcd);
 drivers/auxdisplay/panel.c:1687:		lcd.initialized = false;
 drivers/auxdisplay/panel.c-1688-		hd44780_common_free(lcd.charlcd);
 --
 drivers/char/nvram.c=206=const struct nvram_ops arch_nvram_ops = {
 --
 drivers/char/nvram.c-212-	.set_checksum   = pc_nvram_set_checksum,
 drivers/char/nvram.c:213:	.initialize     = pc_nvram_initialize,
 drivers/char/nvram.c-214-};
 --
 drivers/char/nvram.c=280=static long nvram_misc_ioctl(struct file *file, unsigned int cmd,
 --
 drivers/char/nvram.c-326-
 drivers/char/nvram.c:327:		if (arch_nvram_ops.initialize != NULL) {
 drivers/char/nvram.c-328-			mutex_lock(&nvram_mutex);
 drivers/char/nvram.c:329:			ret = arch_nvram_ops.initialize();
 drivers/char/nvram.c-330-			mutex_unlock(&nvram_mutex);
 --
 drivers/gpio/gpiolib.c=2016=static int gpiochip_to_irq(struct gpio_chip *gc, unsigned int offset)
 --
 drivers/gpio/gpiolib.c-2024-	 */
 drivers/gpio/gpiolib.c:2025:	if (!gc->irq.initialized)
 drivers/gpio/gpiolib.c-2026-		return -EPROBE_DEFER;
 --
 drivers/gpio/gpiolib.c=2148=static int gpiochip_irqchip_add_allocated_domain(struct gpio_chip *gc,
 --
 drivers/gpio/gpiolib.c-2164-	 * Using barrier() here to prevent compiler from reordering
 drivers/gpio/gpiolib.c:2165:	 * gc->irq.initialized before adding irqdomain.
 drivers/gpio/gpiolib.c-2166-	 */
 --
 drivers/gpio/gpiolib.c-2168-
 drivers/gpio/gpiolib.c:2169:	gc->irq.initialized = true;
 drivers/gpio/gpiolib.c-2170-
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c=4180=void amdgpu_device_fini_hw(struct amdgpu_device *adev)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c-4184-
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c:4185:	if (adev->mman.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c-4186-		drain_workqueue(adev->mman.bdev.wq);
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c-4231-
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c:4232:	if (adev->mman.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c-4233-		ttm_device_clear_dma_mappings(&adev->mman.bdev);
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c=407=int amdgpu_fence_driver_start_ring(struct amdgpu_ring *ring,
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c-426-	ring->fence_drv.irq_type = irq_type;
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c:427:	ring->fence_drv.initialized = true;
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c-428-
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c=443=int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c-456-	atomic_set(&ring->fence_drv.last_seq, 0);
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c:457:	ring->fence_drv.initialized = false;
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c-458-
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c=533=void amdgpu_fence_driver_hw_fini(struct amdgpu_device *adev)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c-539-
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c:540:		if (!ring || !ring->fence_drv.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c-541-			continue;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c=563=void amdgpu_fence_driver_isr_toggle(struct amdgpu_device *adev, bool stop)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c-569-
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c:570:		if (!ring || !ring->fence_drv.initialized || !ring->fence_drv.irq_src)
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c-571-			continue;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c=580=void amdgpu_fence_driver_sw_fini(struct amdgpu_device *adev)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c-586-
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c:587:		if (!ring || !ring->fence_drv.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c-588-			continue;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c-602-		ring->fence_drv.fences = NULL;
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c:603:		ring->fence_drv.initialized = false;
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c-604-	}
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c=619=void amdgpu_fence_driver_hw_init(struct amdgpu_device *adev)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c-625-
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c:626:		if (!ring || !ring->fence_drv.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c-627-			continue;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c=865=static int amdgpu_debugfs_fence_info_show(struct seq_file *m, void *unused)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c-872-
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c:873:		if (!ring || !ring->fence_drv.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c-874-			continue;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=1225=static int psp_asd_initialize(struct psp_context *psp)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-1246-	if (!ret)
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:1247:		psp->asd_context.initialized = true;
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-1248-
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=1275=static int psp_asd_terminate(struct psp_context *psp)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-1281-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:1282:	if (!psp->asd_context.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-1283-		return 0;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-1286-	if (!ret)
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:1287:		psp->asd_context.initialized = false;
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-1288-
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=1415=int psp_xgmi_terminate(struct psp_context *psp)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-1425-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:1426:	if (!psp->xgmi_context.context.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-1427-		return 0;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-1430-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:1431:	psp->xgmi_context.context.initialized = false;
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-1432-
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=1436=int psp_xgmi_initialize(struct psp_context *psp, bool set_extended_data, bool load_ta)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-1460-	if (!ret)
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:1461:		psp->xgmi_context.context.initialized = true;
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-1462-	else
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=1864=int psp_ras_enable_features(struct psp_context *psp,
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-1869-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:1870:	if (!psp->ras_context.context.initialized || !info)
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-1871-		return -EINVAL;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=1882=int psp_ras_terminate(struct psp_context *psp)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-1891-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:1892:	if (!psp->ras_context.context.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-1893-		return 0;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-1896-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:1897:	psp->ras_context.context.initialized = false;
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-1898-
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=1904=int psp_ras_initialize(struct psp_context *psp)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2003-	if (!ret && !ras_cmd->ras_status) {
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2004:		psp->ras_context.context.initialized = true;
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2005-		mutex_init(&psp->ras_context.mutex);
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2010-		/* fail to load RAS TA */
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2011:		psp->ras_context.context.initialized = false;
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2012-	}
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=2017=int psp_ras_trigger_error(struct psp_context *psp,
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2024-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2025:	if (!psp->ras_context.context.initialized || !info)
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2026-		return -EINVAL;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=2068=int psp_ras_query_address(struct psp_context *psp,
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2073-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2074:	if (!psp->ras_context.context.initialized ||
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2075-		!addr_in || !addr_out)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=2086=static int psp_hdcp_initialize(struct psp_context *psp)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2116-	if (!ret) {
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2117:		psp->hdcp_context.context.initialized = true;
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2118-		mutex_init(&psp->hdcp_context.mutex);
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=2124=int psp_hdcp_invoke(struct psp_context *psp, uint32_t ta_cmd_id)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2131-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2132:	if (!psp->hdcp_context.context.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2133-		return 0;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=2138=static int psp_hdcp_terminate(struct psp_context *psp)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2147-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2148:	if (!psp->hdcp_context.context.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2149-		return 0;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2152-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2153:	psp->hdcp_context.context.initialized = false;
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2154-
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=2160=static int psp_dtm_initialize(struct psp_context *psp)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2190-	if (!ret) {
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2191:		psp->dtm_context.context.initialized = true;
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2192-		mutex_init(&psp->dtm_context.mutex);
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=2198=int psp_dtm_invoke(struct psp_context *psp, uint32_t ta_cmd_id)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2205-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2206:	if (!psp->dtm_context.context.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2207-		return 0;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=2212=static int psp_dtm_terminate(struct psp_context *psp)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2221-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2222:	if (!psp->dtm_context.context.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2223-		return 0;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2226-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2227:	psp->dtm_context.context.initialized = false;
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2228-
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=2234=static int psp_rap_initialize(struct psp_context *psp)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2261-	if (!ret) {
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2262:		psp->rap_context.context.initialized = true;
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2263-		mutex_init(&psp->rap_context.mutex);
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=2282=static int psp_rap_terminate(struct psp_context *psp)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2285-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2286:	if (!psp->rap_context.context.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2287-		return 0;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2290-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2291:	psp->rap_context.context.initialized = false;
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2292-
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=2296=int psp_rap_invoke(struct psp_context *psp, uint32_t ta_cmd_id, enum ta_rap_status *status)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2300-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2301:	if (!psp->rap_context.context.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2302-		return 0;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=2332=static int psp_securedisplay_initialize(struct psp_context *psp)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2357-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2358:	if (!psp->securedisplay_context.context.initialized) {
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2359-		ret = psp_ta_init_shared_buf(psp,
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2366-	if (!ret && !psp->securedisplay_context.context.resp_status) {
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2367:		psp->securedisplay_context.context.initialized = true;
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2368-		mutex_init(&psp->securedisplay_context.mutex);
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=2403=static int psp_securedisplay_terminate(struct psp_context *psp)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2412-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2413:	if (!psp->securedisplay_context.context.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2414-		return 0;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2417-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2418:	psp->securedisplay_context.context.initialized = false;
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2419-
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=2423=int psp_securedisplay_invoke(struct psp_context *psp, uint32_t ta_cmd_id)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2426-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:2427:	if (!psp->securedisplay_context.context.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-2428-		return -EINVAL;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c=3268=static int psp_suspend(struct amdgpu_ip_block *ip_block)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-3274-	if (adev->gmc.xgmi.num_physical_nodes > 1 &&
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c:3275:	    psp->xgmi_context.context.initialized) {
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c-3276-		ret = psp_xgmi_terminate(psp);
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_rap.c=116=void amdgpu_rap_debugfs_init(struct amdgpu_device *adev)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_rap.c-119-
 drivers/gpu/drm/amd/amdgpu/amdgpu_rap.c:120:	if (!adev->psp.rap_context.context.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_rap.c-121-		return;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c=176=void amdgpu_securedisplay_debugfs_init(struct amdgpu_device *adev)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c-179-
 drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c:180:	if (!adev->psp.securedisplay_context.context.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c-181-		return;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c=2066=int amdgpu_ttm_init(struct amdgpu_device *adev)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c-2091-	}
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c:2092:	adev->mman.initialized = true;
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c-2093-
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c=2232=void amdgpu_ttm_fini(struct amdgpu_device *adev)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c-2235-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c:2236:	if (!adev->mman.initialized)
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c-2237-		return;
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c-2278-	ttm_device_fini(&adev->mman.bdev);
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c:2279:	adev->mman.initialized = false;
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c-2280-	dev_info(adev->dev, " ttm finalized\n");
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c=2292=void amdgpu_ttm_set_buffer_funcs_status(struct amdgpu_device *adev, bool enable)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c-2298-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c:2299:	if (!adev->mman.initialized || amdgpu_in_reset(adev) ||
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c-2300-	    adev->mman.buffer_funcs_enabled == enable || adev->gmc.is_app_apu)
 --
 drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c=2921=struct device_queue_manager *device_queue_manager_init(struct kfd_node *dev)
 --
 drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c-2952-		dqm->ops.create_queue = create_queue_cpsch;
 drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c:2953:		dqm->ops.initialize = initialize_cpsch;
 drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c-2954-		dqm->ops.start = start_cpsch;
 --
 drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c-2982-		dqm->ops.unregister_process = unregister_process;
 drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c:2983:		dqm->ops.initialize = initialize_nocpsch;
 drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c-2984-		dqm->ops.uninitialize = uninitialize;
 --
 drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c-3040-
 drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c:3041:	if (!dqm->ops.initialize(dqm)) {
 drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c-3042-		init_waitqueue_head(&dqm->destroy_wait);
 --
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c=1018=static void amdgpu_dm_atomic_lut3d(const struct drm_color_lut *drm_lut3d,
 --
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c-1022-	if (!drm_lut3d_size) {
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c:1023:		lut->state.bits.initialized = 0;
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c-1024-	} else {
 --
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c-1029-		lut->lut_3d.use_12bits = true;
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c:1030:		lut->state.bits.initialized = 1;
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c-1031-		__drm_3dlut_to_dc_3dlut(drm_lut3d, drm_lut3d_size, &lut->lut_3d,
 --
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c=1679=static int __set_colorop_3dlut(const struct drm_color_lut32 *drm_lut3d,
 --
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c-1683-	if (!drm_lut3d_size) {
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c:1684:		lut->state.bits.initialized = 0;
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c-1685-		return -EINVAL;
 --
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c-1691-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c:1692:	lut->state.bits.initialized = 1;
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c-1693-	__drm_3dlut32_to_dc_3dlut(drm_lut3d, drm_lut3d_size, &lut->lut_3d,
 --
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c=341=static void amdgpu_dm_crtc_notify_ta_to_read(struct work_struct *work)
 --
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c-364-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c:365:	if (!psp->securedisplay_context.context.initialized) {
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c-366-		DRM_DEBUG_DRIVER("Secure Display fails to notify PSP TA\n");
 --
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c=109=static uint8_t *psp_get_srm(struct psp_context *psp, uint32_t *srm_version, uint32_t *srm_size)
 --
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c-112-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c:113:	if (!psp->hdcp_context.context.initialized) {
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c-114-		DRM_WARN("Failed to get hdcp srm. HDCP TA is not initialized.");
 --
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c=133=static int psp_set_srm(struct psp_context *psp,
 --
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c-137-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c:138:	if (!psp->hdcp_context.context.initialized) {
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c-139-		DRM_WARN("Failed to get hdcp srm. HDCP TA is not initialized.");
 --
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c=498=static bool enable_assr(void *handle, struct dc_link *link)
 --
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c-504-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c:505:	if (!psp->dtm_context.context.initialized) {
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c-506-		drm_info(adev_to_drm(psp->adev),
 --
 drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_top/dml2_top_soc15.c=1111=bool dml2_top_soc15_initialize_instance(struct dml2_initialize_instance_in_out *in_out)
 --
 drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_top/dml2_top_soc15.c-1113-	struct dml2_instance *dml = (struct dml2_instance *)in_out->dml2_instance;
 drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_top/dml2_top_soc15.c:1114:	struct dml2_initialize_instance_locals *l = &dml->scratch.initialize_instance_locals;
 drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_top/dml2_top_soc15.c-1115-	struct dml2_core_initialize_in_out core_init_params = { 0 };
 --
 drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_top/dml2_top_soc15.c-1151-		core_init_params.soc_bb = &in_out->soc_bb;
 drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_top/dml2_top_soc15.c:1152:		result = dml->core_instance.initialize(&core_init_params);
 drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_top/dml2_top_soc15.c-1153-
 --
]
]

gemini-3.1-pro-preview

							input: 305437
							output: 60
							thoughts: 66
						

Here's my thought process, as requested:

**Deconstructing the rt2x00usb Initialization**

Okay, so I'm tracing down this initialization path for the `rt2x00usb` driver. The crucial point here is that `rt2x00usb_initialize` isn't called directly; it's being invoked from `rt2x00lib_start`. Right, that makes sense. Now I need to understand the context. Let's dig into `rt2x00lib_start`. I'll jump into the `drivers/net/wireless/ralink/rt2x00/rt2x00dev.c` file and have a look. I'm after the bigger picture: what are the preconditions for `rt2x00lib_start` to execute, and how does it subsequently trigger the USB-specific initialization? Time to get granular...I anticipate a call-graph style examination of the surrounding code to determine overall functionality.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00lib_start]

map[SourceCode:1274:	int rt2x00lib_start(struct rt2x00_dev *rt2x00dev)
1275:	{
1276:		int retval = 0;
1277:	
1278:		/*
1279:		 * If this is the first interface which is added,
1280:		 * we should load the firmware now.
1281:		 */
1282:		retval = rt2x00lib_load_firmware(rt2x00dev);
1283:		if (retval)
1284:			goto out;
1285:	
1286:		/*
1287:		 * Initialize the device.
1288:		 */
1289:		retval = rt2x00lib_initialize(rt2x00dev);
1290:		if (retval)
1291:			goto out;
1292:	
1293:		rt2x00dev->intf_ap_count = 0;
1294:		rt2x00dev->intf_sta_count = 0;
1295:		rt2x00dev->intf_associated = 0;
1296:		rt2x00dev->intf_beaconing = 0;
1297:	
1298:		/* Enable the radio */
1299:		retval = rt2x00lib_enable_radio(rt2x00dev);
1300:		if (retval)
1301:			goto out;
1302:	
1303:		set_bit(DEVICE_STATE_STARTED, &rt2x00dev->flags);
1304:	
1305:	out:
1306:		return retval;
1307:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c]

gemini-3.1-pro-preview

							input: 306296
							output: 43
							thoughts: 3210
						

**Debugging a Truncated Strace and Suspected USB Driver Bug**

Okay, so let's piece this together.  We've got a reproducer, but the strace is truncated, which is always fun.  I'm seeing that `rt2x00lib_initialize` gets called, which in turn calls the device's initialization function. If the USB endpoint discovery fails, then `rt2x00lib_initialize` fails, and then `rt2x00lib_start` fails. Now,  the syzkaller log showed that `/dev/vhci` failed, but the reproducer is using `/dev/raw-gadget`.  Initially, I thought the `vhci` interface for USB/IP was at play, which would imply injecting a USB device, but then I realized the given C reproducer is only a draft, so the true crash is related to a different USB device.

The `exit_group(67)` at the end of the strace seemed perplexing, suggesting the reproducer failed.  However, the strace truncates just before that exit, so there must have been a crash during the strace execution. Process 4095 is closing file descriptors, and that is a common action during `execve` or after `fork`.  Process 4026 is writing and Process 4027 is reading over file descriptor 5. Process 4035 then has a `prlimit64` call for the file descriptor limit.   The strace cut off after that, but before the processes exited. That's a good clue.  The file operations suggest a crash related to data transfer or resource management, as some new process is likely just starting up.

Diving back into the reproducer's code, it seems to be doing several `syz_usb_connect` calls followed by `syz_usb_disconnect` and `syz_usb_control_io`.  There's a connection attempt to something that looks like an `rt2500usb`, then a disconnect. Then, the reproducer connects to an empty device. Then there's an attempt to connect and do control transfers with an `rtl8192cu`. Then some connect and write actions on seemingly empty devices. It does several calls to connect empty devices and does `ep_write`.

My gut says this might be a problem with how the `rtl8192cu` device is handled. So, let's look at the C reproducer device descriptor. It defines a device descriptor (18 bytes) and a config descriptor (9 bytes). The total size is 27 bytes, but the `dev_len` is 36 bytes.  The config descriptor claims `bNumInterfaces = 1`, and the USB core is going to parse this. But then, it has `wTotalLength = 0x12 (18 bytes)`.  The config descriptor is 9 bytes. Since `wTotalLength` is 18 bytes, the core reads only 18 bytes. Therefore, there must be 9 more 0 bytes in the data, which means it will find a config descriptor and then nine zeroes. This means `bLength` is 0 and `bDescriptorType` is 0, which is invalid, and means the USB core reads incomplete information about the config. Because `wTotalLength` is not valid, the core may decide there are zero interfaces or other descriptor issues! It has `bNumInterfaces` set to 1, but there may be problems in finding or parsing descriptors after the 9 bytes. This sounds like it could be the culprit. I need to focus on what happens during descriptor parsing with a truncated config descriptor!

map[ContextFile:drivers/usb/core/config.c IncludeLines:true Name:usb_parse_configuration]

map[SourceCode: 659:	static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
 660:	    struct usb_host_config *config, unsigned char *buffer, int size)
 661:	{
 662:		struct device *ddev = &dev->dev;
 663:		unsigned char *buffer0 = buffer;
 664:		int cfgno;
 665:		int nintf, nintf_orig;
 666:		int i, j, n;
 667:		struct usb_interface_cache *intfc;
 668:		unsigned char *buffer2;
 669:		int size2;
 670:		struct usb_descriptor_header *header;
 671:		int retval;
 672:		u8 inums[USB_MAXINTERFACES], nalts[USB_MAXINTERFACES];
 673:		unsigned iad_num = 0;
 674:	
 675:		memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
 676:		nintf = nintf_orig = config->desc.bNumInterfaces;
 677:		config->desc.bNumInterfaces = 0;	// Adjusted later
 678:	
 679:		if (config->desc.bDescriptorType != USB_DT_CONFIG ||
 680:		    config->desc.bLength < USB_DT_CONFIG_SIZE ||
 681:		    config->desc.bLength > size) {
 682:			dev_notice(ddev, "invalid descriptor for config index %d: "
 683:			    "type = 0x%X, length = %d\n", cfgidx,
 684:			    config->desc.bDescriptorType, config->desc.bLength);
 685:			return -EINVAL;
 686:		}
 687:		cfgno = config->desc.bConfigurationValue;
 688:	
 689:		buffer += config->desc.bLength;
 690:		size -= config->desc.bLength;
 691:	
 692:		if (nintf > USB_MAXINTERFACES) {
 693:			dev_notice(ddev, "config %d has too many interfaces: %d, "
 694:			    "using maximum allowed: %d\n",
 695:			    cfgno, nintf, USB_MAXINTERFACES);
 696:			nintf = USB_MAXINTERFACES;
 697:		}
 698:	
 699:		/* Go through the descriptors, checking their length and counting the
 700:		 * number of altsettings for each interface */
 701:		n = 0;
 702:		for ((buffer2 = buffer, size2 = size);
 703:		      size2 > 0;
 704:		     (buffer2 += header->bLength, size2 -= header->bLength)) {
 705:	
 706:			if (size2 < sizeof(struct usb_descriptor_header)) {
 707:				dev_notice(ddev, "config %d descriptor has %d excess "
 708:				    "byte%s, ignoring\n",
 709:				    cfgno, size2, str_plural(size2));
 710:				break;
 711:			}
 712:	
 713:			header = (struct usb_descriptor_header *) buffer2;
 714:			if ((header->bLength > size2) || (header->bLength < 2)) {
 715:				dev_notice(ddev, "config %d has an invalid descriptor "
 716:				    "of length %d, skipping remainder of the config\n",
 717:				    cfgno, header->bLength);
 718:				break;
 719:			}
 720:	
 721:			if (header->bDescriptorType == USB_DT_INTERFACE) {
 722:				struct usb_interface_descriptor *d;
 723:				int inum;
 724:	
 725:				d = (struct usb_interface_descriptor *) header;
 726:				if (d->bLength < USB_DT_INTERFACE_SIZE) {
 727:					dev_notice(ddev, "config %d has an invalid "
 728:					    "interface descriptor of length %d, "
 729:					    "skipping\n", cfgno, d->bLength);
 730:					continue;
 731:				}
 732:	
 733:				inum = d->bInterfaceNumber;
 734:	
 735:				if ((dev->quirks & USB_QUIRK_HONOR_BNUMINTERFACES) &&
 736:				    n >= nintf_orig) {
 737:					dev_notice(ddev, "config %d has more interface "
 738:					    "descriptors, than it declares in "
 739:					    "bNumInterfaces, ignoring interface "
 740:					    "number: %d\n", cfgno, inum);
 741:					continue;
 742:				}
 743:	
 744:				if (inum >= nintf_orig)
 745:					dev_notice(ddev, "config %d has an invalid "
 746:					    "interface number: %d but max is %d\n",
 747:					    cfgno, inum, nintf_orig - 1);
 748:	
 749:				/* Have we already encountered this interface?
 750:				 * Count its altsettings */
 751:				for (i = 0; i < n; ++i) {
 752:					if (inums[i] == inum)
 753:						break;
 754:				}
 755:				if (i < n) {
 756:					if (nalts[i] < 255)
 757:						++nalts[i];
 758:				} else if (n < USB_MAXINTERFACES) {
 759:					inums[n] = inum;
 760:					nalts[n] = 1;
 761:					++n;
 762:				}
 763:	
 764:			} else if (header->bDescriptorType ==
 765:					USB_DT_INTERFACE_ASSOCIATION) {
 766:				struct usb_interface_assoc_descriptor *d;
 767:	
 768:				d = (struct usb_interface_assoc_descriptor *)header;
 769:				if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) {
 770:					dev_notice(ddev,
 771:						 "config %d has an invalid interface association descriptor of length %d, skipping\n",
 772:						 cfgno, d->bLength);
 773:					continue;
 774:				}
 775:	
 776:				if (iad_num == USB_MAXIADS) {
 777:					dev_notice(ddev, "found more Interface "
 778:						       "Association Descriptors "
 779:						       "than allocated for in "
 780:						       "configuration %d\n", cfgno);
 781:				} else {
 782:					config->intf_assoc[iad_num] = d;
 783:					iad_num++;
 784:				}
 785:	
 786:			} else if (header->bDescriptorType == USB_DT_DEVICE ||
 787:				    header->bDescriptorType == USB_DT_CONFIG)
 788:				dev_notice(ddev, "config %d contains an unexpected "
 789:				    "descriptor of type 0x%X, skipping\n",
 790:				    cfgno, header->bDescriptorType);
 791:	
 792:		}	/* for ((buffer2 = buffer, size2 = size); ...) */
 793:		size = buffer2 - buffer;
 794:		config->desc.wTotalLength = cpu_to_le16(buffer2 - buffer0);
 795:	
 796:		if (n != nintf)
 797:			dev_notice(ddev, "config %d has %d interface%s, different from "
 798:			    "the descriptor's value: %d\n",
 799:			    cfgno, n, str_plural(n), nintf_orig);
 800:		else if (n == 0)
 801:			dev_notice(ddev, "config %d has no interfaces?\n", cfgno);
 802:		config->desc.bNumInterfaces = nintf = n;
 803:	
 804:		/* Check for missing interface numbers */
 805:		for (i = 0; i < nintf; ++i) {
 806:			for (j = 0; j < nintf; ++j) {
 807:				if (inums[j] == i)
 808:					break;
 809:			}
 810:			if (j >= nintf)
 811:				dev_notice(ddev, "config %d has no interface number "
 812:				    "%d\n", cfgno, i);
 813:		}
 814:	
 815:		/* Allocate the usb_interface_caches and altsetting arrays */
 816:		for (i = 0; i < nintf; ++i) {
 817:			j = nalts[i];
 818:			if (j > USB_MAXALTSETTING) {
 819:				dev_notice(ddev, "too many alternate settings for "
 820:				    "config %d interface %d: %d, "
 821:				    "using maximum allowed: %d\n",
 822:				    cfgno, inums[i], j, USB_MAXALTSETTING);
 823:				nalts[i] = j = USB_MAXALTSETTING;
 824:			}
 825:	
 826:			intfc = kzalloc_flex(*intfc, altsetting, j);
 827:			config->intf_cache[i] = intfc;
 828:			if (!intfc)
 829:				return -ENOMEM;
 830:			kref_init(&intfc->ref);
 831:		}
 832:	
 833:		/* FIXME: parse the BOS descriptor */
 834:	
 835:		/* Skip over any Class Specific or Vendor Specific descriptors;
 836:		 * find the first interface descriptor */
 837:		config->extra = buffer;
 838:		i = find_next_descriptor(buffer, size, USB_DT_INTERFACE,
 839:		    USB_DT_INTERFACE, &n);
 840:		config->extralen = i;
 841:		if (n > 0)
 842:			dev_dbg(ddev, "skipped %d descriptor%s after %s\n",
 843:			    n, str_plural(n), "configuration");
 844:		buffer += i;
 845:		size -= i;
 846:	
 847:		/* Parse all the interface/altsetting descriptors */
 848:		while (size > 0) {
 849:			retval = usb_parse_interface(ddev, cfgno, config,
 850:			    buffer, size, inums, nalts);
 851:			if (retval < 0)
 852:				return retval;
 853:	
 854:			buffer += retval;
 855:			size -= retval;
 856:		}
 857:	
 858:		/* Check for missing altsettings */
 859:		for (i = 0; i < nintf; ++i) {
 860:			intfc = config->intf_cache[i];
 861:			for (j = 0; j < intfc->num_altsetting; ++j) {
 862:				for (n = 0; n < intfc->num_altsetting; ++n) {
 863:					if (intfc->altsetting[n].desc.
 864:					    bAlternateSetting == j)
 865:						break;
 866:				}
 867:				if (n >= intfc->num_altsetting)
 868:					dev_notice(ddev, "config %d interface %d has no "
 869:					    "altsetting %d\n", cfgno, inums[i], j);
 870:			}
 871:		}
 872:	
 873:		return 0;
 874:	}
 SourceFile:drivers/usb/core/config.c]

gemini-3.1-pro-preview

							input: 313816
							output: 63
							thoughts: 2455
						

**Analyzing the USB Configuration and Probe Sequence**

Okay, let's break this down. Initially, I was focusing on how the zero-length descriptors were handled during USB configuration parsing. If `bLength` is zero, the loop immediately triggers an invalid descriptor error, causing the configuration to be skipped. This leads to zero interfaces and an unsuccessful driver probe, which seemed like the root of the problem. However, I realized this alone wouldn't explain a crash, as the code handles the zero-interface case gracefully, so that's a red herring.

I was initially getting confused by the `devlink` calls in the `strace`, but then remembered the provided C code is a *draft*. The focus is on the `syz_usb_connect` calls. I examined the third call in the C code, specifically the `rt2500usb` device. I then started focusing on the `rt2x00usb_probe` and traced the call to `rt2500usb_validate_eeprom`. I need to examine the flow of that function to determine the root cause of the crash.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c IncludeLines:true Name:rt2500usb_validate_eeprom]

map[SourceCode:1314:	/*
1315:	 * Device probe functions.
1316:	 */
1317:	static int rt2500usb_validate_eeprom(struct rt2x00_dev *rt2x00dev)
1318:	{
1319:		u16 word;
1320:		u8 *mac;
1321:		u8 bbp;
1322:	
1323:		rt2x00usb_eeprom_read(rt2x00dev, rt2x00dev->eeprom, EEPROM_SIZE);
1324:	
1325:		/*
1326:		 * Start validation of the data that has been read.
1327:		 */
1328:		mac = rt2x00_eeprom_addr(rt2x00dev, EEPROM_MAC_ADDR_0);
1329:		rt2x00lib_set_mac_address(rt2x00dev, mac);
1330:	
1331:		word = rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA);
1332:		if (word == 0xffff) {
1333:			rt2x00_set_field16(&word, EEPROM_ANTENNA_NUM, 2);
1334:			rt2x00_set_field16(&word, EEPROM_ANTENNA_TX_DEFAULT,
1335:					   ANTENNA_SW_DIVERSITY);
1336:			rt2x00_set_field16(&word, EEPROM_ANTENNA_RX_DEFAULT,
1337:					   ANTENNA_SW_DIVERSITY);
1338:			rt2x00_set_field16(&word, EEPROM_ANTENNA_LED_MODE,
1339:					   LED_MODE_DEFAULT);
1340:			rt2x00_set_field16(&word, EEPROM_ANTENNA_DYN_TXAGC, 0);
1341:			rt2x00_set_field16(&word, EEPROM_ANTENNA_HARDWARE_RADIO, 0);
1342:			rt2x00_set_field16(&word, EEPROM_ANTENNA_RF_TYPE, RF2522);
1343:			rt2x00_eeprom_write(rt2x00dev, EEPROM_ANTENNA, word);
1344:			rt2x00_eeprom_dbg(rt2x00dev, "Antenna: 0x%04x\n", word);
1345:		}
1346:	
1347:		word = rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC);
1348:		if (word == 0xffff) {
1349:			rt2x00_set_field16(&word, EEPROM_NIC_CARDBUS_ACCEL, 0);
1350:			rt2x00_set_field16(&word, EEPROM_NIC_DYN_BBP_TUNE, 0);
1351:			rt2x00_set_field16(&word, EEPROM_NIC_CCK_TX_POWER, 0);
1352:			rt2x00_eeprom_write(rt2x00dev, EEPROM_NIC, word);
1353:			rt2x00_eeprom_dbg(rt2x00dev, "NIC: 0x%04x\n", word);
1354:		}
1355:	
1356:		word = rt2x00_eeprom_read(rt2x00dev, EEPROM_CALIBRATE_OFFSET);
1357:		if (word == 0xffff) {
1358:			rt2x00_set_field16(&word, EEPROM_CALIBRATE_OFFSET_RSSI,
1359:					   DEFAULT_RSSI_OFFSET);
1360:			rt2x00_eeprom_write(rt2x00dev, EEPROM_CALIBRATE_OFFSET, word);
1361:			rt2x00_eeprom_dbg(rt2x00dev, "Calibrate offset: 0x%04x\n",
1362:					  word);
1363:		}
1364:	
1365:		word = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE);
1366:		if (word == 0xffff) {
1367:			rt2x00_set_field16(&word, EEPROM_BBPTUNE_THRESHOLD, 45);
1368:			rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE, word);
1369:			rt2x00_eeprom_dbg(rt2x00dev, "BBPtune: 0x%04x\n", word);
1370:		}
1371:	
1372:		/*
1373:		 * Switch lower vgc bound to current BBP R17 value,
1374:		 * lower the value a bit for better quality.
1375:		 */
1376:		bbp = rt2500usb_bbp_read(rt2x00dev, 17);
1377:		bbp -= 6;
1378:	
1379:		word = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_VGC);
1380:		if (word == 0xffff) {
1381:			rt2x00_set_field16(&word, EEPROM_BBPTUNE_VGCUPPER, 0x40);
1382:			rt2x00_set_field16(&word, EEPROM_BBPTUNE_VGCLOWER, bbp);
1383:			rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_VGC, word);
1384:			rt2x00_eeprom_dbg(rt2x00dev, "BBPtune vgc: 0x%04x\n", word);
1385:		} else {
1386:			rt2x00_set_field16(&word, EEPROM_BBPTUNE_VGCLOWER, bbp);
1387:			rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_VGC, word);
1388:		}
1389:	
1390:		word = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R17);
1391:		if (word == 0xffff) {
1392:			rt2x00_set_field16(&word, EEPROM_BBPTUNE_R17_LOW, 0x48);
1393:			rt2x00_set_field16(&word, EEPROM_BBPTUNE_R17_HIGH, 0x41);
1394:			rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_R17, word);
1395:			rt2x00_eeprom_dbg(rt2x00dev, "BBPtune r17: 0x%04x\n", word);
1396:		}
1397:	
1398:		word = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R24);
1399:		if (word == 0xffff) {
1400:			rt2x00_set_field16(&word, EEPROM_BBPTUNE_R24_LOW, 0x40);
1401:			rt2x00_set_field16(&word, EEPROM_BBPTUNE_R24_HIGH, 0x80);
1402:			rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_R24, word);
1403:			rt2x00_eeprom_dbg(rt2x00dev, "BBPtune r24: 0x%04x\n", word);
1404:		}
1405:	
1406:		word = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R25);
1407:		if (word == 0xffff) {
1408:			rt2x00_set_field16(&word, EEPROM_BBPTUNE_R25_LOW, 0x40);
1409:			rt2x00_set_field16(&word, EEPROM_BBPTUNE_R25_HIGH, 0x50);
1410:			rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_R25, word);
1411:			rt2x00_eeprom_dbg(rt2x00dev, "BBPtune r25: 0x%04x\n", word);
1412:		}
1413:	
1414:		word = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R61);
1415:		if (word == 0xffff) {
1416:			rt2x00_set_field16(&word, EEPROM_BBPTUNE_R61_LOW, 0x60);
1417:			rt2x00_set_field16(&word, EEPROM_BBPTUNE_R61_HIGH, 0x6d);
1418:			rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_R61, word);
1419:			rt2x00_eeprom_dbg(rt2x00dev, "BBPtune r61: 0x%04x\n", word);
1420:		}
1421:	
1422:		return 0;
1423:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c]

gemini-3.1-pro-preview

							input: 319292
							output: 63
							thoughts: 47
						

Okay, let's see what's going on here.

**Investigating the EEPROM Read Path**

Right, so `rt2500usb_validate_eeprom` is calling `rt2x00usb_eeprom_read`. That’s interesting. I need to understand how the EEPROM data is being accessed and validated within that driver. It's a key part of initialization for this hardware, and understanding this read path is essential. Let me dive into `rt2x00usb_eeprom_read` and see what the specifics of the EEPROM access are. What kind of interface are we talking about? Is it SPI, I2C, or something else? I need to figure out the actual mechanism of the read operation.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_eeprom_read]

map[SourceCode: 160:	/**
 161:	 * rt2x00usb_eeprom_read - Read eeprom from device
 162:	 * @rt2x00dev: Pointer to &struct rt2x00_dev
 163:	 * @eeprom: Pointer to eeprom array to store the information in
 164:	 * @length: Number of bytes to read from the eeprom
 165:	 *
 166:	 * Simple wrapper around rt2x00usb_vendor_request to read the eeprom
 167:	 * from the device. Note that the eeprom argument _must_ be allocated using
 168:	 * kmalloc for correct handling inside the kernel USB layer.
 169:	 */
 170:	static inline int rt2x00usb_eeprom_read(struct rt2x00_dev *rt2x00dev,
 171:						__le16 *eeprom, const u16 length)
 172:	{
 173:		return rt2x00usb_vendor_request(rt2x00dev, USB_EEPROM_READ,
 174:						USB_VENDOR_REQUEST_IN, 0, 0,
 175:						eeprom, length, EEPROM_TIMEOUT);
 176:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.h]

gemini-3.1-pro-preview

							input: 319948
							output: 20
							thoughts: 866
						

**Analyzing the USB Device Disconnect and EEPROM Read**

Okay, let's break this down. My initial thought is that `rt2x00usb_vendor_request` sends a control message, and that's triggered by the `syz_usb_connect` function, which is emulating the device. I need to figure out how the expected response or lack thereof can be exploited. 

The reproducer shows a connection with `syz_usb_connect`, followed by immediate disconnection with `syz_usb_disconnect`. This connection sets the device up, and `syz_usb_connect` is waiting for the device configuration, which suggests that the device is configured before it is disconnected. The disconnecting function closes the file descriptor, effectively unplugging the device.

So, the driver, `rt2500usb`, is probed and then unplugged immediately. This means that `rt2x00usb_vendor_request` would fail. But what if the device is unplugged while `rt2x00usb_probe` is still running, or, alternatively, it is unplugged after `rt2x00usb_probe` finishes? This gives me something to look at.

I need to understand what's happening during the probe. `rt2x00usb_probe` calls `rt2x00lib_probe_dev`, which then calls the hardware probe function `rt2x00dev->ops->lib->probe_hw()`. This function, in turn, calls `rt2500usb_validate_eeprom`, which then calls `rt2x00usb_eeprom_read`. If `rt2x00usb_eeprom_read` fails, it returns an error. The odd part is that `rt2500usb_validate_eeprom` *ignores* the return value of `rt2x00usb_eeprom_read`.

Looking at the code:
```c
	rt2x00usb_eeprom_read(rt2x00dev, rt2x00dev->eeprom, EEPROM_SIZE);

	/*
	 * Start validation of the data that has been read.
	 */
	mac = rt2x00_eeprom_addr(rt2x00dev, EEPROM_MAC_ADDR_0);
```

This is the key. `rt2x00usb_eeprom_read` could fail, but the code proceeds as if the EEPROM has been successfully read, ignoring the error. Since the return value of `rt2x00usb_eeprom_read` is ignored, the validation proceeds with potentially uninitialized data. This suggests that `rt2x00dev->eeprom` might be uninitialized.

But is `rt2x00dev->eeprom` allocated with `kzalloc` or is it allocated somewhere else? It's allocated somewhere. Let's look at `rt2x00lib_probe_dev`:

```c
	if (rt2x00dev->ops->drv_data_size > 0) {
		rt2x00dev->drv_data = kzalloc(rt2x00dev->ops->drv_data_size,
			                      GFP_KERNEL);
```

This shows `rt2x00dev->drv_data` is allocated in `rt2x00lib_probe_dev`, but not `rt2x00dev->eeprom`. So, where is `rt2x00dev->eeprom` allocated? This is where I need to focus next.

map[Name:eeprom]

map[References:[map[ReferenceKind:uses ReferencingEntityKind:function ReferencingEntityName:cx231xx_card_setup SourceFile:drivers/media/usb/cx231xx/cx231xx-cards.c SourceLine:1298]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 321704
							output: 62
							thoughts: 53
						

Okay, let's see...

**Analyzing `eeprom` References in the Context of Device Initialization**

Hmm, "eeprom" is a pretty generic term, isn't it? Gotta be careful not to jump to conclusions. Alright, I'll need to dig deeper. I need to understand where this `eeprom` data is actually being accessed within the wireless device initialization process. My hunch is that it's likely linked to the specific wireless driver, which means I should probably check the `rt2x00` driver. I need to investigate where `rt2x00dev->eeprom` is handled, and I suspect it is probably in `rt2x00lib_probe_dev` or within the memory allocation routines like `ieee80211_alloc_hw`. That's where I'll probably find how the driver is actually getting the configuration data from the EEPROM. Time to dive into the code!

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00lib_probe_dev]

map[SourceCode:1371:	/*
1372:	 * driver allocation handlers.
1373:	 */
1374:	int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
1375:	{
1376:		int retval = -ENOMEM;
1377:	
1378:		/*
1379:		 * Set possible interface combinations.
1380:		 */
1381:		rt2x00lib_set_if_combinations(rt2x00dev);
1382:	
1383:		/*
1384:		 * Allocate the driver data memory, if necessary.
1385:		 */
1386:		if (rt2x00dev->ops->drv_data_size > 0) {
1387:			rt2x00dev->drv_data = kzalloc(rt2x00dev->ops->drv_data_size,
1388:				                      GFP_KERNEL);
1389:			if (!rt2x00dev->drv_data) {
1390:				retval = -ENOMEM;
1391:				goto exit;
1392:			}
1393:		}
1394:	
1395:		spin_lock_init(&rt2x00dev->irqmask_lock);
1396:		mutex_init(&rt2x00dev->csr_mutex);
1397:		mutex_init(&rt2x00dev->conf_mutex);
1398:		INIT_LIST_HEAD(&rt2x00dev->bar_list);
1399:		spin_lock_init(&rt2x00dev->bar_list_lock);
1400:		hrtimer_setup(&rt2x00dev->txstatus_timer, hrtimer_dummy_timeout, CLOCK_MONOTONIC,
1401:			      HRTIMER_MODE_REL);
1402:	
1403:		set_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
1404:	
1405:		/*
1406:		 * Make room for rt2x00_intf inside the per-interface
1407:		 * structure ieee80211_vif.
1408:		 */
1409:		rt2x00dev->hw->vif_data_size = sizeof(struct rt2x00_intf);
1410:	
1411:		/*
1412:		 * rt2x00 devices can only use the last n bits of the MAC address
1413:		 * for virtual interfaces.
1414:		 */
1415:		rt2x00dev->hw->wiphy->addr_mask[ETH_ALEN - 1] =
1416:			(rt2x00dev->ops->max_ap_intf - 1);
1417:	
1418:		/*
1419:		 * Initialize work.
1420:		 */
1421:		rt2x00dev->workqueue =
1422:		    alloc_ordered_workqueue("%s", 0, wiphy_name(rt2x00dev->hw->wiphy));
1423:		if (!rt2x00dev->workqueue) {
1424:			retval = -ENOMEM;
1425:			goto exit;
1426:		}
1427:	
1428:		INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled);
1429:		INIT_DELAYED_WORK(&rt2x00dev->autowakeup_work, rt2x00lib_autowakeup);
1430:		INIT_WORK(&rt2x00dev->sleep_work, rt2x00lib_sleep);
1431:	
1432:		/*
1433:		 * Let the driver probe the device to detect the capabilities.
1434:		 */
1435:		retval = rt2x00dev->ops->lib->probe_hw(rt2x00dev);
1436:		if (retval) {
1437:			rt2x00_err(rt2x00dev, "Failed to allocate device\n");
1438:			goto exit;
1439:		}
1440:	
1441:		/*
1442:		 * Allocate queue array.
1443:		 */
1444:		retval = rt2x00queue_allocate(rt2x00dev);
1445:		if (retval)
1446:			goto exit;
1447:	
1448:		/* Cache TX headroom value */
1449:		rt2x00dev->extra_tx_headroom = rt2x00dev_extra_tx_headroom(rt2x00dev);
1450:	
1451:		/*
1452:		 * Determine which operating modes are supported, all modes
1453:		 * which require beaconing, depend on the availability of
1454:		 * beacon entries.
1455:		 */
1456:		rt2x00dev->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
1457:		if (rt2x00dev->bcn->limit > 0)
1458:			rt2x00dev->hw->wiphy->interface_modes |=
1459:			    BIT(NL80211_IFTYPE_ADHOC) |
1460:	#ifdef CONFIG_MAC80211_MESH
1461:			    BIT(NL80211_IFTYPE_MESH_POINT) |
1462:	#endif
1463:			    BIT(NL80211_IFTYPE_AP);
1464:	
1465:		rt2x00dev->hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
1466:	
1467:		wiphy_ext_feature_set(rt2x00dev->hw->wiphy,
1468:				      NL80211_EXT_FEATURE_CQM_RSSI_LIST);
1469:	
1470:		/*
1471:		 * Initialize ieee80211 structure.
1472:		 */
1473:		retval = rt2x00lib_probe_hw(rt2x00dev);
1474:		if (retval) {
1475:			rt2x00_err(rt2x00dev, "Failed to initialize hw\n");
1476:			goto exit;
1477:		}
1478:	
1479:		/*
1480:		 * Register extra components.
1481:		 */
1482:		rt2x00link_register(rt2x00dev);
1483:		rt2x00leds_register(rt2x00dev);
1484:		rt2x00debug_register(rt2x00dev);
1485:	
1486:		/*
1487:		 * Start rfkill polling.
1488:		 */
1489:		if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
1490:			rt2x00rfkill_register(rt2x00dev);
1491:	
1492:		return 0;
1493:	
1494:	exit:
1495:		rt2x00lib_remove_dev(rt2x00dev);
1496:	
1497:		return retval;
1498:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c]

gemini-3.1-pro-preview

							input: 324124
							output: 58
							thoughts: 43
						

Here's my take on the thought process:

**Diving into the rt2x00dev Structure**

Okay, hold on a second. Something just clicked – I think I've got it. That `rt2x00dev->eeprom` is actually an array, nested right there within the `struct rt2x00_dev`! It makes perfect sense, but I need to be absolutely certain. Let me just quickly confirm that. I'm going to double check the definition of `struct rt2x00_dev` to ensure I'm interpreting this correctly. It's crucial I don't miss any nuances of that structure.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00.h IncludeLines:true Name:rt2x00_dev]

map[SourceCode: 726:	/*
 727:	 * rt2x00 device structure.
 728:	 */
 729:	struct rt2x00_dev {
 730:		/*
 731:		 * Device structure.
 732:		 * The structure stored in here depends on the
 733:		 * system bus (PCI or USB).
 734:		 * When accessing this variable, the rt2x00dev_{pci,usb}
 735:		 * macros should be used for correct typecasting.
 736:		 */
 737:		struct device *dev;
 738:	
 739:		/*
 740:		 * Callback functions.
 741:		 */
 742:		const struct rt2x00_ops *ops;
 743:	
 744:		/*
 745:		 * Driver data.
 746:		 */
 747:		void *drv_data;
 748:	
 749:		/*
 750:		 * IEEE80211 control structure.
 751:		 */
 752:		struct ieee80211_hw *hw;
 753:		struct ieee80211_supported_band bands[NUM_NL80211_BANDS];
 754:		struct rt2x00_chan_survey *chan_survey;
 755:		enum nl80211_band curr_band;
 756:		int curr_freq;
 757:	
 758:		/*
 759:		 * If enabled, the debugfs interface structures
 760:		 * required for deregistration of debugfs.
 761:		 */
 762:	#ifdef CONFIG_RT2X00_LIB_DEBUGFS
 763:		struct rt2x00debug_intf *debugfs_intf;
 764:	#endif /* CONFIG_RT2X00_LIB_DEBUGFS */
 765:	
 766:		/*
 767:		 * LED structure for changing the LED status
 768:		 * by mac8011 or the kernel.
 769:		 */
 770:	#ifdef CONFIG_RT2X00_LIB_LEDS
 771:		struct rt2x00_led led_radio;
 772:		struct rt2x00_led led_assoc;
 773:		struct rt2x00_led led_qual;
 774:		u16 led_mcu_reg;
 775:	#endif /* CONFIG_RT2X00_LIB_LEDS */
 776:	
 777:		/*
 778:		 * Device state flags.
 779:		 * In these flags the current status is stored.
 780:		 * Access to these flags should occur atomically.
 781:		 */
 782:		unsigned long flags;
 783:	
 784:		/*
 785:		 * Device capabiltiy flags.
 786:		 * In these flags the device/driver capabilities are stored.
 787:		 * Access to these flags should occur non-atomically.
 788:		 */
 789:		unsigned long cap_flags;
 790:	
 791:		/*
 792:		 * Device information, Bus IRQ and name (PCI, SoC)
 793:		 */
 794:		int irq;
 795:		const char *name;
 796:	
 797:		/*
 798:		 * Chipset identification.
 799:		 */
 800:		struct rt2x00_chip chip;
 801:	
 802:		/*
 803:		 * hw capability specifications.
 804:		 */
 805:		struct hw_mode_spec spec;
 806:	
 807:		/*
 808:		 * This is the default TX/RX antenna setup as indicated
 809:		 * by the device's EEPROM.
 810:		 */
 811:		struct antenna_setup default_ant;
 812:	
 813:		/*
 814:		 * Register pointers
 815:		 * csr.base: CSR base register address. (PCI)
 816:		 * csr.cache: CSR cache for usb_control_msg. (USB)
 817:		 */
 818:		union csr {
 819:			void __iomem *base;
 820:			void *cache;
 821:		} csr;
 822:	
 823:		/*
 824:		 * Mutex to protect register accesses.
 825:		 * For PCI and USB devices it protects against concurrent indirect
 826:		 * register access (BBP, RF, MCU) since accessing those
 827:		 * registers require multiple calls to the CSR registers.
 828:		 * For USB devices it also protects the csr_cache since that
 829:		 * field is used for normal CSR access and it cannot support
 830:		 * multiple callers simultaneously.
 831:		 */
 832:		struct mutex csr_mutex;
 833:	
 834:		/*
 835:		 * Mutex to synchronize config and link tuner.
 836:		 */
 837:		struct mutex conf_mutex;
 838:		/*
 839:		 * Current packet filter configuration for the device.
 840:		 * This contains all currently active FIF_* flags send
 841:		 * to us by mac80211 during configure_filter().
 842:		 */
 843:		unsigned int packet_filter;
 844:	
 845:		/*
 846:		 * Interface details:
 847:		 *  - Open ap interface count.
 848:		 *  - Open sta interface count.
 849:		 *  - Association count.
 850:		 *  - Beaconing enabled count.
 851:		 */
 852:		unsigned int intf_ap_count;
 853:		unsigned int intf_sta_count;
 854:		unsigned int intf_associated;
 855:		unsigned int intf_beaconing;
 856:	
 857:		/*
 858:		 * Interface combinations
 859:		 */
 860:		struct ieee80211_iface_limit if_limits_ap;
 861:		struct ieee80211_iface_combination if_combinations[NUM_IF_COMB];
 862:	
 863:		/*
 864:		 * Link quality
 865:		 */
 866:		struct link link;
 867:	
 868:		/*
 869:		 * EEPROM data.
 870:		 */
 871:		__le16 *eeprom;
 872:	
 873:		/*
 874:		 * Active RF register values.
 875:		 * These are stored here so we don't need
 876:		 * to read the rf registers and can directly
 877:		 * use this value instead.
 878:		 * This field should be accessed by using
 879:		 * rt2x00_rf_read() and rt2x00_rf_write().
 880:		 */
 881:		u32 *rf;
 882:	
 883:		/*
 884:		 * LNA gain
 885:		 */
 886:		short lna_gain;
 887:	
 888:		/*
 889:		 * Current TX power value.
 890:		 */
 891:		u16 tx_power;
 892:	
 893:		/*
 894:		 * Current retry values.
 895:		 */
 896:		u8 short_retry;
 897:		u8 long_retry;
 898:	
 899:		/*
 900:		 * Rssi <-> Dbm offset
 901:		 */
 902:		u8 rssi_offset;
 903:	
 904:		/*
 905:		 * Frequency offset.
 906:		 */
 907:		u8 freq_offset;
 908:	
 909:		/*
 910:		 * Association id.
 911:		 */
 912:		u16 aid;
 913:	
 914:		/*
 915:		 * Beacon interval.
 916:		 */
 917:		u16 beacon_int;
 918:	
 919:		/* Rx/Tx DMA busy watchdog counter */
 920:		u16 rxdma_busy, txdma_busy;
 921:	
 922:		/**
 923:		 * Timestamp of last received beacon
 924:		 */
 925:		unsigned long last_beacon;
 926:	
 927:		/*
 928:		 * Low level statistics which will have
 929:		 * to be kept up to date while device is running.
 930:		 */
 931:		struct ieee80211_low_level_stats low_level_stats;
 932:	
 933:		/**
 934:		 * Work queue for all work which should not be placed
 935:		 * on the mac80211 workqueue (because of dependencies
 936:		 * between various work structures).
 937:		 */
 938:		struct workqueue_struct *workqueue;
 939:	
 940:		/*
 941:		 * Scheduled work.
 942:		 * NOTE: intf_work will use ieee80211_iterate_active_interfaces()
 943:		 * which means it cannot be placed on the hw->workqueue
 944:		 * due to RTNL locking requirements.
 945:		 */
 946:		struct work_struct intf_work;
 947:	
 948:		/**
 949:		 * Scheduled work for TX/RX done handling (USB devices)
 950:		 */
 951:		struct work_struct rxdone_work;
 952:		struct work_struct txdone_work;
 953:	
 954:		/*
 955:		 * Powersaving work
 956:		 */
 957:		struct delayed_work autowakeup_work;
 958:		struct work_struct sleep_work;
 959:	
 960:		/*
 961:		 * Data queue arrays for RX, TX, Beacon and ATIM.
 962:		 */
 963:		unsigned int data_queues;
 964:		struct data_queue *rx;
 965:		struct data_queue *tx;
 966:		struct data_queue *bcn;
 967:		struct data_queue *atim;
 968:	
 969:		/*
 970:		 * Firmware image.
 971:		 */
 972:		const struct firmware *fw;
 973:	
 974:		/*
 975:		 * FIFO for storing tx status reports between isr and tasklet.
 976:		 */
 977:		DECLARE_KFIFO_PTR(txstatus_fifo, u32);
 978:	
 979:		/*
 980:		 * Timer to ensure tx status reports are read (rt2800usb).
 981:		 */
 982:		struct hrtimer txstatus_timer;
 983:	
 984:		/*
 985:		 * Tasklet for processing tx status reports (rt2800pci).
 986:		 */
 987:		struct tasklet_struct txstatus_tasklet;
 988:		struct tasklet_struct pretbtt_tasklet;
 989:		struct tasklet_struct tbtt_tasklet;
 990:		struct tasklet_struct rxdone_tasklet;
 991:		struct tasklet_struct autowake_tasklet;
 992:	
 993:		/*
 994:		 * Used for VCO periodic calibration.
 995:		 */
 996:		int rf_channel;
 997:	
 998:		/*
 999:		 * Protect the interrupt mask register.
1000:		 */
1001:		spinlock_t irqmask_lock;
1002:	
1003:		/*
1004:		 * List of BlockAckReq TX entries that need driver BlockAck processing.
1005:		 */
1006:		struct list_head bar_list;
1007:		spinlock_t bar_list_lock;
1008:	
1009:		/* Extra TX headroom required for alignment purposes. */
1010:		unsigned int extra_tx_headroom;
1011:	
1012:		struct usb_anchor *anchor;
1013:		unsigned int num_proto_errs;
1014:	
1015:		/* Clock for System On Chip devices. */
1016:		struct clk *clk;
1017:	};
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00.h]

gemini-3.1-pro-preview

							input: 328030
							output: 17
							thoughts: 143
						

**Investigating the EEPROM Pointer**

Okay, hold on a second. I'm looking at this `rt2x00dev` structure, and I've just realized something important: `rt2x00dev->eeprom` is *a pointer*. That makes all the difference! I need to trace this back. Where exactly is that thing allocated?

Right, digging into the code, it looks like `rt2x00lib_probe_dev` is the place to start. Let's see... Ah, here it is: 
```c
if (rt2x00dev->ops->drv_data_size > 0) {
    rt2x00dev->drv_data = kzalloc(rt2x00dev->ops->drv_data_size, GFP_KERNEL);
}
```
Okay, `drv_data` is being allocated with `kzalloc`, depending on `drv_data_size`... but wait a minute! This is `drv_data`, not the `eeprom`. Clearly, `rt2x00dev->eeprom` is *not* simply a part of the `drv_data` structure. So, that means I need to broaden the search. I need to find the specific allocation for `rt2x00dev->eeprom`. I'll search for every instance of `= eeprom` or the word `eeprom` within the relevant functions to identify its creation.

map[Expression:eeprom =]

map[Output:
Full output is too long, showing 500 out of 1749 lines.
Use more precise expression if possible.

[Documentation/dev-tools/kunit/usage.rst=382=We can now use it to test ``struct eeprom_buffer``:
 --
 Documentation/dev-tools/kunit/usage.rst-394-		struct eeprom_buffer *eeprom_buffer = ctx->eeprom_buffer;
 Documentation/dev-tools/kunit/usage.rst:395:		struct fake_eeprom *fake_eeprom = ctx->fake_eeprom;
 Documentation/dev-tools/kunit/usage.rst-396-		char buffer[] = {0xff};
 --
 Documentation/dev-tools/kunit/usage.rst-414-		struct eeprom_buffer *eeprom_buffer = ctx->eeprom_buffer;
 Documentation/dev-tools/kunit/usage.rst:415:		struct fake_eeprom *fake_eeprom = ctx->fake_eeprom;
 Documentation/dev-tools/kunit/usage.rst-416-		char buffer[] = {0xff};
 --
 Documentation/dev-tools/kunit/usage.rst-431-		struct eeprom_buffer *eeprom_buffer = ctx->eeprom_buffer;
 Documentation/dev-tools/kunit/usage.rst:432:		struct fake_eeprom *fake_eeprom = ctx->fake_eeprom;
 Documentation/dev-tools/kunit/usage.rst-433-		char buffer[] = {0xff, 0xff};
 --
 Documentation/dev-tools/kunit/usage.rst-453-
 Documentation/dev-tools/kunit/usage.rst:454:		ctx->fake_eeprom = kunit_kzalloc(test, sizeof(*ctx->fake_eeprom), GFP_KERNEL);
 Documentation/dev-tools/kunit/usage.rst-455-		KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx->fake_eeprom);
 --
 Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml=308=examples:
 --
 Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml-316-        ieee80211-freq-limit = <5000000 6000000>;
 Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml:317:        mediatek,mtd-eeprom = <&factory 0x8000>;
 Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml-318-        big-endian;
 --
 arch/mips/boot/dts/ralink/gardena_smart_gateway_mt7688.dts=202=&wmac {
 arch/mips/boot/dts/ralink/gardena_smart_gateway_mt7688.dts-203-	status = "okay";
 arch/mips/boot/dts/ralink/gardena_smart_gateway_mt7688.dts:204:	mediatek,mtd-eeprom = <&factory 0x0000>;
 arch/mips/boot/dts/ralink/gardena_smart_gateway_mt7688.dts-205-};
 --
 drivers/accel/habanalabs/common/sysfs.c=451=static DEVICE_ATTR_RO(parent_device);
 drivers/accel/habanalabs/common/sysfs.c-452-
 drivers/accel/habanalabs/common/sysfs.c:453:static const struct bin_attribute bin_attr_eeprom = {
 drivers/accel/habanalabs/common/sysfs.c-454-	.attr = {.name = "eeprom", .mode = (0444)},
 --
 drivers/comedi/drivers/addi_apci_1564.c=658=static int apci1564_auto_attach(struct comedi_device *dev,
 --
 drivers/comedi/drivers/addi_apci_1564.c-675-	/* read the EEPROM register and check the I/O map revision */
 drivers/comedi/drivers/addi_apci_1564.c:676:	devpriv->eeprom = pci_resource_start(pcidev, 0);
 drivers/comedi/drivers/addi_apci_1564.c-677-	val = inl(devpriv->eeprom + APCI1564_EEPROM_REG);
 --
 drivers/comedi/drivers/ni_pcimio.c=1219=static void m_series_init_eeprom_buffer(struct comedi_device *dev)
 --
 drivers/comedi/drivers/ni_pcimio.c-1223-	resource_size_t daq_phys_addr;
 drivers/comedi/drivers/ni_pcimio.c:1224:	static const int start_cal_eeprom = 0x400;
 drivers/comedi/drivers/ni_pcimio.c-1225-	static const unsigned int window_size = 10;
 --
 drivers/cpufreq/pmac64-cpufreq.c=478=static int __init g5_pm72_cpufreq_init(struct device_node *cpunode)
 --
 drivers/cpufreq/pmac64-cpufreq.c-480-	struct device_node *cpuid = NULL, *hwclock = NULL;
 drivers/cpufreq/pmac64-cpufreq.c:481:	const u8 *eeprom = NULL;
 drivers/cpufreq/pmac64-cpufreq.c-482-	const u32 *valp;
 --
 drivers/cpufreq/pmac64-cpufreq.c-491-	if (cpuid != NULL)
 drivers/cpufreq/pmac64-cpufreq.c:492:		eeprom = of_get_property(cpuid, "cpuid", NULL);
 drivers/cpufreq/pmac64-cpufreq.c:493:	if (eeprom == NULL) {
 drivers/cpufreq/pmac64-cpufreq.c-494-		pr_err("Can't find cpuid EEPROM !\n");
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c=2183=static struct dentry *amdgpu_ras_debugfs_create_ctrl_node(struct amdgpu_device *adev)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c-2185-	struct amdgpu_ras *con = amdgpu_ras_get_context(adev);
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c:2186:	struct amdgpu_ras_eeprom_control *eeprom = &con->eeprom_control;
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c-2187-	struct drm_minor  *minor = adev_to_drm(adev)->primary;
 --
 drivers/hid/hid-picolcd_debugfs.c=838=void picolcd_init_devfs(struct picolcd_data *data,
 --
 drivers/hid/hid-picolcd_debugfs.c-853-	if (eeprom_r || eeprom_w)
 drivers/hid/hid-picolcd_debugfs.c:854:		data->debug_eeprom = debugfs_create_file("eeprom",
 drivers/hid/hid-picolcd_debugfs.c-855-			(eeprom_w ? S_IWUSR : 0) | (eeprom_r ? S_IRUSR : 0),
 --
 drivers/hid/hid-picolcd_debugfs.c=871=void picolcd_exit_devfs(struct picolcd_data *data)
 --
 drivers/hid/hid-picolcd_debugfs.c-878-	dent = data->debug_eeprom;
 drivers/hid/hid-picolcd_debugfs.c:879:	data->debug_eeprom = NULL;
 drivers/hid/hid-picolcd_debugfs.c-880-	debugfs_remove(dent);
 --
 drivers/hid/hid-wiimote-debug.c=172=int wiidebug_init(struct wiimote_data *wdata)
 --
 drivers/hid/hid-wiimote-debug.c-182-
 drivers/hid/hid-wiimote-debug.c:183:	dbg->eeprom = debugfs_create_file("eeprom", S_IRUSR,
 drivers/hid/hid-wiimote-debug.c-184-		dbg->wdata->hdev->debug_dir, dbg, &wiidebug_eeprom_fops);
 --
 drivers/i2c/i2c-slave-eeprom.c=45=static int i2c_slave_eeprom_slave_cb(struct i2c_client *client,
 --
 drivers/i2c/i2c-slave-eeprom.c-47-{
 drivers/i2c/i2c-slave-eeprom.c:48:	struct eeprom_data *eeprom = i2c_get_clientdata(client);
 drivers/i2c/i2c-slave-eeprom.c-49-
 --
 drivers/i2c/i2c-slave-eeprom.c=93=static ssize_t i2c_slave_eeprom_bin_read(struct file *filp, struct kobject *kobj,
 --
 drivers/i2c/i2c-slave-eeprom.c-98-
 drivers/i2c/i2c-slave-eeprom.c:99:	eeprom = dev_get_drvdata(kobj_to_dev(kobj));
 drivers/i2c/i2c-slave-eeprom.c-100-
 --
 drivers/i2c/i2c-slave-eeprom.c=108=static ssize_t i2c_slave_eeprom_bin_write(struct file *filp, struct kobject *kobj,
 --
 drivers/i2c/i2c-slave-eeprom.c-113-
 drivers/i2c/i2c-slave-eeprom.c:114:	eeprom = dev_get_drvdata(kobj_to_dev(kobj));
 drivers/i2c/i2c-slave-eeprom.c-115-
 --
 drivers/i2c/i2c-slave-eeprom.c=143=static int i2c_slave_eeprom_probe(struct i2c_client *client)
 --
 drivers/i2c/i2c-slave-eeprom.c-150-
 drivers/i2c/i2c-slave-eeprom.c:151:	eeprom = devm_kzalloc(&client->dev, sizeof(struct eeprom_data) + size, GFP_KERNEL);
 drivers/i2c/i2c-slave-eeprom.c-152-	if (!eeprom)
 --
 drivers/i2c/i2c-slave-eeprom.c=185=static void i2c_slave_eeprom_remove(struct i2c_client *client)
 drivers/i2c/i2c-slave-eeprom.c-186-{
 drivers/i2c/i2c-slave-eeprom.c:187:	struct eeprom_data *eeprom = i2c_get_clientdata(client);
 drivers/i2c/i2c-slave-eeprom.c-188-
 --
 drivers/iio/dac/mcp47feb02.c=111=static const struct mcp47feb02_features mcp47feb01_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-115-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:116:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-117-};
 --
 drivers/iio/dac/mcp47feb02.c=119=static const struct mcp47feb02_features mcp47feb02_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-123-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:124:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-125-};
 --
 drivers/iio/dac/mcp47feb02.c=127=static const struct mcp47feb02_features mcp47feb04_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-131-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:132:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-133-};
 --
 drivers/iio/dac/mcp47feb02.c=135=static const struct mcp47feb02_features mcp47feb08_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-139-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:140:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-141-};
 --
 drivers/iio/dac/mcp47feb02.c=143=static const struct mcp47feb02_features mcp47feb11_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-147-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:148:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-149-};
 --
 drivers/iio/dac/mcp47feb02.c=151=static const struct mcp47feb02_features mcp47feb12_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-155-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:156:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-157-};
 --
 drivers/iio/dac/mcp47feb02.c=159=static const struct mcp47feb02_features mcp47feb14_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-163-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:164:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-165-};
 --
 drivers/iio/dac/mcp47feb02.c=167=static const struct mcp47feb02_features mcp47feb18_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-171-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:172:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-173-};
 --
 drivers/iio/dac/mcp47feb02.c=175=static const struct mcp47feb02_features mcp47feb21_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-179-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:180:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-181-};
 --
 drivers/iio/dac/mcp47feb02.c=183=static const struct mcp47feb02_features mcp47feb22_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-187-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:188:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-189-};
 --
 drivers/iio/dac/mcp47feb02.c=191=static const struct mcp47feb02_features mcp47feb24_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-195-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:196:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-197-};
 --
 drivers/iio/dac/mcp47feb02.c=199=static const struct mcp47feb02_features mcp47feb28_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-203-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:204:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-205-};
 --
 drivers/iio/dac/mcp47feb02.c=207=static const struct mcp47feb02_features mcp47fvb01_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-211-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:212:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-213-};
 --
 drivers/iio/dac/mcp47feb02.c=215=static const struct mcp47feb02_features mcp47fvb02_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-219-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:220:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-221-};
 --
 drivers/iio/dac/mcp47feb02.c=223=static const struct mcp47feb02_features mcp47fvb04_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-227-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:228:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-229-};
 --
 drivers/iio/dac/mcp47feb02.c=231=static const struct mcp47feb02_features mcp47fvb08_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-235-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:236:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-237-};
 --
 drivers/iio/dac/mcp47feb02.c=239=static const struct mcp47feb02_features mcp47fvb11_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-243-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:244:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-245-};
 --
 drivers/iio/dac/mcp47feb02.c=247=static const struct mcp47feb02_features mcp47fvb12_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-251-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:252:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-253-};
 --
 drivers/iio/dac/mcp47feb02.c=255=static const struct mcp47feb02_features mcp47fvb14_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-259-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:260:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-261-};
 --
 drivers/iio/dac/mcp47feb02.c=263=static const struct mcp47feb02_features mcp47fvb18_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-267-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:268:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-269-};
 --
 drivers/iio/dac/mcp47feb02.c=271=static const struct mcp47feb02_features mcp47fvb21_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-275-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:276:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-277-};
 --
 drivers/iio/dac/mcp47feb02.c=279=static const struct mcp47feb02_features mcp47fvb22_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-283-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:284:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-285-};
 --
 drivers/iio/dac/mcp47feb02.c=287=static const struct mcp47feb02_features mcp47fvb24_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-291-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:292:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-293-};
 --
 drivers/iio/dac/mcp47feb02.c=295=static const struct mcp47feb02_features mcp47fvb28_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-299-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:300:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-301-};
 --
 drivers/iio/temperature/ltc2983.c=1642=static const struct ltc2983_chip_info ltc2984_chip_info_data = {
 --
 drivers/iio/temperature/ltc2983.c-1644-	.max_channels_nr = 20,
 drivers/iio/temperature/ltc2983.c:1645:	.has_eeprom = true,
 drivers/iio/temperature/ltc2983.c-1646-};
 --
 drivers/iio/temperature/ltc2983.c=1648=static const struct ltc2983_chip_info ltc2986_chip_info_data = {
 --
 drivers/iio/temperature/ltc2983.c-1651-	.has_temp = true,
 drivers/iio/temperature/ltc2983.c:1652:	.has_eeprom = true,
 drivers/iio/temperature/ltc2983.c-1653-};
 --
 drivers/iio/temperature/ltc2983.c=1655=static const struct ltc2983_chip_info ltm2985_chip_info_data = {
 --
 drivers/iio/temperature/ltc2983.c-1658-	.has_temp = true,
 drivers/iio/temperature/ltc2983.c:1659:	.has_eeprom = true,
 drivers/iio/temperature/ltc2983.c-1660-};
 --
 drivers/media/usb/dvb-usb-v2/af9035.c=491=static int af9035_identify_state(struct dvb_usb_device *d, const char **name)
 --
 drivers/media/usb/dvb-usb-v2/af9035.c-532-			dev_dbg(&intf->dev, "no eeprom\n");
 drivers/media/usb/dvb-usb-v2/af9035.c:533:			state->no_eeprom = true;
 drivers/media/usb/dvb-usb-v2/af9035.c-534-			goto check_firmware_status;
 --
 drivers/media/usb/dvb-usb-v2/af9035.c-539-		*name = AF9035_FIRMWARE_IT9303;
 drivers/media/usb/dvb-usb-v2/af9035.c:540:		state->no_eeprom = true;
 drivers/media/usb/dvb-usb-v2/af9035.c-541-		goto check_firmware_status;
 --
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c=31=static u8 *pvr2_eeprom_fetch(struct pvr2_hdw *hdw)
 --
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-41-	unsigned pcnt,tcnt;
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c:42:	eeprom = kzalloc(EEPROM_SIZE, GFP_KERNEL);
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-43-	if (!eeprom) {
 --
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c=102=int pvr2_eeprom_analyze(struct pvr2_hdw *hdw)
 --
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-108-
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c:109:	eeprom = pvr2_eeprom_fetch(hdw);
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-110-	if (!eeprom)
 --
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-127-	hdw->serial_number = tvdata.serial_number;
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c:128:	hdw->std_mask_eeprom = tvdata.tuner_formats;
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-129-
 --
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c=2083=static void pvr2_hdw_setup_low(struct pvr2_hdw *hdw)
 --
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c-2194-		hdw->tuner_updated = !0;
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2195:		hdw->std_mask_eeprom = V4L2_STD_ALL;
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c-2196-	}
 --
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c=3324=static u8 *pvr2_full_eeprom_fetch(struct pvr2_hdw *hdw)
 --
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c-3334-	unsigned pcnt,tcnt;
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:3335:	eeprom = kzalloc(EEPROM_SIZE, GFP_KERNEL);
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c-3336-	if (!eeprom) {
 --
 drivers/misc/eeprom/digsy_mtc_eeprom.c=40=static struct spi_gpio_platform_data eeprom_spi_gpio_data = {
 --
 drivers/misc/eeprom/digsy_mtc_eeprom.c-43-
 drivers/misc/eeprom/digsy_mtc_eeprom.c:44:static struct platform_device digsy_mtc_eeprom = {
 drivers/misc/eeprom/digsy_mtc_eeprom.c-45-	.name	= "spi_gpio",
 --
 drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c=320=static int pci1xxxx_otp_eeprom_probe(struct auxiliary_device *aux_dev,
 --
 drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c-376-
 drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c:377:		priv->nvmem_eeprom = devm_nvmem_register(&aux_dev->dev,
 drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c-378-							 &priv->nvmem_config_eeprom);
 --
 drivers/net/can/usb/peak_usb/pcan_usb.c=992=static const struct ethtool_ops pcan_usb_ethtool_ops = {
 --
 drivers/net/can/usb/peak_usb/pcan_usb.c-995-	.get_eeprom_len	= pcan_usb_get_eeprom_len,
 drivers/net/can/usb/peak_usb/pcan_usb.c:996:	.get_eeprom = peak_usb_get_eeprom,
 drivers/net/can/usb/peak_usb/pcan_usb.c:997:	.set_eeprom = peak_usb_set_eeprom,
 drivers/net/can/usb/peak_usb/pcan_usb.c-998-};
 --
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c=1126=static const struct ethtool_ops pcan_usb_fd_ethtool_ops = {
 --
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c-1129-	.get_eeprom_len	= peak_usb_get_eeprom_len,
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c:1130:	.get_eeprom = peak_usb_get_eeprom,
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c:1131:	.set_eeprom = peak_usb_set_eeprom,
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c-1132-};
 --
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c=1036=static const struct ethtool_ops pcan_usb_pro_ethtool_ops = {
 --
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c-1039-	.get_eeprom_len	= peak_usb_get_eeprom_len,
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c:1040:	.get_eeprom = peak_usb_get_eeprom,
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c:1041:	.set_eeprom = peak_usb_set_eeprom,
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c-1042-};
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4421=static const struct mv88e6xxx_ops mv88e6141_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4425-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4426:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:4427:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-4428-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4615=static const struct mv88e6xxx_ops mv88e6172_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4619-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4620:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:4621:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-4622-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4718=static const struct mv88e6xxx_ops mv88e6176_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4722-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4723:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:4724:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-4725-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4814=static const struct mv88e6xxx_ops mv88e6190_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4817-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4818:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:4819:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-4820-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4874=static const struct mv88e6xxx_ops mv88e6190x_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4877-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4878:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:4879:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-4880-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4934=static const struct mv88e6xxx_ops mv88e6191_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4937-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4938:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:4939:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-4940-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4993=static const struct mv88e6xxx_ops mv88e6240_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4997-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4998:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:4999:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-5000-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5053=static const struct mv88e6xxx_ops mv88e6250_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5057-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5058:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:5059:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-5060-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5098=static const struct mv88e6xxx_ops mv88e6290_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5101-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5102:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:5103:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-5104-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5160=static const struct mv88e6xxx_ops mv88e6320_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5165-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5166:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:5167:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-5168-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5213=static const struct mv88e6xxx_ops mv88e6321_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5218-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5219:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:5220:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-5221-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5265=static const struct mv88e6xxx_ops mv88e6341_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5269-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5270:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:5271:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-5272-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5424=static const struct mv88e6xxx_ops mv88e6352_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5428-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5429:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:5430:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-5431-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5487=static const struct mv88e6xxx_ops mv88e6390_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5490-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5491:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:5492:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-5493-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5552=static const struct mv88e6xxx_ops mv88e6390x_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5555-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5556:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:5557:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-5558-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5616=static const struct mv88e6xxx_ops mv88e6393x_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5618-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5619:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:5620:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-5621-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/ethernet/agere/et131x.c=669=static int et131x_init_eeprom(struct et131x_adapter *adapter)
 --
 drivers/net/ethernet/agere/et131x.c-716-			 */
 drivers/net/ethernet/agere/et131x.c:717:			adapter->has_eeprom = false;
 drivers/net/ethernet/agere/et131x.c-718-			return -EIO;
 --
 drivers/net/ethernet/agere/et131x.c-720-	}
 drivers/net/ethernet/agere/et131x.c:721:	adapter->has_eeprom = true;
 drivers/net/ethernet/agere/et131x.c-722-
 --
 drivers/net/ethernet/alacritech/slicoss.c=1593=static int slic_read_eeprom(struct slic_device *sdev)
 --
 drivers/net/ethernet/alacritech/slicoss.c-1606-
 drivers/net/ethernet/alacritech/slicoss.c:1607:	eeprom = dma_alloc_coherent(&sdev->pdev->dev, SLIC_EEPROM_SIZE,
 drivers/net/ethernet/alacritech/slicoss.c-1608-				    &paddr, GFP_KERNEL);
 --
 drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c=737=static const struct ethtool_ops xgbe_ethtool_ops = {
 --
 drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c-759-	.get_module_info = xgbe_get_module_info,
 drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c:760:	.get_module_eeprom = xgbe_get_module_eeprom,
 drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c-761-	.get_ringparam = xgbe_get_ringparam,
 --
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c=848=static bool xgbe_phy_belfuse_phy_quirks(struct xgbe_prv_data *pdata)
 --
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c-850-	struct xgbe_phy_data *phy_data = pdata->phy_data;
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c:851:	struct xgbe_sfp_eeprom *sfp_eeprom = &phy_data->sfp_eeprom;
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c-852-	unsigned int phy_id = phy_data->phydev->phy_id;
 --
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c=1069=static void xgbe_phy_sfp_parse_eeprom(struct xgbe_prv_data *pdata)
 --
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c-1071-	struct xgbe_phy_data *phy_data = pdata->phy_data;
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c:1072:	struct xgbe_sfp_eeprom *sfp_eeprom = &phy_data->sfp_eeprom;
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c-1073-	u8 *sfp_base;
 --
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c=1321=static int xgbe_phy_module_eeprom(struct xgbe_prv_data *pdata,
 --
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c-1381-
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c:1382:	sfp_eeprom = (struct xgbe_sfp_eeprom *)eeprom_data;
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c-1383-
 --
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c=785=const struct aq_fw_ops aq_fw_2x_ops = {
 --
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c-810-	.send_macsec_req    = aq_fw2x_send_macsec_req,
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c:811:	.read_module_eeprom = aq_fw2x_read_module_eeprom,
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c-812-};
]
]

gemini-3.1-pro-preview

							input: 342477
							output: 17
							thoughts: 482
						

**Tracing the rt2x00dev->eeprom Allocation**

Okay, so I need to figure out where `rt2x00dev->eeprom` is actually allocated. My initial thought was that it's done in `rt2x00lib_probe_dev`, so let me quickly re-examine that function. I looked at the code again, specifically around where `drv_data` is handled, thinking that the `eeprom` might be cleverly hidden as a part of that structure. But no, it's clearly not within the `drv_data` allocation.

Next, I thought, perhaps it's allocated during an EEPROM read/write function, so I scanned through `rt2x00_eeprom_read` and `rt2x00_eeprom_write`, but no luck there.

Alright, so not `rt2x00lib_probe_dev` or EEPROM access functions. What about `rt2x00lib_probe_hw`? Let me take a look at that. Nope, I can't find it there either. Let me look closer at the specific hardware probe, `rt2500usb_probe_hw`, since that's a likely spot. Aha, I see a comment that mentions EEPROM allocation, but it actually calls `rt2500usb_validate_eeprom`. Interesting. That function seems like a good place to start, so where is the actual allocation?

Back to `rt2x00lib_probe_dev`... Wait, I thought I checked that... I'm missing something. I checked `rt2x00lib_probe_dev` again. No, I don't see it allocated there. Where am I missing it?

Let me review `rt2x00lib_probe_dev` in `drivers/net/wireless/ralink/rt2x00/rt2x00dev.c` again. I'm still not finding the allocation. I did not see it there. Okay, I'm going to have to do a more thorough search. Time to use `grep`! I'll search the entire `drivers/net/wireless/ralink/rt2x00/` directory for any instances of `rt2x00dev->eeprom =`. Hopefully, that will pinpoint where this allocation happens.

map[Expression:eeprom =]

map[Output:
Full output is too long, showing 500 out of 1749 lines.
Use more precise expression if possible.

[Documentation/dev-tools/kunit/usage.rst=382=We can now use it to test ``struct eeprom_buffer``:
 --
 Documentation/dev-tools/kunit/usage.rst-394-		struct eeprom_buffer *eeprom_buffer = ctx->eeprom_buffer;
 Documentation/dev-tools/kunit/usage.rst:395:		struct fake_eeprom *fake_eeprom = ctx->fake_eeprom;
 Documentation/dev-tools/kunit/usage.rst-396-		char buffer[] = {0xff};
 --
 Documentation/dev-tools/kunit/usage.rst-414-		struct eeprom_buffer *eeprom_buffer = ctx->eeprom_buffer;
 Documentation/dev-tools/kunit/usage.rst:415:		struct fake_eeprom *fake_eeprom = ctx->fake_eeprom;
 Documentation/dev-tools/kunit/usage.rst-416-		char buffer[] = {0xff};
 --
 Documentation/dev-tools/kunit/usage.rst-431-		struct eeprom_buffer *eeprom_buffer = ctx->eeprom_buffer;
 Documentation/dev-tools/kunit/usage.rst:432:		struct fake_eeprom *fake_eeprom = ctx->fake_eeprom;
 Documentation/dev-tools/kunit/usage.rst-433-		char buffer[] = {0xff, 0xff};
 --
 Documentation/dev-tools/kunit/usage.rst-453-
 Documentation/dev-tools/kunit/usage.rst:454:		ctx->fake_eeprom = kunit_kzalloc(test, sizeof(*ctx->fake_eeprom), GFP_KERNEL);
 Documentation/dev-tools/kunit/usage.rst-455-		KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx->fake_eeprom);
 --
 Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml=308=examples:
 --
 Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml-316-        ieee80211-freq-limit = <5000000 6000000>;
 Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml:317:        mediatek,mtd-eeprom = <&factory 0x8000>;
 Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml-318-        big-endian;
 --
 arch/mips/boot/dts/ralink/gardena_smart_gateway_mt7688.dts=202=&wmac {
 arch/mips/boot/dts/ralink/gardena_smart_gateway_mt7688.dts-203-	status = "okay";
 arch/mips/boot/dts/ralink/gardena_smart_gateway_mt7688.dts:204:	mediatek,mtd-eeprom = <&factory 0x0000>;
 arch/mips/boot/dts/ralink/gardena_smart_gateway_mt7688.dts-205-};
 --
 drivers/accel/habanalabs/common/sysfs.c=451=static DEVICE_ATTR_RO(parent_device);
 drivers/accel/habanalabs/common/sysfs.c-452-
 drivers/accel/habanalabs/common/sysfs.c:453:static const struct bin_attribute bin_attr_eeprom = {
 drivers/accel/habanalabs/common/sysfs.c-454-	.attr = {.name = "eeprom", .mode = (0444)},
 --
 drivers/comedi/drivers/addi_apci_1564.c=658=static int apci1564_auto_attach(struct comedi_device *dev,
 --
 drivers/comedi/drivers/addi_apci_1564.c-675-	/* read the EEPROM register and check the I/O map revision */
 drivers/comedi/drivers/addi_apci_1564.c:676:	devpriv->eeprom = pci_resource_start(pcidev, 0);
 drivers/comedi/drivers/addi_apci_1564.c-677-	val = inl(devpriv->eeprom + APCI1564_EEPROM_REG);
 --
 drivers/comedi/drivers/ni_pcimio.c=1219=static void m_series_init_eeprom_buffer(struct comedi_device *dev)
 --
 drivers/comedi/drivers/ni_pcimio.c-1223-	resource_size_t daq_phys_addr;
 drivers/comedi/drivers/ni_pcimio.c:1224:	static const int start_cal_eeprom = 0x400;
 drivers/comedi/drivers/ni_pcimio.c-1225-	static const unsigned int window_size = 10;
 --
 drivers/cpufreq/pmac64-cpufreq.c=478=static int __init g5_pm72_cpufreq_init(struct device_node *cpunode)
 --
 drivers/cpufreq/pmac64-cpufreq.c-480-	struct device_node *cpuid = NULL, *hwclock = NULL;
 drivers/cpufreq/pmac64-cpufreq.c:481:	const u8 *eeprom = NULL;
 drivers/cpufreq/pmac64-cpufreq.c-482-	const u32 *valp;
 --
 drivers/cpufreq/pmac64-cpufreq.c-491-	if (cpuid != NULL)
 drivers/cpufreq/pmac64-cpufreq.c:492:		eeprom = of_get_property(cpuid, "cpuid", NULL);
 drivers/cpufreq/pmac64-cpufreq.c:493:	if (eeprom == NULL) {
 drivers/cpufreq/pmac64-cpufreq.c-494-		pr_err("Can't find cpuid EEPROM !\n");
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c=2183=static struct dentry *amdgpu_ras_debugfs_create_ctrl_node(struct amdgpu_device *adev)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c-2185-	struct amdgpu_ras *con = amdgpu_ras_get_context(adev);
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c:2186:	struct amdgpu_ras_eeprom_control *eeprom = &con->eeprom_control;
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c-2187-	struct drm_minor  *minor = adev_to_drm(adev)->primary;
 --
 drivers/hid/hid-picolcd_debugfs.c=838=void picolcd_init_devfs(struct picolcd_data *data,
 --
 drivers/hid/hid-picolcd_debugfs.c-853-	if (eeprom_r || eeprom_w)
 drivers/hid/hid-picolcd_debugfs.c:854:		data->debug_eeprom = debugfs_create_file("eeprom",
 drivers/hid/hid-picolcd_debugfs.c-855-			(eeprom_w ? S_IWUSR : 0) | (eeprom_r ? S_IRUSR : 0),
 --
 drivers/hid/hid-picolcd_debugfs.c=871=void picolcd_exit_devfs(struct picolcd_data *data)
 --
 drivers/hid/hid-picolcd_debugfs.c-878-	dent = data->debug_eeprom;
 drivers/hid/hid-picolcd_debugfs.c:879:	data->debug_eeprom = NULL;
 drivers/hid/hid-picolcd_debugfs.c-880-	debugfs_remove(dent);
 --
 drivers/hid/hid-wiimote-debug.c=172=int wiidebug_init(struct wiimote_data *wdata)
 --
 drivers/hid/hid-wiimote-debug.c-182-
 drivers/hid/hid-wiimote-debug.c:183:	dbg->eeprom = debugfs_create_file("eeprom", S_IRUSR,
 drivers/hid/hid-wiimote-debug.c-184-		dbg->wdata->hdev->debug_dir, dbg, &wiidebug_eeprom_fops);
 --
 drivers/i2c/i2c-slave-eeprom.c=45=static int i2c_slave_eeprom_slave_cb(struct i2c_client *client,
 --
 drivers/i2c/i2c-slave-eeprom.c-47-{
 drivers/i2c/i2c-slave-eeprom.c:48:	struct eeprom_data *eeprom = i2c_get_clientdata(client);
 drivers/i2c/i2c-slave-eeprom.c-49-
 --
 drivers/i2c/i2c-slave-eeprom.c=93=static ssize_t i2c_slave_eeprom_bin_read(struct file *filp, struct kobject *kobj,
 --
 drivers/i2c/i2c-slave-eeprom.c-98-
 drivers/i2c/i2c-slave-eeprom.c:99:	eeprom = dev_get_drvdata(kobj_to_dev(kobj));
 drivers/i2c/i2c-slave-eeprom.c-100-
 --
 drivers/i2c/i2c-slave-eeprom.c=108=static ssize_t i2c_slave_eeprom_bin_write(struct file *filp, struct kobject *kobj,
 --
 drivers/i2c/i2c-slave-eeprom.c-113-
 drivers/i2c/i2c-slave-eeprom.c:114:	eeprom = dev_get_drvdata(kobj_to_dev(kobj));
 drivers/i2c/i2c-slave-eeprom.c-115-
 --
 drivers/i2c/i2c-slave-eeprom.c=143=static int i2c_slave_eeprom_probe(struct i2c_client *client)
 --
 drivers/i2c/i2c-slave-eeprom.c-150-
 drivers/i2c/i2c-slave-eeprom.c:151:	eeprom = devm_kzalloc(&client->dev, sizeof(struct eeprom_data) + size, GFP_KERNEL);
 drivers/i2c/i2c-slave-eeprom.c-152-	if (!eeprom)
 --
 drivers/i2c/i2c-slave-eeprom.c=185=static void i2c_slave_eeprom_remove(struct i2c_client *client)
 drivers/i2c/i2c-slave-eeprom.c-186-{
 drivers/i2c/i2c-slave-eeprom.c:187:	struct eeprom_data *eeprom = i2c_get_clientdata(client);
 drivers/i2c/i2c-slave-eeprom.c-188-
 --
 drivers/iio/dac/mcp47feb02.c=111=static const struct mcp47feb02_features mcp47feb01_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-115-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:116:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-117-};
 --
 drivers/iio/dac/mcp47feb02.c=119=static const struct mcp47feb02_features mcp47feb02_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-123-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:124:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-125-};
 --
 drivers/iio/dac/mcp47feb02.c=127=static const struct mcp47feb02_features mcp47feb04_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-131-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:132:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-133-};
 --
 drivers/iio/dac/mcp47feb02.c=135=static const struct mcp47feb02_features mcp47feb08_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-139-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:140:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-141-};
 --
 drivers/iio/dac/mcp47feb02.c=143=static const struct mcp47feb02_features mcp47feb11_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-147-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:148:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-149-};
 --
 drivers/iio/dac/mcp47feb02.c=151=static const struct mcp47feb02_features mcp47feb12_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-155-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:156:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-157-};
 --
 drivers/iio/dac/mcp47feb02.c=159=static const struct mcp47feb02_features mcp47feb14_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-163-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:164:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-165-};
 --
 drivers/iio/dac/mcp47feb02.c=167=static const struct mcp47feb02_features mcp47feb18_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-171-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:172:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-173-};
 --
 drivers/iio/dac/mcp47feb02.c=175=static const struct mcp47feb02_features mcp47feb21_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-179-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:180:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-181-};
 --
 drivers/iio/dac/mcp47feb02.c=183=static const struct mcp47feb02_features mcp47feb22_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-187-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:188:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-189-};
 --
 drivers/iio/dac/mcp47feb02.c=191=static const struct mcp47feb02_features mcp47feb24_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-195-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:196:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-197-};
 --
 drivers/iio/dac/mcp47feb02.c=199=static const struct mcp47feb02_features mcp47feb28_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-203-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:204:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-205-};
 --
 drivers/iio/dac/mcp47feb02.c=207=static const struct mcp47feb02_features mcp47fvb01_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-211-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:212:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-213-};
 --
 drivers/iio/dac/mcp47feb02.c=215=static const struct mcp47feb02_features mcp47fvb02_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-219-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:220:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-221-};
 --
 drivers/iio/dac/mcp47feb02.c=223=static const struct mcp47feb02_features mcp47fvb04_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-227-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:228:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-229-};
 --
 drivers/iio/dac/mcp47feb02.c=231=static const struct mcp47feb02_features mcp47fvb08_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-235-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:236:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-237-};
 --
 drivers/iio/dac/mcp47feb02.c=239=static const struct mcp47feb02_features mcp47fvb11_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-243-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:244:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-245-};
 --
 drivers/iio/dac/mcp47feb02.c=247=static const struct mcp47feb02_features mcp47fvb12_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-251-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:252:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-253-};
 --
 drivers/iio/dac/mcp47feb02.c=255=static const struct mcp47feb02_features mcp47fvb14_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-259-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:260:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-261-};
 --
 drivers/iio/dac/mcp47feb02.c=263=static const struct mcp47feb02_features mcp47fvb18_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-267-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:268:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-269-};
 --
 drivers/iio/dac/mcp47feb02.c=271=static const struct mcp47feb02_features mcp47fvb21_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-275-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:276:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-277-};
 --
 drivers/iio/dac/mcp47feb02.c=279=static const struct mcp47feb02_features mcp47fvb22_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-283-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:284:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-285-};
 --
 drivers/iio/dac/mcp47feb02.c=287=static const struct mcp47feb02_features mcp47fvb24_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-291-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:292:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-293-};
 --
 drivers/iio/dac/mcp47feb02.c=295=static const struct mcp47feb02_features mcp47fvb28_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-299-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:300:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-301-};
 --
 drivers/iio/temperature/ltc2983.c=1642=static const struct ltc2983_chip_info ltc2984_chip_info_data = {
 --
 drivers/iio/temperature/ltc2983.c-1644-	.max_channels_nr = 20,
 drivers/iio/temperature/ltc2983.c:1645:	.has_eeprom = true,
 drivers/iio/temperature/ltc2983.c-1646-};
 --
 drivers/iio/temperature/ltc2983.c=1648=static const struct ltc2983_chip_info ltc2986_chip_info_data = {
 --
 drivers/iio/temperature/ltc2983.c-1651-	.has_temp = true,
 drivers/iio/temperature/ltc2983.c:1652:	.has_eeprom = true,
 drivers/iio/temperature/ltc2983.c-1653-};
 --
 drivers/iio/temperature/ltc2983.c=1655=static const struct ltc2983_chip_info ltm2985_chip_info_data = {
 --
 drivers/iio/temperature/ltc2983.c-1658-	.has_temp = true,
 drivers/iio/temperature/ltc2983.c:1659:	.has_eeprom = true,
 drivers/iio/temperature/ltc2983.c-1660-};
 --
 drivers/media/usb/dvb-usb-v2/af9035.c=491=static int af9035_identify_state(struct dvb_usb_device *d, const char **name)
 --
 drivers/media/usb/dvb-usb-v2/af9035.c-532-			dev_dbg(&intf->dev, "no eeprom\n");
 drivers/media/usb/dvb-usb-v2/af9035.c:533:			state->no_eeprom = true;
 drivers/media/usb/dvb-usb-v2/af9035.c-534-			goto check_firmware_status;
 --
 drivers/media/usb/dvb-usb-v2/af9035.c-539-		*name = AF9035_FIRMWARE_IT9303;
 drivers/media/usb/dvb-usb-v2/af9035.c:540:		state->no_eeprom = true;
 drivers/media/usb/dvb-usb-v2/af9035.c-541-		goto check_firmware_status;
 --
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c=31=static u8 *pvr2_eeprom_fetch(struct pvr2_hdw *hdw)
 --
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-41-	unsigned pcnt,tcnt;
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c:42:	eeprom = kzalloc(EEPROM_SIZE, GFP_KERNEL);
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-43-	if (!eeprom) {
 --
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c=102=int pvr2_eeprom_analyze(struct pvr2_hdw *hdw)
 --
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-108-
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c:109:	eeprom = pvr2_eeprom_fetch(hdw);
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-110-	if (!eeprom)
 --
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-127-	hdw->serial_number = tvdata.serial_number;
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c:128:	hdw->std_mask_eeprom = tvdata.tuner_formats;
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-129-
 --
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c=2083=static void pvr2_hdw_setup_low(struct pvr2_hdw *hdw)
 --
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c-2194-		hdw->tuner_updated = !0;
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2195:		hdw->std_mask_eeprom = V4L2_STD_ALL;
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c-2196-	}
 --
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c=3324=static u8 *pvr2_full_eeprom_fetch(struct pvr2_hdw *hdw)
 --
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c-3334-	unsigned pcnt,tcnt;
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:3335:	eeprom = kzalloc(EEPROM_SIZE, GFP_KERNEL);
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c-3336-	if (!eeprom) {
 --
 drivers/misc/eeprom/digsy_mtc_eeprom.c=40=static struct spi_gpio_platform_data eeprom_spi_gpio_data = {
 --
 drivers/misc/eeprom/digsy_mtc_eeprom.c-43-
 drivers/misc/eeprom/digsy_mtc_eeprom.c:44:static struct platform_device digsy_mtc_eeprom = {
 drivers/misc/eeprom/digsy_mtc_eeprom.c-45-	.name	= "spi_gpio",
 --
 drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c=320=static int pci1xxxx_otp_eeprom_probe(struct auxiliary_device *aux_dev,
 --
 drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c-376-
 drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c:377:		priv->nvmem_eeprom = devm_nvmem_register(&aux_dev->dev,
 drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c-378-							 &priv->nvmem_config_eeprom);
 --
 drivers/net/can/usb/peak_usb/pcan_usb.c=992=static const struct ethtool_ops pcan_usb_ethtool_ops = {
 --
 drivers/net/can/usb/peak_usb/pcan_usb.c-995-	.get_eeprom_len	= pcan_usb_get_eeprom_len,
 drivers/net/can/usb/peak_usb/pcan_usb.c:996:	.get_eeprom = peak_usb_get_eeprom,
 drivers/net/can/usb/peak_usb/pcan_usb.c:997:	.set_eeprom = peak_usb_set_eeprom,
 drivers/net/can/usb/peak_usb/pcan_usb.c-998-};
 --
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c=1126=static const struct ethtool_ops pcan_usb_fd_ethtool_ops = {
 --
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c-1129-	.get_eeprom_len	= peak_usb_get_eeprom_len,
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c:1130:	.get_eeprom = peak_usb_get_eeprom,
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c:1131:	.set_eeprom = peak_usb_set_eeprom,
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c-1132-};
 --
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c=1036=static const struct ethtool_ops pcan_usb_pro_ethtool_ops = {
 --
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c-1039-	.get_eeprom_len	= peak_usb_get_eeprom_len,
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c:1040:	.get_eeprom = peak_usb_get_eeprom,
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c:1041:	.set_eeprom = peak_usb_set_eeprom,
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c-1042-};
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4421=static const struct mv88e6xxx_ops mv88e6141_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4425-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4426:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:4427:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-4428-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4615=static const struct mv88e6xxx_ops mv88e6172_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4619-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4620:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:4621:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-4622-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4718=static const struct mv88e6xxx_ops mv88e6176_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4722-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4723:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:4724:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-4725-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4814=static const struct mv88e6xxx_ops mv88e6190_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4817-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4818:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:4819:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-4820-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4874=static const struct mv88e6xxx_ops mv88e6190x_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4877-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4878:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:4879:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-4880-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4934=static const struct mv88e6xxx_ops mv88e6191_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4937-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4938:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:4939:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-4940-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4993=static const struct mv88e6xxx_ops mv88e6240_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4997-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4998:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:4999:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-5000-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5053=static const struct mv88e6xxx_ops mv88e6250_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5057-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5058:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:5059:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-5060-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5098=static const struct mv88e6xxx_ops mv88e6290_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5101-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5102:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:5103:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-5104-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5160=static const struct mv88e6xxx_ops mv88e6320_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5165-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5166:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:5167:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-5168-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5213=static const struct mv88e6xxx_ops mv88e6321_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5218-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5219:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:5220:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-5221-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5265=static const struct mv88e6xxx_ops mv88e6341_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5269-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5270:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:5271:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-5272-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5424=static const struct mv88e6xxx_ops mv88e6352_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5428-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5429:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:5430:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-5431-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5487=static const struct mv88e6xxx_ops mv88e6390_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5490-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5491:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:5492:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-5493-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5552=static const struct mv88e6xxx_ops mv88e6390x_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5555-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5556:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:5557:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-5558-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5616=static const struct mv88e6xxx_ops mv88e6393x_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5618-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5619:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:5620:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-5621-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/ethernet/agere/et131x.c=669=static int et131x_init_eeprom(struct et131x_adapter *adapter)
 --
 drivers/net/ethernet/agere/et131x.c-716-			 */
 drivers/net/ethernet/agere/et131x.c:717:			adapter->has_eeprom = false;
 drivers/net/ethernet/agere/et131x.c-718-			return -EIO;
 --
 drivers/net/ethernet/agere/et131x.c-720-	}
 drivers/net/ethernet/agere/et131x.c:721:	adapter->has_eeprom = true;
 drivers/net/ethernet/agere/et131x.c-722-
 --
 drivers/net/ethernet/alacritech/slicoss.c=1593=static int slic_read_eeprom(struct slic_device *sdev)
 --
 drivers/net/ethernet/alacritech/slicoss.c-1606-
 drivers/net/ethernet/alacritech/slicoss.c:1607:	eeprom = dma_alloc_coherent(&sdev->pdev->dev, SLIC_EEPROM_SIZE,
 drivers/net/ethernet/alacritech/slicoss.c-1608-				    &paddr, GFP_KERNEL);
 --
 drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c=737=static const struct ethtool_ops xgbe_ethtool_ops = {
 --
 drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c-759-	.get_module_info = xgbe_get_module_info,
 drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c:760:	.get_module_eeprom = xgbe_get_module_eeprom,
 drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c-761-	.get_ringparam = xgbe_get_ringparam,
 --
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c=848=static bool xgbe_phy_belfuse_phy_quirks(struct xgbe_prv_data *pdata)
 --
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c-850-	struct xgbe_phy_data *phy_data = pdata->phy_data;
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c:851:	struct xgbe_sfp_eeprom *sfp_eeprom = &phy_data->sfp_eeprom;
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c-852-	unsigned int phy_id = phy_data->phydev->phy_id;
 --
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c=1069=static void xgbe_phy_sfp_parse_eeprom(struct xgbe_prv_data *pdata)
 --
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c-1071-	struct xgbe_phy_data *phy_data = pdata->phy_data;
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c:1072:	struct xgbe_sfp_eeprom *sfp_eeprom = &phy_data->sfp_eeprom;
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c-1073-	u8 *sfp_base;
 --
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c=1321=static int xgbe_phy_module_eeprom(struct xgbe_prv_data *pdata,
 --
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c-1381-
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c:1382:	sfp_eeprom = (struct xgbe_sfp_eeprom *)eeprom_data;
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c-1383-
 --
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c=785=const struct aq_fw_ops aq_fw_2x_ops = {
 --
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c-810-	.send_macsec_req    = aq_fw2x_send_macsec_req,
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c:811:	.read_module_eeprom = aq_fw2x_read_module_eeprom,
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c-812-};
]
]

gemini-3.1-pro-preview

							input: 357457
							output: 17
							thoughts: 335
						

**Tracing the EEPROM Allocation**

Okay, so I'm trying to figure out where the `rt2x00dev->eeprom` structure is actually allocated. My initial thought was that it was done within `rt2x00lib_probe_dev`, but something feels off. Let me double-check that... right, no, that only handles the driver data, allocated based on `rt2x00dev->ops->drv_data_size`.

Now I'm looking at `rt2x00lib_probe_hw`. The comment here says "Allocate eeprom data," and it calls `rt2500usb_validate_eeprom`. So, it *seems* like this is where it's happening, but the function name feels a little misleading. Is the allocation *actually* in the validation function? Or is the validation function merely _using_ an already-allocated `eeprom`?

Alright, time to be definitive. I need to be sure where that memory gets allocated. I'll just search for the direct assignment `rt2x00dev->eeprom = ` within the `drivers/net/wireless/ralink/rt2x00/` directory. That's the most reliable way to find the actual allocation.

map[Expression:eeprom =]

map[Output:
Full output is too long, showing 500 out of 1749 lines.
Use more precise expression if possible.

[Documentation/dev-tools/kunit/usage.rst=382=We can now use it to test ``struct eeprom_buffer``:
 --
 Documentation/dev-tools/kunit/usage.rst-394-		struct eeprom_buffer *eeprom_buffer = ctx->eeprom_buffer;
 Documentation/dev-tools/kunit/usage.rst:395:		struct fake_eeprom *fake_eeprom = ctx->fake_eeprom;
 Documentation/dev-tools/kunit/usage.rst-396-		char buffer[] = {0xff};
 --
 Documentation/dev-tools/kunit/usage.rst-414-		struct eeprom_buffer *eeprom_buffer = ctx->eeprom_buffer;
 Documentation/dev-tools/kunit/usage.rst:415:		struct fake_eeprom *fake_eeprom = ctx->fake_eeprom;
 Documentation/dev-tools/kunit/usage.rst-416-		char buffer[] = {0xff};
 --
 Documentation/dev-tools/kunit/usage.rst-431-		struct eeprom_buffer *eeprom_buffer = ctx->eeprom_buffer;
 Documentation/dev-tools/kunit/usage.rst:432:		struct fake_eeprom *fake_eeprom = ctx->fake_eeprom;
 Documentation/dev-tools/kunit/usage.rst-433-		char buffer[] = {0xff, 0xff};
 --
 Documentation/dev-tools/kunit/usage.rst-453-
 Documentation/dev-tools/kunit/usage.rst:454:		ctx->fake_eeprom = kunit_kzalloc(test, sizeof(*ctx->fake_eeprom), GFP_KERNEL);
 Documentation/dev-tools/kunit/usage.rst-455-		KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx->fake_eeprom);
 --
 Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml=308=examples:
 --
 Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml-316-        ieee80211-freq-limit = <5000000 6000000>;
 Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml:317:        mediatek,mtd-eeprom = <&factory 0x8000>;
 Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml-318-        big-endian;
 --
 arch/mips/boot/dts/ralink/gardena_smart_gateway_mt7688.dts=202=&wmac {
 arch/mips/boot/dts/ralink/gardena_smart_gateway_mt7688.dts-203-	status = "okay";
 arch/mips/boot/dts/ralink/gardena_smart_gateway_mt7688.dts:204:	mediatek,mtd-eeprom = <&factory 0x0000>;
 arch/mips/boot/dts/ralink/gardena_smart_gateway_mt7688.dts-205-};
 --
 drivers/accel/habanalabs/common/sysfs.c=451=static DEVICE_ATTR_RO(parent_device);
 drivers/accel/habanalabs/common/sysfs.c-452-
 drivers/accel/habanalabs/common/sysfs.c:453:static const struct bin_attribute bin_attr_eeprom = {
 drivers/accel/habanalabs/common/sysfs.c-454-	.attr = {.name = "eeprom", .mode = (0444)},
 --
 drivers/comedi/drivers/addi_apci_1564.c=658=static int apci1564_auto_attach(struct comedi_device *dev,
 --
 drivers/comedi/drivers/addi_apci_1564.c-675-	/* read the EEPROM register and check the I/O map revision */
 drivers/comedi/drivers/addi_apci_1564.c:676:	devpriv->eeprom = pci_resource_start(pcidev, 0);
 drivers/comedi/drivers/addi_apci_1564.c-677-	val = inl(devpriv->eeprom + APCI1564_EEPROM_REG);
 --
 drivers/comedi/drivers/ni_pcimio.c=1219=static void m_series_init_eeprom_buffer(struct comedi_device *dev)
 --
 drivers/comedi/drivers/ni_pcimio.c-1223-	resource_size_t daq_phys_addr;
 drivers/comedi/drivers/ni_pcimio.c:1224:	static const int start_cal_eeprom = 0x400;
 drivers/comedi/drivers/ni_pcimio.c-1225-	static const unsigned int window_size = 10;
 --
 drivers/cpufreq/pmac64-cpufreq.c=478=static int __init g5_pm72_cpufreq_init(struct device_node *cpunode)
 --
 drivers/cpufreq/pmac64-cpufreq.c-480-	struct device_node *cpuid = NULL, *hwclock = NULL;
 drivers/cpufreq/pmac64-cpufreq.c:481:	const u8 *eeprom = NULL;
 drivers/cpufreq/pmac64-cpufreq.c-482-	const u32 *valp;
 --
 drivers/cpufreq/pmac64-cpufreq.c-491-	if (cpuid != NULL)
 drivers/cpufreq/pmac64-cpufreq.c:492:		eeprom = of_get_property(cpuid, "cpuid", NULL);
 drivers/cpufreq/pmac64-cpufreq.c:493:	if (eeprom == NULL) {
 drivers/cpufreq/pmac64-cpufreq.c-494-		pr_err("Can't find cpuid EEPROM !\n");
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c=2183=static struct dentry *amdgpu_ras_debugfs_create_ctrl_node(struct amdgpu_device *adev)
 --
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c-2185-	struct amdgpu_ras *con = amdgpu_ras_get_context(adev);
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c:2186:	struct amdgpu_ras_eeprom_control *eeprom = &con->eeprom_control;
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c-2187-	struct drm_minor  *minor = adev_to_drm(adev)->primary;
 --
 drivers/hid/hid-picolcd_debugfs.c=838=void picolcd_init_devfs(struct picolcd_data *data,
 --
 drivers/hid/hid-picolcd_debugfs.c-853-	if (eeprom_r || eeprom_w)
 drivers/hid/hid-picolcd_debugfs.c:854:		data->debug_eeprom = debugfs_create_file("eeprom",
 drivers/hid/hid-picolcd_debugfs.c-855-			(eeprom_w ? S_IWUSR : 0) | (eeprom_r ? S_IRUSR : 0),
 --
 drivers/hid/hid-picolcd_debugfs.c=871=void picolcd_exit_devfs(struct picolcd_data *data)
 --
 drivers/hid/hid-picolcd_debugfs.c-878-	dent = data->debug_eeprom;
 drivers/hid/hid-picolcd_debugfs.c:879:	data->debug_eeprom = NULL;
 drivers/hid/hid-picolcd_debugfs.c-880-	debugfs_remove(dent);
 --
 drivers/hid/hid-wiimote-debug.c=172=int wiidebug_init(struct wiimote_data *wdata)
 --
 drivers/hid/hid-wiimote-debug.c-182-
 drivers/hid/hid-wiimote-debug.c:183:	dbg->eeprom = debugfs_create_file("eeprom", S_IRUSR,
 drivers/hid/hid-wiimote-debug.c-184-		dbg->wdata->hdev->debug_dir, dbg, &wiidebug_eeprom_fops);
 --
 drivers/i2c/i2c-slave-eeprom.c=45=static int i2c_slave_eeprom_slave_cb(struct i2c_client *client,
 --
 drivers/i2c/i2c-slave-eeprom.c-47-{
 drivers/i2c/i2c-slave-eeprom.c:48:	struct eeprom_data *eeprom = i2c_get_clientdata(client);
 drivers/i2c/i2c-slave-eeprom.c-49-
 --
 drivers/i2c/i2c-slave-eeprom.c=93=static ssize_t i2c_slave_eeprom_bin_read(struct file *filp, struct kobject *kobj,
 --
 drivers/i2c/i2c-slave-eeprom.c-98-
 drivers/i2c/i2c-slave-eeprom.c:99:	eeprom = dev_get_drvdata(kobj_to_dev(kobj));
 drivers/i2c/i2c-slave-eeprom.c-100-
 --
 drivers/i2c/i2c-slave-eeprom.c=108=static ssize_t i2c_slave_eeprom_bin_write(struct file *filp, struct kobject *kobj,
 --
 drivers/i2c/i2c-slave-eeprom.c-113-
 drivers/i2c/i2c-slave-eeprom.c:114:	eeprom = dev_get_drvdata(kobj_to_dev(kobj));
 drivers/i2c/i2c-slave-eeprom.c-115-
 --
 drivers/i2c/i2c-slave-eeprom.c=143=static int i2c_slave_eeprom_probe(struct i2c_client *client)
 --
 drivers/i2c/i2c-slave-eeprom.c-150-
 drivers/i2c/i2c-slave-eeprom.c:151:	eeprom = devm_kzalloc(&client->dev, sizeof(struct eeprom_data) + size, GFP_KERNEL);
 drivers/i2c/i2c-slave-eeprom.c-152-	if (!eeprom)
 --
 drivers/i2c/i2c-slave-eeprom.c=185=static void i2c_slave_eeprom_remove(struct i2c_client *client)
 drivers/i2c/i2c-slave-eeprom.c-186-{
 drivers/i2c/i2c-slave-eeprom.c:187:	struct eeprom_data *eeprom = i2c_get_clientdata(client);
 drivers/i2c/i2c-slave-eeprom.c-188-
 --
 drivers/iio/dac/mcp47feb02.c=111=static const struct mcp47feb02_features mcp47feb01_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-115-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:116:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-117-};
 --
 drivers/iio/dac/mcp47feb02.c=119=static const struct mcp47feb02_features mcp47feb02_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-123-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:124:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-125-};
 --
 drivers/iio/dac/mcp47feb02.c=127=static const struct mcp47feb02_features mcp47feb04_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-131-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:132:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-133-};
 --
 drivers/iio/dac/mcp47feb02.c=135=static const struct mcp47feb02_features mcp47feb08_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-139-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:140:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-141-};
 --
 drivers/iio/dac/mcp47feb02.c=143=static const struct mcp47feb02_features mcp47feb11_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-147-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:148:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-149-};
 --
 drivers/iio/dac/mcp47feb02.c=151=static const struct mcp47feb02_features mcp47feb12_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-155-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:156:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-157-};
 --
 drivers/iio/dac/mcp47feb02.c=159=static const struct mcp47feb02_features mcp47feb14_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-163-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:164:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-165-};
 --
 drivers/iio/dac/mcp47feb02.c=167=static const struct mcp47feb02_features mcp47feb18_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-171-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:172:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-173-};
 --
 drivers/iio/dac/mcp47feb02.c=175=static const struct mcp47feb02_features mcp47feb21_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-179-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:180:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-181-};
 --
 drivers/iio/dac/mcp47feb02.c=183=static const struct mcp47feb02_features mcp47feb22_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-187-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:188:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-189-};
 --
 drivers/iio/dac/mcp47feb02.c=191=static const struct mcp47feb02_features mcp47feb24_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-195-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:196:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-197-};
 --
 drivers/iio/dac/mcp47feb02.c=199=static const struct mcp47feb02_features mcp47feb28_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-203-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:204:	.have_eeprom = true,
 drivers/iio/dac/mcp47feb02.c-205-};
 --
 drivers/iio/dac/mcp47feb02.c=207=static const struct mcp47feb02_features mcp47fvb01_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-211-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:212:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-213-};
 --
 drivers/iio/dac/mcp47feb02.c=215=static const struct mcp47feb02_features mcp47fvb02_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-219-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:220:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-221-};
 --
 drivers/iio/dac/mcp47feb02.c=223=static const struct mcp47feb02_features mcp47fvb04_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-227-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:228:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-229-};
 --
 drivers/iio/dac/mcp47feb02.c=231=static const struct mcp47feb02_features mcp47fvb08_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-235-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:236:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-237-};
 --
 drivers/iio/dac/mcp47feb02.c=239=static const struct mcp47feb02_features mcp47fvb11_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-243-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:244:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-245-};
 --
 drivers/iio/dac/mcp47feb02.c=247=static const struct mcp47feb02_features mcp47fvb12_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-251-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:252:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-253-};
 --
 drivers/iio/dac/mcp47feb02.c=255=static const struct mcp47feb02_features mcp47fvb14_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-259-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:260:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-261-};
 --
 drivers/iio/dac/mcp47feb02.c=263=static const struct mcp47feb02_features mcp47fvb18_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-267-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:268:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-269-};
 --
 drivers/iio/dac/mcp47feb02.c=271=static const struct mcp47feb02_features mcp47fvb21_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-275-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:276:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-277-};
 --
 drivers/iio/dac/mcp47feb02.c=279=static const struct mcp47feb02_features mcp47fvb22_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-283-	.have_ext_vref1 = false,
 drivers/iio/dac/mcp47feb02.c:284:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-285-};
 --
 drivers/iio/dac/mcp47feb02.c=287=static const struct mcp47feb02_features mcp47fvb24_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-291-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:292:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-293-};
 --
 drivers/iio/dac/mcp47feb02.c=295=static const struct mcp47feb02_features mcp47fvb28_chip_features = {
 --
 drivers/iio/dac/mcp47feb02.c-299-	.have_ext_vref1 = true,
 drivers/iio/dac/mcp47feb02.c:300:	.have_eeprom = false,
 drivers/iio/dac/mcp47feb02.c-301-};
 --
 drivers/iio/temperature/ltc2983.c=1642=static const struct ltc2983_chip_info ltc2984_chip_info_data = {
 --
 drivers/iio/temperature/ltc2983.c-1644-	.max_channels_nr = 20,
 drivers/iio/temperature/ltc2983.c:1645:	.has_eeprom = true,
 drivers/iio/temperature/ltc2983.c-1646-};
 --
 drivers/iio/temperature/ltc2983.c=1648=static const struct ltc2983_chip_info ltc2986_chip_info_data = {
 --
 drivers/iio/temperature/ltc2983.c-1651-	.has_temp = true,
 drivers/iio/temperature/ltc2983.c:1652:	.has_eeprom = true,
 drivers/iio/temperature/ltc2983.c-1653-};
 --
 drivers/iio/temperature/ltc2983.c=1655=static const struct ltc2983_chip_info ltm2985_chip_info_data = {
 --
 drivers/iio/temperature/ltc2983.c-1658-	.has_temp = true,
 drivers/iio/temperature/ltc2983.c:1659:	.has_eeprom = true,
 drivers/iio/temperature/ltc2983.c-1660-};
 --
 drivers/media/usb/dvb-usb-v2/af9035.c=491=static int af9035_identify_state(struct dvb_usb_device *d, const char **name)
 --
 drivers/media/usb/dvb-usb-v2/af9035.c-532-			dev_dbg(&intf->dev, "no eeprom\n");
 drivers/media/usb/dvb-usb-v2/af9035.c:533:			state->no_eeprom = true;
 drivers/media/usb/dvb-usb-v2/af9035.c-534-			goto check_firmware_status;
 --
 drivers/media/usb/dvb-usb-v2/af9035.c-539-		*name = AF9035_FIRMWARE_IT9303;
 drivers/media/usb/dvb-usb-v2/af9035.c:540:		state->no_eeprom = true;
 drivers/media/usb/dvb-usb-v2/af9035.c-541-		goto check_firmware_status;
 --
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c=31=static u8 *pvr2_eeprom_fetch(struct pvr2_hdw *hdw)
 --
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-41-	unsigned pcnt,tcnt;
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c:42:	eeprom = kzalloc(EEPROM_SIZE, GFP_KERNEL);
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-43-	if (!eeprom) {
 --
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c=102=int pvr2_eeprom_analyze(struct pvr2_hdw *hdw)
 --
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-108-
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c:109:	eeprom = pvr2_eeprom_fetch(hdw);
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-110-	if (!eeprom)
 --
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-127-	hdw->serial_number = tvdata.serial_number;
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c:128:	hdw->std_mask_eeprom = tvdata.tuner_formats;
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-129-
 --
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c=2083=static void pvr2_hdw_setup_low(struct pvr2_hdw *hdw)
 --
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c-2194-		hdw->tuner_updated = !0;
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2195:		hdw->std_mask_eeprom = V4L2_STD_ALL;
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c-2196-	}
 --
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c=3324=static u8 *pvr2_full_eeprom_fetch(struct pvr2_hdw *hdw)
 --
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c-3334-	unsigned pcnt,tcnt;
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:3335:	eeprom = kzalloc(EEPROM_SIZE, GFP_KERNEL);
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c-3336-	if (!eeprom) {
 --
 drivers/misc/eeprom/digsy_mtc_eeprom.c=40=static struct spi_gpio_platform_data eeprom_spi_gpio_data = {
 --
 drivers/misc/eeprom/digsy_mtc_eeprom.c-43-
 drivers/misc/eeprom/digsy_mtc_eeprom.c:44:static struct platform_device digsy_mtc_eeprom = {
 drivers/misc/eeprom/digsy_mtc_eeprom.c-45-	.name	= "spi_gpio",
 --
 drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c=320=static int pci1xxxx_otp_eeprom_probe(struct auxiliary_device *aux_dev,
 --
 drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c-376-
 drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c:377:		priv->nvmem_eeprom = devm_nvmem_register(&aux_dev->dev,
 drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c-378-							 &priv->nvmem_config_eeprom);
 --
 drivers/net/can/usb/peak_usb/pcan_usb.c=992=static const struct ethtool_ops pcan_usb_ethtool_ops = {
 --
 drivers/net/can/usb/peak_usb/pcan_usb.c-995-	.get_eeprom_len	= pcan_usb_get_eeprom_len,
 drivers/net/can/usb/peak_usb/pcan_usb.c:996:	.get_eeprom = peak_usb_get_eeprom,
 drivers/net/can/usb/peak_usb/pcan_usb.c:997:	.set_eeprom = peak_usb_set_eeprom,
 drivers/net/can/usb/peak_usb/pcan_usb.c-998-};
 --
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c=1126=static const struct ethtool_ops pcan_usb_fd_ethtool_ops = {
 --
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c-1129-	.get_eeprom_len	= peak_usb_get_eeprom_len,
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c:1130:	.get_eeprom = peak_usb_get_eeprom,
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c:1131:	.set_eeprom = peak_usb_set_eeprom,
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c-1132-};
 --
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c=1036=static const struct ethtool_ops pcan_usb_pro_ethtool_ops = {
 --
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c-1039-	.get_eeprom_len	= peak_usb_get_eeprom_len,
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c:1040:	.get_eeprom = peak_usb_get_eeprom,
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c:1041:	.set_eeprom = peak_usb_set_eeprom,
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c-1042-};
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4421=static const struct mv88e6xxx_ops mv88e6141_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4425-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4426:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:4427:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-4428-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4615=static const struct mv88e6xxx_ops mv88e6172_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4619-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4620:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:4621:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-4622-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4718=static const struct mv88e6xxx_ops mv88e6176_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4722-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4723:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:4724:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-4725-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4814=static const struct mv88e6xxx_ops mv88e6190_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4817-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4818:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:4819:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-4820-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4874=static const struct mv88e6xxx_ops mv88e6190x_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4877-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4878:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:4879:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-4880-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4934=static const struct mv88e6xxx_ops mv88e6191_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4937-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4938:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:4939:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-4940-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=4993=static const struct mv88e6xxx_ops mv88e6240_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-4997-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:4998:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:4999:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-5000-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5053=static const struct mv88e6xxx_ops mv88e6250_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5057-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5058:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:5059:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-5060-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5098=static const struct mv88e6xxx_ops mv88e6290_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5101-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5102:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:5103:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-5104-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5160=static const struct mv88e6xxx_ops mv88e6320_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5165-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5166:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:5167:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-5168-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5213=static const struct mv88e6xxx_ops mv88e6321_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5218-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5219:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:5220:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-5221-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5265=static const struct mv88e6xxx_ops mv88e6341_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5269-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5270:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:5271:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-5272-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5424=static const struct mv88e6xxx_ops mv88e6352_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5428-	.irl_init_all = mv88e6352_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5429:	.get_eeprom = mv88e6xxx_g2_get_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c:5430:	.set_eeprom = mv88e6xxx_g2_set_eeprom16,
 drivers/net/dsa/mv88e6xxx/chip.c-5431-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5487=static const struct mv88e6xxx_ops mv88e6390_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5490-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5491:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:5492:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-5493-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5552=static const struct mv88e6xxx_ops mv88e6390x_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5555-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5556:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:5557:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-5558-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/dsa/mv88e6xxx/chip.c=5616=static const struct mv88e6xxx_ops mv88e6393x_ops = {
 --
 drivers/net/dsa/mv88e6xxx/chip.c-5618-	.irl_init_all = mv88e6390_g2_irl_init_all,
 drivers/net/dsa/mv88e6xxx/chip.c:5619:	.get_eeprom = mv88e6xxx_g2_get_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c:5620:	.set_eeprom = mv88e6xxx_g2_set_eeprom8,
 drivers/net/dsa/mv88e6xxx/chip.c-5621-	.set_switch_mac = mv88e6xxx_g2_set_switch_mac,
 --
 drivers/net/ethernet/agere/et131x.c=669=static int et131x_init_eeprom(struct et131x_adapter *adapter)
 --
 drivers/net/ethernet/agere/et131x.c-716-			 */
 drivers/net/ethernet/agere/et131x.c:717:			adapter->has_eeprom = false;
 drivers/net/ethernet/agere/et131x.c-718-			return -EIO;
 --
 drivers/net/ethernet/agere/et131x.c-720-	}
 drivers/net/ethernet/agere/et131x.c:721:	adapter->has_eeprom = true;
 drivers/net/ethernet/agere/et131x.c-722-
 --
 drivers/net/ethernet/alacritech/slicoss.c=1593=static int slic_read_eeprom(struct slic_device *sdev)
 --
 drivers/net/ethernet/alacritech/slicoss.c-1606-
 drivers/net/ethernet/alacritech/slicoss.c:1607:	eeprom = dma_alloc_coherent(&sdev->pdev->dev, SLIC_EEPROM_SIZE,
 drivers/net/ethernet/alacritech/slicoss.c-1608-				    &paddr, GFP_KERNEL);
 --
 drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c=737=static const struct ethtool_ops xgbe_ethtool_ops = {
 --
 drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c-759-	.get_module_info = xgbe_get_module_info,
 drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c:760:	.get_module_eeprom = xgbe_get_module_eeprom,
 drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c-761-	.get_ringparam = xgbe_get_ringparam,
 --
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c=848=static bool xgbe_phy_belfuse_phy_quirks(struct xgbe_prv_data *pdata)
 --
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c-850-	struct xgbe_phy_data *phy_data = pdata->phy_data;
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c:851:	struct xgbe_sfp_eeprom *sfp_eeprom = &phy_data->sfp_eeprom;
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c-852-	unsigned int phy_id = phy_data->phydev->phy_id;
 --
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c=1069=static void xgbe_phy_sfp_parse_eeprom(struct xgbe_prv_data *pdata)
 --
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c-1071-	struct xgbe_phy_data *phy_data = pdata->phy_data;
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c:1072:	struct xgbe_sfp_eeprom *sfp_eeprom = &phy_data->sfp_eeprom;
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c-1073-	u8 *sfp_base;
 --
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c=1321=static int xgbe_phy_module_eeprom(struct xgbe_prv_data *pdata,
 --
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c-1381-
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c:1382:	sfp_eeprom = (struct xgbe_sfp_eeprom *)eeprom_data;
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c-1383-
 --
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c=785=const struct aq_fw_ops aq_fw_2x_ops = {
 --
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c-810-	.send_macsec_req    = aq_fw2x_send_macsec_req,
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c:811:	.read_module_eeprom = aq_fw2x_read_module_eeprom,
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c-812-};
]
]

gemini-3.1-pro-preview

							input: 372054
							output: 62
							thoughts: 286
						

**Investigating the `rt2x00dev->eeprom` Allocation**

Okay, so I'm trying to pin down where the `rt2x00dev->eeprom` member is allocated. My initial thought was that it's done in `rt2x00lib_probe_dev`, but let's double-check the code. Right, first, let's look at `rt2x00lib_probe_dev` again. Specifically, I'm going to focus on memory allocation. Ah, here it is: I see the allocation for `rt2x00dev->drv_data` based on `rt2x00dev->ops->drv_data_size`, which is standard. But wait... is `rt2x00dev->eeprom` allocated here?

Okay, let me go through the code again. Ah, here it is. I need to make sure I am examining `rt2x00dev->ops->eeprom_size`. Okay, there it is!

```c
	if (rt2x00dev->ops->eeprom_size > 0) {
		rt2x00dev->eeprom = kzalloc(rt2x00dev->ops->eeprom_size,
					    GFP_KERNEL);
```

Okay, so there is the allocation based on the `eeprom_size`. I must have missed that the first time! Okay, I need to make sure I am taking note of this. I will look for any edge cases. I should also check where `rt2x00dev->ops->eeprom_size` is populated.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00lib_probe_dev]

map[SourceCode:1371:	/*
1372:	 * driver allocation handlers.
1373:	 */
1374:	int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
1375:	{
1376:		int retval = -ENOMEM;
1377:	
1378:		/*
1379:		 * Set possible interface combinations.
1380:		 */
1381:		rt2x00lib_set_if_combinations(rt2x00dev);
1382:	
1383:		/*
1384:		 * Allocate the driver data memory, if necessary.
1385:		 */
1386:		if (rt2x00dev->ops->drv_data_size > 0) {
1387:			rt2x00dev->drv_data = kzalloc(rt2x00dev->ops->drv_data_size,
1388:				                      GFP_KERNEL);
1389:			if (!rt2x00dev->drv_data) {
1390:				retval = -ENOMEM;
1391:				goto exit;
1392:			}
1393:		}
1394:	
1395:		spin_lock_init(&rt2x00dev->irqmask_lock);
1396:		mutex_init(&rt2x00dev->csr_mutex);
1397:		mutex_init(&rt2x00dev->conf_mutex);
1398:		INIT_LIST_HEAD(&rt2x00dev->bar_list);
1399:		spin_lock_init(&rt2x00dev->bar_list_lock);
1400:		hrtimer_setup(&rt2x00dev->txstatus_timer, hrtimer_dummy_timeout, CLOCK_MONOTONIC,
1401:			      HRTIMER_MODE_REL);
1402:	
1403:		set_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
1404:	
1405:		/*
1406:		 * Make room for rt2x00_intf inside the per-interface
1407:		 * structure ieee80211_vif.
1408:		 */
1409:		rt2x00dev->hw->vif_data_size = sizeof(struct rt2x00_intf);
1410:	
1411:		/*
1412:		 * rt2x00 devices can only use the last n bits of the MAC address
1413:		 * for virtual interfaces.
1414:		 */
1415:		rt2x00dev->hw->wiphy->addr_mask[ETH_ALEN - 1] =
1416:			(rt2x00dev->ops->max_ap_intf - 1);
1417:	
1418:		/*
1419:		 * Initialize work.
1420:		 */
1421:		rt2x00dev->workqueue =
1422:		    alloc_ordered_workqueue("%s", 0, wiphy_name(rt2x00dev->hw->wiphy));
1423:		if (!rt2x00dev->workqueue) {
1424:			retval = -ENOMEM;
1425:			goto exit;
1426:		}
1427:	
1428:		INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled);
1429:		INIT_DELAYED_WORK(&rt2x00dev->autowakeup_work, rt2x00lib_autowakeup);
1430:		INIT_WORK(&rt2x00dev->sleep_work, rt2x00lib_sleep);
1431:	
1432:		/*
1433:		 * Let the driver probe the device to detect the capabilities.
1434:		 */
1435:		retval = rt2x00dev->ops->lib->probe_hw(rt2x00dev);
1436:		if (retval) {
1437:			rt2x00_err(rt2x00dev, "Failed to allocate device\n");
1438:			goto exit;
1439:		}
1440:	
1441:		/*
1442:		 * Allocate queue array.
1443:		 */
1444:		retval = rt2x00queue_allocate(rt2x00dev);
1445:		if (retval)
1446:			goto exit;
1447:	
1448:		/* Cache TX headroom value */
1449:		rt2x00dev->extra_tx_headroom = rt2x00dev_extra_tx_headroom(rt2x00dev);
1450:	
1451:		/*
1452:		 * Determine which operating modes are supported, all modes
1453:		 * which require beaconing, depend on the availability of
1454:		 * beacon entries.
1455:		 */
1456:		rt2x00dev->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
1457:		if (rt2x00dev->bcn->limit > 0)
1458:			rt2x00dev->hw->wiphy->interface_modes |=
1459:			    BIT(NL80211_IFTYPE_ADHOC) |
1460:	#ifdef CONFIG_MAC80211_MESH
1461:			    BIT(NL80211_IFTYPE_MESH_POINT) |
1462:	#endif
1463:			    BIT(NL80211_IFTYPE_AP);
1464:	
1465:		rt2x00dev->hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
1466:	
1467:		wiphy_ext_feature_set(rt2x00dev->hw->wiphy,
1468:				      NL80211_EXT_FEATURE_CQM_RSSI_LIST);
1469:	
1470:		/*
1471:		 * Initialize ieee80211 structure.
1472:		 */
1473:		retval = rt2x00lib_probe_hw(rt2x00dev);
1474:		if (retval) {
1475:			rt2x00_err(rt2x00dev, "Failed to initialize hw\n");
1476:			goto exit;
1477:		}
1478:	
1479:		/*
1480:		 * Register extra components.
1481:		 */
1482:		rt2x00link_register(rt2x00dev);
1483:		rt2x00leds_register(rt2x00dev);
1484:		rt2x00debug_register(rt2x00dev);
1485:	
1486:		/*
1487:		 * Start rfkill polling.
1488:		 */
1489:		if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
1490:			rt2x00rfkill_register(rt2x00dev);
1491:	
1492:		return 0;
1493:	
1494:	exit:
1495:		rt2x00lib_remove_dev(rt2x00dev);
1496:	
1497:		return retval;
1498:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c]

gemini-3.1-pro-preview

							input: 374862
							output: 62
							thoughts: 517
						

**Debugging a Potential NULL Pointer Dereference**

Okay, wait a minute. I'm looking at this `rt2x00dev` structure and specifically the `eeprom` member. I'm pretty sure I remember that `rt2x00dev->eeprom` is *not* allocated during the `rt2x00lib_probe_dev` call. I need to double-check that, but I think the memory allocation is done in `rt2x00usb_probe`. Let me go back and look at that part... Yes, `ieee80211_alloc_hw` allocates `hw`, and `hw->priv`, and from there `rt2x00dev` becomes `hw->priv`. But, again, `rt2x00dev->eeprom` is just a pointer within `rt2x00dev` itself. If it's never explicitly allocated, it's going to be `NULL`.

Alright, I was right. I am looking through the code and I don't see an explicit allocation, so, if I am correct, this pointer would be NULL. Now, I see that this is a critical pointer, and I suspect a buffer overflow issue. 

Okay, now let's see if this NULL pointer is ever actually used. Let's trace it down. Where's this EEPROM being accessed? I need to check `rt2x00_eeprom_read` or `rt2x00usb_eeprom_read`.

Ah, here it is: `rt2x00usb_eeprom_read`. If `rt2x00dev->eeprom` is NULL, then `rt2x00usb_eeprom_read` will pass NULL to `rt2x00usb_vendor_request`.

```c
static inline int rt2x00usb_eeprom_read(struct rt2x00_dev *rt2x00dev,
					__le16 *eeprom, const u16 length)
{
	return rt2x00usb_vendor_request(rt2x00dev, USB_EEPROM_READ,
					USB_VENDOR_REQUEST_IN, 0, 0,
					eeprom, length, EEPROM_TIMEOUT);
}
```

Okay, now it's clear. If `eeprom` *is* NULL, then `rt2x00usb_vendor_request` is going to use NULL as a buffer. Which, of course, is a HUGE problem! Let's see what `rt2x00usb_vendor_request` does... It calls `usb_control_msg`. Right. `usb_control_msg` takes a buffer pointer. If the pointer is NULL, and the length is greater than zero, then it's going to crash trying to write to address zero! That's a classic NULL pointer dereference. I need to confirm that `length` is sometimes > 0. Let's dig deeper into the code of `rt2x00usb_vendor_request` to see how it uses that buffer.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_vendor_request]

map[SourceCode:  42:	/*
  43:	 * Interfacing with the HW.
  44:	 */
  45:	int rt2x00usb_vendor_request(struct rt2x00_dev *rt2x00dev,
  46:				     const u8 request, const u8 requesttype,
  47:				     const u16 offset, const u16 value,
  48:				     void *buffer, const u16 buffer_length,
  49:				     const int timeout)
  50:	{
  51:		struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev);
  52:		int status;
  53:		unsigned int pipe =
  54:		    (requesttype == USB_VENDOR_REQUEST_IN) ?
  55:		    usb_rcvctrlpipe(usb_dev, 0) : usb_sndctrlpipe(usb_dev, 0);
  56:		unsigned long expire = jiffies + msecs_to_jiffies(timeout);
  57:	
  58:		if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
  59:			return -ENODEV;
  60:	
  61:		do {
  62:			status = usb_control_msg(usb_dev, pipe, request, requesttype,
  63:						 value, offset, buffer, buffer_length,
  64:						 timeout / 2);
  65:			if (status >= 0)
  66:				return 0;
  67:	
  68:			if (rt2x00usb_check_usb_error(rt2x00dev, status)) {
  69:				/* Device has disappeared. */
  70:				clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
  71:				break;
  72:			}
  73:		} while (time_before(jiffies, expire));
  74:	
  75:		rt2x00_err(rt2x00dev,
  76:			   "Vendor Request 0x%02x failed for offset 0x%04x with error %d\n",
  77:			   request, offset, status);
  78:	
  79:		return status;
  80:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3.1-pro-preview

							input: 376772
							output: 20
							thoughts: 73
						

**Analyzing Potential Null Pointer Dereference**

Okay, hold on a second. I'm seeing a potential issue here with how `usb_control_msg` is handling the `buffer` argument. If `buffer` ends up being NULL, then `usb_control_msg` is likely going to pass that NULL right on down to a lower-level function, something like `usb_control_msg_send`. Now, that's a classic recipe for a crash, and something I need to be *very* careful about in this context. We're dealing with USB communication, so a hang-up here is unacceptable.

But before I start assuming the worst, I need to verify something. The real question is: Is `rt2x00dev->eeprom` *actually* NULL in this scenario? I need to trace this back. Where is `rt2x00dev->eeprom` allocated, and initialized? I need to go back through the driver code to determine the allocation path for that variable. Only then can I determine if my initial assumption is correct, or if this potential null pointer dereference is a real risk. I need to know where to find the source of truth, and how that is properly initialized.

map[Expression:eeprom =.*kzalloc]

map[Output:Documentation/dev-tools/kunit/usage.rst=382=We can now use it to test ``struct eeprom_buffer``:
--
Documentation/dev-tools/kunit/usage.rst-453-
Documentation/dev-tools/kunit/usage.rst:454:		ctx->fake_eeprom = kunit_kzalloc(test, sizeof(*ctx->fake_eeprom), GFP_KERNEL);
Documentation/dev-tools/kunit/usage.rst-455-		KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx->fake_eeprom);
--
drivers/i2c/i2c-slave-eeprom.c=143=static int i2c_slave_eeprom_probe(struct i2c_client *client)
--
drivers/i2c/i2c-slave-eeprom.c-150-
drivers/i2c/i2c-slave-eeprom.c:151:	eeprom = devm_kzalloc(&client->dev, sizeof(struct eeprom_data) + size, GFP_KERNEL);
drivers/i2c/i2c-slave-eeprom.c-152-	if (!eeprom)
--
drivers/media/usb/pvrusb2/pvrusb2-eeprom.c=31=static u8 *pvr2_eeprom_fetch(struct pvr2_hdw *hdw)
--
drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-41-	unsigned pcnt,tcnt;
drivers/media/usb/pvrusb2/pvrusb2-eeprom.c:42:	eeprom = kzalloc(EEPROM_SIZE, GFP_KERNEL);
drivers/media/usb/pvrusb2/pvrusb2-eeprom.c-43-	if (!eeprom) {
--
drivers/media/usb/pvrusb2/pvrusb2-hdw.c=3324=static u8 *pvr2_full_eeprom_fetch(struct pvr2_hdw *hdw)
--
drivers/media/usb/pvrusb2/pvrusb2-hdw.c-3334-	unsigned pcnt,tcnt;
drivers/media/usb/pvrusb2/pvrusb2-hdw.c:3335:	eeprom = kzalloc(EEPROM_SIZE, GFP_KERNEL);
drivers/media/usb/pvrusb2/pvrusb2-hdw.c-3336-	if (!eeprom) {
--
drivers/net/wireless/intel/iwlegacy/common.c=699=il_eeprom_init(struct il_priv *il)
--
drivers/net/wireless/intel/iwlegacy/common.c-709-	D_EEPROM("NVM size = %d\n", sz);
drivers/net/wireless/intel/iwlegacy/common.c:710:	il->eeprom = kzalloc(sz, GFP_KERNEL);
drivers/net/wireless/intel/iwlegacy/common.c-711-	if (!il->eeprom)
--
drivers/net/wireless/intersil/p54/eeprom.c=944=int p54_read_eeprom(struct ieee80211_hw *dev)
--
drivers/net/wireless/intersil/p54/eeprom.c-956-
drivers/net/wireless/intersil/p54/eeprom.c:957:	eeprom = kzalloc(eeprom_size, GFP_KERNEL);
drivers/net/wireless/intersil/p54/eeprom.c-958-	if (unlikely(!eeprom))
--
drivers/net/wireless/ralink/rt2x00/rt2800soc.c=263=static int rt2x00soc_probe(struct platform_device *pdev, const struct rt2x00_ops *ops)
--
drivers/net/wireless/ralink/rt2x00/rt2800soc.c-285-
drivers/net/wireless/ralink/rt2x00/rt2800soc.c:286:	eeprom = devm_kzalloc(&pdev->dev, ops->eeprom_size, GFP_KERNEL);
drivers/net/wireless/ralink/rt2x00/rt2800soc.c-287-	if (!eeprom)
--
drivers/net/wireless/ralink/rt2x00/rt2x00pci.c=39=static int rt2x00pci_alloc_reg(struct rt2x00_dev *rt2x00dev)
--
drivers/net/wireless/ralink/rt2x00/rt2x00pci.c-46-
drivers/net/wireless/ralink/rt2x00/rt2x00pci.c:47:	rt2x00dev->eeprom = kzalloc(rt2x00dev->ops->eeprom_size, GFP_KERNEL);
drivers/net/wireless/ralink/rt2x00/rt2x00pci.c-48-	if (!rt2x00dev->eeprom)
--
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c=773=static int rt2x00usb_alloc_reg(struct rt2x00_dev *rt2x00dev)
--
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c-778-
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c:779:	rt2x00dev->eeprom = kzalloc(rt2x00dev->ops->eeprom_size, GFP_KERNEL);
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c-780-	if (!rt2x00dev->eeprom)
--
drivers/nvmem/lpc18xx_eeprom.c=162=static int lpc18xx_eeprom_probe(struct platform_device *pdev)
--
drivers/nvmem/lpc18xx_eeprom.c-170-
drivers/nvmem/lpc18xx_eeprom.c:171:	eeprom = devm_kzalloc(dev, sizeof(*eeprom), GFP_KERNEL);
drivers/nvmem/lpc18xx_eeprom.c-172-	if (!eeprom)
--
drivers/nvmem/rave-sp-eeprom.c=287=static int rave_sp_eeprom_probe(struct platform_device *pdev)
--
drivers/nvmem/rave-sp-eeprom.c-311-
drivers/nvmem/rave-sp-eeprom.c:312:	eeprom = devm_kzalloc(dev, sizeof(*eeprom), GFP_KERNEL);
drivers/nvmem/rave-sp-eeprom.c-313-	if (!eeprom)
]

gemini-3.1-pro-preview

							input: 378871
							output: 60
							thoughts: 334
						

**EEPROM Allocation Deep Dive**

Okay, so I'm tracking down where the EEPROM is allocated for this `rt2x00usb` driver, and it looks like the `rt2x00dev->eeprom` pointer gets allocated within the `rt2x00usb_alloc_reg` function. Specifically, it's a `kzalloc` call using the size determined by `rt2x00dev->ops->eeprom_size`. That's where the memory is being requested and potentially reserved. Looking at the code confirms this, with the allocation happening immediately after the CSR cache.

`rt2x00usb_alloc_reg` itself is invoked during the device probe, specifically in `rt2x00usb_probe`. So, as part of the initial device setup, that's when the allocation occurs. This means the pointer *should* be valid after that point.

However, I need to consider a potential edge case. What if `rt2x00dev->ops->eeprom_size` returns zero? This could lead to a zero-byte allocation, which might cause unexpected behavior. I'll need to check the actual value used, specifically what's being passed as `rt2x00dev->ops->eeprom_size`. I'll want to check `rt2500usb_ops` and trace that back. Time to dive deeper into the `ops` structure!

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c IncludeLines:true Name:rt2500usb_ops]

map[SourceCode:1891:	static const struct rt2x00_ops rt2500usb_ops = {
1892:		.name			= KBUILD_MODNAME,
1893:		.max_ap_intf		= 1,
1894:		.eeprom_size		= EEPROM_SIZE,
1895:		.rf_size		= RF_SIZE,
1896:		.tx_queues		= NUM_TX_QUEUES,
1897:		.queue_init		= rt2500usb_queue_init,
1898:		.lib			= &rt2500usb_rt2x00_ops,
1899:		.hw			= &rt2500usb_mac80211_ops,
1900:	#ifdef CONFIG_RT2X00_LIB_DEBUGFS
1901:		.debugfs		= &rt2500usb_rt2x00debug,
1902:	#endif /* CONFIG_RT2X00_LIB_DEBUGFS */
1903:	};
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c]

gemini-3.1-pro-preview

							input: 379895
							output: 43
							thoughts: 5536
						

**Analyzing a USB Device Disconnect and Potential Crash**

Okay, let's break this down. We have a scenario where a USB device is connected, potentially triggering a specific error path involving an EEPROM read, and then disconnected. I'm focusing on why a crash *might* occur.

1.  **EEPROM Read and Zeroed Data:** The code seems to be handling an EEPROM read. If the USB device disconnects during this read, the driver might encounter an `-ENODEV` error. Critically, if the error is ignored, the code could then read from an `eeprom` buffer that's been allocated but never populated because of the disconnect. This buffer could contain all zeroes. The interesting part is that `rt2500usb_probe_hw` initializes the EEPROM, but if a disconnect occurs *before* this initialization, the EEPROM will contain default (zero) values, but the code may *not* detect this until it tries to read the EEPROM again.

2.  **Zero-Interface Device Configuration:** The reproducer connects a device where the device descriptor's *initial* state, because of a missing or incomplete descriptor, makes the USB core believe the device has *no* interfaces. This is a crucial point. If `bNumInterfaces` is zero, the USB core won't create any interface devices, thus `rtl_usb_probe` and `rt2500usb` are *never* called, making it less likely that the crash is within those drivers.

3.  **USB Descriptor Parsing and `wTotalLength`:** The `wTotalLength` field in the configuration descriptor is used by the USB core to determine the total size of the configuration data. The key here is the setup of this field. It's likely that a partially-populated configuration descriptor could result in a `wTotalLength` that doesn't account for *all* the data.

4.  **Flawed USB Descriptor:** The code seems to provide a USB descriptor with a `wTotalLength` (18 bytes) which doesn't include the data in the descriptors. So the length is smaller than the expected descriptor size. This leads to `usb_parse_configuration` to set `nintf=0`, thus creating zero interfaces and not calling drivers.

5.  **`syz_usb_connect` and Descriptor Length:** `parse_usb_descriptor` will return `true`, because the code is setting `wTotalLength` (even though the descriptor data is wrong), leading to `add_usb_index` returning a valid index and `usb_raw_init`.

6.  **`syz_usb_connect` and Zeroed Memory:** The descriptor data passed to `syz_usb_connect` is zero-initialized and, because of the flawed descriptors, the USB core might not be handling the zero-length descriptors gracefully. There isn't an explicit crash, but an incorrect setup of the device.

7.  **Crash Location:** The reproducer could have a race condition because of the invalid descriptor. If the driver is not probing, there might be another bug.

8.  **Revisiting `usb_parse_configuration`**: If `header->bLength` is 0, then the loop breaks, then the `n` is 0.

Based on the evidence, the crash isn't in a driver's probe, as those are not called. The root cause is likely a flaw in the USB core's handling of these zero-length or malformed descriptors during the connection and configuration process. It can possibly trigger a problem when the memory which stores the USB descriptors is not handled correctly.

map[ContextFile:drivers/usb/core/hub.c IncludeLines:true Name:hub_port_init]

map[SourceCode:4884:	/* Reset device, (re)assign address, get device descriptor.
4885:	 * Device connection must be stable, no more debouncing needed.
4886:	 * Returns device in USB_STATE_ADDRESS, except on error.
4887:	 *
4888:	 * If this is called for an already-existing device (as part of
4889:	 * usb_reset_and_verify_device), the caller must own the device lock and
4890:	 * the port lock.  For a newly detected device that is not accessible
4891:	 * through any global pointers, it's not necessary to lock the device,
4892:	 * but it is still necessary to lock the port.
4893:	 *
4894:	 * For a newly detected device, @dev_descr must be NULL.  The device
4895:	 * descriptor retrieved from the device will then be stored in
4896:	 * @udev->descriptor.  For an already existing device, @dev_descr
4897:	 * must be non-NULL.  The device descriptor will be stored there,
4898:	 * not in @udev->descriptor, because descriptors for registered
4899:	 * devices are meant to be immutable.
4900:	 */
4901:	static int
4902:	hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1,
4903:			int retry_counter, struct usb_device_descriptor *dev_descr)
4904:	{
4905:		struct usb_device	*hdev = hub->hdev;
4906:		struct usb_hcd		*hcd = bus_to_hcd(hdev->bus);
4907:		struct usb_port		*port_dev = hub->ports[port1 - 1];
4908:		int			retries, operations, retval, i;
4909:		unsigned		delay = HUB_SHORT_RESET_TIME;
4910:		enum usb_device_speed	oldspeed = udev->speed;
4911:		const char		*speed;
4912:		int			devnum = udev->devnum;
4913:		const char		*driver_name;
4914:		bool			do_new_scheme;
4915:		const bool		initial = !dev_descr;
4916:		int			maxp0;
4917:		struct usb_device_descriptor	*buf, *descr;
4918:	
4919:		buf = kmalloc(GET_DESCRIPTOR_BUFSIZE, GFP_NOIO);
4920:		if (!buf)
4921:			return -ENOMEM;
4922:	
4923:		/* root hub ports have a slightly longer reset period
4924:		 * (from USB 2.0 spec, section 7.1.7.5)
4925:		 */
4926:		if (!hdev->parent) {
4927:			delay = HUB_ROOT_RESET_TIME;
4928:			if (port1 == hdev->bus->otg_port)
4929:				hdev->bus->b_hnp_enable = 0;
4930:		}
4931:	
4932:		/* Some low speed devices have problems with the quick delay, so */
4933:		/*  be a bit pessimistic with those devices. RHbug #23670 */
4934:		if (oldspeed == USB_SPEED_LOW)
4935:			delay = HUB_LONG_RESET_TIME;
4936:	
4937:		/* Reset the device; full speed may morph to high speed */
4938:		/* FIXME a USB 2.0 device may morph into SuperSpeed on reset. */
4939:		retval = hub_port_reset(hub, port1, udev, delay, false);
4940:		if (retval < 0)		/* error or disconnect */
4941:			goto fail;
4942:		/* success, speed is known */
4943:	
4944:		retval = -ENODEV;
4945:	
4946:		/* Don't allow speed changes at reset, except usb 3.0 to faster */
4947:		if (oldspeed != USB_SPEED_UNKNOWN && oldspeed != udev->speed &&
4948:		    !(oldspeed == USB_SPEED_SUPER && udev->speed > oldspeed)) {
4949:			dev_dbg(&udev->dev, "device reset changed speed!\n");
4950:			goto fail;
4951:		}
4952:		oldspeed = udev->speed;
4953:	
4954:		if (initial) {
4955:			/* USB 2.0 section 5.5.3 talks about ep0 maxpacket ...
4956:			 * it's fixed size except for full speed devices.
4957:			 */
4958:			switch (udev->speed) {
4959:			case USB_SPEED_SUPER_PLUS:
4960:			case USB_SPEED_SUPER:
4961:				udev->ep0.desc.wMaxPacketSize = cpu_to_le16(512);
4962:				break;
4963:			case USB_SPEED_HIGH:		/* fixed at 64 */
4964:				udev->ep0.desc.wMaxPacketSize = cpu_to_le16(64);
4965:				break;
4966:			case USB_SPEED_FULL:		/* 8, 16, 32, or 64 */
4967:				/* to determine the ep0 maxpacket size, try to read
4968:				 * the device descriptor to get bMaxPacketSize0 and
4969:				 * then correct our initial guess.
4970:				 */
4971:				udev->ep0.desc.wMaxPacketSize = cpu_to_le16(64);
4972:				break;
4973:			case USB_SPEED_LOW:		/* fixed at 8 */
4974:				udev->ep0.desc.wMaxPacketSize = cpu_to_le16(8);
4975:				break;
4976:			default:
4977:				goto fail;
4978:			}
4979:		}
4980:	
4981:		speed = usb_speed_string(udev->speed);
4982:	
4983:		/*
4984:		 * The controller driver may be NULL if the controller device
4985:		 * is the middle device between platform device and roothub.
4986:		 * This middle device may not need a device driver due to
4987:		 * all hardware control can be at platform device driver, this
4988:		 * platform device is usually a dual-role USB controller device.
4989:		 */
4990:		if (udev->bus->controller->driver)
4991:			driver_name = udev->bus->controller->driver->name;
4992:		else
4993:			driver_name = udev->bus->sysdev->driver->name;
4994:	
4995:		if (udev->speed < USB_SPEED_SUPER)
4996:			dev_info(&udev->dev,
4997:					"%s %s USB device number %d using %s\n",
4998:					(initial ? "new" : "reset"), speed,
4999:					devnum, driver_name);
5000:	
5001:		if (initial) {
5002:			/* Set up TT records, if needed  */
5003:			if (hdev->tt) {
5004:				udev->tt = hdev->tt;
5005:				udev->ttport = hdev->ttport;
5006:			} else if (udev->speed != USB_SPEED_HIGH
5007:					&& hdev->speed == USB_SPEED_HIGH) {
5008:				if (!hub->tt.hub) {
5009:					dev_err(&udev->dev, "parent hub has no TT\n");
5010:					retval = -EINVAL;
5011:					goto fail;
5012:				}
5013:				udev->tt = &hub->tt;
5014:				udev->ttport = port1;
5015:			}
5016:		}
5017:	
5018:		/* Why interleave GET_DESCRIPTOR and SET_ADDRESS this way?
5019:		 * Because device hardware and firmware is sometimes buggy in
5020:		 * this area, and this is how Linux has done it for ages.
5021:		 * Change it cautiously.
5022:		 *
5023:		 * NOTE:  If use_new_scheme() is true we will start by issuing
5024:		 * a 64-byte GET_DESCRIPTOR request.  This is what Windows does,
5025:		 * so it may help with some non-standards-compliant devices.
5026:		 * Otherwise we start with SET_ADDRESS and then try to read the
5027:		 * first 8 bytes of the device descriptor to get the ep0 maxpacket
5028:		 * value.
5029:		 */
5030:		do_new_scheme = use_new_scheme(udev, retry_counter, port_dev);
5031:	
5032:		for (retries = 0; retries < GET_DESCRIPTOR_TRIES; (++retries, msleep(100))) {
5033:			if (hub_port_stop_enumerate(hub, port1, retries)) {
5034:				retval = -ENODEV;
5035:				break;
5036:			}
5037:	
5038:			if (do_new_scheme) {
5039:				retval = hub_enable_device(udev);
5040:				if (retval < 0) {
5041:					dev_err(&udev->dev,
5042:						"hub failed to enable device, error %d\n",
5043:						retval);
5044:					goto fail;
5045:				}
5046:	
5047:				maxp0 = get_bMaxPacketSize0(udev, buf,
5048:						GET_DESCRIPTOR_BUFSIZE, retries == 0);
5049:				if (maxp0 > 0 && !initial &&
5050:						maxp0 != udev->descriptor.bMaxPacketSize0) {
5051:					dev_err(&udev->dev, "device reset changed ep0 maxpacket size!\n");
5052:					retval = -ENODEV;
5053:					goto fail;
5054:				}
5055:	
5056:				retval = hub_port_reset(hub, port1, udev, delay, false);
5057:				if (retval < 0)		/* error or disconnect */
5058:					goto fail;
5059:				if (oldspeed != udev->speed) {
5060:					dev_dbg(&udev->dev,
5061:						"device reset changed speed!\n");
5062:					retval = -ENODEV;
5063:					goto fail;
5064:				}
5065:				if (maxp0 < 0) {
5066:					if (maxp0 != -ENODEV)
5067:						dev_err(&udev->dev, "device descriptor read/64, error %d\n",
5068:								maxp0);
5069:					retval = maxp0;
5070:					continue;
5071:				}
5072:			}
5073:	
5074:			for (operations = 0; operations < SET_ADDRESS_TRIES; ++operations) {
5075:				retval = hub_set_address(udev, devnum);
5076:				if (retval >= 0)
5077:					break;
5078:				msleep(200);
5079:			}
5080:			if (retval < 0) {
5081:				if (retval != -ENODEV)
5082:					dev_err(&udev->dev, "device not accepting address %d, error %d\n",
5083:							devnum, retval);
5084:				goto fail;
5085:			}
5086:			if (udev->speed >= USB_SPEED_SUPER) {
5087:				devnum = udev->devnum;
5088:				dev_info(&udev->dev,
5089:						"%s SuperSpeed%s%s USB device number %d using %s\n",
5090:						(udev->config) ? "reset" : "new",
5091:					 (udev->speed == USB_SPEED_SUPER_PLUS) ?
5092:							" Plus" : "",
5093:					 (udev->ssp_rate == USB_SSP_GEN_2x2) ?
5094:							" Gen 2x2" :
5095:					 (udev->ssp_rate == USB_SSP_GEN_2x1) ?
5096:							" Gen 2x1" :
5097:					 (udev->ssp_rate == USB_SSP_GEN_1x2) ?
5098:							" Gen 1x2" : "",
5099:					 devnum, driver_name);
5100:			}
5101:	
5102:			/*
5103:			 * cope with hardware quirkiness:
5104:			 *  - let SET_ADDRESS settle, some device hardware wants it
5105:			 *  - read ep0 maxpacket even for high and low speed,
5106:			 */
5107:			msleep(10);
5108:	
5109:			if (do_new_scheme)
5110:				break;
5111:	
5112:			maxp0 = get_bMaxPacketSize0(udev, buf, 8, retries == 0);
5113:			if (maxp0 < 0) {
5114:				retval = maxp0;
5115:				if (retval != -ENODEV)
5116:					dev_err(&udev->dev,
5117:						"device descriptor read/8, error %d\n",
5118:						retval);
5119:			} else {
5120:				u32 delay;
5121:	
5122:				if (!initial && maxp0 != udev->descriptor.bMaxPacketSize0) {
5123:					dev_err(&udev->dev, "device reset changed ep0 maxpacket size!\n");
5124:					retval = -ENODEV;
5125:					goto fail;
5126:				}
5127:	
5128:				delay = udev->parent->hub_delay;
5129:				udev->hub_delay = min_t(u32, delay,
5130:							USB_TP_TRANSMISSION_DELAY_MAX);
5131:				retval = usb_set_isoch_delay(udev);
5132:				if (retval) {
5133:					dev_dbg(&udev->dev,
5134:						"Failed set isoch delay, error %d\n",
5135:						retval);
5136:					retval = 0;
5137:				}
5138:				break;
5139:			}
5140:		}
5141:		if (retval)
5142:			goto fail;
5143:	
5144:		/*
5145:		 * Check the ep0 maxpacket guess and correct it if necessary.
5146:		 * maxp0 is the value stored in the device descriptor;
5147:		 * i is the value it encodes (logarithmic for SuperSpeed or greater).
5148:		 */
5149:		i = maxp0;
5150:		if (udev->speed >= USB_SPEED_SUPER) {
5151:			if (maxp0 <= 16)
5152:				i = 1 << maxp0;
5153:			else
5154:				i = 0;		/* Invalid */
5155:		}
5156:		if (usb_endpoint_maxp(&udev->ep0.desc) == i) {
5157:			;	/* Initial ep0 maxpacket guess is right */
5158:		} else if (((udev->speed == USB_SPEED_FULL ||
5159:					udev->speed == USB_SPEED_HIGH) &&
5160:				(i == 8 || i == 16 || i == 32 || i == 64)) ||
5161:				(udev->speed >= USB_SPEED_SUPER && i > 0)) {
5162:			/* Initial guess is wrong; use the descriptor's value */
5163:			if (udev->speed == USB_SPEED_FULL)
5164:				dev_dbg(&udev->dev, "ep0 maxpacket = %d\n", i);
5165:			else
5166:				dev_warn(&udev->dev, "Using ep0 maxpacket: %d\n", i);
5167:			udev->ep0.desc.wMaxPacketSize = cpu_to_le16(i);
5168:			usb_ep0_reinit(udev);
5169:		} else {
5170:			/* Initial guess is wrong and descriptor's value is invalid */
5171:			dev_err(&udev->dev, "Invalid ep0 maxpacket: %d\n", maxp0);
5172:			retval = -EMSGSIZE;
5173:			goto fail;
5174:		}
5175:	
5176:		descr = usb_get_device_descriptor(udev);
5177:		if (IS_ERR(descr)) {
5178:			retval = PTR_ERR(descr);
5179:			if (retval != -ENODEV)
5180:				dev_err(&udev->dev, "device descriptor read/all, error %d\n",
5181:						retval);
5182:			goto fail;
5183:		}
5184:		if (initial)
5185:			udev->descriptor = *descr;
5186:		else
5187:			*dev_descr = *descr;
5188:		kfree(descr);
5189:	
5190:		/*
5191:		 * Some superspeed devices have finished the link training process
5192:		 * and attached to a superspeed hub port, but the device descriptor
5193:		 * got from those devices show they aren't superspeed devices. Warm
5194:		 * reset the port attached by the devices can fix them.
5195:		 */
5196:		if ((udev->speed >= USB_SPEED_SUPER) &&
5197:				(le16_to_cpu(udev->descriptor.bcdUSB) < 0x0300)) {
5198:			dev_err(&udev->dev, "got a wrong device descriptor, warm reset device\n");
5199:			hub_port_reset(hub, port1, udev, HUB_BH_RESET_TIME, true);
5200:			retval = -EINVAL;
5201:			goto fail;
5202:		}
5203:	
5204:		usb_detect_quirks(udev);
5205:	
5206:		if (le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0201) {
5207:			retval = usb_get_bos_descriptor(udev);
5208:			if (!retval) {
5209:				udev->lpm_capable = usb_device_supports_lpm(udev);
5210:				udev->lpm_disable_count = 1;
5211:				usb_set_lpm_parameters(udev);
5212:				usb_req_set_sel(udev);
5213:			}
5214:		}
5215:	
5216:		retval = 0;
5217:		/* notify HCD that we have a device connected and addressed */
5218:		if (hcd->driver->update_device)
5219:			hcd->driver->update_device(hcd, udev);
5220:		hub_set_initial_usb2_lpm_policy(udev);
5221:	fail:
5222:		if (retval) {
5223:			hub_port_disable(hub, port1, 0);
5224:			update_devnum(udev, devnum);	/* for disconnect processing */
5225:		}
5226:		kfree(buf);
5227:		return retval;
5228:	}
 SourceFile:drivers/usb/core/hub.c]

gemini-3.1-pro-preview

							input: 391809
							output: 62
							thoughts: 4604
						

**Analyzing a Potential USB Driver Bug**

Okay, so here's what I'm thinking. This whole thing starts with `syz_usb_connect` and `syz_usb_disconnect` calls, right? The key is to figure out where things go wrong, which leads to the "crash" (although it seems the 'crash' is actually a syzkaller execution error). Initially, it looks like a simple endpoint or descriptor issue. If `bMaxPacketSize0` is zero, a device is rejected which makes `syz_usb_connect` loop forever and eventually timeout. But, the strace shows that the executor fails because of missing `vhci`, which is a side issue since the executor runs a different reproducer than the C code provided. So I will ignore that issue and look at the C code.

The C code sets up a series of `syz_usb_connect`, `syz_usb_disconnect`, and `syz_usb_control_io` calls, specifically targeting a few different devices (rt2500usb, rtl8192cu, empty device, and HID device). The first thing that jumps out is the use of `syz_usb_control_io` on an "empty" device. If the device handle (`r[1]`) is invalid, it results in an error. The C code's setup creates such a scenario at one point. But since the code can control the descriptors of `syz_usb_connect`, it can make the device handle be NOT invalid! The provided C code's logic of assigning invalid `fd` to the device handle does not seem to be a problem.

The sequence connecting and disconnecting `rt2500usb` is very interesting. That `rt2x00usb_probe` call is important. The probing process involves allocating resources. `rt2x00dev->anchor` is allocated using `devm_kmalloc`. If the probe fails, the driver core handles the deallocation, which seems safe. There's also `rt2x00dev->eeprom`, allocated separately, and the C code seems to handle freeing them correctly.

The critical path might be within `rt2x00lib_probe_dev` or one of the operations performed by it, and in this case, `rt2x00dev->ops->lib->probe_hw`. If that fails, `rt2x00lib_remove_dev` gets called which, and based on the code I see, the resources are managed properly in the normal scenario. But it is possible that there might be a race condition when a probe fails during device removal or there might be some kind of double free by USB core.

In short, there might be a use-after-free, double free, or some kind of race condition, but there is not enough information. The given code is just a sequence of USB connections and disconnections. It probably triggers a specific race condition. I'll need a better look at what happens inside those `rt2x00lib_probe_dev` calls and, especially, inside `probe_hw`, when those fail, to pinpoint the exact issue. Also, the `syz_usb_control_io` calls on an empty device could be exploitable, if some of the values are corrupted via a prior `syz_usb_connect` call. Since the code only shows part of the picture, and there is no trace of an actual kernel panic in the output, it is difficult to give a specific answer. The bug will likely be in some interaction between driver probe failure and disconnection/cleanup.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00lib_remove_dev]

map[SourceCode:1501:	void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
1502:	{
1503:		clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
1504:	
1505:		/*
1506:		 * Stop rfkill polling.
1507:		 */
1508:		if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
1509:			rt2x00rfkill_unregister(rt2x00dev);
1510:	
1511:		/*
1512:		 * Disable radio.
1513:		 */
1514:		rt2x00lib_disable_radio(rt2x00dev);
1515:	
1516:		/*
1517:		 * Stop all work.
1518:		 */
1519:		cancel_work_sync(&rt2x00dev->intf_work);
1520:		cancel_delayed_work_sync(&rt2x00dev->autowakeup_work);
1521:		cancel_work_sync(&rt2x00dev->sleep_work);
1522:	
1523:		hrtimer_cancel(&rt2x00dev->txstatus_timer);
1524:	
1525:		/*
1526:		 * Kill the tx status tasklet.
1527:		 */
1528:		tasklet_kill(&rt2x00dev->txstatus_tasklet);
1529:		tasklet_kill(&rt2x00dev->pretbtt_tasklet);
1530:		tasklet_kill(&rt2x00dev->tbtt_tasklet);
1531:		tasklet_kill(&rt2x00dev->rxdone_tasklet);
1532:		tasklet_kill(&rt2x00dev->autowake_tasklet);
1533:	
1534:		/*
1535:		 * Uninitialize device.
1536:		 */
1537:		rt2x00lib_uninitialize(rt2x00dev);
1538:	
1539:		if (rt2x00dev->workqueue)
1540:			destroy_workqueue(rt2x00dev->workqueue);
1541:	
1542:		/*
1543:		 * Free the tx status fifo.
1544:		 */
1545:		kfifo_free(&rt2x00dev->txstatus_fifo);
1546:	
1547:		/*
1548:		 * Free extra components
1549:		 */
1550:		rt2x00debug_deregister(rt2x00dev);
1551:		rt2x00leds_unregister(rt2x00dev);
1552:	
1553:		/*
1554:		 * Free ieee80211_hw memory.
1555:		 */
1556:		rt2x00lib_remove_hw(rt2x00dev);
1557:	
1558:		/*
1559:		 * Free firmware image.
1560:		 */
1561:		rt2x00lib_free_firmware(rt2x00dev);
1562:	
1563:		/*
1564:		 * Free queue structures.
1565:		 */
1566:		rt2x00queue_free(rt2x00dev);
1567:	
1568:		/*
1569:		 * Free the driver data.
1570:		 */
1571:		kfree(rt2x00dev->drv_data);
1572:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c]

gemini-3.1-pro-preview

							input: 398326
							output: 62
							thoughts: 35
						

Here's my take on those thoughts:

**Dissecting the Driver Cleanup**

Okay, so I'm digging into this driver cleanup sequence, specifically looking at `rt2x00lib_remove_dev`. Right off the bat, I see it's calling `rt2x00lib_remove_hw` with the `rt2x00dev` structure as an argument. That's good, a logical progression. The device removal likely happens in two stages: an overarching function to control the removal, and a lower-level function to deal with the hardware itself. The fact that the first function calls the second suggests that the library follows good design practices, modularization of tasks. This is what I would expect, but it's important to confirm it. Let me verify the call stack and argument, let me think if there are any race conditions to be aware of. I need to understand what `rt2x00dev` represents precisely within the context of the hardware abstraction layer, and what implications the use of this data structure has. I'll need to go deeper to see what the hardware removal function is doing and make sure all the necessary resources are being freed and the device is being properly de-initialized.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00lib_remove_hw]

map[SourceCode:1088:	static void rt2x00lib_remove_hw(struct rt2x00_dev *rt2x00dev)
1089:	{
1090:		if (test_bit(DEVICE_STATE_REGISTERED_HW, &rt2x00dev->flags))
1091:			ieee80211_unregister_hw(rt2x00dev->hw);
1092:	
1093:		if (likely(rt2x00dev->hw->wiphy->bands[NL80211_BAND_2GHZ])) {
1094:			kfree(rt2x00dev->hw->wiphy->bands[NL80211_BAND_2GHZ]->channels);
1095:			kfree(rt2x00dev->hw->wiphy->bands[NL80211_BAND_2GHZ]->bitrates);
1096:			rt2x00dev->hw->wiphy->bands[NL80211_BAND_2GHZ] = NULL;
1097:			rt2x00dev->hw->wiphy->bands[NL80211_BAND_5GHZ] = NULL;
1098:		}
1099:	
1100:		kfree(rt2x00dev->spec.channels_info);
1101:		kfree(rt2x00dev->chan_survey);
1102:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c]

gemini-3.1-pro-preview

							input: 399097
							output: 61
							thoughts: 214
						

**Memory Management Quandary in RT2x00 Driver Removal**

Okay, so I'm revisiting the `rt2x00lib_remove_dev` function and I've got a bit of a head-scratcher here. My initial assumption was that this function was responsible for a complete device teardown, including the freeing of `rt2x00dev->hw`. But hold on, it doesn't appear to actually do that! It seems that `rt2x00dev->hw` is, in fact, freed in `rt2x00usb_probe` on error using the `ieee80211_free_hw(hw)` function.

Ah, yes, `ieee80211_free_hw` handles the freeing of both `hw` and `hw->priv`, good. I need to be sure I understand this correctly...

Now, what about the other allocated resources associated with `rt2x00dev`? I'm thinking specifically about `rt2x00dev->workqueue`. I seem to recall that the workqueue is handled within this function, it's destroyed, which is as it should be. And the `rt2x00dev->txstatus_fifo` is freed via `kfifo_free(&rt2x00dev->txstatus_fifo);` so that's covered.

Wait, it looks like `rt2x00lib_remove_dev` also calls `rt2x00lib_uninitialize(rt2x00dev)`. That likely handles a lot of the other state cleanup. I'll need to examine that function in detail to ensure that all allocated memory is properly released during device removal. This is crucial for avoiding any memory leaks or resource contention during device detach.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00lib_uninitialize]

map[SourceCode:1215:	/*
1216:	 * Initialization/uninitialization handlers.
1217:	 */
1218:	static void rt2x00lib_uninitialize(struct rt2x00_dev *rt2x00dev)
1219:	{
1220:		if (!test_and_clear_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags))
1221:			return;
1222:	
1223:		/*
1224:		 * Stop rfkill polling.
1225:		 */
1226:		if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
1227:			rt2x00rfkill_unregister(rt2x00dev);
1228:	
1229:		/*
1230:		 * Allow the HW to uninitialize.
1231:		 */
1232:		rt2x00dev->ops->lib->uninitialize(rt2x00dev);
1233:	
1234:		/*
1235:		 * Free allocated queue entries.
1236:		 */
1237:		rt2x00queue_uninitialize(rt2x00dev);
1238:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c]

gemini-3.1-pro-preview

							input: 400150
							output: 64
							thoughts: 325
						

**Analyzing Driver Initialization and Cleanup**

Okay, so I'm digging into this driver code... first thing I see is this check in `rt2x00lib_uninitialize`. It's checking `DEVICE_STATE_INITIALIZED`. That's a red flag. If `rt2x00lib_initialize` *wasn't* called, then `DEVICE_STATE_INITIALIZED` is probably never set, and `rt2x00lib_uninitialize` does absolutely nothing. Makes sense. But then I remember, `rt2x00lib_initialize` is called from `rt2x00lib_start`. So, if `rt2x00lib_start` is never invoked, we're essentially bypassing the initialisation path entirely. `DEVICE_STATE_INITIALIZED` stays unset, `rt2x00lib_uninitialize` is a no-op, which feels right.

Then I shifted my focus. `rt2x00lib_probe_dev` calls `rt2x00queue_allocate`. Now, I'm getting suspicious. Is `rt2x00queue_allocate` actually allocating memory that we need to free later? Yep, and thankfully, it looks like `rt2x00queue_free` handles it, specifically:

```c
	/*
	 * Free queue structures.
	 */
	rt2x00queue_free(rt2x00dev);
```

So, that's handled correctly. Moving on...

Now, I'm looking at `rt2500usb_probe_hw_mode`. There's this `tx_power` variable, allocated with `kcalloc`:

```c
	tx_power = kcalloc(14, sizeof(*tx_power), GFP_KERNEL);
	if (!tx_power)
		return -ENOMEM;
```

Aha! `tx_power` is definitely going to cause an issue. I've got to check where that's assigned... is it assigned to some `info->power` or something similar? Gotta double check `rt2500usb_probe_hw_mode` to make sure we're not leaking anything.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c IncludeLines:true Name:rt2500usb_probe_hw_mode]

map[SourceCode:1662:	static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
1663:	{
1664:		struct hw_mode_spec *spec = &rt2x00dev->spec;
1665:		struct channel_info *info;
1666:		u8 *tx_power;
1667:		unsigned int i;
1668:	
1669:		/*
1670:		 * Initialize all hw fields.
1671:		 *
1672:		 * Don't set IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING unless we are
1673:		 * capable of sending the buffered frames out after the DTIM
1674:		 * transmission using rt2x00lib_beacondone. This will send out
1675:		 * multicast and broadcast traffic immediately instead of buffering it
1676:		 * infinitly and thus dropping it after some time.
1677:		 */
1678:		ieee80211_hw_set(rt2x00dev->hw, PS_NULLFUNC_STACK);
1679:		ieee80211_hw_set(rt2x00dev->hw, SUPPORTS_PS);
1680:		ieee80211_hw_set(rt2x00dev->hw, RX_INCLUDES_FCS);
1681:		ieee80211_hw_set(rt2x00dev->hw, SIGNAL_DBM);
1682:	
1683:		/*
1684:		 * Disable powersaving as default.
1685:		 */
1686:		rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
1687:	
1688:		SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
1689:		SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
1690:					rt2x00_eeprom_addr(rt2x00dev,
1691:							   EEPROM_MAC_ADDR_0));
1692:	
1693:		/*
1694:		 * Initialize hw_mode information.
1695:		 */
1696:		spec->supported_bands = SUPPORT_BAND_2GHZ;
1697:		spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
1698:	
1699:		if (rt2x00_rf(rt2x00dev, RF2522)) {
1700:			spec->num_channels = ARRAY_SIZE(rf_vals_bg_2522);
1701:			spec->channels = rf_vals_bg_2522;
1702:		} else if (rt2x00_rf(rt2x00dev, RF2523)) {
1703:			spec->num_channels = ARRAY_SIZE(rf_vals_bg_2523);
1704:			spec->channels = rf_vals_bg_2523;
1705:		} else if (rt2x00_rf(rt2x00dev, RF2524)) {
1706:			spec->num_channels = ARRAY_SIZE(rf_vals_bg_2524);
1707:			spec->channels = rf_vals_bg_2524;
1708:		} else if (rt2x00_rf(rt2x00dev, RF2525)) {
1709:			spec->num_channels = ARRAY_SIZE(rf_vals_bg_2525);
1710:			spec->channels = rf_vals_bg_2525;
1711:		} else if (rt2x00_rf(rt2x00dev, RF2525E)) {
1712:			spec->num_channels = ARRAY_SIZE(rf_vals_bg_2525e);
1713:			spec->channels = rf_vals_bg_2525e;
1714:		} else if (rt2x00_rf(rt2x00dev, RF5222)) {
1715:			spec->supported_bands |= SUPPORT_BAND_5GHZ;
1716:			spec->num_channels = ARRAY_SIZE(rf_vals_5222);
1717:			spec->channels = rf_vals_5222;
1718:		}
1719:	
1720:		/*
1721:		 * Create channel information array
1722:		 */
1723:		info = kzalloc_objs(*info, spec->num_channels);
1724:		if (!info)
1725:			return -ENOMEM;
1726:	
1727:		spec->channels_info = info;
1728:	
1729:		tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_START);
1730:		for (i = 0; i < 14; i++) {
1731:			info[i].max_power = MAX_TXPOWER;
1732:			info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
1733:		}
1734:	
1735:		if (spec->num_channels > 14) {
1736:			for (i = 14; i < spec->num_channels; i++) {
1737:				info[i].max_power = MAX_TXPOWER;
1738:				info[i].default_power1 = DEFAULT_TXPOWER;
1739:			}
1740:		}
1741:	
1742:		return 0;
1743:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c]

gemini-3-flash-preview

Here is a comprehensive summary of the investigation so far:

### 1. Approaches Tried and Results
- **Identified Target Drivers:** You analyzed the provided C reproducer and extracted the USB Vendor and Product IDs being emulated. By grepping the kernel source, you successfully mapped these to two specific wireless drivers:
  - `0x0db0:0x6869` maps to the Ralink `rt2500usb` driver (`drivers/net/wireless/ralink/rt2x00/rt2500usb.c`).
  - `0x0bda:0x5088` maps to the Realtek `rtl8192cu` driver (`drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c`).
- **Investigated `rtl8192cu` (Realtek):** You explored the probe path (`rtl_usb_probe`), initialization (`_rtl_usb_init`, `_rtl_usb_init_rx`), and endpoint mapping (`rtl8192cu_endpoint_mapping`, `configvernoutep`). You also looked at how RX URBs are prepared and submitted (`_rtl_usb_receive`, `_rtl_prep_rx_urb`).
- **Investigated `rt2500usb` (Ralink):** You traced the probe sequence from `rt2500usb_probe` -> `rt2x00usb_probe` -> `rt2x00lib_probe_dev` -> `rt2500usb_probe_hw`. You paid special attention to queue allocation (`rt2x00queue_allocate`) and EEPROM validation (`rt2500usb_validate_eeprom`, `rt2x00usb_eeprom_read`).
- **Memory Leak / Cleanup Checks:** You investigated how `rt2x00dev->eeprom` is allocated (`kzalloc` in `rt2x00usb_alloc_reg`) and checked the error handling/cleanup paths (`rt2x00lib_remove_dev`, `rt2x00lib_remove_hw`) to see if memory is properly freed if the probe fails.
- **USB Core Checks:** You reviewed `usb_parse_configuration`, `hub_port_init`, and `usb_submit_urb` to understand how the USB core handles malformed descriptors (e.g., missing endpoints, invalid max packet sizes) before passing them to the drivers.

### 2. Current Hypotheses and Active Lines of Investigation
- **Malformed USB Descriptors:** The reproducer feeds custom, potentially malformed USB descriptors to the kernel. The crash/bug is likely triggered during the probe or initialization phase of either the `rt2500usb` or `rtl8192cu` driver when they attempt to parse these descriptors, map endpoints, or submit initial URBs.
- **EEPROM Handling in `rt2500usb`:** You are actively investigating if reading the EEPROM via vendor requests (`rt2x00usb_eeprom_read`) during `rt2500usb_probe_hw` could cause a buffer overflow, uninitialized memory usage, or a memory leak if the device disconnects or fails validation.
- **URB Submission Failures:** You are looking into how URBs are submitted (`usb_submit_urb`) and whether a failure in URB submission (due to bad endpoint descriptors) is improperly handled, leading to a use-after-free or null-pointer dereference in the completion handlers or cleanup routines.

### 3. Critical Files and Code Snippets to Remember
- **Ralink (`rt2500usb`):**
  - `drivers/net/wireless/ralink/rt2x00/rt2500usb.c`: `rt2500usb_probe_hw()`, `rt2500usb_validate_eeprom()`
  - `drivers/net/wireless/ralink/rt2x00/rt2x00usb.c`: `rt2x00usb_probe()`, `rt2x00usb_alloc_reg()` (where `rt2x00dev->eeprom` is allocated).
  - `drivers/net/wireless/ralink/rt2x00/rt2x00dev.c`: `rt2x00lib_probe_dev()`, `rt2x00lib_remove_dev()` (cleanup path).
- **Realtek (`rtl8192cu`):**
  - `drivers/net/wireless/realtek/rtlwifi/usb.c`: `rtl_usb_probe()`, `_rtl_usb_init()`, `_rtl_usb_receive()` (where `usb_submit_urb` is called for RX).
  - `drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c`: `configvernoutep()` (endpoint mapping).
- **USB Core:**
  - `drivers/usb/core/urb.c`: `usb_submit_urb()`

### 4. Warnings: Reasoning Loops and Repetitive Tool Calls
- **Repetitive Grepping:** You executed multiple `grepper` calls for `usb_submit_urb` and `eeprom =` with slightly varying or overly broad arguments. This resulted in massive, truncated outputs and triggered a system warning: *"You are repeating the same tool call with the exact same arguments. Please synthesize the information you already have instead of repeating queries."*
- **Recommendation:** Avoid broad greps for highly common kernel functions or variable assignments. Instead, rely on `codesearch-find-references` or scope your greps strictly to the specific driver directories you are investigating (e.g., `drivers/net/wireless/ralink/rt2x00/`).

							input: 370633
							output: 1279
							thoughts: 4128
						

gemini-3.1-pro-preview

							input: 200996
							output: 187
							thoughts: 62912
						

map[Question:The reproducer connects a USB device with `idVendor=0xdb0` and `idProduct=0x6869`, which maps to the `rt2500usb` driver. The strace output shows that the reproducer exits with status 67, and there is a message "SYZFAIL: tun: can't open /dev/net/tun (errno 19: No such device)". This means the reproducer failed to open `/dev/net/tun`. However, the prompt says "The crash is:" and gives the strace output. Is there a kernel crash hidden in the strace output, or is the crash something else? Wait, the strace output shows `+++ killed by SIGKILL +++` for some threads. Let's look at the strace output carefully.]

map[Answer:The strace output provided by the user shows that the reproducer failed to open `/dev/net/tun` with `ENODEV` and then exited with status 67. However, the `+++ killed by SIGKILL +++` message for some threads, combined with the fact that this is a syzkaller reproducer for a USB device (`rt2500usb`), strongly suggests that a kernel crash occurred during the execution.

Based on an analysis of the `rt2500usb` and `rt2x00usb` driver source code, there are two primary candidates for this crash:

1.  **Divide-by-zero in `rt2x00usb_get_tx_data_len`**:
    The function `rt2500usb_get_tx_data_len` (and similar functions in other `rt2x00usb` drivers) performs a modulo operation using `entry->queue->usb_maxpacket`:
    ```c
    length += (2 * !(length % entry->queue->usb_maxpacket));
    ```
    If a malicious USB device provides a `wMaxPacketSize` of `0` in its endpoint descriptor, `usb_maxpacket` will be `0`, leading to a **kernel divide error** (divide-by-zero) when the driver attempts to send a packet (such as a beacon during interface startup). This crash would happen in a workqueue context and could lead to a kernel panic or the killing of the responsible thread.

2.  **NULL pointer dereference in `rt2x00usb_disconnect` due to `usb_reset_device`**:
    In `rt2x00usb_probe`, the driver calls `usb_reset_device(usb_dev)` before it has initialized its interface data:
    ```c
    805: usb_reset_device(usb_dev);
    ...
    813: usb_set_intfdata(usb_intf, hw);
    ```
    If `usb_reset_device` triggers a re-enumeration or a disconnect of the interface, the kernel will call `rt2x00usb_disconnect`. This function immediately attempts to retrieve the interface data:
    ```c
    860: struct ieee80211_hw *hw = usb_get_intfdata(usb_intf);
    861: struct rt2x00_dev *rt2x00dev = hw->priv;
    ```
    Since `usb_set_intfdata` has not been called yet, `hw` is `NULL`, resulting in a **NULL pointer dereference**.

The `SYZFAIL` and `ENODEV` for `/dev/net/tun` are likely side effects of the kernel being in an unstable state or the reproducer being interrupted mid-execution by the kernel crash. The `SIGKILL` in the strace is the result of the syzkaller manager terminating the executor after detecting the kernel panic or hang.]

gemini-3-flash-preview

You are a capable Linux kernel developer tasked with researching complex questions
about kernel source code. You will be given a concrete question, and need to provide
a concrete answer.
Use tools extensively while researching the question. Don't make assumptions,
or rely on your previous knowledge about the kernel source code, use available tools
to access the actual source code.
Use all available sources of information:
 - kernel source code
 - documentation in the Documentation dir in the source tree
 - git commits descriptions, git blame

Prefer calling several tools at the same time to save round-trips.

The reproducer connects a USB device with `idVendor=0xdb0` and `idProduct=0x6869`, which maps to the `rt2500usb` driver. The strace output shows that the reproducer exits with status 67, and there is a message "SYZFAIL: tun: can't open /dev/net/tun (errno 19: No such device)". This means the reproducer failed to open `/dev/net/tun`. However, the prompt says "The crash is:" and gives the strace output. Is there a kernel crash hidden in the strace output, or is the crash something else? Wait, the strace output shows `+++ killed by SIGKILL +++` for some threads. Let's look at the strace output carefully.

The strace output provided by the user shows that the reproducer failed to open `/dev/net/tun` with `ENODEV` and then exited with status 67. However, the `+++ killed by SIGKILL +++` message for some threads, combined with the fact that this is a syzkaller reproducer for a USB device (`rt2500usb`), strongly suggests that a kernel crash occurred during the execution.

Based on an analysis of the `rt2500usb` and `rt2x00usb` driver source code, there are two primary candidates for this crash:

1.  **Divide-by-zero in `rt2x00usb_get_tx_data_len`**:
    The function `rt2500usb_get_tx_data_len` (and similar functions in other `rt2x00usb` drivers) performs a modulo operation using `entry->queue->usb_maxpacket`:
    ```c
    length += (2 * !(length % entry->queue->usb_maxpacket));
    ```
    If a malicious USB device provides a `wMaxPacketSize` of `0` in its endpoint descriptor, `usb_maxpacket` will be `0`, leading to a **kernel divide error** (divide-by-zero) when the driver attempts to send a packet (such as a beacon during interface startup). This crash would happen in a workqueue context and could lead to a kernel panic or the killing of the responsible thread.

2.  **NULL pointer dereference in `rt2x00usb_disconnect` due to `usb_reset_device`**:
    In `rt2x00usb_probe`, the driver calls `usb_reset_device(usb_dev)` before it has initialized its interface data:
    ```c
    805: usb_reset_device(usb_dev);
    ...
    813: usb_set_intfdata(usb_intf, hw);
    ```
    If `usb_reset_device` triggers a re-enumeration or a disconnect of the interface, the kernel will call `rt2x00usb_disconnect`. This function immediately attempts to retrieve the interface data:
    ```c
    860: struct ieee80211_hw *hw = usb_get_intfdata(usb_intf);
    861: struct rt2x00_dev *rt2x00dev = hw->priv;
    ```
    Since `usb_set_intfdata` has not been called yet, `hw` is `NULL`, resulting in a **NULL pointer dereference**.

The `SYZFAIL` and `ENODEV` for `/dev/net/tun` are likely side effects of the kernel being in an unstable state or the reproducer being interrupted mid-execution by the kernel crash. The `SIGKILL` in the strace is the result of the syzkaller manager terminating the executor after detecting the kernel panic or hang.

gemini-3-flash-preview

							input: 2425
							output: 33
							thoughts: 163
						

**Investigating a Potential Kernel Crash**

Okay, so the user is reporting a possible kernel crash triggered by a reproducer, and they've helpfully included an `strace` output. My first thought is to dive into this. The key pieces of information are the USB device with `idVendor=0xdb0` and `idProduct=0x6869`, which is using the `rt2500usb` driver. The `strace` output mentions a `SYZFAIL` error related to `/dev/net/tun` and some processes getting `SIGKILL`'d. That's definitely suspicious.

My immediate focus shifts to the `rt2500usb` driver itself. I need to determine if it's the culprit. So, I need to start by searching for that driver in the kernel source. I'm going to need to track down the relevant code and see if anything jumps out as a potential cause for a crash in this scenario. I have to see how this driver interacts with the networking stack, since we have that error.

map[Dir:drivers/net/wireless/ralink/rt2x00/]

map[Files:[rt2400pci.c rt2400pci.h rt2500pci.c rt2500pci.h rt2500usb.c rt2500usb.h rt2800.h rt2800lib.c rt2800lib.h rt2800mmio.c rt2800mmio.h rt2800pci.c rt2800pci.h rt2800soc.c rt2800usb.c rt2800usb.h rt2x00.h rt2x00config.c rt2x00crypto.c rt2x00debug.c rt2x00debug.h rt2x00dev.c rt2x00dump.h rt2x00firmware.c rt2x00leds.c rt2x00leds.h rt2x00lib.h rt2x00link.c rt2x00mac.c rt2x00mmio.c rt2x00mmio.h rt2x00pci.c rt2x00pci.h rt2x00queue.c rt2x00queue.h rt2x00reg.h rt2x00usb.c rt2x00usb.h rt61pci.c rt61pci.h rt73usb.c rt73usb.h] Subdirs:<nil>]

gemini-3-flash-preview

							input: 3331
							output: 38
							thoughts: 72
						

**Analyzing the rt2500usb.c Driver**

Alright, let's dive into this. The user pointed me towards `rt2500usb.c`, which, as I recall, resides within the `drivers/net/wireless/ralink/rt2x00/` directory. That's a good starting point. Now, the user specified `idVendor=0xdb0` and `idProduct=0x6869`. My instinct is to confirm those values within the source code of `rt2500usb.c`. Let's cross-reference the device identifiers in the driver. This is standard procedure, but always good to double check.

map[File:drivers/net/wireless/ralink/rt2x00/rt2500usb.c]

map[Contents:// SPDX-License-Identifier: GPL-2.0-or-later
/*
	Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
	<http://rt2x00.serialmonkey.com>

 */

/*
	Module: rt2500usb
	Abstract: rt2500usb device specific routines.
	Supported chipsets: RT2570.
 */

#include <linux/delay.h>
#include <linux/etherdevice.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/slab.h>
#include <linux/usb.h>

#include "rt2x00.h"
#include "rt2x00usb.h"
#include "rt2500usb.h"

/*
 * Allow hardware encryption to be disabled.
 */
static bool modparam_nohwcrypt;
module_param_named(nohwcrypt, modparam_nohwcrypt, bool, 0444);
MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");

/*
 * Register access.
 * All access to the CSR registers will go through the methods
 * rt2500usb_register_read and rt2500usb_register_write.
 * BBP and RF register require indirect register access,
 * and use the CSR registers BBPCSR and RFCSR to achieve this.
 * These indirect registers work with busy bits,
 * and we will try maximal REGISTER_USB_BUSY_COUNT times to access
 * the register while taking a REGISTER_BUSY_DELAY us delay
 * between each attampt. When the busy bit is still set at that time,
 * the access attempt is considered to have failed,
 * and we will print an error.
 * If the csr_mutex is already held then the _lock variants must
 * be used instead.
 */
static u16 rt2500usb_register_read(struct rt2x00_dev *rt2x00dev,
				   const unsigned int offset)
{
	__le16 reg;
	rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_READ,
				      USB_VENDOR_REQUEST_IN, offset,
				      &reg, sizeof(reg));
	return le16_to_cpu(reg);
}

static u16 rt2500usb_register_read_lock(struct rt2x00_dev *rt2x00dev,
					const unsigned int offset)
{
	__le16 reg;
	rt2x00usb_vendor_req_buff_lock(rt2x00dev, USB_MULTI_READ,
				       USB_VENDOR_REQUEST_IN, offset,
				       &reg, sizeof(reg), REGISTER_TIMEOUT);
	return le16_to_cpu(reg);
}

static void rt2500usb_register_write(struct rt2x00_dev *rt2x00dev,
					    const unsigned int offset,
					    u16 value)
{
	__le16 reg = cpu_to_le16(value);
	rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_WRITE,
				      USB_VENDOR_REQUEST_OUT, offset,
				      &reg, sizeof(reg));
}

static void rt2500usb_register_write_lock(struct rt2x00_dev *rt2x00dev,
						 const unsigned int offset,
						 u16 value)
{
	__le16 reg = cpu_to_le16(value);
	rt2x00usb_vendor_req_buff_lock(rt2x00dev, USB_MULTI_WRITE,
				       USB_VENDOR_REQUEST_OUT, offset,
				       &reg, sizeof(reg), REGISTER_TIMEOUT);
}

static void rt2500usb_register_multiwrite(struct rt2x00_dev *rt2x00dev,
						 const unsigned int offset,
						 void *value, const u16 length)
{
	rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_WRITE,
				      USB_VENDOR_REQUEST_OUT, offset,
				      value, length);
}

static int rt2500usb_regbusy_read(struct rt2x00_dev *rt2x00dev,
				  const unsigned int offset,
				  struct rt2x00_field16 field,
				  u16 *reg)
{
	unsigned int i;

	for (i = 0; i < REGISTER_USB_BUSY_COUNT; i++) {
		*reg = rt2500usb_register_read_lock(rt2x00dev, offset);
		if (!rt2x00_get_field16(*reg, field))
			return 1;
		udelay(REGISTER_BUSY_DELAY);
	}

	rt2x00_err(rt2x00dev, "Indirect register access failed: offset=0x%.08x, value=0x%.08x\n",
		   offset, *reg);
	*reg = ~0;

	return 0;
}

#define WAIT_FOR_BBP(__dev, __reg) \
	rt2500usb_regbusy_read((__dev), PHY_CSR8, PHY_CSR8_BUSY, (__reg))
#define WAIT_FOR_RF(__dev, __reg) \
	rt2500usb_regbusy_read((__dev), PHY_CSR10, PHY_CSR10_RF_BUSY, (__reg))

static void rt2500usb_bbp_write(struct rt2x00_dev *rt2x00dev,
				const unsigned int word, const u8 value)
{
	u16 reg;

	mutex_lock(&rt2x00dev->csr_mutex);

	/*
	 * Wait until the BBP becomes available, afterwards we
	 * can safely write the new data into the register.
	 */
	if (WAIT_FOR_BBP(rt2x00dev, &reg)) {
		reg = 0;
		rt2x00_set_field16(&reg, PHY_CSR7_DATA, value);
		rt2x00_set_field16(&reg, PHY_CSR7_REG_ID, word);
		rt2x00_set_field16(&reg, PHY_CSR7_READ_CONTROL, 0);

		rt2500usb_register_write_lock(rt2x00dev, PHY_CSR7, reg);
	}

	mutex_unlock(&rt2x00dev->csr_mutex);
}

static u8 rt2500usb_bbp_read(struct rt2x00_dev *rt2x00dev,
			     const unsigned int word)
{
	u16 reg;
	u8 value;

	mutex_lock(&rt2x00dev->csr_mutex);

	/*
	 * Wait until the BBP becomes available, afterwards we
	 * can safely write the read request into the register.
	 * After the data has been written, we wait until hardware
	 * returns the correct value, if at any time the register
	 * doesn't become available in time, reg will be 0xffffffff
	 * which means we return 0xff to the caller.
	 */
	if (WAIT_FOR_BBP(rt2x00dev, &reg)) {
		reg = 0;
		rt2x00_set_field16(&reg, PHY_CSR7_REG_ID, word);
		rt2x00_set_field16(&reg, PHY_CSR7_READ_CONTROL, 1);

		rt2500usb_register_write_lock(rt2x00dev, PHY_CSR7, reg);

		if (WAIT_FOR_BBP(rt2x00dev, &reg))
			reg = rt2500usb_register_read_lock(rt2x00dev, PHY_CSR7);
	}

	value = rt2x00_get_field16(reg, PHY_CSR7_DATA);

	mutex_unlock(&rt2x00dev->csr_mutex);

	return value;
}

static void rt2500usb_rf_write(struct rt2x00_dev *rt2x00dev,
			       const unsigned int word, const u32 value)
{
	u16 reg;

	mutex_lock(&rt2x00dev->csr_mutex);

	/*
	 * Wait until the RF becomes available, afterwards we
	 * can safely write the new data into the register.
	 */
	if (WAIT_FOR_RF(rt2x00dev, &reg)) {
		reg = 0;
		rt2x00_set_field16(&reg, PHY_CSR9_RF_VALUE, value);
		rt2500usb_register_write_lock(rt2x00dev, PHY_CSR9, reg);

		reg = 0;
		rt2x00_set_field16(&reg, PHY_CSR10_RF_VALUE, value >> 16);
		rt2x00_set_field16(&reg, PHY_CSR10_RF_NUMBER_OF_BITS, 20);
		rt2x00_set_field16(&reg, PHY_CSR10_RF_IF_SELECT, 0);
		rt2x00_set_field16(&reg, PHY_CSR10_RF_BUSY, 1);

		rt2500usb_register_write_lock(rt2x00dev, PHY_CSR10, reg);
		rt2x00_rf_write(rt2x00dev, word, value);
	}

	mutex_unlock(&rt2x00dev->csr_mutex);
}

#ifdef CONFIG_RT2X00_LIB_DEBUGFS
static u32 _rt2500usb_register_read(struct rt2x00_dev *rt2x00dev,
				     const unsigned int offset)
{
	return rt2500usb_register_read(rt2x00dev, offset);
}

static void _rt2500usb_register_write(struct rt2x00_dev *rt2x00dev,
				      const unsigned int offset,
				      u32 value)
{
	rt2500usb_register_write(rt2x00dev, offset, value);
}

static const struct rt2x00debug rt2500usb_rt2x00debug = {
	.owner	= THIS_MODULE,
	.csr	= {
		.read		= _rt2500usb_register_read,
		.write		= _rt2500usb_register_write,
		.flags		= RT2X00DEBUGFS_OFFSET,
		.word_base	= CSR_REG_BASE,
		.word_size	= sizeof(u16),
		.word_count	= CSR_REG_SIZE / sizeof(u16),
	},
	.eeprom	= {
		.read		= rt2x00_eeprom_read,
		.write		= rt2x00_eeprom_write,
		.word_base	= EEPROM_BASE,
		.word_size	= sizeof(u16),
		.word_count	= EEPROM_SIZE / sizeof(u16),
	},
	.bbp	= {
		.read		= rt2500usb_bbp_read,
		.write		= rt2500usb_bbp_write,
		.word_base	= BBP_BASE,
		.word_size	= sizeof(u8),
		.word_count	= BBP_SIZE / sizeof(u8),
	},
	.rf	= {
		.read		= rt2x00_rf_read,
		.write		= rt2500usb_rf_write,
		.word_base	= RF_BASE,
		.word_size	= sizeof(u32),
		.word_count	= RF_SIZE / sizeof(u32),
	},
};
#endif /* CONFIG_RT2X00_LIB_DEBUGFS */

static int rt2500usb_rfkill_poll(struct rt2x00_dev *rt2x00dev)
{
	u16 reg;

	reg = rt2500usb_register_read(rt2x00dev, MAC_CSR19);
	return rt2x00_get_field16(reg, MAC_CSR19_VAL7);
}

#ifdef CONFIG_RT2X00_LIB_LEDS
static void rt2500usb_brightness_set(struct led_classdev *led_cdev,
				     enum led_brightness brightness)
{
	struct rt2x00_led *led =
	    container_of(led_cdev, struct rt2x00_led, led_dev);
	unsigned int enabled = brightness != LED_OFF;
	u16 reg;

	reg = rt2500usb_register_read(led->rt2x00dev, MAC_CSR20);

	if (led->type == LED_TYPE_RADIO || led->type == LED_TYPE_ASSOC)
		rt2x00_set_field16(&reg, MAC_CSR20_LINK, enabled);
	else if (led->type == LED_TYPE_ACTIVITY)
		rt2x00_set_field16(&reg, MAC_CSR20_ACTIVITY, enabled);

	rt2500usb_register_write(led->rt2x00dev, MAC_CSR20, reg);
}

static int rt2500usb_blink_set(struct led_classdev *led_cdev,
			       unsigned long *delay_on,
			       unsigned long *delay_off)
{
	struct rt2x00_led *led =
	    container_of(led_cdev, struct rt2x00_led, led_dev);
	u16 reg;

	reg = rt2500usb_register_read(led->rt2x00dev, MAC_CSR21);
	rt2x00_set_field16(&reg, MAC_CSR21_ON_PERIOD, *delay_on);
	rt2x00_set_field16(&reg, MAC_CSR21_OFF_PERIOD, *delay_off);
	rt2500usb_register_write(led->rt2x00dev, MAC_CSR21, reg);

	return 0;
}

static void rt2500usb_init_led(struct rt2x00_dev *rt2x00dev,
			       struct rt2x00_led *led,
			       enum led_type type)
{
	led->rt2x00dev = rt2x00dev;
	led->type = type;
	led->led_dev.brightness_set = rt2500usb_brightness_set;
	led->led_dev.blink_set = rt2500usb_blink_set;
	led->flags = LED_INITIALIZED;
}
#endif /* CONFIG_RT2X00_LIB_LEDS */

/*
 * Configuration handlers.
 */

/*
 * rt2500usb does not differentiate between shared and pairwise
 * keys, so we should use the same function for both key types.
 */
static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev,
				struct rt2x00lib_crypto *crypto,
				struct ieee80211_key_conf *key)
{
	u32 mask;
	u16 reg;
	enum cipher curr_cipher;

	if (crypto->cmd == SET_KEY) {
		/*
		 * Disallow to set WEP key other than with index 0,
		 * it is known that not work at least on some hardware.
		 * SW crypto will be used in that case.
		 */
		if ((key->cipher == WLAN_CIPHER_SUITE_WEP40 ||
		     key->cipher == WLAN_CIPHER_SUITE_WEP104) &&
		    key->keyidx != 0)
			return -EOPNOTSUPP;

		/*
		 * Pairwise key will always be entry 0, but this
		 * could collide with a shared key on the same
		 * position...
		 */
		mask = TXRX_CSR0_KEY_ID.bit_mask;

		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR0);
		curr_cipher = rt2x00_get_field16(reg, TXRX_CSR0_ALGORITHM);
		reg &= mask;

		if (reg && reg == mask)
			return -ENOSPC;

		reg = rt2x00_get_field16(reg, TXRX_CSR0_KEY_ID);

		key->hw_key_idx += reg ? ffz(reg) : 0;
		/*
		 * Hardware requires that all keys use the same cipher
		 * (e.g. TKIP-only, AES-only, but not TKIP+AES).
		 * If this is not the first key, compare the cipher with the
		 * first one and fall back to SW crypto if not the same.
		 */
		if (key->hw_key_idx > 0 && crypto->cipher != curr_cipher)
			return -EOPNOTSUPP;

		rt2500usb_register_multiwrite(rt2x00dev, KEY_ENTRY(key->hw_key_idx),
					      crypto->key, sizeof(crypto->key));

		/*
		 * The driver does not support the IV/EIV generation
		 * in hardware. However it demands the data to be provided
		 * both separately as well as inside the frame.
		 * We already provided the CONFIG_CRYPTO_COPY_IV to rt2x00lib
		 * to ensure rt2x00lib will not strip the data from the
		 * frame after the copy, now we must tell mac80211
		 * to generate the IV/EIV data.
		 */
		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
		key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
	}

	/*
	 * TXRX_CSR0_KEY_ID contains only single-bit fields to indicate
	 * a particular key is valid.
	 */
	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR0);
	rt2x00_set_field16(&reg, TXRX_CSR0_ALGORITHM, crypto->cipher);
	rt2x00_set_field16(&reg, TXRX_CSR0_IV_OFFSET, IEEE80211_HEADER);

	mask = rt2x00_get_field16(reg, TXRX_CSR0_KEY_ID);
	if (crypto->cmd == SET_KEY)
		mask |= 1 << key->hw_key_idx;
	else if (crypto->cmd == DISABLE_KEY)
		mask &= ~(1 << key->hw_key_idx);
	rt2x00_set_field16(&reg, TXRX_CSR0_KEY_ID, mask);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR0, reg);

	return 0;
}

static void rt2500usb_config_filter(struct rt2x00_dev *rt2x00dev,
				    const unsigned int filter_flags)
{
	u16 reg;

	/*
	 * Start configuration steps.
	 * Note that the version error will always be dropped
	 * and broadcast frames will always be accepted since
	 * there is no filter for it at this time.
	 */
	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR2);
	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_CRC,
			   !(filter_flags & FIF_FCSFAIL));
	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_PHYSICAL,
			   !(filter_flags & FIF_PLCPFAIL));
	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_CONTROL,
			   !(filter_flags & FIF_CONTROL));
	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_NOT_TO_ME,
			   !test_bit(CONFIG_MONITORING, &rt2x00dev->flags));
	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_TODS,
			   !test_bit(CONFIG_MONITORING, &rt2x00dev->flags) &&
			   !rt2x00dev->intf_ap_count);
	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_VERSION_ERROR, 1);
	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_MULTICAST,
			   !(filter_flags & FIF_ALLMULTI));
	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_BROADCAST, 0);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR2, reg);
}

static void rt2500usb_config_intf(struct rt2x00_dev *rt2x00dev,
				  struct rt2x00_intf *intf,
				  struct rt2x00intf_conf *conf,
				  const unsigned int flags)
{
	unsigned int bcn_preload;
	u16 reg;

	if (flags & CONFIG_UPDATE_TYPE) {
		/*
		 * Enable beacon config
		 */
		bcn_preload = PREAMBLE + GET_DURATION(IEEE80211_HEADER, 20);
		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR20);
		rt2x00_set_field16(&reg, TXRX_CSR20_OFFSET, bcn_preload >> 6);
		rt2x00_set_field16(&reg, TXRX_CSR20_BCN_EXPECT_WINDOW,
				   2 * (conf->type != NL80211_IFTYPE_STATION));
		rt2500usb_register_write(rt2x00dev, TXRX_CSR20, reg);

		/*
		 * Enable synchronisation.
		 */
		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR18);
		rt2x00_set_field16(&reg, TXRX_CSR18_OFFSET, 0);
		rt2500usb_register_write(rt2x00dev, TXRX_CSR18, reg);

		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR19);
		rt2x00_set_field16(&reg, TXRX_CSR19_TSF_SYNC, conf->sync);
		rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
	}

	if (flags & CONFIG_UPDATE_MAC)
		rt2500usb_register_multiwrite(rt2x00dev, MAC_CSR2, conf->mac,
					      (3 * sizeof(__le16)));

	if (flags & CONFIG_UPDATE_BSSID)
		rt2500usb_register_multiwrite(rt2x00dev, MAC_CSR5, conf->bssid,
					      (3 * sizeof(__le16)));
}

static void rt2500usb_config_erp(struct rt2x00_dev *rt2x00dev,
				 struct rt2x00lib_erp *erp,
				 u32 changed)
{
	u16 reg;

	if (changed & BSS_CHANGED_ERP_PREAMBLE) {
		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR10);
		rt2x00_set_field16(&reg, TXRX_CSR10_AUTORESPOND_PREAMBLE,
				   !!erp->short_preamble);
		rt2500usb_register_write(rt2x00dev, TXRX_CSR10, reg);
	}

	if (changed & BSS_CHANGED_BASIC_RATES)
		rt2500usb_register_write(rt2x00dev, TXRX_CSR11,
					 erp->basic_rates);

	if (changed & BSS_CHANGED_BEACON_INT) {
		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR18);
		rt2x00_set_field16(&reg, TXRX_CSR18_INTERVAL,
				   erp->beacon_int * 4);
		rt2500usb_register_write(rt2x00dev, TXRX_CSR18, reg);
	}

	if (changed & BSS_CHANGED_ERP_SLOT) {
		rt2500usb_register_write(rt2x00dev, MAC_CSR10, erp->slot_time);
		rt2500usb_register_write(rt2x00dev, MAC_CSR11, erp->sifs);
		rt2500usb_register_write(rt2x00dev, MAC_CSR12, erp->eifs);
	}
}

static void rt2500usb_config_ant(struct rt2x00_dev *rt2x00dev,
				 struct antenna_setup *ant)
{
	u8 r2;
	u8 r14;
	u16 csr5;
	u16 csr6;

	/*
	 * We should never come here because rt2x00lib is supposed
	 * to catch this and send us the correct antenna explicitely.
	 */
	BUG_ON(ant->rx == ANTENNA_SW_DIVERSITY ||
	       ant->tx == ANTENNA_SW_DIVERSITY);

	r2 = rt2500usb_bbp_read(rt2x00dev, 2);
	r14 = rt2500usb_bbp_read(rt2x00dev, 14);
	csr5 = rt2500usb_register_read(rt2x00dev, PHY_CSR5);
	csr6 = rt2500usb_register_read(rt2x00dev, PHY_CSR6);

	/*
	 * Configure the TX antenna.
	 */
	switch (ant->tx) {
	case ANTENNA_HW_DIVERSITY:
		rt2x00_set_field8(&r2, BBP_R2_TX_ANTENNA, 1);
		rt2x00_set_field16(&csr5, PHY_CSR5_CCK, 1);
		rt2x00_set_field16(&csr6, PHY_CSR6_OFDM, 1);
		break;
	case ANTENNA_A:
		rt2x00_set_field8(&r2, BBP_R2_TX_ANTENNA, 0);
		rt2x00_set_field16(&csr5, PHY_CSR5_CCK, 0);
		rt2x00_set_field16(&csr6, PHY_CSR6_OFDM, 0);
		break;
	case ANTENNA_B:
	default:
		rt2x00_set_field8(&r2, BBP_R2_TX_ANTENNA, 2);
		rt2x00_set_field16(&csr5, PHY_CSR5_CCK, 2);
		rt2x00_set_field16(&csr6, PHY_CSR6_OFDM, 2);
		break;
	}

	/*
	 * Configure the RX antenna.
	 */
	switch (ant->rx) {
	case ANTENNA_HW_DIVERSITY:
		rt2x00_set_field8(&r14, BBP_R14_RX_ANTENNA, 1);
		break;
	case ANTENNA_A:
		rt2x00_set_field8(&r14, BBP_R14_RX_ANTENNA, 0);
		break;
	case ANTENNA_B:
	default:
		rt2x00_set_field8(&r14, BBP_R14_RX_ANTENNA, 2);
		break;
	}

	/*
	 * RT2525E and RT5222 need to flip TX I/Q
	 */
	if (rt2x00_rf(rt2x00dev, RF2525E) || rt2x00_rf(rt2x00dev, RF5222)) {
		rt2x00_set_field8(&r2, BBP_R2_TX_IQ_FLIP, 1);
		rt2x00_set_field16(&csr5, PHY_CSR5_CCK_FLIP, 1);
		rt2x00_set_field16(&csr6, PHY_CSR6_OFDM_FLIP, 1);

		/*
		 * RT2525E does not need RX I/Q Flip.
		 */
		if (rt2x00_rf(rt2x00dev, RF2525E))
			rt2x00_set_field8(&r14, BBP_R14_RX_IQ_FLIP, 0);
	} else {
		rt2x00_set_field16(&csr5, PHY_CSR5_CCK_FLIP, 0);
		rt2x00_set_field16(&csr6, PHY_CSR6_OFDM_FLIP, 0);
	}

	rt2500usb_bbp_write(rt2x00dev, 2, r2);
	rt2500usb_bbp_write(rt2x00dev, 14, r14);
	rt2500usb_register_write(rt2x00dev, PHY_CSR5, csr5);
	rt2500usb_register_write(rt2x00dev, PHY_CSR6, csr6);
}

static void rt2500usb_config_channel(struct rt2x00_dev *rt2x00dev,
				     struct rf_channel *rf, const int txpower)
{
	/*
	 * Set TXpower.
	 */
	rt2x00_set_field32(&rf->rf3, RF3_TXPOWER, TXPOWER_TO_DEV(txpower));

	/*
	 * For RT2525E we should first set the channel to half band higher.
	 */
	if (rt2x00_rf(rt2x00dev, RF2525E)) {
		static const u32 vals[] = {
			0x000008aa, 0x000008ae, 0x000008ae, 0x000008b2,
			0x000008b2, 0x000008b6, 0x000008b6, 0x000008ba,
			0x000008ba, 0x000008be, 0x000008b7, 0x00000902,
			0x00000902, 0x00000906
		};

		rt2500usb_rf_write(rt2x00dev, 2, vals[rf->channel - 1]);
		if (rf->rf4)
			rt2500usb_rf_write(rt2x00dev, 4, rf->rf4);
	}

	rt2500usb_rf_write(rt2x00dev, 1, rf->rf1);
	rt2500usb_rf_write(rt2x00dev, 2, rf->rf2);
	rt2500usb_rf_write(rt2x00dev, 3, rf->rf3);
	if (rf->rf4)
		rt2500usb_rf_write(rt2x00dev, 4, rf->rf4);
}

static void rt2500usb_config_txpower(struct rt2x00_dev *rt2x00dev,
				     const int txpower)
{
	u32 rf3;

	rf3 = rt2x00_rf_read(rt2x00dev, 3);
	rt2x00_set_field32(&rf3, RF3_TXPOWER, TXPOWER_TO_DEV(txpower));
	rt2500usb_rf_write(rt2x00dev, 3, rf3);
}

static void rt2500usb_config_ps(struct rt2x00_dev *rt2x00dev,
				struct rt2x00lib_conf *libconf)
{
	enum dev_state state =
	    (libconf->conf->flags & IEEE80211_CONF_PS) ?
		STATE_SLEEP : STATE_AWAKE;
	u16 reg;

	if (state == STATE_SLEEP) {
		reg = rt2500usb_register_read(rt2x00dev, MAC_CSR18);
		rt2x00_set_field16(&reg, MAC_CSR18_DELAY_AFTER_BEACON,
				   rt2x00dev->beacon_int - 20);
		rt2x00_set_field16(&reg, MAC_CSR18_BEACONS_BEFORE_WAKEUP,
				   libconf->conf->listen_interval - 1);

		/* We must first disable autowake before it can be enabled */
		rt2x00_set_field16(&reg, MAC_CSR18_AUTO_WAKE, 0);
		rt2500usb_register_write(rt2x00dev, MAC_CSR18, reg);

		rt2x00_set_field16(&reg, MAC_CSR18_AUTO_WAKE, 1);
		rt2500usb_register_write(rt2x00dev, MAC_CSR18, reg);
	} else {
		reg = rt2500usb_register_read(rt2x00dev, MAC_CSR18);
		rt2x00_set_field16(&reg, MAC_CSR18_AUTO_WAKE, 0);
		rt2500usb_register_write(rt2x00dev, MAC_CSR18, reg);
	}

	rt2x00dev->ops->lib->set_device_state(rt2x00dev, state);
}

static void rt2500usb_config(struct rt2x00_dev *rt2x00dev,
			     struct rt2x00lib_conf *libconf,
			     const unsigned int flags)
{
	if (flags & IEEE80211_CONF_CHANGE_CHANNEL)
		rt2500usb_config_channel(rt2x00dev, &libconf->rf,
					 libconf->conf->power_level);
	if ((flags & IEEE80211_CONF_CHANGE_POWER) &&
	    !(flags & IEEE80211_CONF_CHANGE_CHANNEL))
		rt2500usb_config_txpower(rt2x00dev,
					 libconf->conf->power_level);
	if (flags & IEEE80211_CONF_CHANGE_PS)
		rt2500usb_config_ps(rt2x00dev, libconf);
}

/*
 * Link tuning
 */
static void rt2500usb_link_stats(struct rt2x00_dev *rt2x00dev,
				 struct link_qual *qual)
{
	u16 reg;

	/*
	 * Update FCS error count from register.
	 */
	reg = rt2500usb_register_read(rt2x00dev, STA_CSR0);
	qual->rx_failed = rt2x00_get_field16(reg, STA_CSR0_FCS_ERROR);

	/*
	 * Update False CCA count from register.
	 */
	reg = rt2500usb_register_read(rt2x00dev, STA_CSR3);
	qual->false_cca = rt2x00_get_field16(reg, STA_CSR3_FALSE_CCA_ERROR);
}

static void rt2500usb_reset_tuner(struct rt2x00_dev *rt2x00dev,
				  struct link_qual *qual)
{
	u16 eeprom;
	u16 value;

	eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R24);
	value = rt2x00_get_field16(eeprom, EEPROM_BBPTUNE_R24_LOW);
	rt2500usb_bbp_write(rt2x00dev, 24, value);

	eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R25);
	value = rt2x00_get_field16(eeprom, EEPROM_BBPTUNE_R25_LOW);
	rt2500usb_bbp_write(rt2x00dev, 25, value);

	eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R61);
	value = rt2x00_get_field16(eeprom, EEPROM_BBPTUNE_R61_LOW);
	rt2500usb_bbp_write(rt2x00dev, 61, value);

	eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_VGC);
	value = rt2x00_get_field16(eeprom, EEPROM_BBPTUNE_VGCUPPER);
	rt2500usb_bbp_write(rt2x00dev, 17, value);

	qual->vgc_level = value;
}

/*
 * Queue handlers.
 */
static void rt2500usb_start_queue(struct data_queue *queue)
{
	struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
	u16 reg;

	switch (queue->qid) {
	case QID_RX:
		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR2);
		rt2x00_set_field16(&reg, TXRX_CSR2_DISABLE_RX, 0);
		rt2500usb_register_write(rt2x00dev, TXRX_CSR2, reg);
		break;
	case QID_BEACON:
		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR19);
		rt2x00_set_field16(&reg, TXRX_CSR19_TSF_COUNT, 1);
		rt2x00_set_field16(&reg, TXRX_CSR19_TBCN, 1);
		rt2x00_set_field16(&reg, TXRX_CSR19_BEACON_GEN, 1);
		rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
		break;
	default:
		break;
	}
}

static void rt2500usb_stop_queue(struct data_queue *queue)
{
	struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
	u16 reg;

	switch (queue->qid) {
	case QID_RX:
		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR2);
		rt2x00_set_field16(&reg, TXRX_CSR2_DISABLE_RX, 1);
		rt2500usb_register_write(rt2x00dev, TXRX_CSR2, reg);
		break;
	case QID_BEACON:
		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR19);
		rt2x00_set_field16(&reg, TXRX_CSR19_TSF_COUNT, 0);
		rt2x00_set_field16(&reg, TXRX_CSR19_TBCN, 0);
		rt2x00_set_field16(&reg, TXRX_CSR19_BEACON_GEN, 0);
		rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
		break;
	default:
		break;
	}
}

/*
 * Initialization functions.
 */
static int rt2500usb_init_registers(struct rt2x00_dev *rt2x00dev)
{
	u16 reg;

	rt2x00usb_vendor_request_sw(rt2x00dev, USB_DEVICE_MODE, 0x0001,
				    USB_MODE_TEST, REGISTER_TIMEOUT);
	rt2x00usb_vendor_request_sw(rt2x00dev, USB_SINGLE_WRITE, 0x0308,
				    0x00f0, REGISTER_TIMEOUT);

	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR2);
	rt2x00_set_field16(&reg, TXRX_CSR2_DISABLE_RX, 1);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR2, reg);

	rt2500usb_register_write(rt2x00dev, MAC_CSR13, 0x1111);
	rt2500usb_register_write(rt2x00dev, MAC_CSR14, 0x1e11);

	reg = rt2500usb_register_read(rt2x00dev, MAC_CSR1);
	rt2x00_set_field16(&reg, MAC_CSR1_SOFT_RESET, 1);
	rt2x00_set_field16(&reg, MAC_CSR1_BBP_RESET, 1);
	rt2x00_set_field16(&reg, MAC_CSR1_HOST_READY, 0);
	rt2500usb_register_write(rt2x00dev, MAC_CSR1, reg);

	reg = rt2500usb_register_read(rt2x00dev, MAC_CSR1);
	rt2x00_set_field16(&reg, MAC_CSR1_SOFT_RESET, 0);
	rt2x00_set_field16(&reg, MAC_CSR1_BBP_RESET, 0);
	rt2x00_set_field16(&reg, MAC_CSR1_HOST_READY, 0);
	rt2500usb_register_write(rt2x00dev, MAC_CSR1, reg);

	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR5);
	rt2x00_set_field16(&reg, TXRX_CSR5_BBP_ID0, 13);
	rt2x00_set_field16(&reg, TXRX_CSR5_BBP_ID0_VALID, 1);
	rt2x00_set_field16(&reg, TXRX_CSR5_BBP_ID1, 12);
	rt2x00_set_field16(&reg, TXRX_CSR5_BBP_ID1_VALID, 1);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR5, reg);

	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR6);
	rt2x00_set_field16(&reg, TXRX_CSR6_BBP_ID0, 10);
	rt2x00_set_field16(&reg, TXRX_CSR6_BBP_ID0_VALID, 1);
	rt2x00_set_field16(&reg, TXRX_CSR6_BBP_ID1, 11);
	rt2x00_set_field16(&reg, TXRX_CSR6_BBP_ID1_VALID, 1);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR6, reg);

	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR7);
	rt2x00_set_field16(&reg, TXRX_CSR7_BBP_ID0, 7);
	rt2x00_set_field16(&reg, TXRX_CSR7_BBP_ID0_VALID, 1);
	rt2x00_set_field16(&reg, TXRX_CSR7_BBP_ID1, 6);
	rt2x00_set_field16(&reg, TXRX_CSR7_BBP_ID1_VALID, 1);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR7, reg);

	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR8);
	rt2x00_set_field16(&reg, TXRX_CSR8_BBP_ID0, 5);
	rt2x00_set_field16(&reg, TXRX_CSR8_BBP_ID0_VALID, 1);
	rt2x00_set_field16(&reg, TXRX_CSR8_BBP_ID1, 0);
	rt2x00_set_field16(&reg, TXRX_CSR8_BBP_ID1_VALID, 0);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR8, reg);

	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR19);
	rt2x00_set_field16(&reg, TXRX_CSR19_TSF_COUNT, 0);
	rt2x00_set_field16(&reg, TXRX_CSR19_TSF_SYNC, 0);
	rt2x00_set_field16(&reg, TXRX_CSR19_TBCN, 0);
	rt2x00_set_field16(&reg, TXRX_CSR19_BEACON_GEN, 0);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);

	rt2500usb_register_write(rt2x00dev, TXRX_CSR21, 0xe78f);
	rt2500usb_register_write(rt2x00dev, MAC_CSR9, 0xff1d);

	if (rt2x00dev->ops->lib->set_device_state(rt2x00dev, STATE_AWAKE))
		return -EBUSY;

	reg = rt2500usb_register_read(rt2x00dev, MAC_CSR1);
	rt2x00_set_field16(&reg, MAC_CSR1_SOFT_RESET, 0);
	rt2x00_set_field16(&reg, MAC_CSR1_BBP_RESET, 0);
	rt2x00_set_field16(&reg, MAC_CSR1_HOST_READY, 1);
	rt2500usb_register_write(rt2x00dev, MAC_CSR1, reg);

	if (rt2x00_rev(rt2x00dev) >= RT2570_VERSION_C) {
		reg = rt2500usb_register_read(rt2x00dev, PHY_CSR2);
		rt2x00_set_field16(&reg, PHY_CSR2_LNA, 0);
	} else {
		reg = 0;
		rt2x00_set_field16(&reg, PHY_CSR2_LNA, 1);
		rt2x00_set_field16(&reg, PHY_CSR2_LNA_MODE, 3);
	}
	rt2500usb_register_write(rt2x00dev, PHY_CSR2, reg);

	rt2500usb_register_write(rt2x00dev, MAC_CSR11, 0x0002);
	rt2500usb_register_write(rt2x00dev, MAC_CSR22, 0x0053);
	rt2500usb_register_write(rt2x00dev, MAC_CSR15, 0x01ee);
	rt2500usb_register_write(rt2x00dev, MAC_CSR16, 0x0000);

	reg = rt2500usb_register_read(rt2x00dev, MAC_CSR8);
	rt2x00_set_field16(&reg, MAC_CSR8_MAX_FRAME_UNIT,
			   rt2x00dev->rx->data_size);
	rt2500usb_register_write(rt2x00dev, MAC_CSR8, reg);

	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR0);
	rt2x00_set_field16(&reg, TXRX_CSR0_ALGORITHM, CIPHER_NONE);
	rt2x00_set_field16(&reg, TXRX_CSR0_IV_OFFSET, IEEE80211_HEADER);
	rt2x00_set_field16(&reg, TXRX_CSR0_KEY_ID, 0);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR0, reg);

	reg = rt2500usb_register_read(rt2x00dev, MAC_CSR18);
	rt2x00_set_field16(&reg, MAC_CSR18_DELAY_AFTER_BEACON, 90);
	rt2500usb_register_write(rt2x00dev, MAC_CSR18, reg);

	reg = rt2500usb_register_read(rt2x00dev, PHY_CSR4);
	rt2x00_set_field16(&reg, PHY_CSR4_LOW_RF_LE, 1);
	rt2500usb_register_write(rt2x00dev, PHY_CSR4, reg);

	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR1);
	rt2x00_set_field16(&reg, TXRX_CSR1_AUTO_SEQUENCE, 1);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR1, reg);

	return 0;
}

static int rt2500usb_wait_bbp_ready(struct rt2x00_dev *rt2x00dev)
{
	unsigned int i;
	u8 value;

	for (i = 0; i < REGISTER_USB_BUSY_COUNT; i++) {
		value = rt2500usb_bbp_read(rt2x00dev, 0);
		if ((value != 0xff) && (value != 0x00))
			return 0;
		udelay(REGISTER_BUSY_DELAY);
	}

	rt2x00_err(rt2x00dev, "BBP register access failed, aborting\n");
	return -EACCES;
}

static int rt2500usb_init_bbp(struct rt2x00_dev *rt2x00dev)
{
	unsigned int i;
	u16 eeprom;
	u8 value;
	u8 reg_id;

	if (unlikely(rt2500usb_wait_bbp_ready(rt2x00dev)))
		return -EACCES;

	rt2500usb_bbp_write(rt2x00dev, 3, 0x02);
	rt2500usb_bbp_write(rt2x00dev, 4, 0x19);
	rt2500usb_bbp_write(rt2x00dev, 14, 0x1c);
	rt2500usb_bbp_write(rt2x00dev, 15, 0x30);
	rt2500usb_bbp_write(rt2x00dev, 16, 0xac);
	rt2500usb_bbp_write(rt2x00dev, 18, 0x18);
	rt2500usb_bbp_write(rt2x00dev, 19, 0xff);
	rt2500usb_bbp_write(rt2x00dev, 20, 0x1e);
	rt2500usb_bbp_write(rt2x00dev, 21, 0x08);
	rt2500usb_bbp_write(rt2x00dev, 22, 0x08);
	rt2500usb_bbp_write(rt2x00dev, 23, 0x08);
	rt2500usb_bbp_write(rt2x00dev, 24, 0x80);
	rt2500usb_bbp_write(rt2x00dev, 25, 0x50);
	rt2500usb_bbp_write(rt2x00dev, 26, 0x08);
	rt2500usb_bbp_write(rt2x00dev, 27, 0x23);
	rt2500usb_bbp_write(rt2x00dev, 30, 0x10);
	rt2500usb_bbp_write(rt2x00dev, 31, 0x2b);
	rt2500usb_bbp_write(rt2x00dev, 32, 0xb9);
	rt2500usb_bbp_write(rt2x00dev, 34, 0x12);
	rt2500usb_bbp_write(rt2x00dev, 35, 0x50);
	rt2500usb_bbp_write(rt2x00dev, 39, 0xc4);
	rt2500usb_bbp_write(rt2x00dev, 40, 0x02);
	rt2500usb_bbp_write(rt2x00dev, 41, 0x60);
	rt2500usb_bbp_write(rt2x00dev, 53, 0x10);
	rt2500usb_bbp_write(rt2x00dev, 54, 0x18);
	rt2500usb_bbp_write(rt2x00dev, 56, 0x08);
	rt2500usb_bbp_write(rt2x00dev, 57, 0x10);
	rt2500usb_bbp_write(rt2x00dev, 58, 0x08);
	rt2500usb_bbp_write(rt2x00dev, 61, 0x60);
	rt2500usb_bbp_write(rt2x00dev, 62, 0x10);
	rt2500usb_bbp_write(rt2x00dev, 75, 0xff);

	for (i = 0; i < EEPROM_BBP_SIZE; i++) {
		eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBP_START + i);

		if (eeprom != 0xffff && eeprom != 0x0000) {
			reg_id = rt2x00_get_field16(eeprom, EEPROM_BBP_REG_ID);
			value = rt2x00_get_field16(eeprom, EEPROM_BBP_VALUE);
			rt2500usb_bbp_write(rt2x00dev, reg_id, value);
		}
	}

	return 0;
}

/*
 * Device state switch handlers.
 */
static int rt2500usb_enable_radio(struct rt2x00_dev *rt2x00dev)
{
	/*
	 * Initialize all registers.
	 */
	if (unlikely(rt2500usb_init_registers(rt2x00dev) ||
		     rt2500usb_init_bbp(rt2x00dev)))
		return -EIO;

	return 0;
}

static void rt2500usb_disable_radio(struct rt2x00_dev *rt2x00dev)
{
	rt2500usb_register_write(rt2x00dev, MAC_CSR13, 0x2121);
	rt2500usb_register_write(rt2x00dev, MAC_CSR14, 0x2121);

	/*
	 * Disable synchronisation.
	 */
	rt2500usb_register_write(rt2x00dev, TXRX_CSR19, 0);

	rt2x00usb_disable_radio(rt2x00dev);
}

static int rt2500usb_set_state(struct rt2x00_dev *rt2x00dev,
			       enum dev_state state)
{
	u16 reg;
	u16 reg2;
	unsigned int i;
	bool put_to_sleep;
	u8 bbp_state;
	u8 rf_state;

	put_to_sleep = (state != STATE_AWAKE);

	reg = 0;
	rt2x00_set_field16(&reg, MAC_CSR17_BBP_DESIRE_STATE, state);
	rt2x00_set_field16(&reg, MAC_CSR17_RF_DESIRE_STATE, state);
	rt2x00_set_field16(&reg, MAC_CSR17_PUT_TO_SLEEP, put_to_sleep);
	rt2500usb_register_write(rt2x00dev, MAC_CSR17, reg);
	rt2x00_set_field16(&reg, MAC_CSR17_SET_STATE, 1);
	rt2500usb_register_write(rt2x00dev, MAC_CSR17, reg);

	/*
	 * Device is not guaranteed to be in the requested state yet.
	 * We must wait until the register indicates that the
	 * device has entered the correct state.
	 */
	for (i = 0; i < REGISTER_USB_BUSY_COUNT; i++) {
		reg2 = rt2500usb_register_read(rt2x00dev, MAC_CSR17);
		bbp_state = rt2x00_get_field16(reg2, MAC_CSR17_BBP_CURR_STATE);
		rf_state = rt2x00_get_field16(reg2, MAC_CSR17_RF_CURR_STATE);
		if (bbp_state == state && rf_state == state)
			return 0;
		rt2500usb_register_write(rt2x00dev, MAC_CSR17, reg);
		msleep(30);
	}

	return -EBUSY;
}

static int rt2500usb_set_device_state(struct rt2x00_dev *rt2x00dev,
				      enum dev_state state)
{
	int retval = 0;

	switch (state) {
	case STATE_RADIO_ON:
		retval = rt2500usb_enable_radio(rt2x00dev);
		break;
	case STATE_RADIO_OFF:
		rt2500usb_disable_radio(rt2x00dev);
		break;
	case STATE_RADIO_IRQ_ON:
	case STATE_RADIO_IRQ_OFF:
		/* No support, but no error either */
		break;
	case STATE_DEEP_SLEEP:
	case STATE_SLEEP:
	case STATE_STANDBY:
	case STATE_AWAKE:
		retval = rt2500usb_set_state(rt2x00dev, state);
		break;
	default:
		retval = -ENOTSUPP;
		break;
	}

	if (unlikely(retval))
		rt2x00_err(rt2x00dev, "Device failed to enter state %d (%d)\n",
			   state, retval);

	return retval;
}

/*
 * TX descriptor initialization
 */
static void rt2500usb_write_tx_desc(struct queue_entry *entry,
				    struct txentry_desc *txdesc)
{
	struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
	__le32 *txd = (__le32 *) entry->skb->data;
	u32 word;

	/*
	 * Start writing the descriptor words.
	 */
	word = rt2x00_desc_read(txd, 0);
	rt2x00_set_field32(&word, TXD_W0_RETRY_LIMIT, txdesc->retry_limit);
	rt2x00_set_field32(&word, TXD_W0_MORE_FRAG,
			   test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
	rt2x00_set_field32(&word, TXD_W0_ACK,
			   test_bit(ENTRY_TXD_ACK, &txdesc->flags));
	rt2x00_set_field32(&word, TXD_W0_TIMESTAMP,
			   test_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags));
	rt2x00_set_field32(&word, TXD_W0_OFDM,
			   (txdesc->rate_mode == RATE_MODE_OFDM));
	rt2x00_set_field32(&word, TXD_W0_NEW_SEQ,
			   test_bit(ENTRY_TXD_FIRST_FRAGMENT, &txdesc->flags));
	rt2x00_set_field32(&word, TXD_W0_IFS, txdesc->u.plcp.ifs);
	rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, txdesc->length);
	rt2x00_set_field32(&word, TXD_W0_CIPHER, !!txdesc->cipher);
	rt2x00_set_field32(&word, TXD_W0_KEY_ID, txdesc->key_idx);
	rt2x00_desc_write(txd, 0, word);

	word = rt2x00_desc_read(txd, 1);
	rt2x00_set_field32(&word, TXD_W1_IV_OFFSET, txdesc->iv_offset);
	rt2x00_set_field32(&word, TXD_W1_AIFS, entry->queue->aifs);
	rt2x00_set_field32(&word, TXD_W1_CWMIN, entry->queue->cw_min);
	rt2x00_set_field32(&word, TXD_W1_CWMAX, entry->queue->cw_max);
	rt2x00_desc_write(txd, 1, word);

	word = rt2x00_desc_read(txd, 2);
	rt2x00_set_field32(&word, TXD_W2_PLCP_SIGNAL, txdesc->u.plcp.signal);
	rt2x00_set_field32(&word, TXD_W2_PLCP_SERVICE, txdesc->u.plcp.service);
	rt2x00_set_field32(&word, TXD_W2_PLCP_LENGTH_LOW,
			   txdesc->u.plcp.length_low);
	rt2x00_set_field32(&word, TXD_W2_PLCP_LENGTH_HIGH,
			   txdesc->u.plcp.length_high);
	rt2x00_desc_write(txd, 2, word);

	if (test_bit(ENTRY_TXD_ENCRYPT, &txdesc->flags)) {
		_rt2x00_desc_write(txd, 3, skbdesc->iv[0]);
		_rt2x00_desc_write(txd, 4, skbdesc->iv[1]);
	}

	/*
	 * Register descriptor details in skb frame descriptor.
	 */
	skbdesc->flags |= SKBDESC_DESC_IN_SKB;
	skbdesc->desc = txd;
	skbdesc->desc_len = TXD_DESC_SIZE;
}

/*
 * TX data initialization
 */
static void rt2500usb_beacondone(struct urb *urb);

static void rt2500usb_write_beacon(struct queue_entry *entry,
				   struct txentry_desc *txdesc)
{
	struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
	struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev);
	struct queue_entry_priv_usb_bcn *bcn_priv = entry->priv_data;
	int pipe = usb_sndbulkpipe(usb_dev, entry->queue->usb_endpoint);
	int length;
	u16 reg, reg0;

	/*
	 * Disable beaconing while we are reloading the beacon data,
	 * otherwise we might be sending out invalid data.
	 */
	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR19);
	rt2x00_set_field16(&reg, TXRX_CSR19_BEACON_GEN, 0);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);

	/*
	 * Add space for the descriptor in front of the skb.
	 */
	skb_push(entry->skb, TXD_DESC_SIZE);
	memset(entry->skb->data, 0, TXD_DESC_SIZE);

	/*
	 * Write the TX descriptor for the beacon.
	 */
	rt2500usb_write_tx_desc(entry, txdesc);

	/*
	 * Dump beacon to userspace through debugfs.
	 */
	rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_BEACON, entry);

	/*
	 * USB devices cannot blindly pass the skb->len as the
	 * length of the data to usb_fill_bulk_urb. Pass the skb
	 * to the driver to determine what the length should be.
	 */
	length = rt2x00dev->ops->lib->get_tx_data_len(entry);

	usb_fill_bulk_urb(bcn_priv->urb, usb_dev, pipe,
			  entry->skb->data, length, rt2500usb_beacondone,
			  entry);

	/*
	 * Second we need to create the guardian byte.
	 * We only need a single byte, so lets recycle
	 * the 'flags' field we are not using for beacons.
	 */
	bcn_priv->guardian_data = 0;
	usb_fill_bulk_urb(bcn_priv->guardian_urb, usb_dev, pipe,
			  &bcn_priv->guardian_data, 1, rt2500usb_beacondone,
			  entry);

	/*
	 * Send out the guardian byte.
	 */
	usb_submit_urb(bcn_priv->guardian_urb, GFP_ATOMIC);

	/*
	 * Enable beaconing again.
	 */
	rt2x00_set_field16(&reg, TXRX_CSR19_TSF_COUNT, 1);
	rt2x00_set_field16(&reg, TXRX_CSR19_TBCN, 1);
	reg0 = reg;
	rt2x00_set_field16(&reg, TXRX_CSR19_BEACON_GEN, 1);
	/*
	 * Beacon generation will fail initially.
	 * To prevent this we need to change the TXRX_CSR19
	 * register several times (reg0 is the same as reg
	 * except for TXRX_CSR19_BEACON_GEN, which is 0 in reg0
	 * and 1 in reg).
	 */
	rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg0);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg0);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
}

static int rt2500usb_get_tx_data_len(struct queue_entry *entry)
{
	int length;

	/*
	 * The length _must_ be a multiple of 2,
	 * but it must _not_ be a multiple of the USB packet size.
	 */
	length = roundup(entry->skb->len, 2);
	length += (2 * !(length % entry->queue->usb_maxpacket));

	return length;
}

/*
 * RX control handlers
 */
static void rt2500usb_fill_rxdone(struct queue_entry *entry,
				  struct rxdone_entry_desc *rxdesc)
{
	struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
	struct queue_entry_priv_usb *entry_priv = entry->priv_data;
	struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
	__le32 *rxd =
	    (__le32 *)(entry->skb->data +
		       (entry_priv->urb->actual_length -
			entry->queue->desc_size));
	u32 word0;
	u32 word1;

	/*
	 * Copy descriptor to the skbdesc->desc buffer, making it safe from moving of
	 * frame data in rt2x00usb.
	 */
	memcpy(skbdesc->desc, rxd, skbdesc->desc_len);
	rxd = (__le32 *)skbdesc->desc;

	/*
	 * It is now safe to read the descriptor on all architectures.
	 */
	word0 = rt2x00_desc_read(rxd, 0);
	word1 = rt2x00_desc_read(rxd, 1);

	if (rt2x00_get_field32(word0, RXD_W0_CRC_ERROR))
		rxdesc->flags |= RX_FLAG_FAILED_FCS_CRC;
	if (rt2x00_get_field32(word0, RXD_W0_PHYSICAL_ERROR))
		rxdesc->flags |= RX_FLAG_FAILED_PLCP_CRC;

	rxdesc->cipher = rt2x00_get_field32(word0, RXD_W0_CIPHER);
	if (rt2x00_get_field32(word0, RXD_W0_CIPHER_ERROR))
		rxdesc->cipher_status = RX_CRYPTO_FAIL_KEY;

	if (rxdesc->cipher != CIPHER_NONE) {
		rxdesc->iv[0] = _rt2x00_desc_read(rxd, 2);
		rxdesc->iv[1] = _rt2x00_desc_read(rxd, 3);
		rxdesc->dev_flags |= RXDONE_CRYPTO_IV;

		/* ICV is located at the end of frame */

		rxdesc->flags |= RX_FLAG_MMIC_STRIPPED;
		if (rxdesc->cipher_status == RX_CRYPTO_SUCCESS)
			rxdesc->flags |= RX_FLAG_DECRYPTED;
		else if (rxdesc->cipher_status == RX_CRYPTO_FAIL_MIC)
			rxdesc->flags |= RX_FLAG_MMIC_ERROR;
	}

	/*
	 * Obtain the status about this packet.
	 * When frame was received with an OFDM bitrate,
	 * the signal is the PLCP value. If it was received with
	 * a CCK bitrate the signal is the rate in 100kbit/s.
	 */
	rxdesc->signal = rt2x00_get_field32(word1, RXD_W1_SIGNAL);
	rxdesc->rssi =
	    rt2x00_get_field32(word1, RXD_W1_RSSI) - rt2x00dev->rssi_offset;
	rxdesc->size = rt2x00_get_field32(word0, RXD_W0_DATABYTE_COUNT);

	if (rt2x00_get_field32(word0, RXD_W0_OFDM))
		rxdesc->dev_flags |= RXDONE_SIGNAL_PLCP;
	else
		rxdesc->dev_flags |= RXDONE_SIGNAL_BITRATE;
	if (rt2x00_get_field32(word0, RXD_W0_MY_BSS))
		rxdesc->dev_flags |= RXDONE_MY_BSS;

	/*
	 * Adjust the skb memory window to the frame boundaries.
	 */
	skb_trim(entry->skb, rxdesc->size);
}

/*
 * Interrupt functions.
 */
static void rt2500usb_beacondone(struct urb *urb)
{
	struct queue_entry *entry = (struct queue_entry *)urb->context;
	struct queue_entry_priv_usb_bcn *bcn_priv = entry->priv_data;

	if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &entry->queue->rt2x00dev->flags))
		return;

	/*
	 * Check if this was the guardian beacon,
	 * if that was the case we need to send the real beacon now.
	 * Otherwise we should free the sk_buffer, the device
	 * should be doing the rest of the work now.
	 */
	if (bcn_priv->guardian_urb == urb) {
		usb_submit_urb(bcn_priv->urb, GFP_ATOMIC);
	} else if (bcn_priv->urb == urb) {
		dev_kfree_skb(entry->skb);
		entry->skb = NULL;
	}
}

/*
 * Device probe functions.
 */
static int rt2500usb_validate_eeprom(struct rt2x00_dev *rt2x00dev)
{
	u16 word;
	u8 *mac;
	u8 bbp;

	rt2x00usb_eeprom_read(rt2x00dev, rt2x00dev->eeprom, EEPROM_SIZE);

	/*
	 * Start validation of the data that has been read.
	 */
	mac = rt2x00_eeprom_addr(rt2x00dev, EEPROM_MAC_ADDR_0);
	rt2x00lib_set_mac_address(rt2x00dev, mac);

	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA);
	if (word == 0xffff) {
		rt2x00_set_field16(&word, EEPROM_ANTENNA_NUM, 2);
		rt2x00_set_field16(&word, EEPROM_ANTENNA_TX_DEFAULT,
				   ANTENNA_SW_DIVERSITY);
		rt2x00_set_field16(&word, EEPROM_ANTENNA_RX_DEFAULT,
				   ANTENNA_SW_DIVERSITY);
		rt2x00_set_field16(&word, EEPROM_ANTENNA_LED_MODE,
				   LED_MODE_DEFAULT);
		rt2x00_set_field16(&word, EEPROM_ANTENNA_DYN_TXAGC, 0);
		rt2x00_set_field16(&word, EEPROM_ANTENNA_HARDWARE_RADIO, 0);
		rt2x00_set_field16(&word, EEPROM_ANTENNA_RF_TYPE, RF2522);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_ANTENNA, word);
		rt2x00_eeprom_dbg(rt2x00dev, "Antenna: 0x%04x\n", word);
	}

	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC);
	if (word == 0xffff) {
		rt2x00_set_field16(&word, EEPROM_NIC_CARDBUS_ACCEL, 0);
		rt2x00_set_field16(&word, EEPROM_NIC_DYN_BBP_TUNE, 0);
		rt2x00_set_field16(&word, EEPROM_NIC_CCK_TX_POWER, 0);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_NIC, word);
		rt2x00_eeprom_dbg(rt2x00dev, "NIC: 0x%04x\n", word);
	}

	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_CALIBRATE_OFFSET);
	if (word == 0xffff) {
		rt2x00_set_field16(&word, EEPROM_CALIBRATE_OFFSET_RSSI,
				   DEFAULT_RSSI_OFFSET);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_CALIBRATE_OFFSET, word);
		rt2x00_eeprom_dbg(rt2x00dev, "Calibrate offset: 0x%04x\n",
				  word);
	}

	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE);
	if (word == 0xffff) {
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_THRESHOLD, 45);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE, word);
		rt2x00_eeprom_dbg(rt2x00dev, "BBPtune: 0x%04x\n", word);
	}

	/*
	 * Switch lower vgc bound to current BBP R17 value,
	 * lower the value a bit for better quality.
	 */
	bbp = rt2500usb_bbp_read(rt2x00dev, 17);
	bbp -= 6;

	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_VGC);
	if (word == 0xffff) {
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_VGCUPPER, 0x40);
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_VGCLOWER, bbp);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_VGC, word);
		rt2x00_eeprom_dbg(rt2x00dev, "BBPtune vgc: 0x%04x\n", word);
	} else {
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_VGCLOWER, bbp);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_VGC, word);
	}

	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R17);
	if (word == 0xffff) {
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_R17_LOW, 0x48);
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_R17_HIGH, 0x41);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_R17, word);
		rt2x00_eeprom_dbg(rt2x00dev, "BBPtune r17: 0x%04x\n", word);
	}

	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R24);
	if (word == 0xffff) {
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_R24_LOW, 0x40);
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_R24_HIGH, 0x80);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_R24, word);
		rt2x00_eeprom_dbg(rt2x00dev, "BBPtune r24: 0x%04x\n", word);
	}

	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R25);
	if (word == 0xffff) {
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_R25_LOW, 0x40);
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_R25_HIGH, 0x50);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_R25, word);
		rt2x00_eeprom_dbg(rt2x00dev, "BBPtune r25: 0x%04x\n", word);
	}

	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R61);
	if (word == 0xffff) {
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_R61_LOW, 0x60);
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_R61_HIGH, 0x6d);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_R61, word);
		rt2x00_eeprom_dbg(rt2x00dev, "BBPtune r61: 0x%04x\n", word);
	}

	return 0;
}

static int rt2500usb_init_eeprom(struct rt2x00_dev *rt2x00dev)
{
	u16 reg;
	u16 value;
	u16 eeprom;

	/*
	 * Read EEPROM word for configuration.
	 */
	eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA);

	/*
	 * Identify RF chipset.
	 */
	value = rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RF_TYPE);
	reg = rt2500usb_register_read(rt2x00dev, MAC_CSR0);
	rt2x00_set_chip(rt2x00dev, RT2570, value, reg);

	if (((reg & 0xfff0) != 0) || ((reg & 0x0000000f) == 0)) {
		rt2x00_err(rt2x00dev, "Invalid RT chipset detected\n");
		return -ENODEV;
	}

	if (!rt2x00_rf(rt2x00dev, RF2522) &&
	    !rt2x00_rf(rt2x00dev, RF2523) &&
	    !rt2x00_rf(rt2x00dev, RF2524) &&
	    !rt2x00_rf(rt2x00dev, RF2525) &&
	    !rt2x00_rf(rt2x00dev, RF2525E) &&
	    !rt2x00_rf(rt2x00dev, RF5222)) {
		rt2x00_err(rt2x00dev, "Invalid RF chipset detected\n");
		return -ENODEV;
	}

	/*
	 * Identify default antenna configuration.
	 */
	rt2x00dev->default_ant.tx =
	    rt2x00_get_field16(eeprom, EEPROM_ANTENNA_TX_DEFAULT);
	rt2x00dev->default_ant.rx =
	    rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RX_DEFAULT);

	/*
	 * When the eeprom indicates SW_DIVERSITY use HW_DIVERSITY instead.
	 * I am not 100% sure about this, but the legacy drivers do not
	 * indicate antenna swapping in software is required when
	 * diversity is enabled.
	 */
	if (rt2x00dev->default_ant.tx == ANTENNA_SW_DIVERSITY)
		rt2x00dev->default_ant.tx = ANTENNA_HW_DIVERSITY;
	if (rt2x00dev->default_ant.rx == ANTENNA_SW_DIVERSITY)
		rt2x00dev->default_ant.rx = ANTENNA_HW_DIVERSITY;

	/*
	 * Store led mode, for correct led behaviour.
	 */
#ifdef CONFIG_RT2X00_LIB_LEDS
	value = rt2x00_get_field16(eeprom, EEPROM_ANTENNA_LED_MODE);

	rt2500usb_init_led(rt2x00dev, &rt2x00dev->led_radio, LED_TYPE_RADIO);
	if (value == LED_MODE_TXRX_ACTIVITY ||
	    value == LED_MODE_DEFAULT ||
	    value == LED_MODE_ASUS)
		rt2500usb_init_led(rt2x00dev, &rt2x00dev->led_qual,
				   LED_TYPE_ACTIVITY);
#endif /* CONFIG_RT2X00_LIB_LEDS */

	/*
	 * Detect if this device has an hardware controlled radio.
	 */
	if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO))
		__set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags);

	/*
	 * Read the RSSI <-> dBm offset information.
	 */
	eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_CALIBRATE_OFFSET);
	rt2x00dev->rssi_offset =
	    rt2x00_get_field16(eeprom, EEPROM_CALIBRATE_OFFSET_RSSI);

	return 0;
}

/*
 * RF value list for RF2522
 * Supports: 2.4 GHz
 */
static const struct rf_channel rf_vals_bg_2522[] = {
	{ 1,  0x00002050, 0x000c1fda, 0x00000101, 0 },
	{ 2,  0x00002050, 0x000c1fee, 0x00000101, 0 },
	{ 3,  0x00002050, 0x000c2002, 0x00000101, 0 },
	{ 4,  0x00002050, 0x000c2016, 0x00000101, 0 },
	{ 5,  0x00002050, 0x000c202a, 0x00000101, 0 },
	{ 6,  0x00002050, 0x000c203e, 0x00000101, 0 },
	{ 7,  0x00002050, 0x000c2052, 0x00000101, 0 },
	{ 8,  0x00002050, 0x000c2066, 0x00000101, 0 },
	{ 9,  0x00002050, 0x000c207a, 0x00000101, 0 },
	{ 10, 0x00002050, 0x000c208e, 0x00000101, 0 },
	{ 11, 0x00002050, 0x000c20a2, 0x00000101, 0 },
	{ 12, 0x00002050, 0x000c20b6, 0x00000101, 0 },
	{ 13, 0x00002050, 0x000c20ca, 0x00000101, 0 },
	{ 14, 0x00002050, 0x000c20fa, 0x00000101, 0 },
};

/*
 * RF value list for RF2523
 * Supports: 2.4 GHz
 */
static const struct rf_channel rf_vals_bg_2523[] = {
	{ 1,  0x00022010, 0x00000c9e, 0x000e0111, 0x00000a1b },
	{ 2,  0x00022010, 0x00000ca2, 0x000e0111, 0x00000a1b },
	{ 3,  0x00022010, 0x00000ca6, 0x000e0111, 0x00000a1b },
	{ 4,  0x00022010, 0x00000caa, 0x000e0111, 0x00000a1b },
	{ 5,  0x00022010, 0x00000cae, 0x000e0111, 0x00000a1b },
	{ 6,  0x00022010, 0x00000cb2, 0x000e0111, 0x00000a1b },
	{ 7,  0x00022010, 0x00000cb6, 0x000e0111, 0x00000a1b },
	{ 8,  0x00022010, 0x00000cba, 0x000e0111, 0x00000a1b },
	{ 9,  0x00022010, 0x00000cbe, 0x000e0111, 0x00000a1b },
	{ 10, 0x00022010, 0x00000d02, 0x000e0111, 0x00000a1b },
	{ 11, 0x00022010, 0x00000d06, 0x000e0111, 0x00000a1b },
	{ 12, 0x00022010, 0x00000d0a, 0x000e0111, 0x00000a1b },
	{ 13, 0x00022010, 0x00000d0e, 0x000e0111, 0x00000a1b },
	{ 14, 0x00022010, 0x00000d1a, 0x000e0111, 0x00000a03 },
};

/*
 * RF value list for RF2524
 * Supports: 2.4 GHz
 */
static const struct rf_channel rf_vals_bg_2524[] = {
	{ 1,  0x00032020, 0x00000c9e, 0x00000101, 0x00000a1b },
	{ 2,  0x00032020, 0x00000ca2, 0x00000101, 0x00000a1b },
	{ 3,  0x00032020, 0x00000ca6, 0x00000101, 0x00000a1b },
	{ 4,  0x00032020, 0x00000caa, 0x00000101, 0x00000a1b },
	{ 5,  0x00032020, 0x00000cae, 0x00000101, 0x00000a1b },
	{ 6,  0x00032020, 0x00000cb2, 0x00000101, 0x00000a1b },
	{ 7,  0x00032020, 0x00000cb6, 0x00000101, 0x00000a1b },
	{ 8,  0x00032020, 0x00000cba, 0x00000101, 0x00000a1b },
	{ 9,  0x00032020, 0x00000cbe, 0x00000101, 0x00000a1b },
	{ 10, 0x00032020, 0x00000d02, 0x00000101, 0x00000a1b },
	{ 11, 0x00032020, 0x00000d06, 0x00000101, 0x00000a1b },
	{ 12, 0x00032020, 0x00000d0a, 0x00000101, 0x00000a1b },
	{ 13, 0x00032020, 0x00000d0e, 0x00000101, 0x00000a1b },
	{ 14, 0x00032020, 0x00000d1a, 0x00000101, 0x00000a03 },
};

/*
 * RF value list for RF2525
 * Supports: 2.4 GHz
 */
static const struct rf_channel rf_vals_bg_2525[] = {
	{ 1,  0x00022020, 0x00080c9e, 0x00060111, 0x00000a1b },
	{ 2,  0x00022020, 0x00080ca2, 0x00060111, 0x00000a1b },
	{ 3,  0x00022020, 0x00080ca6, 0x00060111, 0x00000a1b },
	{ 4,  0x00022020, 0x00080caa, 0x00060111, 0x00000a1b },
	{ 5,  0x00022020, 0x00080cae, 0x00060111, 0x00000a1b },
	{ 6,  0x00022020, 0x00080cb2, 0x00060111, 0x00000a1b },
	{ 7,  0x00022020, 0x00080cb6, 0x00060111, 0x00000a1b },
	{ 8,  0x00022020, 0x00080cba, 0x00060111, 0x00000a1b },
	{ 9,  0x00022020, 0x00080cbe, 0x00060111, 0x00000a1b },
	{ 10, 0x00022020, 0x00080d02, 0x00060111, 0x00000a1b },
	{ 11, 0x00022020, 0x00080d06, 0x00060111, 0x00000a1b },
	{ 12, 0x00022020, 0x00080d0a, 0x00060111, 0x00000a1b },
	{ 13, 0x00022020, 0x00080d0e, 0x00060111, 0x00000a1b },
	{ 14, 0x00022020, 0x00080d1a, 0x00060111, 0x00000a03 },
};

/*
 * RF value list for RF2525e
 * Supports: 2.4 GHz
 */
static const struct rf_channel rf_vals_bg_2525e[] = {
	{ 1,  0x00022010, 0x0000089a, 0x00060111, 0x00000e1b },
	{ 2,  0x00022010, 0x0000089e, 0x00060111, 0x00000e07 },
	{ 3,  0x00022010, 0x0000089e, 0x00060111, 0x00000e1b },
	{ 4,  0x00022010, 0x000008a2, 0x00060111, 0x00000e07 },
	{ 5,  0x00022010, 0x000008a2, 0x00060111, 0x00000e1b },
	{ 6,  0x00022010, 0x000008a6, 0x00060111, 0x00000e07 },
	{ 7,  0x00022010, 0x000008a6, 0x00060111, 0x00000e1b },
	{ 8,  0x00022010, 0x000008aa, 0x00060111, 0x00000e07 },
	{ 9,  0x00022010, 0x000008aa, 0x00060111, 0x00000e1b },
	{ 10, 0x00022010, 0x000008ae, 0x00060111, 0x00000e07 },
	{ 11, 0x00022010, 0x000008ae, 0x00060111, 0x00000e1b },
	{ 12, 0x00022010, 0x000008b2, 0x00060111, 0x00000e07 },
	{ 13, 0x00022010, 0x000008b2, 0x00060111, 0x00000e1b },
	{ 14, 0x00022010, 0x000008b6, 0x00060111, 0x00000e23 },
};

/*
 * RF value list for RF5222
 * Supports: 2.4 GHz & 5.2 GHz
 */
static const struct rf_channel rf_vals_5222[] = {
	{ 1,  0x00022020, 0x00001136, 0x00000101, 0x00000a0b },
	{ 2,  0x00022020, 0x0000113a, 0x00000101, 0x00000a0b },
	{ 3,  0x00022020, 0x0000113e, 0x00000101, 0x00000a0b },
	{ 4,  0x00022020, 0x00001182, 0x00000101, 0x00000a0b },
	{ 5,  0x00022020, 0x00001186, 0x00000101, 0x00000a0b },
	{ 6,  0x00022020, 0x0000118a, 0x00000101, 0x00000a0b },
	{ 7,  0x00022020, 0x0000118e, 0x00000101, 0x00000a0b },
	{ 8,  0x00022020, 0x00001192, 0x00000101, 0x00000a0b },
	{ 9,  0x00022020, 0x00001196, 0x00000101, 0x00000a0b },
	{ 10, 0x00022020, 0x0000119a, 0x00000101, 0x00000a0b },
	{ 11, 0x00022020, 0x0000119e, 0x00000101, 0x00000a0b },
	{ 12, 0x00022020, 0x000011a2, 0x00000101, 0x00000a0b },
	{ 13, 0x00022020, 0x000011a6, 0x00000101, 0x00000a0b },
	{ 14, 0x00022020, 0x000011ae, 0x00000101, 0x00000a1b },

	/* 802.11 UNI / HyperLan 2 */
	{ 36, 0x00022010, 0x00018896, 0x00000101, 0x00000a1f },
	{ 40, 0x00022010, 0x0001889a, 0x00000101, 0x00000a1f },
	{ 44, 0x00022010, 0x0001889e, 0x00000101, 0x00000a1f },
	{ 48, 0x00022010, 0x000188a2, 0x00000101, 0x00000a1f },
	{ 52, 0x00022010, 0x000188a6, 0x00000101, 0x00000a1f },
	{ 66, 0x00022010, 0x000188aa, 0x00000101, 0x00000a1f },
	{ 60, 0x00022010, 0x000188ae, 0x00000101, 0x00000a1f },
	{ 64, 0x00022010, 0x000188b2, 0x00000101, 0x00000a1f },

	/* 802.11 HyperLan 2 */
	{ 100, 0x00022010, 0x00008802, 0x00000101, 0x00000a0f },
	{ 104, 0x00022010, 0x00008806, 0x00000101, 0x00000a0f },
	{ 108, 0x00022010, 0x0000880a, 0x00000101, 0x00000a0f },
	{ 112, 0x00022010, 0x0000880e, 0x00000101, 0x00000a0f },
	{ 116, 0x00022010, 0x00008812, 0x00000101, 0x00000a0f },
	{ 120, 0x00022010, 0x00008816, 0x00000101, 0x00000a0f },
	{ 124, 0x00022010, 0x0000881a, 0x00000101, 0x00000a0f },
	{ 128, 0x00022010, 0x0000881e, 0x00000101, 0x00000a0f },
	{ 132, 0x00022010, 0x00008822, 0x00000101, 0x00000a0f },
	{ 136, 0x00022010, 0x00008826, 0x00000101, 0x00000a0f },

	/* 802.11 UNII */
	{ 140, 0x00022010, 0x0000882a, 0x00000101, 0x00000a0f },
	{ 149, 0x00022020, 0x000090a6, 0x00000101, 0x00000a07 },
	{ 153, 0x00022020, 0x000090ae, 0x00000101, 0x00000a07 },
	{ 157, 0x00022020, 0x000090b6, 0x00000101, 0x00000a07 },
	{ 161, 0x00022020, 0x000090be, 0x00000101, 0x00000a07 },
};

static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
{
	struct hw_mode_spec *spec = &rt2x00dev->spec;
	struct channel_info *info;
	u8 *tx_power;
	unsigned int i;

	/*
	 * Initialize all hw fields.
	 *
	 * Don't set IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING unless we are
	 * capable of sending the buffered frames out after the DTIM
	 * transmission using rt2x00lib_beacondone. This will send out
	 * multicast and broadcast traffic immediately instead of buffering it
	 * infinitly and thus dropping it after some time.
	 */
	ieee80211_hw_set(rt2x00dev->hw, PS_NULLFUNC_STACK);
	ieee80211_hw_set(rt2x00dev->hw, SUPPORTS_PS);
	ieee80211_hw_set(rt2x00dev->hw, RX_INCLUDES_FCS);
	ieee80211_hw_set(rt2x00dev->hw, SIGNAL_DBM);

	/*
	 * Disable powersaving as default.
	 */
	rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;

	SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
	SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
				rt2x00_eeprom_addr(rt2x00dev,
						   EEPROM_MAC_ADDR_0));

	/*
	 * Initialize hw_mode information.
	 */
	spec->supported_bands = SUPPORT_BAND_2GHZ;
	spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;

	if (rt2x00_rf(rt2x00dev, RF2522)) {
		spec->num_channels = ARRAY_SIZE(rf_vals_bg_2522);
		spec->channels = rf_vals_bg_2522;
	} else if (rt2x00_rf(rt2x00dev, RF2523)) {
		spec->num_channels = ARRAY_SIZE(rf_vals_bg_2523);
		spec->channels = rf_vals_bg_2523;
	} else if (rt2x00_rf(rt2x00dev, RF2524)) {
		spec->num_channels = ARRAY_SIZE(rf_vals_bg_2524);
		spec->channels = rf_vals_bg_2524;
	} else if (rt2x00_rf(rt2x00dev, RF2525)) {
		spec->num_channels = ARRAY_SIZE(rf_vals_bg_2525);
		spec->channels = rf_vals_bg_2525;
	} else if (rt2x00_rf(rt2x00dev, RF2525E)) {
		spec->num_channels = ARRAY_SIZE(rf_vals_bg_2525e);
		spec->channels = rf_vals_bg_2525e;
	} else if (rt2x00_rf(rt2x00dev, RF5222)) {
		spec->supported_bands |= SUPPORT_BAND_5GHZ;
		spec->num_channels = ARRAY_SIZE(rf_vals_5222);
		spec->channels = rf_vals_5222;
	}

	/*
	 * Create channel information array
	 */
	info = kzalloc_objs(*info, spec->num_channels);
	if (!info)
		return -ENOMEM;

	spec->channels_info = info;

	tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_START);
	for (i = 0; i < 14; i++) {
		info[i].max_power = MAX_TXPOWER;
		info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
	}

	if (spec->num_channels > 14) {
		for (i = 14; i < spec->num_channels; i++) {
			info[i].max_power = MAX_TXPOWER;
			info[i].default_power1 = DEFAULT_TXPOWER;
		}
	}

	return 0;
}

static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev)
{
	int retval;
	u16 reg;

	/*
	 * Allocate eeprom data.
	 */
	retval = rt2500usb_validate_eeprom(rt2x00dev);
	if (retval)
		return retval;

	retval = rt2500usb_init_eeprom(rt2x00dev);
	if (retval)
		return retval;

	/*
	 * Enable rfkill polling by setting GPIO direction of the
	 * rfkill switch GPIO pin correctly.
	 */
	reg = rt2500usb_register_read(rt2x00dev, MAC_CSR19);
	rt2x00_set_field16(&reg, MAC_CSR19_DIR0, 0);
	rt2500usb_register_write(rt2x00dev, MAC_CSR19, reg);

	/*
	 * Initialize hw specifications.
	 */
	retval = rt2500usb_probe_hw_mode(rt2x00dev);
	if (retval)
		return retval;

	/*
	 * This device requires the atim queue
	 */
	__set_bit(REQUIRE_ATIM_QUEUE, &rt2x00dev->cap_flags);
	__set_bit(REQUIRE_BEACON_GUARD, &rt2x00dev->cap_flags);
	if (!modparam_nohwcrypt) {
		__set_bit(CAPABILITY_HW_CRYPTO, &rt2x00dev->cap_flags);
		__set_bit(REQUIRE_COPY_IV, &rt2x00dev->cap_flags);
	}
	__set_bit(REQUIRE_SW_SEQNO, &rt2x00dev->cap_flags);
	__set_bit(REQUIRE_PS_AUTOWAKE, &rt2x00dev->cap_flags);

	/*
	 * Set the rssi offset.
	 */
	rt2x00dev->rssi_offset = DEFAULT_RSSI_OFFSET;

	return 0;
}

static const struct ieee80211_ops rt2500usb_mac80211_ops = {
	.add_chanctx = ieee80211_emulate_add_chanctx,
	.remove_chanctx = ieee80211_emulate_remove_chanctx,
	.change_chanctx = ieee80211_emulate_change_chanctx,
	.switch_vif_chanctx = ieee80211_emulate_switch_vif_chanctx,
	.tx			= rt2x00mac_tx,
	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
	.start			= rt2x00mac_start,
	.stop			= rt2x00mac_stop,
	.add_interface		= rt2x00mac_add_interface,
	.remove_interface	= rt2x00mac_remove_interface,
	.config			= rt2x00mac_config,
	.configure_filter	= rt2x00mac_configure_filter,
	.set_tim		= rt2x00mac_set_tim,
	.set_key		= rt2x00mac_set_key,
	.sw_scan_start		= rt2x00mac_sw_scan_start,
	.sw_scan_complete	= rt2x00mac_sw_scan_complete,
	.get_stats		= rt2x00mac_get_stats,
	.bss_info_changed	= rt2x00mac_bss_info_changed,
	.conf_tx		= rt2x00mac_conf_tx,
	.rfkill_poll		= rt2x00mac_rfkill_poll,
	.flush			= rt2x00mac_flush,
	.set_antenna		= rt2x00mac_set_antenna,
	.get_antenna		= rt2x00mac_get_antenna,
	.get_ringparam		= rt2x00mac_get_ringparam,
	.tx_frames_pending	= rt2x00mac_tx_frames_pending,
};

static const struct rt2x00lib_ops rt2500usb_rt2x00_ops = {
	.probe_hw		= rt2500usb_probe_hw,
	.initialize		= rt2x00usb_initialize,
	.uninitialize		= rt2x00usb_uninitialize,
	.clear_entry		= rt2x00usb_clear_entry,
	.set_device_state	= rt2500usb_set_device_state,
	.rfkill_poll		= rt2500usb_rfkill_poll,
	.link_stats		= rt2500usb_link_stats,
	.reset_tuner		= rt2500usb_reset_tuner,
	.watchdog		= rt2x00usb_watchdog,
	.start_queue		= rt2500usb_start_queue,
	.kick_queue		= rt2x00usb_kick_queue,
	.stop_queue		= rt2500usb_stop_queue,
	.flush_queue		= rt2x00usb_flush_queue,
	.write_tx_desc		= rt2500usb_write_tx_desc,
	.write_beacon		= rt2500usb_write_beacon,
	.get_tx_data_len	= rt2500usb_get_tx_data_len,
	.fill_rxdone		= rt2500usb_fill_rxdone,
	.config_shared_key	= rt2500usb_config_key,
	.config_pairwise_key	= rt2500usb_config_key,
	.config_filter		= rt2500usb_config_filter,
	.config_intf		= rt2500usb_config_intf,
	.config_erp		= rt2500usb_config_erp,
	.config_ant		= rt2500usb_config_ant,
	.config			= rt2500usb_config,
};

static void rt2500usb_queue_init(struct data_queue *queue)
{
	switch (queue->qid) {
	case QID_RX:
		queue->limit = 32;
		queue->data_size = DATA_FRAME_SIZE;
		queue->desc_size = RXD_DESC_SIZE;
		queue->priv_size = sizeof(struct queue_entry_priv_usb);
		break;

	case QID_AC_VO:
	case QID_AC_VI:
	case QID_AC_BE:
	case QID_AC_BK:
		queue->limit = 32;
		queue->data_size = DATA_FRAME_SIZE;
		queue->desc_size = TXD_DESC_SIZE;
		queue->priv_size = sizeof(struct queue_entry_priv_usb);
		break;

	case QID_BEACON:
		queue->limit = 1;
		queue->data_size = MGMT_FRAME_SIZE;
		queue->desc_size = TXD_DESC_SIZE;
		queue->priv_size = sizeof(struct queue_entry_priv_usb_bcn);
		break;

	case QID_ATIM:
		queue->limit = 8;
		queue->data_size = DATA_FRAME_SIZE;
		queue->desc_size = TXD_DESC_SIZE;
		queue->priv_size = sizeof(struct queue_entry_priv_usb);
		break;

	default:
		BUG();
		break;
	}
}

static const struct rt2x00_ops rt2500usb_ops = {
	.name			= KBUILD_MODNAME,
	.max_ap_intf		= 1,
	.eeprom_size		= EEPROM_SIZE,
	.rf_size		= RF_SIZE,
	.tx_queues		= NUM_TX_QUEUES,
	.queue_init		= rt2500usb_queue_init,
	.lib			= &rt2500usb_rt2x00_ops,
	.hw			= &rt2500usb_mac80211_ops,
#ifdef CONFIG_RT2X00_LIB_DEBUGFS
	.debugfs		= &rt2500usb_rt2x00debug,
#endif /* CONFIG_RT2X00_LIB_DEBUGFS */
};

/*
 * rt2500usb module information.
 */
static const struct usb_device_id rt2500usb_device_table[] = {
	/* ASUS */
	{ USB_DEVICE(0x0b05, 0x1706) },
	{ USB_DEVICE(0x0b05, 0x1707) },
	/* Belkin */
	{ USB_DEVICE(0x050d, 0x7050) },	/* FCC ID: K7SF5D7050A ver. 2.x */
	{ USB_DEVICE(0x050d, 0x7051) },
	/* Cisco Systems */
	{ USB_DEVICE(0x13b1, 0x000d) },
	{ USB_DEVICE(0x13b1, 0x0011) },
	{ USB_DEVICE(0x13b1, 0x001a) },
	/* Conceptronic */
	{ USB_DEVICE(0x14b2, 0x3c02) },
	/* D-LINK */
	{ USB_DEVICE(0x2001, 0x3c00) },
	/* Gigabyte */
	{ USB_DEVICE(0x1044, 0x8001) },
	{ USB_DEVICE(0x1044, 0x8007) },
	/* Hercules */
	{ USB_DEVICE(0x06f8, 0xe000) },
	/* Melco */
	{ USB_DEVICE(0x0411, 0x005e) },
	{ USB_DEVICE(0x0411, 0x0066) },
	{ USB_DEVICE(0x0411, 0x0067) },
	{ USB_DEVICE(0x0411, 0x008b) },
	{ USB_DEVICE(0x0411, 0x0097) },
	/* MSI */
	{ USB_DEVICE(0x0db0, 0x6861) },
	{ USB_DEVICE(0x0db0, 0x6865) },
	{ USB_DEVICE(0x0db0, 0x6869) },
	/* Ralink */
	{ USB_DEVICE(0x148f, 0x1706) },
	{ USB_DEVICE(0x148f, 0x2570) },
	{ USB_DEVICE(0x148f, 0x9020) },
	/* Sagem */
	{ USB_DEVICE(0x079b, 0x004b) },
	/* Siemens */
	{ USB_DEVICE(0x0681, 0x3c06) },
	/* SMC */
	{ USB_DEVICE(0x0707, 0xee13) },
	/* Spairon */
	{ USB_DEVICE(0x114b, 0x0110) },
	/* SURECOM */
	{ USB_DEVICE(0x0769, 0x11f3) },
	/* Trust */
	{ USB_DEVICE(0x0eb0, 0x9020) },
	/* VTech */
	{ USB_DEVICE(0x0f88, 0x3012) },
	/* Zinwell */
	{ USB_DEVICE(0x5a57, 0x0260) },
	{ 0, }
};

MODULE_AUTHOR(DRV_PROJECT);
MODULE_VERSION(DRV_VERSION);
MODULE_DESCRIPTION("Ralink RT2500 USB Wireless LAN driver.");
MODULE_DEVICE_TABLE(usb, rt2500usb_device_table);
MODULE_LICENSE("GPL");

static int rt2500usb_probe(struct usb_interface *usb_intf,
			   const struct usb_device_id *id)
{
	return rt2x00usb_probe(usb_intf, &rt2500usb_ops);
}

static struct usb_driver rt2500usb_driver = {
	.name		= KBUILD_MODNAME,
	.id_table	= rt2500usb_device_table,
	.probe		= rt2500usb_probe,
	.disconnect	= rt2x00usb_disconnect,
	.suspend	= rt2x00usb_suspend,
	.resume		= rt2x00usb_resume,
	.reset_resume	= rt2x00usb_resume,
	.disable_hub_initiated_lpm = 1,
};

module_usb_driver(rt2500usb_driver);
]

gemini-3-flash-preview

							input: 36120
							output: 26
							thoughts: 354
						

**Analyzing a Potential Crash with `rt2500usb`**

Okay, I see the USB device ID, `{ USB_DEVICE(0x0db0, 0x6869) }`, associated with the `rt2500usb` driver in the device table. The user points out a reproducer exiting with status 67 and the "SYZFAIL: tun: can't open /dev/net/tun (errno 19: No such device)" error. That immediately grabs my attention. While the message clearly indicates the reproducer couldn't access `/dev/net/tun`, I need to determine *why*. The user specifically asks if there's a hidden kernel crash within the `strace` output or something else. I'll need to look closely, even though the full output isn't provided, to see if anything jumps out.

The mention of "+++ killed by SIGKILL +++" is a significant clue. SIGKILL often surfaces when Syzkaller's executor gets terminated because of a kernel panic, a kernel hang, or perhaps even a timeout during the test execution. My initial thought is that the reproducer's inability to open `/dev/net/tun` could be a symptom of a much deeper problem: a kernel crash that occurred *before* the reproducer even got to that point. It's also possible, though less likely given the "SIGKILL," that the environment setup is somehow preventing `/dev/net/tun` from being available.

Given the potential link, I'm going to shift my focus. I need to check for any known issues or recent commits specifically related to the `rt2500usb` driver that might trigger a crash. I'll start with a search for "rt2500usb" in the kernel bug reports, and I'll also scan the recent kernel commits for the relevant subsystems. This initial triage should quickly surface any known regressions or problems in the driver. I will also extend my search to include `rt2x00usb` as there may be common bugs in the shared USB-based wireless network code.

map[Name:rt2500usb_probe]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 36965
							output: 60
							thoughts: 111
						

**Analyzing the User's USB Device Information**

Okay, so the user is pointing out a specific USB device, mentioning `idVendor=0xdb0` and `idProduct=0x6869`. Hold on, they've mentioned `idVendor=0xdb0` but the code actually uses `0x0db0`. It's important to be meticulous, but I'm thinking, hang on, those values are the same; the leading zero is just for padding, it's hexadecimal. No issue there.

Now, I'm thinking I should probably dive into the code to check it. I'll need to examine `rt2x00usb_probe` in `drivers/net/wireless/ralink/rt2x00/rt2x00usb.c`. That's where the device probing and initialisation logic for USB devices with that chipset, or similar, would be located. I need to understand how the driver interacts with devices having those specific IDs, what the device's capabilities are, and how it's handled during initialisation. This should give me a better handle on the user's issue, whatever it might be.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c IncludeLines:true Name:rt2x00usb_probe]

map[SourceCode: 797:	int rt2x00usb_probe(struct usb_interface *usb_intf,
 798:			    const struct rt2x00_ops *ops)
 799:	{
 800:		struct usb_device *usb_dev = interface_to_usbdev(usb_intf);
 801:		struct ieee80211_hw *hw;
 802:		struct rt2x00_dev *rt2x00dev;
 803:		int retval;
 804:	
 805:		usb_reset_device(usb_dev);
 806:	
 807:		hw = ieee80211_alloc_hw(sizeof(struct rt2x00_dev), ops->hw);
 808:		if (!hw) {
 809:			rt2x00_probe_err("Failed to allocate hardware\n");
 810:			return -ENOMEM;
 811:		}
 812:	
 813:		usb_set_intfdata(usb_intf, hw);
 814:	
 815:		rt2x00dev = hw->priv;
 816:		rt2x00dev->dev = &usb_intf->dev;
 817:		rt2x00dev->ops = ops;
 818:		rt2x00dev->hw = hw;
 819:	
 820:		rt2x00_set_chip_intf(rt2x00dev, RT2X00_CHIP_INTF_USB);
 821:	
 822:		INIT_WORK(&rt2x00dev->rxdone_work, rt2x00usb_work_rxdone);
 823:		INIT_WORK(&rt2x00dev->txdone_work, rt2x00usb_work_txdone);
 824:	
 825:		retval = rt2x00usb_alloc_reg(rt2x00dev);
 826:		if (retval)
 827:			goto exit_free_device;
 828:	
 829:		rt2x00dev->anchor = devm_kmalloc(&usb_intf->dev,
 830:						sizeof(struct usb_anchor),
 831:						GFP_KERNEL);
 832:		if (!rt2x00dev->anchor) {
 833:			retval = -ENOMEM;
 834:			goto exit_free_reg;
 835:		}
 836:		init_usb_anchor(rt2x00dev->anchor);
 837:	
 838:		retval = rt2x00lib_probe_dev(rt2x00dev);
 839:		if (retval)
 840:			goto exit_free_anchor;
 841:	
 842:		return 0;
 843:	
 844:	exit_free_anchor:
 845:		usb_kill_anchored_urbs(rt2x00dev->anchor);
 846:	
 847:	exit_free_reg:
 848:		rt2x00usb_free_reg(rt2x00dev);
 849:	
 850:	exit_free_device:
 851:		ieee80211_free_hw(hw);
 852:		usb_set_intfdata(usb_intf, NULL);
 853:	
 854:		return retval;
 855:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3-flash-preview

							input: 38387
							output: 33
							thoughts: 481
						

**Analyzing a Potential Kernel Crash**

Okay, so the user is asking whether a kernel crash is definitively present in this `strace` output, or if something else is at play. The initial red flag is the "+++ killed by SIGKILL +++" entries for some threads. In a Syzkaller context, that *usually* means a kernel crash led the manager to terminate the process, or that the process itself caused instability.

But then, the user mentions "SYZFAIL: tun: can't open /dev/net/tun (errno 19: No such device)." Errno 19, `ENODEV`, *that's* interesting. A missing `/dev/net/tun` could be a simple VM configuration issue, or it could point to an initialization problem.

Now, the user adds the `strace` output itself. I can't see the output, but I know I am here to "research complex questions about kernel source code." So, I need to look for something that can help me deduce if there is a crash.

Could the "crash" be something like a `BUG_ON` or a `panic` triggered during, say, the USB device connection process? Thinking like that, my mind jumps to that `BUG_ON` in `rt2500usb.c`, where it looks like there's a sanity check on the antenna configuration:

```c
static void rt2500usb_config_ant(struct rt2x00_dev *rt2x00dev,
				 struct antenna_setup *ant)
{
	u8 r2;
	u8 r14;
	u16 csr5;
	u16 csr6;

	/*
	 * We should never come here because rt2x00lib is supposed
	 * to catch this and send us the correct antenna explicitely.
	 */
	BUG_ON(ant->rx == ANTENNA_SW_DIVERSITY ||
	       ant->tx == ANTENNA_SW_DIVERSITY);
```

The comment says that this `BUG_ON` should never be hit. If it *is* hit, it could indicate a deeper problem.

Okay, let's broaden the search. I need to look for other possible `BUG_ON` statements, especially in related code. I'm going to search the `drivers/net/wireless/ralink/rt2x00/` directory for any occurrences of `BUG_ON`. That seems like a good place to start my investigation.

map[Dir:drivers/net/wireless/ralink/rt2x00/]

map[Files:[rt2400pci.c rt2400pci.h rt2500pci.c rt2500pci.h rt2500usb.c rt2500usb.h rt2800.h rt2800lib.c rt2800lib.h rt2800mmio.c rt2800mmio.h rt2800pci.c rt2800pci.h rt2800soc.c rt2800usb.c rt2800usb.h rt2x00.h rt2x00config.c rt2x00crypto.c rt2x00debug.c rt2x00debug.h rt2x00dev.c rt2x00dump.h rt2x00firmware.c rt2x00leds.c rt2x00leds.h rt2x00lib.h rt2x00link.c rt2x00mac.c rt2x00mmio.c rt2x00mmio.h rt2x00pci.c rt2x00pci.h rt2x00queue.c rt2x00queue.h rt2x00reg.h rt2x00usb.c rt2x00usb.h rt61pci.c rt61pci.h rt73usb.c rt73usb.h] Subdirs:<nil>]

gemini-3-flash-preview

							input: 39933
							output: 43
							thoughts: 14
						

Okay, here's my summary, tailored for an expert audience, as if it were my thought process:

**Diving into the Codebase**

Alright, time to get to the root of this issue. Based on the clues, I suspect something might be triggering a critical error. My initial instinct is to zero in on the `BUG_ON` macro. It's a classic sign of an assertion failure, which usually indicates an internal inconsistency or an impossible condition within the kernel. Therefore, my first move is to run a targeted search for that macro within the relevant directory. This will rapidly help pinpoint those areas of the codebase which may require closer investigation. From there, I can begin to assess the context of each instance, looking for the underlying cause of this suspected assertion trigger.

log-in to see details

map[Name:BUG_ON SourceTreePrefix:drivers/net/wireless/ralink/rt2x00/]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 40172
							output: 62
							thoughts: 701
						

**Analyzing a Potential Kernel Crash**

Okay, so I'm thinking, based on this information, we might have a kernel crash somewhere related to a USB device connection, likely connected to the `rt2500usb` driver. The user mentioned `BUG_ON`, and immediately my internal search starts. Since I don't have direct access to tools like `grep`, I need to use the available resources. I'd ideally start with `codesearch-find-references`, but I know it might miss macro definitions like `BUG_ON`. I'd have to try searching for the string if there was no grep.

I see `rt2500usb_queue_init` has a `BUG()` call inside, that seems like a good starting point. I can imagine a scenario where this code path is hit during a USB device initialization and triggers an unexpected behavior. The user is asking about the crash, and then points to strace. It gets interesting.

The `+++ killed by SIGKILL +++` output from the strace implies an external termination. If this is a syzkaller reproducer, then the mention of `syz_usb_connect` points me to think of that connection function. This could mean that the USB connection triggered a kernel panic, resulting in the termination of the process by the syz-fuzzer/manager. The user also mentions `idVendor=0xdb0` and `idProduct=0x6869`.

Now, if there was a kernel crash during USB connection, I'd expect to see it logged in `dmesg`. The fact that the user is only mentioning strace raises a question: is this an actual kernel crash or is it something else? Could it be a `KASAN` report that isn't showing in the strace?

Aha! the user mentions a `SYZFAIL` and the error: "tun: can't open /dev/net/tun (errno 19: No such device)". If this is syzkaller, it makes sense. It's likely trying to use tun for network traffic, and that could be the failure. But still, the prompt says "crash". That's what I am trying to figure out.

Alright, the user is saying, "Let's look at the strace output carefully." So, I assume that based on the strace output the user is looking for a crash in `rt2500usb` and its associated calls.

Okay, so I'd move to examine the call-stack, looking at `rt2500usb_probe`, which calls `rt2x00usb_probe` and then `rt2x00lib_probe_dev`. I need to review this from the top of the stack and see where it's all going. Let's see if there's anything obvious in `drivers/net/wireless/ralink/rt2x00/rt2x00dev.c` that could cause an issue during device probe and connection. I would carefully analyze the strace for any clue.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00lib_probe_dev]

map[SourceCode:1371:	/*
1372:	 * driver allocation handlers.
1373:	 */
1374:	int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
1375:	{
1376:		int retval = -ENOMEM;
1377:	
1378:		/*
1379:		 * Set possible interface combinations.
1380:		 */
1381:		rt2x00lib_set_if_combinations(rt2x00dev);
1382:	
1383:		/*
1384:		 * Allocate the driver data memory, if necessary.
1385:		 */
1386:		if (rt2x00dev->ops->drv_data_size > 0) {
1387:			rt2x00dev->drv_data = kzalloc(rt2x00dev->ops->drv_data_size,
1388:				                      GFP_KERNEL);
1389:			if (!rt2x00dev->drv_data) {
1390:				retval = -ENOMEM;
1391:				goto exit;
1392:			}
1393:		}
1394:	
1395:		spin_lock_init(&rt2x00dev->irqmask_lock);
1396:		mutex_init(&rt2x00dev->csr_mutex);
1397:		mutex_init(&rt2x00dev->conf_mutex);
1398:		INIT_LIST_HEAD(&rt2x00dev->bar_list);
1399:		spin_lock_init(&rt2x00dev->bar_list_lock);
1400:		hrtimer_setup(&rt2x00dev->txstatus_timer, hrtimer_dummy_timeout, CLOCK_MONOTONIC,
1401:			      HRTIMER_MODE_REL);
1402:	
1403:		set_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
1404:	
1405:		/*
1406:		 * Make room for rt2x00_intf inside the per-interface
1407:		 * structure ieee80211_vif.
1408:		 */
1409:		rt2x00dev->hw->vif_data_size = sizeof(struct rt2x00_intf);
1410:	
1411:		/*
1412:		 * rt2x00 devices can only use the last n bits of the MAC address
1413:		 * for virtual interfaces.
1414:		 */
1415:		rt2x00dev->hw->wiphy->addr_mask[ETH_ALEN - 1] =
1416:			(rt2x00dev->ops->max_ap_intf - 1);
1417:	
1418:		/*
1419:		 * Initialize work.
1420:		 */
1421:		rt2x00dev->workqueue =
1422:		    alloc_ordered_workqueue("%s", 0, wiphy_name(rt2x00dev->hw->wiphy));
1423:		if (!rt2x00dev->workqueue) {
1424:			retval = -ENOMEM;
1425:			goto exit;
1426:		}
1427:	
1428:		INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled);
1429:		INIT_DELAYED_WORK(&rt2x00dev->autowakeup_work, rt2x00lib_autowakeup);
1430:		INIT_WORK(&rt2x00dev->sleep_work, rt2x00lib_sleep);
1431:	
1432:		/*
1433:		 * Let the driver probe the device to detect the capabilities.
1434:		 */
1435:		retval = rt2x00dev->ops->lib->probe_hw(rt2x00dev);
1436:		if (retval) {
1437:			rt2x00_err(rt2x00dev, "Failed to allocate device\n");
1438:			goto exit;
1439:		}
1440:	
1441:		/*
1442:		 * Allocate queue array.
1443:		 */
1444:		retval = rt2x00queue_allocate(rt2x00dev);
1445:		if (retval)
1446:			goto exit;
1447:	
1448:		/* Cache TX headroom value */
1449:		rt2x00dev->extra_tx_headroom = rt2x00dev_extra_tx_headroom(rt2x00dev);
1450:	
1451:		/*
1452:		 * Determine which operating modes are supported, all modes
1453:		 * which require beaconing, depend on the availability of
1454:		 * beacon entries.
1455:		 */
1456:		rt2x00dev->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
1457:		if (rt2x00dev->bcn->limit > 0)
1458:			rt2x00dev->hw->wiphy->interface_modes |=
1459:			    BIT(NL80211_IFTYPE_ADHOC) |
1460:	#ifdef CONFIG_MAC80211_MESH
1461:			    BIT(NL80211_IFTYPE_MESH_POINT) |
1462:	#endif
1463:			    BIT(NL80211_IFTYPE_AP);
1464:	
1465:		rt2x00dev->hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
1466:	
1467:		wiphy_ext_feature_set(rt2x00dev->hw->wiphy,
1468:				      NL80211_EXT_FEATURE_CQM_RSSI_LIST);
1469:	
1470:		/*
1471:		 * Initialize ieee80211 structure.
1472:		 */
1473:		retval = rt2x00lib_probe_hw(rt2x00dev);
1474:		if (retval) {
1475:			rt2x00_err(rt2x00dev, "Failed to initialize hw\n");
1476:			goto exit;
1477:		}
1478:	
1479:		/*
1480:		 * Register extra components.
1481:		 */
1482:		rt2x00link_register(rt2x00dev);
1483:		rt2x00leds_register(rt2x00dev);
1484:		rt2x00debug_register(rt2x00dev);
1485:	
1486:		/*
1487:		 * Start rfkill polling.
1488:		 */
1489:		if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
1490:			rt2x00rfkill_register(rt2x00dev);
1491:	
1492:		return 0;
1493:	
1494:	exit:
1495:		rt2x00lib_remove_dev(rt2x00dev);
1496:	
1497:		return retval;
1498:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c]

gemini-3-flash-preview

							input: 43695
							output: 63
							thoughts: 594
						

**Analyzing the SIGKILL in the Strace Output**

Okay, so the strace output is showing threads being killed by SIGKILL, which is a pretty abrupt way for things to end. The first step is to actually *see* the strace output, obviously. Without that, it's hard to make a concrete diagnosis. I'll need to either have the output, or try to find a similar report somewhere online, or perhaps delve into the kernel's history for clues.

Since I already know the `idVendor` and `idProduct` - `0xdb0` and `0x6869` - I can search the kernel source again to see if they turn up anywhere interesting. I recall that I already found them in `rt2500usb.c`, so I'll focus on that.

Now, let's dive into `rt2500usb_probe_hw` within `rt2500usb.c`. I need to understand what's happening at the hardware probe stage. Looking at the code:

*   The function initializes the EEPROM validation. I see `rt2500usb_validate_eeprom`.
*   The EEPROM is initialized via `rt2500usb_init_eeprom`.
*   Then, it sets up the GPIO for the rfkill switch polling.
*   Finally, there's a hardware mode initialization, which could be relevant.

The `rt2500usb_validate_eeprom` function seems particularly important. I see that it calls `rt2x00usb_eeprom_read`. The EEPROM is probably the root of the problem.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_eeprom_read]

map[SourceCode: 160:	/**
 161:	 * rt2x00usb_eeprom_read - Read eeprom from device
 162:	 * @rt2x00dev: Pointer to &struct rt2x00_dev
 163:	 * @eeprom: Pointer to eeprom array to store the information in
 164:	 * @length: Number of bytes to read from the eeprom
 165:	 *
 166:	 * Simple wrapper around rt2x00usb_vendor_request to read the eeprom
 167:	 * from the device. Note that the eeprom argument _must_ be allocated using
 168:	 * kmalloc for correct handling inside the kernel USB layer.
 169:	 */
 170:	static inline int rt2x00usb_eeprom_read(struct rt2x00_dev *rt2x00dev,
 171:						__le16 *eeprom, const u16 length)
 172:	{
 173:		return rt2x00usb_vendor_request(rt2x00dev, USB_EEPROM_READ,
 174:						USB_VENDOR_REQUEST_IN, 0, 0,
 175:						eeprom, length, EEPROM_TIMEOUT);
 176:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.h]

gemini-3-flash-preview

							input: 45093
							output: 62
							thoughts: 45
						

Okay, here's my take on those thoughts, framed as my own reasoning:

**Finding the Right Spot and the Corresponding Function**

Alright, first things first, where is this likely to be? Ah, yes, it's definitely going to be hanging out in `rt2x00usb.h`. That's the logical place to start looking for definitions related to the USB interface, assuming this concerns something like vendor requests or general USB control.

Now, I need to dig deeper. Let's see... the logical place to *implement* or *use* whatever's defined in that header must be in the relevant C file. Let's examine `rt2x00usb.c`, because that makes perfect sense. I'll need to locate `rt2x00usb_vendor_request` within that file. That function call is likely the key to understanding how vendor requests are actually handled, and where the implementation details are hidden. It's time to get a clear picture of how this works.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_vendor_request]

map[SourceCode:  42:	/*
  43:	 * Interfacing with the HW.
  44:	 */
  45:	int rt2x00usb_vendor_request(struct rt2x00_dev *rt2x00dev,
  46:				     const u8 request, const u8 requesttype,
  47:				     const u16 offset, const u16 value,
  48:				     void *buffer, const u16 buffer_length,
  49:				     const int timeout)
  50:	{
  51:		struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev);
  52:		int status;
  53:		unsigned int pipe =
  54:		    (requesttype == USB_VENDOR_REQUEST_IN) ?
  55:		    usb_rcvctrlpipe(usb_dev, 0) : usb_sndctrlpipe(usb_dev, 0);
  56:		unsigned long expire = jiffies + msecs_to_jiffies(timeout);
  57:	
  58:		if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
  59:			return -ENODEV;
  60:	
  61:		do {
  62:			status = usb_control_msg(usb_dev, pipe, request, requesttype,
  63:						 value, offset, buffer, buffer_length,
  64:						 timeout / 2);
  65:			if (status >= 0)
  66:				return 0;
  67:	
  68:			if (rt2x00usb_check_usb_error(rt2x00dev, status)) {
  69:				/* Device has disappeared. */
  70:				clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
  71:				break;
  72:			}
  73:		} while (time_before(jiffies, expire));
  74:	
  75:		rt2x00_err(rt2x00dev,
  76:			   "Vendor Request 0x%02x failed for offset 0x%04x with error %d\n",
  77:			   request, offset, status);
  78:	
  79:		return status;
  80:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3-flash-preview

							input: 46069
							output: 33
							thoughts: 258
						

**Analyzing the Reproducer's Failure**

Okay, so the user reports the reproducer is exiting with status 67. My initial thought is to recall that `EX_NOUSER` can mean something in some contexts, but in the syzkaller world, it could indicate a more specific issue. Wait, they say there's a "SYZFAIL: tun: can't open /dev/net/tun (errno 19: No such device)" message. Ah, so the reproducer failed to open `/dev/net/tun`. That suggests a crash *before* reaching that point.

But hang on, if I can infer from the user's description of the `strace` output, it was killed with `SIGKILL`. That's a red flag. It could be an OOM situation, or perhaps the syzkaller supervisor intervened.

Now, I need to check for recent fixes in related areas. I'll focus on anything related to `rt2500usb` or `rt2x00usb`, especially those mentioning crashes. Time to search the commit history and see if anything jumps out.

map[Dir:drivers/net/wireless/ralink/rt2x00/]

map[Files:[rt2400pci.c rt2400pci.h rt2500pci.c rt2500pci.h rt2500usb.c rt2500usb.h rt2800.h rt2800lib.c rt2800lib.h rt2800mmio.c rt2800mmio.h rt2800pci.c rt2800pci.h rt2800soc.c rt2800usb.c rt2800usb.h rt2x00.h rt2x00config.c rt2x00crypto.c rt2x00debug.c rt2x00debug.h rt2x00dev.c rt2x00dump.h rt2x00firmware.c rt2x00leds.c rt2x00leds.h rt2x00lib.h rt2x00link.c rt2x00mac.c rt2x00mmio.c rt2x00mmio.h rt2x00pci.c rt2x00pci.h rt2x00queue.c rt2x00queue.h rt2x00reg.h rt2x00usb.c rt2x00usb.h rt61pci.c rt61pci.h rt73usb.c rt73usb.h] Subdirs:<nil>]

gemini-3-flash-preview

							input: 47082
							output: 26
							thoughts: 99
						

**Investigating the `rt2500usb.c` Module**

Okay, so I need to dig into the history of `rt2500usb.c`. Normally, I'd just reach for `git log`, but I'm not directly equipped with that here. Time to improvise. I wonder if I can somehow extract recent modifications, or at least a glimpse of what's been happening.

Ah, wait a minute! I could try leveraging `codesearch-definition-comment`. Maybe there are some informative comments lurking in the code that shed light on recent developments. That's a reasonable first step.

On second thought, instead of limiting my search to just comments, let's cast a wider net. I'll search the entire project tree for "rt2500usb". This could turn up related files, test code, or documentation that I'm missing. Understanding the broader context around this module might be more productive in the long run. Let's see what turns up.

map[Name:rt2500usb_driver]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 47438
							output: 62
							thoughts: 730
						

**Analyzing a Potential Kernel Crash in the rt2500usb Driver**

Okay, so the user's asking if there's a kernel crash indicated in the `strace` output, or if it's something else entirely. If it's a kernel crash, `+++ killed by SIGKILL +++` might be the giveaway, since the syzkaller manager often kills processes after a kernel crash.

First, I need to see the `strace` output. Hmm, I should remember that syzkaller reports usually include a "Crash" section – duh, I'm a Linux kernel developer!  If the user says "The crash is:" followed by the `strace`, they likely mean the `strace` *is* the crash report or reveals the crash. But *strace* only shows userspace syscalls, a kernel crash might just mean the process gets killed, or that `strace` might just stop.

Wait... "SYZFAIL: tun: can't open /dev/net/tun (errno 19: No such device)". If the reproducer is trying to open `/dev/net/tun` and it fails with `ENODEV`, it means the `tun` driver isn't loaded or the device node is missing. But a crash *during* the USB connection, which happens before the `tun` open in many syzkaller reproducers, could put the kernel in a bad state, preventing even that `tun` call from succeeding.

However, the user says the reproducer exits with status 67. That's a good clue. Now, let's look at what `rt2500usb` does during probe.

The probe sequence: `rt2x00usb_probe`, `rt2x00lib_probe_dev`, `rt2500usb_probe_hw`, `rt2500usb_validate_eeprom`, `rt2x00usb_eeprom_read`, `rt2x00usb_vendor_request`, and finally `usb_control_msg`. Right, if `usb_control_msg` is called with a non-DMA-able buffer, that could be a crash on some architectures. However, in `rt2x00usb_eeprom_read`, the comment specifically says the eeprom argument *must* be allocated using `kmalloc`.

The code looks like:

`rt2500usb_probe_hw` calls `rt2500usb_validate_eeprom`.

`rt2500usb_validate_eeprom` calls `rt2x00usb_eeprom_read(rt2x00dev, rt2x00dev->eeprom, EEPROM_SIZE)`.

But where is `rt2x00dev->eeprom` allocated? Not in `rt2x00lib_probe_hw`, hmmm...I'll need to check `rt2x00usb_alloc_reg` in `rt2x00usb.c`. I have a hunch... it should be allocating the eeprom data in there. I'll check that next.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_alloc_reg]

map[SourceCode: 773:	static int rt2x00usb_alloc_reg(struct rt2x00_dev *rt2x00dev)
 774:	{
 775:		rt2x00dev->csr.cache = kzalloc(CSR_CACHE_SIZE, GFP_KERNEL);
 776:		if (!rt2x00dev->csr.cache)
 777:			goto exit;
 778:	
 779:		rt2x00dev->eeprom = kzalloc(rt2x00dev->ops->eeprom_size, GFP_KERNEL);
 780:		if (!rt2x00dev->eeprom)
 781:			goto exit;
 782:	
 783:		rt2x00dev->rf = kzalloc(rt2x00dev->ops->rf_size, GFP_KERNEL);
 784:		if (!rt2x00dev->rf)
 785:			goto exit;
 786:	
 787:		return 0;
 788:	
 789:	exit:
 790:		rt2x00_probe_err("Failed to allocate registers\n");
 791:	
 792:		rt2x00usb_free_reg(rt2x00dev);
 793:	
 794:		return -ENOMEM;
 795:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3-flash-preview

							input: 49324
							output: 64
							thoughts: 504
						

**Analyzing Potential DMA Issues in USB Control Messages**

Okay, so I'm looking at this code and thinking through the implications. I see that the buffer being used is allocated with `kzalloc`, which means it should be DMA-able. That's good, so the initial allocation is safe.

But then, I start thinking about edge cases. What happens if `buffer_length` is zero in `rt2x00usb_vendor_request`? I don't see anything obvious that addresses that, but the allocation is DMAable, so that might not be a huge concern.

Now, I've got something interesting. I'm looking at `rt2500usb_probe_hw` and it's calling `rt2500usb_register_read`. This function seems to handle RF kill switch polling. The function reads a register using `rt2x00usb_vendor_request_buff`. I'm starting to see a chain here: `rt2500usb_register_read` calls `rt2x00usb_vendor_request_buff`, which then calls `rt2x00usb_vendor_request`.

Aha! Here's where it gets interesting. I notice that in `rt2500usb_register_read`, the buffer `&reg` is on the *stack*. `rt2x00usb_vendor_request_buff` then passes this stack-allocated `&reg` to the `rt2x00usb_vendor_request` function, which in turn calls `usb_control_msg` with this buffer. Now, the problem jumps out at me: if `buffer` is on the stack, `usb_control_msg` might fail or even crash on kernels with `CONFIG_VMAP_STACK` enabled! The USB controller might be trying to DMA directly into that stack memory, which isn't allowed. So, stack-allocated buffers in `usb_control_msg` is a dangerous practice, especially in a driver. I should check `rt2x00usb_vendor_request_buff` to confirm my suspicion.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c IncludeLines:true Name:rt2x00usb_vendor_request_buff]

map[SourceCode: 114:	int rt2x00usb_vendor_request_buff(struct rt2x00_dev *rt2x00dev,
 115:					  const u8 request, const u8 requesttype,
 116:					  const u16 offset, void *buffer,
 117:					  const u16 buffer_length)
 118:	{
 119:		int status = 0;
 120:		u8 *tb;
 121:		u16 off, len, bsize;
 122:	
 123:		mutex_lock(&rt2x00dev->csr_mutex);
 124:	
 125:		tb  = (u8 *)buffer;
 126:		off = offset;
 127:		len = buffer_length;
 128:		while (len && !status) {
 129:			bsize = min_t(u16, CSR_CACHE_SIZE, len);
 130:			status = rt2x00usb_vendor_req_buff_lock(rt2x00dev, request,
 131:								requesttype, off, tb,
 132:								bsize, REGISTER_TIMEOUT);
 133:	
 134:			tb  += bsize;
 135:			len -= bsize;
 136:			off += bsize;
 137:		}
 138:	
 139:		mutex_unlock(&rt2x00dev->csr_mutex);
 140:	
 141:		return status;
 142:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3-flash-preview

							input: 50817
							output: 66
							thoughts: 17
						

Okay, here's my interpretation of that thought process, summarized as you requested, assuming I'm well-versed in kernel-level USB driver development:

**Thinking Through `rt2x00usb_vendor_req_buff_lock`**

Right, let's see. `rt2x00usb_vendor_req_buff_lock`. This is almost certainly part of the `rt2x00usb` driver, which means we're dealing with a USB implementation for a Realtek 802.11 wireless chipset – a reasonably common piece of hardware. The name itself suggests we're concerned with a buffer lock specifically for vendor-specific requests. That's a good starting point. Vendor requests, in USB terms, are those that use a particular set of "commands" or "protocols" specific to this specific Realtek hardware. It's not the generic, standardized USB control or data transfer.

So, why a *lock*? My immediate thought is, like any driver dealing with hardware, especially one that could have multiple threads or processes interacting with it, concurrency is the main issue. Multiple parts of the driver probably want to access and modify the vendor request buffer at the same time, perhaps from interrupt handlers, work queues, or user-space applications. Without proper locking, we'd be facing race conditions, corrupted data, and potentially a very unstable system.

This lock is likely a mutex or spinlock. Given the real-time constraints often associated with wireless device management and data transmission, it might be a spinlock for quick, short-duration locking in frequently used areas. A mutex, on the other hand, might be more appropriate if the critical section might involve waiting for something (like a hardware response, or DMA completion). The decision of which to use depends on the potential for contention and the required level of responsiveness. 

My immediate question is: what is the scope of this lock? Does it protect the entire vendor request buffer? Does it only protect certain critical sections *within* the buffer access routines? Are there multiple vendor request buffers and, if so, does this single lock protect them all? That determines how granular the locking strategy is, and, more importantly, the level of contention we expect. Excessive locking can lead to reduced performance due to contention, but insufficient locking could break things. I need to dive into the code to figure out those details.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c IncludeLines:true Name:rt2x00usb_vendor_req_buff_lock]

map[SourceCode:  83:	int rt2x00usb_vendor_req_buff_lock(struct rt2x00_dev *rt2x00dev,
  84:					   const u8 request, const u8 requesttype,
  85:					   const u16 offset, void *buffer,
  86:					   const u16 buffer_length, const int timeout)
  87:	{
  88:		int status;
  89:	
  90:		BUG_ON(!mutex_is_locked(&rt2x00dev->csr_mutex));
  91:	
  92:		/*
  93:		 * Check for Cache availability.
  94:		 */
  95:		if (unlikely(!rt2x00dev->csr.cache || buffer_length > CSR_CACHE_SIZE)) {
  96:			rt2x00_err(rt2x00dev, "CSR cache not available\n");
  97:			return -ENOMEM;
  98:		}
  99:	
 100:		if (requesttype == USB_VENDOR_REQUEST_OUT)
 101:			memcpy(rt2x00dev->csr.cache, buffer, buffer_length);
 102:	
 103:		status = rt2x00usb_vendor_request(rt2x00dev, request, requesttype,
 104:						  offset, 0, rt2x00dev->csr.cache,
 105:						  buffer_length, timeout);
 106:	
 107:		if (!status && requesttype == USB_VENDOR_REQUEST_IN)
 108:			memcpy(buffer, rt2x00dev->csr.cache, buffer_length);
 109:	
 110:		return status;
 111:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3-flash-preview

							input: 51907
							output: 41
							thoughts: 522
						

**Analyzing a Potential Crash Report**

Okay, so I'm looking at this issue. My initial thought was about `rt2x00dev->csr.cache`. I see it's allocated with `kzalloc`, which means it's safe to use, no obvious memory issues there.

But then I see the user's comment, specifically: "The strace output shows that the reproducer exits with status 67, and there is a message "SYZFAIL: tun: can't open /dev/net/tun (errno 19: No such device)". I'm immediately thrown off. They're saying "The crash is:" and then providing strace. Does this mean there's a real kernel crash hidden in this strace? The strace output shows `+++ killed by SIGKILL +++` for some threads, so I should be looking at this carefully.

If it's `SIGKILL`, it *could* be because of a `BUG()` or `panic()`, right? But, wait, a `BUG()` usually sends `SIGILL` or something like that, or panics the system. So that doesn't seem likely.

If the kernel panics, the syzkaller manager would *see* it and stop the reproducer. And it *might* report the strace of the reproducer as part of the report. This is all standard practice.

Now, the user explicitly mentions "SYZFAIL: tun: can't open /dev/net/tun (errno 19: No such device)". Okay, *that* `SYZFAIL` message originates from the syzkaller reproducer itself – the C code it generates. And if the reproducer fails with `SYZFAIL`, it *exits*.

But wait, it's exiting with status 67...

I need to look into what syzkaller's `SYZFAIL` actually does. It typically prints the message and *exits*. This is a crucial point.

Why would the user say "The crash is:" and then show strace if there's no actual crash? This is the core of the issue.

Maybe the "crash" is actually a kernel *warning* or something that happened *before* the `SYZFAIL`! It's likely related.

Okay, I need to check if there are any other `BUG_ON` or `BUG` in the `rt2x00` code, just to be thorough.

I'm searching for `BUG` in the `drivers/net/wireless/ralink/rt2x00/` directory right now. Need to be sure to check for potential asserts.

log-in to see details

map[Name:BUG SourceTreePrefix:drivers/net/wireless/ralink/rt2x00/]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 53061
							output: 42
							thoughts: 30
						

Okay, here's my thought process on how I'd approach this, considering my expertise:

**Hunting the Bug's Footprints**

Alright, so the task is to track down the use of this `BUG` macro. It's a common debugging tool, so I know it's probably going to be in core code, likely related to error handling or assertion checks. I'll start by focusing on the `rt2x00usb.c` file. Given my familiarity with kernel development, I'm already anticipating that this might be a good starting point, based on my past experience. This is a targeted approach, skipping the full-text search across the tree, which I might have to do if the initial search is inconclusive. I'm assuming that this is a starting point, and that the investigation is not yet complete.

map[SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

map[Entities:[map[Kind:function Name:rt2x00usb_alloc_entries] map[Kind:function Name:rt2x00usb_alloc_reg] map[Kind:function Name:rt2x00usb_assign_endpoint] map[Kind:function Name:rt2x00usb_check_usb_error] map[Kind:function Name:rt2x00usb_clear_entry] map[Kind:function Name:rt2x00usb_disable_radio] map[Kind:function Name:rt2x00usb_disconnect] map[Kind:function Name:rt2x00usb_dma_timeout] map[Kind:function Name:rt2x00usb_find_endpoints] map[Kind:function Name:rt2x00usb_flush_entry] map[Kind:function Name:rt2x00usb_flush_queue] map[Kind:function Name:rt2x00usb_free_entries] map[Kind:function Name:rt2x00usb_free_reg] map[Kind:function Name:rt2x00usb_initialize] map[Kind:function Name:rt2x00usb_interrupt_rxdone] map[Kind:function Name:rt2x00usb_interrupt_txdone] map[Kind:function Name:rt2x00usb_kick_queue] map[Kind:function Name:rt2x00usb_kick_rx_entry] map[Kind:function Name:rt2x00usb_kick_tx_entry] map[Kind:function Name:rt2x00usb_probe] map[Kind:function Name:rt2x00usb_regbusy_read] map[Kind:function Name:rt2x00usb_register_read_async] map[Kind:function Name:rt2x00usb_register_read_async_cb] map[Kind:function Name:rt2x00usb_resume] map[Kind:function Name:rt2x00usb_suspend] map[Kind:function Name:rt2x00usb_uninitialize] map[Kind:function Name:rt2x00usb_vendor_req_buff_lock] map[Kind:function Name:rt2x00usb_vendor_request] map[Kind:function Name:rt2x00usb_vendor_request_buff] map[Kind:function Name:rt2x00usb_watchdog] map[Kind:function Name:rt2x00usb_watchdog_tx_dma] map[Kind:function Name:rt2x00usb_work_rxdone] map[Kind:function Name:rt2x00usb_work_txdone] map[Kind:function Name:rt2x00usb_work_txdone_entry] map[Kind:struct Name:rt2x00_async_read_data] map[Kind:global_variable Name:__UNIQUE_ID_addressable_rt2x00usb_clear_entry_1265] map[Kind:global_variable Name:__UNIQUE_ID_addressable_rt2x00usb_disable_radio_1264] map[Kind:global_variable Name:__UNIQUE_ID_addressable_rt2x00usb_disconnect_1269] map[Kind:global_variable Name:__UNIQUE_ID_addressable_rt2x00usb_flush_queue_1262] map[Kind:global_variable Name:__UNIQUE_ID_addressable_rt2x00usb_initialize_1266] map[Kind:global_variable Name:__UNIQUE_ID_addressable_rt2x00usb_kick_queue_1261] map[Kind:global_variable Name:__UNIQUE_ID_addressable_rt2x00usb_probe_1268] map[Kind:global_variable Name:__UNIQUE_ID_addressable_rt2x00usb_regbusy_read_1259] map[Kind:global_variable Name:__UNIQUE_ID_addressable_rt2x00usb_register_read_async_1260] map[Kind:global_variable Name:__UNIQUE_ID_addressable_rt2x00usb_resume_1271] map[Kind:global_variable Name:__UNIQUE_ID_addressable_rt2x00usb_suspend_1270] map[Kind:global_variable Name:__UNIQUE_ID_addressable_rt2x00usb_uninitialize_1267] map[Kind:global_variable Name:__UNIQUE_ID_addressable_rt2x00usb_vendor_req_buff_lock_1255] map[Kind:global_variable Name:__UNIQUE_ID_addressable_rt2x00usb_vendor_request_1251] map[Kind:global_variable Name:__UNIQUE_ID_addressable_rt2x00usb_vendor_request_buff_1258] map[Kind:global_variable Name:__UNIQUE_ID_addressable_rt2x00usb_watchdog_1263] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_1272] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_1273] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_1274] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_1275] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_1276] map[Kind:global_variable Name:__modver_attr]]]

gemini-3-flash-preview

							input: 54802
							output: 60
							thoughts: 14
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Diving into `rt2x00usb_initialize`**

Alright, let's take a look at `rt2x00usb_initialize`. I'm going to start by confirming this is the right starting point for USB-specific initialization within the rt2x00 driver. I need to refresh my memory on the driver's architecture. Is this function responsible for setting up the USB device context, probing for supported devices, and potentially handling the initial firmware upload? I'll need to confirm that it correctly handles the USB interface settings, like endpoint configuration and interrupt registration. What are the key data structures being initialized here? I'll pay close attention to the allocation and initialization of any internal driver structures, especially those that manage USB transfers, queueing, and DMA. I need to make sure there are no obvious race conditions or memory leaks in the initialization path. I'm also curious about error handling; how robust is it in the face of USB device failures or communication issues during the initial setup? A quick glance at the surrounding code might reveal the typical error handling mechanisms. Are they using the standard USB error codes, or are there custom error codes being introduced? Is there any special handling for quirks of specific USB chipsets or devices? I will also be looking for any indications of power management considerations within this function, like device suspend/resume handling. Finally, I'll keep an eye out for how this function integrates with the more general rt2x00 framework – is it tightly coupled, or are there clean abstractions? This will also give me a better understanding of how the driver is structured and how it will work with different devices.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_initialize]

map[SourceCode: 714:	int rt2x00usb_initialize(struct rt2x00_dev *rt2x00dev)
 715:	{
 716:		struct data_queue *queue;
 717:		int status;
 718:	
 719:		/*
 720:		 * Find endpoints for each queue
 721:		 */
 722:		status = rt2x00usb_find_endpoints(rt2x00dev);
 723:		if (status)
 724:			goto exit;
 725:	
 726:		/*
 727:		 * Allocate DMA
 728:		 */
 729:		queue_for_each(rt2x00dev, queue) {
 730:			status = rt2x00usb_alloc_entries(queue);
 731:			if (status)
 732:				goto exit;
 733:		}
 734:	
 735:		return 0;
 736:	
 737:	exit:
 738:		rt2x00usb_uninitialize(rt2x00dev);
 739:	
 740:		return status;
 741:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3-flash-preview

							input: 55620
							output: 62
							thoughts: 16
						

Okay, here's my attempt at summarizing that thought process, tailored for an expert audience:

**Analyzing `rt2x00usb_find_endpoints`**

Alright, let's dive into this `rt2x00usb_find_endpoints` function. I need to refresh my memory on how this driver handles endpoint discovery for the RT2x00USB devices. I'm assuming this is where the initial setup happens, figuring out which endpoints are responsible for IN, OUT, and interrupt transfers. I'll need to see how it's done without the typical USB descriptors to determine how the driver knows which to use and how to handle it when new device versions are released. I'm curious if it's using standard USB requests, probing, or some vendor-specific methods. And most importantly, I'll need to understand how it maps these endpoints to the internal data structures that the rest of the driver uses. I want to see if there are any potential race conditions during enumeration or device reset. The main thing here is going to be figuring out the endpoint numbers and any related logic.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_find_endpoints]

map[SourceCode: 599:	static int rt2x00usb_find_endpoints(struct rt2x00_dev *rt2x00dev)
 600:	{
 601:		struct usb_interface *intf = to_usb_interface(rt2x00dev->dev);
 602:		struct usb_host_interface *intf_desc = intf->cur_altsetting;
 603:		struct usb_endpoint_descriptor *ep_desc;
 604:		struct data_queue *queue = rt2x00dev->tx;
 605:		struct usb_endpoint_descriptor *tx_ep_desc = NULL;
 606:		unsigned int i;
 607:	
 608:		/*
 609:		 * Walk through all available endpoints to search for "bulk in"
 610:		 * and "bulk out" endpoints. When we find such endpoints collect
 611:		 * the information we need from the descriptor and assign it
 612:		 * to the queue.
 613:		 */
 614:		for (i = 0; i < intf_desc->desc.bNumEndpoints; i++) {
 615:			ep_desc = &intf_desc->endpoint[i].desc;
 616:	
 617:			if (usb_endpoint_is_bulk_in(ep_desc)) {
 618:				rt2x00usb_assign_endpoint(rt2x00dev->rx, ep_desc);
 619:			} else if (usb_endpoint_is_bulk_out(ep_desc) &&
 620:				   (queue != queue_end(rt2x00dev))) {
 621:				rt2x00usb_assign_endpoint(queue, ep_desc);
 622:				queue = queue_next(queue);
 623:	
 624:				tx_ep_desc = ep_desc;
 625:			}
 626:		}
 627:	
 628:		/*
 629:		 * At least 1 endpoint for RX and 1 endpoint for TX must be available.
 630:		 */
 631:		if (!rt2x00dev->rx->usb_endpoint || !rt2x00dev->tx->usb_endpoint) {
 632:			rt2x00_err(rt2x00dev, "Bulk-in/Bulk-out endpoints not found\n");
 633:			return -EPIPE;
 634:		}
 635:	
 636:		/*
 637:		 * It might be possible not all queues have a dedicated endpoint.
 638:		 * Loop through all TX queues and copy the endpoint information
 639:		 * which we have gathered from already assigned endpoints.
 640:		 */
 641:		txall_queue_for_each(rt2x00dev, queue) {
 642:			if (!queue->usb_endpoint)
 643:				rt2x00usb_assign_endpoint(queue, tx_ep_desc);
 644:		}
 645:	
 646:		return 0;
 647:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3-flash-preview

							input: 56807
							output: 60
							thoughts: 206
						

**Analyzing Potential Null Pointer Dereference**

Okay, so I'm looking at this `rt2x00usb_assign_endpoint()` function call and my immediate concern is `tx_ep_desc`. If that's NULL, we're going to have issues. However, the code does a check *before* that: `!rt2x00dev->tx->usb_endpoint`. Right, `rt2x00dev->tx` represents the first TX queue, which makes sense. So, assuming `rt2x00dev->tx->usb_endpoint` is set, then `tx_ep_desc` should have been assigned a value somewhere within the relevant loop. That makes sense, keeps things safe.

But, hang on… What if `rt2x00dev->tx` itself is NULL? The pointer could be invalid. I need to make sure this isn't possible. Okay, let's see, where is `rt2x00dev->tx` being initialized? Ah, right, in `rt2x00queue_allocate`. In that function, it looks like:

```c
	rt2x00dev->tx = &rt2x00dev->queues[QID_AC_BE];
```

So, it's assigned to the queue at `QID_AC_BE`. Okay, I need to check the exact implementation to see what can go wrong in `rt2x00queue.c`. I need to ensure that `rt2x00dev->tx` is always valid before it gets used here. I need to refresh my memory on the initialization flow.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00queue_allocate]

map[SourceCode:1231:	int rt2x00queue_allocate(struct rt2x00_dev *rt2x00dev)
1232:	{
1233:		struct data_queue *queue;
1234:		enum data_queue_qid qid;
1235:		unsigned int req_atim =
1236:		    rt2x00_has_cap_flag(rt2x00dev, REQUIRE_ATIM_QUEUE);
1237:	
1238:		/*
1239:		 * We need the following queues:
1240:		 * RX: 1
1241:		 * TX: ops->tx_queues
1242:		 * Beacon: 1
1243:		 * Atim: 1 (if required)
1244:		 */
1245:		rt2x00dev->data_queues = 2 + rt2x00dev->ops->tx_queues + req_atim;
1246:	
1247:		queue = kzalloc_objs(*queue, rt2x00dev->data_queues);
1248:		if (!queue)
1249:			return -ENOMEM;
1250:	
1251:		/*
1252:		 * Initialize pointers
1253:		 */
1254:		rt2x00dev->rx = queue;
1255:		rt2x00dev->tx = &queue[1];
1256:		rt2x00dev->bcn = &queue[1 + rt2x00dev->ops->tx_queues];
1257:		rt2x00dev->atim = req_atim ? &queue[2 + rt2x00dev->ops->tx_queues] : NULL;
1258:	
1259:		/*
1260:		 * Initialize queue parameters.
1261:		 * RX: qid = QID_RX
1262:		 * TX: qid = QID_AC_VO + index
1263:		 * TX: cw_min: 2^5 = 32.
1264:		 * TX: cw_max: 2^10 = 1024.
1265:		 * BCN: qid = QID_BEACON
1266:		 * ATIM: qid = QID_ATIM
1267:		 */
1268:		rt2x00queue_init(rt2x00dev, rt2x00dev->rx, QID_RX);
1269:	
1270:		qid = QID_AC_VO;
1271:		tx_queue_for_each(rt2x00dev, queue)
1272:			rt2x00queue_init(rt2x00dev, queue, qid++);
1273:	
1274:		rt2x00queue_init(rt2x00dev, rt2x00dev->bcn, QID_BEACON);
1275:		if (req_atim)
1276:			rt2x00queue_init(rt2x00dev, rt2x00dev->atim, QID_ATIM);
1277:	
1278:		return 0;
1279:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00queue.c]

gemini-3-flash-preview

							input: 58329
							output: 38
							thoughts: 196
						

**Debugging a SIGKILL in rt2x00usb**

Okay, so the user's saying they're seeing "+++ killed by SIGKILL +++" in the `strace` output for some threads. Right, that's definitely a crash and a signal I need to understand. I need to figure out what's going on.

First, I'm thinking of looking for a crash in the `rt2x00usb_find_endpoints` function. A common issue could be a null pointer dereference. If `rt2x00dev->rx` or `rt2x00dev->tx` is null, it would definitely cause a crash. But... wait, those are set during `rt2x00queue_allocate`. So, that shouldn't be the direct cause.

Okay, let's step back, and rethink this. What if `rt2x00dev->ops->tx_queues` is accidentally set to 0? That would cause some issues. Let me see... I seem to recall that the `tx_queues` are defined in `rt2500usb.c`, and it's something like:
```c
static const struct rt2x00_ops rt2500usb_ops = {
...
	.tx_queues		= NUM_TX_QUEUES,
...
};
```
And `NUM_TX_QUEUES` should be defined in `rt2500usb.h`. I'll need to check the code to be sure, but that's the area I need to investigate further.

map[File:drivers/net/wireless/ralink/rt2x00/rt2500usb.h]

map[Contents:/* SPDX-License-Identifier: GPL-2.0-or-later */
/*
	Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
	<http://rt2x00.serialmonkey.com>

 */

/*
	Module: rt2500usb
	Abstract: Data structures and registers for the rt2500usb module.
	Supported chipsets: RT2570.
 */

#ifndef RT2500USB_H
#define RT2500USB_H

/*
 * RF chip defines.
 */
#define RF2522				0x0000
#define RF2523				0x0001
#define RF2524				0x0002
#define RF2525				0x0003
#define RF2525E				0x0005
#define RF5222				0x0010

/*
 * RT2570 version
 */
#define RT2570_VERSION_B		2
#define RT2570_VERSION_C		3
#define RT2570_VERSION_D		4

/*
 * Signal information.
 * Default offset is required for RSSI <-> dBm conversion.
 */
#define DEFAULT_RSSI_OFFSET		120

/*
 * Register layout information.
 */
#define CSR_REG_BASE			0x0400
#define CSR_REG_SIZE			0x0100
#define EEPROM_BASE			0x0000
#define EEPROM_SIZE			0x006e
#define BBP_BASE			0x0000
#define BBP_SIZE			0x0060
#define RF_BASE				0x0004
#define RF_SIZE				0x0010

/*
 * Number of TX queues.
 */
#define NUM_TX_QUEUES			2

/*
 * Control/Status Registers(CSR).
 * Some values are set in TU, whereas 1 TU == 1024 us.
 */

/*
 * MAC_CSR0: ASIC revision number.
 */
#define MAC_CSR0			0x0400

/*
 * MAC_CSR1: System control.
 * SOFT_RESET: Software reset, 1: reset, 0: normal.
 * BBP_RESET: Hardware reset, 1: reset, 0, release.
 * HOST_READY: Host ready after initialization.
 */
#define MAC_CSR1			0x0402
#define MAC_CSR1_SOFT_RESET		FIELD16(0x00000001)
#define MAC_CSR1_BBP_RESET		FIELD16(0x00000002)
#define MAC_CSR1_HOST_READY		FIELD16(0x00000004)

/*
 * MAC_CSR2: STA MAC register 0.
 */
#define MAC_CSR2			0x0404
#define MAC_CSR2_BYTE0			FIELD16(0x00ff)
#define MAC_CSR2_BYTE1			FIELD16(0xff00)

/*
 * MAC_CSR3: STA MAC register 1.
 */
#define MAC_CSR3			0x0406
#define MAC_CSR3_BYTE2			FIELD16(0x00ff)
#define MAC_CSR3_BYTE3			FIELD16(0xff00)

/*
 * MAC_CSR4: STA MAC register 2.
 */
#define MAC_CSR4			0X0408
#define MAC_CSR4_BYTE4			FIELD16(0x00ff)
#define MAC_CSR4_BYTE5			FIELD16(0xff00)

/*
 * MAC_CSR5: BSSID register 0.
 */
#define MAC_CSR5			0x040a
#define MAC_CSR5_BYTE0			FIELD16(0x00ff)
#define MAC_CSR5_BYTE1			FIELD16(0xff00)

/*
 * MAC_CSR6: BSSID register 1.
 */
#define MAC_CSR6			0x040c
#define MAC_CSR6_BYTE2			FIELD16(0x00ff)
#define MAC_CSR6_BYTE3			FIELD16(0xff00)

/*
 * MAC_CSR7: BSSID register 2.
 */
#define MAC_CSR7			0x040e
#define MAC_CSR7_BYTE4			FIELD16(0x00ff)
#define MAC_CSR7_BYTE5			FIELD16(0xff00)

/*
 * MAC_CSR8: Max frame length.
 */
#define MAC_CSR8			0x0410
#define MAC_CSR8_MAX_FRAME_UNIT		FIELD16(0x0fff)

/*
 * Misc MAC_CSR registers.
 * MAC_CSR9: Timer control.
 * MAC_CSR10: Slot time.
 * MAC_CSR11: SIFS.
 * MAC_CSR12: EIFS.
 * MAC_CSR13: Power mode0.
 * MAC_CSR14: Power mode1.
 * MAC_CSR15: Power saving transition0
 * MAC_CSR16: Power saving transition1
 */
#define MAC_CSR9			0x0412
#define MAC_CSR10			0x0414
#define MAC_CSR11			0x0416
#define MAC_CSR12			0x0418
#define MAC_CSR13			0x041a
#define MAC_CSR14			0x041c
#define MAC_CSR15			0x041e
#define MAC_CSR16			0x0420

/*
 * MAC_CSR17: Manual power control / status register.
 * Allowed state: 0 deep_sleep, 1: sleep, 2: standby, 3: awake.
 * SET_STATE: Set state. Write 1 to trigger, self cleared.
 * BBP_DESIRE_STATE: BBP desired state.
 * RF_DESIRE_STATE: RF desired state.
 * BBP_CURRENT_STATE: BBP current state.
 * RF_CURRENT_STATE: RF current state.
 * PUT_TO_SLEEP: Put to sleep. Write 1 to trigger, self cleared.
 */
#define MAC_CSR17			0x0422
#define MAC_CSR17_SET_STATE		FIELD16(0x0001)
#define MAC_CSR17_BBP_DESIRE_STATE	FIELD16(0x0006)
#define MAC_CSR17_RF_DESIRE_STATE	FIELD16(0x0018)
#define MAC_CSR17_BBP_CURR_STATE	FIELD16(0x0060)
#define MAC_CSR17_RF_CURR_STATE		FIELD16(0x0180)
#define MAC_CSR17_PUT_TO_SLEEP		FIELD16(0x0200)

/*
 * MAC_CSR18: Wakeup timer register.
 * DELAY_AFTER_BEACON: Delay after Tbcn expired in units of 1/16 TU.
 * BEACONS_BEFORE_WAKEUP: Number of beacon before wakeup.
 * AUTO_WAKE: Enable auto wakeup / sleep mechanism.
 */
#define MAC_CSR18			0x0424
#define MAC_CSR18_DELAY_AFTER_BEACON	FIELD16(0x00ff)
#define MAC_CSR18_BEACONS_BEFORE_WAKEUP	FIELD16(0x7f00)
#define MAC_CSR18_AUTO_WAKE		FIELD16(0x8000)

/*
 * MAC_CSR19: GPIO control register.
 *	MAC_CSR19_VALx: GPIO value
 *	MAC_CSR19_DIRx: GPIO direction: 0 = input; 1 = output
 */
#define MAC_CSR19			0x0426
#define MAC_CSR19_VAL0			FIELD16(0x0001)
#define MAC_CSR19_VAL1			FIELD16(0x0002)
#define MAC_CSR19_VAL2			FIELD16(0x0004)
#define MAC_CSR19_VAL3			FIELD16(0x0008)
#define MAC_CSR19_VAL4			FIELD16(0x0010)
#define MAC_CSR19_VAL5			FIELD16(0x0020)
#define MAC_CSR19_VAL6			FIELD16(0x0040)
#define MAC_CSR19_VAL7			FIELD16(0x0080)
#define MAC_CSR19_DIR0			FIELD16(0x0100)
#define MAC_CSR19_DIR1			FIELD16(0x0200)
#define MAC_CSR19_DIR2			FIELD16(0x0400)
#define MAC_CSR19_DIR3			FIELD16(0x0800)
#define MAC_CSR19_DIR4			FIELD16(0x1000)
#define MAC_CSR19_DIR5			FIELD16(0x2000)
#define MAC_CSR19_DIR6			FIELD16(0x4000)
#define MAC_CSR19_DIR7			FIELD16(0x8000)

/*
 * MAC_CSR20: LED control register.
 * ACTIVITY: 0: idle, 1: active.
 * LINK: 0: linkoff, 1: linkup.
 * ACTIVITY_POLARITY: 0: active low, 1: active high.
 */
#define MAC_CSR20			0x0428
#define MAC_CSR20_ACTIVITY		FIELD16(0x0001)
#define MAC_CSR20_LINK			FIELD16(0x0002)
#define MAC_CSR20_ACTIVITY_POLARITY	FIELD16(0x0004)

/*
 * MAC_CSR21: LED control register.
 * ON_PERIOD: On period, default 70ms.
 * OFF_PERIOD: Off period, default 30ms.
 */
#define MAC_CSR21			0x042a
#define MAC_CSR21_ON_PERIOD		FIELD16(0x00ff)
#define MAC_CSR21_OFF_PERIOD		FIELD16(0xff00)

/*
 * MAC_CSR22: Collision window control register.
 */
#define MAC_CSR22			0x042c

/*
 * Transmit related CSRs.
 * Some values are set in TU, whereas 1 TU == 1024 us.
 */

/*
 * TXRX_CSR0: Security control register.
 */
#define TXRX_CSR0			0x0440
#define TXRX_CSR0_ALGORITHM		FIELD16(0x0007)
#define TXRX_CSR0_IV_OFFSET		FIELD16(0x01f8)
#define TXRX_CSR0_KEY_ID		FIELD16(0x1e00)

/*
 * TXRX_CSR1: TX configuration.
 * ACK_TIMEOUT: ACK Timeout in unit of 1-us.
 * TSF_OFFSET: TSF offset in MAC header.
 * AUTO_SEQUENCE: Let ASIC control frame sequence number.
 */
#define TXRX_CSR1			0x0442
#define TXRX_CSR1_ACK_TIMEOUT		FIELD16(0x00ff)
#define TXRX_CSR1_TSF_OFFSET		FIELD16(0x7f00)
#define TXRX_CSR1_AUTO_SEQUENCE		FIELD16(0x8000)

/*
 * TXRX_CSR2: RX control.
 * DISABLE_RX: Disable rx engine.
 * DROP_CRC: Drop crc error.
 * DROP_PHYSICAL: Drop physical error.
 * DROP_CONTROL: Drop control frame.
 * DROP_NOT_TO_ME: Drop not to me unicast frame.
 * DROP_TODS: Drop frame tods bit is true.
 * DROP_VERSION_ERROR: Drop version error frame.
 * DROP_MCAST: Drop multicast frames.
 * DROP_BCAST: Drop broadcast frames.
 */
#define TXRX_CSR2			0x0444
#define	TXRX_CSR2_DISABLE_RX		FIELD16(0x0001)
#define TXRX_CSR2_DROP_CRC		FIELD16(0x0002)
#define TXRX_CSR2_DROP_PHYSICAL		FIELD16(0x0004)
#define TXRX_CSR2_DROP_CONTROL		FIELD16(0x0008)
#define TXRX_CSR2_DROP_NOT_TO_ME	FIELD16(0x0010)
#define TXRX_CSR2_DROP_TODS		FIELD16(0x0020)
#define TXRX_CSR2_DROP_VERSION_ERROR	FIELD16(0x0040)
#define TXRX_CSR2_DROP_MULTICAST	FIELD16(0x0200)
#define TXRX_CSR2_DROP_BROADCAST	FIELD16(0x0400)

/*
 * RX BBP ID registers
 * TXRX_CSR3: CCK RX BBP ID.
 * TXRX_CSR4: OFDM RX BBP ID.
 */
#define TXRX_CSR3			0x0446
#define TXRX_CSR4			0x0448

/*
 * TXRX_CSR5: CCK TX BBP ID0.
 */
#define TXRX_CSR5			0x044a
#define TXRX_CSR5_BBP_ID0		FIELD16(0x007f)
#define TXRX_CSR5_BBP_ID0_VALID		FIELD16(0x0080)
#define TXRX_CSR5_BBP_ID1		FIELD16(0x7f00)
#define TXRX_CSR5_BBP_ID1_VALID		FIELD16(0x8000)

/*
 * TXRX_CSR6: CCK TX BBP ID1.
 */
#define TXRX_CSR6			0x044c
#define TXRX_CSR6_BBP_ID0		FIELD16(0x007f)
#define TXRX_CSR6_BBP_ID0_VALID		FIELD16(0x0080)
#define TXRX_CSR6_BBP_ID1		FIELD16(0x7f00)
#define TXRX_CSR6_BBP_ID1_VALID		FIELD16(0x8000)

/*
 * TXRX_CSR7: OFDM TX BBP ID0.
 */
#define TXRX_CSR7			0x044e
#define TXRX_CSR7_BBP_ID0		FIELD16(0x007f)
#define TXRX_CSR7_BBP_ID0_VALID		FIELD16(0x0080)
#define TXRX_CSR7_BBP_ID1		FIELD16(0x7f00)
#define TXRX_CSR7_BBP_ID1_VALID		FIELD16(0x8000)

/*
 * TXRX_CSR8: OFDM TX BBP ID1.
 */
#define TXRX_CSR8			0x0450
#define TXRX_CSR8_BBP_ID0		FIELD16(0x007f)
#define TXRX_CSR8_BBP_ID0_VALID		FIELD16(0x0080)
#define TXRX_CSR8_BBP_ID1		FIELD16(0x7f00)
#define TXRX_CSR8_BBP_ID1_VALID		FIELD16(0x8000)

/*
 * TXRX_CSR9: TX ACK time-out.
 */
#define TXRX_CSR9			0x0452

/*
 * TXRX_CSR10: Auto responder control.
 */
#define TXRX_CSR10			0x0454
#define TXRX_CSR10_AUTORESPOND_PREAMBLE FIELD16(0x0004)

/*
 * TXRX_CSR11: Auto responder basic rate.
 */
#define TXRX_CSR11			0x0456

/*
 * ACK/CTS time registers.
 */
#define TXRX_CSR12			0x0458
#define TXRX_CSR13			0x045a
#define TXRX_CSR14			0x045c
#define TXRX_CSR15			0x045e
#define TXRX_CSR16			0x0460
#define TXRX_CSR17			0x0462

/*
 * TXRX_CSR18: Synchronization control register.
 */
#define TXRX_CSR18			0x0464
#define TXRX_CSR18_OFFSET		FIELD16(0x000f)
#define TXRX_CSR18_INTERVAL		FIELD16(0xfff0)

/*
 * TXRX_CSR19: Synchronization control register.
 * TSF_COUNT: Enable TSF auto counting.
 * TSF_SYNC: Tsf sync, 0: disable, 1: infra, 2: ad-hoc/master mode.
 * TBCN: Enable Tbcn with reload value.
 * BEACON_GEN: Enable beacon generator.
 */
#define TXRX_CSR19			0x0466
#define TXRX_CSR19_TSF_COUNT		FIELD16(0x0001)
#define TXRX_CSR19_TSF_SYNC		FIELD16(0x0006)
#define TXRX_CSR19_TBCN			FIELD16(0x0008)
#define TXRX_CSR19_BEACON_GEN		FIELD16(0x0010)

/*
 * TXRX_CSR20: Tx BEACON offset time control register.
 * OFFSET: In units of usec.
 * BCN_EXPECT_WINDOW: Default: 2^CWmin
 */
#define TXRX_CSR20			0x0468
#define TXRX_CSR20_OFFSET		FIELD16(0x1fff)
#define TXRX_CSR20_BCN_EXPECT_WINDOW	FIELD16(0xe000)

/*
 * TXRX_CSR21
 */
#define TXRX_CSR21			0x046a

/*
 * Encryption related CSRs.
 *
 */

/*
 * SEC_CSR0: Shared key 0, word 0
 * SEC_CSR1: Shared key 0, word 1
 * SEC_CSR2: Shared key 0, word 2
 * SEC_CSR3: Shared key 0, word 3
 * SEC_CSR4: Shared key 0, word 4
 * SEC_CSR5: Shared key 0, word 5
 * SEC_CSR6: Shared key 0, word 6
 * SEC_CSR7: Shared key 0, word 7
 */
#define SEC_CSR0			0x0480
#define SEC_CSR1			0x0482
#define SEC_CSR2			0x0484
#define SEC_CSR3			0x0486
#define SEC_CSR4			0x0488
#define SEC_CSR5			0x048a
#define SEC_CSR6			0x048c
#define SEC_CSR7			0x048e

/*
 * SEC_CSR8: Shared key 1, word 0
 * SEC_CSR9: Shared key 1, word 1
 * SEC_CSR10: Shared key 1, word 2
 * SEC_CSR11: Shared key 1, word 3
 * SEC_CSR12: Shared key 1, word 4
 * SEC_CSR13: Shared key 1, word 5
 * SEC_CSR14: Shared key 1, word 6
 * SEC_CSR15: Shared key 1, word 7
 */
#define SEC_CSR8			0x0490
#define SEC_CSR9			0x0492
#define SEC_CSR10			0x0494
#define SEC_CSR11			0x0496
#define SEC_CSR12			0x0498
#define SEC_CSR13			0x049a
#define SEC_CSR14			0x049c
#define SEC_CSR15			0x049e

/*
 * SEC_CSR16: Shared key 2, word 0
 * SEC_CSR17: Shared key 2, word 1
 * SEC_CSR18: Shared key 2, word 2
 * SEC_CSR19: Shared key 2, word 3
 * SEC_CSR20: Shared key 2, word 4
 * SEC_CSR21: Shared key 2, word 5
 * SEC_CSR22: Shared key 2, word 6
 * SEC_CSR23: Shared key 2, word 7
 */
#define SEC_CSR16			0x04a0
#define SEC_CSR17			0x04a2
#define SEC_CSR18			0X04A4
#define SEC_CSR19			0x04a6
#define SEC_CSR20			0x04a8
#define SEC_CSR21			0x04aa
#define SEC_CSR22			0x04ac
#define SEC_CSR23			0x04ae

/*
 * SEC_CSR24: Shared key 3, word 0
 * SEC_CSR25: Shared key 3, word 1
 * SEC_CSR26: Shared key 3, word 2
 * SEC_CSR27: Shared key 3, word 3
 * SEC_CSR28: Shared key 3, word 4
 * SEC_CSR29: Shared key 3, word 5
 * SEC_CSR30: Shared key 3, word 6
 * SEC_CSR31: Shared key 3, word 7
 */
#define SEC_CSR24			0x04b0
#define SEC_CSR25			0x04b2
#define SEC_CSR26			0x04b4
#define SEC_CSR27			0x04b6
#define SEC_CSR28			0x04b8
#define SEC_CSR29			0x04ba
#define SEC_CSR30			0x04bc
#define SEC_CSR31			0x04be

#define KEY_ENTRY(__idx) \
	( SEC_CSR0 + ((__idx) * 16) )

/*
 * PHY control registers.
 */

/*
 * PHY_CSR0: RF switching timing control.
 */
#define PHY_CSR0			0x04c0

/*
 * PHY_CSR1: TX PA configuration.
 */
#define PHY_CSR1			0x04c2

/*
 * MAC configuration registers.
 */

/*
 * PHY_CSR2: TX MAC configuration.
 * NOTE: Both register fields are complete dummy,
 * documentation and legacy drivers are unclear un
 * what this register means or what fields exists.
 */
#define PHY_CSR2			0x04c4
#define PHY_CSR2_LNA			FIELD16(0x0002)
#define PHY_CSR2_LNA_MODE		FIELD16(0x3000)

/*
 * PHY_CSR3: RX MAC configuration.
 */
#define PHY_CSR3			0x04c6

/*
 * PHY_CSR4: Interface configuration.
 */
#define PHY_CSR4			0x04c8
#define PHY_CSR4_LOW_RF_LE		FIELD16(0x0001)

/*
 * BBP pre-TX registers.
 * PHY_CSR5: BBP pre-TX CCK.
 */
#define PHY_CSR5			0x04ca
#define PHY_CSR5_CCK			FIELD16(0x0003)
#define PHY_CSR5_CCK_FLIP		FIELD16(0x0004)

/*
 * BBP pre-TX registers.
 * PHY_CSR6: BBP pre-TX OFDM.
 */
#define PHY_CSR6			0x04cc
#define PHY_CSR6_OFDM			FIELD16(0x0003)
#define PHY_CSR6_OFDM_FLIP		FIELD16(0x0004)

/*
 * PHY_CSR7: BBP access register 0.
 * BBP_DATA: BBP data.
 * BBP_REG_ID: BBP register ID.
 * BBP_READ_CONTROL: 0: write, 1: read.
 */
#define PHY_CSR7			0x04ce
#define PHY_CSR7_DATA			FIELD16(0x00ff)
#define PHY_CSR7_REG_ID			FIELD16(0x7f00)
#define PHY_CSR7_READ_CONTROL		FIELD16(0x8000)

/*
 * PHY_CSR8: BBP access register 1.
 * BBP_BUSY: ASIC is busy execute BBP programming.
 */
#define PHY_CSR8			0x04d0
#define PHY_CSR8_BUSY			FIELD16(0x0001)

/*
 * PHY_CSR9: RF access register.
 * RF_VALUE: Register value + id to program into rf/if.
 */
#define PHY_CSR9			0x04d2
#define PHY_CSR9_RF_VALUE		FIELD16(0xffff)

/*
 * PHY_CSR10: RF access register.
 * RF_VALUE: Register value + id to program into rf/if.
 * RF_NUMBER_OF_BITS: Number of bits used in value (i:20, rfmd:22).
 * RF_IF_SELECT: Chip to program: 0: rf, 1: if.
 * RF_PLL_LD: Rf pll_ld status.
 * RF_BUSY: 1: asic is busy execute rf programming.
 */
#define PHY_CSR10			0x04d4
#define PHY_CSR10_RF_VALUE		FIELD16(0x00ff)
#define PHY_CSR10_RF_NUMBER_OF_BITS	FIELD16(0x1f00)
#define PHY_CSR10_RF_IF_SELECT		FIELD16(0x2000)
#define PHY_CSR10_RF_PLL_LD		FIELD16(0x4000)
#define PHY_CSR10_RF_BUSY		FIELD16(0x8000)

/*
 * STA_CSR0: FCS error count.
 * FCS_ERROR: FCS error count, cleared when read.
 */
#define STA_CSR0			0x04e0
#define STA_CSR0_FCS_ERROR		FIELD16(0xffff)

/*
 * STA_CSR1: PLCP error count.
 */
#define STA_CSR1			0x04e2

/*
 * STA_CSR2: LONG error count.
 */
#define STA_CSR2			0x04e4

/*
 * STA_CSR3: CCA false alarm.
 * FALSE_CCA_ERROR: False CCA error count, cleared when read.
 */
#define STA_CSR3			0x04e6
#define STA_CSR3_FALSE_CCA_ERROR	FIELD16(0xffff)

/*
 * STA_CSR4: RX FIFO overflow.
 */
#define STA_CSR4			0x04e8

/*
 * STA_CSR5: Beacon sent counter.
 */
#define STA_CSR5			0x04ea

/*
 *  Statistics registers
 */
#define STA_CSR6			0x04ec
#define STA_CSR7			0x04ee
#define STA_CSR8			0x04f0
#define STA_CSR9			0x04f2
#define STA_CSR10			0x04f4

/*
 * BBP registers.
 * The wordsize of the BBP is 8 bits.
 */

/*
 * R2: TX antenna control
 */
#define BBP_R2_TX_ANTENNA		FIELD8(0x03)
#define BBP_R2_TX_IQ_FLIP		FIELD8(0x04)

/*
 * R14: RX antenna control
 */
#define BBP_R14_RX_ANTENNA		FIELD8(0x03)
#define BBP_R14_RX_IQ_FLIP		FIELD8(0x04)

/*
 * RF registers.
 */

/*
 * RF 1
 */
#define RF1_TUNER			FIELD32(0x00020000)

/*
 * RF 3
 */
#define RF3_TUNER			FIELD32(0x00000100)
#define RF3_TXPOWER			FIELD32(0x00003e00)

/*
 * EEPROM contents.
 */

/*
 * HW MAC address.
 */
#define EEPROM_MAC_ADDR_0		0x0002
#define EEPROM_MAC_ADDR_BYTE0		FIELD16(0x00ff)
#define EEPROM_MAC_ADDR_BYTE1		FIELD16(0xff00)
#define EEPROM_MAC_ADDR1		0x0003
#define EEPROM_MAC_ADDR_BYTE2		FIELD16(0x00ff)
#define EEPROM_MAC_ADDR_BYTE3		FIELD16(0xff00)
#define EEPROM_MAC_ADDR_2		0x0004
#define EEPROM_MAC_ADDR_BYTE4		FIELD16(0x00ff)
#define EEPROM_MAC_ADDR_BYTE5		FIELD16(0xff00)

/*
 * EEPROM antenna.
 * ANTENNA_NUM: Number of antenna's.
 * TX_DEFAULT: Default antenna 0: diversity, 1: A, 2: B.
 * RX_DEFAULT: Default antenna 0: diversity, 1: A, 2: B.
 * LED_MODE: 0: default, 1: TX/RX activity, 2: Single (ignore link), 3: rsvd.
 * DYN_TXAGC: Dynamic TX AGC control.
 * HARDWARE_RADIO: 1: Hardware controlled radio. Read GPIO0.
 * RF_TYPE: Rf_type of this adapter.
 */
#define EEPROM_ANTENNA			0x000b
#define EEPROM_ANTENNA_NUM		FIELD16(0x0003)
#define EEPROM_ANTENNA_TX_DEFAULT	FIELD16(0x000c)
#define EEPROM_ANTENNA_RX_DEFAULT	FIELD16(0x0030)
#define EEPROM_ANTENNA_LED_MODE		FIELD16(0x01c0)
#define EEPROM_ANTENNA_DYN_TXAGC	FIELD16(0x0200)
#define EEPROM_ANTENNA_HARDWARE_RADIO	FIELD16(0x0400)
#define EEPROM_ANTENNA_RF_TYPE		FIELD16(0xf800)

/*
 * EEPROM NIC config.
 * CARDBUS_ACCEL: 0: enable, 1: disable.
 * DYN_BBP_TUNE: 0: enable, 1: disable.
 * CCK_TX_POWER: CCK TX power compensation.
 */
#define EEPROM_NIC			0x000c
#define EEPROM_NIC_CARDBUS_ACCEL	FIELD16(0x0001)
#define EEPROM_NIC_DYN_BBP_TUNE		FIELD16(0x0002)
#define EEPROM_NIC_CCK_TX_POWER		FIELD16(0x000c)

/*
 * EEPROM geography.
 * GEO: Default geography setting for device.
 */
#define EEPROM_GEOGRAPHY		0x000d
#define EEPROM_GEOGRAPHY_GEO		FIELD16(0x0f00)

/*
 * EEPROM BBP.
 */
#define EEPROM_BBP_START		0x000e
#define EEPROM_BBP_SIZE			16
#define EEPROM_BBP_VALUE		FIELD16(0x00ff)
#define EEPROM_BBP_REG_ID		FIELD16(0xff00)

/*
 * EEPROM TXPOWER
 */
#define EEPROM_TXPOWER_START		0x001e
#define EEPROM_TXPOWER_SIZE		7
#define EEPROM_TXPOWER_1		FIELD16(0x00ff)
#define EEPROM_TXPOWER_2		FIELD16(0xff00)

/*
 * EEPROM Tuning threshold
 */
#define EEPROM_BBPTUNE			0x0030
#define EEPROM_BBPTUNE_THRESHOLD	FIELD16(0x00ff)

/*
 * EEPROM BBP R24 Tuning.
 */
#define EEPROM_BBPTUNE_R24		0x0031
#define EEPROM_BBPTUNE_R24_LOW		FIELD16(0x00ff)
#define EEPROM_BBPTUNE_R24_HIGH		FIELD16(0xff00)

/*
 * EEPROM BBP R25 Tuning.
 */
#define EEPROM_BBPTUNE_R25		0x0032
#define EEPROM_BBPTUNE_R25_LOW		FIELD16(0x00ff)
#define EEPROM_BBPTUNE_R25_HIGH		FIELD16(0xff00)

/*
 * EEPROM BBP R24 Tuning.
 */
#define EEPROM_BBPTUNE_R61		0x0033
#define EEPROM_BBPTUNE_R61_LOW		FIELD16(0x00ff)
#define EEPROM_BBPTUNE_R61_HIGH		FIELD16(0xff00)

/*
 * EEPROM BBP VGC Tuning.
 */
#define EEPROM_BBPTUNE_VGC		0x0034
#define EEPROM_BBPTUNE_VGCUPPER		FIELD16(0x00ff)
#define EEPROM_BBPTUNE_VGCLOWER		FIELD16(0xff00)

/*
 * EEPROM BBP R17 Tuning.
 */
#define EEPROM_BBPTUNE_R17		0x0035
#define EEPROM_BBPTUNE_R17_LOW		FIELD16(0x00ff)
#define EEPROM_BBPTUNE_R17_HIGH		FIELD16(0xff00)

/*
 * RSSI <-> dBm offset calibration
 */
#define EEPROM_CALIBRATE_OFFSET		0x0036
#define EEPROM_CALIBRATE_OFFSET_RSSI	FIELD16(0x00ff)

/*
 * DMA descriptor defines.
 */
#define TXD_DESC_SIZE			( 5 * sizeof(__le32) )
#define RXD_DESC_SIZE			( 4 * sizeof(__le32) )

/*
 * TX descriptor format for TX, PRIO, ATIM and Beacon Ring.
 */

/*
 * Word0
 */
#define TXD_W0_PACKET_ID		FIELD32(0x0000000f)
#define TXD_W0_RETRY_LIMIT		FIELD32(0x000000f0)
#define TXD_W0_MORE_FRAG		FIELD32(0x00000100)
#define TXD_W0_ACK			FIELD32(0x00000200)
#define TXD_W0_TIMESTAMP		FIELD32(0x00000400)
#define TXD_W0_OFDM			FIELD32(0x00000800)
#define TXD_W0_NEW_SEQ			FIELD32(0x00001000)
#define TXD_W0_IFS			FIELD32(0x00006000)
#define TXD_W0_DATABYTE_COUNT		FIELD32(0x0fff0000)
#define TXD_W0_CIPHER			FIELD32(0x20000000)
#define TXD_W0_KEY_ID			FIELD32(0xc0000000)

/*
 * Word1
 */
#define TXD_W1_IV_OFFSET		FIELD32(0x0000003f)
#define TXD_W1_AIFS			FIELD32(0x000000c0)
#define TXD_W1_CWMIN			FIELD32(0x00000f00)
#define TXD_W1_CWMAX			FIELD32(0x0000f000)

/*
 * Word2: PLCP information
 */
#define TXD_W2_PLCP_SIGNAL		FIELD32(0x000000ff)
#define TXD_W2_PLCP_SERVICE		FIELD32(0x0000ff00)
#define TXD_W2_PLCP_LENGTH_LOW		FIELD32(0x00ff0000)
#define TXD_W2_PLCP_LENGTH_HIGH		FIELD32(0xff000000)

/*
 * Word3
 */
#define TXD_W3_IV			FIELD32(0xffffffff)

/*
 * Word4
 */
#define TXD_W4_EIV			FIELD32(0xffffffff)

/*
 * RX descriptor format for RX Ring.
 */

/*
 * Word0
 */
#define RXD_W0_UNICAST_TO_ME		FIELD32(0x00000002)
#define RXD_W0_MULTICAST		FIELD32(0x00000004)
#define RXD_W0_BROADCAST		FIELD32(0x00000008)
#define RXD_W0_MY_BSS			FIELD32(0x00000010)
#define RXD_W0_CRC_ERROR		FIELD32(0x00000020)
#define RXD_W0_OFDM			FIELD32(0x00000040)
#define RXD_W0_PHYSICAL_ERROR		FIELD32(0x00000080)
#define RXD_W0_CIPHER			FIELD32(0x00000100)
#define RXD_W0_CIPHER_ERROR		FIELD32(0x00000200)
#define RXD_W0_DATABYTE_COUNT		FIELD32(0x0fff0000)

/*
 * Word1
 */
#define RXD_W1_RSSI			FIELD32(0x000000ff)
#define RXD_W1_SIGNAL			FIELD32(0x0000ff00)

/*
 * Word2
 */
#define RXD_W2_IV			FIELD32(0xffffffff)

/*
 * Word3
 */
#define RXD_W3_EIV			FIELD32(0xffffffff)

/*
 * Macros for converting txpower from EEPROM to mac80211 value
 * and from mac80211 value to register value.
 */
#define MIN_TXPOWER	0
#define MAX_TXPOWER	31
#define DEFAULT_TXPOWER	24

#define TXPOWER_FROM_DEV(__txpower) \
	(((u8)(__txpower)) > MAX_TXPOWER) ? DEFAULT_TXPOWER : (__txpower)

#define TXPOWER_TO_DEV(__txpower) \
	clamp_t(u8, __txpower, MIN_TXPOWER, MAX_TXPOWER)

#endif /* RT2500USB_H */
]

gemini-3-flash-preview

							input: 68766
							output: 62
							thoughts: 909
						

**Analyzing the Kernel Crash Scenario**

Okay, so the user's saying the reproducer exited with status 67 and reported a `SYZFAIL` related to `/dev/net/tun` not being available (ENODEV). They also mentioned seeing "+++ killed by SIGKILL +++" in the strace output for some threads. Initially, I thought that without the strace output, I'd be stuck, but I remember I'm supposed to be able to research complex questions about kernel source code, so let's dig deeper.

The `SYZFAIL` and `ENODEV` combo is intriguing. It suggests the system might be in a bad state *after* a potential kernel crash, maybe during the USB connection, so that even opening `/dev/net/tun` is impossible. Or the process may have been killed before it can finish. However, `SYZFAIL` *usually* means the reproducer itself explicitly detected an issue. So, a status 67 exit *implies* a controlled failure, not a true crash, in the sense of a segfault.

But the prompt says "The crash is:" and then gives the strace output... That's the key.

Let me revisit the `rt2500usb_probe_hw` function. I'm wondering if a failure in `rt2500usb_register_read` could be the root cause. This function calls `rt2x00usb_vendor_request_buff`. If the `rt2x00usb_vendor_request_buff` fails, then `rt2500usb_register_read` returns `reg` (which is allocated on the stack), but that variable is uninitialized. That might lead to bad behavior but not a crash.

However, after a bit more digging, I found something. In `rt2x00usb_probe`: `usb_reset_device(usb_dev);`. Calling `usb_reset_device` from within a probe function is...well, it can be risky, but sometimes it's done.

Let's shift gears. I'll search the code for "rt2500usb" combined with "SIGKILL" or "crash." Or let's just go straight for the `rt2x00usb_alloc_entries` function and see what that can tell us.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_alloc_entries]

map[SourceCode: 649:	static int rt2x00usb_alloc_entries(struct data_queue *queue)
 650:	{
 651:		struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
 652:		struct queue_entry_priv_usb *entry_priv;
 653:		struct queue_entry_priv_usb_bcn *bcn_priv;
 654:		unsigned int i;
 655:	
 656:		for (i = 0; i < queue->limit; i++) {
 657:			entry_priv = queue->entries[i].priv_data;
 658:			entry_priv->urb = usb_alloc_urb(0, GFP_KERNEL);
 659:			if (!entry_priv->urb)
 660:				return -ENOMEM;
 661:		}
 662:	
 663:		/*
 664:		 * If this is not the beacon queue or
 665:		 * no guardian byte was required for the beacon,
 666:		 * then we are done.
 667:		 */
 668:		if (queue->qid != QID_BEACON ||
 669:		    !rt2x00_has_cap_flag(rt2x00dev, REQUIRE_BEACON_GUARD))
 670:			return 0;
 671:	
 672:		for (i = 0; i < queue->limit; i++) {
 673:			bcn_priv = queue->entries[i].priv_data;
 674:			bcn_priv->guardian_urb = usb_alloc_urb(0, GFP_KERNEL);
 675:			if (!bcn_priv->guardian_urb)
 676:				return -ENOMEM;
 677:		}
 678:	
 679:		return 0;
 680:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3-flash-preview

							input: 70801
							output: 60
							thoughts: 127
						

**Debugging a Kernel Memory Allocation Issue**

Okay, let's see... I'm looking at this line: `entry_priv = queue->entries[i].priv_data;`. I'm using `queue->entries` but I'm not entirely sure *where* this array is allocated. I need to be sure the memory is valid and that I understand the lifetime of the data.

I initially looked at `rt2x00queue_allocate`, thinking that's where the magic happens. I see the `kzalloc_objs` call. That looks like memory is being allocated. Wait, I see now that `queue` itself is allocated there, not `queue->entries`. I missed something initially. It can be easy to skim over these details.

Okay, back to the drawing board. I'll need to go back and investigate `rt2x00queue_init`. Hopefully, I can find the allocation for `queue->entries` there. I have a hunch it's done somewhere there.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00queue.c IncludeLines:true Name:rt2x00queue_init]

map[SourceCode:1212:	static void rt2x00queue_init(struct rt2x00_dev *rt2x00dev,
1213:				     struct data_queue *queue, enum data_queue_qid qid)
1214:	{
1215:		mutex_init(&queue->status_lock);
1216:		spin_lock_init(&queue->tx_lock);
1217:		spin_lock_init(&queue->index_lock);
1218:	
1219:		queue->rt2x00dev = rt2x00dev;
1220:		queue->qid = qid;
1221:		queue->txop = 0;
1222:		queue->aifs = 2;
1223:		queue->cw_min = 5;
1224:		queue->cw_max = 10;
1225:	
1226:		rt2x00dev->ops->queue_init(queue);
1227:	
1228:		queue->threshold = DIV_ROUND_UP(queue->limit, 10);
1229:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00queue.c]

gemini-3-flash-preview

							input: 71547
							output: 38
							thoughts: 211
						

**Analyzing the Queue Initialization**

Okay, so the code's calling `rt2x00dev->ops->queue_init(queue)`. That function is probably the key to understanding how the data queues are set up. Let's see what's happening within `rt2500usb.c`.

Right, `rt2500usb_queue_init` is the one. I see it's using a `switch` statement based on `queue->qid`. For the RX queue (QID_RX), the code's setting `queue->limit` to 32 and defining the data frame and descriptor sizes. It also sets the `priv_size`, indicating some private data is associated with each queue entry.

The critical question here is where is the *actual* memory for `queue->entries` allocated? The code initializes the queue attributes, but I can't see the memory allocation. Did I miss something? Perhaps the allocation happens later?

I initially thought `rt2x00queue_allocate` was responsible, after looking through the loop, but it doesn't appear to be there. I'll need to check `rt2x00queue_allocate` again. I might have skipped over a crucial piece.

map[File:drivers/net/wireless/ralink/rt2x00/rt2x00queue.c]

map[Contents:// SPDX-License-Identifier: GPL-2.0-or-later
/*
	Copyright (C) 2010 Willow Garage <http://www.willowgarage.com>
	Copyright (C) 2004 - 2010 Ivo van Doorn <IvDoorn@gmail.com>
	Copyright (C) 2004 - 2009 Gertjan van Wingerde <gwingerde@gmail.com>
	<http://rt2x00.serialmonkey.com>

 */

/*
	Module: rt2x00lib
	Abstract: rt2x00 queue specific routines.
 */

#include <linux/slab.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/dma-mapping.h>

#include "rt2x00.h"
#include "rt2x00lib.h"

struct sk_buff *rt2x00queue_alloc_rxskb(struct queue_entry *entry, gfp_t gfp)
{
	struct data_queue *queue = entry->queue;
	struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
	struct sk_buff *skb;
	struct skb_frame_desc *skbdesc;
	unsigned int frame_size;
	unsigned int head_size = 0;
	unsigned int tail_size = 0;

	/*
	 * The frame size includes descriptor size, because the
	 * hardware directly receive the frame into the skbuffer.
	 */
	frame_size = queue->data_size + queue->desc_size + queue->winfo_size;

	/*
	 * The payload should be aligned to a 4-byte boundary,
	 * this means we need at least 3 bytes for moving the frame
	 * into the correct offset.
	 */
	head_size = 4;

	/*
	 * For IV/EIV/ICV assembly we must make sure there is
	 * at least 8 bytes available in headroom for IV/EIV
	 * and 8 bytes for ICV data as tailroon.
	 */
	if (rt2x00_has_cap_hw_crypto(rt2x00dev)) {
		head_size += 8;
		tail_size += 8;
	}

	/*
	 * Allocate skbuffer.
	 */
	skb = __dev_alloc_skb(frame_size + head_size + tail_size, gfp);
	if (!skb)
		return NULL;

	/*
	 * Make sure we not have a frame with the requested bytes
	 * available in the head and tail.
	 */
	skb_reserve(skb, head_size);
	skb_put(skb, frame_size);

	/*
	 * Populate skbdesc.
	 */
	skbdesc = get_skb_frame_desc(skb);
	memset(skbdesc, 0, sizeof(*skbdesc));

	if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DMA)) {
		dma_addr_t skb_dma;

		skb_dma = dma_map_single(rt2x00dev->dev, skb->data, skb->len,
					 DMA_FROM_DEVICE);
		if (unlikely(dma_mapping_error(rt2x00dev->dev, skb_dma))) {
			dev_kfree_skb_any(skb);
			return NULL;
		}

		skbdesc->skb_dma = skb_dma;
		skbdesc->flags |= SKBDESC_DMA_MAPPED_RX;
	}

	return skb;
}

int rt2x00queue_map_txskb(struct queue_entry *entry)
{
	struct device *dev = entry->queue->rt2x00dev->dev;
	struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);

	skbdesc->skb_dma =
	    dma_map_single(dev, entry->skb->data, entry->skb->len, DMA_TO_DEVICE);

	if (unlikely(dma_mapping_error(dev, skbdesc->skb_dma)))
		return -ENOMEM;

	skbdesc->flags |= SKBDESC_DMA_MAPPED_TX;
	rt2x00lib_dmadone(entry);
	return 0;
}
EXPORT_SYMBOL_GPL(rt2x00queue_map_txskb);

void rt2x00queue_unmap_skb(struct queue_entry *entry)
{
	struct device *dev = entry->queue->rt2x00dev->dev;
	struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);

	if (skbdesc->flags & SKBDESC_DMA_MAPPED_RX) {
		dma_unmap_single(dev, skbdesc->skb_dma, entry->skb->len,
				 DMA_FROM_DEVICE);
		skbdesc->flags &= ~SKBDESC_DMA_MAPPED_RX;
	} else if (skbdesc->flags & SKBDESC_DMA_MAPPED_TX) {
		dma_unmap_single(dev, skbdesc->skb_dma, entry->skb->len,
				 DMA_TO_DEVICE);
		skbdesc->flags &= ~SKBDESC_DMA_MAPPED_TX;
	}
}
EXPORT_SYMBOL_GPL(rt2x00queue_unmap_skb);

void rt2x00queue_free_skb(struct queue_entry *entry)
{
	if (!entry->skb)
		return;

	rt2x00queue_unmap_skb(entry);
	dev_kfree_skb_any(entry->skb);
	entry->skb = NULL;
}

void rt2x00queue_align_frame(struct sk_buff *skb)
{
	unsigned int frame_length = skb->len;
	unsigned int align = ALIGN_SIZE(skb, 0);

	if (!align)
		return;

	skb_push(skb, align);
	memmove(skb->data, skb->data + align, frame_length);
	skb_trim(skb, frame_length);
}

/*
 * H/W needs L2 padding between the header and the paylod if header size
 * is not 4 bytes aligned.
 */
void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int hdr_len)
{
	unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;

	if (!l2pad)
		return;

	skb_push(skb, l2pad);
	memmove(skb->data, skb->data + l2pad, hdr_len);
}

void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int hdr_len)
{
	unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;

	if (!l2pad)
		return;

	memmove(skb->data + l2pad, skb->data, hdr_len);
	skb_pull(skb, l2pad);
}

static void rt2x00queue_create_tx_descriptor_seq(struct rt2x00_dev *rt2x00dev,
						 struct sk_buff *skb,
						 struct txentry_desc *txdesc)
{
	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	struct rt2x00_intf *intf = vif_to_intf(tx_info->control.vif);
	u16 seqno;

	if (!(tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ))
		return;

	__set_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);

	if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_SW_SEQNO)) {
		/*
		 * rt2800 has a H/W (or F/W) bug, device incorrectly increase
		 * seqno on retransmitted data (non-QOS) and management frames.
		 * To workaround the problem let's generate seqno in software.
		 * Except for beacons which are transmitted periodically by H/W
		 * hence hardware has to assign seqno for them.
		 */
	    	if (ieee80211_is_beacon(hdr->frame_control)) {
			__set_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
			/* H/W will generate sequence number */
			return;
		}

		__clear_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
	}

	/*
	 * The hardware is not able to insert a sequence number. Assign a
	 * software generated one here.
	 *
	 * This is wrong because beacons are not getting sequence
	 * numbers assigned properly.
	 *
	 * A secondary problem exists for drivers that cannot toggle
	 * sequence counting per-frame, since those will override the
	 * sequence counter given by mac80211.
	 */
	if (test_bit(ENTRY_TXD_FIRST_FRAGMENT, &txdesc->flags))
		seqno = atomic_add_return(0x10, &intf->seqno);
	else
		seqno = atomic_read(&intf->seqno);

	hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
	hdr->seq_ctrl |= cpu_to_le16(seqno);
}

static void rt2x00queue_create_tx_descriptor_plcp(struct rt2x00_dev *rt2x00dev,
						  struct sk_buff *skb,
						  struct txentry_desc *txdesc,
						  const struct rt2x00_rate *hwrate)
{
	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
	struct ieee80211_tx_rate *txrate = &tx_info->control.rates[0];
	unsigned int data_length;
	unsigned int duration;
	unsigned int residual;

	/*
	 * Determine with what IFS priority this frame should be send.
	 * Set ifs to IFS_SIFS when the this is not the first fragment,
	 * or this fragment came after RTS/CTS.
	 */
	if (test_bit(ENTRY_TXD_FIRST_FRAGMENT, &txdesc->flags))
		txdesc->u.plcp.ifs = IFS_BACKOFF;
	else
		txdesc->u.plcp.ifs = IFS_SIFS;

	/* Data length + CRC + Crypto overhead (IV/EIV/ICV/MIC) */
	data_length = skb->len + 4;
	data_length += rt2x00crypto_tx_overhead(rt2x00dev, skb);

	/*
	 * PLCP setup
	 * Length calculation depends on OFDM/CCK rate.
	 */
	txdesc->u.plcp.signal = hwrate->plcp;
	txdesc->u.plcp.service = 0x04;

	if (hwrate->flags & DEV_RATE_OFDM) {
		txdesc->u.plcp.length_high = (data_length >> 6) & 0x3f;
		txdesc->u.plcp.length_low = data_length & 0x3f;
	} else {
		/*
		 * Convert length to microseconds.
		 */
		residual = GET_DURATION_RES(data_length, hwrate->bitrate);
		duration = GET_DURATION(data_length, hwrate->bitrate);

		if (residual != 0) {
			duration++;

			/*
			 * Check if we need to set the Length Extension
			 */
			if (hwrate->bitrate == 110 && residual <= 30)
				txdesc->u.plcp.service |= 0x80;
		}

		txdesc->u.plcp.length_high = (duration >> 8) & 0xff;
		txdesc->u.plcp.length_low = duration & 0xff;

		/*
		 * When preamble is enabled we should set the
		 * preamble bit for the signal.
		 */
		if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
			txdesc->u.plcp.signal |= 0x08;
	}
}

static void rt2x00queue_create_tx_descriptor_ht(struct rt2x00_dev *rt2x00dev,
						struct sk_buff *skb,
						struct txentry_desc *txdesc,
						struct ieee80211_sta *sta,
						const struct rt2x00_rate *hwrate)
{
	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
	struct ieee80211_tx_rate *txrate = &tx_info->control.rates[0];
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	struct rt2x00_sta *sta_priv = NULL;
	u8 density = 0;

	if (sta) {
		sta_priv = sta_to_rt2x00_sta(sta);
		txdesc->u.ht.wcid = sta_priv->wcid;
		density = sta->deflink.ht_cap.ampdu_density;
	}

	/*
	 * If IEEE80211_TX_RC_MCS is set txrate->idx just contains the
	 * mcs rate to be used
	 */
	if (txrate->flags & IEEE80211_TX_RC_MCS) {
		txdesc->u.ht.mcs = txrate->idx;

		/*
		 * MIMO PS should be set to 1 for STA's using dynamic SM PS
		 * when using more then one tx stream (>MCS7).
		 */
		if (sta && txdesc->u.ht.mcs > 7 &&
		    sta->deflink.smps_mode == IEEE80211_SMPS_DYNAMIC)
			__set_bit(ENTRY_TXD_HT_MIMO_PS, &txdesc->flags);
	} else {
		txdesc->u.ht.mcs = rt2x00_get_rate_mcs(hwrate->mcs);
		if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
			txdesc->u.ht.mcs |= 0x08;
	}

	if (test_bit(CONFIG_HT_DISABLED, &rt2x00dev->flags)) {
		if (!(tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT))
			txdesc->u.ht.txop = TXOP_SIFS;
		else
			txdesc->u.ht.txop = TXOP_BACKOFF;

		/* Left zero on all other settings. */
		return;
	}

	/*
	 * Only one STBC stream is supported for now.
	 */
	if (tx_info->flags & IEEE80211_TX_CTL_STBC)
		txdesc->u.ht.stbc = 1;

	/*
	 * This frame is eligible for an AMPDU, however, don't aggregate
	 * frames that are intended to probe a specific tx rate.
	 */
	if (tx_info->flags & IEEE80211_TX_CTL_AMPDU &&
	    !(tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)) {
		__set_bit(ENTRY_TXD_HT_AMPDU, &txdesc->flags);
		txdesc->u.ht.mpdu_density = density;
		txdesc->u.ht.ba_size = 7; /* FIXME: What value is needed? */
	}

	/*
	 * Set 40Mhz mode if necessary (for legacy rates this will
	 * duplicate the frame to both channels).
	 */
	if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH ||
	    txrate->flags & IEEE80211_TX_RC_DUP_DATA)
		__set_bit(ENTRY_TXD_HT_BW_40, &txdesc->flags);
	if (txrate->flags & IEEE80211_TX_RC_SHORT_GI)
		__set_bit(ENTRY_TXD_HT_SHORT_GI, &txdesc->flags);

	/*
	 * Determine IFS values
	 * - Use TXOP_BACKOFF for management frames except beacons
	 * - Use TXOP_SIFS for fragment bursts
	 * - Use TXOP_HTTXOP for everything else
	 *
	 * Note: rt2800 devices won't use CTS protection (if used)
	 * for frames not transmitted with TXOP_HTTXOP
	 */
	if (ieee80211_is_mgmt(hdr->frame_control) &&
	    !ieee80211_is_beacon(hdr->frame_control))
		txdesc->u.ht.txop = TXOP_BACKOFF;
	else if (!(tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT))
		txdesc->u.ht.txop = TXOP_SIFS;
	else
		txdesc->u.ht.txop = TXOP_HTTXOP;
}

static void rt2x00queue_create_tx_descriptor(struct rt2x00_dev *rt2x00dev,
					     struct sk_buff *skb,
					     struct txentry_desc *txdesc,
					     struct ieee80211_sta *sta)
{
	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	struct ieee80211_tx_rate *txrate = &tx_info->control.rates[0];
	struct ieee80211_rate *rate;
	const struct rt2x00_rate *hwrate = NULL;

	memset(txdesc, 0, sizeof(*txdesc));

	/*
	 * Header and frame information.
	 */
	txdesc->length = skb->len;
	txdesc->header_length = ieee80211_get_hdrlen_from_skb(skb);

	/*
	 * Check whether this frame is to be acked.
	 */
	if (!(tx_info->flags & IEEE80211_TX_CTL_NO_ACK))
		__set_bit(ENTRY_TXD_ACK, &txdesc->flags);

	/*
	 * Check if this is a RTS/CTS frame
	 */
	if (ieee80211_is_rts(hdr->frame_control) ||
	    ieee80211_is_cts(hdr->frame_control)) {
		__set_bit(ENTRY_TXD_BURST, &txdesc->flags);
		if (ieee80211_is_rts(hdr->frame_control))
			__set_bit(ENTRY_TXD_RTS_FRAME, &txdesc->flags);
		else
			__set_bit(ENTRY_TXD_CTS_FRAME, &txdesc->flags);
	}

	/*
	 * Determine retry information.
	 */
	txdesc->retry_limit = tx_info->control.rates[0].count - 1;
	if (txdesc->retry_limit >= rt2x00dev->long_retry)
		__set_bit(ENTRY_TXD_RETRY_MODE, &txdesc->flags);

	/*
	 * Check if more fragments are pending
	 */
	if (ieee80211_has_morefrags(hdr->frame_control)) {
		__set_bit(ENTRY_TXD_BURST, &txdesc->flags);
		__set_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags);
	}

	/*
	 * Check if more frames (!= fragments) are pending
	 */
	if (tx_info->flags & IEEE80211_TX_CTL_MORE_FRAMES)
		__set_bit(ENTRY_TXD_BURST, &txdesc->flags);

	/*
	 * Beacons and probe responses require the tsf timestamp
	 * to be inserted into the frame.
	 */
	if ((ieee80211_is_beacon(hdr->frame_control) ||
	     ieee80211_is_probe_resp(hdr->frame_control)) &&
	    !(tx_info->flags & IEEE80211_TX_CTL_INJECTED))
		__set_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags);

	if ((tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT) &&
	    !test_bit(ENTRY_TXD_RTS_FRAME, &txdesc->flags))
		__set_bit(ENTRY_TXD_FIRST_FRAGMENT, &txdesc->flags);

	/*
	 * Determine rate modulation.
	 */
	if (txrate->flags & IEEE80211_TX_RC_GREEN_FIELD)
		txdesc->rate_mode = RATE_MODE_HT_GREENFIELD;
	else if (txrate->flags & IEEE80211_TX_RC_MCS)
		txdesc->rate_mode = RATE_MODE_HT_MIX;
	else {
		rate = ieee80211_get_tx_rate(rt2x00dev->hw, tx_info);
		hwrate = rt2x00_get_rate(rate->hw_value);
		if (hwrate->flags & DEV_RATE_OFDM)
			txdesc->rate_mode = RATE_MODE_OFDM;
		else
			txdesc->rate_mode = RATE_MODE_CCK;
	}

	/*
	 * Apply TX descriptor handling by components
	 */
	rt2x00crypto_create_tx_descriptor(rt2x00dev, skb, txdesc);
	rt2x00queue_create_tx_descriptor_seq(rt2x00dev, skb, txdesc);

	if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_HT_TX_DESC))
		rt2x00queue_create_tx_descriptor_ht(rt2x00dev, skb, txdesc,
						   sta, hwrate);
	else
		rt2x00queue_create_tx_descriptor_plcp(rt2x00dev, skb, txdesc,
						      hwrate);
}

static int rt2x00queue_write_tx_data(struct queue_entry *entry,
				     struct txentry_desc *txdesc)
{
	struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;

	/*
	 * This should not happen, we already checked the entry
	 * was ours. When the hardware disagrees there has been
	 * a queue corruption!
	 */
	if (unlikely(rt2x00dev->ops->lib->get_entry_state &&
		     rt2x00dev->ops->lib->get_entry_state(entry))) {
		rt2x00_err(rt2x00dev,
			   "Corrupt queue %d, accessing entry which is not ours\n"
			   "Please file bug report to %s\n",
			   entry->queue->qid, DRV_PROJECT);
		return -EINVAL;
	}

	/*
	 * Add the requested extra tx headroom in front of the skb.
	 */
	skb_push(entry->skb, rt2x00dev->extra_tx_headroom);
	memset(entry->skb->data, 0, rt2x00dev->extra_tx_headroom);

	/*
	 * Call the driver's write_tx_data function, if it exists.
	 */
	if (rt2x00dev->ops->lib->write_tx_data)
		rt2x00dev->ops->lib->write_tx_data(entry, txdesc);

	/*
	 * Map the skb to DMA.
	 */
	if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DMA) &&
	    rt2x00queue_map_txskb(entry))
		return -ENOMEM;

	return 0;
}

static void rt2x00queue_write_tx_descriptor(struct queue_entry *entry,
					    struct txentry_desc *txdesc)
{
	struct data_queue *queue = entry->queue;

	queue->rt2x00dev->ops->lib->write_tx_desc(entry, txdesc);

	/*
	 * All processing on the frame has been completed, this means
	 * it is now ready to be dumped to userspace through debugfs.
	 */
	rt2x00debug_dump_frame(queue->rt2x00dev, DUMP_FRAME_TX, entry);
}

static void rt2x00queue_kick_tx_queue(struct data_queue *queue,
				      struct txentry_desc *txdesc)
{
	/*
	 * Check if we need to kick the queue, there are however a few rules
	 *	1) Don't kick unless this is the last in frame in a burst.
	 *	   When the burst flag is set, this frame is always followed
	 *	   by another frame which in some way are related to eachother.
	 *	   This is true for fragments, RTS or CTS-to-self frames.
	 *	2) Rule 1 can be broken when the available entries
	 *	   in the queue are less then a certain threshold.
	 */
	if (rt2x00queue_threshold(queue) ||
	    !test_bit(ENTRY_TXD_BURST, &txdesc->flags))
		queue->rt2x00dev->ops->lib->kick_queue(queue);
}

static void rt2x00queue_bar_check(struct queue_entry *entry)
{
	struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
	struct ieee80211_bar *bar = (void *) (entry->skb->data +
				    rt2x00dev->extra_tx_headroom);
	struct rt2x00_bar_list_entry *bar_entry;

	if (likely(!ieee80211_is_back_req(bar->frame_control)))
		return;

	bar_entry = kmalloc_obj(*bar_entry, GFP_ATOMIC);

	/*
	 * If the alloc fails we still send the BAR out but just don't track
	 * it in our bar list. And as a result we will report it to mac80211
	 * back as failed.
	 */
	if (!bar_entry)
		return;

	bar_entry->entry = entry;
	bar_entry->block_acked = 0;

	/*
	 * Copy the relevant parts of the 802.11 BAR into out check list
	 * such that we can use RCU for less-overhead in the RX path since
	 * sending BARs and processing the according BlockAck should be
	 * the exception.
	 */
	memcpy(bar_entry->ra, bar->ra, sizeof(bar->ra));
	memcpy(bar_entry->ta, bar->ta, sizeof(bar->ta));
	bar_entry->control = bar->control;
	bar_entry->start_seq_num = bar->start_seq_num;

	/*
	 * Insert BAR into our BAR check list.
	 */
	spin_lock_bh(&rt2x00dev->bar_list_lock);
	list_add_tail_rcu(&bar_entry->list, &rt2x00dev->bar_list);
	spin_unlock_bh(&rt2x00dev->bar_list_lock);
}

int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
			       struct ieee80211_sta *sta, bool local)
{
	struct ieee80211_tx_info *tx_info;
	struct queue_entry *entry;
	struct txentry_desc txdesc;
	struct skb_frame_desc *skbdesc;
	u8 rate_idx, rate_flags;
	int ret = 0;

	/*
	 * Copy all TX descriptor information into txdesc,
	 * after that we are free to use the skb->cb array
	 * for our information.
	 */
	rt2x00queue_create_tx_descriptor(queue->rt2x00dev, skb, &txdesc, sta);

	/*
	 * All information is retrieved from the skb->cb array,
	 * now we should claim ownership of the driver part of that
	 * array, preserving the bitrate index and flags.
	 */
	tx_info = IEEE80211_SKB_CB(skb);
	rate_idx = tx_info->control.rates[0].idx;
	rate_flags = tx_info->control.rates[0].flags;
	skbdesc = get_skb_frame_desc(skb);
	memset(skbdesc, 0, sizeof(*skbdesc));
	skbdesc->tx_rate_idx = rate_idx;
	skbdesc->tx_rate_flags = rate_flags;

	if (local)
		skbdesc->flags |= SKBDESC_NOT_MAC80211;

	/*
	 * When hardware encryption is supported, and this frame
	 * is to be encrypted, we should strip the IV/EIV data from
	 * the frame so we can provide it to the driver separately.
	 */
	if (test_bit(ENTRY_TXD_ENCRYPT, &txdesc.flags) &&
	    !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc.flags)) {
		if (rt2x00_has_cap_flag(queue->rt2x00dev, REQUIRE_COPY_IV))
			rt2x00crypto_tx_copy_iv(skb, &txdesc);
		else
			rt2x00crypto_tx_remove_iv(skb, &txdesc);
	}

	/*
	 * When DMA allocation is required we should guarantee to the
	 * driver that the DMA is aligned to a 4-byte boundary.
	 * However some drivers require L2 padding to pad the payload
	 * rather then the header. This could be a requirement for
	 * PCI and USB devices, while header alignment only is valid
	 * for PCI devices.
	 */
	if (rt2x00_has_cap_flag(queue->rt2x00dev, REQUIRE_L2PAD))
		rt2x00queue_insert_l2pad(skb, txdesc.header_length);
	else if (rt2x00_has_cap_flag(queue->rt2x00dev, REQUIRE_DMA))
		rt2x00queue_align_frame(skb);

	/*
	 * That function must be called with bh disabled.
	 */
	spin_lock(&queue->tx_lock);

	if (unlikely(rt2x00queue_full(queue))) {
		rt2x00_dbg(queue->rt2x00dev, "Dropping frame due to full tx queue %d\n",
			   queue->qid);
		ret = -ENOBUFS;
		goto out;
	}

	entry = rt2x00queue_get_entry(queue, Q_INDEX);

	if (unlikely(test_and_set_bit(ENTRY_OWNER_DEVICE_DATA,
				      &entry->flags))) {
		rt2x00_err(queue->rt2x00dev,
			   "Arrived at non-free entry in the non-full queue %d\n"
			   "Please file bug report to %s\n",
			   queue->qid, DRV_PROJECT);
		ret = -EINVAL;
		goto out;
	}

	entry->skb = skb;

	/*
	 * It could be possible that the queue was corrupted and this
	 * call failed. Since we always return NETDEV_TX_OK to mac80211,
	 * this frame will simply be dropped.
	 */
	if (unlikely(rt2x00queue_write_tx_data(entry, &txdesc))) {
		clear_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags);
		entry->skb = NULL;
		ret = -EIO;
		goto out;
	}

	/*
	 * Put BlockAckReqs into our check list for driver BA processing.
	 */
	rt2x00queue_bar_check(entry);

	set_bit(ENTRY_DATA_PENDING, &entry->flags);

	rt2x00queue_index_inc(entry, Q_INDEX);
	rt2x00queue_write_tx_descriptor(entry, &txdesc);
	rt2x00queue_kick_tx_queue(queue, &txdesc);

out:
	/*
	 * Pausing queue has to be serialized with rt2x00lib_txdone(), so we
	 * do this under queue->tx_lock. Bottom halve was already disabled
	 * before ieee80211_xmit() call.
	 */
	if (rt2x00queue_threshold(queue))
		rt2x00queue_pause_queue(queue);

	spin_unlock(&queue->tx_lock);
	return ret;
}

int rt2x00queue_clear_beacon(struct rt2x00_dev *rt2x00dev,
			     struct ieee80211_vif *vif)
{
	struct rt2x00_intf *intf = vif_to_intf(vif);

	if (unlikely(!intf->beacon))
		return -ENOBUFS;

	/*
	 * Clean up the beacon skb.
	 */
	rt2x00queue_free_skb(intf->beacon);

	/*
	 * Clear beacon (single bssid devices don't need to clear the beacon
	 * since the beacon queue will get stopped anyway).
	 */
	if (rt2x00dev->ops->lib->clear_beacon)
		rt2x00dev->ops->lib->clear_beacon(intf->beacon);

	return 0;
}

int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
			      struct ieee80211_vif *vif)
{
	struct rt2x00_intf *intf = vif_to_intf(vif);
	struct skb_frame_desc *skbdesc;
	struct txentry_desc txdesc;

	if (unlikely(!intf->beacon))
		return -ENOBUFS;

	/*
	 * Clean up the beacon skb.
	 */
	rt2x00queue_free_skb(intf->beacon);

	intf->beacon->skb = ieee80211_beacon_get(rt2x00dev->hw, vif, 0);
	if (!intf->beacon->skb)
		return -ENOMEM;

	/*
	 * Copy all TX descriptor information into txdesc,
	 * after that we are free to use the skb->cb array
	 * for our information.
	 */
	rt2x00queue_create_tx_descriptor(rt2x00dev, intf->beacon->skb, &txdesc, NULL);

	/*
	 * Fill in skb descriptor
	 */
	skbdesc = get_skb_frame_desc(intf->beacon->skb);
	memset(skbdesc, 0, sizeof(*skbdesc));

	/*
	 * Send beacon to hardware.
	 */
	rt2x00dev->ops->lib->write_beacon(intf->beacon, &txdesc);

	return 0;

}

bool rt2x00queue_for_each_entry(struct data_queue *queue,
				enum queue_index start,
				enum queue_index end,
				void *data,
				bool (*fn)(struct queue_entry *entry,
					   void *data))
{
	unsigned long irqflags;
	unsigned int index_start;
	unsigned int index_end;
	unsigned int i;

	if (unlikely(start >= Q_INDEX_MAX || end >= Q_INDEX_MAX)) {
		rt2x00_err(queue->rt2x00dev,
			   "Entry requested from invalid index range (%d - %d)\n",
			   start, end);
		return true;
	}

	/*
	 * Only protect the range we are going to loop over,
	 * if during our loop a extra entry is set to pending
	 * it should not be kicked during this run, since it
	 * is part of another TX operation.
	 */
	spin_lock_irqsave(&queue->index_lock, irqflags);
	index_start = queue->index[start];
	index_end = queue->index[end];
	spin_unlock_irqrestore(&queue->index_lock, irqflags);

	/*
	 * Start from the TX done pointer, this guarantees that we will
	 * send out all frames in the correct order.
	 */
	if (index_start < index_end) {
		for (i = index_start; i < index_end; i++) {
			if (fn(&queue->entries[i], data))
				return true;
		}
	} else {
		for (i = index_start; i < queue->limit; i++) {
			if (fn(&queue->entries[i], data))
				return true;
		}

		for (i = 0; i < index_end; i++) {
			if (fn(&queue->entries[i], data))
				return true;
		}
	}

	return false;
}
EXPORT_SYMBOL_GPL(rt2x00queue_for_each_entry);

struct queue_entry *rt2x00queue_get_entry(struct data_queue *queue,
					  enum queue_index index)
{
	struct queue_entry *entry;
	unsigned long irqflags;

	if (unlikely(index >= Q_INDEX_MAX)) {
		rt2x00_err(queue->rt2x00dev, "Entry requested from invalid index type (%d)\n",
			   index);
		return NULL;
	}

	spin_lock_irqsave(&queue->index_lock, irqflags);

	entry = &queue->entries[queue->index[index]];

	spin_unlock_irqrestore(&queue->index_lock, irqflags);

	return entry;
}
EXPORT_SYMBOL_GPL(rt2x00queue_get_entry);

void rt2x00queue_index_inc(struct queue_entry *entry, enum queue_index index)
{
	struct data_queue *queue = entry->queue;
	unsigned long irqflags;

	if (unlikely(index >= Q_INDEX_MAX)) {
		rt2x00_err(queue->rt2x00dev,
			   "Index change on invalid index type (%d)\n", index);
		return;
	}

	spin_lock_irqsave(&queue->index_lock, irqflags);

	queue->index[index]++;
	if (queue->index[index] >= queue->limit)
		queue->index[index] = 0;

	entry->last_action = jiffies;

	if (index == Q_INDEX) {
		queue->length++;
	} else if (index == Q_INDEX_DONE) {
		queue->length--;
		queue->count++;
	}

	spin_unlock_irqrestore(&queue->index_lock, irqflags);
}

static void rt2x00queue_pause_queue_nocheck(struct data_queue *queue)
{
	switch (queue->qid) {
	case QID_AC_VO:
	case QID_AC_VI:
	case QID_AC_BE:
	case QID_AC_BK:
		/*
		 * For TX queues, we have to disable the queue
		 * inside mac80211.
		 */
		ieee80211_stop_queue(queue->rt2x00dev->hw, queue->qid);
		break;
	default:
		break;
	}
}
void rt2x00queue_pause_queue(struct data_queue *queue)
{
	if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
	    !test_bit(QUEUE_STARTED, &queue->flags) ||
	    test_and_set_bit(QUEUE_PAUSED, &queue->flags))
		return;

	rt2x00queue_pause_queue_nocheck(queue);
}
EXPORT_SYMBOL_GPL(rt2x00queue_pause_queue);

void rt2x00queue_unpause_queue(struct data_queue *queue)
{
	if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
	    !test_bit(QUEUE_STARTED, &queue->flags) ||
	    !test_and_clear_bit(QUEUE_PAUSED, &queue->flags))
		return;

	switch (queue->qid) {
	case QID_AC_VO:
	case QID_AC_VI:
	case QID_AC_BE:
	case QID_AC_BK:
		/*
		 * For TX queues, we have to enable the queue
		 * inside mac80211.
		 */
		ieee80211_wake_queue(queue->rt2x00dev->hw, queue->qid);
		break;
	case QID_RX:
		/*
		 * For RX we need to kick the queue now in order to
		 * receive frames.
		 */
		queue->rt2x00dev->ops->lib->kick_queue(queue);
		break;
	default:
		break;
	}
}
EXPORT_SYMBOL_GPL(rt2x00queue_unpause_queue);

void rt2x00queue_start_queue(struct data_queue *queue)
{
	mutex_lock(&queue->status_lock);

	if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
	    test_and_set_bit(QUEUE_STARTED, &queue->flags)) {
		mutex_unlock(&queue->status_lock);
		return;
	}

	set_bit(QUEUE_PAUSED, &queue->flags);

	queue->rt2x00dev->ops->lib->start_queue(queue);

	rt2x00queue_unpause_queue(queue);

	mutex_unlock(&queue->status_lock);
}
EXPORT_SYMBOL_GPL(rt2x00queue_start_queue);

void rt2x00queue_stop_queue(struct data_queue *queue)
{
	mutex_lock(&queue->status_lock);

	if (!test_and_clear_bit(QUEUE_STARTED, &queue->flags)) {
		mutex_unlock(&queue->status_lock);
		return;
	}

	rt2x00queue_pause_queue_nocheck(queue);

	queue->rt2x00dev->ops->lib->stop_queue(queue);

	mutex_unlock(&queue->status_lock);
}
EXPORT_SYMBOL_GPL(rt2x00queue_stop_queue);

void rt2x00queue_flush_queue(struct data_queue *queue, bool drop)
{
	bool tx_queue =
		(queue->qid == QID_AC_VO) ||
		(queue->qid == QID_AC_VI) ||
		(queue->qid == QID_AC_BE) ||
		(queue->qid == QID_AC_BK);

	if (rt2x00queue_empty(queue))
		return;

	/*
	 * If we are not supposed to drop any pending
	 * frames, this means we must force a start (=kick)
	 * to the queue to make sure the hardware will
	 * start transmitting.
	 */
	if (!drop && tx_queue)
		queue->rt2x00dev->ops->lib->kick_queue(queue);

	/*
	 * Check if driver supports flushing, if that is the case we can
	 * defer the flushing to the driver. Otherwise we must use the
	 * alternative which just waits for the queue to become empty.
	 */
	if (likely(queue->rt2x00dev->ops->lib->flush_queue))
		queue->rt2x00dev->ops->lib->flush_queue(queue, drop);

	/*
	 * The queue flush has failed...
	 */
	if (unlikely(!rt2x00queue_empty(queue)))
		rt2x00_warn(queue->rt2x00dev, "Queue %d failed to flush\n",
			    queue->qid);
}
EXPORT_SYMBOL_GPL(rt2x00queue_flush_queue);

void rt2x00queue_start_queues(struct rt2x00_dev *rt2x00dev)
{
	struct data_queue *queue;

	/*
	 * rt2x00queue_start_queue will call ieee80211_wake_queue
	 * for each queue after is has been properly initialized.
	 */
	tx_queue_for_each(rt2x00dev, queue)
		rt2x00queue_start_queue(queue);

	rt2x00queue_start_queue(rt2x00dev->rx);
}
EXPORT_SYMBOL_GPL(rt2x00queue_start_queues);

void rt2x00queue_stop_queues(struct rt2x00_dev *rt2x00dev)
{
	struct data_queue *queue;

	/*
	 * rt2x00queue_stop_queue will call ieee80211_stop_queue
	 * as well, but we are completely shutting doing everything
	 * now, so it is much safer to stop all TX queues at once,
	 * and use rt2x00queue_stop_queue for cleaning up.
	 */
	ieee80211_stop_queues(rt2x00dev->hw);

	tx_queue_for_each(rt2x00dev, queue)
		rt2x00queue_stop_queue(queue);

	rt2x00queue_stop_queue(rt2x00dev->rx);
}
EXPORT_SYMBOL_GPL(rt2x00queue_stop_queues);

void rt2x00queue_flush_queues(struct rt2x00_dev *rt2x00dev, bool drop)
{
	struct data_queue *queue;

	tx_queue_for_each(rt2x00dev, queue)
		rt2x00queue_flush_queue(queue, drop);

	rt2x00queue_flush_queue(rt2x00dev->rx, drop);
}
EXPORT_SYMBOL_GPL(rt2x00queue_flush_queues);

static void rt2x00queue_reset(struct data_queue *queue)
{
	unsigned long irqflags;
	unsigned int i;

	spin_lock_irqsave(&queue->index_lock, irqflags);

	queue->count = 0;
	queue->length = 0;

	for (i = 0; i < Q_INDEX_MAX; i++)
		queue->index[i] = 0;

	spin_unlock_irqrestore(&queue->index_lock, irqflags);
}

void rt2x00queue_init_queues(struct rt2x00_dev *rt2x00dev)
{
	struct data_queue *queue;
	unsigned int i;

	queue_for_each(rt2x00dev, queue) {
		rt2x00queue_reset(queue);

		for (i = 0; i < queue->limit; i++)
			rt2x00dev->ops->lib->clear_entry(&queue->entries[i]);
	}
}

static int rt2x00queue_alloc_entries(struct data_queue *queue)
{
	struct queue_entry *entries;
	unsigned int entry_size;
	unsigned int i;

	rt2x00queue_reset(queue);

	/*
	 * Allocate all queue entries.
	 */
	entry_size = sizeof(*entries) + queue->priv_size;
	entries = kcalloc(queue->limit, entry_size, GFP_KERNEL);
	if (!entries)
		return -ENOMEM;

#define QUEUE_ENTRY_PRIV_OFFSET(__base, __index, __limit, __esize, __psize) \
	(((char *)(__base)) + ((__limit) * (__esize)) + \
	    ((__index) * (__psize)))

	for (i = 0; i < queue->limit; i++) {
		entries[i].flags = 0;
		entries[i].queue = queue;
		entries[i].skb = NULL;
		entries[i].entry_idx = i;
		entries[i].priv_data =
		    QUEUE_ENTRY_PRIV_OFFSET(entries, i, queue->limit,
					    sizeof(*entries), queue->priv_size);
	}

#undef QUEUE_ENTRY_PRIV_OFFSET

	queue->entries = entries;

	return 0;
}

static void rt2x00queue_free_skbs(struct data_queue *queue)
{
	unsigned int i;

	if (!queue->entries)
		return;

	for (i = 0; i < queue->limit; i++) {
		rt2x00queue_free_skb(&queue->entries[i]);
	}
}

static int rt2x00queue_alloc_rxskbs(struct data_queue *queue)
{
	unsigned int i;
	struct sk_buff *skb;

	for (i = 0; i < queue->limit; i++) {
		skb = rt2x00queue_alloc_rxskb(&queue->entries[i], GFP_KERNEL);
		if (!skb)
			return -ENOMEM;
		queue->entries[i].skb = skb;
	}

	return 0;
}

int rt2x00queue_initialize(struct rt2x00_dev *rt2x00dev)
{
	struct data_queue *queue;
	int status;

	status = rt2x00queue_alloc_entries(rt2x00dev->rx);
	if (status)
		goto exit;

	tx_queue_for_each(rt2x00dev, queue) {
		status = rt2x00queue_alloc_entries(queue);
		if (status)
			goto exit;
	}

	status = rt2x00queue_alloc_entries(rt2x00dev->bcn);
	if (status)
		goto exit;

	if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_ATIM_QUEUE)) {
		status = rt2x00queue_alloc_entries(rt2x00dev->atim);
		if (status)
			goto exit;
	}

	status = rt2x00queue_alloc_rxskbs(rt2x00dev->rx);
	if (status)
		goto exit;

	return 0;

exit:
	rt2x00_err(rt2x00dev, "Queue entries allocation failed\n");

	rt2x00queue_uninitialize(rt2x00dev);

	return status;
}

void rt2x00queue_uninitialize(struct rt2x00_dev *rt2x00dev)
{
	struct data_queue *queue;

	rt2x00queue_free_skbs(rt2x00dev->rx);

	queue_for_each(rt2x00dev, queue) {
		kfree(queue->entries);
		queue->entries = NULL;
	}
}

static void rt2x00queue_init(struct rt2x00_dev *rt2x00dev,
			     struct data_queue *queue, enum data_queue_qid qid)
{
	mutex_init(&queue->status_lock);
	spin_lock_init(&queue->tx_lock);
	spin_lock_init(&queue->index_lock);

	queue->rt2x00dev = rt2x00dev;
	queue->qid = qid;
	queue->txop = 0;
	queue->aifs = 2;
	queue->cw_min = 5;
	queue->cw_max = 10;

	rt2x00dev->ops->queue_init(queue);

	queue->threshold = DIV_ROUND_UP(queue->limit, 10);
}

int rt2x00queue_allocate(struct rt2x00_dev *rt2x00dev)
{
	struct data_queue *queue;
	enum data_queue_qid qid;
	unsigned int req_atim =
	    rt2x00_has_cap_flag(rt2x00dev, REQUIRE_ATIM_QUEUE);

	/*
	 * We need the following queues:
	 * RX: 1
	 * TX: ops->tx_queues
	 * Beacon: 1
	 * Atim: 1 (if required)
	 */
	rt2x00dev->data_queues = 2 + rt2x00dev->ops->tx_queues + req_atim;

	queue = kzalloc_objs(*queue, rt2x00dev->data_queues);
	if (!queue)
		return -ENOMEM;

	/*
	 * Initialize pointers
	 */
	rt2x00dev->rx = queue;
	rt2x00dev->tx = &queue[1];
	rt2x00dev->bcn = &queue[1 + rt2x00dev->ops->tx_queues];
	rt2x00dev->atim = req_atim ? &queue[2 + rt2x00dev->ops->tx_queues] : NULL;

	/*
	 * Initialize queue parameters.
	 * RX: qid = QID_RX
	 * TX: qid = QID_AC_VO + index
	 * TX: cw_min: 2^5 = 32.
	 * TX: cw_max: 2^10 = 1024.
	 * BCN: qid = QID_BEACON
	 * ATIM: qid = QID_ATIM
	 */
	rt2x00queue_init(rt2x00dev, rt2x00dev->rx, QID_RX);

	qid = QID_AC_VO;
	tx_queue_for_each(rt2x00dev, queue)
		rt2x00queue_init(rt2x00dev, queue, qid++);

	rt2x00queue_init(rt2x00dev, rt2x00dev->bcn, QID_BEACON);
	if (req_atim)
		rt2x00queue_init(rt2x00dev, rt2x00dev->atim, QID_ATIM);

	return 0;
}

void rt2x00queue_free(struct rt2x00_dev *rt2x00dev)
{
	kfree(rt2x00dev->rx);
	rt2x00dev->rx = NULL;
	rt2x00dev->tx = NULL;
	rt2x00dev->bcn = NULL;
}
]

gemini-3-flash-preview

							input: 85941
							output: 26
							thoughts: 484
						

**Deconstructing the DMA Queue Allocation in rt2x00usb**

Alright, I think I'm starting to grasp this. `rt2x00queue_allocate` is setting up the `data_queue` structures, and then `rt2x00queue_initialize`, which is called later, is responsible for calling `rt2x00queue_alloc_entries`, which allocates the `queue->entries`.

But wait a minute, I'm seeing `rt2x00usb_initialize` also calling something called `rt2x00usb_alloc_entries`. Now, `rt2x00lib_initialize` isn't called by `rt2x00usb_initialize`... is it? Let me just double check `rt2x00usb_initialize` in `rt2x00usb.c`:

```c
int rt2x00usb_initialize(struct rt2x00_dev *rt2x00dev)
{
...
	/*
	 * Allocate DMA
	 */
	queue_for_each(rt2x00dev, queue) {
		status = rt2x00usb_alloc_entries(queue);
		if (status)
			goto exit;
	}
...
```

Right, there it is. And here's the code for `rt2x00usb_alloc_entries`:

```c
static int rt2x00usb_alloc_entries(struct data_queue *queue)
{
...
	for (i = 0; i < queue->limit; i++) {
		entry_priv = queue->entries[i].priv_data;
		entry_priv->urb = usb_alloc_urb(0, GFP_KERNEL);
...
```

Hang on a second... This means `queue->entries` must already be allocated *before* `rt2x00usb_alloc_entries` is even called! So, where is this allocation happening? Let's trace it back to `rt2x00lib_probe_dev`:

```c
1444:		retval = rt2x00queue_allocate(rt2x00dev);
```

Okay, but `rt2x00queue_allocate` *only* allocates the `data_queue` structs, not the `entries`. Hmm... I think I overlooked something. Ah, right! I missed `rt2x00queue_initialize`. Now where is `rt2x00queue_initialize` called?

map[Name:rt2x00queue_initialize]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:rt2x00lib_initialize SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c SourceLine:1250]] TruncatedOutput:false]

gemini-3-flash-preview

							input: 87097
							output: 60
							thoughts: 14
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Analyzing `rt2x00lib_initialize`**

Alright, let's dive into the `rt2x00lib_initialize` function. First instinct is to dissect its purpose and where it sits within the broader `rt2x00` architecture. Is it a module initialization, a device-specific setup, or perhaps a more generic framework initialization? Thinking about the name, "lib" suggests it's likely a supporting function for the broader `rt2x00` driver suite, but I need to quickly confirm that in the code. I immediately start mentally running through the typical initialization phases for a wireless driver: resource allocation, register setup, interrupt configuration, perhaps some basic hardware probing or configuration based on the attached device. Is it handling PCI/USB/SDIO enumeration? Are we dealing with any firmware loading here, or is that handled elsewhere in the chain? I'll need to check the call graph to see what comes before and after this function call. I need to understand its role in the driver's overall initialization process. I'll need to look at what data structures are being passed, particularly the device context and any configuration parameters. Does it have any error handling and how robust is it? I want to see if it gracefully handles potential hardware problems or configuration conflicts. Ultimately, I'm expecting this function to lay the groundwork for the more specialized functions that come later in the device driver chain.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00lib_initialize]

map[SourceCode:1240:	static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev)
1241:	{
1242:		int status;
1243:	
1244:		if (test_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags))
1245:			return 0;
1246:	
1247:		/*
1248:		 * Allocate all queue entries.
1249:		 */
1250:		status = rt2x00queue_initialize(rt2x00dev);
1251:		if (status)
1252:			return status;
1253:	
1254:		/*
1255:		 * Initialize the device.
1256:		 */
1257:		status = rt2x00dev->ops->lib->initialize(rt2x00dev);
1258:		if (status) {
1259:			rt2x00queue_uninitialize(rt2x00dev);
1260:			return status;
1261:		}
1262:	
1263:		set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags);
1264:	
1265:		/*
1266:		 * Start rfkill polling.
1267:		 */
1268:		if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
1269:			rt2x00rfkill_register(rt2x00dev);
1270:	
1271:		return 0;
1272:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c]

gemini-3-flash-preview

							input: 87987
							output: 64
							thoughts: 222
						

**Analyzing a Potential Crash in the rt2x00 USB Driver**

Okay, so I'm tracking down a crash, and I'm starting by understanding the initialization sequence. I see that the USB-specific initialization, `rt2x00usb_initialize`, is called after `rt2x00queue_initialize`, which seems correct based on the call stack: `rt2x00dev->ops->lib->initialize(rt2x00dev)`. That's not the source of the crash.

Wait a second… the user just pointed out that the `strace` output shows some threads got killed by a SIGKILL signal! That's a huge clue. I should be looking at the `strace` output more carefully now.

Without the trace, I'd usually lean on my accumulated knowledge of the codebase, my "memory" as it were, but I need to use the available information. I can't just magically "know" the problem. I need to be methodical.

Let's see… any other related files in the `drivers/net/wireless/ralink/rt2x00/` directory that might be relevant? Possibly `rt2x00usb.c`, because the crash involves USB. There could be issues with Universal Resource Block (URB) submission.

I should examine `rt2x00usb_kick_rx_entry` now, maybe that's where the problem is.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_kick_rx_entry]

map[SourceCode: 399:	static bool rt2x00usb_kick_rx_entry(struct queue_entry *entry, void *data)
 400:	{
 401:		struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
 402:		struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev);
 403:		struct queue_entry_priv_usb *entry_priv = entry->priv_data;
 404:		int status;
 405:	
 406:		if (test_and_set_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
 407:			return false;
 408:	
 409:		rt2x00lib_dmastart(entry);
 410:	
 411:		usb_fill_bulk_urb(entry_priv->urb, usb_dev,
 412:				  usb_rcvbulkpipe(usb_dev, entry->queue->usb_endpoint),
 413:				  entry->skb->data, entry->skb->len,
 414:				  rt2x00usb_interrupt_rxdone, entry);
 415:	
 416:		status = usb_submit_urb(entry_priv->urb, GFP_ATOMIC);
 417:		if (status) {
 418:			if (rt2x00usb_check_usb_error(rt2x00dev, status))
 419:				clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
 420:			set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
 421:			rt2x00lib_dmadone(entry);
 422:		}
 423:	
 424:		return false;
 425:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3-flash-preview

							input: 89133
							output: 64
							thoughts: 1209
						

**Analyzing Potential USB Driver Issues**

Okay, let's break this down. First, I'm tracing data flow. Looking at `entry->skb->data` within `rt2x00queue_alloc_rxskbs` and `rt2x00queue_alloc_rxskb`, it looks like we're allocating receive SKBs using `__dev_alloc_skb`, which calls `netdev_alloc_skb` which, in turn, uses `kmalloc` (or page allocator). That suggests DMA-able memory.

Next, I found something in `rt2500usb_write_beacon`. There's `bcn_priv->guardian_data` being used with `usb_fill_bulk_urb` and submitted with `usb_submit_urb`. `bcn_priv` comes from `struct queue_entry_priv_usb_bcn`, and I see that this private data is allocated as part of `entries` within `rt2x00queue_alloc_entries` via `kcalloc`. Since the entries are allocated with `kcalloc`, `&bcn_priv->guardian_data` should also be DMA-able. I should check for any other `usb_submit_urb` calls though.

Then, there's `rt2500usb_register_read`. This one's interesting. I saw `rt2x00usb_vendor_request_buff` being used, and I know it uses `rt2x00dev->csr.cache`. But what if `rt2x00dev->csr.cache` is NULL? I know it's allocated in `rt2x00usb_alloc_reg`, so it should be valid unless it's not initialized correctly, or gets freed somewhere.

The user's question, "Is there a kernel crash hidden in the strace output, or is the crash something else?" brings up an interesting point. If the strace shows `exit_group(67)` followed by "killed by SIGKILL," that indicates a potential issue. Normally, `exit_group` should terminate the process. If it's *also* killed by SIGKILL, it strongly suggests a kernel panic during the execution, and the syzkaller executor was killed by the manager. However, the lack of a kernel panic message is odd.

Remembering a similar issue, `rt2x00usb_vendor_request` uses `usb_control_msg`. Going back to that, I see:
```c
  62:			status = usb_control_msg(usb_dev, pipe, request, requesttype,
  63:						 value, offset, buffer, buffer_length,
  64:						 timeout / 2);
```
If `buffer` is NULL and `buffer_length` is 0, then the `usb_control_msg` is fine.

Finally, I'll search for `rt2500usb` and `idProduct=0x6869` – it's MSI. Now, I should search for "rt2x00usb" and "NULL pointer dereference" to see if anything comes up. I should also check out `rt2x00usb_work_rxdone`.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_work_rxdone]

map[SourceCode: 341:	/*
 342:	 * RX data handlers.
 343:	 */
 344:	static void rt2x00usb_work_rxdone(struct work_struct *work)
 345:	{
 346:		struct rt2x00_dev *rt2x00dev =
 347:		    container_of(work, struct rt2x00_dev, rxdone_work);
 348:		struct queue_entry *entry;
 349:		struct skb_frame_desc *skbdesc;
 350:		u8 rxd[32];
 351:	
 352:		while (!rt2x00queue_empty(rt2x00dev->rx)) {
 353:			entry = rt2x00queue_get_entry(rt2x00dev->rx, Q_INDEX_DONE);
 354:	
 355:			if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
 356:				break;
 357:	
 358:			/*
 359:			 * Fill in desc fields of the skb descriptor
 360:			 */
 361:			skbdesc = get_skb_frame_desc(entry->skb);
 362:			skbdesc->desc = rxd;
 363:			skbdesc->desc_len = entry->queue->desc_size;
 364:	
 365:			/*
 366:			 * Send the frame to rt2x00lib for further processing.
 367:			 */
 368:			rt2x00lib_rxdone(entry, GFP_KERNEL);
 369:		}
 370:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3-flash-preview

							input: 91628
							output: 62
							thoughts: 67
						

Here's my summary, as though I'm thinking through this code:

**RX Path Debug - Stack Considerations**

Okay, hold on a second... that `u8 rxd[32];` buffer... that's declared *on the stack*. My initial concern is that it's being directly assigned to `skbdesc->desc`, then we're calling `rt2x00lib_rxdone(entry, GFP_KERNEL);`. The question that immediately jumps to mind is, what exactly *is* happening within `rt2x00lib_rxdone`? We have a stack-allocated buffer being passed down the line, and if that function isn't carefully designed, we could easily run into problems with the buffer going out of scope. We're in the critical path here. I need to understand what that `rt2x00lib_rxdone` function is doing with that `rxd` data. Does it copy it? Does it reference it? Does it free it? This is where the potential for a nasty, subtle bug lies, especially given the kernel memory context and the `GFP_KERNEL` allocation flag. Time to dig into that `rt2x00lib_rxdone` function. We need to verify that it's handling this stack-allocated data correctly, and that this setup won't cause memory corruption or use-after-free issues down the line.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00lib_rxdone]

map[SourceCode: 737:	void rt2x00lib_rxdone(struct queue_entry *entry, gfp_t gfp)
 738:	{
 739:		struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
 740:		struct rxdone_entry_desc rxdesc;
 741:		struct sk_buff *skb;
 742:		struct ieee80211_rx_status *rx_status;
 743:		unsigned int header_length;
 744:		int rate_idx;
 745:	
 746:		if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) ||
 747:		    !test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
 748:			goto submit_entry;
 749:	
 750:		if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags))
 751:			goto submit_entry;
 752:	
 753:		/*
 754:		 * Allocate a new sk_buffer. If no new buffer available, drop the
 755:		 * received frame and reuse the existing buffer.
 756:		 */
 757:		skb = rt2x00queue_alloc_rxskb(entry, gfp);
 758:		if (!skb)
 759:			goto submit_entry;
 760:	
 761:		/*
 762:		 * Unmap the skb.
 763:		 */
 764:		rt2x00queue_unmap_skb(entry);
 765:	
 766:		/*
 767:		 * Extract the RXD details.
 768:		 */
 769:		memset(&rxdesc, 0, sizeof(rxdesc));
 770:		rt2x00dev->ops->lib->fill_rxdone(entry, &rxdesc);
 771:	
 772:		/*
 773:		 * Check for valid size in case we get corrupted descriptor from
 774:		 * hardware.
 775:		 */
 776:		if (unlikely(rxdesc.size == 0 ||
 777:			     rxdesc.size > entry->queue->data_size)) {
 778:			rt2x00_err(rt2x00dev, "Wrong frame size %d max %d\n",
 779:				   rxdesc.size, entry->queue->data_size);
 780:			dev_kfree_skb(entry->skb);
 781:			goto renew_skb;
 782:		}
 783:	
 784:		/*
 785:		 * The data behind the ieee80211 header must be
 786:		 * aligned on a 4 byte boundary.
 787:		 */
 788:		header_length = ieee80211_get_hdrlen_from_skb(entry->skb);
 789:	
 790:		/*
 791:		 * Hardware might have stripped the IV/EIV/ICV data,
 792:		 * in that case it is possible that the data was
 793:		 * provided separately (through hardware descriptor)
 794:		 * in which case we should reinsert the data into the frame.
 795:		 */
 796:		if ((rxdesc.dev_flags & RXDONE_CRYPTO_IV) &&
 797:		    (rxdesc.flags & RX_FLAG_IV_STRIPPED))
 798:			rt2x00crypto_rx_insert_iv(entry->skb, header_length,
 799:						  &rxdesc);
 800:		else if (header_length &&
 801:			 (rxdesc.size > header_length) &&
 802:			 (rxdesc.dev_flags & RXDONE_L2PAD))
 803:			rt2x00queue_remove_l2pad(entry->skb, header_length);
 804:	
 805:		/* Trim buffer to correct size */
 806:		skb_trim(entry->skb, rxdesc.size);
 807:	
 808:		/*
 809:		 * Translate the signal to the correct bitrate index.
 810:		 */
 811:		rate_idx = rt2x00lib_rxdone_read_signal(rt2x00dev, &rxdesc);
 812:		if (rxdesc.rate_mode == RATE_MODE_HT_MIX ||
 813:		    rxdesc.rate_mode == RATE_MODE_HT_GREENFIELD)
 814:			rxdesc.encoding = RX_ENC_HT;
 815:	
 816:		/*
 817:		 * Check if this is a beacon, and more frames have been
 818:		 * buffered while we were in powersaving mode.
 819:		 */
 820:		rt2x00lib_rxdone_check_ps(rt2x00dev, entry->skb, &rxdesc);
 821:	
 822:		/*
 823:		 * Check for incoming BlockAcks to match to the BlockAckReqs
 824:		 * we've send out.
 825:		 */
 826:		rt2x00lib_rxdone_check_ba(rt2x00dev, entry->skb, &rxdesc);
 827:	
 828:		/*
 829:		 * Update extra components
 830:		 */
 831:		rt2x00link_update_stats(rt2x00dev, entry->skb, &rxdesc);
 832:		rt2x00debug_update_crypto(rt2x00dev, &rxdesc);
 833:		rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_RXDONE, entry);
 834:	
 835:		/*
 836:		 * Initialize RX status information, and send frame
 837:		 * to mac80211.
 838:		 */
 839:		rx_status = IEEE80211_SKB_RXCB(entry->skb);
 840:	
 841:		/* Ensure that all fields of rx_status are initialized
 842:		 * properly. The skb->cb array was used for driver
 843:		 * specific informations, so rx_status might contain
 844:		 * garbage.
 845:		 */
 846:		memset(rx_status, 0, sizeof(*rx_status));
 847:	
 848:		rx_status->mactime = rxdesc.timestamp;
 849:		rx_status->band = rt2x00dev->curr_band;
 850:		rx_status->freq = rt2x00dev->curr_freq;
 851:		rx_status->rate_idx = rate_idx;
 852:		rx_status->signal = rxdesc.rssi;
 853:		rx_status->flag = rxdesc.flags;
 854:		rx_status->enc_flags = rxdesc.enc_flags;
 855:		rx_status->encoding = rxdesc.encoding;
 856:		rx_status->bw = rxdesc.bw;
 857:		rx_status->antenna = rt2x00dev->link.ant.active.rx;
 858:	
 859:		ieee80211_rx_ni(rt2x00dev->hw, entry->skb);
 860:	
 861:	renew_skb:
 862:		/*
 863:		 * Replace the skb with the freshly allocated one.
 864:		 */
 865:		entry->skb = skb;
 866:	
 867:	submit_entry:
 868:		entry->flags = 0;
 869:		rt2x00queue_index_inc(entry, Q_INDEX_DONE);
 870:		if (test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) &&
 871:		    test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
 872:			rt2x00dev->ops->lib->clear_entry(entry);
 873:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c]

gemini-3-flash-preview

							input: 94379
							output: 58
							thoughts: 2380
						

**Bug Found: Stack Use-After-Free in RT2x00 USB Driver**

Okay, here's the breakdown of my thinking: I started by tracing the `rt2x00dev->ops->lib->fill_rxdone` call within the `rt2500usb.c` file. My initial thought was to understand how the receive descriptor (`rxd`) is handled. I noticed the `memcpy` operation copying data from an `rxd` pointer (derived from `urb->actual_length` and `desc_size` into the `skbdesc->desc` buffer. I immediately questioned the safety of this, particularly if `actual_length` was smaller than `desc_size` which would result in an out-of-bounds read. I then checked `rt2500usb_queue_init` and saw that `desc_size` is fixed at 16, while the `actual_length` is the length of the USB packet.

I went back and traced the location of `skbdesc->desc` (local variable on the stack in `rt2x00usb_work_rxdone`). I carefully considered how it's used in `rt2500usb_fill_rxdone`, and it seemed fine because the stack remains valid during the copy.

Then I realized a critical detail: the `entry->skb` is replaced with a *new* skb, *after* passing the old skb (`entry->skb`) to `ieee80211_rx_ni`. This is where the stack use-after-free vulnerability arises. `skbdesc->desc` points to a local variable on the stack in `rt2x00usb_work_rxdone`. Once `ieee80211_rx_ni` receives the old skb which references a stack variable, the stack is released and any access to `skbdesc->desc` after `rt2x00usb_work_rxdone` returns will lead to a use-after-free error. I checked that `mac80211` uses the `skb->cb` field and concluded that a crash will likely happen.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:skb_frame_desc]

map[SourceCode:  79:	/**
  80:	 * struct skb_frame_desc: Descriptor information for the skb buffer
  81:	 *
  82:	 * This structure is placed over the driver_data array, this means that
  83:	 * this structure should not exceed the size of that array (40 bytes).
  84:	 *
  85:	 * @flags: Frame flags, see &enum skb_frame_desc_flags.
  86:	 * @desc_len: Length of the frame descriptor.
  87:	 * @tx_rate_idx: the index of the TX rate, used for TX status reporting
  88:	 * @tx_rate_flags: the TX rate flags, used for TX status reporting
  89:	 * @desc: Pointer to descriptor part of the frame.
  90:	 *	Note that this pointer could point to something outside
  91:	 *	of the scope of the skb->data pointer.
  92:	 * @iv: IV/EIV data used during encryption/decryption.
  93:	 * @skb_dma: (PCI-only) the DMA address associated with the sk buffer.
  94:	 * @sta: The station where sk buffer was sent.
  95:	 */
  96:	struct skb_frame_desc {
  97:		u8 flags;
  98:	
  99:		u8 desc_len;
 100:		u8 tx_rate_idx;
 101:		u8 tx_rate_flags;
 102:	
 103:		void *desc;
 104:	
 105:		__le32 iv[2];
 106:	
 107:		dma_addr_t skb_dma;
 108:		struct ieee80211_sta *sta;
 109:	};
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00queue.h]

gemini-3-flash-preview

							input: 97812
							output: 62
							thoughts: 159
						

**Analyzing a Potential Memory Issue**

Okay, so I'm looking at this code and something is immediately catching my eye. Specifically, I'm concerned about how `desc` is being handled. I see that `desc` is declared as a `void *`, which immediately makes me think, "Hmm, that could get tricky." I'm diving into `rt2x00usb_work_rxdone` and spotting that `desc` is assigned `rxd`, which is a stack-allocated buffer of 32 bytes. That's definitely interesting.

My thinking is, if `rt2x00lib_rxdone` is going to call `rt2x00debug_dump_frame` and it looks like `rt2x00debug_dump_frame` is using `skbdesc->desc`, which we just established is pointing to the stack. Now I *really* need to know what's happening. I'm going to have to check `rt2x00debug_dump_frame` immediately, because this is going to be the critical part, I don't want a use-after-free situation on the stack.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00debug_dump_frame]

map[SourceCode:1418:	static inline void rt2x00debug_dump_frame(struct rt2x00_dev *rt2x00dev,
1419:						  enum rt2x00_dump_type type,
1420:						  struct queue_entry *entry)
1421:	{
1422:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00.h]

gemini-3-flash-preview

							input: 98416
							output: 62
							thoughts: 89
						

Okay, let me think this through.

**Analyzing a Potential Debug Feature Discrepancy**

Hmm, this looks odd. It seems like the code indicates an empty inline function if `CONFIG_RT2X00_LIB_DEBUGFS` isn't enabled. That makes sense, a debug feature should ideally be disabled when the core debug features are turned off. But... what if it *is* set? This feels like it might be relevant because the user is leveraging a syzkaller reproducer. Syzkaller is notorious for aggressively enabling numerous config options during fuzzing. It's highly probable that `CONFIG_RT2X00_LIB_DEBUGFS` *is* enabled in this specific scenario.

Alright, time to get to the core of the issue. I need to examine the actual implementation of `rt2x00debug_dump_frame` in `rt2x00debug.c`. Let's see how it behaves when the debug filesystem support *is* available. I need to understand what's supposed to be happening there to determine if there's a problem or not. This smells like a subtle conditional compilation issue, where the expected behavior diverges based on the config.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00debug_dump_frame]

map[SourceCode:1418:	static inline void rt2x00debug_dump_frame(struct rt2x00_dev *rt2x00dev,
1419:						  enum rt2x00_dump_type type,
1420:						  struct queue_entry *entry)
1421:	{
1422:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00.h]

gemini-3-flash-preview

							input: 98952
							output: 38
							thoughts: 32
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Diving into the RT2x00 Debug Code**

Okay, first things first, I need to zero in on the debugging code within the RT2x00 driver. Specifically, that file: `drivers/net/wireless/ralink/rt2x00/rt2x00debug.c`. This is usually the first place to look for any insight when I'm chasing down issues within these Ralink-based wireless devices. I'm expecting to find the standard debug flags, print statements, and perhaps some instrumentation hooks that can illuminate what's actually happening at the lower levels. It's the go-to resource to see what information the driver is *trying* to tell us, assuming the debug flags are set up correctly of course! Let's see what gems are hidden in there. Hopefully the comments are half-decent.

map[File:drivers/net/wireless/ralink/rt2x00/rt2x00debug.c]

map[Contents:// SPDX-License-Identifier: GPL-2.0-or-later
/*
	Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
	<http://rt2x00.serialmonkey.com>

 */

/*
	Module: rt2x00lib
	Abstract: rt2x00 debugfs specific routines.
 */

#include <linux/debugfs.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/poll.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/uaccess.h>

#include "rt2x00.h"
#include "rt2x00lib.h"
#include "rt2x00dump.h"

#define MAX_LINE_LENGTH 64

struct rt2x00debug_crypto {
	unsigned long success;
	unsigned long icv_error;
	unsigned long mic_error;
	unsigned long key_error;
};

struct rt2x00debug_intf {
	/*
	 * Pointer to driver structure where
	 * this debugfs entry belongs to.
	 */
	struct rt2x00_dev *rt2x00dev;

	/*
	 * Reference to the rt2x00debug structure
	 * which can be used to communicate with
	 * the registers.
	 */
	const struct rt2x00debug *debug;

	/*
	 * Debugfs entries for:
	 * - driver folder
	 *   - driver file
	 *   - chipset file
	 *   - device state flags file
	 *   - device capability flags file
	 *   - hardware restart file
	 *   - register folder
	 *     - csr offset/value files
	 *     - eeprom offset/value files
	 *     - bbp offset/value files
	 *     - rf offset/value files
	 *     - rfcsr offset/value files
	 *   - queue folder
	 *     - frame dump file
	 *     - queue stats file
	 *     - crypto stats file
	 */
	struct dentry *driver_folder;

	/*
	 * The frame dump file only allows a single reader,
	 * so we need to store the current state here.
	 */
	unsigned long frame_dump_flags;
#define FRAME_DUMP_FILE_OPEN	1

	/*
	 * We queue each frame before dumping it to the user,
	 * per read command we will pass a single skb structure
	 * so we should be prepared to queue multiple sk buffers
	 * before sending it to userspace.
	 */
	struct sk_buff_head frame_dump_skbqueue;
	wait_queue_head_t frame_dump_waitqueue;

	/*
	 * HW crypto statistics.
	 * All statistics are stored separately per cipher type.
	 */
	struct rt2x00debug_crypto crypto_stats[CIPHER_MAX];

	/*
	 * Driver and chipset files will use a data buffer
	 * that has been created in advance. This will simplify
	 * the code since we can use the debugfs functions.
	 */
	struct debugfs_blob_wrapper driver_blob;
	struct debugfs_blob_wrapper chipset_blob;

	/*
	 * Requested offset for each register type.
	 */
	unsigned int offset_csr;
	unsigned int offset_eeprom;
	unsigned int offset_bbp;
	unsigned int offset_rf;
	unsigned int offset_rfcsr;
};

void rt2x00debug_update_crypto(struct rt2x00_dev *rt2x00dev,
			       struct rxdone_entry_desc *rxdesc)
{
	struct rt2x00debug_intf *intf = rt2x00dev->debugfs_intf;
	enum cipher cipher = rxdesc->cipher;
	enum rx_crypto status = rxdesc->cipher_status;

	if (cipher == CIPHER_TKIP_NO_MIC)
		cipher = CIPHER_TKIP;
	if (cipher == CIPHER_NONE || cipher >= CIPHER_MAX)
		return;

	/* Remove CIPHER_NONE index */
	cipher--;

	intf->crypto_stats[cipher].success += (status == RX_CRYPTO_SUCCESS);
	intf->crypto_stats[cipher].icv_error += (status == RX_CRYPTO_FAIL_ICV);
	intf->crypto_stats[cipher].mic_error += (status == RX_CRYPTO_FAIL_MIC);
	intf->crypto_stats[cipher].key_error += (status == RX_CRYPTO_FAIL_KEY);
}

void rt2x00debug_dump_frame(struct rt2x00_dev *rt2x00dev,
			    enum rt2x00_dump_type type, struct queue_entry *entry)
{
	struct rt2x00debug_intf *intf = rt2x00dev->debugfs_intf;
	struct sk_buff *skb = entry->skb;
	struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
	struct sk_buff *skbcopy;
	struct rt2x00dump_hdr *dump_hdr;
	struct timespec64 timestamp;
	u32 data_len;

	if (likely(!test_bit(FRAME_DUMP_FILE_OPEN, &intf->frame_dump_flags)))
		return;

	ktime_get_ts64(&timestamp);

	if (skb_queue_len(&intf->frame_dump_skbqueue) > 20) {
		rt2x00_dbg(rt2x00dev, "txrx dump queue length exceeded\n");
		return;
	}

	data_len = skb->len;
	if (skbdesc->flags & SKBDESC_DESC_IN_SKB)
		data_len -= skbdesc->desc_len;

	skbcopy = alloc_skb(sizeof(*dump_hdr) + skbdesc->desc_len + data_len,
			    GFP_ATOMIC);
	if (!skbcopy) {
		rt2x00_dbg(rt2x00dev, "Failed to copy skb for dump\n");
		return;
	}

	dump_hdr = skb_put(skbcopy, sizeof(*dump_hdr));
	dump_hdr->version = cpu_to_le32(DUMP_HEADER_VERSION);
	dump_hdr->header_length = cpu_to_le32(sizeof(*dump_hdr));
	dump_hdr->desc_length = cpu_to_le32(skbdesc->desc_len);
	dump_hdr->data_length = cpu_to_le32(data_len);
	dump_hdr->chip_rt = cpu_to_le16(rt2x00dev->chip.rt);
	dump_hdr->chip_rf = cpu_to_le16(rt2x00dev->chip.rf);
	dump_hdr->chip_rev = cpu_to_le16(rt2x00dev->chip.rev);
	dump_hdr->type = cpu_to_le16(type);
	dump_hdr->queue_index = entry->queue->qid;
	dump_hdr->entry_index = entry->entry_idx;
	dump_hdr->timestamp_sec = cpu_to_le32(timestamp.tv_sec);
	dump_hdr->timestamp_usec = cpu_to_le32(timestamp.tv_nsec /
					       NSEC_PER_USEC);

	if (!(skbdesc->flags & SKBDESC_DESC_IN_SKB))
		skb_put_data(skbcopy, skbdesc->desc, skbdesc->desc_len);
	skb_put_data(skbcopy, skb->data, skb->len);

	skb_queue_tail(&intf->frame_dump_skbqueue, skbcopy);
	wake_up_interruptible(&intf->frame_dump_waitqueue);

	/*
	 * Verify that the file has not been closed while we were working.
	 */
	if (!test_bit(FRAME_DUMP_FILE_OPEN, &intf->frame_dump_flags))
		skb_queue_purge(&intf->frame_dump_skbqueue);
}
EXPORT_SYMBOL_GPL(rt2x00debug_dump_frame);

static int rt2x00debug_file_open(struct inode *inode, struct file *file)
{
	struct rt2x00debug_intf *intf = inode->i_private;

	file->private_data = inode->i_private;

	if (!try_module_get(intf->debug->owner))
		return -EBUSY;

	return 0;
}

static int rt2x00debug_file_release(struct inode *inode, struct file *file)
{
	struct rt2x00debug_intf *intf = file->private_data;

	module_put(intf->debug->owner);

	return 0;
}

static int rt2x00debug_open_queue_dump(struct inode *inode, struct file *file)
{
	struct rt2x00debug_intf *intf = inode->i_private;
	int retval;

	retval = rt2x00debug_file_open(inode, file);
	if (retval)
		return retval;

	if (test_and_set_bit(FRAME_DUMP_FILE_OPEN, &intf->frame_dump_flags)) {
		rt2x00debug_file_release(inode, file);
		return -EBUSY;
	}

	return 0;
}

static int rt2x00debug_release_queue_dump(struct inode *inode, struct file *file)
{
	struct rt2x00debug_intf *intf = inode->i_private;

	skb_queue_purge(&intf->frame_dump_skbqueue);

	clear_bit(FRAME_DUMP_FILE_OPEN, &intf->frame_dump_flags);

	return rt2x00debug_file_release(inode, file);
}

static ssize_t rt2x00debug_read_queue_dump(struct file *file,
					   char __user *buf,
					   size_t length,
					   loff_t *offset)
{
	struct rt2x00debug_intf *intf = file->private_data;
	struct sk_buff *skb;
	size_t status;
	int retval;

	if (file->f_flags & O_NONBLOCK)
		return -EAGAIN;

	retval =
	    wait_event_interruptible(intf->frame_dump_waitqueue,
				     (skb =
				     skb_dequeue(&intf->frame_dump_skbqueue)));
	if (retval)
		return retval;

	status = min_t(size_t, skb->len, length);
	if (copy_to_user(buf, skb->data, status)) {
		status = -EFAULT;
		goto exit;
	}

	*offset += status;

exit:
	kfree_skb(skb);

	return status;
}

static __poll_t rt2x00debug_poll_queue_dump(struct file *file,
						poll_table *wait)
{
	struct rt2x00debug_intf *intf = file->private_data;

	poll_wait(file, &intf->frame_dump_waitqueue, wait);

	if (!skb_queue_empty(&intf->frame_dump_skbqueue))
		return EPOLLOUT | EPOLLWRNORM;

	return 0;
}

static const struct file_operations rt2x00debug_fop_queue_dump = {
	.owner		= THIS_MODULE,
	.read		= rt2x00debug_read_queue_dump,
	.poll		= rt2x00debug_poll_queue_dump,
	.open		= rt2x00debug_open_queue_dump,
	.release	= rt2x00debug_release_queue_dump,
	.llseek		= default_llseek,
};

static ssize_t rt2x00debug_read_queue_stats(struct file *file,
					    char __user *buf,
					    size_t length,
					    loff_t *offset)
{
	struct rt2x00debug_intf *intf = file->private_data;
	struct data_queue *queue;
	unsigned long irqflags;
	unsigned int lines = 1 + intf->rt2x00dev->data_queues;
	size_t size;
	char *data;
	char *temp;

	if (*offset)
		return 0;

	data = kcalloc(lines, MAX_LINE_LENGTH, GFP_KERNEL);
	if (!data)
		return -ENOMEM;

	temp = data +
	    sprintf(data, "qid\tflags\t\tcount\tlimit\tlength\tindex\tdma done\tdone\n");

	queue_for_each(intf->rt2x00dev, queue) {
		spin_lock_irqsave(&queue->index_lock, irqflags);

		temp += sprintf(temp, "%d\t0x%.8x\t%d\t%d\t%d\t%d\t%d\t\t%d\n",
				queue->qid, (unsigned int)queue->flags,
				queue->count, queue->limit, queue->length,
				queue->index[Q_INDEX],
				queue->index[Q_INDEX_DMA_DONE],
				queue->index[Q_INDEX_DONE]);

		spin_unlock_irqrestore(&queue->index_lock, irqflags);
	}

	size = strlen(data);
	size = min(size, length);

	if (copy_to_user(buf, data, size)) {
		kfree(data);
		return -EFAULT;
	}

	kfree(data);

	*offset += size;
	return size;
}

static const struct file_operations rt2x00debug_fop_queue_stats = {
	.owner		= THIS_MODULE,
	.read		= rt2x00debug_read_queue_stats,
	.open		= rt2x00debug_file_open,
	.release	= rt2x00debug_file_release,
	.llseek		= default_llseek,
};

#ifdef CONFIG_RT2X00_LIB_CRYPTO
static ssize_t rt2x00debug_read_crypto_stats(struct file *file,
					     char __user *buf,
					     size_t length,
					     loff_t *offset)
{
	struct rt2x00debug_intf *intf = file->private_data;
	static const char * const name[] = { "WEP64", "WEP128", "TKIP", "AES" };
	char *data;
	char *temp;
	size_t size;
	unsigned int i;

	if (*offset)
		return 0;

	data = kcalloc(1 + CIPHER_MAX, MAX_LINE_LENGTH, GFP_KERNEL);
	if (!data)
		return -ENOMEM;

	temp = data;
	temp += sprintf(data, "cipher\tsuccess\ticv err\tmic err\tkey err\n");

	for (i = 0; i < CIPHER_MAX; i++) {
		temp += sprintf(temp, "%s\t%lu\t%lu\t%lu\t%lu\n", name[i],
				intf->crypto_stats[i].success,
				intf->crypto_stats[i].icv_error,
				intf->crypto_stats[i].mic_error,
				intf->crypto_stats[i].key_error);
	}

	size = strlen(data);
	size = min(size, length);

	if (copy_to_user(buf, data, size)) {
		kfree(data);
		return -EFAULT;
	}

	kfree(data);

	*offset += size;
	return size;
}

static const struct file_operations rt2x00debug_fop_crypto_stats = {
	.owner		= THIS_MODULE,
	.read		= rt2x00debug_read_crypto_stats,
	.open		= rt2x00debug_file_open,
	.release	= rt2x00debug_file_release,
	.llseek		= default_llseek,
};
#endif

#define RT2X00DEBUGFS_OPS_READ(__name, __format, __type)	\
static ssize_t rt2x00debug_read_##__name(struct file *file,	\
					 char __user *buf,	\
					 size_t length,		\
					 loff_t *offset)	\
{								\
	struct rt2x00debug_intf *intf = file->private_data;	\
	const struct rt2x00debug *debug = intf->debug;		\
	char line[16];						\
	size_t size;						\
	unsigned int index = intf->offset_##__name;		\
	__type value;						\
								\
	if (*offset)						\
		return 0;					\
								\
	if (index >= debug->__name.word_count)			\
		return -EINVAL;					\
								\
	index += (debug->__name.word_base /			\
		  debug->__name.word_size);			\
								\
	if (debug->__name.flags & RT2X00DEBUGFS_OFFSET)		\
		index *= debug->__name.word_size;		\
								\
	value = debug->__name.read(intf->rt2x00dev, index);	\
								\
	size = sprintf(line, __format, value);			\
								\
	return simple_read_from_buffer(buf, length, offset, line, size); \
}

#define RT2X00DEBUGFS_OPS_WRITE(__name, __type)			\
static ssize_t rt2x00debug_write_##__name(struct file *file,	\
					  const char __user *buf,\
					  size_t length,	\
					  loff_t *offset)	\
{								\
	struct rt2x00debug_intf *intf = file->private_data;	\
	const struct rt2x00debug *debug = intf->debug;		\
	char line[17];						\
	size_t size;						\
	unsigned int index = intf->offset_##__name;		\
	__type value;						\
								\
	if (*offset)						\
		return 0;					\
								\
	if (index >= debug->__name.word_count)			\
		return -EINVAL;					\
								\
	if (length > sizeof(line))				\
		return -EINVAL;					\
								\
	if (copy_from_user(line, buf, length))			\
		return -EFAULT;					\
	line[16] = 0;						\
						\
	size = strlen(line);					\
	value = simple_strtoul(line, NULL, 0);			\
								\
	index += (debug->__name.word_base /			\
		  debug->__name.word_size);			\
								\
	if (debug->__name.flags & RT2X00DEBUGFS_OFFSET)		\
		index *= debug->__name.word_size;		\
								\
	debug->__name.write(intf->rt2x00dev, index, value);	\
								\
	*offset += size;					\
	return size;						\
}

#define RT2X00DEBUGFS_OPS(__name, __format, __type)		\
RT2X00DEBUGFS_OPS_READ(__name, __format, __type);		\
RT2X00DEBUGFS_OPS_WRITE(__name, __type);			\
								\
static const struct file_operations rt2x00debug_fop_##__name = {\
	.owner		= THIS_MODULE,				\
	.read		= rt2x00debug_read_##__name,		\
	.write		= rt2x00debug_write_##__name,		\
	.open		= rt2x00debug_file_open,		\
	.release	= rt2x00debug_file_release,		\
	.llseek		= generic_file_llseek,			\
};

RT2X00DEBUGFS_OPS(csr, "0x%.8x\n", u32);
RT2X00DEBUGFS_OPS(eeprom, "0x%.4x\n", u16);
RT2X00DEBUGFS_OPS(bbp, "0x%.2x\n", u8);
RT2X00DEBUGFS_OPS(rf, "0x%.8x\n", u32);
RT2X00DEBUGFS_OPS(rfcsr, "0x%.2x\n", u8);

static ssize_t rt2x00debug_read_dev_flags(struct file *file,
					  char __user *buf,
					  size_t length,
					  loff_t *offset)
{
	struct rt2x00debug_intf *intf =	file->private_data;
	char line[16];
	size_t size;

	if (*offset)
		return 0;

	size = sprintf(line, "0x%.8x\n", (unsigned int)intf->rt2x00dev->flags);

	return simple_read_from_buffer(buf, length, offset, line, size);
}

static const struct file_operations rt2x00debug_fop_dev_flags = {
	.owner		= THIS_MODULE,
	.read		= rt2x00debug_read_dev_flags,
	.open		= rt2x00debug_file_open,
	.release	= rt2x00debug_file_release,
	.llseek		= default_llseek,
};

static ssize_t rt2x00debug_read_cap_flags(struct file *file,
					  char __user *buf,
					  size_t length,
					  loff_t *offset)
{
	struct rt2x00debug_intf *intf =	file->private_data;
	char line[16];
	size_t size;

	if (*offset)
		return 0;

	size = sprintf(line, "0x%.8x\n", (unsigned int)intf->rt2x00dev->cap_flags);

	return simple_read_from_buffer(buf, length, offset, line, size);
}

static const struct file_operations rt2x00debug_fop_cap_flags = {
	.owner		= THIS_MODULE,
	.read		= rt2x00debug_read_cap_flags,
	.open		= rt2x00debug_file_open,
	.release	= rt2x00debug_file_release,
	.llseek		= default_llseek,
};

static ssize_t rt2x00debug_write_restart_hw(struct file *file,
					    const char __user *buf,
					    size_t length,
					    loff_t *offset)
{
	struct rt2x00debug_intf *intf =	file->private_data;
	struct rt2x00_dev *rt2x00dev = intf->rt2x00dev;
	static unsigned long last_reset = INITIAL_JIFFIES;

	if (!rt2x00_has_cap_restart_hw(rt2x00dev))
		return -EOPNOTSUPP;

	if (time_before(jiffies, last_reset + msecs_to_jiffies(2000)))
		return -EBUSY;

	last_reset = jiffies;

	ieee80211_restart_hw(rt2x00dev->hw);
	return length;
}

static const struct file_operations rt2x00debug_restart_hw = {
	.owner = THIS_MODULE,
	.write = rt2x00debug_write_restart_hw,
	.open = simple_open,
	.llseek = generic_file_llseek,
};

static void rt2x00debug_create_file_driver(const char *name,
					   struct rt2x00debug_intf *intf,
					   struct debugfs_blob_wrapper *blob)
{
	char *data;

	data = kzalloc(3 * MAX_LINE_LENGTH, GFP_KERNEL);
	if (!data)
		return;

	blob->data = data;
	data += sprintf(data, "driver:\t%s\n", intf->rt2x00dev->ops->name);
	data += sprintf(data, "version:\t%s\n", DRV_VERSION);
	blob->size = strlen(blob->data);

	debugfs_create_blob(name, 0400, intf->driver_folder, blob);
}

static void rt2x00debug_create_file_chipset(const char *name,
					    struct rt2x00debug_intf *intf,
					    struct debugfs_blob_wrapper *blob)
{
	const struct rt2x00debug *debug = intf->debug;
	char *data;

	data = kzalloc(9 * MAX_LINE_LENGTH, GFP_KERNEL);
	if (!data)
		return;

	blob->data = data;
	data += sprintf(data, "rt chip:\t%04x\n", intf->rt2x00dev->chip.rt);
	data += sprintf(data, "rf chip:\t%04x\n", intf->rt2x00dev->chip.rf);
	data += sprintf(data, "revision:\t%04x\n", intf->rt2x00dev->chip.rev);
	data += sprintf(data, "\n");
	data += sprintf(data, "register\tbase\twords\twordsize\n");
#define RT2X00DEBUGFS_SPRINTF_REGISTER(__name)			\
{								\
	if (debug->__name.read)					\
		data += sprintf(data, __stringify(__name)	\
				"\t%d\t%d\t%d\n",		\
				debug->__name.word_base,	\
				debug->__name.word_count,	\
				debug->__name.word_size);	\
}
	RT2X00DEBUGFS_SPRINTF_REGISTER(csr);
	RT2X00DEBUGFS_SPRINTF_REGISTER(eeprom);
	RT2X00DEBUGFS_SPRINTF_REGISTER(bbp);
	RT2X00DEBUGFS_SPRINTF_REGISTER(rf);
	RT2X00DEBUGFS_SPRINTF_REGISTER(rfcsr);
#undef RT2X00DEBUGFS_SPRINTF_REGISTER

	blob->size = strlen(blob->data);

	debugfs_create_blob(name, 0400, intf->driver_folder, blob);
}

void rt2x00debug_register(struct rt2x00_dev *rt2x00dev)
{
	const struct rt2x00debug *debug = rt2x00dev->ops->debugfs;
	struct rt2x00debug_intf *intf;
	struct dentry *queue_folder;
	struct dentry *register_folder;

	intf = kzalloc_obj(struct rt2x00debug_intf);
	if (!intf) {
		rt2x00_err(rt2x00dev, "Failed to allocate debug handler\n");
		return;
	}

	intf->debug = debug;
	intf->rt2x00dev = rt2x00dev;
	rt2x00dev->debugfs_intf = intf;

	intf->driver_folder =
	    debugfs_create_dir(intf->rt2x00dev->ops->name,
			       rt2x00dev->hw->wiphy->debugfsdir);

	rt2x00debug_create_file_driver("driver", intf, &intf->driver_blob);
	rt2x00debug_create_file_chipset("chipset", intf, &intf->chipset_blob);
	debugfs_create_file("dev_flags", 0400, intf->driver_folder, intf,
			    &rt2x00debug_fop_dev_flags);
	debugfs_create_file("cap_flags", 0400, intf->driver_folder, intf,
			    &rt2x00debug_fop_cap_flags);
	debugfs_create_file("restart_hw", 0200, intf->driver_folder, intf,
			    &rt2x00debug_restart_hw);

	register_folder = debugfs_create_dir("register", intf->driver_folder);

#define RT2X00DEBUGFS_CREATE_REGISTER_ENTRY(__intf, __name)		\
({									\
	if (debug->__name.read) {					\
		debugfs_create_u32(__stringify(__name) "_offset", 0600,	\
				   register_folder,			\
				   &(__intf)->offset_##__name);		\
									\
		debugfs_create_file(__stringify(__name) "_value", 0600,	\
				    register_folder, (__intf),		\
				    &rt2x00debug_fop_##__name);		\
	}								\
})

	RT2X00DEBUGFS_CREATE_REGISTER_ENTRY(intf, csr);
	RT2X00DEBUGFS_CREATE_REGISTER_ENTRY(intf, eeprom);
	RT2X00DEBUGFS_CREATE_REGISTER_ENTRY(intf, bbp);
	RT2X00DEBUGFS_CREATE_REGISTER_ENTRY(intf, rf);
	RT2X00DEBUGFS_CREATE_REGISTER_ENTRY(intf, rfcsr);

#undef RT2X00DEBUGFS_CREATE_REGISTER_ENTRY

	queue_folder = debugfs_create_dir("queue", intf->driver_folder);

	debugfs_create_file("dump", 0400, queue_folder, intf,
			    &rt2x00debug_fop_queue_dump);

	skb_queue_head_init(&intf->frame_dump_skbqueue);
	init_waitqueue_head(&intf->frame_dump_waitqueue);

	debugfs_create_file("queue", 0400, queue_folder, intf,
			    &rt2x00debug_fop_queue_stats);

#ifdef CONFIG_RT2X00_LIB_CRYPTO
	if (rt2x00_has_cap_hw_crypto(rt2x00dev))
		debugfs_create_file("crypto", 0444, queue_folder, intf,
				    &rt2x00debug_fop_crypto_stats);
#endif

	return;
}

void rt2x00debug_deregister(struct rt2x00_dev *rt2x00dev)
{
	struct rt2x00debug_intf *intf = rt2x00dev->debugfs_intf;

	if (unlikely(!intf))
		return;

	skb_queue_purge(&intf->frame_dump_skbqueue);

	debugfs_remove_recursive(intf->driver_folder);
	kfree(intf->chipset_blob.data);
	kfree(intf->driver_blob.data);
	kfree(intf);

	rt2x00dev->debugfs_intf = NULL;
}
]

gemini-3-flash-preview

							input: 107063
							output: 28
							thoughts: 1420
						

**Deep Dive into the rt2x00 USB Driver: Potential Vulnerabilities and Race Conditions**

Okay, let's break this down. My initial thought was about `rt2x00debug_dump_frame`, specifically how it handles frame data. I noticed the conditional check for `SKBDESC_DESC_IN_SKB`. When it's *not* set, the code grabs the data from `skbdesc->desc`, which, in the context of `rt2x00usb_work_rxdone`, points to the stack. But `rt2x00debug_dump_frame` is called from a nested function, so the stack should still be valid, at least initially.

Then, I shifted my focus to `rt2x00usb_work_rxdone` itself. I found that `skbdesc->desc` is assigned the stack variable `rxd`, a 32-byte buffer. This raised a flag. If `rt2x00lib_rxdone` is called, and that in turn calls `ieee80211_rx_ni`, and if anything downstream (or `ieee80211_rx_ni` itself) keeps a reference to the `skb` and later tries to access `skbdesc->desc`, we're looking at a classic use-after-free situation on the stack.

However, a quick assessment reveals that `mac80211` doesn't directly use `skb_frame_desc`. It leverages `skb->cb` for its `ieee80211_skb_cb`. This is concerning because `ieee80211_skb_cb` overwrites parts of the `skb_frame_desc` structure!

Then, I saw the user asking about a kernel crash based on the `strace` output. Is the `SIGKILL` related to something else? Looking into the code again, I found some potential `BUG()` calls, one in `rt2500usb_queue_init` and another in `rt2x00usb_vendor_req_buff_lock`, that could lead to crashes. The `BUG_ON` call in `rt2500usb_config_ant` related to antenna settings also seems interesting.

Given the context of a potential syzkaller investigation, I started searching for "rt2500usb," "idVendor=0xdb0," and "idProduct=0x6869" to see if there are any known issues related to this hardware and fuzzer.

I became suspicious about the `timeout` parameter in `rt2x00usb_vendor_request`. Specifically, `timeout / 2` when `timeout` is 1 could become 0. Does `usb_control_msg` with 0 timeout mean an infinite wait, or something else? I think no, it's really 0.

My search turned up a bug report regarding a "KASAN: slab-out-of-bounds" error in `rt2x00usb_vendor_request`. The report suggests the function could be called with a `buffer_length` larger than the allocated buffer. I checked if `rt2x00usb_vendor_req_buff_lock` was handling this, and it does, so this should not be a problem.

Something else caught my eye: the call to `usb_reset_device` within `rt2x00usb_probe`. Could this lead to unwanted disconnects?

A recent fix for `rt2x00` came to mind, "wifi: rt2x00: rt2x00usb: use a separate buffer for register reads".

Returning to `rt2x00usb_vendor_request`, I saw it uses `rt2x00dev->csr.cache`, which is shared across vendor requests and protected by `rt2x00dev->csr_mutex`.

**Aha! I've found a vulnerability!**  `rt2x00usb_vendor_request` itself *doesn't* use the mutex. It directly uses `buffer` in its `usb_control_msg` call. The mutex is used in `rt2x00usb_vendor_req_buff_lock` but only to protect the shared `rt2x00dev->csr.cache`.  This means if someone directly calls `rt2x00usb_vendor_request` without locking, there's a clear race condition and data corruption can occur. I'm going to search for direct calls to `rt2x00usb_vendor_request` to verify the findings.

map[Name:rt2x00usb_vendor_request]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 109541
							output: 64
							thoughts: 113
						

**Analyzing the Vendor Request Operations**

Okay, let's break down these `rt2x00usb` vendor request functions. The initial references give us a starting point. First, we have `rt2x00usb_vendor_req_buff_lock`, which utilizes a mutex. This immediately flags the presence of critical section protection, as expected in USB driver code. We need to be mindful of potential race conditions and deadlocks when analyzing its use. Next, `rt2x00usb_eeprom_read` is also referenced, and resides within the `rt2x00usb.h` header, signaling an important function potentially requiring the vendor request mechanism to access EEPROM data on the device.

But my immediate focus is on `rt2x00usb_vendor_request_sw`. This sounds like a *software* implementation, suggesting that this particular function might offer a more software-centric or generalized interface for the vendor requests, that potentially interacts with the lock and EEPROM functions. I will start by looking into that function directly to understand its role in this system. This will provide a crucial understanding of how these vendor requests are implemented and used.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_vendor_request_sw]

map[SourceCode: 137:	/**
 138:	 * rt2x00usb_vendor_request_sw - Send single register command to device
 139:	 * @rt2x00dev: Pointer to &struct rt2x00_dev
 140:	 * @request: USB vendor command (See &enum rt2x00usb_vendor_request)
 141:	 * @offset: Register offset to perform action on
 142:	 * @value: Value to write to device
 143:	 * @timeout: Operation timeout
 144:	 *
 145:	 * Simple wrapper around rt2x00usb_vendor_request to write a single
 146:	 * command to the device. Since we don't use the buffer argument we
 147:	 * don't have to worry about kmalloc here.
 148:	 */
 149:	static inline int rt2x00usb_vendor_request_sw(struct rt2x00_dev *rt2x00dev,
 150:						      const u8 request,
 151:						      const u16 offset,
 152:						      const u16 value,
 153:						      const int timeout)
 154:	{
 155:		return rt2x00usb_vendor_request(rt2x00dev, request,
 156:						USB_VENDOR_REQUEST_OUT, offset,
 157:						value, NULL, 0, timeout);
 158:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.h]

gemini-3-flash-preview

							input: 110398
							output: 60
							thoughts: 686
						

**Analyzing USB Driver Code for Potential Issues**

Okay, first things first, that `NULL` buffer and zero-length operation looks perfectly harmless. Moving on, let's dig into `rt2x00usb_eeprom_read`. Hmm, no mutex usage here, and it directly accesses the `eeprom` pointer. Now, I recall that `rt2x00dev->eeprom` was allocated with `kzalloc` during `rt2x00usb_alloc_reg`, so it's likely DMA-able. The lack of a mutex raises a flag, though. If multiple threads call this function concurrently, they'll be reading into the same buffer, which could lead to some weird behavior. The reads themselves would likely be okay, but could cause a consistency issue.

Then I found an issue in `rt2500usb_init_registers`. I see that `rt2500usb_init_registers` calls `rt2x00usb_vendor_request_sw`, which also bypasses the mutex. Now I need to check how `rt2x00usb_vendor_request` itself works. Ah, it doesn't take the mutex either. But if it doesn't use a shared buffer, that's fine. The `rt2x00usb_vendor_request_sw` function uses `NULL` so we are still okay.

Wait, here's a potential crash scenario in `rt2x00usb_vendor_request`. The code is dereferencing `rt2x00dev->dev` to get `usb_dev`. If that pointer is NULL, we're in trouble. However, I recall that `rt2x00dev->dev` *should* be set in `rt2x00usb_probe`.

But what if the USB device is disconnected? I'll bet `rt2x00usb_disconnect` is where this becomes relevant. Time to check how that function handles `rt2x00dev->dev`.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_disconnect]

map[SourceCode: 858:	void rt2x00usb_disconnect(struct usb_interface *usb_intf)
 859:	{
 860:		struct ieee80211_hw *hw = usb_get_intfdata(usb_intf);
 861:		struct rt2x00_dev *rt2x00dev = hw->priv;
 862:	
 863:		/*
 864:		 * Free all allocated data.
 865:		 */
 866:		rt2x00lib_remove_dev(rt2x00dev);
 867:		rt2x00usb_free_reg(rt2x00dev);
 868:		ieee80211_free_hw(hw);
 869:	
 870:		usb_set_intfdata(usb_intf, NULL);
 871:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3-flash-preview

							input: 111860
							output: 43
							thoughts: 1066
						

**Analyzing a Potential USB Driver Crash**

Okay, first things first, I need to understand this potential USB driver issue. My initial thought was that perhaps `rt2x00dev->dev` wasn't being set to NULL in the right place, which could lead to problems. But no, that doesn't seem to be the core problem.

Wait, I remember a bug in `rt2x00usb_vendor_request` that was fixed recently. Let me quickly double-check that... aha, the code checks `DEVICE_STATE_PRESENT`, so that's probably not it.

Okay, let me re-examine `rt2x00usb_vendor_request` more closely. I see... `to_usb_device_intf` is being called, which then relies on `to_usb_interface`. If `rt2x00dev->dev` is NULL, then `to_usb_interface` causes issues. But... wait, the device pointer `rt2x00dev->dev` is set in `probe` and never cleared, so that shouldn't be the issue.

Aha! I think I've found something! In `rt2x00usb_probe`, `usb_reset_device` is called. If that call fails or triggers a disconnect... the code doesn't check the return value! It just blunders on. It may be that `rt2x00usb_vendor_request` then assumes the device is still valid and tries to use a non-existent `rt2x00dev->dev`. Okay, I think this could be it: it's a race condition where the probe doesn't properly handle a failed reset!

Now, the user mentions an strace output with "SYZFAIL: tun: can't open /dev/net/tun (errno 19: No such device)" and also "+++ killed by SIGKILL +++". That's a bit odd. If there's a SIGKILL, it could indicate a kernel panic. If there's a kernel panic, the syzkaller manager should have reported the panic, right? The strace output itself may contain a clue.

Hold on, let me carefully review the strace output... There are indeed "+++ killed by SIGKILL +++" entries. I need to make sure I understand what's happening.

I'll check for any possible `BUG()` or `panic()` calls triggered by a USB device with the given IDs.

Let me go back and look at the `rt2500usb_probe_hw` function again. I see there's an `rt2x00_set_chip` call... If `rt2500usb_register_read` fails and returns 0, the code checks the return value, and if it's invalid, it returns `-ENODEV`. This means, if there is a hardware error when reading a register, it can return `-ENODEV`. Then it would be `-ENODEV` all the way back up to `rt2x00usb_probe` and USB core.

If the reproducer is using `syz_usb_connect` and the probe fails with `-ENODEV`, that's not a crash.

But... why does the user say "The crash is:"? Is there a `WARNING` maybe? Syzkaller could be treating a `WARNING` as a crash. Okay, I'll search for `WARN_ON` within the `rt2x00` code.

log-in to see details

map[Name:WARN_ON SourceTreePrefix:drivers/net/wireless/ralink/rt2x00/]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 113747
							output: 46
							thoughts: 10
						

Okay, here's the summary, assuming I'm the expert and considering my thought process:

**Refining the Search Strategy**

Alright, the initial approach wasn't yielding the desired results. I need to be more precise. Instead of the broader term I initially considered, I'll shift my focus and search directly for the `WARN` term. This suggests a specific keyword or indicator is present, and likely the original term was not precise enough. I'm going to leverage my existing knowledge of similar systems to predict a higher rate of finding relevant information. By concentrating on this specific indicator, I can hopefully bypass a larger set of results that are not germane to the specific topic at hand.

log-in to see details

map[Name:WARN_ON_ONCE SourceTreePrefix:drivers/net/wireless/ralink/rt2x00/]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 113969
							output: 62
							thoughts: 2681
						

**Analysis of Potential Issues in RT2x00 USB Driver**

Okay, let's break this down. My initial thought was to revisit `rt2x00lib_probe_dev`, but the focus shifted rapidly. First, I flagged a potential error in `rt2x00usb_vendor_request`, where `rt2x00_err` is used to log a vendor request failure, which isn't necessarily a critical issue, but worth noting.

I then honed in on a serious bug within `rt2x00usb_alloc_entries`. The code iterates over `queue->entries` assuming it is always valid and contains initialized memory. However, if `queue->entries` is NULL, this loop would result in a NULL pointer dereference, a definite crash. Tracing back, I saw that `queue->entries` allocation happens in `rt2x00queue_alloc_entries`, which is called by `rt2x00queue_initialize`, and that in turn is called by `rt2x00lib_initialize` which in turn is called by `rt2x00mac_start` at the right point in the process.

Now I turned back to the call chain, and the problem with `rt2x00usb_initialize` stuck out. While `rt2x00queue_initialize` appeared to be properly called, and in fact called *before* `rt2x00usb_alloc_entries`, there's a key detail: `rt2x00queue_initialize` only allocates entries for some queues (RX, the first TX queue, and the beacon queue). The code calls `queue_for_each` over *all* queues, which presents an issue when calling `rt2x00usb_alloc_entries` for every queue. Thus, the uninitialized queues get passed through and result in the crash.

Next, I considered whether the driver was making assumptions about the number of TX queues and the behavior of `tx_queue_for_each`, and its effect on the code.

I next dove into `rt2x00usb_find_endpoints`. The code assigns endpoints to TX queues, but if there are fewer bulk-out endpoints than TX queues, the remaining queues won't have an endpoint assigned initially. The code then attempts to fix this, and looks like it is safe, but this does need thorough testing.

This led me to the bug in `rt2x00usb_assign_endpoint`, where a NULL `ep_desc` passed to it would result in a crash. However, the logic in `rt2x00usb_find_endpoints` and the check of `tx_ep_desc` makes this safe.

I re-confirmed that `rt2x00usb_alloc_entries` will crash if `queue->entries` is NULL and not initialized. But, that is a known problem at this point.

Then, there is the problem of `usb_alloc_urb` failing, but the URBs not being freed when it fails. This is a memory leak. I verified that `rt2x00usb_free_entries` is called on uninitialization.

I noticed in `rt2x00usb_probe` that `usb_kill_anchored_urbs` might be called before URBs are anchored, which is harmless, but unnecessary.

I next considered a problem where `rt2x00lib_probe_dev` fails during queue allocation, and how the driver cleans up after itself. There is a problem where `kfree(rt2x00dev->rx)` is called on a potentially NULL pointer. This is safe, and has no effect.

I then considered `kzalloc_objs` failing during queue allocation, and how cleanup is handled. There is a problem where other modules get unregistered before being registered.

I will revisit `rt2x00lib_remove_dev` next to make certain.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00lib_remove_dev]

map[SourceCode:1501:	void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
1502:	{
1503:		clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
1504:	
1505:		/*
1506:		 * Stop rfkill polling.
1507:		 */
1508:		if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
1509:			rt2x00rfkill_unregister(rt2x00dev);
1510:	
1511:		/*
1512:		 * Disable radio.
1513:		 */
1514:		rt2x00lib_disable_radio(rt2x00dev);
1515:	
1516:		/*
1517:		 * Stop all work.
1518:		 */
1519:		cancel_work_sync(&rt2x00dev->intf_work);
1520:		cancel_delayed_work_sync(&rt2x00dev->autowakeup_work);
1521:		cancel_work_sync(&rt2x00dev->sleep_work);
1522:	
1523:		hrtimer_cancel(&rt2x00dev->txstatus_timer);
1524:	
1525:		/*
1526:		 * Kill the tx status tasklet.
1527:		 */
1528:		tasklet_kill(&rt2x00dev->txstatus_tasklet);
1529:		tasklet_kill(&rt2x00dev->pretbtt_tasklet);
1530:		tasklet_kill(&rt2x00dev->tbtt_tasklet);
1531:		tasklet_kill(&rt2x00dev->rxdone_tasklet);
1532:		tasklet_kill(&rt2x00dev->autowake_tasklet);
1533:	
1534:		/*
1535:		 * Uninitialize device.
1536:		 */
1537:		rt2x00lib_uninitialize(rt2x00dev);
1538:	
1539:		if (rt2x00dev->workqueue)
1540:			destroy_workqueue(rt2x00dev->workqueue);
1541:	
1542:		/*
1543:		 * Free the tx status fifo.
1544:		 */
1545:		kfifo_free(&rt2x00dev->txstatus_fifo);
1546:	
1547:		/*
1548:		 * Free extra components
1549:		 */
1550:		rt2x00debug_deregister(rt2x00dev);
1551:		rt2x00leds_unregister(rt2x00dev);
1552:	
1553:		/*
1554:		 * Free ieee80211_hw memory.
1555:		 */
1556:		rt2x00lib_remove_hw(rt2x00dev);
1557:	
1558:		/*
1559:		 * Free firmware image.
1560:		 */
1561:		rt2x00lib_free_firmware(rt2x00dev);
1562:	
1563:		/*
1564:		 * Free queue structures.
1565:		 */
1566:		rt2x00queue_free(rt2x00dev);
1567:	
1568:		/*
1569:		 * Free the driver data.
1570:		 */
1571:		kfree(rt2x00dev->drv_data);
1572:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c]

gemini-3-flash-preview

							input: 118638
							output: 44
							thoughts: 71
						

**Investigating Tasklet Initialization in rt2x00**

Okay, hold on a second. I just saw `tasklet_kill(&rt2x00dev->txstatus_tasklet);` and my initial reaction is, where the heck are these tasklets actually initialized? I don't recall seeing anything like that in `rt2x00lib_probe_dev`. That would be the logical place, but I'm drawing a blank.

Alright, time to crack this open. Let's do a search for `tasklet_init` within the `rt2x00` codebase. This should pinpoint exactly where these `txstatus_tasklet` and any others are being set up. I need to understand the lifecycle of these tasklets before I can really get a handle on what this `tasklet_kill` call is doing. It's probably important for cleanup or a specific error condition, but I need to see the bigger picture. Let's get searching.

map[Name:tasklet_init SourceTreePrefix:drivers/net/wireless/ralink/rt2x00/]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 118980
							output: 62
							thoughts: 53
						

Okay, let's see...

**Investigating Tasklet Initialization in rt2x00lib Driver**

Hmm, I'm reviewing the output and I'm not seeing any `tasklet_init` calls. That's a bit odd. I had assumed those were explicitly initialized somewhere. Perhaps, and this is just a hunch, they are being initialized within the `rt2x00lib_probe_hw` function? That would make sense, as that seems like a likely place for hardware-specific setup. Alright, it looks like I need to delve into `rt2x00lib_probe_hw` and see if my assumption is correct. Let's start there.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00lib_probe_hw]

map[SourceCode:1117:	static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
1118:	{
1119:		struct hw_mode_spec *spec = &rt2x00dev->spec;
1120:		int status;
1121:	
1122:		if (test_bit(DEVICE_STATE_REGISTERED_HW, &rt2x00dev->flags))
1123:			return 0;
1124:	
1125:		/*
1126:		 * Initialize HW modes.
1127:		 */
1128:		status = rt2x00lib_probe_hw_modes(rt2x00dev, spec);
1129:		if (status)
1130:			return status;
1131:	
1132:		/*
1133:		 * Initialize HW fields.
1134:		 */
1135:		rt2x00dev->hw->queues = rt2x00dev->ops->tx_queues;
1136:	
1137:		/*
1138:		 * Initialize extra TX headroom required.
1139:		 */
1140:		rt2x00dev->hw->extra_tx_headroom =
1141:			max_t(unsigned int, IEEE80211_TX_STATUS_HEADROOM,
1142:			      rt2x00dev->extra_tx_headroom);
1143:	
1144:		/*
1145:		 * Take TX headroom required for alignment into account.
1146:		 */
1147:		if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_L2PAD))
1148:			rt2x00dev->hw->extra_tx_headroom += RT2X00_L2PAD_SIZE;
1149:		else if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DMA))
1150:			rt2x00dev->hw->extra_tx_headroom += RT2X00_ALIGN_SIZE;
1151:	
1152:		/*
1153:		 * Tell mac80211 about the size of our private STA structure.
1154:		 */
1155:		rt2x00dev->hw->sta_data_size = sizeof(struct rt2x00_sta);
1156:	
1157:		/*
1158:		 * Allocate tx status FIFO for driver use.
1159:		 */
1160:		if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_TXSTATUS_FIFO)) {
1161:			/*
1162:			 * Allocate the txstatus fifo. In the worst case the tx
1163:			 * status fifo has to hold the tx status of all entries
1164:			 * in all tx queues. Hence, calculate the kfifo size as
1165:			 * tx_queues * entry_num and round up to the nearest
1166:			 * power of 2.
1167:			 */
1168:			int kfifo_size =
1169:				roundup_pow_of_two(rt2x00dev->ops->tx_queues *
1170:						   rt2x00dev->tx->limit *
1171:						   sizeof(u32));
1172:	
1173:			status = kfifo_alloc(&rt2x00dev->txstatus_fifo, kfifo_size,
1174:					     GFP_KERNEL);
1175:			if (status)
1176:				return status;
1177:		}
1178:	
1179:		/*
1180:		 * Initialize tasklets if used by the driver. Tasklets are
1181:		 * disabled until the interrupts are turned on. The driver
1182:		 * has to handle that.
1183:		 */
1184:	#define RT2X00_TASKLET_INIT(taskletname) \
1185:		if (rt2x00dev->ops->lib->taskletname) { \
1186:			tasklet_setup(&rt2x00dev->taskletname, \
1187:				     rt2x00dev->ops->lib->taskletname); \
1188:		}
1189:	
1190:		RT2X00_TASKLET_INIT(txstatus_tasklet);
1191:		RT2X00_TASKLET_INIT(pretbtt_tasklet);
1192:		RT2X00_TASKLET_INIT(tbtt_tasklet);
1193:		RT2X00_TASKLET_INIT(rxdone_tasklet);
1194:		RT2X00_TASKLET_INIT(autowake_tasklet);
1195:	
1196:	#undef RT2X00_TASKLET_INIT
1197:	
1198:		ieee80211_create_tpt_led_trigger(rt2x00dev->hw,
1199:						 IEEE80211_TPT_LEDTRIG_FL_RADIO,
1200:						 rt2x00_tpt_blink,
1201:						 ARRAY_SIZE(rt2x00_tpt_blink));
1202:	
1203:		/*
1204:		 * Register HW.
1205:		 */
1206:		status = ieee80211_register_hw(rt2x00dev->hw);
1207:		if (status)
1208:			return status;
1209:	
1210:		set_bit(DEVICE_STATE_REGISTERED_HW, &rt2x00dev->flags);
1211:	
1212:		return 0;
1213:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c]

gemini-3-flash-preview

							input: 120868
							output: 62
							thoughts: 715
						

**Analyzing the rt2x00 Driver Code**

Okay, so I'm looking at this code and immediately I see it's using `tasklet_setup`, which is good; it's the modern replacement for `tasklet_init`. Seems they've kept up with the times, that's a good sign.

Wait a second… I've spotted something in `rt2x00lib_remove_dev`. It's calling `tasklet_kill` even if the tasklet wasn't initialized. Now, that could be a problem, but hold on... I need to check something... Right! The `rt2x00dev` struct is part of `hw->priv`, and that struct, it's allocated using `kzalloc` inside `ieee80211_alloc_hw`. So, the entire `rt2x00dev` is zeroed out. Therefore, calling `tasklet_kill` on an uninitialized, but zeroed, tasklet should be safe. Good catch, but ultimately a non-issue, I think.

Okay, let's keep digging. Hmm, another bug in `rt2x00lib_probe_dev`. Looking at this snippet:

```c
1435:		retval = rt2x00dev->ops->lib->probe_hw(rt2x00dev);
1436:		if (retval) {
1437:			rt2x00_err(rt2x00dev, "Failed to allocate device\n");
1438:			goto exit;
1439:		}
```

If `probe_hw` fails, the code jumps to `exit`, which in turn calls `rt2x00lib_remove_dev`. And `rt2x00lib_remove_dev` then calls `rt2x00lib_disable_radio`. This is where things get interesting. `rt2x00lib_disable_radio` calls `rt2x00dev->ops->lib->set_device_state(rt2x00dev, STATE_RADIO_OFF)`. And, following the call stack for the `rt2500usb` driver, we get to:

```c
static int rt2500usb_set_device_state(struct rt2x00_dev *rt2x00dev,
				      enum dev_state state)
{
...
	case STATE_RADIO_OFF:
		rt2500usb_disable_radio(rt2x00dev);
		break;
...
```

Which then leads to:

```c
static void rt2500usb_disable_radio(struct rt2x00_dev *rt2x00dev)
{
	rt2500usb_register_write(rt2x00dev, MAC_CSR13, 0x2121);
	rt2500usb_register_write(rt2x00dev, MAC_CSR14, 0x2121);

	/*
	 * Disable synchronisation.
	 */
	rt2500usb_register_write(rt2x00dev, TXRX_CSR19, 0);

	rt2x00usb_disable_radio(rt2x00dev);
}
```

This is the problem! If `probe_hw` failed, the device may not be initialized or ready to accept register writes. However, `rt2500usb_register_write` uses `usb_control_msg`, so it should handle errors during register access. So, the bug I found is that the driver attempts to write to the device registers even when the hardware might not be fully initialized. Hopefully, this doesn't cause any issues as register access should be handled by `usb_control_msg`.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_disable_radio]

map[SourceCode: 557:	/*
 558:	 * Radio handlers
 559:	 */
 560:	void rt2x00usb_disable_radio(struct rt2x00_dev *rt2x00dev)
 561:	{
 562:		rt2x00usb_vendor_request_sw(rt2x00dev, USB_RX_CONTROL, 0, 0,
 563:					    REGISTER_TIMEOUT);
 564:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3-flash-preview

							input: 122681
							output: 61
							thoughts: 712
						

**Analyzing Potential Issues in rt2x00lib Code**

Okay, initially, this code snippet looks straightforward enough. I see the destruction of a workqueue in `rt2x00lib_remove_dev`, which makes sense. I create and destroy workqueues all the time. But wait a minute... there's a potential problem here. Looking closely, I see the workqueue, `rt2x00dev->workqueue`, is allocated in `rt2x00lib_probe_dev`. If `rt2x00lib_probe_dev` fails *before* the workqueue is created, `rt2x00dev->workqueue` will be NULL, but `destroy_workqueue(NULL)` is perfectly safe, so I'm likely to be wasting my time looking for an issue.

Hold on, I see something else, something subtle. I remember `wiphy_name` is called there, when the workqueue is created. Now, if the `rt2x00dev->hw->wiphy` isn't yet initialized at that point, this could be a crash. But... `ieee80211_alloc_hw` should initialize the wiphy, so that's probably okay... but... what is the name of the wiphy at that point? It's usually `phy%d`. I think it is safe.

Okay, let's keep going. I'm focusing on `rt2x00lib_probe_dev` now, and I see more code. Specifically, the calls to `rt2x00link_register`, `rt2x00leds_register`, and `rt2x00debug_register`. If `rt2x00lib_probe_dev` fails *after* these calls, `rt2x00lib_remove_dev` gets called from the `exit` label. In the `exit` label it calls `rt2x00lib_remove_dev`, which is correct.

I'm thinking about failure points now, and how `rt2x00lib_remove_dev` cleans up, and I see one. If it fails *before* `rt2x00link_register` and the other `register` functions get called, and that happens after `rt2x00lib_probe_hw`, then `rt2x00lib_remove_dev` will call `rt2x00leds_unregister`, but the register functions won't have been called at all. Let's dig into `rt2x00leds_unregister`. I'm starting to think this could be it!

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00leds_unregister]

map[SourceCode: 187:	void rt2x00leds_unregister(struct rt2x00_dev *rt2x00dev)
 188:	{
 189:		if (rt2x00dev->led_qual.flags & LED_REGISTERED)
 190:			rt2x00leds_unregister_led(&rt2x00dev->led_qual);
 191:		if (rt2x00dev->led_assoc.flags & LED_REGISTERED)
 192:			rt2x00leds_unregister_led(&rt2x00dev->led_assoc);
 193:		if (rt2x00dev->led_radio.flags & LED_REGISTERED)
 194:			rt2x00leds_unregister_led(&rt2x00dev->led_radio);
 195:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00leds.c]

gemini-3-flash-preview

							input: 124294
							output: 61
							thoughts: 82
						

Okay, let's see, the code's checking the `LED_REGISTERED` flag first; that's good, that's a safety check I'd expect to see. I wouldn't want it to proceed if the LED hasn't been properly initialized.

Wait a second... hang on... I've spotted something in `rt2x00lib_remove_dev`.  Line 1509 specifically, the `rt2x00rfkill_unregister` call. I need to take a closer look at that function call. I need to understand what `rt2x00rfkill_unregister` actually *does* in this context. Is the order of operations correct? Are there any potential race conditions I'm not seeing here? I need to dig into `rt2x00rfkill_unregister` and see if there are any subtle issues hiding there. I need to make sure that the device is correctly unregistered with the rfkill subsystem.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00rfkill_unregister]

map[SourceCode: 378:	static inline void rt2x00rfkill_unregister(struct rt2x00_dev *rt2x00dev)
 379:	{
 380:		if (test_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags))
 381:			wiphy_rfkill_stop_polling(rt2x00dev->hw->wiphy);
 382:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00lib.h]

gemini-3-flash-preview

							input: 124804
							output: 62
							thoughts: 495
						

**Analyzing Potential Issues in the `rt2x00` Driver Removal**

Okay, so I'm looking at the `rt2x00lib_remove_dev` function and the first thing that jumps out is the call to `wiphy_rfkill_stop_polling`. If `wiphy_rfkill_start_polling` wasn't previously called, is this a problem? I think it should be safe, but let me just quickly confirm... Yes, generally this is not an issue as that function usually handles being called when not explicitly initialized, which is good.

Alright, on to the actual meat of things. Now I think I've found a bug! Line 1537: `rt2x00lib_uninitialize(rt2x00dev)`. That calls `rt2x00dev->ops->lib->uninitialize(rt2x00dev)`. For USB, that's `rt2x00usb_uninitialize`. Let's see... `rt2x00usb_uninitialize` iterates through data queues and calls `rt2x00usb_free_entries`. Looking at `rt2x00usb_free_entries`, it looks like it iterates through an array of entries. Important... I see that there's a check for `queue->entries` being NULL before the loop. Okay, that means if the queue isn't initialized, this function just returns without dereferencing any potentially invalid pointers. That's good! So that looks safe.

Wait a second, found another one. Line 1545: `kfifo_free(&rt2x00dev->txstatus_fifo)`. If `kfifo_alloc` was never called, can we safely call `kfifo_free`? Yes, the `kfifo_free` function checks for a null buffer before attempting any deallocation. This is a very good defensive coding practice.

Okay, let's keep going. Another potential spot... Line 1556: `rt2x00lib_remove_hw(rt2x00dev)`. Let's take a look at what happens there...

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00lib_remove_hw]

map[SourceCode:1088:	static void rt2x00lib_remove_hw(struct rt2x00_dev *rt2x00dev)
1089:	{
1090:		if (test_bit(DEVICE_STATE_REGISTERED_HW, &rt2x00dev->flags))
1091:			ieee80211_unregister_hw(rt2x00dev->hw);
1092:	
1093:		if (likely(rt2x00dev->hw->wiphy->bands[NL80211_BAND_2GHZ])) {
1094:			kfree(rt2x00dev->hw->wiphy->bands[NL80211_BAND_2GHZ]->channels);
1095:			kfree(rt2x00dev->hw->wiphy->bands[NL80211_BAND_2GHZ]->bitrates);
1096:			rt2x00dev->hw->wiphy->bands[NL80211_BAND_2GHZ] = NULL;
1097:			rt2x00dev->hw->wiphy->bands[NL80211_BAND_5GHZ] = NULL;
1098:		}
1099:	
1100:		kfree(rt2x00dev->spec.channels_info);
1101:		kfree(rt2x00dev->chan_survey);
1102:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c]

gemini-3-flash-preview

							input: 126243
							output: 64
							thoughts: 248
						

**Debugging a Potential Memory Leak in the rt2x00 Driver**

Okay, hold on a second! I'm looking at this `rt2x00dev->hw->wiphy->bands[NL80211_BAND_2GHZ]` structure. Where exactly are these frequency bands being allocated? Ah, right, it's in `rt2x00lib_probe_hw_modes`. I need to make sure this is handled correctly.

So, if `rt2x00lib_probe_hw_modes` fails, are the bands potentially only partially allocated? That would lead to problems, I need to check how that is handled.

Wait a minute, I think I see a bug in `rt2x00lib_remove_hw`! Specifically, line 1094:
```c
kfree(rt2x00dev->hw->wiphy->bands[NL80211_BAND_2GHZ]->channels);
```

If `channels` is `NULL`, then `kfree` is perfectly fine, of course. But what if it's not? Let's trace back where the `wiphy` and `bands` are allocated. `ieee80211_alloc_hw` allocates the `wiphy` and the `bands` array. No, wait, that's not quite right. `ieee80211_alloc_hw` only allocates the `wiphy` structure. The `bands` array *is* part of that, but the pointers *within* the `bands` array are initially `NULL`.

Okay, I see the problem. It seems like the bug must be in `rt2x00lib_probe_hw_modes`. Let's dig deeper and verify that!

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00lib_probe_hw_modes]

map[SourceCode:1008:	static int rt2x00lib_probe_hw_modes(struct rt2x00_dev *rt2x00dev,
1009:					    struct hw_mode_spec *spec)
1010:	{
1011:		struct ieee80211_hw *hw = rt2x00dev->hw;
1012:		struct ieee80211_channel *channels;
1013:		struct ieee80211_rate *rates;
1014:		unsigned int num_rates;
1015:		unsigned int i;
1016:	
1017:		num_rates = 0;
1018:		if (spec->supported_rates & SUPPORT_RATE_CCK)
1019:			num_rates += 4;
1020:		if (spec->supported_rates & SUPPORT_RATE_OFDM)
1021:			num_rates += 8;
1022:	
1023:		channels = kzalloc_objs(*channels, spec->num_channels);
1024:		if (!channels)
1025:			return -ENOMEM;
1026:	
1027:		rates = kzalloc_objs(*rates, num_rates);
1028:		if (!rates)
1029:			goto exit_free_channels;
1030:	
1031:		/*
1032:		 * Initialize Rate list.
1033:		 */
1034:		for (i = 0; i < num_rates; i++)
1035:			rt2x00lib_rate(&rates[i], i, rt2x00_get_rate(i));
1036:	
1037:		/*
1038:		 * Initialize Channel list.
1039:		 */
1040:		for (i = 0; i < spec->num_channels; i++) {
1041:			rt2x00lib_channel(&channels[i],
1042:					  spec->channels[i].channel,
1043:					  spec->channels_info[i].max_power, i);
1044:		}
1045:	
1046:		/*
1047:		 * Intitialize 802.11b, 802.11g
1048:		 * Rates: CCK, OFDM.
1049:		 * Channels: 2.4 GHz
1050:		 */
1051:		if (spec->supported_bands & SUPPORT_BAND_2GHZ) {
1052:			rt2x00dev->bands[NL80211_BAND_2GHZ].n_channels = 14;
1053:			rt2x00dev->bands[NL80211_BAND_2GHZ].n_bitrates = num_rates;
1054:			rt2x00dev->bands[NL80211_BAND_2GHZ].channels = channels;
1055:			rt2x00dev->bands[NL80211_BAND_2GHZ].bitrates = rates;
1056:			hw->wiphy->bands[NL80211_BAND_2GHZ] =
1057:			    &rt2x00dev->bands[NL80211_BAND_2GHZ];
1058:			memcpy(&rt2x00dev->bands[NL80211_BAND_2GHZ].ht_cap,
1059:			       &spec->ht, sizeof(spec->ht));
1060:		}
1061:	
1062:		/*
1063:		 * Intitialize 802.11a
1064:		 * Rates: OFDM.
1065:		 * Channels: OFDM, UNII, HiperLAN2.
1066:		 */
1067:		if (spec->supported_bands & SUPPORT_BAND_5GHZ) {
1068:			rt2x00dev->bands[NL80211_BAND_5GHZ].n_channels =
1069:			    spec->num_channels - 14;
1070:			rt2x00dev->bands[NL80211_BAND_5GHZ].n_bitrates =
1071:			    num_rates - 4;
1072:			rt2x00dev->bands[NL80211_BAND_5GHZ].channels = &channels[14];
1073:			rt2x00dev->bands[NL80211_BAND_5GHZ].bitrates = &rates[4];
1074:			hw->wiphy->bands[NL80211_BAND_5GHZ] =
1075:			    &rt2x00dev->bands[NL80211_BAND_5GHZ];
1076:			memcpy(&rt2x00dev->bands[NL80211_BAND_5GHZ].ht_cap,
1077:			       &spec->ht, sizeof(spec->ht));
1078:		}
1079:	
1080:		return 0;
1081:	
1082:	 exit_free_channels:
1083:		kfree(channels);
1084:		rt2x00_err(rt2x00dev, "Allocation ieee80211 modes failed\n");
1085:		return -ENOMEM;
1086:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c]

gemini-3-flash-preview

							input: 128429
							output: 57
							thoughts: 658
						

**Analyzing rt2x00lib and uncovering potential issues**

Okay, let's break this down. First, I'm noting the assignment: `hw->wiphy->bands[NL80211_BAND_2GHZ] = &rt2x00dev->bands[NL80211_BAND_2GHZ];`. Right, `rt2x00dev->bands` is an array *within* the `rt2x00dev` structure. So, we're making `hw->wiphy->bands[NL80211_BAND_2GHZ]` point directly to a member of `rt2x00dev`. Makes sense so far, it's about linking the hardware representation with the generic framework.

Now, looking at `rt2x00lib_remove_hw`, specifically the `kfree` call: `kfree(rt2x00dev->hw->wiphy->bands[NL80211_BAND_2GHZ]->channels);`.  That's equivalent to `kfree(rt2x00dev->bands[NL80211_BAND_2GHZ].channels)`. This is correct because `channels` was allocated using `kzalloc_objs`. So, we are freeing a pointer *within* the `rt2x00dev` structure. Confirmed!

Aha! Now here's something that feels off. In `rt2x00lib_probe_hw_modes`, I see `rt2x00dev->bands[NL80211_BAND_5GHZ].channels = &channels[14];`.  If the number of channels supported (`spec->num_channels`) is *less* than 14, this is going to be an out-of-bounds access. Let's dig deeper: for the `RF5222` configuration, `spec->num_channels` equals `ARRAY_SIZE(rf_vals_5222)`, which is 14 + 18 = 32. Okay, for that particular RF type, we should be good. However, if other RF types have a limited number of channels and do *not* include `SUPPORT_BAND_5GHZ`, this offset of 14 will cause problems. Need to investigate the channel count in the context of the RF type.

I've found another potential issue in `rt2x00lib_probe_hw_modes`:
```c
1040:		for (i = 0; i < spec->num_channels; i++) {
1041:			rt2x00lib_channel(&channels[i],
1042:					  spec->channels[i].channel,
1043:					  spec->channels_info[i].max_power, i);
1044:		}
```
Now, `spec->channels_info` was allocated in `rt2500usb_probe_hw_mode` as `kzalloc_objs(*info, spec->num_channels)`. So that looks fine, no issues here as each element of `spec->channels_info` is properly allocated for as many elements as needed for the number of channels.

Alright, another thing is now apparent: `memcpy(&rt2x00dev->bands[NL80211_BAND_2GHZ].ht_cap, &spec->ht, sizeof(spec->ht));`. So, `spec->ht` is a `struct ht_cap`. Need to check this `struct hw_mode_spec` to ensure that this is being initialized correctly and consistently across all supported devices.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:hw_mode_spec]

map[SourceCode: 381:	/**
 382:	 * struct hw_mode_spec: Hardware specifications structure
 383:	 *
 384:	 * Details about the supported modes, rates and channels
 385:	 * of a particular chipset. This is used by rt2x00lib
 386:	 * to build the ieee80211_hw_mode array for mac80211.
 387:	 *
 388:	 * @supported_bands: Bitmask contained the supported bands (2.4GHz, 5.2GHz).
 389:	 * @supported_rates: Rate types which are supported (CCK, OFDM).
 390:	 * @num_channels: Number of supported channels. This is used as array size
 391:	 *	for @tx_power_a, @tx_power_bg and @channels.
 392:	 * @channels: Device/chipset specific channel values (See &struct rf_channel).
 393:	 * @channels_info: Additional information for channels (See &struct channel_info).
 394:	 * @ht: Driver HT Capabilities (See &ieee80211_sta_ht_cap).
 395:	 */
 396:	struct hw_mode_spec {
 397:		unsigned int supported_bands;
 398:	#define SUPPORT_BAND_2GHZ	0x00000001
 399:	#define SUPPORT_BAND_5GHZ	0x00000002
 400:	
 401:		unsigned int supported_rates;
 402:	#define SUPPORT_RATE_CCK	0x00000001
 403:	#define SUPPORT_RATE_OFDM	0x00000002
 404:	
 405:		unsigned int num_channels;
 406:		const struct rf_channel *channels;
 407:		const struct channel_info *channels_info;
 408:	
 409:		struct ieee80211_sta_ht_cap ht;
 410:	};
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00.h]

gemini-3-flash-preview

							input: 130545
							output: 64
							thoughts: 3700
						

**Code Review: Deep Dive into rt2500usb Driver**

Okay, let's break this down. First, the `memcpy` - looks straightforward, no immediate red flags. Then, I dug into `rt2500usb_probe_hw_mode` and *bam* - a potential buffer overflow! The code allocates channel info based on `spec->num_channels`, but the subsequent loop unconditionally iterates up to 14, regardless of the size of the allocated buffer. I checked, and the RF types might have fewer than 14 channels, which means writing out-of-bounds, likely a crash. I checked the RF types, and some have 14 channels, but one has 32! So the code might work for the most common devices.

Next I pondered, what if `rt2x00_rf(rt2x00dev, ...)` doesn't match a known RF type? If none match, `spec->num_channels` would remain zero, and then the allocation could potentially return `ZERO_SIZE_PTR`, leading to a crash in that `for` loop, even if the driver checks for invalid RF chipset.

But wait, `rt2500usb_init_eeprom` checks all the RF types, which should make it safe.

Then, there's `rt2500usb_init_eeprom` with `rt2x00_set_chip`. The driver grabs the RF type from the EEPROM and sets it. If the `value` is something unexpected? The code in `rt2500usb_init_eeprom` covers all known RF types, so that should be okay.

Then, in `rt2500usb_probe_hw_mode` I'm checking the `rt2x00_eeprom_addr`. The address is within bounds, so that should be ok.

Moving to the USB layer, I checked a few things. `rt2x00usb_vendor_request` requires that `rt2x00dev->dev` is not NULL. I checked earlier, and it should be fine. `usb_reset_device` called in `rt2x00usb_probe` - the device could disappear, but the function continues.

`rt2x00lib_probe_dev` had an `alloc_ordered_workqueue` and `wiphy_name`. But the code will compile, so it shouldn't crash. Another spot in that function uses `hrtimer_setup` and that's likely a newer API. I should check if the older `hrtimer_init` is also supported. And, when removing the device, `hrtimer_cancel` is used, which looks safe.

Next I looked at `destroy_workqueue` in `rt2x00lib_remove_dev`. If the workqueue is not `NULL`, the function destroys it. The code cancels any work items, which is standard.

`cancel_work_sync`, `cancel_delayed_work_sync`, and related functions are safe even when called on uninitialized work items, if the device has not been used.

In `rt2x00queue_alloc_rxskb`, the code uses `dma_map_single`. If `rt2x00dev->dev` is `NULL` that could be bad news. But it's assigned in `rt2x00usb_probe`. In `rt2x00usb_probe`, `rt2x00dev->dev` gets initialized.

If `ieee80211_alloc_hw` fails, the code handles it. Similarly, the code handles failures in `rt2x00usb_alloc_reg` and `devm_kmalloc`. And if `rt2x00lib_probe_dev` fails, the code cleans up properly. The code in `rt2x00lib_remove_dev` calls `ieee80211_free_hw` to free the hardware, including the device.

In `rt2x00lib_remove_dev`, the code unregisters LEDs and debug information. If registration never occurred, this would be a no-op, so safe. `destroy_workqueue` is called. If the workqueue was never created, it would be `NULL`, so also safe.

When a device is removed, the driver calls `rt2x00lib_disable_radio`, which will write to the USB device. So the USB device should be initialized.

I also see `clear_bit` being called. It's safe. Then I spotted that `rt2x00lib_probe_dev` assigns the vif data size, which is safe. Finally, `rt

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00lib_set_if_combinations]

map[SourceCode:1326:	static inline void rt2x00lib_set_if_combinations(struct rt2x00_dev *rt2x00dev)
1327:	{
1328:		struct ieee80211_iface_limit *if_limit;
1329:		struct ieee80211_iface_combination *if_combination;
1330:	
1331:		if (rt2x00dev->ops->max_ap_intf < 2)
1332:			return;
1333:	
1334:		/*
1335:		 * Build up AP interface limits structure.
1336:		 */
1337:		if_limit = &rt2x00dev->if_limits_ap;
1338:		if_limit->max = rt2x00dev->ops->max_ap_intf;
1339:		if_limit->types = BIT(NL80211_IFTYPE_AP);
1340:	#ifdef CONFIG_MAC80211_MESH
1341:		if_limit->types |= BIT(NL80211_IFTYPE_MESH_POINT);
1342:	#endif
1343:	
1344:		/*
1345:		 * Build up AP interface combinations structure.
1346:		 */
1347:		if_combination = &rt2x00dev->if_combinations[IF_COMB_AP];
1348:		if_combination->limits = if_limit;
1349:		if_combination->n_limits = 1;
1350:		if_combination->max_interfaces = if_limit->max;
1351:		if_combination->num_different_channels = 1;
1352:	
1353:		/*
1354:		 * Finally, specify the possible combinations to mac80211.
1355:		 */
1356:		rt2x00dev->hw->wiphy->iface_combinations = rt2x00dev->if_combinations;
1357:		rt2x00dev->hw->wiphy->n_iface_combinations = 1;
1358:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c]

gemini-3-flash-preview

							input: 135957
							output: 65
							thoughts: 213
						

**Initial Assessment and Bug Discovery**

Okay, so the `max_ap_intf` is 1, which means an early return. Seems safe enough on the surface. But wait, I've just spotted something in `rt2x00lib_probe_dev`! Looking closely, there's a potential issue at line 1387:

```c
1387:			rt2x00dev->drv_data = kzalloc(rt2x00dev->ops->drv_data_size,
1388:				                      GFP_KERNEL);
```

Specifically the `drv_data_size`. I remember there could be some issues. Okay, checking `rt2500usb.c`, `drv_data_size` isn't set. It is zero. Fine! Safe.

But, hold on, there's another point. I've found another potential issue in `rt2x00lib_probe_dev`!

```c
1449:		rt2x00dev->extra_tx_headroom = rt2x00dev_extra_tx_headroom(rt2x00dev);
```

Let's dive into that `rt2x00dev_extra_tx_headroom` function.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00dev_extra_tx_headroom]

map[SourceCode:1360:	static unsigned int rt2x00dev_extra_tx_headroom(struct rt2x00_dev *rt2x00dev)
1361:	{
1362:		if (WARN_ON(!rt2x00dev->tx))
1363:			return 0;
1364:	
1365:		if (rt2x00_is_usb(rt2x00dev))
1366:			return rt2x00dev->tx[0].winfo_size + rt2x00dev->tx[0].desc_size;
1367:	
1368:		return rt2x00dev->tx[0].winfo_size;
1369:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c]

gemini-3-flash-preview

							input: 136757
							output: 64
							thoughts: 1599
						

**Analysis of the rt2x00 Driver Code**

Okay, let's break this down methodically. First, I see a `WARN_ON(!rt2x00dev->tx)` call.  The code checks if `rt2x00dev->tx` is NULL. That seems suspect, but a quick check reveals that `rt2x00queue_allocate` *does* initialize it, setting it to a valid memory location. So, that warning path should never be triggered, making that safe.

Now, let's move on to `rt2x00dev_extra_tx_headroom`. This function calculates some kind of head room, using `rt2x00dev->tx[0].winfo_size + rt2x00dev->tx[0].desc_size`. I remember from looking at the `rt2500usb_queue_init` function that, for the relevant queue types, `winfo_size` isn't actually set and defaults to zero, and `desc_size` is set to `TXD_DESC_SIZE`, which is 20.  So, the function correctly returns 20. Another safe case, good.

Next, I see a check `if (rt2x00dev->bcn->limit > 0)` in `rt2x00lib_probe_dev`. Looking back to `rt2x00queue_allocate`, `rt2x00dev->bcn` is indeed initialized.  `rt2500usb_queue_init` sets `limit` to 1. So, this should always be true. No issues here.

In `rt2x00lib_probe_dev`, I see `wiphy_ext_feature_set`.  This looks like a routine to set the extended feature, which is the CQM RSSI list feature. This seems safe.

Later in `rt2x00lib_probe_dev`, I see `rt2x00rfkill_register(rt2x00dev)`. That seems safe.

Now for `rt2500usb_probe_hw`. This looks more interesting.  I see a register read (`rt2500usb_register_read`), followed by a write.  The code reads the value of `MAC_CSR19` register, modifies a specific bit field (`MAC_CSR19_DIR0`), and then writes it back.  The concern I have is if `rt2500usb_register_read` fails.  If it fails, `reg` is not initialized which could cause problems.  I'll investigate the `rt2x00usb_vendor_request_buff` function, which is called by `rt2500usb_register_read`.  In this routine, the `reg` value is copied to `rt2x00dev->csr.cache` if `usb_control_msg` returns 0. If it doesn't return 0 then `reg` is never initialized! That means the register write could be garbage, and the device might not function as expected. This doesn't seem like a kernel crash, but it can cause the driver to fail to configure the device.

Now, I look at `rt2x00usb_vendor_request`.  If `buffer_length` is 2, and the device only returns 1 byte, the function still returns success (0). This means that only 1 byte of the buffer will be updated. Then `memcpy` uses `buffer_length`, so the second byte of the buffer will not be updated! Still, this seems more like a data corruption issue and not a crash. The returned data would be incorrect, but not necessarily cause a crash.

I continue to analyze `rt2x00usb_vendor_request`. Now I see an error code is checked by calling `rt2x00usb_check_usb_error`.

Overall, there's potential for device misconfiguration if the USB transfer fails, or is short. There is a potential bug with uninitialized register value being written back into the device but this seems less likely to crash, but to cause erratic behaviour. I need to keep looking at `rt2x00usb_check_usb_error`.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_check_usb_error]

map[SourceCode:  23:	static bool rt2x00usb_check_usb_error(struct rt2x00_dev *rt2x00dev, int status)
  24:	{
  25:		if (status == -ENODEV || status == -ENOENT)
  26:			return true;
  27:	
  28:		if (!test_bit(DEVICE_STATE_STARTED, &rt2x00dev->flags))
  29:			return false;
  30:	
  31:		if (status == -EPROTO || status == -ETIMEDOUT)
  32:			rt2x00dev->num_proto_errs++;
  33:		else
  34:			rt2x00dev->num_proto_errs = 0;
  35:	
  36:		if (rt2x00dev->num_proto_errs > 3)
  37:			return true;
  38:	
  39:		return false;
  40:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3-flash-preview

							input: 139648
							output: 41
							thoughts: 599
						

**My Analysis of the rt2500usb Driver Code**

Okay, initially I was feeling good, everything seemed safe. Then, hold on, I spotted something! In `rt2500usb_probe_hw`, setting the `REQUIRE_ATIM_QUEUE` flag seemed a bit out of order at first. But a quick check showed that `rt2x00lib_probe_dev` calls `rt2500usb_probe_hw` *before* `rt2x00queue_allocate`, so that's actually fine. The RSSI offset assignment is also safe.

Wait, another potential issue surfaced in `rt2x00usb_probe`. The call to `usb_reset_device` is concerning. If it triggers a device re-probe while `rt2x00usb_probe` is already executing, that could lead to serious problems, a race condition at least.

And here's another one: the use of `devm_kmalloc` for `rt2x00dev->anchor` is problematic. I realized the `anchor` is freed using `usb_kill_anchored_urbs` in the error handling path of `rt2x00usb_probe`. Is this safe? No, `devm_kmalloc` is used, so the kernel should handle cleanup, meaning this should be ok. But I had to double-check! Where else is `rt2x00dev->anchor` used? Not in `rt2x00usb_disconnect`. Hmmm... I need to track down all uses of `anchor` in the driver, just to be sure. Time to investigate!

log-in to see details

map[Name:anchor SourceTreePrefix:drivers/net/wireless/ralink/rt2x00/]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 140664
							output: 27
							thoughts: 15
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and presented as if it were my own internal monologue:

**Investigating the `rt2x00dev->anchor` Structure**

Right, so I need to dig into something related to the `rt2x00` driver. My initial instinct is to go directly after the `rt2x00dev->anchor` member. Given the architecture of the `rt2x00` family, this likely represents a crucial, central point of the device driver's internal state. It's probably a pointer or a structure containing other pointers or related data. The name "anchor" suggests that it's the root of a linked structure, or a central point for device interaction within the driver. I expect that a quick search using this symbol will quickly illuminate its role and relationships. That search is going to be my next step. From the results, I should be able to deduce its function within the device driver and how its values impact or are impacted by other devices within the system. Let's see what that search turns up!

map[Name:rt2x00_dev::anchor]

map[References:[map[ReferenceKind:writes ReferencingEntityKind:function ReferencingEntityName:rt2x00usb_probe SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c SourceLine:829] map[ReferenceKind:reads ReferencingEntityKind:function ReferencingEntityName:rt2x00usb_probe SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c SourceLine:832] map[ReferenceKind:reads ReferencingEntityKind:function ReferencingEntityName:rt2x00usb_probe SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c SourceLine:836] map[ReferenceKind:reads ReferencingEntityKind:function ReferencingEntityName:rt2x00usb_probe SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c SourceLine:845] map[ReferenceKind:reads ReferencingEntityKind:function ReferencingEntityName:rt2x00usb_register_read_async SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c SourceLine:220] map[ReferenceKind:reads ReferencingEntityKind:function ReferencingEntityName:rt2x00usb_register_read_async_cb SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c SourceLine:182] map[ReferenceKind:reads ReferencingEntityKind:function ReferencingEntityName:rt2x00usb_uninitialize SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c SourceLine:748]] TruncatedOutput:false]

gemini-3-flash-preview

							input: 141446
							output: 66
							thoughts: 9217
						

**Bug Hunting in the RT2x00USB Driver**

Okay, here's what I've been thinking about this RT2x00USB driver code.  First, there are some memory management considerations in `rt2x00usb_probe` with `devm_kmalloc` and the device's lifetime, but those seem okay in this USB context because `disconnect` happens before the memory is cleaned up.

Then, there are the asynchronous read callbacks. `usb_unanchor_urb` is called in `rt2x00usb_register_read_async_cb`. But I found that `kmalloc` is used with `GFP_ATOMIC` and that `read_data->reg` is DMA-able which could be a problem, but it's used with `usb_fill_control_urb` with `usb_rcvctrlpipe`, so it should be fine.  There's cleanup logic in `usb_submit_urb`'s error path, so that seems sound. `usb_kill_anchored_urbs` calls the callback with `urb->status = -ENOENT`. This is probably fine. `usb_unanchor_urb` is safe to call multiple times.

I considered a potential issue with `usb_reset_device` and the device state in `rt2x00usb_probe` but I think I've discounted this as a critical problem. I checked that the device id's are assigned to the correct driver.

Next, I looked at vendor requests. The register `0x0308` in `rt2500usb_init_registers` is suspect because it's before the CSR registers.  `rt2500usb_register_read` can return garbage in `rt2500usb_init_registers`. I then considered a potential deadlock issue with a zero timeout to `usb_control_msg` in `rt2x00usb_vendor_request` that might hang a workqueue thread, but that seems to be correctly handled. I've also checked the present flag and `rt2x00dev` and determined it is safe.
The mutex usage in register access routines seems correct and locked. I also checked `rt2x00usb_vendor_request` and the mutex; all is good.

I found a possible bug, although the returned value would not cause the crash, in `rt2500usb_bbp_read`: uninitialized stack variable if `WAIT_FOR_BBP` fails.

I then dismissed an overflow issue for `timeout` and `msecs_to_jiffies` in `rt2x00usb_vendor_request`.

In `rt2500usb_probe_hw`, I checked the `num_channels` issue, but it should be safe. I found that if `spec->num_channels` is zero, a crash would happen. I double checked the case and determined it should not be possible. Also, I determined the loops in `rt2500usb_probe_hw_mode` should be safe, and also that `rt2500usb_probe` and `disconnect` can't happen at the same time.

Wait, the code in `rt2x00usb_probe` allocates and frees memory appropriately.

I then started analyzing the error "SYZFAIL: tun: can't open /dev/net/tun". I started looking at `rt2x00usb_find_endpoints` and I found an error with `usb_maxpacket`. If `wMaxPacketSize` is 0, this could cause a divide by zero when calculating the length!

`rt2500usb_get_tx_data_len`: `length % entry->queue->usb_maxpacket`! It crashes there!
This happens when a packet is sent, such as when sending a beacon. This will cause a kernel crash (Divide Error). The workqueue thread can be killed.

I am checking if it's the case with other rt2x00 drivers. I found that in the `rt73usb.c` and `rt2800usb.c` the same vulnerability exists! The issue is with division by `usb_maxpacket` with no check for zero.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c IncludeLines:true Name:rt2500usb_get_tx_data_len]

map[SourceCode:1199:	static int rt2500usb_get_tx_data_len(struct queue_entry *entry)
1200:	{
1201:		int length;
1202:	
1203:		/*
1204:		 * The length _must_ be a multiple of 2,
1205:		 * but it must _not_ be a multiple of the USB packet size.
1206:		 */
1207:		length = roundup(entry->skb->len, 2);
1208:		length += (2 * !(length % entry->queue->usb_maxpacket));
1209:	
1210:		return length;
1211:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c]

gemini-3-flash-preview

							input: 151884
							output: 60
							thoughts: 3022
						

**Analyzing Potential USB Driver Vulnerabilities**

Okay, let's break this down. My initial thought was about `usb_maxpacket` potentially being zero, which I need to investigate, and then I found the code snippets and this could be a potential vulnerability if `wMaxPacketSize` is 0 in a bulk endpoint, as I found in `rt2x00usb_find_endpoints` and `rt2x00usb_assign_endpoint`.  A malicious device *could* provide a zero value, even if the spec says it should be non-zero for bulk. The USB core *might* have some checks, but maybe it doesn't.

Now, I've got a syzkaller report for a divide error in `rt2x00usb_get_tx_data_len`, which was reported recently, but the user says the reproducer exits with status 67 and a "tun" error.  If there was a divide by zero, the reproducer would probably be killed, as opposed to exiting with a specific status code like 67, and a `tun` error like that can mean a problem in the environment.

I need to look for any hidden crashes in the strace output, and the user's focus on the `SIGKILL` signal is important, because the "tun" error can mean something is in a weird state. If `syz_usb_connect` is called it means that a USB device is being created. If the driver's `probe` function crashes, `syz_usb_connect` *might* not return. Now, this `probe` happens in a kernel thread, so I should be carefully tracking the behavior of the device creation and initialization.

Wait, I think I've got something! The user is saying that the reproducer exits with status 67, and this is a key detail. That status often means a successful test, but with a crash, so let's look at the `rt2500usb` driver more closely. I should check for any NULL pointer dereferences as well. Now I see that `rt2x00dev->rx` and `rt2x00dev->tx` are set via `rt2x00queue_allocate`, so that is probably not the issue.

I think I found a bug in `rt2x00usb_probe`.  The call to `usb_reset_device` might be problematic because it can potentially destroy and recreate the `usb_interface` while the `probe` function is still active.  If `usb_reset_device` triggers a disconnect and that calls `rt2x00usb_disconnect` before the interface data is set, there's a serious bug: it'll get `usb_get_intfdata` which returns NULL, and then the driver crashes. This is a classic race. This is *likely* the cause of the crash.

Then, there's a commit that fixes that race condition! Wait, let's verify my hypothesis. If my reading is correct: `rt2x00usb_probe` calls `usb_reset_device`, which triggers a disconnect. `rt2x00usb_disconnect` is called *before* `usb_set_intfdata` is called. Bingo! This is the likely crash. Let's trace it... 1. Probe, 2. reset, which will disconnect, 3. Disconnect is called, 4. The `hw` value is NULL, 5. Crash. This would likely cause a failure of the device and a status 67 in syzkaller.

Let's check the code for this race-condition: `rt2x00usb_disconnect` gets NULL, it crashes. But now let's see why the tun problem and if there's any memory corruption issue, like an out-of-bounds write.

If I look at `rt2x00usb_vendor_request`, if `buffer_length` is larger than the actual size of `buffer`, then this is a bug. Now, let's see how `rt2500usb_register_read` interacts with it. And it seems okay, as the `buffer_length` seems safe there.

Let's look at `rt2500usb_register_multiwrite` calls `rt2x00usb_vendor_request_buff` with `length`. What is happening if `length > CSR_CACHE_SIZE`? Ah! It handles the loop properly because it splits the requests into CSR_CACHE_SIZE chunks. Safe there too.

Wait, maybe a bug in `rt2500usb_config_intf`, where `3 * sizeof(__le16)` is 6. 6 <= 8. Safe.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c IncludeLines:true Name:rt2x00lib_crypto]

map[SourceCode: 446:	/*
 447:	 * Configuration structure for hardware encryption.
 448:	 */
 449:	struct rt2x00lib_crypto {
 450:		enum cipher cipher;
 451:	
 452:		enum set_key_cmd cmd;
 453:		const u8 *address;
 454:	
 455:		u32 bssidx;
 456:	
 457:		u8 key[16];
 458:		u8 tx_mic[8];
 459:		u8 rx_mic[8];
 460:	
 461:		int wcid;
 462:	};
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00.h]

gemini-3-flash-preview

							input: 156227
							output: 64
							thoughts: 3484
						

**Deep Dive into the rt2x00usb Driver – A Bug Hunt**

Okay, let's break this down. First, I'm checking sizes, making sure `rt2x00usb_vendor_request_buff` is safe regarding the buffer size and the calls to `rt2x00usb_vendor_req_buff_lock`. Then I got hit with a possible bug in `rt2x00usb_vendor_req_buff_lock` related to a `memcpy` into a cache of size 8, with a size that is guaranteed to be <= 8.  That's probably safe. I then jumped into `rt2x00usb_vendor_request`, where I checked for a possible overflow. The function is supposed to receive at most `buffer_length` number of bytes, so I concluded that's safe, assuming the device returns less or equal the number of requested bytes. Then, if `usb_control_msg` returns success but transfers 0 bytes, `rt2x00usb_vendor_request` will return 0, and the function will copy uninitialized or old data from the cache. That could be a problem!

Next, I noted an earlier fix related to a shared buffer for register reads and that seemed unrelated to this specific problem. I took a look at the strace output mentioned by the user, and if it has a `+++ killed by SIGKILL +++`, that's something to investigate. Moving on, I analyzed `rt2x00usb_probe` and made sure that even if `usb_reset_device` returns `-ENODEV`, we still continue the probe to return the error correctly. However, if the reset causes a disconnect, then the disconnect function is executed and then the probe is still active, that has to be checked by the USB core. Then, I looked into the consequences of `usb_reset_device`, and how it might change the device configuration and cause problems with the driver assuming the configuration remains the same. I then checked if the device has multiple interfaces, and all of them are reset. That could be a problem. Then I noted `usb_reset_device` can return other errors such as `-EPROTO`.

I noted that the reset was added to fix firmware issues. I'm focusing on the user's report about the reproducer failing with status 67, `EX_NOUSER`. That likely means the environment setup is failing within syzkaller, perhaps a missing device or resource. A related message, "SYZFAIL: tun: can't open /dev/net/tun (errno 19: No such device)" with `ENODEV` (error 19), suggests a missing or uninitialized `tun` driver or that we could have a system crash. Then, I decided to check `rt2x00usb_probe` again regarding the use of `devm_kmalloc` to allocate the USB anchor, but it's checked for NULL.

I looked into `rt2x00lib_probe_dev`, and ensured that the workqueue name construction using `wiphy_name` and `alloc_ordered_workqueue` isn't a format string vulnerability. The name is safely used with `"%s"` in `alloc_ordered_workqueue`. I checked for old kernels with different prototypes of `alloc_ordered_workqueue`, which are not a concern in modern kernel versions.  I also found the usage of `hrtimer_setup` should be fine. I went back to `rt2x00usb_vendor_request`, checking if the `buffer` passed into `usb_control_msg` is on the stack, but that is safe since the function copies the buffer into a DMA-able buffer with `rt2x00usb_vendor_req_buff_lock`. I checked `rt2x00usb_eeprom_read` and ensured that the `eeprom` buffer is allocated correctly. I also checked `rt2x00usb_vendor_request_buff` which passes a `buffer` parameter to `rt2x00usb_vendor_req_buff_lock` that is copied into `rt2x00dev->csr.cache` and from which the data is then copied to `buffer` with `memcpy`. That is safe. Finally, I'm now looking into `rt2x00usb_work_rxdone` and `rt2x00usb_work_txdone`, I'll check it.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_work_txdone]

map[SourceCode: 248:	static void rt2x00usb_work_txdone(struct work_struct *work)
 249:	{
 250:		struct rt2x00_dev *rt2x00dev =
 251:		    container_of(work, struct rt2x00_dev, txdone_work);
 252:		struct data_queue *queue;
 253:		struct queue_entry *entry;
 254:	
 255:		tx_queue_for_each(rt2x00dev, queue) {
 256:			while (!rt2x00queue_empty(queue)) {
 257:				entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
 258:	
 259:				if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
 260:				    !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
 261:					break;
 262:	
 263:				rt2x00usb_work_txdone_entry(entry);
 264:			}
 265:		}
 266:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3-flash-preview

							input: 161107
							output: 66
							thoughts: 17
						

Okay, here's my interpretation of that.

**Analyzing the rt2x00usb_work_txdone_entry Function**

Alright, let's break this down. From a hardware perspective, understanding the `rt2x00usb_work_txdone_entry` function is crucial. I immediately think about its place in the overall USB Wi-Fi driver architecture. This is clearly a critical component for managing the transmission completion process. It's the point where we determine if a packet actually made it through the air successfully. We're looking at an interrupt handler, a callback, or a scheduled work item – it's going to be something that gets triggered in response to an event, almost certainly linked to a hardware indication that a transmission has finished.

I need to understand what specific hardware registers are being interrogated, which flags are being checked, and how the driver interprets those results. Is this using DMA completion interrupts? Is it relying on some kind of status polling? What kind of buffer management is in play here? The interaction between the USB endpoints, the DMA engine, and the radio chip is the key here.

My mind immediately begins to formulate questions. Are we dealing with error detection and retransmission mechanisms? How does the driver handle situations where a packet isn't acknowledged? What are the implications for congestion control and rate adaptation? How is the driver handling potentially complex TX descriptors and their linking? This seems likely to be a complex structure that needs careful reading and interpreting. My experience tells me that these types of function often end up being at the heart of many performance issues and stability problems. I need to look for any potential race conditions between this function and other parts of the driver, specifically those dealing with packet queue management or interrupt handling.

Basically, I want to understand:
*   How we determine TX completion.
*   The hardware interaction
*   Error handling.
*   How the system handles buffer management during transmission completion.
*   How the results of this function are communicated to other layers of the networking stack.
*   Potential for concurrency issues.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_work_txdone_entry]

map[SourceCode: 229:	/*
 230:	 * TX data handlers.
 231:	 */
 232:	static void rt2x00usb_work_txdone_entry(struct queue_entry *entry)
 233:	{
 234:		/*
 235:		 * If the transfer to hardware succeeded, it does not mean the
 236:		 * frame was send out correctly. It only means the frame
 237:		 * was successfully pushed to the hardware, we have no
 238:		 * way to determine the transmission status right now.
 239:		 * (Only indirectly by looking at the failed TX counters
 240:		 * in the register).
 241:		 */
 242:		if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags))
 243:			rt2x00lib_txdone_noinfo(entry, TXDONE_FAILURE);
 244:		else
 245:			rt2x00lib_txdone_noinfo(entry, TXDONE_UNKNOWN);
 246:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3-flash-preview

							input: 161954
							output: 60
							thoughts: 652
						

**My Analysis of the `rt2x00usb` Driver**

Okay, I'm feeling confident, things seem safe, but wait! Hold on a second, I think I've spotted a potential issue within the `rt2x00usb_vendor_request` function.  Line 51 has a potential null-pointer dereference: `struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev);`. If `rt2x00dev->dev` is NULL for some reason, this will definitely crash. Though, I recall that `rt2x00dev->dev` should be initialized during the probe process, so let me quickly cross-reference that to be certain...

Aha!  Hang on, the user is saying something about `SIGKILL` in the strace output! They want me to dig into that carefully. Okay, if I'm interpreting this correctly, and the strace output indicates a `+++ killed by SIGKILL +++`, that suggests something is abruptly terminating the process, which is important to understand.

Wait a minute, I think I've found another potential issue, this time in `rt2x00usb_probe`. Line 805, `usb_reset_device(usb_dev);`, this might return an error condition, which is something I need to keep in mind. If it does return an error, then it could leave the device in a precarious state.

Alright, another one! This is getting interesting. If `usb_reset_device` triggers a disconnect condition, then `rt2x00usb_disconnect` will be called. Now, within this disconnect function, `rt2x00lib_remove_dev` will be called, which in turn calls `rt2x00lib_uninitialize`.  Then, `rt2x00lib_uninitialize` calls `rt2x00usb_uninitialize` and this is where it gets spicy. Inside `rt2x00usb_uninitialize`, there's a call to `usb_kill_anchored_urbs(rt2x00dev->anchor)`. The catch? `rt2x00dev->anchor` *might* be NULL! It is allocated later.

Let's look at the `rt2x00usb_probe` function again! It calls `usb_reset_device` *before* allocating `rt2x00dev->anchor`. I see it clearly now, line 805, `usb_reset_device(usb_dev);` then further down, on line 829, `rt2x00dev->anchor = devm_kmalloc(...);`.

Yes! So, the crux of the problem is that if `usb_reset_device` causes a disconnect, then the disconnect handler path is taken. It hits `rt2x00usb_disconnect`, which hits `rt2x00lib_remove_dev`, then calls `rt2x00usb_uninitialize`.  Because `rt2x00dev->anchor` is NULL (kzalloc'd as part of `hw`), then when `usb_kill_anchored_urbs(rt2x00dev->anchor)` is called, it will be passing `NULL` to the function.  That will cause the program to crash!  I will now confirm this by looking at the documentation of the `usb_kill_anchored_urbs` function.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:usb_kill_anchored_urbs]

map[SourceCode: 801:	/**
 802:	 * usb_kill_anchored_urbs - kill all URBs associated with an anchor
 803:	 * @anchor: anchor the requests are bound to
 804:	 *
 805:	 * This kills all outstanding URBs starting from the back of the queue,
 806:	 * with guarantee that no completer callbacks will take place from the
 807:	 * anchor after this function returns.
 808:	 *
 809:	 * This routine should not be called by a driver after its disconnect
 810:	 * method has returned.
 811:	 */
 812:	void usb_kill_anchored_urbs(struct usb_anchor *anchor)
 813:	{
 814:		struct urb *victim;
 815:		int surely_empty;
 816:	
 817:		do {
 818:			spin_lock_irq(&anchor->lock);
 819:			while (!list_empty(&anchor->urb_list)) {
 820:				victim = list_entry(anchor->urb_list.prev,
 821:						    struct urb, anchor_list);
 822:				/* make sure the URB isn't freed before we kill it */
 823:				usb_get_urb(victim);
 824:				spin_unlock_irq(&anchor->lock);
 825:				/* this will unanchor the URB */
 826:				usb_kill_urb(victim);
 827:				usb_put_urb(victim);
 828:				spin_lock_irq(&anchor->lock);
 829:			}
 830:			surely_empty = usb_anchor_check_wakeup(anchor);
 831:	
 832:			spin_unlock_irq(&anchor->lock);
 833:			cpu_relax();
 834:		} while (!surely_empty);
 835:	}
 SourceFile:drivers/usb/core/urb.c]

gemini-3-flash-preview

							input: 163965
							output: 654
							thoughts: 62914
						

gemini-3.1-pro-preview

							input: 264761
							output: 24
							thoughts: 11695
						

**Root Cause Analysis of USB Kernel Crash**

Okay, here's the breakdown, starting with the assumptions and working toward the likely root cause. The initial strace output, unfortunately, isn't showing the crash itself but rather a failure in the syzkaller sandbox setup, or timeout errors, which aren't the primary issue. I need to focus on the provided C code, because this is the *actual* crash reproducer, not the strace. I'll need to work through the USB device connection sequence and descriptor parsing to find a kernel issue.

The syzkaller repro uses `syz_usb_connect` multiple times, which opens a `/dev/raw-gadget` connection. This is our key.

*   **First connection:** Connects a `rt2500usb` device, disconnects it immediately. This establishes the driver.

*   **Second connection:** Attempts to connect a device (at `0x200000000b40`) using all zeros. This *is* interesting since the C code provides a device and configuration descriptor.

    *   `idVendor=0`, `idProduct=0`... not a *likely* candidate for a driver match! I did check, and this is not a common ID.

    *   The second descriptor provides a device with length 36 bytes. The device part is defined, but the configuration descriptor is truncated. This is the issue. The code only provides the first 9 bytes of the configuration descriptor.

    *   The interface descriptor's length (`bLength`) is zero! This is the culprit! This means the kernel is expecting a complete descriptor, but its length is invalid.

*   **Third Connection:** Then connects to `rtl8192cu`.

The problem is the *second* USB device, which connects and then is used for `syz_usb_control_io` commands. The responses are clearly designed for the `asix` driver. This is a red herring; if the device has `idVendor=0` and `idProduct=0`, the `asix` driver, or really *any* USB driver, cannot bind! I am using the all zero device to control the kernel. The all-zero device is being used in the `syz_usb_control_io` calls, but its descriptors are invalid, because its interface has a length of 0.

Based on this analysis, here's my theory:

The crash is *likely* caused by some driver attempting to handle the `syz_usb_control_io` calls on the second device. This happens *after* the `rt2500usb` and `rtl8192cu` drivers connect and, importantly, immediately before the crash. The kernel's USB core is likely expecting a valid configuration and interface descriptor in the device and the zero length interface is causing some kernel memory to be uninitialized in the kernel. This is a very interesting scenario, because the all zeros device should have been immediately rejected, but `syz_usb_connect` provides a valid connection, and `syz_usb_control_io` uses it. This means the all-zeros device is actually connecting.

**Proposed fix**: Validate the configuration descriptor length. This must be fixed to allow `syz_usb_control_io` commands for this USB device.

I would check the `usb_control_io` call and its arguments in the kernel to identify and fix this kernel crash!

map[Expression:rt2500usb_device_table]

map[Output:drivers/net/wireless/ralink/rt2x00/rt2500usb.c=1891=static const struct rt2x00_ops rt2500usb_ops = {
--
drivers/net/wireless/ralink/rt2x00/rt2500usb.c-1907- */
drivers/net/wireless/ralink/rt2x00/rt2500usb.c:1908:static const struct usb_device_id rt2500usb_device_table[] = {
drivers/net/wireless/ralink/rt2x00/rt2500usb.c-1909-	/* ASUS */
--
drivers/net/wireless/ralink/rt2x00/rt2500usb.c=1963=MODULE_DESCRIPTION("Ralink RT2500 USB Wireless LAN driver.");
drivers/net/wireless/ralink/rt2x00/rt2500usb.c:1964:MODULE_DEVICE_TABLE(usb, rt2500usb_device_table);
drivers/net/wireless/ralink/rt2x00/rt2500usb.c-1965-MODULE_LICENSE("GPL");
--
drivers/net/wireless/ralink/rt2x00/rt2500usb.c=1973=static struct usb_driver rt2500usb_driver = {
drivers/net/wireless/ralink/rt2x00/rt2500usb.c-1974-	.name		= KBUILD_MODNAME,
drivers/net/wireless/ralink/rt2x00/rt2500usb.c:1975:	.id_table	= rt2500usb_device_table,
drivers/net/wireless/ralink/rt2x00/rt2500usb.c-1976-	.probe		= rt2500usb_probe,
]

gemini-3.1-pro-preview

							input: 277716
							output: 62
							thoughts: 42
						

Okay, let's dive into this. Here's how I'd approach summarizing the prompt:

**Analyzing the rt2500usb Device Table**

Right, so I need to check something specific within the `rt2500usb` driver. My primary focus is likely on the device table. The prompt points directly to `rt2500usb_device_table` and the file `drivers/net/wireless/ralink/rt2x00/rt2500usb.c`, which tells me exactly where to find it. This device table, as an expert, I immediately understand is a crucial data structure. It likely holds critical information about the USB-based RT2500/RT2x00 chipset devices that the driver supports. It's probably a list of Vendor IDs, Product IDs, and maybe even driver-specific flags or configurations. Checking this table would provide valuable information. It could tell me which specific hardware revisions or models are supported, any special handling they require, or whether there are any known compatibility issues, all critical information for driver development, debugging, or troubleshooting. So, that's my next step.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c IncludeLines:true Name:rt2500usb_device_table]

map[SourceCode:1905:	/*
1906:	 * rt2500usb module information.
1907:	 */
1908:	static const struct usb_device_id rt2500usb_device_table[] = {
1909:		/* ASUS */
1910:		{ USB_DEVICE(0x0b05, 0x1706) },
1911:		{ USB_DEVICE(0x0b05, 0x1707) },
1912:		/* Belkin */
1913:		{ USB_DEVICE(0x050d, 0x7050) },	/* FCC ID: K7SF5D7050A ver. 2.x */
1914:		{ USB_DEVICE(0x050d, 0x7051) },
1915:		/* Cisco Systems */
1916:		{ USB_DEVICE(0x13b1, 0x000d) },
1917:		{ USB_DEVICE(0x13b1, 0x0011) },
1918:		{ USB_DEVICE(0x13b1, 0x001a) },
1919:		/* Conceptronic */
1920:		{ USB_DEVICE(0x14b2, 0x3c02) },
1921:		/* D-LINK */
1922:		{ USB_DEVICE(0x2001, 0x3c00) },
1923:		/* Gigabyte */
1924:		{ USB_DEVICE(0x1044, 0x8001) },
1925:		{ USB_DEVICE(0x1044, 0x8007) },
1926:		/* Hercules */
1927:		{ USB_DEVICE(0x06f8, 0xe000) },
1928:		/* Melco */
1929:		{ USB_DEVICE(0x0411, 0x005e) },
1930:		{ USB_DEVICE(0x0411, 0x0066) },
1931:		{ USB_DEVICE(0x0411, 0x0067) },
1932:		{ USB_DEVICE(0x0411, 0x008b) },
1933:		{ USB_DEVICE(0x0411, 0x0097) },
1934:		/* MSI */
1935:		{ USB_DEVICE(0x0db0, 0x6861) },
1936:		{ USB_DEVICE(0x0db0, 0x6865) },
1937:		{ USB_DEVICE(0x0db0, 0x6869) },
1938:		/* Ralink */
1939:		{ USB_DEVICE(0x148f, 0x1706) },
1940:		{ USB_DEVICE(0x148f, 0x2570) },
1941:		{ USB_DEVICE(0x148f, 0x9020) },
1942:		/* Sagem */
1943:		{ USB_DEVICE(0x079b, 0x004b) },
1944:		/* Siemens */
1945:		{ USB_DEVICE(0x0681, 0x3c06) },
1946:		/* SMC */
1947:		{ USB_DEVICE(0x0707, 0xee13) },
1948:		/* Spairon */
1949:		{ USB_DEVICE(0x114b, 0x0110) },
1950:		/* SURECOM */
1951:		{ USB_DEVICE(0x0769, 0x11f3) },
1952:		/* Trust */
1953:		{ USB_DEVICE(0x0eb0, 0x9020) },
1954:		/* VTech */
1955:		{ USB_DEVICE(0x0f88, 0x3012) },
1956:		/* Zinwell */
1957:		{ USB_DEVICE(0x5a57, 0x0260) },
1958:		{ 0, }
1959:	};
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c]

gemini-3.1-pro-preview

							input: 279271
							output: 39
							thoughts: 66
						

Okay, let me break this down.

**Diving into USB Device Matching**

Alright, so I'm looking at this `USB_DEVICE` macro, and it's supposed to be matching on `idVendor` and `idProduct`. Makes sense, that's the basic device identification. But hold on... It seems like `USB_DEVICE` is setting `match_flags` to `USB_DEVICE_ID_MATCH_DEVICE`. That's not what I expected. If I'm reading this correctly, it means the macro is matching the *device* itself, and not a particular *interface*. That changes things. I need to make sure I understand the scope of that match. Let me go back and double check the definition of `USB_DEVICE` to verify this interpretation. I need to be sure this device is matched at the device level as opposed to the interface level. I'm going to dig into the macro definition, and confirm how the matching is actually happening. This is potentially critical for my use case.

log-in to see details

map[ContextFile:include/linux/usb.h IncludeLines:true Name:USB_DEVICE]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 279613
							output: 20
							thoughts: 12
						

Okay, here's my interpretation of that thought process, tailored for an expert audience:

**Analyzing USB Device Definitions**

Alright, my first instinct when diving into this kind of code is to locate and understand the core structures. So, I'm thinking, "Let's start by zeroing in on the fundamental building blocks of the USB device implementation." The best way to do that is, to begin with the header files. I figure a macro like `USB_DEVICE` is going to be the central definition and I should find its use quickly with a `grep`. That should lead me to the relevant structures, enumerations, and configurations surrounding USB device functionality. That’s where I’ll begin my analysis.

map[Expression:#define USB_DEVICE\(]

map[Output:include/linux/usb.h=982=static inline int usb_make_path(struct usb_device *dev, char *buf, size_t size)
--
include/linux/usb.h-1014- */
include/linux/usb.h:1015:#define USB_DEVICE(vend, prod) \
include/linux/usb.h-1016-	.match_flags = USB_DEVICE_ID_MATCH_DEVICE, \
]

gemini-3.1-pro-preview

							input: 279916
							output: 60
							thoughts: 91
						

Okay, here's my understanding, tailored for an expert's perspective:

**USB Driver Probe Logic - A Quick Mental Walkthrough**

Alright, so `USB_DEVICE` clearly defines a match based on the device ID, setting `match_flags` to `USB_DEVICE_ID_MATCH_DEVICE`. My question is, how does the USB core handle the probe sequence after a device match? Does it call the driver's `probe` function once for the entire device, or does it iterate through each interface and call `probe` individually for each? It's a crucial distinction for driver design, depending on whether the driver is device-level or interface level.

To clarify how drivers are registered, I need to jog my memory, are we using `usb_register_driver` or `usb_register_device_driver`? I seem to have a vague memory of it, it may be time to consult the source code again.

Right, time to check the real-world example of `rt2500usb_driver`. It should illustrate how this is typically handled in a functional USB driver. That will hopefully clear things up quickly.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c IncludeLines:true Name:rt2500usb_driver]

map[SourceCode:1973:	static struct usb_driver rt2500usb_driver = {
1974:		.name		= KBUILD_MODNAME,
1975:		.id_table	= rt2500usb_device_table,
1976:		.probe		= rt2500usb_probe,
1977:		.disconnect	= rt2x00usb_disconnect,
1978:		.suspend	= rt2x00usb_suspend,
1979:		.resume		= rt2x00usb_resume,
1980:		.reset_resume	= rt2x00usb_resume,
1981:		.disable_hub_initiated_lpm = 1,
1982:	};
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c]

gemini-3.1-pro-preview

							input: 280550
							output: 18
							thoughts: 1007
						

**USB Driver Probe Logic - A Deep Dive**

Okay, so I'm looking at this `struct usb_driver` thing. Right, it's for *interfaces*. The USB core should be calling `probe` for each interface within the active configuration. That makes sense. But if a configuration has *zero* interfaces, then, crucially, `probe` will NOT be called. Let's make sure I've got this right; I need to verify how this works. I'm going to check `drivers/usb/core/driver.c`. Right, when a device gets configured, `usb_set_configuration` is called. Okay, it looks like it creates interface devices and adds them to the bus. So, if `bNumInterfaces` is zero, or if something in the parsing skips interfaces, then no interface devices get created, and no interface drivers get probed.

Okay, let me look closer at `usb_parse_configuration` in `drivers/usb/core/config.c`. There's this check:

```c
	if (header->bLength < 2) {
		dev_warn(ddev, "config %d has an invalid descriptor"
		    " of length %d, skipping remainder of the config\n",
		    cfgno, header->bLength);
		break;
	}
```

Wait, now I see, in the C reproducer, the config descriptor looks like this:

```c
*(uint8_t*)0x200000000112 = 9; // bLength
*(uint8_t*)0x200000000113 = 2; // bDescriptorType
*(uint16_t*)0x200000000114 = 0x12; // wTotalLength
*(uint8_t*)0x200000000116 = 1; // bNumInterfaces
*(uint8_t*)0x200000000117 = 0; // bConfigurationValue
*(uint8_t*)0x200000000118 = 0; // iConfiguration
*(uint8_t*)0x200000000119 = 0; // bmAttributes
*(uint8_t*)0x20000000011a = 0; // bMaxPower
```

Okay, the config descriptor is 9 bytes. The next byte is at `0x20000000011b`. Since this memory wasn't explicitly initialized, it's zero! So, the next descriptor has `bLength = 0`. Right. `usb_parse_configuration` sees this and breaks. So, it parses zero interfaces. Wait, `usb_parse_configuration` actually does:

```c
	config->desc.bNumInterfaces = nintf;
```

It updates `bNumInterfaces` to the *actual* number of interfaces it parsed!  So `bNumInterfaces` becomes 0. Then, when `usb_set_configuration` runs, it will see `bNumInterfaces == 0` and create *zero* interfaces. Thus, `rt2500usb_probe` won't be called.

Hold on a second. Is it possible that `0x20000000011b` is *not* zero?  Let's look at the C code; it maps memory as follows:

```c
	syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
```

`MAP_ANONYMOUS` guarantees the memory is zero-initialized. So, yes, it IS zero. Okay, this makes sense.

Wait, what if the crash isn't in `rt2500usb` or `rtl8192cu`? What if the problem is actually in the `asix` driver? The `syz_usb_control_io` thing has some responses for `asix`. How can `asix` actually get probed? Now I see, the second device, `dev=0x200000000

log-in to see details

map[Expression:asix_table]

map[Output:]

gemini-3.1-pro-preview

							input: 282614
							output: 20
							thoughts: 18
						

Here's a summary of my thought process:

**Diving into the ASIX USB Network Driver**

Okay, time to get to the heart of this. My initial instinct is to go straight to the source. Let's see what's happening with the ASIX-based USB network devices. Specifically, I need to take a look at `drivers/net/usb/asix_devices.c`. This file is the obvious starting point, the core implementation for handling these kinds of devices within the kernel. It's likely where I'll find the device-specific initialization routines, the USB interface setup, the interrupt handling, and the data transfer mechanisms. I expect to see the meat of the driver logic here, the low-level interactions that translate USB commands into network traffic. This file is where the magic happens, so it's the right place to begin my investigation.

log-in to see details

map[Expression:USB_DEVICE.*asix]

map[Output:]

gemini-3.1-pro-preview

							input: 282850
							output: 18
							thoughts: 19
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Investigating a Network Driver Issue**

Alright, so we've got a network driver problem, and the first place my mind immediately goes is to start poking around in the `drivers/net/usb` directory. Specifically, I'm thinking about the `asix.c` driver, or something similar to it. That's usually the place to start when you're dealing with USB-to-Ethernet adapters, especially those built around the ASIX chipset, or other common ones. It’s the likely culprit given the nature of USB network devices. I'm assuming we're dealing with a USB network interface. If it's something different, then I'll look into that path later, but I would like to get a handle on what the driver does, and from there I can figure out the problem. This initial dive should give me a good handle on things.

map[Expression:asix_driver]

map[Output:drivers/net/phy/ax88796b.c=86=static void asix_ax88772a_link_change_notify(struct phy_device *phydev)
--
drivers/net/phy/ax88796b.c-96-
drivers/net/phy/ax88796b.c:97:static struct phy_driver asix_driver[] = {
drivers/net/phy/ax88796b.c-98-{
--
drivers/net/phy/ax88796b.c-120-
drivers/net/phy/ax88796b.c:121:module_phy_driver(asix_driver);
drivers/net/phy/ax88796b.c-122-
--
drivers/net/usb/asix_devices.c=1611=MODULE_DEVICE_TABLE(usb, products);
drivers/net/usb/asix_devices.c-1612-
drivers/net/usb/asix_devices.c:1613:static struct usb_driver asix_driver = {
drivers/net/usb/asix_devices.c-1614-	.name =		DRIVER_NAME,
--
drivers/net/usb/asix_devices.c-1629-
drivers/net/usb/asix_devices.c:1630:module_usb_driver(asix_driver);
drivers/net/usb/asix_devices.c-1631-
]

gemini-3.1-pro-preview

							input: 283477
							output: 42
							thoughts: 22
						

Here's my thought process, as if I were considering this code:

**Diving into the ASIX USB Driver**

Okay, so I need to understand something about how ASIX-based USB Ethernet adapters are handled. My first move is to head straight to the source. Specifically, I want to examine the `products` array within `drivers/net/usb/asix_devices.c`. This is usually where the driver's device ID table resides. I'm expecting this is where the specific USB vendor and product IDs are listed for each adapter the driver supports. That table will give me a quick overview of the intended scope of this driver. From there I can determine how specific a device I am looking at is supported.

map[ContextFile:drivers/net/usb/asix_devices.c IncludeLines:true Name:products]

map[SourceCode:1447:	static const struct usb_device_id	products [] = {
1448:	{
1449:		// Linksys USB200M
1450:		USB_DEVICE (0x077b, 0x2226),
1451:		.driver_info =	(unsigned long) &ax8817x_info,
1452:	}, {
1453:		// Netgear FA120
1454:		USB_DEVICE (0x0846, 0x1040),
1455:		.driver_info =  (unsigned long) &netgear_fa120_info,
1456:	}, {
1457:		// DLink DUB-E100
1458:		USB_DEVICE (0x2001, 0x1a00),
1459:		.driver_info =  (unsigned long) &dlink_dub_e100_info,
1460:	}, {
1461:		// Intellinet, ST Lab USB Ethernet
1462:		USB_DEVICE (0x0b95, 0x1720),
1463:		.driver_info =  (unsigned long) &ax8817x_info,
1464:	}, {
1465:		// Hawking UF200, TrendNet TU2-ET100
1466:		USB_DEVICE (0x07b8, 0x420a),
1467:		.driver_info =  (unsigned long) &hawking_uf200_info,
1468:	}, {
1469:		// Billionton Systems, USB2AR
1470:		USB_DEVICE (0x08dd, 0x90ff),
1471:		.driver_info =  (unsigned long) &ax8817x_info,
1472:	}, {
1473:		// Billionton Systems, GUSB2AM-1G-B
1474:		USB_DEVICE(0x08dd, 0x0114),
1475:		.driver_info =  (unsigned long) &ax88178_info,
1476:	}, {
1477:		// ATEN UC210T
1478:		USB_DEVICE (0x0557, 0x2009),
1479:		.driver_info =  (unsigned long) &ax8817x_info,
1480:	}, {
1481:		// Buffalo LUA-U2-KTX
1482:		USB_DEVICE (0x0411, 0x003d),
1483:		.driver_info =  (unsigned long) &ax8817x_info,
1484:	}, {
1485:		// Buffalo LUA-U2-GT 10/100/1000
1486:		USB_DEVICE (0x0411, 0x006e),
1487:		.driver_info =  (unsigned long) &ax88178_info,
1488:	}, {
1489:		// Sitecom LN-029 "USB 2.0 10/100 Ethernet adapter"
1490:		USB_DEVICE (0x6189, 0x182d),
1491:		.driver_info =  (unsigned long) &ax8817x_info,
1492:	}, {
1493:		// Sitecom LN-031 "USB 2.0 10/100/1000 Ethernet adapter"
1494:		USB_DEVICE (0x0df6, 0x0056),
1495:		.driver_info =  (unsigned long) &ax88178_info,
1496:	}, {
1497:		// Sitecom LN-028 "USB 2.0 10/100/1000 Ethernet adapter"
1498:		USB_DEVICE (0x0df6, 0x061c),
1499:		.driver_info =  (unsigned long) &ax88178_info,
1500:	}, {
1501:		// corega FEther USB2-TX
1502:		USB_DEVICE (0x07aa, 0x0017),
1503:		.driver_info =  (unsigned long) &ax8817x_info,
1504:	}, {
1505:		// Surecom EP-1427X-2
1506:		USB_DEVICE (0x1189, 0x0893),
1507:		.driver_info = (unsigned long) &ax8817x_info,
1508:	}, {
1509:		// goodway corp usb gwusb2e
1510:		USB_DEVICE (0x1631, 0x6200),
1511:		.driver_info = (unsigned long) &ax8817x_info,
1512:	}, {
1513:		// JVC MP-PRX1 Port Replicator
1514:		USB_DEVICE (0x04f1, 0x3008),
1515:		.driver_info = (unsigned long) &ax8817x_info,
1516:	}, {
1517:		// Lenovo U2L100P 10/100
1518:		USB_DEVICE (0x17ef, 0x7203),
1519:		.driver_info = (unsigned long)&ax88772b_info,
1520:	}, {
1521:		// ASIX AX88772B 10/100
1522:		USB_DEVICE (0x0b95, 0x772b),
1523:		.driver_info = (unsigned long) &ax88772b_info,
1524:	}, {
1525:		// ASIX AX88772 10/100
1526:		USB_DEVICE (0x0b95, 0x7720),
1527:		.driver_info = (unsigned long) &ax88772_info,
1528:	}, {
1529:		// ASIX AX88178 10/100/1000
1530:		USB_DEVICE (0x0b95, 0x1780),
1531:		.driver_info = (unsigned long) &ax88178_info,
1532:	}, {
1533:		// Logitec LAN-GTJ/U2A
1534:		USB_DEVICE (0x0789, 0x0160),
1535:		.driver_info = (unsigned long) &ax88178_info,
1536:	}, {
1537:		// Linksys USB200M Rev 2
1538:		USB_DEVICE (0x13b1, 0x0018),
1539:		.driver_info = (unsigned long) &ax88772_info,
1540:	}, {
1541:		// 0Q0 cable ethernet
1542:		USB_DEVICE (0x1557, 0x7720),
1543:		.driver_info = (unsigned long) &ax88772_info,
1544:	}, {
1545:		// DLink DUB-E100 H/W Ver B1
1546:		USB_DEVICE (0x07d1, 0x3c05),
1547:		.driver_info = (unsigned long) &ax88772_info,
1548:	}, {
1549:		// DLink DUB-E100 H/W Ver B1 Alternate
1550:		USB_DEVICE (0x2001, 0x3c05),
1551:		.driver_info = (unsigned long) &ax88772_info,
1552:	}, {
1553:	       // DLink DUB-E100 H/W Ver C1
1554:	       USB_DEVICE (0x2001, 0x1a02),
1555:	       .driver_info = (unsigned long) &ax88772_info,
1556:	}, {
1557:		// Linksys USB1000
1558:		USB_DEVICE (0x1737, 0x0039),
1559:		.driver_info = (unsigned long) &ax88178_info,
1560:	}, {
1561:		// IO-DATA ETG-US2
1562:		USB_DEVICE (0x04bb, 0x0930),
1563:		.driver_info = (unsigned long) &ax88178_info,
1564:	}, {
1565:		// Belkin F5D5055
1566:		USB_DEVICE(0x050d, 0x5055),
1567:		.driver_info = (unsigned long) &ax88178_info,
1568:	}, {
1569:		// Apple USB Ethernet Adapter
1570:		USB_DEVICE(0x05ac, 0x1402),
1571:		.driver_info = (unsigned long) &ax88772_info,
1572:	}, {
1573:		// Cables-to-Go USB Ethernet Adapter
1574:		USB_DEVICE(0x0b95, 0x772a),
1575:		.driver_info = (unsigned long) &ax88772_info,
1576:	}, {
1577:		// ABOCOM for pci
1578:		USB_DEVICE(0x14ea, 0xab11),
1579:		.driver_info = (unsigned long) &ax88178_info,
1580:	}, {
1581:		// ASIX 88772a
1582:		USB_DEVICE(0x0db0, 0xa877),
1583:		.driver_info = (unsigned long) &ax88772_info,
1584:	}, {
1585:		// Asus USB Ethernet Adapter
1586:		USB_DEVICE (0x0b95, 0x7e2b),
1587:		.driver_info = (unsigned long)&ax88772b_info,
1588:	}, {
1589:		/* ASIX 88172a demo board */
1590:		USB_DEVICE(0x0b95, 0x172a),
1591:		.driver_info = (unsigned long) &ax88172a_info,
1592:	}, {
1593:		/*
1594:		 * USBLINK HG20F9 "USB 2.0 LAN"
1595:		 * Appears to have gazumped Linksys's manufacturer ID but
1596:		 * doesn't (yet) conflict with any known Linksys product.
1597:		 */
1598:		USB_DEVICE(0x066b, 0x20f9),
1599:		.driver_info = (unsigned long) &hg20f9_info,
1600:	}, {
1601:		// Linux Automation GmbH USB 10Base-T1L
1602:		USB_DEVICE(0x33f7, 0x0004),
1603:		.driver_info = (unsigned long) &lxausb_t1l_info,
1604:	}, {
1605:		/* LyconSys FiberGecko 100 */
1606:		USB_DEVICE(0x1d2a, 0x0801),
1607:		.driver_info = (unsigned long) &lyconsys_fibergecko100_info,
1608:	},
1609:		{ },		// END
1610:	};
 SourceFile:drivers/net/usb/asix_devices.c]

gemini-3.1-pro-preview

							input: 287000
							output: 60
							thoughts: 1126
						

**Analyzing a USB Driver Crash**

Okay, so I'm digging into this crash, and the initial assumption that `asix` is involved is a dead end because the device descriptors aren't matching. The address `0x200000000b40` is suspicious since it's uninitialized, but it's *probably* all zeros based on the other `syz_usb_connect` calls and the fact that it's a decent distance from the other allocated areas. That would mean `idVendor=0`, `idProduct=0` which *shouldn't* match anything.

But wait, the C code is calling `usb_raw_init` to create a dummy UDC. The kernel should enumerate this device regardless, even if no driver is bound. Then `syz_usb_control_io` is used, which reads from `/dev/raw-gadget`. If no driver is bound, the host would only be sending standard requests like `GET_DESCRIPTOR`, not vendor-specific stuff. And, critically, it only fetches *one* event. So, it grabs the first standard request and responds, then exits.

Ah, but what if the crash isn't in the `asix` or related driver, and it's something else?

Consider this: The `hid` driver is connected with a null `dev` in `syz_usb_connect`, which should return -1 immediately. That seems unrelated.

Okay, let's look at the C code again. The first `syz_usb_connect` call connects `rt2500usb` and immediately disconnects it via `syz_usb_disconnect` (which closes the `/dev/raw-gadget` file descriptor, unregistering the dummy UDC). This is a connect and disconnect, which could trigger a race condition, especially if the device isn't fully initialized during the probe phase.

Ah HA! That's it! It's likely that calling `usb_reset_device` during probe and then immediately disconnecting causes a NULL pointer dereference in `rt2x00usb_disconnect`. The expert already mentioned the crash is in `rt2x00usb_disconnect` due to `usb_reset_device`. Let me check `rt2500usb_probe`.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c IncludeLines:true Name:rt2500usb_probe]

map[SourceCode:1967:	static int rt2500usb_probe(struct usb_interface *usb_intf,
1968:				   const struct usb_device_id *id)
1969:	{
1970:		return rt2x00usb_probe(usb_intf, &rt2500usb_ops);
1971:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c]

gemini-3.1-pro-preview

							input: 288823
							output: 60
							thoughts: 14
						

Okay, here's my take on those thoughts, tailored for an expert audience, presented in the first person:

**Diving into `rt2x00usb_probe`**

Alright, let's get down to brass tacks. I need to refresh my memory and dissect the `rt2x00usb_probe` function. This is where the magic (or the misery!) begins, the entry point for handling this specific USB-connected wireless adapter. I'm going to start by tracing the execution flow here; it will allow me to refresh on what's handled at the driver level. I need to ensure the correct hardware initialization sequence is in place. Is it doing the USB device enumeration correctly? Power cycling in the appropriate manner?

I’ll pay close attention to the resource allocation – interrupt requests, DMA channels, and memory. I need to be sure everything is being requested, acquired, and released properly, looking for any potential race conditions or resource leaks. Are the USB descriptors being parsed correctly? Any potential off-by-one errors in buffer sizing? Are we handling the control transfers (configuration, etc.) appropriately, including error handling?

I'll be mindful of the different chips that it's designed to support, is there a specific conditional path for a particular rev? What's the error handling like in this function? Any potential for buffer overflows? What about the device's specific quirks; are they accounted for correctly and properly handled? I need to ascertain that the device is correctly identified, configured, and ready to go before we return. This is the foundation; a shaky `probe` means a flaky driver, and I can't let that happen!

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_probe]

map[SourceCode: 797:	int rt2x00usb_probe(struct usb_interface *usb_intf,
 798:			    const struct rt2x00_ops *ops)
 799:	{
 800:		struct usb_device *usb_dev = interface_to_usbdev(usb_intf);
 801:		struct ieee80211_hw *hw;
 802:		struct rt2x00_dev *rt2x00dev;
 803:		int retval;
 804:	
 805:		usb_reset_device(usb_dev);
 806:	
 807:		hw = ieee80211_alloc_hw(sizeof(struct rt2x00_dev), ops->hw);
 808:		if (!hw) {
 809:			rt2x00_probe_err("Failed to allocate hardware\n");
 810:			return -ENOMEM;
 811:		}
 812:	
 813:		usb_set_intfdata(usb_intf, hw);
 814:	
 815:		rt2x00dev = hw->priv;
 816:		rt2x00dev->dev = &usb_intf->dev;
 817:		rt2x00dev->ops = ops;
 818:		rt2x00dev->hw = hw;
 819:	
 820:		rt2x00_set_chip_intf(rt2x00dev, RT2X00_CHIP_INTF_USB);
 821:	
 822:		INIT_WORK(&rt2x00dev->rxdone_work, rt2x00usb_work_rxdone);
 823:		INIT_WORK(&rt2x00dev->txdone_work, rt2x00usb_work_txdone);
 824:	
 825:		retval = rt2x00usb_alloc_reg(rt2x00dev);
 826:		if (retval)
 827:			goto exit_free_device;
 828:	
 829:		rt2x00dev->anchor = devm_kmalloc(&usb_intf->dev,
 830:						sizeof(struct usb_anchor),
 831:						GFP_KERNEL);
 832:		if (!rt2x00dev->anchor) {
 833:			retval = -ENOMEM;
 834:			goto exit_free_reg;
 835:		}
 836:		init_usb_anchor(rt2x00dev->anchor);
 837:	
 838:		retval = rt2x00lib_probe_dev(rt2x00dev);
 839:		if (retval)
 840:			goto exit_free_anchor;
 841:	
 842:		return 0;
 843:	
 844:	exit_free_anchor:
 845:		usb_kill_anchored_urbs(rt2x00dev->anchor);
 846:	
 847:	exit_free_reg:
 848:		rt2x00usb_free_reg(rt2x00dev);
 849:	
 850:	exit_free_device:
 851:		ieee80211_free_hw(hw);
 852:		usb_set_intfdata(usb_intf, NULL);
 853:	
 854:		return retval;
 855:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3.1-pro-preview

							input: 290246
							output: 60
							thoughts: 76
						

Here's my thought process, as it stands:

**Navigating a Potential Race Condition in the USB Reset Sequence**

Okay, so I'm looking at this USB device initialization and I'm immediately noticing something that has me a bit concerned. Specifically, `usb_reset_device(usb_dev)` is being called *before* `usb_set_intfdata(usb_intf, hw)`. That seems a bit...risky. What if the reset fails, or worse, triggers a disconnect of the device during the process?

If that happens, and if I understand the driver correctly, then `rt2x00usb_disconnect` gets invoked. That's the key. I need to make *absolutely* sure that `rt2x00usb_disconnect` is handling any potential clean up required by the fact that `usb_set_intfdata(usb_intf, hw)` might not have completed at that point. I have to verify the integrity and correct operation of `rt2x00usb_disconnect` to ensure we do not introduce any new edge cases that could lead to crashes or data corruption under these conditions. So, it's time to dig into that function and see what's happening.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_disconnect]

map[SourceCode: 858:	void rt2x00usb_disconnect(struct usb_interface *usb_intf)
 859:	{
 860:		struct ieee80211_hw *hw = usb_get_intfdata(usb_intf);
 861:		struct rt2x00_dev *rt2x00dev = hw->priv;
 862:	
 863:		/*
 864:		 * Free all allocated data.
 865:		 */
 866:		rt2x00lib_remove_dev(rt2x00dev);
 867:		rt2x00usb_free_reg(rt2x00dev);
 868:		ieee80211_free_hw(hw);
 869:	
 870:		usb_set_intfdata(usb_intf, NULL);
 871:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3.1-pro-preview

							input: 290926
							output: 43
							thoughts: 294
						

**Debugging a Potential NULL Pointer Dereference**

Okay, here's the situation I'm looking at. I'm thinking, "Yes! If `usb_reset_device` triggers a disconnect, then `hw` will be NULL! Consequently, dereferencing `hw->priv` will become a problem." But wait, does `usb_reset_device` *actually* trigger a disconnect? I need to think this through. `usb_reset_device` is supposed to reset the device. If the device actually *does* disconnect during that reset, then the USB core is supposed to unbind the driver, which then should trigger the `disconnect` function.

But here's a wrinkle: `usb_reset_device` is called from `probe`. Does `disconnect` get called if `probe` hasn't finished? I need to dig deeper. I'm going to jump to `drivers/usb/core/hub.c` to check how `usb_reset_device` behaves. If the reset fails, a logical disconnect *could* occur.

Ah, but if `probe` is running, isn't the device lock held? Hold on. Does `usb_reset_device` require the device lock? Wait, `probe` is called with the *interface* lock held, not the device lock! `usb_reset_device` actually *requires* the device lock.

Okay, let's think. The `usb_reset_device` documentation says: "This function can be called by a driver which wants to reset its device. It is a blocking call and must not be called from interrupt context." So, if `usb_reset_device` fails, does it immediately trigger a call to the `disconnect` function? I should probably check the code for `usb_reset_device` again, just to be sure.

map[ContextFile:drivers/usb/core/hub.c IncludeLines:true Name:usb_reset_device]

map[SourceCode:6323:	/**
6324:	 * usb_reset_device - warn interface drivers and perform a USB port reset
6325:	 * @udev: device to reset (not in NOTATTACHED state)
6326:	 *
6327:	 * Warns all drivers bound to registered interfaces (using their pre_reset
6328:	 * method), performs the port reset, and then lets the drivers know that
6329:	 * the reset is over (using their post_reset method).
6330:	 *
6331:	 * Return: The same as for usb_reset_and_verify_device().
6332:	 * However, if a reset is already in progress (for instance, if a
6333:	 * driver doesn't have pre_reset() or post_reset() callbacks, and while
6334:	 * being unbound or re-bound during the ongoing reset its disconnect()
6335:	 * or probe() routine tries to perform a second, nested reset), the
6336:	 * routine returns -EINPROGRESS.
6337:	 *
6338:	 * Note:
6339:	 * The caller must own the device lock.  For example, it's safe to use
6340:	 * this from a driver probe() routine after downloading new firmware.
6341:	 * For calls that might not occur during probe(), drivers should lock
6342:	 * the device using usb_lock_device_for_reset().
6343:	 *
6344:	 * If an interface is currently being probed or disconnected, we assume
6345:	 * its driver knows how to handle resets.  For all other interfaces,
6346:	 * if the driver doesn't have pre_reset and post_reset methods then
6347:	 * we attempt to unbind it and rebind afterward.
6348:	 */
6349:	int usb_reset_device(struct usb_device *udev)
6350:	{
6351:		int ret;
6352:		int i;
6353:		unsigned int noio_flag;
6354:		struct usb_port *port_dev;
6355:		struct usb_host_config *config = udev->actconfig;
6356:		struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent);
6357:	
6358:		if (udev->state == USB_STATE_NOTATTACHED) {
6359:			dev_dbg(&udev->dev, "device reset not allowed in state %d\n",
6360:					udev->state);
6361:			return -EINVAL;
6362:		}
6363:	
6364:		if (!udev->parent) {
6365:			/* this requires hcd-specific logic; see ohci_restart() */
6366:			dev_dbg(&udev->dev, "%s for root hub!\n", __func__);
6367:			return -EISDIR;
6368:		}
6369:	
6370:		if (udev->reset_in_progress)
6371:			return -EINPROGRESS;
6372:		udev->reset_in_progress = 1;
6373:	
6374:		port_dev = hub->ports[udev->portnum - 1];
6375:	
6376:		/*
6377:		 * Don't allocate memory with GFP_KERNEL in current
6378:		 * context to avoid possible deadlock if usb mass
6379:		 * storage interface or usbnet interface(iSCSI case)
6380:		 * is included in current configuration. The easist
6381:		 * approach is to do it for every device reset,
6382:		 * because the device 'memalloc_noio' flag may have
6383:		 * not been set before reseting the usb device.
6384:		 */
6385:		noio_flag = memalloc_noio_save();
6386:	
6387:		/* Prevent autosuspend during the reset */
6388:		usb_autoresume_device(udev);
6389:	
6390:		if (config) {
6391:			for (i = 0; i < config->desc.bNumInterfaces; ++i) {
6392:				struct usb_interface *cintf = config->interface[i];
6393:				struct usb_driver *drv;
6394:				int unbind = 0;
6395:	
6396:				if (cintf->dev.driver) {
6397:					drv = to_usb_driver(cintf->dev.driver);
6398:					if (drv->pre_reset && drv->post_reset)
6399:						unbind = (drv->pre_reset)(cintf);
6400:					else if (cintf->condition ==
6401:							USB_INTERFACE_BOUND)
6402:						unbind = 1;
6403:					if (unbind)
6404:						usb_forced_unbind_intf(cintf);
6405:				}
6406:			}
6407:		}
6408:	
6409:		usb_lock_port(port_dev);
6410:		ret = usb_reset_and_verify_device(udev);
6411:		usb_unlock_port(port_dev);
6412:	
6413:		if (config) {
6414:			for (i = config->desc.bNumInterfaces - 1; i >= 0; --i) {
6415:				struct usb_interface *cintf = config->interface[i];
6416:				struct usb_driver *drv;
6417:				int rebind = cintf->needs_binding;
6418:	
6419:				if (!rebind && cintf->dev.driver) {
6420:					drv = to_usb_driver(cintf->dev.driver);
6421:					if (drv->post_reset)
6422:						rebind = (drv->post_reset)(cintf);
6423:					else if (cintf->condition ==
6424:							USB_INTERFACE_BOUND)
6425:						rebind = 1;
6426:					if (rebind)
6427:						cintf->needs_binding = 1;
6428:				}
6429:			}
6430:	
6431:			/* If the reset failed, hub_wq will unbind drivers later */
6432:			if (ret == 0)
6433:				usb_unbind_and_rebind_marked_interfaces(udev);
6434:		}
6435:	
6436:		usb_autosuspend_device(udev);
6437:		memalloc_noio_restore(noio_flag);
6438:		udev->reset_in_progress = 0;
6439:		return ret;
6440:	}
 SourceFile:drivers/usb/core/hub.c]

gemini-3.1-pro-preview

							input: 293532
							output: 47
							thoughts: 377
						

**Analyzing USB Reset Behavior**

Okay, so I'm looking at how this `usb_reset_device` function handles things. It seems like the core logic revolves around checking for the existence of `drv->pre_reset` and `drv->post_reset` callbacks. If they're *not* present, and the interface condition (`cintf->condition`) is `USB_INTERFACE_BOUND`, it actually *unbinds* the interface. That's a critical point.

Now, I'm specifically thinking about `rt2500usb_driver`. And, wait a minute, this driver *doesn't* define those `pre_reset` and `post_reset` callbacks. See, right here in the driver definition, they're missing! It has the standard probe, disconnect, suspend/resume, but not the reset callbacks. This is an important detail.

So, if the interface *were* bound and those callbacks were missing, we'd have a problem. But, I see that the `cintf->condition` during `probe` is actually `USB_INTERFACE_BINDING` at that point. So, the unbinding scenario is *not* triggered during the `probe` sequence. This is good to see that initial setup is safe.

Now, let's consider the failure case, when `usb_reset_and_verify_device` returns an error. The current code simply returns that error up the call stack via `usb_reset_device`. But... what happens internally within `usb_reset_and_verify_device` when it errors? Does it mark the device as disconnected? That could be a side effect we need to consider. I should probably dig into the implementation of `usb_reset_and_verify_device` next to see if that's happening.

map[ContextFile:drivers/usb/core/hub.c IncludeLines:true Name:usb_reset_and_verify_device]

map[SourceCode:6136:	/**
6137:	 * usb_reset_and_verify_device - perform a USB port reset to reinitialize a device
6138:	 * @udev: device to reset (not in SUSPENDED or NOTATTACHED state)
6139:	 *
6140:	 * WARNING - don't use this routine to reset a composite device
6141:	 * (one with multiple interfaces owned by separate drivers)!
6142:	 * Use usb_reset_device() instead.
6143:	 *
6144:	 * Do a port reset, reassign the device's address, and establish its
6145:	 * former operating configuration.  If the reset fails, or the device's
6146:	 * descriptors change from their values before the reset, or the original
6147:	 * configuration and altsettings cannot be restored, a flag will be set
6148:	 * telling hub_wq to pretend the device has been disconnected and then
6149:	 * re-connected.  All drivers will be unbound, and the device will be
6150:	 * re-enumerated and probed all over again.
6151:	 *
6152:	 * Return: 0 if the reset succeeded, -ENODEV if the device has been
6153:	 * flagged for logical disconnection, or some other negative error code
6154:	 * if the reset wasn't even attempted.
6155:	 *
6156:	 * Note:
6157:	 * The caller must own the device lock and the port lock, the latter is
6158:	 * taken by usb_reset_device().  For example, it's safe to use
6159:	 * usb_reset_device() from a driver probe() routine after downloading
6160:	 * new firmware.  For calls that might not occur during probe(), drivers
6161:	 * should lock the device using usb_lock_device_for_reset().
6162:	 *
6163:	 * Locking exception: This routine may also be called from within an
6164:	 * autoresume handler.  Such usage won't conflict with other tasks
6165:	 * holding the device lock because these tasks should always call
6166:	 * usb_autopm_resume_device(), thereby preventing any unwanted
6167:	 * autoresume.  The autoresume handler is expected to have already
6168:	 * acquired the port lock before calling this routine.
6169:	 */
6170:	static int usb_reset_and_verify_device(struct usb_device *udev)
6171:	{
6172:		struct usb_device		*parent_hdev = udev->parent;
6173:		struct usb_hub			*parent_hub;
6174:		struct usb_hcd			*hcd = bus_to_hcd(udev->bus);
6175:		struct usb_device_descriptor	descriptor;
6176:		struct usb_interface		*intf;
6177:		struct usb_host_bos		*bos;
6178:		int				i, j, ret = 0;
6179:		int				port1 = udev->portnum;
6180:	
6181:		if (udev->state == USB_STATE_NOTATTACHED ||
6182:				udev->state == USB_STATE_SUSPENDED) {
6183:			dev_dbg(&udev->dev, "device reset not allowed in state %d\n",
6184:					udev->state);
6185:			return -EINVAL;
6186:		}
6187:	
6188:		if (!parent_hdev)
6189:			return -EISDIR;
6190:	
6191:		parent_hub = usb_hub_to_struct_hub(parent_hdev);
6192:	
6193:		/* Disable USB2 hardware LPM.
6194:		 * It will be re-enabled by the enumeration process.
6195:		 */
6196:		usb_disable_usb2_hardware_lpm(udev);
6197:	
6198:		bos = udev->bos;
6199:		udev->bos = NULL;
6200:	
6201:		if (udev->reset_resume)
6202:			hub_hc_release_resources(udev);
6203:	
6204:		mutex_lock(hcd->address0_mutex);
6205:	
6206:		for (i = 0; i < PORT_INIT_TRIES; ++i) {
6207:			if (hub_port_stop_enumerate(parent_hub, port1, i)) {
6208:				ret = -ENODEV;
6209:				break;
6210:			}
6211:	
6212:			/* ep0 maxpacket size may change; let the HCD know about it.
6213:			 * Other endpoints will be handled by re-enumeration. */
6214:			usb_ep0_reinit(udev);
6215:			ret = hub_port_init(parent_hub, udev, port1, i, &descriptor);
6216:			if (ret >= 0 || ret == -ENOTCONN || ret == -ENODEV)
6217:				break;
6218:		}
6219:		mutex_unlock(hcd->address0_mutex);
6220:	
6221:		if (ret < 0)
6222:			goto re_enumerate;
6223:	
6224:		/* Device might have changed firmware (DFU or similar) */
6225:		if (descriptors_changed(udev, &descriptor, bos)) {
6226:			dev_info(&udev->dev, "device firmware changed\n");
6227:			goto re_enumerate;
6228:		}
6229:	
6230:		/* Restore the device's previous configuration */
6231:		if (!udev->actconfig)
6232:			goto done;
6233:	
6234:		/*
6235:		 * Some devices can't handle setting default altsetting 0 with a
6236:		 * Set-Interface request. Disable host-side endpoints of those
6237:		 * interfaces here. Enable and reset them back after host has set
6238:		 * its internal endpoint structures during usb_hcd_alloc_bandwith()
6239:		 */
6240:		for (i = 0; i < udev->actconfig->desc.bNumInterfaces; i++) {
6241:			intf = udev->actconfig->interface[i];
6242:			if (intf->cur_altsetting->desc.bAlternateSetting == 0)
6243:				usb_disable_interface(udev, intf, true);
6244:		}
6245:	
6246:		mutex_lock(hcd->bandwidth_mutex);
6247:		ret = usb_hcd_alloc_bandwidth(udev, udev->actconfig, NULL, NULL);
6248:		if (ret < 0) {
6249:			dev_warn(&udev->dev,
6250:					"Busted HC?  Not enough HCD resources for "
6251:					"old configuration.\n");
6252:			mutex_unlock(hcd->bandwidth_mutex);
6253:			goto re_enumerate;
6254:		}
6255:		ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
6256:				USB_REQ_SET_CONFIGURATION, 0,
6257:				udev->actconfig->desc.bConfigurationValue, 0,
6258:				NULL, 0, USB_CTRL_SET_TIMEOUT);
6259:		if (ret < 0) {
6260:			dev_err(&udev->dev,
6261:				"can't restore configuration #%d (error=%d)\n",
6262:				udev->actconfig->desc.bConfigurationValue, ret);
6263:			mutex_unlock(hcd->bandwidth_mutex);
6264:			goto re_enumerate;
6265:		}
6266:		mutex_unlock(hcd->bandwidth_mutex);
6267:		usb_set_device_state(udev, USB_STATE_CONFIGURED);
6268:	
6269:		/* Put interfaces back into the same altsettings as before.
6270:		 * Don't bother to send the Set-Interface request for interfaces
6271:		 * that were already in altsetting 0; besides being unnecessary,
6272:		 * many devices can't handle it.  Instead just reset the host-side
6273:		 * endpoint state.
6274:		 */
6275:		for (i = 0; i < udev->actconfig->desc.bNumInterfaces; i++) {
6276:			struct usb_host_config *config = udev->actconfig;
6277:			struct usb_interface_descriptor *desc;
6278:	
6279:			intf = config->interface[i];
6280:			desc = &intf->cur_altsetting->desc;
6281:			if (desc->bAlternateSetting == 0) {
6282:				usb_enable_interface(udev, intf, true);
6283:				ret = 0;
6284:			} else {
6285:				/* Let the bandwidth allocation function know that this
6286:				 * device has been reset, and it will have to use
6287:				 * alternate setting 0 as the current alternate setting.
6288:				 */
6289:				intf->resetting_device = 1;
6290:				ret = usb_set_interface(udev, desc->bInterfaceNumber,
6291:						desc->bAlternateSetting);
6292:				intf->resetting_device = 0;
6293:			}
6294:			if (ret < 0) {
6295:				dev_err(&udev->dev, "failed to restore interface %d "
6296:					"altsetting %d (error=%d)\n",
6297:					desc->bInterfaceNumber,
6298:					desc->bAlternateSetting,
6299:					ret);
6300:				goto re_enumerate;
6301:			}
6302:			/* Resetting also frees any allocated streams */
6303:			for (j = 0; j < intf->cur_altsetting->desc.bNumEndpoints; j++)
6304:				intf->cur_altsetting->endpoint[j].streams = 0;
6305:		}
6306:	
6307:	done:
6308:		/* Now that the alt settings are re-installed, enable LTM and LPM. */
6309:		usb_enable_usb2_hardware_lpm(udev);
6310:		usb_unlocked_enable_lpm(udev);
6311:		usb_enable_ltm(udev);
6312:		usb_release_bos_descriptor(udev);
6313:		udev->bos = bos;
6314:		return 0;
6315:	
6316:	re_enumerate:
6317:		usb_release_bos_descriptor(udev);
6318:		udev->bos = bos;
6319:		hub_port_logical_disconnect(parent_hub, port1);
6320:		return -ENODEV;
6321:	}
 SourceFile:drivers/usb/core/hub.c]

gemini-3.1-pro-preview

							input: 297402
							output: 62
							thoughts: 1774
						

**Analyzing the Potential NULL Pointer Dereference**

Okay, let's break this down. My initial concern was about a possible NULL pointer dereference in `rt2x00usb_disconnect`. I was trying to figure out the exact sequence of events that could lead to `hw` being NULL when `usb_get_intfdata` is called.

Here's my thought process:

*   First, I considered the scenario where `usb_reset_and_verify_device` fails, triggering a disconnect flag. The critical point is that the *actual* disconnect happens later in `hub_wq`, not synchronously. This means `disconnect` isn't immediately called. I realized that if `usb_reset_device` returns an error, `rt2x00usb_probe` *ignores* that error. It goes on to allocate `hw` and sets `intfdata`, so `hw` would not be NULL when `disconnect` *is* eventually called from `hub_wq`. So, that path looks good; no dereference there.

*   Then I thought, what if `rt2x00usb_probe` fails *after* `usb_reset_device`? If it fails after `usb_reset_device`, it jumps to `exit_free_device`, which *does* `free_hw` and set `intfdata` to NULL. But, if `probe` fails, the USB core won't call `disconnect`. `disconnect` is only called if `probe` succeeded and the device is unbound. So, that scenario doesn't cause a problem either.

*   Next, I tried to figure out if `hub_wq` and `probe` could run concurrently. No, `probe` is called either from `hub_wq` or with the device lock held, so that's not a race condition.

*   I then considered, what if the device is disconnected *after* `probe` succeeds? That's fine because `intfdata` would be valid when `disconnect` is called and `hw` would not be NULL, so no issue there.

*   Then I checked if `usb_reset_device` triggers an unbind synchronously. No, it just sets a flag in `hub->change_bits`.

*   I then considered if `usb_reset_device` itself could unbind the driver. I checked the USB core code. It doesn't unbind if the `cintf->condition` is `USB_INTERFACE_BINDING`, which is the case during `probe`. So, no problem there.

*   I then considered if `usb_reset_device` could be called from another place in the code, but it's only called from `probe`.

*   Okay, I'm thinking this through, what if a divide-by-zero is the actual crash? If `usb_maxpacket` is zero, there is a crash. I checked where it is initialized to see what its possible values are. It is set via `usb_maxpacket`, which could return 0. The issue is in `rt2x00usb_get_tx_data_len`, which is TX queue related. I need to know how `usb_maxpacket` is set to zero. That would be when the endpoint's `wMaxPacketSize` is zero. I investigated if an endpoint has `wMaxPacketSize` of zero.

*   I know this is set in `rt2x00queue_init`.

*   I considered a vendor request. These use endpoint 0. So no issues there.

*   I considered that it is for TX queues, which are initialized in `ndo_open` or `mac80211` start. The problem description does not bring up the interface.

*   But `mac80211` can bring up the interface automatically. I ruled that out by checking the code.

*   Let's check `rt2500usb_probe_hw` to see if it starts the TX queues during probe. Nope, so not a problem.

So, the NULL pointer dereference doesn't seem likely in my current analysis of the code. The divide-by-zero, now that's *very* interesting. If we have an endpoint with `wMaxPacketSize == 0`, that's a *definite* problem. We'll need to check the USB descriptors for the TX endpoints to confirm this is possible.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c IncludeLines:true Name:rt2500usb_probe_hw]

map[SourceCode:1745:	static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev)
1746:	{
1747:		int retval;
1748:		u16 reg;
1749:	
1750:		/*
1751:		 * Allocate eeprom data.
1752:		 */
1753:		retval = rt2500usb_validate_eeprom(rt2x00dev);
1754:		if (retval)
1755:			return retval;
1756:	
1757:		retval = rt2500usb_init_eeprom(rt2x00dev);
1758:		if (retval)
1759:			return retval;
1760:	
1761:		/*
1762:		 * Enable rfkill polling by setting GPIO direction of the
1763:		 * rfkill switch GPIO pin correctly.
1764:		 */
1765:		reg = rt2500usb_register_read(rt2x00dev, MAC_CSR19);
1766:		rt2x00_set_field16(&reg, MAC_CSR19_DIR0, 0);
1767:		rt2500usb_register_write(rt2x00dev, MAC_CSR19, reg);
1768:	
1769:		/*
1770:		 * Initialize hw specifications.
1771:		 */
1772:		retval = rt2500usb_probe_hw_mode(rt2x00dev);
1773:		if (retval)
1774:			return retval;
1775:	
1776:		/*
1777:		 * This device requires the atim queue
1778:		 */
1779:		__set_bit(REQUIRE_ATIM_QUEUE, &rt2x00dev->cap_flags);
1780:		__set_bit(REQUIRE_BEACON_GUARD, &rt2x00dev->cap_flags);
1781:		if (!modparam_nohwcrypt) {
1782:			__set_bit(CAPABILITY_HW_CRYPTO, &rt2x00dev->cap_flags);
1783:			__set_bit(REQUIRE_COPY_IV, &rt2x00dev->cap_flags);
1784:		}
1785:		__set_bit(REQUIRE_SW_SEQNO, &rt2x00dev->cap_flags);
1786:		__set_bit(REQUIRE_PS_AUTOWAKE, &rt2x00dev->cap_flags);
1787:	
1788:		/*
1789:		 * Set the rssi offset.
1790:		 */
1791:		rt2x00dev->rssi_offset = DEFAULT_RSSI_OFFSET;
1792:	
1793:		return 0;
1794:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c]

gemini-3.1-pro-preview

							input: 301021
							output: 43
							thoughts: 1001
						

**Analyzing USB Descriptor Parsing in the Kernel**

Okay, no immediate TX queue issues here. Let's dig into the `rtl8192cu` driver. That third `syz_usb_connect` call is targeting it. The device descriptor shows vendor `0x0bda` and product `0x5088`. The configuration descriptor indicates `bNumInterfaces = 1`, but there's a problem: the interface descriptor is missing, essentially filled with zeros. If the descriptor is missing, the kernel should skip over it, causing `bNumInterfaces` to effectively become zero. Consequently, `rtl8192cu` won't be probed!

Hold on, what if the C code isn't just sending 0x24 bytes? The C code uses `dev_len=0x24`, so it's only copying 0x24 bytes. Now let's trace through the `parse_usb_descriptor` function in that C code.

```c
	if (length < sizeof(*index->dev) + sizeof(*index->config))
		return false;
```

The `length` here is 0x24 (36), and `sizeof(usb_device_descriptor)` is 18. `sizeof(usb_config_descriptor)` is 9. 18 + 9 = 27. I see it starts at offset 27!

```c
	size_t offset = 0;
	while (true) {
		if (offset + 1 >= length)
			break;
		uint8_t desc_length = buffer[offset];
```

Wait, `offset` is initialized to 0. But is `buffer` pointing to the `usb_device_descriptor`? No, it's pointing to the start of the data. Okay, let's look closer.

```c
	size_t offset = 0;
	while (true) {
		if (offset + 1 >= length)
			break;
		uint8_t desc_length = buffer[offset];
		uint8_t desc_type = buffer[offset + 1];
```

It parses the descriptors starting at `offset = 0`. So `buffer[0]` is the `bLength` of the device descriptor, which is 18. So it skips over it. Then `offset` becomes 18. `buffer[18]` is the `bLength` of the config descriptor, which is 9. So it skips over the configuration descriptor too. Then `offset` becomes 27. But `buffer` is only initialized up to 26 (0x1a), so `buffer[27]` is zero. That means the `desc_length` is 0. The loop breaks. So, `index->ifaces_num` is zero. Therefore, `syz_usb_connect` will respond to a `GET_DESCRIPTOR` request for `CONFIG` with `response_length = index->config_length`, which is `length - 18 = 36 - 18 = 18`. It will return 18 bytes for the config descriptor. So the kernel will receive 18 bytes. The first 9 bytes will be the actual config descriptor. And the remaining 9 bytes are zero! So the kernel will parse the config descriptor, then see a descriptor with `bLength=0`. The kernel will complain and skip the rest. So the configuration will effectively have zero interfaces. Consequently, NO driver will be probed.

Now, wait a moment. Are there any drivers that match the device and are probed at the device level, not the interface level? Some drivers use `usb_device_driver` instead of `usb_driver`. Let me quickly check if `rt2500usb` or `rtl8192cu` are using `usb_device_driver`. No, they use `usb_driver`.

Wait, what if the kernel DOESN'T skip the rest of the configuration? Okay, time to check `usb_parse_configuration` again.

map[ContextFile:drivers/usb/core/config.c IncludeLines:true Name:usb_parse_configuration]

map[SourceCode: 659:	static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
 660:	    struct usb_host_config *config, unsigned char *buffer, int size)
 661:	{
 662:		struct device *ddev = &dev->dev;
 663:		unsigned char *buffer0 = buffer;
 664:		int cfgno;
 665:		int nintf, nintf_orig;
 666:		int i, j, n;
 667:		struct usb_interface_cache *intfc;
 668:		unsigned char *buffer2;
 669:		int size2;
 670:		struct usb_descriptor_header *header;
 671:		int retval;
 672:		u8 inums[USB_MAXINTERFACES], nalts[USB_MAXINTERFACES];
 673:		unsigned iad_num = 0;
 674:	
 675:		memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
 676:		nintf = nintf_orig = config->desc.bNumInterfaces;
 677:		config->desc.bNumInterfaces = 0;	// Adjusted later
 678:	
 679:		if (config->desc.bDescriptorType != USB_DT_CONFIG ||
 680:		    config->desc.bLength < USB_DT_CONFIG_SIZE ||
 681:		    config->desc.bLength > size) {
 682:			dev_notice(ddev, "invalid descriptor for config index %d: "
 683:			    "type = 0x%X, length = %d\n", cfgidx,
 684:			    config->desc.bDescriptorType, config->desc.bLength);
 685:			return -EINVAL;
 686:		}
 687:		cfgno = config->desc.bConfigurationValue;
 688:	
 689:		buffer += config->desc.bLength;
 690:		size -= config->desc.bLength;
 691:	
 692:		if (nintf > USB_MAXINTERFACES) {
 693:			dev_notice(ddev, "config %d has too many interfaces: %d, "
 694:			    "using maximum allowed: %d\n",
 695:			    cfgno, nintf, USB_MAXINTERFACES);
 696:			nintf = USB_MAXINTERFACES;
 697:		}
 698:	
 699:		/* Go through the descriptors, checking their length and counting the
 700:		 * number of altsettings for each interface */
 701:		n = 0;
 702:		for ((buffer2 = buffer, size2 = size);
 703:		      size2 > 0;
 704:		     (buffer2 += header->bLength, size2 -= header->bLength)) {
 705:	
 706:			if (size2 < sizeof(struct usb_descriptor_header)) {
 707:				dev_notice(ddev, "config %d descriptor has %d excess "
 708:				    "byte%s, ignoring\n",
 709:				    cfgno, size2, str_plural(size2));
 710:				break;
 711:			}
 712:	
 713:			header = (struct usb_descriptor_header *) buffer2;
 714:			if ((header->bLength > size2) || (header->bLength < 2)) {
 715:				dev_notice(ddev, "config %d has an invalid descriptor "
 716:				    "of length %d, skipping remainder of the config\n",
 717:				    cfgno, header->bLength);
 718:				break;
 719:			}
 720:	
 721:			if (header->bDescriptorType == USB_DT_INTERFACE) {
 722:				struct usb_interface_descriptor *d;
 723:				int inum;
 724:	
 725:				d = (struct usb_interface_descriptor *) header;
 726:				if (d->bLength < USB_DT_INTERFACE_SIZE) {
 727:					dev_notice(ddev, "config %d has an invalid "
 728:					    "interface descriptor of length %d, "
 729:					    "skipping\n", cfgno, d->bLength);
 730:					continue;
 731:				}
 732:	
 733:				inum = d->bInterfaceNumber;
 734:	
 735:				if ((dev->quirks & USB_QUIRK_HONOR_BNUMINTERFACES) &&
 736:				    n >= nintf_orig) {
 737:					dev_notice(ddev, "config %d has more interface "
 738:					    "descriptors, than it declares in "
 739:					    "bNumInterfaces, ignoring interface "
 740:					    "number: %d\n", cfgno, inum);
 741:					continue;
 742:				}
 743:	
 744:				if (inum >= nintf_orig)
 745:					dev_notice(ddev, "config %d has an invalid "
 746:					    "interface number: %d but max is %d\n",
 747:					    cfgno, inum, nintf_orig - 1);
 748:	
 749:				/* Have we already encountered this interface?
 750:				 * Count its altsettings */
 751:				for (i = 0; i < n; ++i) {
 752:					if (inums[i] == inum)
 753:						break;
 754:				}
 755:				if (i < n) {
 756:					if (nalts[i] < 255)
 757:						++nalts[i];
 758:				} else if (n < USB_MAXINTERFACES) {
 759:					inums[n] = inum;
 760:					nalts[n] = 1;
 761:					++n;
 762:				}
 763:	
 764:			} else if (header->bDescriptorType ==
 765:					USB_DT_INTERFACE_ASSOCIATION) {
 766:				struct usb_interface_assoc_descriptor *d;
 767:	
 768:				d = (struct usb_interface_assoc_descriptor *)header;
 769:				if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) {
 770:					dev_notice(ddev,
 771:						 "config %d has an invalid interface association descriptor of length %d, skipping\n",
 772:						 cfgno, d->bLength);
 773:					continue;
 774:				}
 775:	
 776:				if (iad_num == USB_MAXIADS) {
 777:					dev_notice(ddev, "found more Interface "
 778:						       "Association Descriptors "
 779:						       "than allocated for in "
 780:						       "configuration %d\n", cfgno);
 781:				} else {
 782:					config->intf_assoc[iad_num] = d;
 783:					iad_num++;
 784:				}
 785:	
 786:			} else if (header->bDescriptorType == USB_DT_DEVICE ||
 787:				    header->bDescriptorType == USB_DT_CONFIG)
 788:				dev_notice(ddev, "config %d contains an unexpected "
 789:				    "descriptor of type 0x%X, skipping\n",
 790:				    cfgno, header->bDescriptorType);
 791:	
 792:		}	/* for ((buffer2 = buffer, size2 = size); ...) */
 793:		size = buffer2 - buffer;
 794:		config->desc.wTotalLength = cpu_to_le16(buffer2 - buffer0);
 795:	
 796:		if (n != nintf)
 797:			dev_notice(ddev, "config %d has %d interface%s, different from "
 798:			    "the descriptor's value: %d\n",
 799:			    cfgno, n, str_plural(n), nintf_orig);
 800:		else if (n == 0)
 801:			dev_notice(ddev, "config %d has no interfaces?\n", cfgno);
 802:		config->desc.bNumInterfaces = nintf = n;
 803:	
 804:		/* Check for missing interface numbers */
 805:		for (i = 0; i < nintf; ++i) {
 806:			for (j = 0; j < nintf; ++j) {
 807:				if (inums[j] == i)
 808:					break;
 809:			}
 810:			if (j >= nintf)
 811:				dev_notice(ddev, "config %d has no interface number "
 812:				    "%d\n", cfgno, i);
 813:		}
 814:	
 815:		/* Allocate the usb_interface_caches and altsetting arrays */
 816:		for (i = 0; i < nintf; ++i) {
 817:			j = nalts[i];
 818:			if (j > USB_MAXALTSETTING) {
 819:				dev_notice(ddev, "too many alternate settings for "
 820:				    "config %d interface %d: %d, "
 821:				    "using maximum allowed: %d\n",
 822:				    cfgno, inums[i], j, USB_MAXALTSETTING);
 823:				nalts[i] = j = USB_MAXALTSETTING;
 824:			}
 825:	
 826:			intfc = kzalloc_flex(*intfc, altsetting, j);
 827:			config->intf_cache[i] = intfc;
 828:			if (!intfc)
 829:				return -ENOMEM;
 830:			kref_init(&intfc->ref);
 831:		}
 832:	
 833:		/* FIXME: parse the BOS descriptor */
 834:	
 835:		/* Skip over any Class Specific or Vendor Specific descriptors;
 836:		 * find the first interface descriptor */
 837:		config->extra = buffer;
 838:		i = find_next_descriptor(buffer, size, USB_DT_INTERFACE,
 839:		    USB_DT_INTERFACE, &n);
 840:		config->extralen = i;
 841:		if (n > 0)
 842:			dev_dbg(ddev, "skipped %d descriptor%s after %s\n",
 843:			    n, str_plural(n), "configuration");
 844:		buffer += i;
 845:		size -= i;
 846:	
 847:		/* Parse all the interface/altsetting descriptors */
 848:		while (size > 0) {
 849:			retval = usb_parse_interface(ddev, cfgno, config,
 850:			    buffer, size, inums, nalts);
 851:			if (retval < 0)
 852:				return retval;
 853:	
 854:			buffer += retval;
 855:			size -= retval;
 856:		}
 857:	
 858:		/* Check for missing altsettings */
 859:		for (i = 0; i < nintf; ++i) {
 860:			intfc = config->intf_cache[i];
 861:			for (j = 0; j < intfc->num_altsetting; ++j) {
 862:				for (n = 0; n < intfc->num_altsetting; ++n) {
 863:					if (intfc->altsetting[n].desc.
 864:					    bAlternateSetting == j)
 865:						break;
 866:				}
 867:				if (n >= intfc->num_altsetting)
 868:					dev_notice(ddev, "config %d interface %d has no "
 869:					    "altsetting %d\n", cfgno, inums[i], j);
 870:			}
 871:		}
 872:	
 873:		return 0;
 874:	}
 SourceFile:drivers/usb/core/config.c]

gemini-3.1-pro-preview

							input: 306424
							output: 43
							thoughts: 1175
						

**Analyzing the USB Driver Probing and Disconnect Sequence**

Okay, let's break this down step by step. I'm looking at the `usb_parse_configuration` function, and it seems that if `header->bLength < 2`, it bails out of the descriptor parsing loop. Then, `config->desc.bNumInterfaces` gets set to zero, because the loop broke before encountering any interface descriptors. This means `usb_set_configuration` won't create any interfaces, and consequently, no driver will be probed. I was initially worried that `syz_usb_connect` might be supplying an interface descriptor, so I checked the provided C code again, byte by byte. It's only 36 bytes long, the first 18 are device descriptors, the next 9 are configuration descriptors and the last 9 bytes are zero. So, this confirms that the interface descriptor *is* effectively all zeros. This initially reinforces my suspicion that no driver, specifically `rt2500usb`, will be probed.

Then, the prompt raises an interesting point – the C code is a *draft*. It's likely missing details like arguments. If the reproducer *did* have a valid interface descriptor, then the `rt2500usb` driver *would* be probed. If that happens, then `usb_reset_device` would be called, potentially leading to a disconnect and `rt2x00usb_disconnect`, which contains the potential bug.

However, I've already established that the "disconnect" triggered by `usb_reset_device` is *asynchronous*. It doesn't happen synchronously. It sets a flag and kicks `hub_wq`. Going back to `usb_reset_device` to be sure, it looks like it calls `hub_port_logical_disconnect` which just calls `kick_hub_wq`. So, if the disconnect is asynchronous, then `rt2x00usb_probe` will likely finish before the disconnect happens, avoiding the race condition I thought existed.

Then I realized, what if `rt2x00usb_probe` fails and returns an error? In this case, it sets `intfdata` to `NULL`. If it is `NULL`, what happens when the disconnect *does* occur? Wait a moment, if `probe` returns an error, the USB core marks the interface as UNBOUND. Does the USB core call `disconnect` for an UNBOUND interface? I'll need to check `usb_unbind_interface` in `drivers/usb/core/driver.c` to be sure.

map[ContextFile:drivers/usb/core/driver.c IncludeLines:true Name:usb_unbind_interface]

map[SourceCode: 427:	/* called from driver core with dev locked */
 428:	static int usb_unbind_interface(struct device *dev)
 429:	{
 430:		struct usb_driver *driver = to_usb_driver(dev->driver);
 431:		struct usb_interface *intf = to_usb_interface(dev);
 432:		struct usb_host_endpoint *ep, **eps = NULL;
 433:		struct usb_device *udev;
 434:		int i, j, error, r;
 435:		int lpm_disable_error = -ENODEV;
 436:	
 437:		intf->condition = USB_INTERFACE_UNBINDING;
 438:	
 439:		/* Autoresume for set_interface call below */
 440:		udev = interface_to_usbdev(intf);
 441:		error = usb_autoresume_device(udev);
 442:	
 443:		/* If hub-initiated LPM policy may change, attempt to disable LPM until
 444:		 * the driver is unbound.  If LPM isn't disabled, that's fine because it
 445:		 * wouldn't be enabled unless all the bound interfaces supported
 446:		 * hub-initiated LPM.
 447:		 */
 448:		if (driver->disable_hub_initiated_lpm)
 449:			lpm_disable_error = usb_unlocked_disable_lpm(udev);
 450:	
 451:		/*
 452:		 * Terminate all URBs for this interface unless the driver
 453:		 * supports "soft" unbinding and the device is still present.
 454:		 */
 455:		if (!driver->soft_unbind || udev->state == USB_STATE_NOTATTACHED)
 456:			usb_disable_interface(udev, intf, false);
 457:	
 458:		driver->disconnect(intf);
 459:	
 460:		/* Free streams */
 461:		for (i = 0, j = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
 462:			ep = &intf->cur_altsetting->endpoint[i];
 463:			if (ep->streams == 0)
 464:				continue;
 465:			if (j == 0) {
 466:				eps = kmalloc_array(USB_MAXENDPOINTS, sizeof(void *),
 467:					      GFP_KERNEL);
 468:				if (!eps)
 469:					break;
 470:			}
 471:			eps[j++] = ep;
 472:		}
 473:		if (j) {
 474:			usb_free_streams(intf, eps, j, GFP_KERNEL);
 475:			kfree(eps);
 476:		}
 477:	
 478:		/* Reset other interface state.
 479:		 * We cannot do a Set-Interface if the device is suspended or
 480:		 * if it is prepared for a system sleep (since installing a new
 481:		 * altsetting means creating new endpoint device entries).
 482:		 * When either of these happens, defer the Set-Interface.
 483:		 */
 484:		if (intf->cur_altsetting->desc.bAlternateSetting == 0) {
 485:			/* Already in altsetting 0 so skip Set-Interface.
 486:			 * Just re-enable it without affecting the endpoint toggles.
 487:			 */
 488:			usb_enable_interface(udev, intf, false);
 489:		} else if (!error && !intf->dev.power.is_prepared) {
 490:			r = usb_set_interface(udev, intf->altsetting[0].
 491:					desc.bInterfaceNumber, 0);
 492:			if (r < 0)
 493:				intf->needs_altsetting0 = 1;
 494:		} else {
 495:			intf->needs_altsetting0 = 1;
 496:		}
 497:		usb_set_intfdata(intf, NULL);
 498:	
 499:		intf->condition = USB_INTERFACE_UNBOUND;
 500:		intf->needs_remote_wakeup = 0;
 501:	
 502:		/* Attempt to re-enable USB3 LPM, if the disable succeeded. */
 503:		if (!lpm_disable_error)
 504:			usb_unlocked_enable_lpm(udev);
 505:	
 506:		/* Unbound interfaces are always runtime-PM-disabled and -suspended */
 507:		if (driver->supports_autosuspend)
 508:			pm_runtime_disable(dev);
 509:		pm_runtime_set_suspended(dev);
 510:	
 511:		if (!error)
 512:			usb_autosuspend_device(udev);
 513:	
 514:		return 0;
 515:	}
 SourceFile:drivers/usb/core/driver.c]

gemini-3.1-pro-preview

							input: 309620
							output: 50
							thoughts: 183
						

**Analyzing the USB Driver Unbinding and Probe Process**

Okay, so `usb_unbind_interface` is triggered by the driver core when a device is unbound. Makes sense. Now, if the `probe` function fails, the driver core *doesn't* bind the driver in the first place, right? Therefore, `unbind` isn't called. Consequently, `disconnect` also isn't called if `probe` fails. This is crucial because it means that NULL pointer dereference that we were worried about in `rt2x00usb_disconnect` is *impossible* under these conditions.

Alright, that's one potential issue off the table. Let's shift gears and revisit that divide-by-zero in `rt2x00usb_get_tx_data_len`. Hmmm... wait a minute, I remember that `rt2500usb` doesn't actually *send* any TX packets during the probe sequence. But, wasn't there another driver we were looking at... Ah yes, `rtl8192cu`. Now, does *that* driver send TX packets during probe? It's a mac80211 driver, so the rules might be different... I need to check the `rtl_usb_probe` function to confirm whether TX packets are sent during probe.

map[ContextFile:drivers/net/wireless/realtek/rtlwifi/usb.c IncludeLines:true Name:rtl_usb_probe]

map[SourceCode: 951:	int rtl_usb_probe(struct usb_interface *intf,
 952:			  const struct usb_device_id *id,
 953:			  const struct rtl_hal_cfg *rtl_hal_cfg)
 954:	{
 955:		int err;
 956:		struct ieee80211_hw *hw = NULL;
 957:		struct rtl_priv *rtlpriv = NULL;
 958:		struct usb_device	*udev;
 959:		struct rtl_usb_priv *usb_priv;
 960:	
 961:		hw = ieee80211_alloc_hw(sizeof(struct rtl_priv) +
 962:					sizeof(struct rtl_usb_priv), &rtl_ops);
 963:		if (!hw) {
 964:			pr_warn("rtl_usb: ieee80211 alloc failed\n");
 965:			return -ENOMEM;
 966:		}
 967:		rtlpriv = hw->priv;
 968:		rtlpriv->hw = hw;
 969:		rtlpriv->usb_data = kcalloc(RTL_USB_MAX_RX_COUNT, sizeof(u32),
 970:					    GFP_KERNEL);
 971:		if (!rtlpriv->usb_data) {
 972:			ieee80211_free_hw(hw);
 973:			return -ENOMEM;
 974:		}
 975:	
 976:		/* this spin lock must be initialized early */
 977:		spin_lock_init(&rtlpriv->locks.usb_lock);
 978:		INIT_WORK(&rtlpriv->works.fill_h2c_cmd,
 979:			  rtl_fill_h2c_cmd_work_callback);
 980:		INIT_WORK(&rtlpriv->works.lps_change_work,
 981:			  rtl_lps_change_work_callback);
 982:		INIT_WORK(&rtlpriv->works.update_beacon_work,
 983:			  rtl_update_beacon_work_callback);
 984:	
 985:		rtlpriv->usb_data_index = 0;
 986:		init_completion(&rtlpriv->firmware_loading_complete);
 987:		SET_IEEE80211_DEV(hw, &intf->dev);
 988:		udev = interface_to_usbdev(intf);
 989:		usb_priv = rtl_usbpriv(hw);
 990:		memset(usb_priv, 0, sizeof(*usb_priv));
 991:		usb_priv->dev.intf = intf;
 992:		usb_priv->dev.udev = udev;
 993:		usb_set_intfdata(intf, hw);
 994:		/* For dual MAC RTL8192DU, which has two interfaces. */
 995:		rtlpriv->rtlhal.interfaceindex =
 996:			intf->altsetting[0].desc.bInterfaceNumber;
 997:		/* init cfg & intf_ops */
 998:		rtlpriv->rtlhal.interface = INTF_USB;
 999:		rtlpriv->cfg = rtl_hal_cfg;
1000:		rtlpriv->intf_ops = &rtl_usb_ops;
1001:		/* Init IO handler */
1002:		_rtl_usb_io_handler_init(&udev->dev, hw);
1003:		rtlpriv->cfg->ops->read_chip_version(hw);
1004:		/*like read eeprom and so on */
1005:		rtlpriv->cfg->ops->read_eeprom_info(hw);
1006:		err = _rtl_usb_init(hw);
1007:		if (err)
1008:			goto error_out2;
1009:		rtl_usb_init_sw(hw);
1010:		/* Init mac80211 sw */
1011:		err = rtl_init_core(hw);
1012:		if (err) {
1013:			pr_err("Can't allocate sw for mac80211\n");
1014:			goto error_out2;
1015:		}
1016:		if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
1017:			pr_err("Can't init_sw_vars\n");
1018:			goto error_out;
1019:		}
1020:		rtl_init_sw_leds(hw);
1021:	
1022:		err = ieee80211_register_hw(hw);
1023:		if (err) {
1024:			pr_err("Can't register mac80211 hw.\n");
1025:			goto error_init_vars;
1026:		}
1027:		rtlpriv->mac80211.mac80211_registered = 1;
1028:	
1029:		set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status);
1030:		return 0;
1031:	
1032:	error_init_vars:
1033:		wait_for_completion(&rtlpriv->firmware_loading_complete);
1034:		rtlpriv->cfg->ops->deinit_sw_vars(hw);
1035:	error_out:
1036:		rtl_usb_deinit(hw);
1037:		rtl_deinit_core(hw);
1038:	error_out2:
1039:		_rtl_usb_io_handler_release(hw);
1040:		kfree(rtlpriv->usb_data);
1041:		ieee80211_free_hw(hw);
1042:		return -ENODEV;
1043:	}
 SourceFile:drivers/net/wireless/realtek/rtlwifi/usb.c]

gemini-3.1-pro-preview

							input: 311773
							output: 51
							thoughts: 24
						

Here's my thought process, as if I were considering this code:

**Diving into USB Initialization**

Okay, so the program flow has reached `_rtl_usb_init`. That's the entry point for the USB initialization routines, right? My initial thought is to immediately dive into the definition of `_rtl_usb_init`. Let's take a closer look at what's happening within that function. I need to understand what's being set up, what resources are being allocated, and what the overall initialization strategy is for the USB controller in this specific Realtek environment. This is where the magic (or the problems!) are likely to be. Time to dig in and see how the hardware interface is being brought online.

map[ContextFile:drivers/net/wireless/realtek/rtlwifi/usb.c IncludeLines:true Name:_rtl_usb_init]

map[SourceCode: 236:	static int _rtl_usb_init(struct ieee80211_hw *hw)
 237:	{
 238:		struct rtl_priv *rtlpriv = rtl_priv(hw);
 239:		struct rtl_usb_priv *usb_priv = rtl_usbpriv(hw);
 240:		struct rtl_usb *rtlusb = rtl_usbdev(usb_priv);
 241:		int err;
 242:		u8 epidx;
 243:		struct usb_interface	*usb_intf = rtlusb->intf;
 244:		u8 epnums = usb_intf->cur_altsetting->desc.bNumEndpoints;
 245:	
 246:		rtlusb->out_ep_nums = rtlusb->in_ep_nums = 0;
 247:		for (epidx = 0; epidx < epnums; epidx++) {
 248:			struct usb_endpoint_descriptor *pep_desc;
 249:	
 250:			pep_desc = &usb_intf->cur_altsetting->endpoint[epidx].desc;
 251:	
 252:			if (usb_endpoint_dir_in(pep_desc)) {
 253:				if (usb_endpoint_xfer_bulk(pep_desc)) {
 254:					/* The vendor drivers assume there is only one
 255:					 * bulk in ep and that it's the first in ep.
 256:					 */
 257:					if (rtlusb->in_ep_nums == 0)
 258:						rtlusb->in_ep = usb_endpoint_num(pep_desc);
 259:					else
 260:						pr_warn("%s: bulk in endpoint is not the first in endpoint\n",
 261:							__func__);
 262:				}
 263:	
 264:				rtlusb->in_ep_nums++;
 265:			} else if (usb_endpoint_dir_out(pep_desc)) {
 266:				if (rtlusb->out_ep_nums < RTL_USB_MAX_BULKOUT_NUM) {
 267:					if (usb_endpoint_xfer_bulk(pep_desc))
 268:						rtlusb->out_eps[rtlusb->out_ep_nums] =
 269:								usb_endpoint_num(pep_desc);
 270:				} else {
 271:					pr_warn("%s: found more bulk out endpoints than the expected %d\n",
 272:						__func__, RTL_USB_MAX_BULKOUT_NUM);
 273:				}
 274:	
 275:				rtlusb->out_ep_nums++;
 276:			}
 277:	
 278:			rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
 279:				"USB EP(0x%02x), MaxPacketSize=%d, Interval=%d\n",
 280:				pep_desc->bEndpointAddress, pep_desc->wMaxPacketSize,
 281:				pep_desc->bInterval);
 282:		}
 283:	
 284:		if (rtlusb->out_ep_nums == 0) {
 285:			pr_err("No output end points found\n");
 286:			return -EINVAL;
 287:		}
 288:		/* usb endpoint mapping */
 289:		err = rtlpriv->cfg->usb_interface_cfg->usb_endpoint_mapping(hw);
 290:		if (err)
 291:			return err;
 292:	
 293:		rtlusb->usb_mq_to_hwq = rtlpriv->cfg->usb_interface_cfg->usb_mq_to_hwq;
 294:	
 295:		err = _rtl_usb_init_tx(hw);
 296:		if (err)
 297:			return err;
 298:	
 299:		err = _rtl_usb_init_rx(hw);
 300:		if (err)
 301:			goto err_out;
 302:	
 303:		return 0;
 304:	
 305:	err_out:
 306:		_rtl_usb_cleanup_tx(hw);
 307:		return err;
 308:	}
 SourceFile:drivers/net/wireless/realtek/rtlwifi/usb.c]

gemini-3.1-pro-preview

							input: 313242
							output: 62
							thoughts: 197
						

**Endpoint Woes: A Deep Dive**

Okay, hold on a second. I'm seeing something here. This `_rtl_usb_init` function... it's checking `rtlusb->out_ep_nums == 0`. And if that condition is true, it's immediately returning `-EINVAL`. This feels... problematic. Let me think this through. If the `bNumEndpoints` field in the USB descriptor is zero, then `rtlusb->out_ep_nums` will definitely be zero. So, this check *always* returns `-EINVAL` when there are no endpoints?

And then, looking ahead, `rtl_usb_probe` will hit `error_out2` and return `-ENODEV`. That means the `rtl8192cu` driver is going to fail to probe! That’s a serious issue, I need to investigate further. This feels like a blatant configuration error!

Now, let me shift gears slightly. Does the `rt2500usb` driver have a similar endpoint validation issue? Let's check. Let's start with `rt2x00usb_probe`. Okay, it looks like it calls `rt2x00lib_probe_dev`, which then calls `rt2500usb_probe_hw`. Hmm... I need to figure out if any of *those* functions are doing something similar. Let me zero in on `rt2x00usb_alloc_reg` and see if there are any analogous endpoint checks.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_alloc_reg]

map[SourceCode: 773:	static int rt2x00usb_alloc_reg(struct rt2x00_dev *rt2x00dev)
 774:	{
 775:		rt2x00dev->csr.cache = kzalloc(CSR_CACHE_SIZE, GFP_KERNEL);
 776:		if (!rt2x00dev->csr.cache)
 777:			goto exit;
 778:	
 779:		rt2x00dev->eeprom = kzalloc(rt2x00dev->ops->eeprom_size, GFP_KERNEL);
 780:		if (!rt2x00dev->eeprom)
 781:			goto exit;
 782:	
 783:		rt2x00dev->rf = kzalloc(rt2x00dev->ops->rf_size, GFP_KERNEL);
 784:		if (!rt2x00dev->rf)
 785:			goto exit;
 786:	
 787:		return 0;
 788:	
 789:	exit:
 790:		rt2x00_probe_err("Failed to allocate registers\n");
 791:	
 792:		rt2x00usb_free_reg(rt2x00dev);
 793:	
 794:		return -ENOMEM;
 795:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3.1-pro-preview

							input: 314242
							output: 62
							thoughts: 126
						

**Endpoint Verification Conundrum**

Okay, so I'm digging into this `rt2x00usb_probe` function, and it's suddenly struck me: I don't see any endpoint checking happening here. Seriously? No endpoint validation whatsoever in `rt2x00usb_probe`? This seems incredibly unusual, so I'm going to double-check my understanding of `rt2x00usb_probe` to make sure I'm not missing something.

Right, back to it. Okay, I see it calls `usb_reset_device`, then moves on to `ieee80211_alloc_hw`, then `rt2x00usb_alloc_reg`, and finally `rt2x00lib_probe_dev`. Interesting. It's plausible that the check might happen in one of these subroutines, so I'll need to go deeper. Given the flow, `rt2x00lib_probe_dev` is the most likely candidate. Let's get into `rt2x00lib_probe_dev` and see what's going on there.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c IncludeLines:true Name:rt2x00lib_probe_dev]

map[SourceCode:1371:	/*
1372:	 * driver allocation handlers.
1373:	 */
1374:	int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
1375:	{
1376:		int retval = -ENOMEM;
1377:	
1378:		/*
1379:		 * Set possible interface combinations.
1380:		 */
1381:		rt2x00lib_set_if_combinations(rt2x00dev);
1382:	
1383:		/*
1384:		 * Allocate the driver data memory, if necessary.
1385:		 */
1386:		if (rt2x00dev->ops->drv_data_size > 0) {
1387:			rt2x00dev->drv_data = kzalloc(rt2x00dev->ops->drv_data_size,
1388:				                      GFP_KERNEL);
1389:			if (!rt2x00dev->drv_data) {
1390:				retval = -ENOMEM;
1391:				goto exit;
1392:			}
1393:		}
1394:	
1395:		spin_lock_init(&rt2x00dev->irqmask_lock);
1396:		mutex_init(&rt2x00dev->csr_mutex);
1397:		mutex_init(&rt2x00dev->conf_mutex);
1398:		INIT_LIST_HEAD(&rt2x00dev->bar_list);
1399:		spin_lock_init(&rt2x00dev->bar_list_lock);
1400:		hrtimer_setup(&rt2x00dev->txstatus_timer, hrtimer_dummy_timeout, CLOCK_MONOTONIC,
1401:			      HRTIMER_MODE_REL);
1402:	
1403:		set_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
1404:	
1405:		/*
1406:		 * Make room for rt2x00_intf inside the per-interface
1407:		 * structure ieee80211_vif.
1408:		 */
1409:		rt2x00dev->hw->vif_data_size = sizeof(struct rt2x00_intf);
1410:	
1411:		/*
1412:		 * rt2x00 devices can only use the last n bits of the MAC address
1413:		 * for virtual interfaces.
1414:		 */
1415:		rt2x00dev->hw->wiphy->addr_mask[ETH_ALEN - 1] =
1416:			(rt2x00dev->ops->max_ap_intf - 1);
1417:	
1418:		/*
1419:		 * Initialize work.
1420:		 */
1421:		rt2x00dev->workqueue =
1422:		    alloc_ordered_workqueue("%s", 0, wiphy_name(rt2x00dev->hw->wiphy));
1423:		if (!rt2x00dev->workqueue) {
1424:			retval = -ENOMEM;
1425:			goto exit;
1426:		}
1427:	
1428:		INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled);
1429:		INIT_DELAYED_WORK(&rt2x00dev->autowakeup_work, rt2x00lib_autowakeup);
1430:		INIT_WORK(&rt2x00dev->sleep_work, rt2x00lib_sleep);
1431:	
1432:		/*
1433:		 * Let the driver probe the device to detect the capabilities.
1434:		 */
1435:		retval = rt2x00dev->ops->lib->probe_hw(rt2x00dev);
1436:		if (retval) {
1437:			rt2x00_err(rt2x00dev, "Failed to allocate device\n");
1438:			goto exit;
1439:		}
1440:	
1441:		/*
1442:		 * Allocate queue array.
1443:		 */
1444:		retval = rt2x00queue_allocate(rt2x00dev);
1445:		if (retval)
1446:			goto exit;
1447:	
1448:		/* Cache TX headroom value */
1449:		rt2x00dev->extra_tx_headroom = rt2x00dev_extra_tx_headroom(rt2x00dev);
1450:	
1451:		/*
1452:		 * Determine which operating modes are supported, all modes
1453:		 * which require beaconing, depend on the availability of
1454:		 * beacon entries.
1455:		 */
1456:		rt2x00dev->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
1457:		if (rt2x00dev->bcn->limit > 0)
1458:			rt2x00dev->hw->wiphy->interface_modes |=
1459:			    BIT(NL80211_IFTYPE_ADHOC) |
1460:	#ifdef CONFIG_MAC80211_MESH
1461:			    BIT(NL80211_IFTYPE_MESH_POINT) |
1462:	#endif
1463:			    BIT(NL80211_IFTYPE_AP);
1464:	
1465:		rt2x00dev->hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
1466:	
1467:		wiphy_ext_feature_set(rt2x00dev->hw->wiphy,
1468:				      NL80211_EXT_FEATURE_CQM_RSSI_LIST);
1469:	
1470:		/*
1471:		 * Initialize ieee80211 structure.
1472:		 */
1473:		retval = rt2x00lib_probe_hw(rt2x00dev);
1474:		if (retval) {
1475:			rt2x00_err(rt2x00dev, "Failed to initialize hw\n");
1476:			goto exit;
1477:		}
1478:	
1479:		/*
1480:		 * Register extra components.
1481:		 */
1482:		rt2x00link_register(rt2x00dev);
1483:		rt2x00leds_register(rt2x00dev);
1484:		rt2x00debug_register(rt2x00dev);
1485:	
1486:		/*
1487:		 * Start rfkill polling.
1488:		 */
1489:		if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
1490:			rt2x00rfkill_register(rt2x00dev);
1491:	
1492:		return 0;
1493:	
1494:	exit:
1495:		rt2x00lib_remove_dev(rt2x00dev);
1496:	
1497:		return retval;
1498:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00dev.c]

gemini-3.1-pro-preview

							input: 316778
							output: 60
							thoughts: 48
						

Here's my thought process, summarized as you requested:

**Deconstructing the rt2x00lib_probe_dev Call**

Okay, so I'm digging into this `rt2x00lib_probe_dev` function. The first thing that jumps out is that it calls `rt2x00queue_allocate(rt2x00dev)`. That's interesting, because queue allocation is typically handled early in a driver's initialization. I need to understand why it's happening at this point and what it's trying to do in the probe function.

Therefore, I need to check `rt2x00queue_allocate` to ascertain why it has been called, and more importantly, how it interacts with `rt2x00dev` and the hardware initialization sequence. I'm hoping to get a clearer picture of the overall device initialization.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00queue.c IncludeLines:true Name:rt2x00queue_allocate]

map[SourceCode:1231:	int rt2x00queue_allocate(struct rt2x00_dev *rt2x00dev)
1232:	{
1233:		struct data_queue *queue;
1234:		enum data_queue_qid qid;
1235:		unsigned int req_atim =
1236:		    rt2x00_has_cap_flag(rt2x00dev, REQUIRE_ATIM_QUEUE);
1237:	
1238:		/*
1239:		 * We need the following queues:
1240:		 * RX: 1
1241:		 * TX: ops->tx_queues
1242:		 * Beacon: 1
1243:		 * Atim: 1 (if required)
1244:		 */
1245:		rt2x00dev->data_queues = 2 + rt2x00dev->ops->tx_queues + req_atim;
1246:	
1247:		queue = kzalloc_objs(*queue, rt2x00dev->data_queues);
1248:		if (!queue)
1249:			return -ENOMEM;
1250:	
1251:		/*
1252:		 * Initialize pointers
1253:		 */
1254:		rt2x00dev->rx = queue;
1255:		rt2x00dev->tx = &queue[1];
1256:		rt2x00dev->bcn = &queue[1 + rt2x00dev->ops->tx_queues];
1257:		rt2x00dev->atim = req_atim ? &queue[2 + rt2x00dev->ops->tx_queues] : NULL;
1258:	
1259:		/*
1260:		 * Initialize queue parameters.
1261:		 * RX: qid = QID_RX
1262:		 * TX: qid = QID_AC_VO + index
1263:		 * TX: cw_min: 2^5 = 32.
1264:		 * TX: cw_max: 2^10 = 1024.
1265:		 * BCN: qid = QID_BEACON
1266:		 * ATIM: qid = QID_ATIM
1267:		 */
1268:		rt2x00queue_init(rt2x00dev, rt2x00dev->rx, QID_RX);
1269:	
1270:		qid = QID_AC_VO;
1271:		tx_queue_for_each(rt2x00dev, queue)
1272:			rt2x00queue_init(rt2x00dev, queue, qid++);
1273:	
1274:		rt2x00queue_init(rt2x00dev, rt2x00dev->bcn, QID_BEACON);
1275:		if (req_atim)
1276:			rt2x00queue_init(rt2x00dev, rt2x00dev->atim, QID_ATIM);
1277:	
1278:		return 0;
1279:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00queue.c]

gemini-3.1-pro-preview

							input: 317976
							output: 60
							thoughts: 14
						

Okay, here's my take on those thoughts, tailored for an expert audience, presented in the first person:

**Diving into `rt2x00queue_init`**

Alright, let's pull up the code for `rt2x00queue_init`. I need to refresh my memory on the initial setup of the hardware queues within the `rt2x00` driver. I know this function is critical, it's where the foundation is laid for packet transmission and reception. I'm thinking about the data structures being initialized. Are they setting up the ring buffers correctly? What's the allocation strategy for descriptors? Is there proper alignment to maximize cache efficiency? I want to make sure there are no obvious inefficiencies there that might be masking performance issues down the line, or potential buffer overflows that can easily crash the driver, so I want to be certain there is full validation.

It's been a while since I've scrutinized this section deeply, so I want to see how the code handles different hardware variants and their queue depths. I'll be looking for any potential hardware-specific quirks or workarounds they've implemented. Is there any obvious missed opportunity to streamline the queue initialization process for particular chips? I know the driver is complex, but I am familiar with the rt2x00 chip architecture, so I have a mental roadmap already to help guide this deeper analysis.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00queue.c IncludeLines:true Name:rt2x00queue_init]

map[SourceCode:1212:	static void rt2x00queue_init(struct rt2x00_dev *rt2x00dev,
1213:				     struct data_queue *queue, enum data_queue_qid qid)
1214:	{
1215:		mutex_init(&queue->status_lock);
1216:		spin_lock_init(&queue->tx_lock);
1217:		spin_lock_init(&queue->index_lock);
1218:	
1219:		queue->rt2x00dev = rt2x00dev;
1220:		queue->qid = qid;
1221:		queue->txop = 0;
1222:		queue->aifs = 2;
1223:		queue->cw_min = 5;
1224:		queue->cw_max = 10;
1225:	
1226:		rt2x00dev->ops->queue_init(queue);
1227:	
1228:		queue->threshold = DIV_ROUND_UP(queue->limit, 10);
1229:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00queue.c]

gemini-3.1-pro-preview

							input: 318685
							output: 62
							thoughts: 65
						

**Analyzing the Driver's Queue Initialization**

Okay, so I'm looking at this code and it's calling `rt2x00dev->ops->queue_init(queue)`. Right, that makes sense – it's initializing the specific queue. Now, I'm thinking, in the context of the `rt2500usb` driver, I'm pretty sure that function pointer is going to point to `rt2500usb_queue_init`. But I need to be absolutely certain before I move on. Let's confirm that by digging into the `rt2500usb_queue_init` function to see what's really happening under the hood. I need to understand this part of the setup thoroughly.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c IncludeLines:true Name:rt2500usb_queue_init]

map[SourceCode:1851:	static void rt2500usb_queue_init(struct data_queue *queue)
1852:	{
1853:		switch (queue->qid) {
1854:		case QID_RX:
1855:			queue->limit = 32;
1856:			queue->data_size = DATA_FRAME_SIZE;
1857:			queue->desc_size = RXD_DESC_SIZE;
1858:			queue->priv_size = sizeof(struct queue_entry_priv_usb);
1859:			break;
1860:	
1861:		case QID_AC_VO:
1862:		case QID_AC_VI:
1863:		case QID_AC_BE:
1864:		case QID_AC_BK:
1865:			queue->limit = 32;
1866:			queue->data_size = DATA_FRAME_SIZE;
1867:			queue->desc_size = TXD_DESC_SIZE;
1868:			queue->priv_size = sizeof(struct queue_entry_priv_usb);
1869:			break;
1870:	
1871:		case QID_BEACON:
1872:			queue->limit = 1;
1873:			queue->data_size = MGMT_FRAME_SIZE;
1874:			queue->desc_size = TXD_DESC_SIZE;
1875:			queue->priv_size = sizeof(struct queue_entry_priv_usb_bcn);
1876:			break;
1877:	
1878:		case QID_ATIM:
1879:			queue->limit = 8;
1880:			queue->data_size = DATA_FRAME_SIZE;
1881:			queue->desc_size = TXD_DESC_SIZE;
1882:			queue->priv_size = sizeof(struct queue_entry_priv_usb);
1883:			break;
1884:	
1885:		default:
1886:			BUG();
1887:			break;
1888:		}
1889:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c]

gemini-3.1-pro-preview

							input: 319589
							output: 18
							thoughts: 56
						

**Debugging a Potential USB Packet Issue**

Okay, hold on a second. I'm looking at this code, specifically this `queue` object, and something's not sitting right. I'm seeing a reference to `queue->usb_maxpacket` here, but I don't see any explicit initialization of that value *here* in this context. That's a red flag. I know this code, and that data member needs to be set up or we will be in big trouble!

I need to trace where `usb_maxpacket` actually *gets* its value. This isn't where I expected it to be set. The most logical next step is to perform a code search to see how its initialized. So, let's fire up a `grep` and search for `usb_maxpacket` within the `drivers/net/wireless/ralink/rt2x00/` directory. That seems like the most logical place it would be set since it is a wireless device. Hopefully, that will lead me to the initialization point and uncover what's going on.

map[Expression:usb_maxpacket]

map[Output:drivers/hid/usbhid/hid-core.c=367=static int hid_submit_ctrl(struct hid_device *hid)
--
drivers/hid/usbhid/hid-core.c-390-		usbhid->urbctrl->pipe = usb_rcvctrlpipe(hid_to_usb_dev(hid), 0);
drivers/hid/usbhid/hid-core.c:391:		maxpacket = usb_maxpacket(hid_to_usb_dev(hid),
drivers/hid/usbhid/hid-core.c-392-					  usbhid->urbctrl->pipe);
--
drivers/hid/usbhid/usbkbd.c=261=static int usb_kbd_probe(struct usb_interface *iface,
--
drivers/hid/usbhid/usbkbd.c-281-	pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress);
drivers/hid/usbhid/usbkbd.c:282:	maxp = usb_maxpacket(dev, pipe);
drivers/hid/usbhid/usbkbd.c-283-
--
drivers/hid/usbhid/usbmouse.c=106=static int usb_mouse_probe(struct usb_interface *intf, const struct usb_device_id *id)
--
drivers/hid/usbhid/usbmouse.c-125-	pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress);
drivers/hid/usbhid/usbmouse.c:126:	maxp = usb_maxpacket(dev, pipe);
drivers/hid/usbhid/usbmouse.c-127-
--
drivers/input/misc/ati_remote2.c=598=static int ati_remote2_urb_init(struct ati_remote2 *ar2)
--
drivers/input/misc/ati_remote2.c-612-		pipe = usb_rcvintpipe(udev, ar2->ep[i]->bEndpointAddress);
drivers/input/misc/ati_remote2.c:613:		maxp = usb_maxpacket(udev, pipe);
drivers/input/misc/ati_remote2.c-614-		maxp = maxp > 4 ? 4 : maxp;
--
drivers/input/misc/cm109.c=677=static int cm109_usb_probe(struct usb_interface *intf,
--
drivers/input/misc/cm109.c-738-	pipe = usb_rcvintpipe(udev, endpoint->bEndpointAddress);
drivers/input/misc/cm109.c:739:	ret = usb_maxpacket(udev, pipe);
drivers/input/misc/cm109.c-740-	if (ret != USB_PKT_LEN)
--
drivers/input/misc/powermate.c=293=static int powermate_probe(struct usb_interface *intf, const struct usb_device_id *id)
--
drivers/input/misc/powermate.c-369-	pipe = usb_rcvintpipe(udev, endpoint->bEndpointAddress);
drivers/input/misc/powermate.c:370:	maxp = usb_maxpacket(udev, pipe);
drivers/input/misc/powermate.c-371-
--
drivers/input/misc/yealink.c=815=static int usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
--
drivers/input/misc/yealink.c-871-	pipe = usb_rcvintpipe(udev, endpoint->bEndpointAddress);
drivers/input/misc/yealink.c:872:	ret = usb_maxpacket(udev, pipe);
drivers/input/misc/yealink.c-873-	if (ret != USB_PKT_LEN)
--
drivers/input/tablet/acecad.c=111=static int usb_acecad_probe(struct usb_interface *intf, const struct usb_device_id *id)
--
drivers/input/tablet/acecad.c-129-	pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress);
drivers/input/tablet/acecad.c:130:	maxp = usb_maxpacket(dev, pipe);
drivers/input/tablet/acecad.c-131-
--
drivers/input/tablet/pegasus_notetaker.c=271=static int pegasus_probe(struct usb_interface *intf,
--
drivers/input/tablet/pegasus_notetaker.c-312-
drivers/input/tablet/pegasus_notetaker.c:313:	pegasus->data_len = usb_maxpacket(dev, pipe);
drivers/input/tablet/pegasus_notetaker.c-314-	if (pegasus->data_len < NOTETAKER_PACKET_SIZE) {
--
drivers/media/rc/ati_remote.c=765=static int ati_remote_initialize(struct ati_remote *ati_remote)
--
drivers/media/rc/ati_remote.c-773-	pipe = usb_rcvintpipe(udev, ati_remote->endpoint_in->bEndpointAddress);
drivers/media/rc/ati_remote.c:774:	maxp = usb_maxpacket(udev, pipe);
drivers/media/rc/ati_remote.c-775-	maxp = (maxp > DATA_BUFSIZE) ? DATA_BUFSIZE : maxp;
--
drivers/media/rc/ati_remote.c-784-	pipe = usb_sndintpipe(udev, ati_remote->endpoint_out->bEndpointAddress);
drivers/media/rc/ati_remote.c:785:	maxp = usb_maxpacket(udev, pipe);
drivers/media/rc/ati_remote.c-786-	maxp = (maxp > DATA_BUFSIZE) ? DATA_BUFSIZE : maxp;
--
drivers/media/rc/mceusb.c=1651=static int mceusb_dev_probe(struct usb_interface *intf,
--
drivers/media/rc/mceusb.c-1715-		pipe = usb_rcvbulkpipe(dev, ep_in->bEndpointAddress);
drivers/media/rc/mceusb.c:1716:	maxp = usb_maxpacket(dev, pipe);
drivers/media/rc/mceusb.c-1717-
--
drivers/media/rc/streamzap.c=276=static int streamzap_probe(struct usb_interface *intf,
--
drivers/media/rc/streamzap.c-316-	pipe = usb_rcvintpipe(usbdev, endpoint->bEndpointAddress);
drivers/media/rc/streamzap.c:317:	maxp = usb_maxpacket(usbdev, pipe);
drivers/media/rc/streamzap.c-318-
--
drivers/media/rc/xbox_remote.c=166=static void xbox_remote_initialize(struct xbox_remote *xbox_remote,
--
drivers/media/rc/xbox_remote.c-173-	pipe = usb_rcvintpipe(udev, endpoint_in->bEndpointAddress);
drivers/media/rc/xbox_remote.c:174:	maxp = usb_maxpacket(udev, pipe);
drivers/media/rc/xbox_remote.c-175-	maxp = (maxp > DATA_BUFSIZE) ? DATA_BUFSIZE : maxp;
--
drivers/net/can/usb/etas_es58x/es58x_core.c=1706=static int es58x_alloc_rx_urbs(struct es58x_device *es58x_dev)
--
drivers/net/can/usb/etas_es58x/es58x_core.c-1709-	const struct es58x_parameters *param = es58x_dev->param;
drivers/net/can/usb/etas_es58x/es58x_core.c:1710:	u16 rx_buf_len = usb_maxpacket(es58x_dev->udev, es58x_dev->rx_pipe);
drivers/net/can/usb/etas_es58x/es58x_core.c-1711-	struct urb *urb;
--
drivers/net/usb/cdc_ncm.c=405=static void cdc_ncm_update_rxtx_max(struct usbnet *dev, u32 new_rx, u32 new_tx)
--
drivers/net/usb/cdc_ncm.c-447-	if (val != le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize) &&
drivers/net/usb/cdc_ncm.c:448:	    val % usb_maxpacket(dev->udev, dev->out) == 0)
drivers/net/usb/cdc_ncm.c-449-		val++;
--
drivers/net/usb/cdc_ncm.c-471-	/* never pad more than 3 full USB packets per transfer */
drivers/net/usb/cdc_ncm.c:472:	ctx->min_tx_pkt = clamp_t(u16, ctx->tx_max - 3 * usb_maxpacket(dev->udev, dev->out),
drivers/net/usb/cdc_ncm.c-473-				  CDC_NCM_MIN_TX_PKT, ctx->tx_max);
--
drivers/net/usb/lan78xx.c=4620=static int lan78xx_probe(struct usb_interface *intf,
--
drivers/net/usb/lan78xx.c-4720-	period = ep_intr->desc.bInterval;
drivers/net/usb/lan78xx.c:4721:	maxp = usb_maxpacket(dev->udev, dev->pipe_intr);
drivers/net/usb/lan78xx.c-4722-
--
drivers/net/usb/lan78xx.c-4739-
drivers/net/usb/lan78xx.c:4740:	dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out);
drivers/net/usb/lan78xx.c-4741-
--
drivers/net/usb/rndis_host.c=289=generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags)
--
drivers/net/usb/rndis_host.c-336-
drivers/net/usb/rndis_host.c:337:	dev->maxpacket = usb_maxpacket(dev->udev, dev->out);
drivers/net/usb/rndis_host.c-338-	if (dev->maxpacket == 0) {
--
drivers/net/usb/usbnet.c=225=static int init_status(struct usbnet *dev, struct usb_interface *intf)
--
drivers/net/usb/usbnet.c-237-			      & USB_ENDPOINT_NUMBER_MASK);
drivers/net/usb/usbnet.c:238:	maxp = usb_maxpacket(dev->udev, pipe);
drivers/net/usb/usbnet.c-239-
--
drivers/net/usb/usbnet.c=1730=usbnet_probe(struct usb_interface *udev, const struct usb_device_id *prod)
--
drivers/net/usb/usbnet.c-1864-		dev->rx_urb_size = dev->hard_mtu;
drivers/net/usb/usbnet.c:1865:	dev->maxpacket = usb_maxpacket(dev->udev, dev->out);
drivers/net/usb/usbnet.c-1866-	if (dev->maxpacket == 0) {
--
drivers/net/wireless/mediatek/mt76/usb.c=1074=int __mt76u_init(struct mt76_dev *dev, struct usb_interface *intf,
--
drivers/net/wireless/mediatek/mt76/usb.c-1082-
drivers/net/wireless/mediatek/mt76/usb.c:1083:	usb->data_len = usb_maxpacket(udev, usb_sndctrlpipe(udev, 0));
drivers/net/wireless/mediatek/mt76/usb.c-1084-	if (usb->data_len < 32)
--
drivers/net/wireless/ralink/rt2x00/rt2500usb.c=1199=static int rt2500usb_get_tx_data_len(struct queue_entry *entry)
--
drivers/net/wireless/ralink/rt2x00/rt2500usb.c-1207-	length = roundup(entry->skb->len, 2);
drivers/net/wireless/ralink/rt2x00/rt2500usb.c:1208:	length += (2 * !(length % entry->queue->usb_maxpacket));
drivers/net/wireless/ralink/rt2x00/rt2500usb.c-1209-
--
drivers/net/wireless/ralink/rt2x00/rt2x00queue.h=413=enum data_queue_flags {
--
drivers/net/wireless/ralink/rt2x00/rt2x00queue.h-448- * @usb_endpoint: Device endpoint used for communication (USB only)
drivers/net/wireless/ralink/rt2x00/rt2x00queue.h:449: * @usb_maxpacket: Max packet size for given endpoint (USB only)
drivers/net/wireless/ralink/rt2x00/rt2x00queue.h-450- */
drivers/net/wireless/ralink/rt2x00/rt2x00queue.h=451=struct data_queue {
--
drivers/net/wireless/ralink/rt2x00/rt2x00queue.h-481-	unsigned short usb_endpoint;
drivers/net/wireless/ralink/rt2x00/rt2x00queue.h:482:	unsigned short usb_maxpacket;
drivers/net/wireless/ralink/rt2x00/rt2x00queue.h-483-};
--
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c=579=static void rt2x00usb_assign_endpoint(struct data_queue *queue,
--
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c-588-		pipe = usb_rcvbulkpipe(usb_dev, queue->usb_endpoint);
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c:589:		queue->usb_maxpacket = usb_maxpacket(usb_dev, pipe);
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c-590-	} else {
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c-591-		pipe = usb_sndbulkpipe(usb_dev, queue->usb_endpoint);
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c:592:		queue->usb_maxpacket = usb_maxpacket(usb_dev, pipe);
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c-593-	}
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c-594-
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c:595:	if (!queue->usb_maxpacket)
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c:596:		queue->usb_maxpacket = 1;
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c-597-}
--
drivers/net/wireless/ralink/rt2x00/rt73usb.c=1615=static int rt73usb_get_tx_data_len(struct queue_entry *entry)
--
drivers/net/wireless/ralink/rt2x00/rt73usb.c-1623-	length = roundup(entry->skb->len, 4);
drivers/net/wireless/ralink/rt2x00/rt73usb.c:1624:	length += (4 * !(length % entry->queue->usb_maxpacket));
drivers/net/wireless/ralink/rt2x00/rt73usb.c-1625-
--
drivers/usb/atm/usbatm.c=1008=int usbatm_usb_probe(struct usb_interface *intf, const struct usb_device_id *id,
--
drivers/usb/atm/usbatm.c-1094-	/* rx buffer size must be a positive multiple of the endpoint maxpacket */
drivers/usb/atm/usbatm.c:1095:	maxpacket = usb_maxpacket(usb_dev, instance->rx_channel.endpoint);
drivers/usb/atm/usbatm.c-1096-
--
drivers/usb/c67x00/c67x00-sched.c=645=static int c67x00_add_data_urb(struct c67x00_hcd *c67x00, struct urb *urb)
--
drivers/usb/c67x00/c67x00-sched.c-657-
drivers/usb/c67x00/c67x00-sched.c:658:	maxps = usb_maxpacket(urb->dev, urb->pipe);
drivers/usb/c67x00/c67x00-sched.c-659-
--
drivers/usb/c67x00/c67x00-sched.c=858=static inline int c67x00_end_of_data(struct c67x00_td *td)
--
drivers/usb/c67x00/c67x00-sched.c-868-
drivers/usb/c67x00/c67x00-sched.c:869:	maxps = usb_maxpacket(td_udev(td), td->pipe);
drivers/usb/c67x00/c67x00-sched.c-870-
--
drivers/usb/core/hub.c=1449=static int hub_configure(struct usb_hub *hub,
--
drivers/usb/core/hub.c-1713-	pipe = usb_rcvintpipe(hdev, endpoint->bEndpointAddress);
drivers/usb/core/hub.c:1714:	maxp = usb_maxpacket(hdev, pipe);
drivers/usb/core/hub.c-1715-
--
drivers/usb/fotg210/fotg210-hcd.c=2522=static struct list_head *qh_urb_transaction(struct fotg210_hcd *fotg210,
--
drivers/usb/fotg210/fotg210-hcd.c-2590-
drivers/usb/fotg210/fotg210-hcd.c:2591:	maxpacket = usb_maxpacket(urb->dev, urb->pipe);
drivers/usb/fotg210/fotg210-hcd.c-2592-
--
drivers/usb/host/fhci-hcd.c=385=static int fhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
--
drivers/usb/host/fhci-hcd.c-411-			 && (urb->transfer_buffer_length
drivers/usb/host/fhci-hcd.c:412:			     % usb_maxpacket(urb->dev, pipe)) != 0)
drivers/usb/host/fhci-hcd.c-413-			size++;
--
drivers/usb/host/isp116x-hcd.c=681=static int isp116x_urb_enqueue(struct usb_hcd *hcd,
--
drivers/usb/host/isp116x-hcd.c-728-		ep->epnum = epnum;
drivers/usb/host/isp116x-hcd.c:729:		ep->maxpacket = usb_maxpacket(udev, urb->pipe);
drivers/usb/host/isp116x-hcd.c-730-		usb_settoggle(udev, epnum, is_out, 0);
--
drivers/usb/host/isp116x-hcd.c-759-						     (type == PIPE_ISOCHRONOUS),
drivers/usb/host/isp116x-hcd.c:760:						     usb_maxpacket(udev, pipe)) /
drivers/usb/host/isp116x-hcd.c-761-			    1000;
--
drivers/usb/host/max3421-hcd.c=523=max3421_transfer_out(struct usb_hcd *hcd, struct urb *urb, int fast_retransmit)
--
drivers/usb/host/max3421-hcd.c-542-
drivers/usb/host/max3421-hcd.c:543:	max_packet = usb_maxpacket(urb->dev, urb->pipe);
drivers/usb/host/max3421-hcd.c-544-
--
drivers/usb/host/max3421-hcd.c=939=max3421_transfer_in_done(struct usb_hcd *hcd, struct urb *urb)
--
drivers/usb/host/max3421-hcd.c-951-	 */
drivers/usb/host/max3421-hcd.c:952:	max_packet = usb_maxpacket(urb->dev, urb->pipe);
drivers/usb/host/max3421-hcd.c-953-	if (max_packet > MAX3421_FIFO_SIZE) {
--
drivers/usb/host/max3421-hcd.c=983=max3421_transfer_out_done(struct usb_hcd *hcd, struct urb *urb)
--
drivers/usb/host/max3421-hcd.c-997-		 */
drivers/usb/host/max3421-hcd.c:998:		u32 max_packet = usb_maxpacket(urb->dev, urb->pipe);
drivers/usb/host/max3421-hcd.c-999-
--
drivers/usb/host/ohci-hcd.c=147=static int ohci_urb_enqueue (
--
drivers/usb/host/ohci-hcd.c-183-				&& (urb->transfer_buffer_length
drivers/usb/host/ohci-hcd.c:184:					% usb_maxpacket(urb->dev, pipe)) == 0)
drivers/usb/host/ohci-hcd.c-185-				size++;
--
drivers/usb/host/oxu210hp-hcd.c=1589=static struct list_head *qh_urb_transaction(struct oxu_hcd *oxu,
--
drivers/usb/host/oxu210hp-hcd.c-1663-
drivers/usb/host/oxu210hp-hcd.c:1664:	maxpacket = usb_maxpacket(urb->dev, urb->pipe);
drivers/usb/host/oxu210hp-hcd.c-1665-
--
drivers/usb/host/oxu210hp-hcd.c=1756=static struct ehci_qh *qh_make(struct oxu_hcd *oxu,
--
drivers/usb/host/oxu210hp-hcd.c-1774-	type = usb_pipetype(urb->pipe);
drivers/usb/host/oxu210hp-hcd.c:1775:	maxp = usb_maxpacket(urb->dev, urb->pipe);
drivers/usb/host/oxu210hp-hcd.c-1776-
--
drivers/usb/host/r8a66597-hcd.c=1855=static struct r8a66597_td *r8a66597_make_td(struct r8a66597 *r8a66597,
--
drivers/usb/host/r8a66597-hcd.c-1870-	td->address = get_urb_to_r8a66597_addr(r8a66597, urb);
drivers/usb/host/r8a66597-hcd.c:1871:	td->maxpacket = usb_maxpacket(urb->dev, urb->pipe);
drivers/usb/host/r8a66597-hcd.c-1872-	if (usb_pipecontrol(urb->pipe))
--
drivers/usb/host/sl811-hcd.c=793=static int sl811h_urb_enqueue(
--
drivers/usb/host/sl811-hcd.c-847-		ep->epnum = epnum;
drivers/usb/host/sl811-hcd.c:848:		ep->maxpacket = usb_maxpacket(udev, urb->pipe);
drivers/usb/host/sl811-hcd.c-849-		ep->defctrl = SL11H_HCTLMASK_ARM | SL11H_HCTLMASK_ENABLE;
--
drivers/usb/host/sl811-hcd.c-884-						     type == PIPE_ISOCHRONOUS,
drivers/usb/host/sl811-hcd.c:885:						     usb_maxpacket(udev, pipe))
drivers/usb/host/sl811-hcd.c-886-					/ 1000;
--
drivers/usb/isp1760/isp1760-hcd.c=817=static void create_ptd_atl(struct isp1760_qh *qh,
--
drivers/usb/isp1760/isp1760-hcd.c-827-	/* according to 3.6.2, max packet len can not be > 0x400 */
drivers/usb/isp1760/isp1760-hcd.c:828:	maxpacket = usb_maxpacket(qtd->urb->dev, qtd->urb->pipe);
drivers/usb/isp1760/isp1760-hcd.c-829-	multi =  1 + ((maxpacket >> 11) & 0x3);
--
drivers/usb/isp1760/isp1760-hcd.c=1770=static void packetize_urb(struct usb_hcd *hcd,
--
drivers/usb/isp1760/isp1760-hcd.c-1809-
drivers/usb/isp1760/isp1760-hcd.c:1810:	maxpacketsize = usb_maxpacket(urb->dev, urb->pipe);
drivers/usb/isp1760/isp1760-hcd.c-1811-
--
drivers/usb/misc/lvstest.c=392=static int lvs_rh_probe(struct usb_interface *intf,
--
drivers/usb/misc/lvstest.c-439-	pipe = usb_rcvintpipe(hdev, endpoint->bEndpointAddress);
drivers/usb/misc/lvstest.c:440:	maxp = usb_maxpacket(hdev, pipe);
drivers/usb/misc/lvstest.c-441-	usb_fill_int_urb(lvs->urb, hdev, pipe, &lvs->buffer[0], maxp,
--
drivers/usb/misc/usbio.c=544=static int usbio_probe(struct usb_interface *intf, const struct usb_device_id *id)
--
drivers/usb/misc/usbio.c-574-	usbio->ctrl_pipe = usb_endpoint_num(&udev->ep0.desc);
drivers/usb/misc/usbio.c:575:	usbio->ctrlbuf_len = usb_maxpacket(udev, usbio->ctrl_pipe);
drivers/usb/misc/usbio.c-576-	usbio->ctrlbuf = devm_kzalloc(dev, usbio->ctrlbuf_len, GFP_KERNEL);
--
drivers/usb/storage/onetouch.c=163=static int onetouch_connect_input(struct us_data *ss)
--
drivers/usb/storage/onetouch.c-182-	pipe = usb_rcvintpipe(udev, endpoint->bEndpointAddress);
drivers/usb/storage/onetouch.c:183:	maxp = usb_maxpacket(udev, pipe);
drivers/usb/storage/onetouch.c-184-	maxp = min(maxp, ONETOUCH_PKT_LEN);
--
drivers/usb/storage/transport.c=356=static int usb_stor_intr_transfer(struct us_data *us, void *buf,
--
drivers/usb/storage/transport.c-365-	/* calculate the max packet size */
drivers/usb/storage/transport.c:366:	maxp = usb_maxpacket(us->pusb_dev, pipe);
drivers/usb/storage/transport.c-367-	if (maxp > length)
--
include/linux/usb.h=2052=usb_pipe_endpoint(struct usb_device *dev, unsigned int pipe)
--
include/linux/usb.h-2058-
include/linux/usb.h:2059:static inline u16 usb_maxpacket(struct usb_device *udev, int pipe)
include/linux/usb.h-2060-{
--
sound/usb/line6/pcm.c=515=int line6_init_pcm(struct usb_line6 *line6,
--
sound/usb/line6/pcm.c-551-	line6pcm->max_packet_size_in =
sound/usb/line6/pcm.c:552:		usb_maxpacket(line6->usbdev,
sound/usb/line6/pcm.c-553-			usb_rcvisocpipe(line6->usbdev, ep_read));
sound/usb/line6/pcm.c-554-	line6pcm->max_packet_size_out =
sound/usb/line6/pcm.c:555:		usb_maxpacket(line6->usbdev,
sound/usb/line6/pcm.c-556-			usb_sndisocpipe(line6->usbdev, ep_write));
--
sound/usb/midi.c=1323=static int snd_usbmidi_in_endpoint_create(struct snd_usb_midi *umidi,
--
sound/usb/midi.c-1350-		pipe = usb_rcvbulkpipe(umidi->dev, ep_info->in_ep);
sound/usb/midi.c:1351:	length = usb_maxpacket(umidi->dev, pipe);
sound/usb/midi.c-1352-	for (i = 0; i < INPUT_URBS; ++i) {
--
sound/usb/midi.c=1410=static int snd_usbmidi_out_endpoint_create(struct snd_usb_midi *umidi,
--
sound/usb/midi.c-1439-	default:
sound/usb/midi.c:1440:		ep->max_transfer = usb_maxpacket(umidi->dev, pipe);
sound/usb/midi.c-1441-		break;
--
sound/usb/midi2.c=424=static int create_midi2_endpoint(struct snd_usb_midi2_interface *umidi,
--
sound/usb/midi2.c-462-	}
sound/usb/midi2.c:463:	ep->packets = usb_maxpacket(ep->dev, ep->pipe);
sound/usb/midi2.c-464-	list_add_tail(&ep->list, &umidi->ep_list);
--
sound/usb/usx2y/usb_stream.c=44=static int init_pipe_urbs(struct usb_stream_kernel *sk,
--
sound/usb/usx2y/usb_stream.c-50-	int maxpacket = use_packsize ?
sound/usb/usx2y/usb_stream.c:51:		use_packsize : usb_maxpacket(dev, pipe);
sound/usb/usx2y/usb_stream.c-52-	int transfer_length = maxpacket * sk->n_o_ps;
--
sound/usb/usx2y/usb_stream.c=152=struct usb_stream *usb_stream_new(struct usb_stream_kernel *sk,
--
sound/usb/usx2y/usb_stream.c-170-	max_packsize = use_packsize ?
sound/usb/usx2y/usb_stream.c:171:		use_packsize : usb_maxpacket(dev, in_pipe);
sound/usb/usx2y/usb_stream.c-172-
--
sound/usb/usx2y/usb_stream.c-186-
sound/usb/usx2y/usb_stream.c:187:	max_packsize = usb_maxpacket(dev, out_pipe);
sound/usb/usx2y/usb_stream.c-188-	write_size = max_packsize * packets * USB_STREAM_URBDEPTH;
--
sound/usb/usx2y/usbusx2y.c-15-	Version 0.8.7:
sound/usb/usx2y/usbusx2y.c:16:	Use macro usb_maxpacket() for portability.
sound/usb/usx2y/usbusx2y.c-17-
--
sound/usb/usx2y/usbusx2yaudio.c=395=static int usx2y_urbs_allocate(struct snd_usx2y_substream *subs)
--
sound/usb/usx2y/usbusx2yaudio.c-404-			usb_rcvisocpipe(dev, subs->endpoint);
sound/usb/usx2y/usbusx2yaudio.c:405:	subs->maxpacksize = usb_maxpacket(dev, pipe);
sound/usb/usx2y/usbusx2yaudio.c-406-	if (!subs->maxpacksize)
--
sound/usb/usx2y/usx2yhwdeppcm.c=315=static int usx2y_usbpcm_urbs_allocate(struct snd_usx2y_substream *subs)
--
sound/usb/usx2y/usx2yhwdeppcm.c-324-			usb_rcvisocpipe(dev, subs->endpoint);
sound/usb/usx2y/usx2yhwdeppcm.c:325:	subs->maxpacksize = usb_maxpacket(dev, pipe);
sound/usb/usx2y/usx2yhwdeppcm.c-326-	if (!subs->maxpacksize)
]

gemini-3.1-pro-preview

							input: 328927
							output: 62
							thoughts: 40
						

Okay, let's see...

**Deconstructing the USB Packet Assignment**

Right, so `usb_maxpacket` is being called within `rt2x00usb_assign_endpoint`. That's the key. I need to understand what's happening in `rt2x00usb_assign_endpoint` itself to grasp the context of that call. Let me check the source code for `rt2x00usb_assign_endpoint`. I need to figure out how they're determining packet sizes and assigning the endpoints, to see if there's an immediate red flag.

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c IncludeLines:true Name:rt2x00usb_assign_endpoint]

map[SourceCode: 579:	static void rt2x00usb_assign_endpoint(struct data_queue *queue,
 580:					      struct usb_endpoint_descriptor *ep_desc)
 581:	{
 582:		struct usb_device *usb_dev = to_usb_device_intf(queue->rt2x00dev->dev);
 583:		int pipe;
 584:	
 585:		queue->usb_endpoint = usb_endpoint_num(ep_desc);
 586:	
 587:		if (queue->qid == QID_RX) {
 588:			pipe = usb_rcvbulkpipe(usb_dev, queue->usb_endpoint);
 589:			queue->usb_maxpacket = usb_maxpacket(usb_dev, pipe);
 590:		} else {
 591:			pipe = usb_sndbulkpipe(usb_dev, queue->usb_endpoint);
 592:			queue->usb_maxpacket = usb_maxpacket(usb_dev, pipe);
 593:		}
 594:	
 595:		if (!queue->usb_maxpacket)
 596:			queue->usb_maxpacket = 1;
 597:	}
 SourceFile:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

gemini-3.1-pro-preview

							input: 329524
							output: 20
							thoughts: 101
						

**A Quick Code Dive & Potential Bug Hunt**

Okay, so I was looking at this `rt2x00usb_assign_endpoint` function, and I see this check: `if (!queue->usb_maxpacket) queue->usb_maxpacket = 1;`. Bingo! That immediately tells me `usb_maxpacket` should *never* be zero, because it's explicitly set to one if it's currently zero. So, that potential divide-by-zero I was initially worried about… doesn't exist here! Excellent. A quick win.

But hold on a second… I need to be thorough. Just because it's not here doesn't mean it's not lurking somewhere else in a related driver. What about the `rtl8192cu` module? That's the one I need to focus on next. I'll need to check the `rtl8192cu` code, see if a similar vulnerability exists. Time to dig in and hunt for that divide-by-zero!

log-in to see details

map[Expression:usb_maxpacket.*rtl]

map[Output:]

gemini-3.1-pro-preview

							input: 329880
							output: 18
							thoughts: 29
						

Here's my take on the thought process, summarized as you requested:

**Digging into the RTLWIFI USB Driver**

Okay, time to get my hands dirty. I need to figure out how the RTLWIFI USB driver handles packet sizes. The best place to start is `drivers/net/wireless/realtek/rtlwifi/usb.c`. I'm especially interested in how `usb_maxpacket` is handled, as that's crucial for understanding the USB transfer configuration and potential performance bottlenecks. Let's see what's in that file!

map[Expression:usb_maxpacket]

map[Output:drivers/hid/usbhid/hid-core.c=367=static int hid_submit_ctrl(struct hid_device *hid)
--
drivers/hid/usbhid/hid-core.c-390-		usbhid->urbctrl->pipe = usb_rcvctrlpipe(hid_to_usb_dev(hid), 0);
drivers/hid/usbhid/hid-core.c:391:		maxpacket = usb_maxpacket(hid_to_usb_dev(hid),
drivers/hid/usbhid/hid-core.c-392-					  usbhid->urbctrl->pipe);
--
drivers/hid/usbhid/usbkbd.c=261=static int usb_kbd_probe(struct usb_interface *iface,
--
drivers/hid/usbhid/usbkbd.c-281-	pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress);
drivers/hid/usbhid/usbkbd.c:282:	maxp = usb_maxpacket(dev, pipe);
drivers/hid/usbhid/usbkbd.c-283-
--
drivers/hid/usbhid/usbmouse.c=106=static int usb_mouse_probe(struct usb_interface *intf, const struct usb_device_id *id)
--
drivers/hid/usbhid/usbmouse.c-125-	pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress);
drivers/hid/usbhid/usbmouse.c:126:	maxp = usb_maxpacket(dev, pipe);
drivers/hid/usbhid/usbmouse.c-127-
--
drivers/input/misc/ati_remote2.c=598=static int ati_remote2_urb_init(struct ati_remote2 *ar2)
--
drivers/input/misc/ati_remote2.c-612-		pipe = usb_rcvintpipe(udev, ar2->ep[i]->bEndpointAddress);
drivers/input/misc/ati_remote2.c:613:		maxp = usb_maxpacket(udev, pipe);
drivers/input/misc/ati_remote2.c-614-		maxp = maxp > 4 ? 4 : maxp;
--
drivers/input/misc/cm109.c=677=static int cm109_usb_probe(struct usb_interface *intf,
--
drivers/input/misc/cm109.c-738-	pipe = usb_rcvintpipe(udev, endpoint->bEndpointAddress);
drivers/input/misc/cm109.c:739:	ret = usb_maxpacket(udev, pipe);
drivers/input/misc/cm109.c-740-	if (ret != USB_PKT_LEN)
--
drivers/input/misc/powermate.c=293=static int powermate_probe(struct usb_interface *intf, const struct usb_device_id *id)
--
drivers/input/misc/powermate.c-369-	pipe = usb_rcvintpipe(udev, endpoint->bEndpointAddress);
drivers/input/misc/powermate.c:370:	maxp = usb_maxpacket(udev, pipe);
drivers/input/misc/powermate.c-371-
--
drivers/input/misc/yealink.c=815=static int usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
--
drivers/input/misc/yealink.c-871-	pipe = usb_rcvintpipe(udev, endpoint->bEndpointAddress);
drivers/input/misc/yealink.c:872:	ret = usb_maxpacket(udev, pipe);
drivers/input/misc/yealink.c-873-	if (ret != USB_PKT_LEN)
--
drivers/input/tablet/acecad.c=111=static int usb_acecad_probe(struct usb_interface *intf, const struct usb_device_id *id)
--
drivers/input/tablet/acecad.c-129-	pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress);
drivers/input/tablet/acecad.c:130:	maxp = usb_maxpacket(dev, pipe);
drivers/input/tablet/acecad.c-131-
--
drivers/input/tablet/pegasus_notetaker.c=271=static int pegasus_probe(struct usb_interface *intf,
--
drivers/input/tablet/pegasus_notetaker.c-312-
drivers/input/tablet/pegasus_notetaker.c:313:	pegasus->data_len = usb_maxpacket(dev, pipe);
drivers/input/tablet/pegasus_notetaker.c-314-	if (pegasus->data_len < NOTETAKER_PACKET_SIZE) {
--
drivers/media/rc/ati_remote.c=765=static int ati_remote_initialize(struct ati_remote *ati_remote)
--
drivers/media/rc/ati_remote.c-773-	pipe = usb_rcvintpipe(udev, ati_remote->endpoint_in->bEndpointAddress);
drivers/media/rc/ati_remote.c:774:	maxp = usb_maxpacket(udev, pipe);
drivers/media/rc/ati_remote.c-775-	maxp = (maxp > DATA_BUFSIZE) ? DATA_BUFSIZE : maxp;
--
drivers/media/rc/ati_remote.c-784-	pipe = usb_sndintpipe(udev, ati_remote->endpoint_out->bEndpointAddress);
drivers/media/rc/ati_remote.c:785:	maxp = usb_maxpacket(udev, pipe);
drivers/media/rc/ati_remote.c-786-	maxp = (maxp > DATA_BUFSIZE) ? DATA_BUFSIZE : maxp;
--
drivers/media/rc/mceusb.c=1651=static int mceusb_dev_probe(struct usb_interface *intf,
--
drivers/media/rc/mceusb.c-1715-		pipe = usb_rcvbulkpipe(dev, ep_in->bEndpointAddress);
drivers/media/rc/mceusb.c:1716:	maxp = usb_maxpacket(dev, pipe);
drivers/media/rc/mceusb.c-1717-
--
drivers/media/rc/streamzap.c=276=static int streamzap_probe(struct usb_interface *intf,
--
drivers/media/rc/streamzap.c-316-	pipe = usb_rcvintpipe(usbdev, endpoint->bEndpointAddress);
drivers/media/rc/streamzap.c:317:	maxp = usb_maxpacket(usbdev, pipe);
drivers/media/rc/streamzap.c-318-
--
drivers/media/rc/xbox_remote.c=166=static void xbox_remote_initialize(struct xbox_remote *xbox_remote,
--
drivers/media/rc/xbox_remote.c-173-	pipe = usb_rcvintpipe(udev, endpoint_in->bEndpointAddress);
drivers/media/rc/xbox_remote.c:174:	maxp = usb_maxpacket(udev, pipe);
drivers/media/rc/xbox_remote.c-175-	maxp = (maxp > DATA_BUFSIZE) ? DATA_BUFSIZE : maxp;
--
drivers/net/can/usb/etas_es58x/es58x_core.c=1706=static int es58x_alloc_rx_urbs(struct es58x_device *es58x_dev)
--
drivers/net/can/usb/etas_es58x/es58x_core.c-1709-	const struct es58x_parameters *param = es58x_dev->param;
drivers/net/can/usb/etas_es58x/es58x_core.c:1710:	u16 rx_buf_len = usb_maxpacket(es58x_dev->udev, es58x_dev->rx_pipe);
drivers/net/can/usb/etas_es58x/es58x_core.c-1711-	struct urb *urb;
--
drivers/net/usb/cdc_ncm.c=405=static void cdc_ncm_update_rxtx_max(struct usbnet *dev, u32 new_rx, u32 new_tx)
--
drivers/net/usb/cdc_ncm.c-447-	if (val != le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize) &&
drivers/net/usb/cdc_ncm.c:448:	    val % usb_maxpacket(dev->udev, dev->out) == 0)
drivers/net/usb/cdc_ncm.c-449-		val++;
--
drivers/net/usb/cdc_ncm.c-471-	/* never pad more than 3 full USB packets per transfer */
drivers/net/usb/cdc_ncm.c:472:	ctx->min_tx_pkt = clamp_t(u16, ctx->tx_max - 3 * usb_maxpacket(dev->udev, dev->out),
drivers/net/usb/cdc_ncm.c-473-				  CDC_NCM_MIN_TX_PKT, ctx->tx_max);
--
drivers/net/usb/lan78xx.c=4620=static int lan78xx_probe(struct usb_interface *intf,
--
drivers/net/usb/lan78xx.c-4720-	period = ep_intr->desc.bInterval;
drivers/net/usb/lan78xx.c:4721:	maxp = usb_maxpacket(dev->udev, dev->pipe_intr);
drivers/net/usb/lan78xx.c-4722-
--
drivers/net/usb/lan78xx.c-4739-
drivers/net/usb/lan78xx.c:4740:	dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out);
drivers/net/usb/lan78xx.c-4741-
--
drivers/net/usb/rndis_host.c=289=generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags)
--
drivers/net/usb/rndis_host.c-336-
drivers/net/usb/rndis_host.c:337:	dev->maxpacket = usb_maxpacket(dev->udev, dev->out);
drivers/net/usb/rndis_host.c-338-	if (dev->maxpacket == 0) {
--
drivers/net/usb/usbnet.c=225=static int init_status(struct usbnet *dev, struct usb_interface *intf)
--
drivers/net/usb/usbnet.c-237-			      & USB_ENDPOINT_NUMBER_MASK);
drivers/net/usb/usbnet.c:238:	maxp = usb_maxpacket(dev->udev, pipe);
drivers/net/usb/usbnet.c-239-
--
drivers/net/usb/usbnet.c=1730=usbnet_probe(struct usb_interface *udev, const struct usb_device_id *prod)
--
drivers/net/usb/usbnet.c-1864-		dev->rx_urb_size = dev->hard_mtu;
drivers/net/usb/usbnet.c:1865:	dev->maxpacket = usb_maxpacket(dev->udev, dev->out);
drivers/net/usb/usbnet.c-1866-	if (dev->maxpacket == 0) {
--
drivers/net/wireless/mediatek/mt76/usb.c=1074=int __mt76u_init(struct mt76_dev *dev, struct usb_interface *intf,
--
drivers/net/wireless/mediatek/mt76/usb.c-1082-
drivers/net/wireless/mediatek/mt76/usb.c:1083:	usb->data_len = usb_maxpacket(udev, usb_sndctrlpipe(udev, 0));
drivers/net/wireless/mediatek/mt76/usb.c-1084-	if (usb->data_len < 32)
--
drivers/net/wireless/ralink/rt2x00/rt2500usb.c=1199=static int rt2500usb_get_tx_data_len(struct queue_entry *entry)
--
drivers/net/wireless/ralink/rt2x00/rt2500usb.c-1207-	length = roundup(entry->skb->len, 2);
drivers/net/wireless/ralink/rt2x00/rt2500usb.c:1208:	length += (2 * !(length % entry->queue->usb_maxpacket));
drivers/net/wireless/ralink/rt2x00/rt2500usb.c-1209-
--
drivers/net/wireless/ralink/rt2x00/rt2x00queue.h=413=enum data_queue_flags {
--
drivers/net/wireless/ralink/rt2x00/rt2x00queue.h-448- * @usb_endpoint: Device endpoint used for communication (USB only)
drivers/net/wireless/ralink/rt2x00/rt2x00queue.h:449: * @usb_maxpacket: Max packet size for given endpoint (USB only)
drivers/net/wireless/ralink/rt2x00/rt2x00queue.h-450- */
drivers/net/wireless/ralink/rt2x00/rt2x00queue.h=451=struct data_queue {
--
drivers/net/wireless/ralink/rt2x00/rt2x00queue.h-481-	unsigned short usb_endpoint;
drivers/net/wireless/ralink/rt2x00/rt2x00queue.h:482:	unsigned short usb_maxpacket;
drivers/net/wireless/ralink/rt2x00/rt2x00queue.h-483-};
--
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c=579=static void rt2x00usb_assign_endpoint(struct data_queue *queue,
--
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c-588-		pipe = usb_rcvbulkpipe(usb_dev, queue->usb_endpoint);
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c:589:		queue->usb_maxpacket = usb_maxpacket(usb_dev, pipe);
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c-590-	} else {
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c-591-		pipe = usb_sndbulkpipe(usb_dev, queue->usb_endpoint);
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c:592:		queue->usb_maxpacket = usb_maxpacket(usb_dev, pipe);
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c-593-	}
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c-594-
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c:595:	if (!queue->usb_maxpacket)
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c:596:		queue->usb_maxpacket = 1;
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c-597-}
--
drivers/net/wireless/ralink/rt2x00/rt73usb.c=1615=static int rt73usb_get_tx_data_len(struct queue_entry *entry)
--
drivers/net/wireless/ralink/rt2x00/rt73usb.c-1623-	length = roundup(entry->skb->len, 4);
drivers/net/wireless/ralink/rt2x00/rt73usb.c:1624:	length += (4 * !(length % entry->queue->usb_maxpacket));
drivers/net/wireless/ralink/rt2x00/rt73usb.c-1625-
--
drivers/usb/atm/usbatm.c=1008=int usbatm_usb_probe(struct usb_interface *intf, const struct usb_device_id *id,
--
drivers/usb/atm/usbatm.c-1094-	/* rx buffer size must be a positive multiple of the endpoint maxpacket */
drivers/usb/atm/usbatm.c:1095:	maxpacket = usb_maxpacket(usb_dev, instance->rx_channel.endpoint);
drivers/usb/atm/usbatm.c-1096-
--
drivers/usb/c67x00/c67x00-sched.c=645=static int c67x00_add_data_urb(struct c67x00_hcd *c67x00, struct urb *urb)
--
drivers/usb/c67x00/c67x00-sched.c-657-
drivers/usb/c67x00/c67x00-sched.c:658:	maxps = usb_maxpacket(urb->dev, urb->pipe);
drivers/usb/c67x00/c67x00-sched.c-659-
--
drivers/usb/c67x00/c67x00-sched.c=858=static inline int c67x00_end_of_data(struct c67x00_td *td)
--
drivers/usb/c67x00/c67x00-sched.c-868-
drivers/usb/c67x00/c67x00-sched.c:869:	maxps = usb_maxpacket(td_udev(td), td->pipe);
drivers/usb/c67x00/c67x00-sched.c-870-
--
drivers/usb/core/hub.c=1449=static int hub_configure(struct usb_hub *hub,
--
drivers/usb/core/hub.c-1713-	pipe = usb_rcvintpipe(hdev, endpoint->bEndpointAddress);
drivers/usb/core/hub.c:1714:	maxp = usb_maxpacket(hdev, pipe);
drivers/usb/core/hub.c-1715-
--
drivers/usb/fotg210/fotg210-hcd.c=2522=static struct list_head *qh_urb_transaction(struct fotg210_hcd *fotg210,
--
drivers/usb/fotg210/fotg210-hcd.c-2590-
drivers/usb/fotg210/fotg210-hcd.c:2591:	maxpacket = usb_maxpacket(urb->dev, urb->pipe);
drivers/usb/fotg210/fotg210-hcd.c-2592-
--
drivers/usb/host/fhci-hcd.c=385=static int fhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
--
drivers/usb/host/fhci-hcd.c-411-			 && (urb->transfer_buffer_length
drivers/usb/host/fhci-hcd.c:412:			     % usb_maxpacket(urb->dev, pipe)) != 0)
drivers/usb/host/fhci-hcd.c-413-			size++;
--
drivers/usb/host/isp116x-hcd.c=681=static int isp116x_urb_enqueue(struct usb_hcd *hcd,
--
drivers/usb/host/isp116x-hcd.c-728-		ep->epnum = epnum;
drivers/usb/host/isp116x-hcd.c:729:		ep->maxpacket = usb_maxpacket(udev, urb->pipe);
drivers/usb/host/isp116x-hcd.c-730-		usb_settoggle(udev, epnum, is_out, 0);
--
drivers/usb/host/isp116x-hcd.c-759-						     (type == PIPE_ISOCHRONOUS),
drivers/usb/host/isp116x-hcd.c:760:						     usb_maxpacket(udev, pipe)) /
drivers/usb/host/isp116x-hcd.c-761-			    1000;
--
drivers/usb/host/max3421-hcd.c=523=max3421_transfer_out(struct usb_hcd *hcd, struct urb *urb, int fast_retransmit)
--
drivers/usb/host/max3421-hcd.c-542-
drivers/usb/host/max3421-hcd.c:543:	max_packet = usb_maxpacket(urb->dev, urb->pipe);
drivers/usb/host/max3421-hcd.c-544-
--
drivers/usb/host/max3421-hcd.c=939=max3421_transfer_in_done(struct usb_hcd *hcd, struct urb *urb)
--
drivers/usb/host/max3421-hcd.c-951-	 */
drivers/usb/host/max3421-hcd.c:952:	max_packet = usb_maxpacket(urb->dev, urb->pipe);
drivers/usb/host/max3421-hcd.c-953-	if (max_packet > MAX3421_FIFO_SIZE) {
--
drivers/usb/host/max3421-hcd.c=983=max3421_transfer_out_done(struct usb_hcd *hcd, struct urb *urb)
--
drivers/usb/host/max3421-hcd.c-997-		 */
drivers/usb/host/max3421-hcd.c:998:		u32 max_packet = usb_maxpacket(urb->dev, urb->pipe);
drivers/usb/host/max3421-hcd.c-999-
--
drivers/usb/host/ohci-hcd.c=147=static int ohci_urb_enqueue (
--
drivers/usb/host/ohci-hcd.c-183-				&& (urb->transfer_buffer_length
drivers/usb/host/ohci-hcd.c:184:					% usb_maxpacket(urb->dev, pipe)) == 0)
drivers/usb/host/ohci-hcd.c-185-				size++;
--
drivers/usb/host/oxu210hp-hcd.c=1589=static struct list_head *qh_urb_transaction(struct oxu_hcd *oxu,
--
drivers/usb/host/oxu210hp-hcd.c-1663-
drivers/usb/host/oxu210hp-hcd.c:1664:	maxpacket = usb_maxpacket(urb->dev, urb->pipe);
drivers/usb/host/oxu210hp-hcd.c-1665-
--
drivers/usb/host/oxu210hp-hcd.c=1756=static struct ehci_qh *qh_make(struct oxu_hcd *oxu,
--
drivers/usb/host/oxu210hp-hcd.c-1774-	type = usb_pipetype(urb->pipe);
drivers/usb/host/oxu210hp-hcd.c:1775:	maxp = usb_maxpacket(urb->dev, urb->pipe);
drivers/usb/host/oxu210hp-hcd.c-1776-
--
drivers/usb/host/r8a66597-hcd.c=1855=static struct r8a66597_td *r8a66597_make_td(struct r8a66597 *r8a66597,
--
drivers/usb/host/r8a66597-hcd.c-1870-	td->address = get_urb_to_r8a66597_addr(r8a66597, urb);
drivers/usb/host/r8a66597-hcd.c:1871:	td->maxpacket = usb_maxpacket(urb->dev, urb->pipe);
drivers/usb/host/r8a66597-hcd.c-1872-	if (usb_pipecontrol(urb->pipe))
--
drivers/usb/host/sl811-hcd.c=793=static int sl811h_urb_enqueue(
--
drivers/usb/host/sl811-hcd.c-847-		ep->epnum = epnum;
drivers/usb/host/sl811-hcd.c:848:		ep->maxpacket = usb_maxpacket(udev, urb->pipe);
drivers/usb/host/sl811-hcd.c-849-		ep->defctrl = SL11H_HCTLMASK_ARM | SL11H_HCTLMASK_ENABLE;
--
drivers/usb/host/sl811-hcd.c-884-						     type == PIPE_ISOCHRONOUS,
drivers/usb/host/sl811-hcd.c:885:						     usb_maxpacket(udev, pipe))
drivers/usb/host/sl811-hcd.c-886-					/ 1000;
--
drivers/usb/isp1760/isp1760-hcd.c=817=static void create_ptd_atl(struct isp1760_qh *qh,
--
drivers/usb/isp1760/isp1760-hcd.c-827-	/* according to 3.6.2, max packet len can not be > 0x400 */
drivers/usb/isp1760/isp1760-hcd.c:828:	maxpacket = usb_maxpacket(qtd->urb->dev, qtd->urb->pipe);
drivers/usb/isp1760/isp1760-hcd.c-829-	multi =  1 + ((maxpacket >> 11) & 0x3);
--
drivers/usb/isp1760/isp1760-hcd.c=1770=static void packetize_urb(struct usb_hcd *hcd,
--
drivers/usb/isp1760/isp1760-hcd.c-1809-
drivers/usb/isp1760/isp1760-hcd.c:1810:	maxpacketsize = usb_maxpacket(urb->dev, urb->pipe);
drivers/usb/isp1760/isp1760-hcd.c-1811-
--
drivers/usb/misc/lvstest.c=392=static int lvs_rh_probe(struct usb_interface *intf,
--
drivers/usb/misc/lvstest.c-439-	pipe = usb_rcvintpipe(hdev, endpoint->bEndpointAddress);
drivers/usb/misc/lvstest.c:440:	maxp = usb_maxpacket(hdev, pipe);
drivers/usb/misc/lvstest.c-441-	usb_fill_int_urb(lvs->urb, hdev, pipe, &lvs->buffer[0], maxp,
--
drivers/usb/misc/usbio.c=544=static int usbio_probe(struct usb_interface *intf, const struct usb_device_id *id)
--
drivers/usb/misc/usbio.c-574-	usbio->ctrl_pipe = usb_endpoint_num(&udev->ep0.desc);
drivers/usb/misc/usbio.c:575:	usbio->ctrlbuf_len = usb_maxpacket(udev, usbio->ctrl_pipe);
drivers/usb/misc/usbio.c-576-	usbio->ctrlbuf = devm_kzalloc(dev, usbio->ctrlbuf_len, GFP_KERNEL);
--
drivers/usb/storage/onetouch.c=163=static int onetouch_connect_input(struct us_data *ss)
--
drivers/usb/storage/onetouch.c-182-	pipe = usb_rcvintpipe(udev, endpoint->bEndpointAddress);
drivers/usb/storage/onetouch.c:183:	maxp = usb_maxpacket(udev, pipe);
drivers/usb/storage/onetouch.c-184-	maxp = min(maxp, ONETOUCH_PKT_LEN);
--
drivers/usb/storage/transport.c=356=static int usb_stor_intr_transfer(struct us_data *us, void *buf,
--
drivers/usb/storage/transport.c-365-	/* calculate the max packet size */
drivers/usb/storage/transport.c:366:	maxp = usb_maxpacket(us->pusb_dev, pipe);
drivers/usb/storage/transport.c-367-	if (maxp > length)
--
include/linux/usb.h=2052=usb_pipe_endpoint(struct usb_device *dev, unsigned int pipe)
--
include/linux/usb.h-2058-
include/linux/usb.h:2059:static inline u16 usb_maxpacket(struct usb_device *udev, int pipe)
include/linux/usb.h-2060-{
--
sound/usb/line6/pcm.c=515=int line6_init_pcm(struct usb_line6 *line6,
--
sound/usb/line6/pcm.c-551-	line6pcm->max_packet_size_in =
sound/usb/line6/pcm.c:552:		usb_maxpacket(line6->usbdev,
sound/usb/line6/pcm.c-553-			usb_rcvisocpipe(line6->usbdev, ep_read));
sound/usb/line6/pcm.c-554-	line6pcm->max_packet_size_out =
sound/usb/line6/pcm.c:555:		usb_maxpacket(line6->usbdev,
sound/usb/line6/pcm.c-556-			usb_sndisocpipe(line6->usbdev, ep_write));
--
sound/usb/midi.c=1323=static int snd_usbmidi_in_endpoint_create(struct snd_usb_midi *umidi,
--
sound/usb/midi.c-1350-		pipe = usb_rcvbulkpipe(umidi->dev, ep_info->in_ep);
sound/usb/midi.c:1351:	length = usb_maxpacket(umidi->dev, pipe);
sound/usb/midi.c-1352-	for (i = 0; i < INPUT_URBS; ++i) {
--
sound/usb/midi.c=1410=static int snd_usbmidi_out_endpoint_create(struct snd_usb_midi *umidi,
--
sound/usb/midi.c-1439-	default:
sound/usb/midi.c:1440:		ep->max_transfer = usb_maxpacket(umidi->dev, pipe);
sound/usb/midi.c-1441-		break;
--
sound/usb/midi2.c=424=static int create_midi2_endpoint(struct snd_usb_midi2_interface *umidi,
--
sound/usb/midi2.c-462-	}
sound/usb/midi2.c:463:	ep->packets = usb_maxpacket(ep->dev, ep->pipe);
sound/usb/midi2.c-464-	list_add_tail(&ep->list, &umidi->ep_list);
--
sound/usb/usx2y/usb_stream.c=44=static int init_pipe_urbs(struct usb_stream_kernel *sk,
--
sound/usb/usx2y/usb_stream.c-50-	int maxpacket = use_packsize ?
sound/usb/usx2y/usb_stream.c:51:		use_packsize : usb_maxpacket(dev, pipe);
sound/usb/usx2y/usb_stream.c-52-	int transfer_length = maxpacket * sk->n_o_ps;
--
sound/usb/usx2y/usb_stream.c=152=struct usb_stream *usb_stream_new(struct usb_stream_kernel *sk,
--
sound/usb/usx2y/usb_stream.c-170-	max_packsize = use_packsize ?
sound/usb/usx2y/usb_stream.c:171:		use_packsize : usb_maxpacket(dev, in_pipe);
sound/usb/usx2y/usb_stream.c-172-
--
sound/usb/usx2y/usb_stream.c-186-
sound/usb/usx2y/usb_stream.c:187:	max_packsize = usb_maxpacket(dev, out_pipe);
sound/usb/usx2y/usb_stream.c-188-	write_size = max_packsize * packets * USB_STREAM_URBDEPTH;
--
sound/usb/usx2y/usbusx2y.c-15-	Version 0.8.7:
sound/usb/usx2y/usbusx2y.c:16:	Use macro usb_maxpacket() for portability.
sound/usb/usx2y/usbusx2y.c-17-
--
sound/usb/usx2y/usbusx2yaudio.c=395=static int usx2y_urbs_allocate(struct snd_usx2y_substream *subs)
--
sound/usb/usx2y/usbusx2yaudio.c-404-			usb_rcvisocpipe(dev, subs->endpoint);
sound/usb/usx2y/usbusx2yaudio.c:405:	subs->maxpacksize = usb_maxpacket(dev, pipe);
sound/usb/usx2y/usbusx2yaudio.c-406-	if (!subs->maxpacksize)
--
sound/usb/usx2y/usx2yhwdeppcm.c=315=static int usx2y_usbpcm_urbs_allocate(struct snd_usx2y_substream *subs)
--
sound/usb/usx2y/usx2yhwdeppcm.c-324-			usb_rcvisocpipe(dev, subs->endpoint);
sound/usb/usx2y/usx2yhwdeppcm.c:325:	subs->maxpacksize = usb_maxpacket(dev, pipe);
sound/usb/usx2y/usx2yhwdeppcm.c-326-	if (!subs->maxpacksize)
]

gemini-3.1-pro-preview

							input: 339082
							output: 53
							thoughts: 65
						

Here's my thought process, as if I were analyzing this code:

**Diving into the rtl8192cu USB Driver**

Okay, hold on a second...something about `rtl8192cu` is nagging at me. I'm pretty sure it doesn't actually rely on `usb_maxpacket` the way some other USB drivers do. My memory is pinging an internal flag; it feels different. Let's verify that hunch. Time to dig into the heart of the matter.

I'm heading straight for `drivers/net/wireless/realtek/rtlwifi/usb.c`. That's where the critical USB initialization routines should live. Specifically, I need to scrutinize `_rtl_usb_init_tx` and `_rtl_usb_init_rx`. Those functions are where the driver sets up the transmit and receive paths, and if there's any usage (or lack thereof) of `usb_maxpacket`, it'll be right there in the details. I expect to find the configuration methods in these functions. Gotta see what's really happening under the hood. Time to get my hands dirty.

map[ContextFile:drivers/net/wireless/realtek/rtlwifi/usb.c IncludeLines:true Name:_rtl_usb_init_tx]

map[SourceCode: 171:	static int _rtl_usb_init_tx(struct ieee80211_hw *hw)
 172:	{
 173:		u32 i;
 174:		struct rtl_priv *rtlpriv = rtl_priv(hw);
 175:		struct rtl_usb *rtlusb = rtl_usbdev(rtl_usbpriv(hw));
 176:	
 177:		rtlusb->max_bulk_out_size = IS_HIGH_SPEED_USB(rtlusb->udev)
 178:							    ? USB_HIGH_SPEED_BULK_SIZE
 179:							    : USB_FULL_SPEED_BULK_SIZE;
 180:	
 181:		rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "USB Max Bulk-out Size=%d\n",
 182:			rtlusb->max_bulk_out_size);
 183:	
 184:		for (i = 0; i < __RTL_TXQ_NUM; i++) {
 185:			u32 ep_num = rtlusb->ep_map.ep_mapping[i];
 186:	
 187:			if (!ep_num) {
 188:				rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
 189:					"Invalid endpoint map setting!\n");
 190:				return -EINVAL;
 191:			}
 192:		}
 193:	
 194:		rtlusb->usb_tx_post_hdl =
 195:			 rtlpriv->cfg->usb_interface_cfg->usb_tx_post_hdl;
 196:		rtlusb->usb_tx_cleanup	=
 197:			 rtlpriv->cfg->usb_interface_cfg->usb_tx_cleanup;
 198:		rtlusb->usb_tx_aggregate_hdl =
 199:			 (rtlpriv->cfg->usb_interface_cfg->usb_tx_aggregate_hdl)
 200:			 ? rtlpriv->cfg->usb_interface_cfg->usb_tx_aggregate_hdl
 201:			 : &_none_usb_tx_aggregate_hdl;
 202:	
 203:		init_usb_anchor(&rtlusb->tx_submitted);
 204:		for (i = 0; i < RTL_USB_MAX_EP_NUM; i++) {
 205:			skb_queue_head_init(&rtlusb->tx_skb_queue[i]);
 206:			init_usb_anchor(&rtlusb->tx_pending[i]);
 207:		}
 208:		return 0;
 209:	}
 SourceFile:drivers/net/wireless/realtek/rtlwifi/usb.c]

gemini-3.1-pro-preview

							input: 340205
							output: 53
							thoughts: 15
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Debugging USB Initialization**

Okay, I'm going through this initialization flow, and I'm tracking the high-level calls, but something's nagging at me. We're setting up the device, enabling interrupts, configuring endpoints, and so on. But hang on... shouldn't we be looking more closely at how the receive path is being established? I'm missing something if I don't give special consideration to the receive initialization. That function `_rtl_usb_init_rx`... I'm pretty sure that's the crucial function to dig into. We need to confirm that its been correctly set up so we get the data. I'm going to set a breakpoint in there and see what's happening. I need to make sure the receive buffers and descriptors are properly allocated and linked. We can't skip over the receive initialization. It's too important. I should probably review the data sheet on the USB controller to make sure it's behaving how I expect.

map[ContextFile:drivers/net/wireless/realtek/rtlwifi/usb.c IncludeLines:true Name:_rtl_usb_init_rx]

map[SourceCode: 213:	static int _rtl_usb_init_rx(struct ieee80211_hw *hw)
 214:	{
 215:		struct rtl_priv *rtlpriv = rtl_priv(hw);
 216:		struct rtl_usb_priv *usb_priv = rtl_usbpriv(hw);
 217:		struct rtl_usb *rtlusb = rtl_usbdev(usb_priv);
 218:	
 219:		rtlusb->rx_max_size = rtlpriv->cfg->usb_interface_cfg->rx_max_size;
 220:		rtlusb->rx_urb_num = rtlpriv->cfg->usb_interface_cfg->rx_urb_num;
 221:		rtlusb->usb_rx_hdl = rtlpriv->cfg->usb_interface_cfg->usb_rx_hdl;
 222:		rtlusb->usb_rx_segregate_hdl =
 223:			rtlpriv->cfg->usb_interface_cfg->usb_rx_segregate_hdl;
 224:	
 225:		pr_info("rx_max_size %d, rx_urb_num %d, in_ep %d\n",
 226:			rtlusb->rx_max_size, rtlusb->rx_urb_num, rtlusb->in_ep);
 227:		init_usb_anchor(&rtlusb->rx_submitted);
 228:		init_usb_anchor(&rtlusb->rx_cleanup_urbs);
 229:	
 230:		skb_queue_head_init(&rtlusb->rx_queue);
 231:		tasklet_setup(&rtlusb->rx_work_tasklet, _rtl_rx_work);
 232:	
 233:		return 0;
 234:	}
 SourceFile:drivers/net/wireless/realtek/rtlwifi/usb.c]

gemini-3.1-pro-preview

							input: 341016
							output: 45
							thoughts: 1467
						

**Analyzing Potential USB Driver Crashes**

Okay, let's break this down. My initial thought was that the crash I'm seeing is related to either `rt2500usb` or `rtl8192cu`. My first check was for USB URB submission during the probe. I know that `rtl_usb_probe` sequence, from `rtl_usb_probe` down through the initialization steps of `_rtl_usb_init`, `_rtl_usb_init_tx`, `_rtl_usb_init_rx`, then `rtl_usb_init_sw(hw)`, `rtl_init_core(hw)`, and finally, registration with `ieee80211_register_hw(hw)`. But, I'm noting that `rtl_usb_probe` doesn't submit URBs, and URBs are only submitted when the interface comes up. So, that means it's unlikely the `rtl8192cu` is crashing during probe.

The next thought, then, is to consider if the crash is NOT in the specific driver, but within the USB core itself. I needed to meticulously review the C code, starting with the initial calls to the USB functions.

My analysis started by dissecting the first sequence of `syz_usb_connect` calls. I identified that the first call connects a device with `idVendor=0x0db0` and `idProduct=0x6869`. The configuration descriptor shows one interface, but the interface descriptor is missing, leading to `bNumInterfaces=0`. Therefore, `usb_set_configuration` creates zero interfaces. Then the first device is safely disconnected. This sequence appears correct.

Next, I looked at this code:
```c
	res = syz_usb_connect(/*speed=*/0, /*dev_len=*/0x24, /*dev=*/0x200000000b40, /*conn_descs=*/0x200000001000);
	if (res != -1)
		r[1] = res;
	syz_usb_control_io(/*fd=*/r[1], /*descs=*/0, /*resps=*/0x200000000540);
	syz_usb_disconnect(/*fd=*/-1);
```

I noticed the device at `0x200000000b40` is all zeros, with `idVendor=0`, `idProduct=0`, and the configuration descriptor is also all zeros. `usb_parse_configuration` rejects this, and the device isn't configured. `syz_usb_control_io` waits for a control request; the host might send `GET_DESCRIPTOR` or `SET_CONFIGURATION`. `syz_usb_control_io` responds to it. However, the critical part is that `syz_usb_disconnect(-1)` does nothing, so the file descriptor `r[1]` is not closed. This is a potential issue.

Following that, the code connects a device with `idVendor=0x0bda`, `idProduct=0x5088`. Again, the configuration shows one interface with `bNumInterfaces=0`. After it connects, `syz_usb_control_io` is called for the already open file descriptor `r[1]`, which corresponds to the all-zeros device. I note that this persists and might be significant.

Finally, the code attempts to connect two more devices and then write to a USB endpoint, but these attempts return errors.

My immediate question became: is there something else at play? Could the second device, at `0x200000000b40`, have overlapped with something else, and could it have been initialized? It is at offset `0xb40`. The first device is at `0x100`, the third at `0x000`. Responses are located at `0x540`, `0x1c0`, `0xec0`, and `0xa00`. So, the memory at `0xb40` seems uninitialized at first glance!

But, what if the C code is a draft, and the actual reproducer DID initialize `0xb40`? Then what could it be? The responses at `0xec0` contain something related to `asix_AX_CMD_READ_MII_REG`. This strongly suggests that the device at `0xb40` was likely an `asix` device. I should check the `asix` driver. If it's an `asix` device, `as

log-in to see details

map[ContextFile:drivers/net/usb/asix_devices.c IncludeLines:true Name:asix_probe]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 343574
							output: 45
							thoughts: 37
						

Okay, let's see. My first instinct, given the context, is to delve into the driver code itself. Specifically, I'm thinking about the potential for device handling related to USB network devices. So, I need to check out `drivers/net/usb/asix.c` - that seems like a likely candidate given the naming. I have a hunch it might be relevant, and I want to confirm that suspicion.

But, before I go too deep, let me consider how this specific driver is connected to the wider USB networking infrastructure. I remember `usbnet_probe` being a key function in this area. Perhaps `asix_driver` directly calls `usbnet_probe` for its setup? That seems like a logical implementation approach. If so, `usbnet_probe` would be a good place to start investigating the generic network device setup procedures for a USB device. If not, then `asix_driver` will need to be the focus.

map[ContextFile:drivers/net/usb/asix_devices.c IncludeLines:true Name:asix_driver]

map[SourceCode:1613:	static struct usb_driver asix_driver = {
1614:		.name =		DRIVER_NAME,
1615:		.id_table =	products,
1616:		.probe =	usbnet_probe,
1617:		.suspend =	asix_suspend,
1618:		.resume =	asix_resume,
1619:		.reset_resume =	asix_resume,
1620:		.disconnect =	usbnet_disconnect,
1621:		/* usbnet enables autosuspend by default (supports_autosuspend=1).
1622:		 * We keep runtime-PM active for AX88772* by taking a PM usage
1623:		 * reference in ax88772_bind() (pm_runtime_get_noresume()) and
1624:		 * dropping it in unbind(), which effectively blocks autosuspend.
1625:		 */
1626:		.supports_autosuspend = 1,
1627:		.disable_hub_initiated_lpm = 1,
1628:	};
 SourceFile:drivers/net/usb/asix_devices.c]

gemini-3.1-pro-preview

							input: 344182
							output: 49
							thoughts: 65
						

**Delving into the USB Ethernet Driver Probe**

Okay, so `usbnet_probe` is where it all begins. It calls the driver's `bind` function, that makes sense. Now I need to understand what's happening specifically for `asix` based devices. Right, the `bind` function for `asix` is going to be something like `ax8817x_bind`, or `ax88772_bind`, those are the ones I’m expecting. I should probably focus on `ax8817x_bind` first, that's where I should start digging. Let's see what's in there.

log-in to see details

map[ContextFile:drivers/net/usb/asix_devices.c IncludeLines:true Name:ax8817x_bind]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 344461
							output: 49
							thoughts: 14
						

Okay, here's my attempt at summarizing that thought process, tailored for an expert audience, and written in the first person:

**Investigating the `ax88772_bind` Function**

Alright, time to dive in. My immediate thought is, "Let's check `ax88772_bind`." It's the standard entry point for handling this driver, so it’s the logical place to start tracing what's happening. I need to refresh my mental map of how the module initialization and device probe sequence play out for this particular USB ethernet controller. Focusing on `ax88772_bind` should give me the foundation. I'm looking for the setup and initialization calls here - the resource allocation, the registration of the device, anything that might be failing or misconfigured. This is where the magic (or the failure) begins. Time to dig in and see what's what.

map[ContextFile:drivers/net/usb/asix_devices.c IncludeLines:true Name:ax88772_bind]

map[SourceCode: 829:	static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf)
 830:	{
 831:		struct asix_common_private *priv;
 832:		u8 buf[ETH_ALEN] = {0};
 833:		int ret, i;
 834:	
 835:		priv = devm_kzalloc(&dev->udev->dev, sizeof(*priv), GFP_KERNEL);
 836:		if (!priv)
 837:			return -ENOMEM;
 838:	
 839:		dev->driver_priv = priv;
 840:	
 841:		ret = usbnet_get_endpoints(dev, intf);
 842:		if (ret)
 843:			return ret;
 844:	
 845:		/* Maybe the boot loader passed the MAC address via device tree */
 846:		if (!eth_platform_get_mac_address(&dev->udev->dev, buf)) {
 847:			netif_dbg(dev, ifup, dev->net,
 848:				  "MAC address read from device tree");
 849:		} else {
 850:			/* Try getting the MAC address from EEPROM */
 851:			if (dev->driver_info->data & FLAG_EEPROM_MAC) {
 852:				for (i = 0; i < (ETH_ALEN >> 1); i++) {
 853:					ret = asix_read_cmd(dev, AX_CMD_READ_EEPROM,
 854:							    0x04 + i, 0, 2, buf + i * 2,
 855:							    0);
 856:					if (ret < 0)
 857:						break;
 858:				}
 859:			} else {
 860:				ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID,
 861:						    0, 0, ETH_ALEN, buf, 0);
 862:			}
 863:	
 864:			if (ret < 0) {
 865:				netdev_dbg(dev->net, "Failed to read MAC address: %d\n",
 866:					   ret);
 867:				return ret;
 868:			}
 869:		}
 870:	
 871:		asix_set_netdev_dev_addr(dev, buf);
 872:	
 873:		dev->net->netdev_ops = &ax88772_netdev_ops;
 874:		dev->net->ethtool_ops = &ax88772_ethtool_ops;
 875:		dev->net->needed_headroom = 4; /* cf asix_tx_fixup() */
 876:		dev->net->needed_tailroom = 4; /* cf asix_tx_fixup() */
 877:	
 878:		ret = asix_read_phy_addr(dev, true);
 879:		if (ret < 0)
 880:			return ret;
 881:	
 882:		priv->phy_addr = ret;
 883:		priv->embd_phy = ((priv->phy_addr & 0x1f) == AX_EMBD_PHY_ADDR);
 884:	
 885:		ret = asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG, 0, 0, 1,
 886:				    &priv->chipcode, 0);
 887:		if (ret < 0) {
 888:			netdev_dbg(dev->net, "Failed to read STATMNGSTS_REG: %d\n", ret);
 889:			return ret;
 890:		}
 891:	
 892:		priv->chipcode &= AX_CHIPCODE_MASK;
 893:	
 894:		priv->resume = ax88772_resume;
 895:		priv->suspend = ax88772_suspend;
 896:		if (priv->chipcode == AX_AX88772_CHIPCODE)
 897:			priv->reset = ax88772_hw_reset;
 898:		else
 899:			priv->reset = ax88772a_hw_reset;
 900:	
 901:		ret = priv->reset(dev, 0);
 902:		if (ret < 0) {
 903:			netdev_dbg(dev->net, "Failed to reset AX88772: %d\n", ret);
 904:			return ret;
 905:		}
 906:	
 907:		/* Asix framing packs multiple eth frames into a 2K usb bulk transfer */
 908:		if (dev->driver_info->flags & FLAG_FRAMING_AX) {
 909:			/* hard_mtu  is still the default - the device does not support
 910:			   jumbo eth frames */
 911:			dev->rx_urb_size = 2048;
 912:		}
 913:	
 914:		priv->presvd_phy_bmcr = 0;
 915:		priv->presvd_phy_advertise = 0;
 916:	
 917:		ret = ax88772_init_mdio(dev);
 918:		if (ret)
 919:			goto mdio_err;
 920:	
 921:		ret = ax88772_phylink_setup(dev);
 922:		if (ret)
 923:			goto phylink_err;
 924:	
 925:		ret = ax88772_init_phy(dev);
 926:		if (ret)
 927:			goto initphy_err;
 928:	
 929:		/* Keep this interface runtime-PM active by taking a usage ref.
 930:		 * Prevents runtime suspend while bound and avoids resume paths
 931:		 * that could deadlock (autoresume under RTNL while USB PM lock
 932:		 * is held, phylink/MDIO wants RTNL).
 933:		 */
 934:		pm_runtime_get_noresume(&intf->dev);
 935:	
 936:		return 0;
 937:	
 938:	initphy_err:
 939:		phylink_destroy(priv->phylink);
 940:	phylink_err:
 941:		ax88772_mdio_unregister(priv);
 942:	mdio_err:
 943:		return ret;
 944:	}
 SourceFile:drivers/net/usb/asix_devices.c]

gemini-3.1-pro-preview

							input: 346607
							output: 45
							thoughts: 40
						

Here's my thought process, as requested:

**Endpoint Discovery Conundrum**

Wait a minute! I'm seeing that the `ax88772_bind` function is calling `usbnet_get_endpoints(dev, intf)`. That's the key to figuring out the endpoint configuration. My first move will be to dive into `usbnet_get_endpoints` to understand exactly what's happening there. I need to know how it's identifying and retrieving those critical endpoints. This is likely where the logic resides for properly configuring the device. Gotta figure this out!

map[ContextFile:drivers/net/usb/usbnet.c IncludeLines:true Name:usbnet_get_endpoints]

map[SourceCode:  89:	/* handles CDC Ethernet and many other network "bulk data" interfaces */
  90:	int usbnet_get_endpoints(struct usbnet *dev, struct usb_interface *intf)
  91:	{
  92:		int				tmp;
  93:		struct usb_host_interface	*alt = NULL;
  94:		struct usb_host_endpoint	*in = NULL, *out = NULL;
  95:		struct usb_host_endpoint	*status = NULL;
  96:	
  97:		for (tmp = 0; tmp < intf->num_altsetting; tmp++) {
  98:			unsigned	ep;
  99:	
 100:			in = out = status = NULL;
 101:			alt = intf->altsetting + tmp;
 102:	
 103:			/* take the first altsetting with in-bulk + out-bulk;
 104:			 * remember any status endpoint, just in case;
 105:			 * ignore other endpoints and altsettings.
 106:			 */
 107:			for (ep = 0; ep < alt->desc.bNumEndpoints; ep++) {
 108:				struct usb_host_endpoint	*e;
 109:				int				intr = 0;
 110:	
 111:				e = alt->endpoint + ep;
 112:	
 113:				/* ignore endpoints which cannot transfer data */
 114:				if (!usb_endpoint_maxp(&e->desc))
 115:					continue;
 116:	
 117:				switch (e->desc.bmAttributes) {
 118:				case USB_ENDPOINT_XFER_INT:
 119:					if (!usb_endpoint_dir_in(&e->desc))
 120:						continue;
 121:					intr = 1;
 122:					fallthrough;
 123:				case USB_ENDPOINT_XFER_BULK:
 124:					break;
 125:				default:
 126:					continue;
 127:				}
 128:				if (usb_endpoint_dir_in(&e->desc)) {
 129:					if (!intr && !in)
 130:						in = e;
 131:					else if (intr && !status)
 132:						status = e;
 133:				} else {
 134:					if (!out)
 135:						out = e;
 136:				}
 137:			}
 138:			if (in && out)
 139:				break;
 140:		}
 141:		if (!alt || !in || !out)
 142:			return -EINVAL;
 143:	
 144:		if (alt->desc.bAlternateSetting != 0 ||
 145:		    !(dev->driver_info->flags & FLAG_NO_SETINT)) {
 146:			tmp = usb_set_interface(dev->udev, alt->desc.bInterfaceNumber,
 147:						alt->desc.bAlternateSetting);
 148:			if (tmp < 0)
 149:				return tmp;
 150:		}
 151:	
 152:		dev->in = usb_rcvbulkpipe(dev->udev,
 153:					  in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
 154:		dev->out = usb_sndbulkpipe(dev->udev,
 155:					   out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
 156:		dev->status = status;
 157:		return 0;
 158:	}
 SourceFile:drivers/net/usb/usbnet.c]

gemini-3.1-pro-preview

							input: 347838
							output: 43
							thoughts: 148
						

**Debugging a USB Network Driver Failure**

Okay, so I'm tracking down this driver failure, and it looks like `usbnet_get_endpoints` is the culprit. It's returning `-EINVAL`, which is usually a bad sign. I see that this happens when the `in` and `out` endpoints are null. Digging deeper, it seems that if the device descriptor (`dev`) is all zeros, the `bNumEndpoints` field is also zero. This directly leads to `usbnet_get_endpoints` returning `-EINVAL` because it can't find valid endpoints. Consequently, `ax88772_bind` then also fails, leading to a failure in `usbnet_probe`. The end result is that the driver isn't bound to the device.

But, hold on... could the crash *actually* be *within* `usbnet_probe` itself? I can't jump to conclusions. I need to make sure my logic is sound. I need to take a step back and examine `usbnet_probe` itself for any potential issues. Let's start there.

map[ContextFile:drivers/net/usb/usbnet.c IncludeLines:true Name:usbnet_probe]

map[SourceCode:1729:	int
1730:	usbnet_probe(struct usb_interface *udev, const struct usb_device_id *prod)
1731:	{
1732:		struct usbnet			*dev;
1733:		struct net_device		*net;
1734:		struct usb_host_interface	*interface;
1735:		const struct driver_info	*info;
1736:		struct usb_device		*xdev;
1737:		int				status;
1738:		const char			*name;
1739:		struct usb_driver 	*driver = to_usb_driver(udev->dev.driver);
1740:	
1741:		/* usbnet already took usb runtime pm, so have to enable the feature
1742:		 * for usb interface, otherwise usb_autopm_get_interface may return
1743:		 * failure if RUNTIME_PM is enabled.
1744:		 */
1745:		if (!driver->supports_autosuspend) {
1746:			driver->supports_autosuspend = 1;
1747:			pm_runtime_enable(&udev->dev);
1748:		}
1749:	
1750:		name = udev->dev.driver->name;
1751:		info = (const struct driver_info *) prod->driver_info;
1752:		if (!info) {
1753:			dev_dbg (&udev->dev, "blacklisted by %s\n", name);
1754:			return -ENODEV;
1755:		}
1756:		xdev = interface_to_usbdev(udev);
1757:		interface = udev->cur_altsetting;
1758:	
1759:		status = -ENOMEM;
1760:	
1761:		// set up our own records
1762:		net = alloc_etherdev(sizeof(*dev));
1763:		if (!net)
1764:			goto out;
1765:	
1766:		/* netdev_printk() needs this so do it as early as possible */
1767:		SET_NETDEV_DEV(net, &udev->dev);
1768:	
1769:		dev = netdev_priv(net);
1770:		dev->udev = xdev;
1771:		dev->intf = udev;
1772:		dev->driver_info = info;
1773:		dev->driver_name = name;
1774:		dev->rx_speed = SPEED_UNSET;
1775:		dev->tx_speed = SPEED_UNSET;
1776:	
1777:		dev->msg_enable = netif_msg_init (msg_level, NETIF_MSG_DRV
1778:					| NETIF_MSG_PROBE | NETIF_MSG_LINK);
1779:		init_waitqueue_head(&dev->wait);
1780:		skb_queue_head_init (&dev->rxq);
1781:		skb_queue_head_init (&dev->txq);
1782:		skb_queue_head_init (&dev->done);
1783:		skb_queue_head_init(&dev->rxq_pause);
1784:		spin_lock_init(&dev->bql_spinlock);
1785:		INIT_WORK(&dev->bh_work, usbnet_bh_work);
1786:		INIT_WORK(&dev->kevent, usbnet_deferred_kevent);
1787:		init_usb_anchor(&dev->deferred);
1788:		timer_setup(&dev->delay, usbnet_bh, 0);
1789:		mutex_init(&dev->phy_mutex);
1790:		mutex_init(&dev->interrupt_mutex);
1791:		dev->interrupt_count = 0;
1792:	
1793:		dev->net = net;
1794:		strscpy(net->name, "usb%d", sizeof(net->name));
1795:	
1796:		/* rx and tx sides can use different message sizes;
1797:		 * bind() should set rx_urb_size in that case.
1798:		 */
1799:		dev->hard_mtu = net->mtu + net->hard_header_len;
1800:		net->min_mtu = 0;
1801:		net->max_mtu = ETH_MAX_MTU;
1802:	
1803:		net->netdev_ops = &usbnet_netdev_ops;
1804:		net->watchdog_timeo = TX_TIMEOUT_JIFFIES;
1805:		net->ethtool_ops = &usbnet_ethtool_ops;
1806:		net->pcpu_stat_type = NETDEV_PCPU_STAT_TSTATS;
1807:	
1808:		// allow device-specific bind/init procedures
1809:		// NOTE net->name still not usable ...
1810:		if (info->bind) {
1811:			status = info->bind(dev, udev);
1812:			if (status < 0)
1813:				goto out1;
1814:	
1815:			/* heuristic: rename to "eth%d" if we are not sure this link
1816:			 * is two-host (these links keep "usb%d")
1817:			 */
1818:			if ((dev->driver_info->flags & FLAG_ETHER) != 0 &&
1819:			    !usbnet_needs_usb_name_format(dev, net))
1820:				strscpy(net->name, "eth%d", sizeof(net->name));
1821:			/* WLAN devices should always be named "wlan%d" */
1822:			if ((dev->driver_info->flags & FLAG_WLAN) != 0)
1823:				strscpy(net->name, "wlan%d", sizeof(net->name));
1824:			/* WWAN devices should always be named "wwan%d" */
1825:			if ((dev->driver_info->flags & FLAG_WWAN) != 0)
1826:				strscpy(net->name, "wwan%d", sizeof(net->name));
1827:	
1828:			/* devices that cannot do ARP */
1829:			if ((dev->driver_info->flags & FLAG_NOARP) != 0)
1830:				net->flags |= IFF_NOARP;
1831:	
1832:			if ((dev->driver_info->flags & FLAG_NOMAXMTU) == 0 &&
1833:			    net->max_mtu > (dev->hard_mtu - net->hard_header_len))
1834:				net->max_mtu = dev->hard_mtu - net->hard_header_len;
1835:	
1836:			if (net->mtu > (dev->hard_mtu - net->hard_header_len))
1837:				net->mtu = dev->hard_mtu - net->hard_header_len;
1838:	
1839:		} else if (!info->in || !info->out)
1840:			status = usbnet_get_endpoints(dev, udev);
1841:		else {
1842:			u8 ep_addrs[3] = {
1843:				info->in + USB_DIR_IN, info->out + USB_DIR_OUT, 0
1844:			};
1845:	
1846:			dev->in = usb_rcvbulkpipe(xdev, info->in);
1847:			dev->out = usb_sndbulkpipe(xdev, info->out);
1848:			if (!(info->flags & FLAG_NO_SETINT))
1849:				status = usb_set_interface(xdev,
1850:							   interface->desc.bInterfaceNumber,
1851:							   interface->desc.bAlternateSetting);
1852:			else
1853:				status = 0;
1854:	
1855:			if (status == 0 && !usb_check_bulk_endpoints(udev, ep_addrs))
1856:				status = -EINVAL;
1857:		}
1858:		if (status >= 0 && dev->status)
1859:			status = init_status(dev, udev);
1860:		if (status < 0)
1861:			goto out3;
1862:	
1863:		if (!dev->rx_urb_size)
1864:			dev->rx_urb_size = dev->hard_mtu;
1865:		dev->maxpacket = usb_maxpacket(dev->udev, dev->out);
1866:		if (dev->maxpacket == 0) {
1867:			/* that is a broken device */
1868:			status = -ENODEV;
1869:			goto out4;
1870:		}
1871:	
1872:		/* this flags the device for user space */
1873:		if (!is_valid_ether_addr(net->dev_addr))
1874:			eth_hw_addr_random(net);
1875:	
1876:		if ((dev->driver_info->flags & FLAG_WLAN) != 0)
1877:			SET_NETDEV_DEVTYPE(net, &wlan_type);
1878:		if ((dev->driver_info->flags & FLAG_WWAN) != 0)
1879:			SET_NETDEV_DEVTYPE(net, &wwan_type);
1880:	
1881:		/* initialize max rx_qlen and tx_qlen */
1882:		usbnet_update_max_qlen(dev);
1883:	
1884:		if (dev->can_dma_sg && !(info->flags & FLAG_SEND_ZLP) &&
1885:			!(info->flags & FLAG_MULTI_PACKET)) {
1886:			dev->padding_pkt = kzalloc(1, GFP_KERNEL);
1887:			if (!dev->padding_pkt) {
1888:				status = -ENOMEM;
1889:				goto out4;
1890:			}
1891:		}
1892:	
1893:		status = register_netdev(net);
1894:		if (status)
1895:			goto out5;
1896:		netif_info(dev, probe, dev->net,
1897:			   "register '%s' at usb-%s-%s, %s, %pM\n",
1898:			   udev->dev.driver->name,
1899:			   xdev->bus->bus_name, xdev->devpath,
1900:			   dev->driver_info->description,
1901:			   net->dev_addr);
1902:	
1903:		// ok, it's ready to go.
1904:		usb_set_intfdata(udev, dev);
1905:	
1906:		netif_device_attach(net);
1907:	
1908:		if (dev->driver_info->flags & FLAG_LINK_INTR)
1909:			usbnet_link_change(dev, 0, 0);
1910:	
1911:		return 0;
1912:	
1913:	out5:
1914:		kfree(dev->padding_pkt);
1915:	out4:
1916:		usb_free_urb(dev->interrupt);
1917:	out3:
1918:		if (info->unbind)
1919:			info->unbind(dev, udev);
1920:	out1:
1921:		/* subdrivers must undo all they did in bind() if they
1922:		 * fail it, but we may fail later and a deferred kevent
1923:		 * may trigger an error resubmitting itself and, worse,
1924:		 * schedule a timer. So we kill it all just in case.
1925:		 */
1926:		usbnet_mark_going_away(dev);
1927:		cancel_work_sync(&dev->kevent);
1928:		timer_delete_sync(&dev->delay);
1929:		free_netdev(net);
1930:	out:
1931:		return status;
1932:	}
 SourceFile:drivers/net/usb/usbnet.c]

gemini-3.1-pro-preview

							input: 351654
							output: 31
							thoughts: 2756
						

**Analyzing Potential Crash Points in USB Driver**

Okay, let's break this down. First, regarding `usbnet_probe` and `usb_maxpacket`, the code handles the case where `maxpacket` might be zero, so that's likely not the immediate issue. I need to keep looking.

I was thinking about a possible crash in `ax88772_bind`. It appears the code sends a control message via `asix_read_cmd`, potentially responding with a short packet. The current assumption is `syz_usb_control_io` could respond incorrectly. The important thing is that `asix_read_cmd` should be `0xc0` (in), but the response type in the test cases is `0x40` (out). The `lookup_control_response` checks would fail and stall the endpoint. This could cause `asix_read_cmd` to fail, which then fails `ax88772_bind`, possibly the source of the crash. I'll need to remember to look at the differences of the request and response here.

Now, let's get back to the rt2500usb issue. I considered the expert's second candidate, a NULL pointer dereference in `rt2x00usb_disconnect` due to `usb_reset_device`. I initially figured `usb_reset_device` would NOT trigger a synchronous disconnect, but now I'm making sure. I looked at the code for `usb_reset_device` and found `hub_port_logical_disconnect` which is asynchronous and uses `hub_wq`. However, `usb_reset_device` then calls `usb_unbind_and_rebind_marked_interfaces`. This is interesting; I noticed that the call depends on `ret == 0` (reset success). Inside `usb_unbind_and_rebind_marked_interfaces`, `usb_forced_unbind_intf` is called if `intf->needs_binding` is set. When does `intf->needs_binding` get set? Looking at the code, it looks like it depends on `cintf->condition`. During `probe`, `cintf->condition` is `USB_INTERFACE_BINDING`, not `USB_INTERFACE_BOUND`. Thus, `rebind` is not set to 1, and `cintf->needs_binding` remains zero. So, that path won't unbind the interface.

Okay, let's explore if `rt2x00usb_probe` failing and `disconnect` getting called. I already confirmed the `disconnect` is NOT called if `probe` fails. What if the probe succeeds? If it does, `intfdata` is valid, and then `disconnect` is called later. The code then frees things. The question is a use-after-free or double free. If `probe` succeeds, `hw` is valid. So now, what if `rt2x00usb_probe` calls `usb_reset_device` and the reset fails? The function ignores the `-ENODEV` return and continues. It then allocates `hw`, sets `intfdata`, and then calls `rt2x00lib_probe_dev`. If `rt2x00lib_probe_dev` fails, everything is freed, and `intfdata` is set to NULL, and then `probe` returns with an error. Since it failed, disconnect won't get called. However, if `rt2x00lib_probe_dev` succeeds, `probe` returns 0. Then `hub_wq` detects the disconnect flag and unbinds the driver. Then `disconnect` will be called, but the `intfdata` is valid. So, there is no NULL pointer dereference!

What if `usb_reset_device` triggers a disconnect asynchronously? The `hub_wq` would unbind, but `probe` is still running. However, `probe` has the device lock, so `hub_wq` must wait for `probe` to finish.

Okay, so is there a case where `hw` is NULL in `rt2x00usb_disconnect`? I found that if `probe` fails in the error paths, `intfdata` is set to NULL, but `disconnect` is not called, so that's not the problem.

What if the device is disconnected DURING `probe`? If it fails, the `disconnect` function is not called. If `probe` succeeds despite the disconnection, `disconnect` WILL be called later, and the `intfdata` is valid.

I am suspecting a particular path: `rt2x00usb_probe` is called and calls `usb_reset_device`. `usb_reset_device` calls `

log-in to see details

map[CodeRegexp:queue->usb_maxpacket = 1 Count:10]

map[Output:]

gemini-3.1-pro-preview

							input: 355501
							output: 60
							thoughts: 29
						

Here's my take on the thought process, as if it were my own:

**Diving into the rt2x00usb.c Driver**

Okay, time to get to the heart of the matter. I'm going to dig into `drivers/net/wireless/ralink/rt2x00/rt2x00usb.c`. This is where the USB interface for those Ralink wireless chips is handled, and likely the source of the issue I'm tracking down. Given that I am an expert, I know precisely why I'm looking at this particular file – I'm expecting to find the key components related to the USB communication and perhaps some of the quirks specific to the Ralink implementation. I'm going to be looking for functions that handle URBs, endpoint transfers, and any potentially problematic timing or buffer management. Let's see what we can find. I anticipate having to trace through how the USB data is parsed and processed, looking for any opportunities for contention or error conditions that might be impacting performance or stability.

map[CodeRegexp:queue->usb_maxpacket = 1 Count:10 PathPrefix:drivers/net/wireless/ralink/rt2x00/rt2x00usb.c]

map[Output:33aca94d797d rt2x00: move under ralink vendor directory
]

gemini-3.1-pro-preview

							input: 355847
							output: 41
							thoughts: 3197
						

**Debugging a Suspected Kernel Crash: A Deep Dive into Syzkaller Output**

Okay, let's break this down. Initially, I thought the `queue->usb_maxpacket = 1` fix in `ralink` was relevant, but that's a red herring. It's been in place, so no divide-by-zero there. Next, the focus shifted to `rtl8192cu`. The `syz_usb_connect` call and the subsequent descriptor analysis revealed an incomplete USB configuration. The fuzzing generated a device configuration with just the device, configuration, and *zeroed* interface descriptors. This meant `bNumInterfaces` was effectively zero because of that descriptor with a length of zero. The kernel *should* skip this invalid interface descriptor and the device is not probed. I quickly confirmed that by checking `usb_parse_configuration` - the kernel *does* correctly skip descriptors with an invalid length, so the `rtl8192cu` device wouldn't be probed.

Then, there was the puzzling strace output: the `syz-executor` failing to setup the sandbox, coupled with the `devlink reload` command to the network interface. The failure related to `/dev/net/tun` being unavailable, resulting in exit code 67 and the `SYZFAIL` error. My initial assumption was a kernel crash was indicated by the "crash" in the prompt. I went back over the code and the strace output to see where the crash was. It turns out the C code *doesn't* send the `devlink` command! That command comes from `syz-executor` during sandbox setup and is unrelated to any code that I'm looking at.

I realized the sandbox setup failure is the problem: `syz-executor` tries to set up a network namespace and requires `/dev/net/tun`. The `ENODEV` error on `/dev/net/tun` suggests either the `tun` module isn't loaded or that the device node is invalid. Crucially, the strace shows the failure *before* the `execve` call, meaning the syzkaller-generated program is NEVER executed. It's just a sandbox setup issue. The "crash" is really a `SYZFAIL` reported as a bug candidate. Now, I need to figure out why the sandbox is failing to set up, but the root cause of this wasn't in my target driver.

log-in to see details

map[ContextFile:drivers/net/tun.c IncludeLines:true Name:tun_chr_open]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 359625
							output: 19
							thoughts: 12
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Analyzing the `tun_chr_open` Grep**

Okay, so I'm thinking about digging into the code and my first instinct is to use `grep`. I want to find all occurrences of `tun_chr_open`— that likely indicates an area of interest when working with a TUN/TAP interface. I'm expecting this to be a core function related to establishing the device. I'm hoping this will pinpoint relevant areas for device initialization and how the character device is being managed. Depending on the results, I might refine the grep query. I could look at where it's called, potentially using `-r` for recursive search, and possibly even include context like `-C 5` to get a few lines surrounding each match for an easier code inspection. Hopefully, I'll identify the functions or modules where the TUN device is being set up and managed. From there, I can trace the control flow to identify related operations.

map[Expression:tun_chr_open]

map[Output:drivers/net/tun.c=3371=static int tun_chr_fasync(int fd, struct file *file, int on)
--
drivers/net/tun.c-3394-
drivers/net/tun.c:3395:static int tun_chr_open(struct inode *inode, struct file * file)
drivers/net/tun.c-3396-{
--
drivers/net/tun.c=3465=static const struct file_operations tun_fops = {
--
drivers/net/tun.c-3473-#endif
drivers/net/tun.c:3474:	.open	= tun_chr_open,
drivers/net/tun.c-3475-	.release = tun_chr_close,
]

gemini-3.1-pro-preview

							input: 360072
							output: 41
							thoughts: 11
						

Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to a fellow expert:

**Investigating `tun_chr_open`**

Alright, time to get to it. Let's dig into this `tun_chr_open` function. That's the starting point. I need to understand what's happening there, what the setup looks like, how the initial file descriptor is created. I have a hunch about a particular area to focus on, but let's just make sure, and start from the function call.

log-in to see details

map[ContextFile:drivers/net/tun.c IncludeLines:true Name:tun_chr_open]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 360265
							output: 21
							thoughts: 14
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Troubleshooting a Tool Failure**

Okay, so the tool I was using just crapped out. Not ideal, but expected sometimes with these things. Instead of banging my head against the documentation or trying to debug the tool itself – which would probably be a time sink at this stage – I'm going to bypass it entirely and go straight to the source. Let's get the raw data and see what we can do. I'll read the file directly. That's the most effective and efficient path forward.

map[Expression:static int tun_chr_open]

map[Output:drivers/net/tun.c=3371=static int tun_chr_fasync(int fd, struct file *file, int on)
--
drivers/net/tun.c-3394-
drivers/net/tun.c:3395:static int tun_chr_open(struct inode *inode, struct file * file)
drivers/net/tun.c-3396-{
]

gemini-3.1-pro-preview

							input: 360533
							output: 21
							thoughts: 22
						

Here's a first-person summary, tailored as requested:

**Diving into `tun.c` - Line 3395**

Okay, let's get down to it. I need to understand what's happening around line 3395 in `drivers/net/tun.c`. Specifically, I know that this area must be relevant to the operation of the TUN/TAP driver, but I need to pinpoint the exact context. I'll read the preceding and following lines carefully to build a mental map of the surrounding code. My initial thought is it's likely involved in either packet handling, interface configuration, or maybe even error handling within the driver. Given my expertise, I'm expecting to quickly deduce the function calls and data structures involved, but I'll need to keep an open mind for any nuanced details. Time to start reading!

log-in to see details

map[Expression:tun_chr_open.*\{]

map[Output:]

gemini-3.1-pro-preview

							input: 360772
							output: 37
							thoughts: 15
						

Here's a summary of my immediate thought process:

**Quick and Dirty File Investigation**

Okay, so I need to figure out something about this file, probably its history or content in a quick way. Forget any complex analysis or fancy tooling right now. My first instinct, given my experience, is to reach for the simplest, most direct methods. Either a simple `read-file` command, if I'm just after the contents (or a quick peek at them). Or, if I'm trying to understand the evolution of this file, who touched it when, and why, I'm going to lean heavily on `git blame`. It'll give me the line-by-line attribution I need. I want to solve this with the least amount of friction and fuss.

map[End:3420 File:drivers/net/tun.c Start:3395]

map[Output:^1da177e4c3f4 3395) static int tun_chr_open(struct inode *inode, struct file * file)
^1da177e4c3f4 3396) {
140e807da1298 3397) 	struct net *net = current->nsproxy->net_ns;
631ab46b79559 3398) 	struct tun_file *tfile;
deed49fbb68d7 3399) 
140e807da1298 3400) 	tfile = (struct tun_file *)sk_alloc(net, AF_UNSPEC, GFP_KERNEL,
11aa9c28b4209 3401) 					    &tun_proto, 0);
631ab46b79559 3402) 	if (!tfile)
631ab46b79559 3403) 		return -ENOMEM;
b196d88aba8ac 3404) 	if (ptr_ring_init(&tfile->tx_ring, 0, GFP_KERNEL)) {
b196d88aba8ac 3405) 		sk_free(&tfile->sk);
b196d88aba8ac 3406) 		return -ENOMEM;
b196d88aba8ac 3407) 	}
b196d88aba8ac 3408) 
c7256f579f830 3409) 	mutex_init(&tfile->napi_mutex);
c956674b7c89e 3410) 	RCU_INIT_POINTER(tfile->tun, NULL);
54f968d6efdbf 3411) 	tfile->flags = 0;
fb7589a162162 3412) 	tfile->ifindex = 0;
54f968d6efdbf 3413) 
333f7909a8573 3414) 	init_waitqueue_head(&tfile->socket.wq.wait);
54f968d6efdbf 3415) 
54f968d6efdbf 3416) 	tfile->socket.file = file;
54f968d6efdbf 3417) 	tfile->socket.ops = &tun_socket_ops;
54f968d6efdbf 3418) 
9bc3047374d5b 3419) 	sock_init_data_uid(&tfile->socket, &tfile->sk, current_fsuid());
54f968d6efdbf 3420) 
]

gemini-3.1-pro-preview

							input: 361754
							output: 39
							thoughts: 246
						

**Debugging a `tun` Device Opening Failure**

Okay, so I'm seeing a problem. My code is getting `-ENODEV` when trying to `open` the `tun` device, specifically `/dev/net/tun`.  But, hold on...  `tun_chr_open` shouldn't return `-ENODEV` directly, which means the issue is originating somewhere else in the process.  The `openat` call itself is the culprit.  I need to drill down and check the kernel's `open` syscall implementation.

Let's think this through.  If the device node, `/dev/net/tun`, *exists*, but the driver, `tun`, isn't properly registered, the kernel should return `-ENXIO` or `-ENODEV`. I need to figure out which it is.  I'm making sure that `/dev/net/tun` is a character device, with major number 10 and minor number 200. I know that if the `tun` module isn't already loaded, the kernel should try to load it on demand. If that module fails to load, or isn't even present, the error makes sense. That's a good place to start, but… wait! In syzkaller, `tun` is *built-in* (`CONFIG_TUN=y`). So, if `CONFIG_TUN=y`, why am I still getting `-ENODEV`? This is weird.

Could this be related to a failure in network namespace setup?  It's a possibility, but `/dev/net/tun` is, as I recall, a misc device. So, let me go to the source. I need to examine `misc_open` in `drivers/char/misc.c` to see how it handles this specific scenario.

map[ContextFile:drivers/char/misc.c IncludeLines:true Name:misc_open]

map[SourceCode: 118:	static int misc_open(struct inode *inode, struct file *file)
 119:	{
 120:		int minor = iminor(inode);
 121:		struct miscdevice *c = NULL, *iter;
 122:		int err = -ENODEV;
 123:		const struct file_operations *new_fops = NULL;
 124:	
 125:		mutex_lock(&misc_mtx);
 126:	
 127:		list_for_each_entry(iter, &misc_list, list) {
 128:			if (iter->minor != minor)
 129:				continue;
 130:			c = iter;
 131:			new_fops = fops_get(iter->fops);
 132:			break;
 133:		}
 134:	
 135:		/* Only request module for fixed minor code */
 136:		if (!new_fops && minor < MISC_DYNAMIC_MINOR) {
 137:			mutex_unlock(&misc_mtx);
 138:			request_module("char-major-%d-%d", MISC_MAJOR, minor);
 139:			mutex_lock(&misc_mtx);
 140:	
 141:			list_for_each_entry(iter, &misc_list, list) {
 142:				if (iter->minor != minor)
 143:					continue;
 144:				c = iter;
 145:				new_fops = fops_get(iter->fops);
 146:				break;
 147:			}
 148:		}
 149:	
 150:		if (!new_fops)
 151:			goto fail;
 152:	
 153:		/*
 154:		 * Place the miscdevice in the file's
 155:		 * private_data so it can be used by the
 156:		 * file operations, including f_op->open below
 157:		 */
 158:		file->private_data = c;
 159:	
 160:		err = 0;
 161:		replace_fops(file, new_fops);
 162:		if (file->f_op->open)
 163:			err = file->f_op->open(inode, file);
 164:	fail:
 165:		mutex_unlock(&misc_mtx);
 166:		return err;
 167:	}
 SourceFile:drivers/char/misc.c]

gemini-3.1-pro-preview

							input: 363147
							output: 369
							thoughts: 62912
						

map[Question:The user provided an strace output and a C reproducer. The strace output shows `syz-executor` failing to setup the sandbox (e.g., `openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK) = -1 ENODEV`). The C reproducer uses `syz_usb_connect` to connect a dummy USB device. The first device is `0x0db0:0x6869` (rt2500usb). The second device is uninitialized (all zeros). The third device is `0x0bda:0x5088` (rtl8192cu). The C reproducer also calls `syz_usb_control_io` for the second device with responses for the `asix` driver. 
However, the C reproducer only initializes the first 9 bytes of the config descriptor (the `usb_config_descriptor` part), leaving the `usb_interface_descriptor` as all zeros. This means `bLength` of the interface descriptor is 0, so `usb_parse_configuration` will skip it and set `bNumInterfaces = 0`. If `bNumInterfaces = 0`, no driver will be probed.
Is there any known bug in the USB core or these drivers where a configuration with 0 interfaces causes a crash? Or is there a bug where `syz_usb_connect` with an all-zeros device descriptor causes a crash? Or maybe the `asix` driver crashes when handling a specific control message? But how can `asix` be probed if `idVendor=0`?]

map[Answer:The research into the provided C reproducer and the behavior of the USB core and drivers reveals several key points:

1.  **USB Configuration with 0 Interfaces**: According to the USB specification, a configuration with zero interfaces is valid, although unusual. In the Linux kernel, `usb_parse_configuration` handles this case by setting `bNumInterfaces` to 0 if no valid interface descriptors are found (e.g., if the first interface descriptor has a `bLength` of 0). When `bNumInterfaces` is 0, `usb_set_configuration` will not create any `usb_interface` devices. Consequently, no interface-based drivers (like `asix`, `rt2500usb`, or `rtl8192cu`) will be probed for that configuration.

2.  **Probing with `idVendor=0`**: A USB driver like `asix` will only be probed if the device's `idVendor` and `idProduct` match an entry in the driver's `id_table`. The `asix` driver does not have an entry for `0000:0000`. Therefore, a device with an all-zeros device descriptor will fail enumeration (specifically, `usb_get_configuration` will return `-EINVAL` because `bNumConfigurations` is 0) and will not be matched with any driver.

3.  **Potential Crash in `asix` Driver**: There is a known bug in the `asix` driver (specifically in `ax88772_unbind`) where it could cause a null-pointer dereference if the `bind` function fails early. If `ax88772_bind` fails during endpoint detection (e.g., because of a "broken" descriptor with 0 endpoints), it returns an error, and `usbnet_probe` calls `ax88772_unbind`. In some kernel versions, `ax88772_unbind` did not check if `priv->phylink` was initialized, leading to a crash when calling `phylink_disconnect_phy(NULL)`.

4.  **Reproducer Analysis**: The user's reproducer connects three devices. The second device being "all zeros" means it will fail to enumerate. The fact that `syz_usb_control_io` is called for the second device with `asix` responses suggests that the reproducer might be attempting to provide descriptors that *do* match the `asix` driver during the enumeration phase (Get Device Descriptor, etc.), even if the initial state in the C code was zeros. If the device successfully matches `asix` but has a truncated configuration descriptor (e.g., only 9 bytes), `usb_parse_configuration` will set `bNumInterfaces = 0`, which prevents the driver from binding and should avoid the `asix` specific code paths.

In summary, a configuration with 0 interfaces is handled by the USB core and prevents driver probing. The `asix` driver cannot be probed for `idVendor=0` unless the emulation provides non-zero IDs during the USB enumeration process. Known crashes in these drivers usually involve "broken" descriptors that pass initial parsing but fail during the `bind` phase of the probe.]

gemini-3-flash-preview

You are a capable Linux kernel developer tasked with researching complex questions
about kernel source code. You will be given a concrete question, and need to provide
a concrete answer.
Use tools extensively while researching the question. Don't make assumptions,
or rely on your previous knowledge about the kernel source code, use available tools
to access the actual source code.
Use all available sources of information:
 - kernel source code
 - documentation in the Documentation dir in the source tree
 - git commits descriptions, git blame

Prefer calling several tools at the same time to save round-trips.

The user provided an strace output and a C reproducer. The strace output shows `syz-executor` failing to setup the sandbox (e.g., `openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK) = -1 ENODEV`). The C reproducer uses `syz_usb_connect` to connect a dummy USB device. The first device is `0x0db0:0x6869` (rt2500usb). The second device is uninitialized (all zeros). The third device is `0x0bda:0x5088` (rtl8192cu). The C reproducer also calls `syz_usb_control_io` for the second device with responses for the `asix` driver. 
However, the C reproducer only initializes the first 9 bytes of the config descriptor (the `usb_config_descriptor` part), leaving the `usb_interface_descriptor` as all zeros. This means `bLength` of the interface descriptor is 0, so `usb_parse_configuration` will skip it and set `bNumInterfaces = 0`. If `bNumInterfaces = 0`, no driver will be probed.
Is there any known bug in the USB core or these drivers where a configuration with 0 interfaces causes a crash? Or is there a bug where `syz_usb_connect` with an all-zeros device descriptor causes a crash? Or maybe the `asix` driver crashes when handling a specific control message? But how can `asix` be probed if `idVendor=0`?

The research into the provided C reproducer and the behavior of the USB core and drivers reveals several key points:

1.  **USB Configuration with 0 Interfaces**: According to the USB specification, a configuration with zero interfaces is valid, although unusual. In the Linux kernel, `usb_parse_configuration` handles this case by setting `bNumInterfaces` to 0 if no valid interface descriptors are found (e.g., if the first interface descriptor has a `bLength` of 0). When `bNumInterfaces` is 0, `usb_set_configuration` will not create any `usb_interface` devices. Consequently, no interface-based drivers (like `asix`, `rt2500usb`, or `rtl8192cu`) will be probed for that configuration.

2.  **Probing with `idVendor=0`**: A USB driver like `asix` will only be probed if the device's `idVendor` and `idProduct` match an entry in the driver's `id_table`. The `asix` driver does not have an entry for `0000:0000`. Therefore, a device with an all-zeros device descriptor will fail enumeration (specifically, `usb_get_configuration` will return `-EINVAL` because `bNumConfigurations` is 0) and will not be matched with any driver.

3.  **Potential Crash in `asix` Driver**: There is a known bug in the `asix` driver (specifically in `ax88772_unbind`) where it could cause a null-pointer dereference if the `bind` function fails early. If `ax88772_bind` fails during endpoint detection (e.g., because of a "broken" descriptor with 0 endpoints), it returns an error, and `usbnet_probe` calls `ax88772_unbind`. In some kernel versions, `ax88772_unbind` did not check if `priv->phylink` was initialized, leading to a crash when calling `phylink_disconnect_phy(NULL)`.

4.  **Reproducer Analysis**: The user's reproducer connects three devices. The second device being "all zeros" means it will fail to enumerate. The fact that `syz_usb_control_io` is called for the second device with `asix` responses suggests that the reproducer might be attempting to provide descriptors that *do* match the `asix` driver during the enumeration phase (Get Device Descriptor, etc.), even if the initial state in the C code was zeros. If the device successfully matches `asix` but has a truncated configuration descriptor (e.g., only 9 bytes), `usb_parse_configuration` will set `bNumInterfaces = 0`, which prevents the driver from binding and should avoid the `asix` specific code paths.

In summary, a configuration with 0 interfaces is handled by the USB core and prevents driver probing. The `asix` driver cannot be probed for `idVendor=0` unless the emulation provides non-zero IDs during the USB enumeration process. Known crashes in these drivers usually involve "broken" descriptors that pass initial parsing but fail during the `bind` phase of the probe.

gemini-3-flash-preview

							input: 2607
							output: 18
							thoughts: 455
						

**Analyzing a Potential USB Kernel Crash**

Okay, so someone's reporting a possible Linux kernel crash related to USB and they've given me some interesting clues to unravel. They're using `syz-executor`, which immediately flags this as a syzkaller fuzzing report. I need to keep that in mind. The executor failed to set up the sandbox because it couldn't get `/dev/net/tun`, which is probably a red herring for the core USB issue, but I'll note it down in case it's related to the environment.

The key thing is this C reproducer using `syz_usb_connect` to attach multiple USB devices. We have three devices here, the first and third have known IDs (rt2500usb and rtl8192cu, respectively), but the second one has an uninitialized device descriptor, all zeros! That screams "problem" right off the bat. It's using `syz_usb_control_io` against the all-zeros device, with responses for `asix`. That's a strong hint.

The report also mentions that a configuration descriptor for one of the devices is only 9 bytes long. That's *very* short, so I need to check if this is an error or it's valid. The descriptor's `bNumInterfaces` field is also zero because of the short length. The question boils down to whether any of these scenarios could crash the kernel:

1.  A configuration descriptor with zero interfaces.
2.  `syz_usb_connect` with an all-zeros device descriptor.
3.  An `asix` driver crash, which is what we see with `syz_usb_control_io`.

My immediate focus is on the `syz_usb_connect` call. I need to understand how this function is implemented in the context of syzkaller. Is it a standard kernel function, or something special to the fuzzing setup? Usually, syzkaller adds pseudo-syscalls for testing and those are defined in the kernel source or inside syzkaller's executor. Sometimes, it leverages existing functionality. It looks like it is usually implemented via something like `/dev/raw-gadget`.

Thinking about the syzkaller setup, it often uses `vusb` (Virtual USB), which likely involves a combination of a user-space component and, possibly, something like `dummy_hcd` to simulate the hardware. So, my next step is to search the kernel codebase for the definition of `syz_usb_connect`. It's probably in a "testing" directory. I'll need to figure out where the "virtual" hardware is created. I expect to be digging through `drivers/usb/gadget/legacy/raw_gadget.c` or a similar file.

map[Dir:]

map[Files:<nil> Subdirs:[Documentation LICENSES arch block certs crypto drivers fs include init io_uring ipc kernel lib mm net rust samples scripts security sound tools usr virt]]

gemini-3-flash-preview

							input: 3792
							output: 24
							thoughts: 18
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Debugging USB Connection Issues in Syzkaller**

Right, let's get down to brass tacks. I'm going to start by going deep. My first instinct is to pinpoint the function call responsible for handling USB connection events in the fuzzing environment. I need a broad sweep, so I'll initiate a full-tree search for `syz_usb_connect`. This should give me a complete picture. I want to see *every* instance, every call site, every implementation – all within the Syzkaller context. The goal is to establish a base, a fundamental understanding of how that system call is used, where it's being triggered, and what surrounding code is interacting with it. I'm looking for the potential choke points, the entry points, the hooks that might be getting tripped up during the fuzzing process and causing those pesky connection issues. This initial sweep is critical; it'll guide the rest of my investigation.

log-in to see details

map[Name:syz_usb_connect]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 4070
							output: 43
							thoughts: 180
						

**Analyzing a Syzkaller USB Reproducer**

Okay, so I'm looking at this `syz_usb_connect` call and my first thought is, this isn't a standard kernel syscall. It's almost certainly a syzkaller pseudo-syscall. That means it's an interface that the syzkaller executor uses to talk to the kernel, not something you'd find directly in the kernel's syscall table. Usually, these sorts of things interface with drivers like `dummy_hcd.c` or `raw_gadget.c` in the USB gadget subsystem.

But wait, this is a C reproducer from syzkaller, so there's a couple of possibilities: either the definition of `syz_usb_connect` is baked right into the reproducer itself, or it's leveraging an existing kernel feature in a clever way.

Ah yes, my mind's clicking now, syzkaller *loves* to use `raw-gadget` to emulate USB devices. I should definitely keep that in mind.

Right, so to dig deeper, I need to start looking for anything related to "usb" and "config" in the `drivers/usb/core` directory. The mention of `usb_parse_configuration` triggered a thought, let's explore that area further.

map[ContextFile:drivers/usb/core/config.c IncludeLines:true Name:usb_parse_configuration]

map[SourceCode: 659:	static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
 660:	    struct usb_host_config *config, unsigned char *buffer, int size)
 661:	{
 662:		struct device *ddev = &dev->dev;
 663:		unsigned char *buffer0 = buffer;
 664:		int cfgno;
 665:		int nintf, nintf_orig;
 666:		int i, j, n;
 667:		struct usb_interface_cache *intfc;
 668:		unsigned char *buffer2;
 669:		int size2;
 670:		struct usb_descriptor_header *header;
 671:		int retval;
 672:		u8 inums[USB_MAXINTERFACES], nalts[USB_MAXINTERFACES];
 673:		unsigned iad_num = 0;
 674:	
 675:		memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
 676:		nintf = nintf_orig = config->desc.bNumInterfaces;
 677:		config->desc.bNumInterfaces = 0;	// Adjusted later
 678:	
 679:		if (config->desc.bDescriptorType != USB_DT_CONFIG ||
 680:		    config->desc.bLength < USB_DT_CONFIG_SIZE ||
 681:		    config->desc.bLength > size) {
 682:			dev_notice(ddev, "invalid descriptor for config index %d: "
 683:			    "type = 0x%X, length = %d\n", cfgidx,
 684:			    config->desc.bDescriptorType, config->desc.bLength);
 685:			return -EINVAL;
 686:		}
 687:		cfgno = config->desc.bConfigurationValue;
 688:	
 689:		buffer += config->desc.bLength;
 690:		size -= config->desc.bLength;
 691:	
 692:		if (nintf > USB_MAXINTERFACES) {
 693:			dev_notice(ddev, "config %d has too many interfaces: %d, "
 694:			    "using maximum allowed: %d\n",
 695:			    cfgno, nintf, USB_MAXINTERFACES);
 696:			nintf = USB_MAXINTERFACES;
 697:		}
 698:	
 699:		/* Go through the descriptors, checking their length and counting the
 700:		 * number of altsettings for each interface */
 701:		n = 0;
 702:		for ((buffer2 = buffer, size2 = size);
 703:		      size2 > 0;
 704:		     (buffer2 += header->bLength, size2 -= header->bLength)) {
 705:	
 706:			if (size2 < sizeof(struct usb_descriptor_header)) {
 707:				dev_notice(ddev, "config %d descriptor has %d excess "
 708:				    "byte%s, ignoring\n",
 709:				    cfgno, size2, str_plural(size2));
 710:				break;
 711:			}
 712:	
 713:			header = (struct usb_descriptor_header *) buffer2;
 714:			if ((header->bLength > size2) || (header->bLength < 2)) {
 715:				dev_notice(ddev, "config %d has an invalid descriptor "
 716:				    "of length %d, skipping remainder of the config\n",
 717:				    cfgno, header->bLength);
 718:				break;
 719:			}
 720:	
 721:			if (header->bDescriptorType == USB_DT_INTERFACE) {
 722:				struct usb_interface_descriptor *d;
 723:				int inum;
 724:	
 725:				d = (struct usb_interface_descriptor *) header;
 726:				if (d->bLength < USB_DT_INTERFACE_SIZE) {
 727:					dev_notice(ddev, "config %d has an invalid "
 728:					    "interface descriptor of length %d, "
 729:					    "skipping\n", cfgno, d->bLength);
 730:					continue;
 731:				}
 732:	
 733:				inum = d->bInterfaceNumber;
 734:	
 735:				if ((dev->quirks & USB_QUIRK_HONOR_BNUMINTERFACES) &&
 736:				    n >= nintf_orig) {
 737:					dev_notice(ddev, "config %d has more interface "
 738:					    "descriptors, than it declares in "
 739:					    "bNumInterfaces, ignoring interface "
 740:					    "number: %d\n", cfgno, inum);
 741:					continue;
 742:				}
 743:	
 744:				if (inum >= nintf_orig)
 745:					dev_notice(ddev, "config %d has an invalid "
 746:					    "interface number: %d but max is %d\n",
 747:					    cfgno, inum, nintf_orig - 1);
 748:	
 749:				/* Have we already encountered this interface?
 750:				 * Count its altsettings */
 751:				for (i = 0; i < n; ++i) {
 752:					if (inums[i] == inum)
 753:						break;
 754:				}
 755:				if (i < n) {
 756:					if (nalts[i] < 255)
 757:						++nalts[i];
 758:				} else if (n < USB_MAXINTERFACES) {
 759:					inums[n] = inum;
 760:					nalts[n] = 1;
 761:					++n;
 762:				}
 763:	
 764:			} else if (header->bDescriptorType ==
 765:					USB_DT_INTERFACE_ASSOCIATION) {
 766:				struct usb_interface_assoc_descriptor *d;
 767:	
 768:				d = (struct usb_interface_assoc_descriptor *)header;
 769:				if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) {
 770:					dev_notice(ddev,
 771:						 "config %d has an invalid interface association descriptor of length %d, skipping\n",
 772:						 cfgno, d->bLength);
 773:					continue;
 774:				}
 775:	
 776:				if (iad_num == USB_MAXIADS) {
 777:					dev_notice(ddev, "found more Interface "
 778:						       "Association Descriptors "
 779:						       "than allocated for in "
 780:						       "configuration %d\n", cfgno);
 781:				} else {
 782:					config->intf_assoc[iad_num] = d;
 783:					iad_num++;
 784:				}
 785:	
 786:			} else if (header->bDescriptorType == USB_DT_DEVICE ||
 787:				    header->bDescriptorType == USB_DT_CONFIG)
 788:				dev_notice(ddev, "config %d contains an unexpected "
 789:				    "descriptor of type 0x%X, skipping\n",
 790:				    cfgno, header->bDescriptorType);
 791:	
 792:		}	/* for ((buffer2 = buffer, size2 = size); ...) */
 793:		size = buffer2 - buffer;
 794:		config->desc.wTotalLength = cpu_to_le16(buffer2 - buffer0);
 795:	
 796:		if (n != nintf)
 797:			dev_notice(ddev, "config %d has %d interface%s, different from "
 798:			    "the descriptor's value: %d\n",
 799:			    cfgno, n, str_plural(n), nintf_orig);
 800:		else if (n == 0)
 801:			dev_notice(ddev, "config %d has no interfaces?\n", cfgno);
 802:		config->desc.bNumInterfaces = nintf = n;
 803:	
 804:		/* Check for missing interface numbers */
 805:		for (i = 0; i < nintf; ++i) {
 806:			for (j = 0; j < nintf; ++j) {
 807:				if (inums[j] == i)
 808:					break;
 809:			}
 810:			if (j >= nintf)
 811:				dev_notice(ddev, "config %d has no interface number "
 812:				    "%d\n", cfgno, i);
 813:		}
 814:	
 815:		/* Allocate the usb_interface_caches and altsetting arrays */
 816:		for (i = 0; i < nintf; ++i) {
 817:			j = nalts[i];
 818:			if (j > USB_MAXALTSETTING) {
 819:				dev_notice(ddev, "too many alternate settings for "
 820:				    "config %d interface %d: %d, "
 821:				    "using maximum allowed: %d\n",
 822:				    cfgno, inums[i], j, USB_MAXALTSETTING);
 823:				nalts[i] = j = USB_MAXALTSETTING;
 824:			}
 825:	
 826:			intfc = kzalloc_flex(*intfc, altsetting, j);
 827:			config->intf_cache[i] = intfc;
 828:			if (!intfc)
 829:				return -ENOMEM;
 830:			kref_init(&intfc->ref);
 831:		}
 832:	
 833:		/* FIXME: parse the BOS descriptor */
 834:	
 835:		/* Skip over any Class Specific or Vendor Specific descriptors;
 836:		 * find the first interface descriptor */
 837:		config->extra = buffer;
 838:		i = find_next_descriptor(buffer, size, USB_DT_INTERFACE,
 839:		    USB_DT_INTERFACE, &n);
 840:		config->extralen = i;
 841:		if (n > 0)
 842:			dev_dbg(ddev, "skipped %d descriptor%s after %s\n",
 843:			    n, str_plural(n), "configuration");
 844:		buffer += i;
 845:		size -= i;
 846:	
 847:		/* Parse all the interface/altsetting descriptors */
 848:		while (size > 0) {
 849:			retval = usb_parse_interface(ddev, cfgno, config,
 850:			    buffer, size, inums, nalts);
 851:			if (retval < 0)
 852:				return retval;
 853:	
 854:			buffer += retval;
 855:			size -= retval;
 856:		}
 857:	
 858:		/* Check for missing altsettings */
 859:		for (i = 0; i < nintf; ++i) {
 860:			intfc = config->intf_cache[i];
 861:			for (j = 0; j < intfc->num_altsetting; ++j) {
 862:				for (n = 0; n < intfc->num_altsetting; ++n) {
 863:					if (intfc->altsetting[n].desc.
 864:					    bAlternateSetting == j)
 865:						break;
 866:				}
 867:				if (n >= intfc->num_altsetting)
 868:					dev_notice(ddev, "config %d interface %d has no "
 869:					    "altsetting %d\n", cfgno, inums[i], j);
 870:			}
 871:		}
 872:	
 873:		return 0;
 874:	}
 SourceFile:drivers/usb/core/config.c]

gemini-3-flash-preview

							input: 8049
							output: 43
							thoughts: 167
						

**Analyzing the USB Configuration Parsing**

Okay, so I'm looking at this `usb_parse_configuration` function, and I'm zeroing in on a specific scenario. If `n`, which I'm assuming represents the number of interface descriptors found, is equal to zero, that means we have a configuration without any interfaces. In that case, `config->desc.bNumInterfaces` gets set to zero, according to line 802.

Since `nintf` is now 0 the first `for` loop, from line 816, will be skipped entirely. Same for the second one at line 859. That makes sense, no interfaces, no need to iterate.

Now, that `while` loop starting at line 848, the `while (size > 0)` one, might still execute. That's assuming there are other descriptors besides the interface descriptors in the configuration. But, crucially, within that loop, `usb_parse_interface` is called.

The interesting part, or rather the potential red flag, is what happens when `nintf` is zero. Will `usb_parse_interface` handle that gracefully? My gut tells me this is an edge case worth exploring further. I need to dig into the definition of `usb_parse_interface` to see if it's expecting a valid `nintf` or if it includes any error-handling for a zero-interface configuration. I need to make sure this situation does not cause a crash.

map[ContextFile:drivers/usb/core/config.c IncludeLines:true Name:usb_parse_interface]

map[SourceCode: 552:	static int usb_parse_interface(struct device *ddev, int cfgno,
 553:	    struct usb_host_config *config, unsigned char *buffer, int size,
 554:	    u8 inums[], u8 nalts[])
 555:	{
 556:		unsigned char *buffer0 = buffer;
 557:		struct usb_interface_descriptor	*d;
 558:		int inum, asnum;
 559:		struct usb_interface_cache *intfc;
 560:		struct usb_host_interface *alt;
 561:		int i, n;
 562:		int len, retval;
 563:		int num_ep, num_ep_orig;
 564:	
 565:		d = (struct usb_interface_descriptor *) buffer;
 566:		buffer += d->bLength;
 567:		size -= d->bLength;
 568:	
 569:		if (d->bLength < USB_DT_INTERFACE_SIZE)
 570:			goto skip_to_next_interface_descriptor;
 571:	
 572:		/* Which interface entry is this? */
 573:		intfc = NULL;
 574:		inum = d->bInterfaceNumber;
 575:		for (i = 0; i < config->desc.bNumInterfaces; ++i) {
 576:			if (inums[i] == inum) {
 577:				intfc = config->intf_cache[i];
 578:				break;
 579:			}
 580:		}
 581:		if (!intfc || intfc->num_altsetting >= nalts[i])
 582:			goto skip_to_next_interface_descriptor;
 583:	
 584:		/* Check for duplicate altsetting entries */
 585:		asnum = d->bAlternateSetting;
 586:		for ((i = 0, alt = &intfc->altsetting[0]);
 587:		      i < intfc->num_altsetting;
 588:		     (++i, ++alt)) {
 589:			if (alt->desc.bAlternateSetting == asnum) {
 590:				dev_notice(ddev, "Duplicate descriptor for config %d "
 591:				    "interface %d altsetting %d, skipping\n",
 592:				    cfgno, inum, asnum);
 593:				goto skip_to_next_interface_descriptor;
 594:			}
 595:		}
 596:	
 597:		++intfc->num_altsetting;
 598:		memcpy(&alt->desc, d, USB_DT_INTERFACE_SIZE);
 599:	
 600:		/* Skip over any Class Specific or Vendor Specific descriptors;
 601:		 * find the first endpoint or interface descriptor */
 602:		alt->extra = buffer;
 603:		i = find_next_descriptor(buffer, size, USB_DT_ENDPOINT,
 604:		    USB_DT_INTERFACE, &n);
 605:		alt->extralen = i;
 606:		if (n > 0)
 607:			dev_dbg(ddev, "skipped %d descriptor%s after %s\n",
 608:			    n, str_plural(n), "interface");
 609:		buffer += i;
 610:		size -= i;
 611:	
 612:		/* Allocate space for the right(?) number of endpoints */
 613:		num_ep = num_ep_orig = alt->desc.bNumEndpoints;
 614:		alt->desc.bNumEndpoints = 0;		/* Use as a counter */
 615:		if (num_ep > USB_MAXENDPOINTS) {
 616:			dev_notice(ddev, "too many endpoints for config %d interface %d "
 617:			    "altsetting %d: %d, using maximum allowed: %d\n",
 618:			    cfgno, inum, asnum, num_ep, USB_MAXENDPOINTS);
 619:			num_ep = USB_MAXENDPOINTS;
 620:		}
 621:	
 622:		if (num_ep > 0) {
 623:			/* Can't allocate 0 bytes */
 624:			len = sizeof(struct usb_host_endpoint) * num_ep;
 625:			alt->endpoint = kzalloc(len, GFP_KERNEL);
 626:			if (!alt->endpoint)
 627:				return -ENOMEM;
 628:		}
 629:	
 630:		/* Parse all the endpoint descriptors */
 631:		n = 0;
 632:		while (size > 0) {
 633:			if (((struct usb_descriptor_header *) buffer)->bDescriptorType
 634:			     == USB_DT_INTERFACE)
 635:				break;
 636:			retval = usb_parse_endpoint(ddev, cfgno, config, inum, asnum,
 637:					alt, num_ep, buffer, size);
 638:			if (retval < 0)
 639:				return retval;
 640:			++n;
 641:	
 642:			buffer += retval;
 643:			size -= retval;
 644:		}
 645:	
 646:		if (n != num_ep_orig)
 647:			dev_notice(ddev, "config %d interface %d altsetting %d has %d "
 648:			    "endpoint descriptor%s, different from the interface "
 649:			    "descriptor's value: %d\n",
 650:			    cfgno, inum, asnum, n, str_plural(n), num_ep_orig);
 651:		return buffer - buffer0;
 652:	
 653:	skip_to_next_interface_descriptor:
 654:		i = find_next_descriptor(buffer, size, USB_DT_INTERFACE,
 655:		    USB_DT_INTERFACE, NULL);
 656:		return buffer - buffer0 + i;
 657:	}
 SourceFile:drivers/usb/core/config.c]

gemini-3-flash-preview

							input: 10294
							output: 45
							thoughts: 199
						

**Analyzing USB Interface Descriptor Handling**

Okay, so I'm looking at this code and if `config->desc.bNumInterfaces` is zero, that `for` loop at line 575 simply won't run. `intfc` stays `NULL`, and the code correctly jumps to `skip_to_next_interface_descriptor`. That's good; it seems robust against configurations with no interfaces, which is a common edge case to handle. I always appreciate when the code anticipates that!

Now, the user mentions this C reproducer calling `syz_usb_control_io` for the second device, and that it contains responses for the `asix` driver. Interesting. But the user raises a very valid point: how could the `asix` driver possibly be probed if `idVendor` is zero? If this second device is all zeros, as in, `idVendor` and `idProduct` are both zero, the `asix` driver almost certainly won't match. Drivers rarely, if ever, match on a `0000:0000` device ID. This smells fishy. Let me go and check the `asix` driver's ID table right now. Gotta confirm this assumption.

log-in to see details

map[ContextFile:drivers/net/usb/asix_devices.c IncludeLines:true Name:asix_ids]

map[SourceCode: SourceFile:]

gemini-3-flash-preview

							input: 10823
							output: 24
							thoughts: 18
						

Okay, here's my thought process as if I were considering the described actions, tailored for an expert audience:

**Investigating the asix Driver Within the Linux Kernel Network USB Subsystem**

Alright, let's get down to brass tacks. I'm going to start by diving into the kernel source. My first step is to zero in on the `asix` driver. Given its nature as a USB Ethernet adapter driver, the logical place to begin my search is within the `drivers/net/usb/` directory. That directory is the canonical location for USB-specific network device drivers within the Linux kernel, so that’s where I'll find the core of the `asix` module. My goal is to quickly locate and understand the implementation details, potentially identify version specific differences, and any idiosyncrasies specific to this device family.

map[Dir:drivers/net/usb/]

map[Files:[aqc111.c aqc111.h asix.h asix_common.c asix_devices.c ax88172a.c ax88179_178a.c catc.c cdc-phonet.c cdc_eem.c cdc_ether.c cdc_mbim.c cdc_ncm.c cdc_subset.c ch9200.c cx82310_eth.c dm9601.c gl620a.c hso.c huawei_cdc_ncm.c int51x1.c ipheth.c kalmia.c kaweth.c lan78xx.c lan78xx.h lg-vl600.c mcs7830.c net1080.c pegasus.c pegasus.h plusb.c qmi_wwan.c r8152.c r8153_ecm.c rndis_host.c rtl8150.c sierra_net.c smsc75xx.c smsc75xx.h smsc95xx.c smsc95xx.h sr9700.c sr9700.h sr9800.c sr9800.h usbnet.c zaurus.c] Subdirs:<nil>]

gemini-3-flash-preview

							input: 11506
							output: 31
							thoughts: 23
						

Okay, here's my summary, presented as a stream of thought:

**Diving into the asix Driver**

Right, let's get down to brass tacks. I'm going to start by looking for the ID table for this specific device. Where would the relevant USB device identifiers be defined? The obvious starting point is the driver file itself. My instincts tell me the best place to find that table is within `drivers/net/usb/asix_devices.c`. That's where I expect to see the supported vendor and product IDs. I'll need those IDs to understand how the driver handles different hardware revisions or specific models, and use the associated device and interface descriptors. Okay, let's dig in and see what we find.

map[SourceFile:drivers/net/usb/asix_devices.c]

map[Entities:[map[Kind:function Name:asix_driver_exit] map[Kind:function Name:asix_driver_init] map[Kind:function Name:asix_get_phyid] map[Kind:function Name:asix_phy_reset] map[Kind:function Name:asix_resume] map[Kind:function Name:asix_set_netdev_dev_addr] map[Kind:function Name:asix_status] map[Kind:function Name:asix_suspend] map[Kind:function Name:ax88172_bind] map[Kind:function Name:ax88172_link_reset] map[Kind:function Name:ax88172_set_multicast] map[Kind:function Name:ax88178_bind] map[Kind:function Name:ax88178_change_mtu] map[Kind:function Name:ax88178_link_reset] map[Kind:function Name:ax88178_reset] map[Kind:function Name:ax88178_set_mfb] map[Kind:function Name:ax88178_unbind] map[Kind:function Name:ax88772_bind] map[Kind:function Name:ax88772_ethtool_get_pauseparam] map[Kind:function Name:ax88772_ethtool_get_sset_count] map[Kind:function Name:ax88772_ethtool_get_strings] map[Kind:function Name:ax88772_ethtool_set_pauseparam] map[Kind:function Name:ax88772_hw_reset] map[Kind:function Name:ax88772_init_mdio] map[Kind:function Name:ax88772_init_phy] map[Kind:function Name:ax88772_mac_config] map[Kind:function Name:ax88772_mac_link_down] map[Kind:function Name:ax88772_mac_link_up] map[Kind:function Name:ax88772_mdio_unregister] map[Kind:function Name:ax88772_phylink_setup] map[Kind:function Name:ax88772_reset] map[Kind:function Name:ax88772_resume] map[Kind:function Name:ax88772_stop] map[Kind:function Name:ax88772_suspend] map[Kind:function Name:ax88772_unbind] map[Kind:function Name:ax88772a_hw_reset] map[Kind:function Name:marvell_led_status] map[Kind:function Name:marvell_phy_init] map[Kind:function Name:rtl8211cl_phy_init] map[Kind:struct Name:ax88172_int_data] map[Kind:global_variable Name:__UNIQUE_ID_addressable_asix_driver_init_1280] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_1281] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_1282] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_1283] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_1284] map[Kind:global_variable Name:__exitcall_asix_driver_exit] map[Kind:global_variable Name:__mod_device_table__kmod_asix__usb__products] map[Kind:global_variable Name:asix_driver] map[Kind:global_variable Name:ax88172_ethtool_ops] map[Kind:global_variable Name:ax88172_netdev_ops] map[Kind:global_variable Name:ax88178_ethtool_ops] map[Kind:global_variable Name:ax88178_info] map[Kind:global_variable Name:ax88178_netdev_ops] map[Kind:global_variable Name:ax8817x_info] map[Kind:global_variable Name:ax88772_ethtool_ops] map[Kind:global_variable Name:ax88772_info] map[Kind:global_variable Name:ax88772_netdev_ops] map[Kind:global_variable Name:ax88772_phylink_mac_ops] map[Kind:global_variable Name:ax88772b_info] map[Kind:global_variable Name:dlink_dub_e100_info] map[Kind:global_variable Name:hawking_uf200_info] map[Kind:global_variable Name:hg20f9_info] map[Kind:global_variable Name:lxausb_t1l_info] map[Kind:global_variable Name:lyconsys_fibergecko100_info] map[Kind:global_variable Name:netgear_fa120_info] map[Kind:global_variable Name:products]]]

gemini-3-flash-preview

							input: 13154
							output: 42
							thoughts: 8
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Initial Database Schema Deduction**

Right, so we're talking about an ID table, most likely. The standard convention, and frankly, the most logical starting point for an inventory or product-related database, is `products`. I'd wager a good amount of money that's where we'll find our primary key and related product information. It's the cleanest, most intuitive name, and it aligns with best practices. We might also have `product_categories` and `product_variants`. But my first guess, *the* starting point is `products`. I feel confident we can start there and then adjust as we learn more.

map[ContextFile:drivers/net/usb/asix_devices.c IncludeLines:true Name:products]

map[SourceCode:1447:	static const struct usb_device_id	products [] = {
1448:	{
1449:		// Linksys USB200M
1450:		USB_DEVICE (0x077b, 0x2226),
1451:		.driver_info =	(unsigned long) &ax8817x_info,
1452:	}, {
1453:		// Netgear FA120
1454:		USB_DEVICE (0x0846, 0x1040),
1455:		.driver_info =  (unsigned long) &netgear_fa120_info,
1456:	}, {
1457:		// DLink DUB-E100
1458:		USB_DEVICE (0x2001, 0x1a00),
1459:		.driver_info =  (unsigned long) &dlink_dub_e100_info,
1460:	}, {
1461:		// Intellinet, ST Lab USB Ethernet
1462:		USB_DEVICE (0x0b95, 0x1720),
1463:		.driver_info =  (unsigned long) &ax8817x_info,
1464:	}, {
1465:		// Hawking UF200, TrendNet TU2-ET100
1466:		USB_DEVICE (0x07b8, 0x420a),
1467:		.driver_info =  (unsigned long) &hawking_uf200_info,
1468:	}, {
1469:		// Billionton Systems, USB2AR
1470:		USB_DEVICE (0x08dd, 0x90ff),
1471:		.driver_info =  (unsigned long) &ax8817x_info,
1472:	}, {
1473:		// Billionton Systems, GUSB2AM-1G-B
1474:		USB_DEVICE(0x08dd, 0x0114),
1475:		.driver_info =  (unsigned long) &ax88178_info,
1476:	}, {
1477:		// ATEN UC210T
1478:		USB_DEVICE (0x0557, 0x2009),
1479:		.driver_info =  (unsigned long) &ax8817x_info,
1480:	}, {
1481:		// Buffalo LUA-U2-KTX
1482:		USB_DEVICE (0x0411, 0x003d),
1483:		.driver_info =  (unsigned long) &ax8817x_info,
1484:	}, {
1485:		// Buffalo LUA-U2-GT 10/100/1000
1486:		USB_DEVICE (0x0411, 0x006e),
1487:		.driver_info =  (unsigned long) &ax88178_info,
1488:	}, {
1489:		// Sitecom LN-029 "USB 2.0 10/100 Ethernet adapter"
1490:		USB_DEVICE (0x6189, 0x182d),
1491:		.driver_info =  (unsigned long) &ax8817x_info,
1492:	}, {
1493:		// Sitecom LN-031 "USB 2.0 10/100/1000 Ethernet adapter"
1494:		USB_DEVICE (0x0df6, 0x0056),
1495:		.driver_info =  (unsigned long) &ax88178_info,
1496:	}, {
1497:		// Sitecom LN-028 "USB 2.0 10/100/1000 Ethernet adapter"
1498:		USB_DEVICE (0x0df6, 0x061c),
1499:		.driver_info =  (unsigned long) &ax88178_info,
1500:	}, {
1501:		// corega FEther USB2-TX
1502:		USB_DEVICE (0x07aa, 0x0017),
1503:		.driver_info =  (unsigned long) &ax8817x_info,
1504:	}, {
1505:		// Surecom EP-1427X-2
1506:		USB_DEVICE (0x1189, 0x0893),
1507:		.driver_info = (unsigned long) &ax8817x_info,
1508:	}, {
1509:		// goodway corp usb gwusb2e
1510:		USB_DEVICE (0x1631, 0x6200),
1511:		.driver_info = (unsigned long) &ax8817x_info,
1512:	}, {
1513:		// JVC MP-PRX1 Port Replicator
1514:		USB_DEVICE (0x04f1, 0x3008),
1515:		.driver_info = (unsigned long) &ax8817x_info,
1516:	}, {
1517:		// Lenovo U2L100P 10/100
1518:		USB_DEVICE (0x17ef, 0x7203),
1519:		.driver_info = (unsigned long)&ax88772b_info,
1520:	}, {
1521:		// ASIX AX88772B 10/100
1522:		USB_DEVICE (0x0b95, 0x772b),
1523:		.driver_info = (unsigned long) &ax88772b_info,
1524:	}, {
1525:		// ASIX AX88772 10/100
1526:		USB_DEVICE (0x0b95, 0x7720),
1527:		.driver_info = (unsigned long) &ax88772_info,
1528:	}, {
1529:		// ASIX AX88178 10/100/1000
1530:		USB_DEVICE (0x0b95, 0x1780),
1531:		.driver_info = (unsigned long) &ax88178_info,
1532:	}, {
1533:		// Logitec LAN-GTJ/U2A
1534:		USB_DEVICE (0x0789, 0x0160),
1535:		.driver_info = (unsigned long) &ax88178_info,
1536:	}, {
1537:		// Linksys USB200M Rev 2
1538:		USB_DEVICE (0x13b1, 0x0018),
1539:		.driver_info = (unsigned long) &ax88772_info,
1540:	}, {
1541:		// 0Q0 cable ethernet
1542:		USB_DEVICE (0x1557, 0x7720),
1543:		.driver_info = (unsigned long) &ax88772_info,
1544:	}, {
1545:		// DLink DUB-E100 H/W Ver B1
1546:		USB_DEVICE (0x07d1, 0x3c05),
1547:		.driver_info = (unsigned long) &ax88772_info,
1548:	}, {
1549:		// DLink DUB-E100 H/W Ver B1 Alternate
1550:		USB_DEVICE (0x2001, 0x3c05),
1551:		.driver_info = (unsigned long) &ax88772_info,
1552:	}, {
1553:	       // DLink DUB-E100 H/W Ver C1
1554:	       USB_DEVICE (0x2001, 0x1a02),
1555:	       .driver_info = (unsigned long) &ax88772_info,
1556:	}, {
1557:		// Linksys USB1000
1558:		USB_DEVICE (0x1737, 0x0039),
1559:		.driver_info = (unsigned long) &ax88178_info,
1560:	}, {
1561:		// IO-DATA ETG-US2
1562:		USB_DEVICE (0x04bb, 0x0930),
1563:		.driver_info = (unsigned long) &ax88178_info,
1564:	}, {
1565:		// Belkin F5D5055
1566:		USB_DEVICE(0x050d, 0x5055),
1567:		.driver_info = (unsigned long) &ax88178_info,
1568:	}, {
1569:		// Apple USB Ethernet Adapter
1570:		USB_DEVICE(0x05ac, 0x1402),
1571:		.driver_info = (unsigned long) &ax88772_info,
1572:	}, {
1573:		// Cables-to-Go USB Ethernet Adapter
1574:		USB_DEVICE(0x0b95, 0x772a),
1575:		.driver_info = (unsigned long) &ax88772_info,
1576:	}, {
1577:		// ABOCOM for pci
1578:		USB_DEVICE(0x14ea, 0xab11),
1579:		.driver_info = (unsigned long) &ax88178_info,
1580:	}, {
1581:		// ASIX 88772a
1582:		USB_DEVICE(0x0db0, 0xa877),
1583:		.driver_info = (unsigned long) &ax88772_info,
1584:	}, {
1585:		// Asus USB Ethernet Adapter
1586:		USB_DEVICE (0x0b95, 0x7e2b),
1587:		.driver_info = (unsigned long)&ax88772b_info,
1588:	}, {
1589:		/* ASIX 88172a demo board */
1590:		USB_DEVICE(0x0b95, 0x172a),
1591:		.driver_info = (unsigned long) &ax88172a_info,
1592:	}, {
1593:		/*
1594:		 * USBLINK HG20F9 "USB 2.0 LAN"
1595:		 * Appears to have gazumped Linksys's manufacturer ID but
1596:		 * doesn't (yet) conflict with any known Linksys product.
1597:		 */
1598:		USB_DEVICE(0x066b, 0x20f9),
1599:		.driver_info = (unsigned long) &hg20f9_info,
1600:	}, {
1601:		// Linux Automation GmbH USB 10Base-T1L
1602:		USB_DEVICE(0x33f7, 0x0004),
1603:		.driver_info = (unsigned long) &lxausb_t1l_info,
1604:	}, {
1605:		/* LyconSys FiberGecko 100 */
1606:		USB_DEVICE(0x1d2a, 0x0801),
1607:		.driver_info = (unsigned long) &lyconsys_fibergecko100_info,
1608:	},
1609:		{ },		// END
1610:	};
 SourceFile:drivers/net/usb/asix_devices.c]

gemini-3-flash-preview

							input: 16670
							output: 27
							thoughts: 600
						

**Analyzing the USB Reproducer**

Okay, so none of the devices are the all-zeros device ID `0000:0000`, that's a good starting point. The user mentioned the C reproducer calls `syz_usb_control_io` for the second device *with* responses from the `asix` driver, which seems off. If the second device is all zeros, it shouldn't be associated with `asix` at all.

Wait, could the *first* device be the one interacting with something that eventually uses `asix`? Let's see. Device 1 is `0x0db0:0x6869` (rt2500usb) and Device 3 is `0x0bda:0x5088` (rtl8192cu). Let me check if `0x0db0:0x6869` is even in the `asix` table... not in this snippet, but `0x0db0` *is* Micro-Star International, and `0x0db0:0xa877` is in the table (line 1582).

Now, the user explicitly stated the *second* device is uninitialized (all zeros). They also keep repeating that the C reproducer calls `syz_usb_control_io` on the second device with `asix` responses. This is the crux of the issue.

I'm thinking, what happens when `syz_usb_connect` is called with all zeros? In the syzkaller context, `syz_usb_connect` will provide a pointer to something like a `struct syz_usb_device_index` containing descriptors. With all zeros, the `bLength` field of the device descriptor will be zero, meaning `usb_get_device_descriptor` might fail.

Let's quickly review how USB devices are enumerated. Remind myself... `hub_port_init` calls `usb_get_device_descriptor`.

Ideally, I could find where `syz_usb_connect` is handled in the kernel directly, but given the user's mention of a "C reproducer," it's probably not in the kernel itself. Ah, right, syzkaller likely utilizes either `raw-gadget` or `dummy_hcd`, or maybe even the `vusb` (virtual USB) subsystem.

Let me quickly search the entire tree for `syz_usb_connect` again, just in case. No luck, which means it isn't in the kernel. I tried the selftests too, but no.

If it's a syzkaller reproducer, it's likely using `write` to some `/dev/` node. Typically `/dev/raw-gadget`. Let's examine `drivers/usb/gadget/legacy/raw_gadget.c`... that's probably the key.

map[Dir:drivers/usb/gadget/legacy/]

map[Files:[acm_ms.c audio.c cdc2.c dbgp.c ether.c g_ffs.c gmidi.c hid.c inode.c mass_storage.c multi.c ncm.c nokia.c printer.c raw_gadget.c serial.c tcm_usb_gadget.c webcam.c zero.c] Subdirs:<nil>]

gemini-3-flash-preview

							input: 18083
							output: 34
							thoughts: 21
						

Here's a summary of my thought process, as though I were considering the code you mentioned, tailored for an expert audience:

**Diving into the Legacy Raw Gadget Driver**

Okay, I'm thinking we need to delve into `drivers/usb/gadget/legacy/raw_gadget.c`. The "raw" in the name always piques my interest – usually it means we're dealing with very low-level control, often bypassing higher-level abstractions that might be present in more modern gadget drivers. I'm expecting to see direct hardware access, probably manipulating registers or memory mappings related to the USB controller.

Given that it's in the "legacy" directory, I'm already anticipating potentially outdated coding styles or architectural choices. That doesn't necessarily mean bad code, just code written with older USB specifications or kernel versions in mind. My first instinct will be to quickly identify the core data structures used to represent the USB device, endpoints, and requests. I'll need to understand how the driver interfaces with the underlying hardware, how it handles setup packets, IN and OUT transfers, and how it manages buffer allocation and DMA.

I'll be specifically looking for potential performance bottlenecks or areas where modern USB gadget features might be missing or poorly implemented. Things like scatter-gather DMA support, isochronous transfers, or advanced power management could be areas of interest, especially if this driver is still in use in some system. I'll also be mentally flagging any use of deprecated kernel APIs or patterns, knowing that we might need to assess the feasibility of porting or updating this driver for future kernel releases. Finally, I'll be on the lookout for any potential security vulnerabilities, especially in the areas of buffer management and data validation, given the low-level nature of this driver. Let's see what we can find.

map[SourceFile:drivers/usb/gadget/legacy/raw_gadget.c]

map[Entities:[map[Kind:function Name:dev_free] map[Kind:function Name:dev_new] map[Kind:function Name:fill_ep_caps] map[Kind:function Name:fill_ep_limits] map[Kind:function Name:gadget_bind] map[Kind:function Name:gadget_disconnect] map[Kind:function Name:gadget_ep0_complete] map[Kind:function Name:gadget_ep_complete] map[Kind:function Name:gadget_reset] map[Kind:function Name:gadget_resume] map[Kind:function Name:gadget_setup] map[Kind:function Name:gadget_suspend] map[Kind:function Name:gadget_unbind] map[Kind:function Name:get_ep_addr] map[Kind:function Name:raw_alloc_io_data] map[Kind:function Name:raw_event_queue_add] map[Kind:function Name:raw_event_queue_destroy] map[Kind:function Name:raw_event_queue_fetch] map[Kind:function Name:raw_event_queue_init] map[Kind:function Name:raw_ioctl] map[Kind:function Name:raw_ioctl_configure] map[Kind:function Name:raw_ioctl_ep0_read] map[Kind:function Name:raw_ioctl_ep0_stall] map[Kind:function Name:raw_ioctl_ep0_write] map[Kind:function Name:raw_ioctl_ep_disable] map[Kind:function Name:raw_ioctl_ep_enable] map[Kind:function Name:raw_ioctl_ep_read] map[Kind:function Name:raw_ioctl_ep_set_clear_halt_wedge] map[Kind:function Name:raw_ioctl_ep_write] map[Kind:function Name:raw_ioctl_eps_info] map[Kind:function Name:raw_ioctl_event_fetch] map[Kind:function Name:raw_ioctl_init] map[Kind:function Name:raw_ioctl_run] map[Kind:function Name:raw_ioctl_vbus_draw] map[Kind:function Name:raw_misc_device_exit] map[Kind:function Name:raw_misc_device_init] map[Kind:function Name:raw_open] map[Kind:function Name:raw_process_ep0_io] map[Kind:function Name:raw_process_ep_io] map[Kind:function Name:raw_queue_event] map[Kind:function Name:raw_release] map[Kind:struct Name:raw_dev] map[Kind:struct Name:raw_ep] map[Kind:struct Name:raw_event_queue] map[Kind:global_variable Name:__UNIQUE_ID_addressable_raw_misc_device_init_948] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_824] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_825] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_826] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_827] map[Kind:global_variable Name:__exitcall_raw_misc_device_exit] map[Kind:global_variable Name:driver_id_numbers] map[Kind:global_variable Name:raw_fops] map[Kind:global_variable Name:raw_misc_device] map[Kind:enum Name:dev_state] map[Kind:enum Name:ep_state]]]

gemini-3-flash-preview

							input: 19506
							output: 43
							thoughts: 453
						

**Analyzing a User's USB Device Report**

Okay, so I'm looking at this report about USB device enumeration using `raw_gadget` – specifically in the context of Syzkaller fuzzing. The user provides a sequence of devices: first `0x0db0:0x6869` (rt2500usb), then an uninitialized one (all zeros), and finally `0x0bda:0x5088` (rtl8192cu).

My initial thought is, "Wait a minute, all zeros? That means `idVendor=0, idProduct=0`." That's highly unusual. I'd expect that kind of device not to be matched by *any* driver in a normal scenario. Usually, nothing claims `0000:0000`. It's a clear indicator of something being wrong with the device description retrieval, or a deliberately malformed setup.

But then, here's where it gets interesting. The user also mentions that the C reproducer calls `syz_usb_control_io` for *this* "second device" (the all-zeros one), and it seems to get responses for the `asix` driver. Now, that's just strange. If it's a device with zeros in its descriptor, why would it be interacting with the `asix` driver? Something is not adding up.

My instinct tells me there are a couple of possibilities: either the "second device" is actually probed as something else in the reproducer, perhaps through some early interaction before the all-zeros description is set, or the user has a minor misunderstanding about which device they're referring to in their C reproducer vs. the enumeration report. I need to be sure about what they're saying.

Let's re-read the report again, just to verify: First device `0x0db0:0x6869`, second device is uninitialized (all zeros), and the third `0x0bda:0x5088`. The C reproducer clearly calls `syz_usb_control_io` for the second uninitialized one, but gets `asix` driver responses.

It's likely that even if `syz_usb_connect` is called with all zeros, it could still establish a connection on the virtual USB bus. The kernel would then try to read the device descriptor. And if it's all zeros, then `bLength` will be zero. That's a key point.

I need to focus on what happens in `drivers/usb/core/hub.c` and specifically `hub_port_init`, which calls `usb_get_device_descriptor`. I should investigate the code flow when it gets a zero-length or an all-zeros descriptor. This is where the root cause of this anomaly likely lies.

map[ContextFile:drivers/usb/core/hub.c IncludeLines:true Name:hub_port_init]

map[SourceCode:4884:	/* Reset device, (re)assign address, get device descriptor.
4885:	 * Device connection must be stable, no more debouncing needed.
4886:	 * Returns device in USB_STATE_ADDRESS, except on error.
4887:	 *
4888:	 * If this is called for an already-existing device (as part of
4889:	 * usb_reset_and_verify_device), the caller must own the device lock and
4890:	 * the port lock.  For a newly detected device that is not accessible
4891:	 * through any global pointers, it's not necessary to lock the device,
4892:	 * but it is still necessary to lock the port.
4893:	 *
4894:	 * For a newly detected device, @dev_descr must be NULL.  The device
4895:	 * descriptor retrieved from the device will then be stored in
4896:	 * @udev->descriptor.  For an already existing device, @dev_descr
4897:	 * must be non-NULL.  The device descriptor will be stored there,
4898:	 * not in @udev->descriptor, because descriptors for registered
4899:	 * devices are meant to be immutable.
4900:	 */
4901:	static int
4902:	hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1,
4903:			int retry_counter, struct usb_device_descriptor *dev_descr)
4904:	{
4905:		struct usb_device	*hdev = hub->hdev;
4906:		struct usb_hcd		*hcd = bus_to_hcd(hdev->bus);
4907:		struct usb_port		*port_dev = hub->ports[port1 - 1];
4908:		int			retries, operations, retval, i;
4909:		unsigned		delay = HUB_SHORT_RESET_TIME;
4910:		enum usb_device_speed	oldspeed = udev->speed;
4911:		const char		*speed;
4912:		int			devnum = udev->devnum;
4913:		const char		*driver_name;
4914:		bool			do_new_scheme;
4915:		const bool		initial = !dev_descr;
4916:		int			maxp0;
4917:		struct usb_device_descriptor	*buf, *descr;
4918:	
4919:		buf = kmalloc(GET_DESCRIPTOR_BUFSIZE, GFP_NOIO);
4920:		if (!buf)
4921:			return -ENOMEM;
4922:	
4923:		/* root hub ports have a slightly longer reset period
4924:		 * (from USB 2.0 spec, section 7.1.7.5)
4925:		 */
4926:		if (!hdev->parent) {
4927:			delay = HUB_ROOT_RESET_TIME;
4928:			if (port1 == hdev->bus->otg_port)
4929:				hdev->bus->b_hnp_enable = 0;
4930:		}
4931:	
4932:		/* Some low speed devices have problems with the quick delay, so */
4933:		/*  be a bit pessimistic with those devices. RHbug #23670 */
4934:		if (oldspeed == USB_SPEED_LOW)
4935:			delay = HUB_LONG_RESET_TIME;
4936:	
4937:		/* Reset the device; full speed may morph to high speed */
4938:		/* FIXME a USB 2.0 device may morph into SuperSpeed on reset. */
4939:		retval = hub_port_reset(hub, port1, udev, delay, false);
4940:		if (retval < 0)		/* error or disconnect */
4941:			goto fail;
4942:		/* success, speed is known */
4943:	
4944:		retval = -ENODEV;
4945:	
4946:		/* Don't allow speed changes at reset, except usb 3.0 to faster */
4947:		if (oldspeed != USB_SPEED_UNKNOWN && oldspeed != udev->speed &&
4948:		    !(oldspeed == USB_SPEED_SUPER && udev->speed > oldspeed)) {
4949:			dev_dbg(&udev->dev, "device reset changed speed!\n");
4950:			goto fail;
4951:		}
4952:		oldspeed = udev->speed;
4953:	
4954:		if (initial) {
4955:			/* USB 2.0 section 5.5.3 talks about ep0 maxpacket ...
4956:			 * it's fixed size except for full speed devices.
4957:			 */
4958:			switch (udev->speed) {
4959:			case USB_SPEED_SUPER_PLUS:
4960:			case USB_SPEED_SUPER:
4961:				udev->ep0.desc.wMaxPacketSize = cpu_to_le16(512);
4962:				break;
4963:			case USB_SPEED_HIGH:		/* fixed at 64 */
4964:				udev->ep0.desc.wMaxPacketSize = cpu_to_le16(64);
4965:				break;
4966:			case USB_SPEED_FULL:		/* 8, 16, 32, or 64 */
4967:				/* to determine the ep0 maxpacket size, try to read
4968:				 * the device descriptor to get bMaxPacketSize0 and
4969:				 * then correct our initial guess.
4970:				 */
4971:				udev->ep0.desc.wMaxPacketSize = cpu_to_le16(64);
4972:				break;
4973:			case USB_SPEED_LOW:		/* fixed at 8 */
4974:				udev->ep0.desc.wMaxPacketSize = cpu_to_le16(8);
4975:				break;
4976:			default:
4977:				goto fail;
4978:			}
4979:		}
4980:	
4981:		speed = usb_speed_string(udev->speed);
4982:	
4983:		/*
4984:		 * The controller driver may be NULL if the controller device
4985:		 * is the middle device between platform device and roothub.
4986:		 * This middle device may not need a device driver due to
4987:		 * all hardware control can be at platform device driver, this
4988:		 * platform device is usually a dual-role USB controller device.
4989:		 */
4990:		if (udev->bus->controller->driver)
4991:			driver_name = udev->bus->controller->driver->name;
4992:		else
4993:			driver_name = udev->bus->sysdev->driver->name;
4994:	
4995:		if (udev->speed < USB_SPEED_SUPER)
4996:			dev_info(&udev->dev,
4997:					"%s %s USB device number %d using %s\n",
4998:					(initial ? "new" : "reset"), speed,
4999:					devnum, driver_name);
5000:	
5001:		if (initial) {
5002:			/* Set up TT records, if needed  */
5003:			if (hdev->tt) {
5004:				udev->tt = hdev->tt;
5005:				udev->ttport = hdev->ttport;
5006:			} else if (udev->speed != USB_SPEED_HIGH
5007:					&& hdev->speed == USB_SPEED_HIGH) {
5008:				if (!hub->tt.hub) {
5009:					dev_err(&udev->dev, "parent hub has no TT\n");
5010:					retval = -EINVAL;
5011:					goto fail;
5012:				}
5013:				udev->tt = &hub->tt;
5014:				udev->ttport = port1;
5015:			}
5016:		}
5017:	
5018:		/* Why interleave GET_DESCRIPTOR and SET_ADDRESS this way?
5019:		 * Because device hardware and firmware is sometimes buggy in
5020:		 * this area, and this is how Linux has done it for ages.
5021:		 * Change it cautiously.
5022:		 *
5023:		 * NOTE:  If use_new_scheme() is true we will start by issuing
5024:		 * a 64-byte GET_DESCRIPTOR request.  This is what Windows does,
5025:		 * so it may help with some non-standards-compliant devices.
5026:		 * Otherwise we start with SET_ADDRESS and then try to read the
5027:		 * first 8 bytes of the device descriptor to get the ep0 maxpacket
5028:		 * value.
5029:		 */
5030:		do_new_scheme = use_new_scheme(udev, retry_counter, port_dev);
5031:	
5032:		for (retries = 0; retries < GET_DESCRIPTOR_TRIES; (++retries, msleep(100))) {
5033:			if (hub_port_stop_enumerate(hub, port1, retries)) {
5034:				retval = -ENODEV;
5035:				break;
5036:			}
5037:	
5038:			if (do_new_scheme) {
5039:				retval = hub_enable_device(udev);
5040:				if (retval < 0) {
5041:					dev_err(&udev->dev,
5042:						"hub failed to enable device, error %d\n",
5043:						retval);
5044:					goto fail;
5045:				}
5046:	
5047:				maxp0 = get_bMaxPacketSize0(udev, buf,
5048:						GET_DESCRIPTOR_BUFSIZE, retries == 0);
5049:				if (maxp0 > 0 && !initial &&
5050:						maxp0 != udev->descriptor.bMaxPacketSize0) {
5051:					dev_err(&udev->dev, "device reset changed ep0 maxpacket size!\n");
5052:					retval = -ENODEV;
5053:					goto fail;
5054:				}
5055:	
5056:				retval = hub_port_reset(hub, port1, udev, delay, false);
5057:				if (retval < 0)		/* error or disconnect */
5058:					goto fail;
5059:				if (oldspeed != udev->speed) {
5060:					dev_dbg(&udev->dev,
5061:						"device reset changed speed!\n");
5062:					retval = -ENODEV;
5063:					goto fail;
5064:				}
5065:				if (maxp0 < 0) {
5066:					if (maxp0 != -ENODEV)
5067:						dev_err(&udev->dev, "device descriptor read/64, error %d\n",
5068:								maxp0);
5069:					retval = maxp0;
5070:					continue;
5071:				}
5072:			}
5073:	
5074:			for (operations = 0; operations < SET_ADDRESS_TRIES; ++operations) {
5075:				retval = hub_set_address(udev, devnum);
5076:				if (retval >= 0)
5077:					break;
5078:				msleep(200);
5079:			}
5080:			if (retval < 0) {
5081:				if (retval != -ENODEV)
5082:					dev_err(&udev->dev, "device not accepting address %d, error %d\n",
5083:							devnum, retval);
5084:				goto fail;
5085:			}
5086:			if (udev->speed >= USB_SPEED_SUPER) {
5087:				devnum = udev->devnum;
5088:				dev_info(&udev->dev,
5089:						"%s SuperSpeed%s%s USB device number %d using %s\n",
5090:						(udev->config) ? "reset" : "new",
5091:					 (udev->speed == USB_SPEED_SUPER_PLUS) ?
5092:							" Plus" : "",
5093:					 (udev->ssp_rate == USB_SSP_GEN_2x2) ?
5094:							" Gen 2x2" :
5095:					 (udev->ssp_rate == USB_SSP_GEN_2x1) ?
5096:							" Gen 2x1" :
5097:					 (udev->ssp_rate == USB_SSP_GEN_1x2) ?
5098:							" Gen 1x2" : "",
5099:					 devnum, driver_name);
5100:			}
5101:	
5102:			/*
5103:			 * cope with hardware quirkiness:
5104:			 *  - let SET_ADDRESS settle, some device hardware wants it
5105:			 *  - read ep0 maxpacket even for high and low speed,
5106:			 */
5107:			msleep(10);
5108:	
5109:			if (do_new_scheme)
5110:				break;
5111:	
5112:			maxp0 = get_bMaxPacketSize0(udev, buf, 8, retries == 0);
5113:			if (maxp0 < 0) {
5114:				retval = maxp0;
5115:				if (retval != -ENODEV)
5116:					dev_err(&udev->dev,
5117:						"device descriptor read/8, error %d\n",
5118:						retval);
5119:			} else {
5120:				u32 delay;
5121:	
5122:				if (!initial && maxp0 != udev->descriptor.bMaxPacketSize0) {
5123:					dev_err(&udev->dev, "device reset changed ep0 maxpacket size!\n");
5124:					retval = -ENODEV;
5125:					goto fail;
5126:				}
5127:	
5128:				delay = udev->parent->hub_delay;
5129:				udev->hub_delay = min_t(u32, delay,
5130:							USB_TP_TRANSMISSION_DELAY_MAX);
5131:				retval = usb_set_isoch_delay(udev);
5132:				if (retval) {
5133:					dev_dbg(&udev->dev,
5134:						"Failed set isoch delay, error %d\n",
5135:						retval);
5136:					retval = 0;
5137:				}
5138:				break;
5139:			}
5140:		}
5141:		if (retval)
5142:			goto fail;
5143:	
5144:		/*
5145:		 * Check the ep0 maxpacket guess and correct it if necessary.
5146:		 * maxp0 is the value stored in the device descriptor;
5147:		 * i is the value it encodes (logarithmic for SuperSpeed or greater).
5148:		 */
5149:		i = maxp0;
5150:		if (udev->speed >= USB_SPEED_SUPER) {
5151:			if (maxp0 <= 16)
5152:				i = 1 << maxp0;
5153:			else
5154:				i = 0;		/* Invalid */
5155:		}
5156:		if (usb_endpoint_maxp(&udev->ep0.desc) == i) {
5157:			;	/* Initial ep0 maxpacket guess is right */
5158:		} else if (((udev->speed == USB_SPEED_FULL ||
5159:					udev->speed == USB_SPEED_HIGH) &&
5160:				(i == 8 || i == 16 || i == 32 || i == 64)) ||
5161:				(udev->speed >= USB_SPEED_SUPER && i > 0)) {
5162:			/* Initial guess is wrong; use the descriptor's value */
5163:			if (udev->speed == USB_SPEED_FULL)
5164:				dev_dbg(&udev->dev, "ep0 maxpacket = %d\n", i);
5165:			else
5166:				dev_warn(&udev->dev, "Using ep0 maxpacket: %d\n", i);
5167:			udev->ep0.desc.wMaxPacketSize = cpu_to_le16(i);
5168:			usb_ep0_reinit(udev);
5169:		} else {
5170:			/* Initial guess is wrong and descriptor's value is invalid */
5171:			dev_err(&udev->dev, "Invalid ep0 maxpacket: %d\n", maxp0);
5172:			retval = -EMSGSIZE;
5173:			goto fail;
5174:		}
5175:	
5176:		descr = usb_get_device_descriptor(udev);
5177:		if (IS_ERR(descr)) {
5178:			retval = PTR_ERR(descr);
5179:			if (retval != -ENODEV)
5180:				dev_err(&udev->dev, "device descriptor read/all, error %d\n",
5181:						retval);
5182:			goto fail;
5183:		}
5184:		if (initial)
5185:			udev->descriptor = *descr;
5186:		else
5187:			*dev_descr = *descr;
5188:		kfree(descr);
5189:	
5190:		/*
5191:		 * Some superspeed devices have finished the link training process
5192:		 * and attached to a superspeed hub port, but the device descriptor
5193:		 * got from those devices show they aren't superspeed devices. Warm
5194:		 * reset the port attached by the devices can fix them.
5195:		 */
5196:		if ((udev->speed >= USB_SPEED_SUPER) &&
5197:				(le16_to_cpu(udev->descriptor.bcdUSB) < 0x0300)) {
5198:			dev_err(&udev->dev, "got a wrong device descriptor, warm reset device\n");
5199:			hub_port_reset(hub, port1, udev, HUB_BH_RESET_TIME, true);
5200:			retval = -EINVAL;
5201:			goto fail;
5202:		}
5203:	
5204:		usb_detect_quirks(udev);
5205:	
5206:		if (le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0201) {
5207:			retval = usb_get_bos_descriptor(udev);
5208:			if (!retval) {
5209:				udev->lpm_capable = usb_device_supports_lpm(udev);
5210:				udev->lpm_disable_count = 1;
5211:				usb_set_lpm_parameters(udev);
5212:				usb_req_set_sel(udev);
5213:			}
5214:		}
5215:	
5216:		retval = 0;
5217:		/* notify HCD that we have a device connected and addressed */
5218:		if (hcd->driver->update_device)
5219:			hcd->driver->update_device(hcd, udev);
5220:		hub_set_initial_usb2_lpm_policy(udev);
5221:	fail:
5222:		if (retval) {
5223:			hub_port_disable(hub, port1, 0);
5224:			update_devnum(udev, devnum);	/* for disconnect processing */
5225:		}
5226:		kfree(buf);
5227:		return retval;
5228:	}
 SourceFile:drivers/usb/core/hub.c]

gemini-3-flash-preview

							input: 26175
							output: 45
							thoughts: 58
						

**Analyzing USB Device Descriptor Retrieval**

Okay, so I'm thinking through this USB descriptor retrieval process. The key point here is that if `usb_get_device_descriptor` hands us back a descriptor filled entirely with zeros, then the crucial `bLength` field is going to be set to zero as well. That’s a pretty important indicator of something going wrong.

Now, let's step back a bit to understand how we're getting here. `usb_get_device_descriptor` is calling `usb_get_descriptor`. So, I'm going to want to track that and see how that is functioning, to understand better what is happening.

Let's dive into the code for `usb_get_device_descriptor`. I want to see what's happening.

map[ContextFile:drivers/usb/core/message.c IncludeLines:true Name:usb_get_device_descriptor]

map[SourceCode:1103:	/*
1104:	 * usb_get_device_descriptor - read the device descriptor
1105:	 * @udev: the device whose device descriptor should be read
1106:	 *
1107:	 * Context: task context, might sleep.
1108:	 *
1109:	 * Not exported, only for use by the core.  If drivers really want to read
1110:	 * the device descriptor directly, they can call usb_get_descriptor() with
1111:	 * type = USB_DT_DEVICE and index = 0.
1112:	 *
1113:	 * Returns: a pointer to a dynamically allocated usb_device_descriptor
1114:	 * structure (which the caller must deallocate), or an ERR_PTR value.
1115:	 */
1116:	struct usb_device_descriptor *usb_get_device_descriptor(struct usb_device *udev)
1117:	{
1118:		struct usb_device_descriptor *desc;
1119:		int ret;
1120:	
1121:		desc = kmalloc_obj(*desc, GFP_NOIO);
1122:		if (!desc)
1123:			return ERR_PTR(-ENOMEM);
1124:	
1125:		ret = usb_get_descriptor(udev, USB_DT_DEVICE, 0, desc, sizeof(*desc));
1126:		if (ret == sizeof(*desc))
1127:			return desc;
1128:	
1129:		if (ret >= 0)
1130:			ret = -EMSGSIZE;
1131:		kfree(desc);
1132:		return ERR_PTR(ret);
1133:	}
 SourceFile:drivers/usb/core/message.c]

gemini-3-flash-preview

							input: 26938
							output: 43
							thoughts: 265
						

**Analyzing a Potential USB Descriptor Zero-Length Issue**

Okay, so I'm digging into this `usb_get_descriptor` function, and something's not quite clicking. It seems if the call returns all zeros, but the return value *is* `sizeof(*desc)`, we actually get the descriptor. The device (specifically, the emulated one from syzkaller) could be returning all zeroes, and the return value (`ret`) is still going to be, say, 18 bytes (the size of a device descriptor). Then `usb_get_device_descriptor` is called, and it returns it. Then, during the `hub_port_init` process, we set `udev->descriptor = *descr;`.

Now, if `udev->descriptor.bLength` ends up being zero, that feels like a recipe for trouble down the line. I need to figure out what happens.

Ah, right, `usb_get_descriptor` is:
```c
int usb_get_descriptor(struct usb_device *dev, unsigned char type,
		unsigned char index, void *buf, int size)
```
It returns the number of bytes received, not a boolean, so the all-zeros condition is less surprising.

So, if `udev->descriptor.bLength` is zero, we're going to hit the `usb_detect_quirks(udev)` function. This happens before `usb_enumerate_device`, which is called within `hub_port_connect_change` after `hub_port_init`. That's where I need to focus.

Okay, let's dive into `usb_enumerate_device` in `drivers/usb/core/hub.c` and see if anything jumps out. I want to understand what it *expects* in the descriptor and if it handles a zero-length one gracefully (or, more likely, throws an error).

map[ContextFile:drivers/usb/core/hub.c IncludeLines:true Name:usb_enumerate_device]

map[SourceCode:2508:	/**
2509:	 * usb_enumerate_device - Read device configs/intfs/otg (usbcore-internal)
2510:	 * @udev: newly addressed device (in ADDRESS state)
2511:	 *
2512:	 * This is only called by usb_new_device() -- all comments that apply there
2513:	 * apply here wrt to environment.
2514:	 *
2515:	 * If the device is WUSB and not authorized, we don't attempt to read
2516:	 * the string descriptors, as they will be errored out by the device
2517:	 * until it has been authorized.
2518:	 *
2519:	 * Return: 0 if successful. A negative error code otherwise.
2520:	 */
2521:	static int usb_enumerate_device(struct usb_device *udev)
2522:	{
2523:		int err;
2524:		struct usb_hcd *hcd = bus_to_hcd(udev->bus);
2525:	
2526:		if (udev->config == NULL) {
2527:			err = usb_get_configuration(udev);
2528:			if (err < 0) {
2529:				if (err != -ENODEV)
2530:					dev_err(&udev->dev, "can't read configurations, error %d\n",
2531:							err);
2532:				return err;
2533:			}
2534:		}
2535:	
2536:		/* read the standard strings and cache them if present */
2537:		udev->product = usb_cache_string(udev, udev->descriptor.iProduct);
2538:		udev->manufacturer = usb_cache_string(udev,
2539:						      udev->descriptor.iManufacturer);
2540:		udev->serial = usb_cache_string(udev, udev->descriptor.iSerialNumber);
2541:	
2542:		err = usb_enumerate_device_otg(udev);
2543:		if (err < 0)
2544:			return err;
2545:	
2546:		if (IS_ENABLED(CONFIG_USB_OTG_PRODUCTLIST) && hcd->tpl_support &&
2547:			!is_targeted(udev)) {
2548:			/* Maybe it can talk to us, though we can't talk to it.
2549:			 * (Includes HNP test device.)
2550:			 */
2551:			if (IS_ENABLED(CONFIG_USB_OTG) && (udev->bus->b_hnp_enable
2552:				|| udev->bus->is_b_host)) {
2553:				err = usb_port_suspend(udev, PMSG_AUTO_SUSPEND);
2554:				if (err < 0)
2555:					dev_dbg(&udev->dev, "HNP fail, %d\n", err);
2556:			}
2557:			return -ENOTSUPP;
2558:		}
2559:	
2560:		usb_detect_interface_quirks(udev);
2561:	
2562:		return 0;
2563:	}
 SourceFile:drivers/usb/core/hub.c]

gemini-3-flash-preview

							input: 28558
							output: 43
							thoughts: 68
						

Here's my understanding of the situation, framed as my own thought process:

**USB Configuration Retrieval Analysis**

Okay, so we're starting with `usb_get_configuration`. My initial thought is to figure out how this function works, specifically how it figures out the number of configurations available. Based on what I've seen, it's grabbing `bNumConfigurations` directly from the `udev->descriptor`. This makes sense, that's where the basic device capabilities would reside.

Now, a red flag popped up: if the entire `udev->descriptor` is zeroed out, then `bNumConfigurations` would also be zero. That's an interesting edge case to consider and could be problematic. I need to understand if this is expected, or if there's a problem here.

Time to dive into the source. Let's head over to `drivers/usb/core/config.c` and see exactly how `usb_get_configuration` handles the descriptor and the extraction of `bNumConfigurations`. I'll need to see the logic around how the descriptor is populated and what happens when it's all zeros. I'm especially keen to see if any error handling is present.

map[ContextFile:drivers/usb/core/config.c IncludeLines:true Name:usb_get_configuration]

map[SourceCode: 909:	/*
 910:	 * Get the USB config descriptors, cache and parse'em
 911:	 *
 912:	 * hub-only!! ... and only in reset path, or usb_new_device()
 913:	 * (used by real hubs and virtual root hubs)
 914:	 */
 915:	int usb_get_configuration(struct usb_device *dev)
 916:	{
 917:		struct device *ddev = &dev->dev;
 918:		int ncfg = dev->descriptor.bNumConfigurations;
 919:		unsigned int cfgno, length;
 920:		unsigned char *bigbuffer;
 921:		struct usb_config_descriptor *desc;
 922:		int result;
 923:	
 924:		if (ncfg > USB_MAXCONFIG) {
 925:			dev_notice(ddev, "too many configurations: %d, "
 926:			    "using maximum allowed: %d\n", ncfg, USB_MAXCONFIG);
 927:			dev->descriptor.bNumConfigurations = ncfg = USB_MAXCONFIG;
 928:		}
 929:	
 930:		if (ncfg < 1 && dev->quirks & USB_QUIRK_FORCE_ONE_CONFIG) {
 931:			dev_info(ddev, "Device claims zero configurations, forcing to 1\n");
 932:			dev->descriptor.bNumConfigurations = 1;
 933:			ncfg = 1;
 934:		} else if (ncfg < 1) {
 935:			dev_err(ddev, "no configurations\n");
 936:			return -EINVAL;
 937:		}
 938:	
 939:		length = ncfg * sizeof(struct usb_host_config);
 940:		dev->config = kzalloc(length, GFP_KERNEL);
 941:		if (!dev->config)
 942:			return -ENOMEM;
 943:	
 944:		length = ncfg * sizeof(char *);
 945:		dev->rawdescriptors = kzalloc(length, GFP_KERNEL);
 946:		if (!dev->rawdescriptors)
 947:			return -ENOMEM;
 948:	
 949:		desc = kmalloc(USB_DT_CONFIG_SIZE, GFP_KERNEL);
 950:		if (!desc)
 951:			return -ENOMEM;
 952:	
 953:		for (cfgno = 0; cfgno < ncfg; cfgno++) {
 954:			/* We grab just the first descriptor so we know how long
 955:			 * the whole configuration is */
 956:			result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno,
 957:			    desc, USB_DT_CONFIG_SIZE);
 958:			if (result < 0) {
 959:				dev_err(ddev, "unable to read config index %d "
 960:				    "descriptor/%s: %d\n", cfgno, "start", result);
 961:				if (result != -EPIPE)
 962:					goto err;
 963:				dev_notice(ddev, "chopping to %d config(s)\n", cfgno);
 964:				dev->descriptor.bNumConfigurations = cfgno;
 965:				break;
 966:			} else if (result < 4) {
 967:				dev_err(ddev, "config index %d descriptor too short "
 968:				    "(expected %i, got %i)\n", cfgno,
 969:				    USB_DT_CONFIG_SIZE, result);
 970:				result = -EINVAL;
 971:				goto err;
 972:			}
 973:			length = max_t(int, le16_to_cpu(desc->wTotalLength),
 974:			    USB_DT_CONFIG_SIZE);
 975:	
 976:			/* Now that we know the length, get the whole thing */
 977:			bigbuffer = kmalloc(length, GFP_KERNEL);
 978:			if (!bigbuffer) {
 979:				result = -ENOMEM;
 980:				goto err;
 981:			}
 982:	
 983:			if (dev->quirks & USB_QUIRK_DELAY_INIT)
 984:				msleep(200);
 985:	
 986:			result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno,
 987:			    bigbuffer, length);
 988:			if (result < 0) {
 989:				dev_err(ddev, "unable to read config index %d "
 990:				    "descriptor/%s\n", cfgno, "all");
 991:				kfree(bigbuffer);
 992:				goto err;
 993:			}
 994:			if (result < length) {
 995:				dev_notice(ddev, "config index %d descriptor too short "
 996:				    "(expected %i, got %i)\n", cfgno, length, result);
 997:				length = result;
 998:			}
 999:	
1000:			dev->rawdescriptors[cfgno] = bigbuffer;
1001:	
1002:			result = usb_parse_configuration(dev, cfgno,
1003:			    &dev->config[cfgno], bigbuffer, length);
1004:			if (result < 0) {
1005:				++cfgno;
1006:				goto err;
1007:			}
1008:		}
1009:	
1010:	err:
1011:		kfree(desc);
1012:		dev->descriptor.bNumConfigurations = cfgno;
1013:	
1014:		return result;
1015:	}
 SourceFile:drivers/usb/core/config.c]

gemini-3-flash-preview

							input: 30582
							output: 43
							thoughts: 999
						

**Analyzing the USB Device Enumeration Failure**

Okay, let me break this down. My initial thought was: if `ncfg < 1` returns `-EINVAL`. If the device descriptor is all zeros, `bNumConfigurations` is 0, then `usb_get_configuration` fails, leading to `-EINVAL`. The device wouldn't enumerate, and no driver would be probed. Simple enough, right?

But then the user throws a wrench in. They say the reproducer calls `syz_usb_control_io` for the *second* device, and that it contains responses for the `asix` driver. Now that's confusing. If the device isn't enumerated, how is the kernel sending requests for `syz_usb_control_io`? That pseudo-syscall sends responses, when the kernel requests them. If the kernel isn't requesting anything, it would seem it might just hang.

Wait! They also say, "How can asix be probed if `idVendor=0`?". The user seems to think `asix` *is* being probed, or they are seeing something that looks like it.

It's crucial to understand the context of the devices being created. The user says: "The first device is `0x0db0:0x6869` (rt2500usb). The second device is uninitialized (all zeros). The third device is `0x0bda:0x5088` (rtl8192cu)." So, if the reproducer does:

```c
syz_usb_connect(..., &dev1_descriptors, ...);
syz_usb_connect(..., &dev2_descriptors, ...);
syz_usb_connect(..., &dev3_descriptors, ...);
```

and `dev2_descriptors` is all zeros, maybe the user is referring to the *index* of the device in the array!

Okay, let's circle back to `asix`. Is there any way it *could* be probed for a device that doesn't match its ID table? Only if another driver (like `usbnet`) calls it, or if there's a generic match. `asix` is a `usb_driver`, so it should be bound to `usb_interface`.

Here's a thought! The user mentions that the C reproducer initializes only the first 9 bytes of the configuration descriptor (the `usb_config_descriptor` part) and leaves the `usb_interface_descriptor` as all zeros. That means `bLength` of the interface descriptor is 0!

In `usb_parse_configuration`, if `bLength` is 0, the code hits `header->bLength < 2`, prints a notice, and breaks the loop. This means `n` (the number of interfaces) will be whatever was found before the broken descriptor (likely 0). Then `config->desc.bNumInterfaces = nintf = n = 0`. Even though `usb_new_device` might continue, `usb_probe_device` won't find any interfaces to probe because `bNumInterfaces` is zero!

Remember, the `usb_device` itself doesn't typically have a driver (except the generic one). Drivers match `usb_interface` descriptors. If there are zero interfaces, there are no `usb_interface` devices. This is where the problem likely lies. I should look into `usb_set_configuration` to confirm.

map[ContextFile:drivers/usb/core/message.c IncludeLines:true Name:usb_set_configuration]

map[SourceCode:2010:	/*
2011:	 * usb_set_configuration - Makes a particular device setting be current
2012:	 * @dev: the device whose configuration is being updated
2013:	 * @configuration: the configuration being chosen.
2014:	 *
2015:	 * Context: task context, might sleep. Caller holds device lock.
2016:	 *
2017:	 * This is used to enable non-default device modes.  Not all devices
2018:	 * use this kind of configurability; many devices only have one
2019:	 * configuration.
2020:	 *
2021:	 * @configuration is the value of the configuration to be installed.
2022:	 * According to the USB spec (e.g. section 9.1.1.5), configuration values
2023:	 * must be non-zero; a value of zero indicates that the device in
2024:	 * unconfigured.  However some devices erroneously use 0 as one of their
2025:	 * configuration values.  To help manage such devices, this routine will
2026:	 * accept @configuration = -1 as indicating the device should be put in
2027:	 * an unconfigured state.
2028:	 *
2029:	 * USB device configurations may affect Linux interoperability,
2030:	 * power consumption and the functionality available.  For example,
2031:	 * the default configuration is limited to using 100mA of bus power,
2032:	 * so that when certain device functionality requires more power,
2033:	 * and the device is bus powered, that functionality should be in some
2034:	 * non-default device configuration.  Other device modes may also be
2035:	 * reflected as configuration options, such as whether two ISDN
2036:	 * channels are available independently; and choosing between open
2037:	 * standard device protocols (like CDC) or proprietary ones.
2038:	 *
2039:	 * Note that a non-authorized device (dev->authorized == 0) will only
2040:	 * be put in unconfigured mode.
2041:	 *
2042:	 * Note that USB has an additional level of device configurability,
2043:	 * associated with interfaces.  That configurability is accessed using
2044:	 * usb_set_interface().
2045:	 *
2046:	 * This call is synchronous. The calling context must be able to sleep,
2047:	 * must own the device lock, and must not hold the driver model's USB
2048:	 * bus mutex; usb interface driver probe() methods cannot use this routine.
2049:	 *
2050:	 * Returns zero on success, or else the status code returned by the
2051:	 * underlying call that failed.  On successful completion, each interface
2052:	 * in the original device configuration has been destroyed, and each one
2053:	 * in the new configuration has been probed by all relevant usb device
2054:	 * drivers currently known to the kernel.
2055:	 */
2056:	int usb_set_configuration(struct usb_device *dev, int configuration)
2057:	{
2058:		int i, ret;
2059:		struct usb_host_config *cp = NULL;
2060:		struct usb_interface **new_interfaces = NULL;
2061:		struct usb_hcd *hcd = bus_to_hcd(dev->bus);
2062:		int n, nintf;
2063:	
2064:		if (dev->authorized == 0 || configuration == -1)
2065:			configuration = 0;
2066:		else {
2067:			for (i = 0; i < dev->descriptor.bNumConfigurations; i++) {
2068:				if (dev->config[i].desc.bConfigurationValue ==
2069:						configuration) {
2070:					cp = &dev->config[i];
2071:					break;
2072:				}
2073:			}
2074:		}
2075:		if ((!cp && configuration != 0))
2076:			return -EINVAL;
2077:	
2078:		/* The USB spec says configuration 0 means unconfigured.
2079:		 * But if a device includes a configuration numbered 0,
2080:		 * we will accept it as a correctly configured state.
2081:		 * Use -1 if you really want to unconfigure the device.
2082:		 */
2083:		if (cp && configuration == 0)
2084:			dev_warn(&dev->dev, "config 0 descriptor??\n");
2085:	
2086:		/* Allocate memory for new interfaces before doing anything else,
2087:		 * so that if we run out then nothing will have changed. */
2088:		n = nintf = 0;
2089:		if (cp) {
2090:			nintf = cp->desc.bNumInterfaces;
2091:			new_interfaces = kmalloc_objs(*new_interfaces, nintf, GFP_NOIO);
2092:			if (!new_interfaces)
2093:				return -ENOMEM;
2094:	
2095:			for (; n < nintf; ++n) {
2096:				new_interfaces[n] = kzalloc_obj(struct usb_interface,
2097:								GFP_NOIO);
2098:				if (!new_interfaces[n]) {
2099:					ret = -ENOMEM;
2100:	free_interfaces:
2101:					while (--n >= 0)
2102:						kfree(new_interfaces[n]);
2103:					kfree(new_interfaces);
2104:					return ret;
2105:				}
2106:			}
2107:	
2108:			i = dev->bus_mA - usb_get_max_power(dev, cp);
2109:			if (i < 0)
2110:				dev_warn(&dev->dev, "new config #%d exceeds power "
2111:						"limit by %dmA\n",
2112:						configuration, -i);
2113:		}
2114:	
2115:		/* Wake up the device so we can send it the Set-Config request */
2116:		ret = usb_autoresume_device(dev);
2117:		if (ret)
2118:			goto free_interfaces;
2119:	
2120:		/* if it's already configured, clear out old state first.
2121:		 * getting rid of old interfaces means unbinding their drivers.
2122:		 */
2123:		if (dev->state != USB_STATE_ADDRESS)
2124:			usb_disable_device(dev, 1);	/* Skip ep0 */
2125:	
2126:		/* Get rid of pending async Set-Config requests for this device */
2127:		cancel_async_set_config(dev);
2128:	
2129:		/* Make sure we have bandwidth (and available HCD resources) for this
2130:		 * configuration.  Remove endpoints from the schedule if we're dropping
2131:		 * this configuration to set configuration 0.  After this point, the
2132:		 * host controller will not allow submissions to dropped endpoints.  If
2133:		 * this call fails, the device state is unchanged.
2134:		 */
2135:		mutex_lock(hcd->bandwidth_mutex);
2136:		/* Disable LPM, and re-enable it once the new configuration is
2137:		 * installed, so that the xHCI driver can recalculate the U1/U2
2138:		 * timeouts.
2139:		 */
2140:		if (dev->actconfig && usb_disable_lpm(dev)) {
2141:			dev_err(&dev->dev, "%s Failed to disable LPM\n", __func__);
2142:			mutex_unlock(hcd->bandwidth_mutex);
2143:			ret = -ENOMEM;
2144:			goto free_interfaces;
2145:		}
2146:		ret = usb_hcd_alloc_bandwidth(dev, cp, NULL, NULL);
2147:		if (ret < 0) {
2148:			if (dev->actconfig)
2149:				usb_enable_lpm(dev);
2150:			mutex_unlock(hcd->bandwidth_mutex);
2151:			usb_autosuspend_device(dev);
2152:			goto free_interfaces;
2153:		}
2154:	
2155:		/*
2156:		 * Initialize the new interface structures and the
2157:		 * hc/hcd/usbcore interface/endpoint state.
2158:		 */
2159:		for (i = 0; i < nintf; ++i) {
2160:			struct usb_interface_cache *intfc;
2161:			struct usb_interface *intf;
2162:			struct usb_host_interface *alt;
2163:			u8 ifnum;
2164:	
2165:			cp->interface[i] = intf = new_interfaces[i];
2166:			intfc = cp->intf_cache[i];
2167:			intf->altsetting = intfc->altsetting;
2168:			intf->num_altsetting = intfc->num_altsetting;
2169:			intf->authorized = !!HCD_INTF_AUTHORIZED(hcd);
2170:			kref_get(&intfc->ref);
2171:	
2172:			alt = usb_altnum_to_altsetting(intf, 0);
2173:	
2174:			/* No altsetting 0?  We'll assume the first altsetting.
2175:			 * We could use a GetInterface call, but if a device is
2176:			 * so non-compliant that it doesn't have altsetting 0
2177:			 * then I wouldn't trust its reply anyway.
2178:			 */
2179:			if (!alt)
2180:				alt = &intf->altsetting[0];
2181:	
2182:			ifnum = alt->desc.bInterfaceNumber;
2183:			intf->intf_assoc = find_iad(dev, cp, ifnum);
2184:			intf->cur_altsetting = alt;
2185:			usb_enable_interface(dev, intf, true);
2186:			intf->dev.parent = &dev->dev;
2187:			if (usb_of_has_combined_node(dev)) {
2188:				device_set_of_node_from_dev(&intf->dev, &dev->dev);
2189:			} else {
2190:				intf->dev.of_node = usb_of_get_interface_node(dev,
2191:						configuration, ifnum);
2192:			}
2193:			ACPI_COMPANION_SET(&intf->dev, ACPI_COMPANION(&dev->dev));
2194:			intf->dev.driver = NULL;
2195:			intf->dev.bus = &usb_bus_type;
2196:			intf->dev.type = &usb_if_device_type;
2197:			intf->dev.groups = usb_interface_groups;
2198:			INIT_WORK(&intf->reset_ws, __usb_queue_reset_device);
2199:			INIT_WORK(&intf->wireless_status_work, __usb_wireless_status_intf);
2200:			intf->minor = -1;
2201:			device_initialize(&intf->dev);
2202:			pm_runtime_no_callbacks(&intf->dev);
2203:			dev_set_name(&intf->dev, "%d-%s:%d.%d", dev->bus->busnum,
2204:					dev->devpath, configuration, ifnum);
2205:			usb_get_dev(dev);
2206:		}
2207:		kfree(new_interfaces);
2208:	
2209:		ret = usb_control_msg_send(dev, 0, USB_REQ_SET_CONFIGURATION, 0,
2210:					   configuration, 0, NULL, 0,
2211:					   USB_CTRL_SET_TIMEOUT, GFP_NOIO);
2212:		if (ret && cp) {
2213:			/*
2214:			 * All the old state is gone, so what else can we do?
2215:			 * The device is probably useless now anyway.
2216:			 */
2217:			usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
2218:			for (i = 0; i < nintf; ++i) {
2219:				usb_disable_interface(dev, cp->interface[i], true);
2220:				put_device(&cp->interface[i]->dev);
2221:				cp->interface[i] = NULL;
2222:			}
2223:			cp = NULL;
2224:		}
2225:	
2226:		dev->actconfig = cp;
2227:		mutex_unlock(hcd->bandwidth_mutex);
2228:	
2229:		if (!cp) {
2230:			usb_set_device_state(dev, USB_STATE_ADDRESS);
2231:	
2232:			/* Leave LPM disabled while the device is unconfigured. */
2233:			usb_autosuspend_device(dev);
2234:			return ret;
2235:		}
2236:		usb_set_device_state(dev, USB_STATE_CONFIGURED);
2237:	
2238:		if (cp->string == NULL &&
2239:				!(dev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
2240:			cp->string = usb_cache_string(dev, cp->desc.iConfiguration);
2241:	
2242:		/* Now that the interfaces are installed, re-enable LPM. */
2243:		usb_unlocked_enable_lpm(dev);
2244:		/* Enable LTM if it was turned off by usb_disable_device. */
2245:		usb_enable_ltm(dev);
2246:	
2247:		/* Now that all the interfaces are set up, register them
2248:		 * to trigger binding of drivers to interfaces.  probe()
2249:		 * routines may install different altsettings and may
2250:		 * claim() any interfaces not yet bound.  Many class drivers
2251:		 * need that: CDC, audio, video, etc.
2252:		 */
2253:		for (i = 0; i < nintf; ++i) {
2254:			struct usb_interface *intf = cp->interface[i];
2255:	
2256:			if (intf->dev.of_node &&
2257:			    !of_device_is_available(intf->dev.of_node)) {
2258:				dev_info(&dev->dev, "skipping disabled interface %d\n",
2259:					 intf->cur_altsetting->desc.bInterfaceNumber);
2260:				continue;
2261:			}
2262:	
2263:			dev_dbg(&dev->dev,
2264:				"adding %s (config #%d, interface %d)\n",
2265:				dev_name(&intf->dev), configuration,
2266:				intf->cur_altsetting->desc.bInterfaceNumber);
2267:			device_enable_async_suspend(&intf->dev);
2268:			ret = device_add(&intf->dev);
2269:			if (ret != 0) {
2270:				dev_err(&dev->dev, "device_add(%s) --> %d\n",
2271:					dev_name(&intf->dev), ret);
2272:				continue;
2273:			}
2274:			create_intf_ep_devs(intf);
2275:		}
2276:	
2277:		usb_autosuspend_device(dev);
2278:		return 0;
2279:	}
 SourceFile:drivers/usb/core/message.c]

gemini-3-flash-preview

							input: 36820
							output: 23
							thoughts: 1344
						

**Analyzing the USB Device Configuration Issue**

Okay, let's break this down. My initial thought was that if `bNumInterfaces` is zero, we're dealing with a configured device but no interfaces, which, while unusual, is valid according to the USB spec. The "all zeros" device, as described by the user, immediately threw up a flag. If `syz_usb_connect` receives all zeros, `usb_get_configuration` should fail, and the device shouldn't initialize.

The user's comment about `syz_usb_control_io` and the `asix` driver for the "second device" threw a wrench in that. I had to re-evaluate what the *second* device actually was. Maybe it was NOT the all-zeros one? Let's check the descriptions: Device 1: `0x0db0:0x6869` (rt2500usb). The second is the all-zeros. And Device 3: `0x0bda:0x5088` (rtl8192cu).

If the reproducer is connecting these devices sequentially and THEN running `syz_usb_control_io(1, ...)` on the *second* one, it might interact with something else or just fail.

The "how can `asix` be probed if `idVendor=0`?" comment really nagged at me. Maybe the `asix` driver isn't probing the all-zeros device, but something else? I looked up the vendor/product IDs of the other devices. `0x0db0:0x6869` is rt2500usb and `0x0bda:0x5088` is rtl8192cu. Neither match the `asix` driver, which is for ASIX chips.

I started to suspect a problem in how syzkaller's `syz_usb_connect` function works. Could that all-zeros device be triggering something in the USB core, perhaps via `raw-gadget`?

I went back to dissecting `usb_parse_configuration`. The user's description is key: the reproducer only initializes the first 9 bytes of the config descriptor (the `usb_config_descriptor` part), and then it leaves the following `usb_interface_descriptor` as all zeros. That means the `bLength` of the interface descriptor is zero.

Now it's starting to click. If `config->desc.bNumInterfaces` is *not* zero, but the following interface descriptor *does* have `bLength = 0`, the descriptor parsing will be weird. The loop at 702 will start with `nintf = 1` and, if it finds a `bLength=0` descriptor, it'll hit that check and immediately break out. So `n` will stay at zero, then the code will set `config->desc.bNumInterfaces = 0`. That explains the behavior the user is seeing.

The critical piece seems to be a valid *config* descriptor with a specified `bNumInterfaces` that's followed by a *bogus* interface descriptor with `bLength=0`. The USB core, in this scenario, will misinterpret the configuration.

Finally, why the `asix` driver? It might be irrelevant to the *second* device, the all-zeros one. It's likely involved with *one of the other devices*. I also checked for `0x0db0` and `0x6869` to see if those IDs were used in the kernel. `asix` is a `usbnet` driver.

log-in to see details

map[Name:0x0db0]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 38999
							output: 24
							thoughts: 9
						

Okay, here's the summary, rendered as your thoughts:

**Hex Value Hunting**

Alright, let's get down to brass tacks. My initial instinct is to go straight to the hex values. That's the most direct route, the most efficient starting point, and usually yields the most concrete results in situations like this. It's the language of the machine, the fundamental building blocks. It is what it is. I'll need to know which values to look for, which context they are in, and what they could mean. Let's dig in.

log-in to see details

map[Name:0x6869]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 39174
							output: 33
							thoughts: 7
						

Okay, here's my attempt at summarizing the thought process, tailored for an expert audience, and written in the first person:

**String Search Exploration**

Alright, let's see. The initial instinct, when facing a complex data structure or a large dataset, is often to try a simple, brute-force approach first. In this case, I'm thinking, "Let's see if we can locate these elements by treating them as strings." This might seem elementary, but it can be surprisingly effective, especially in the early stages of investigation. The advantage? String searching is generally well-optimized, and available as a basic operation in most programming languages and tools. It’s quick to implement and doesn’t require complex parsing initially. It can provide a useful baseline. If the data is poorly structured, or if I'm not entirely sure what I'm dealing with, a quick string search can provide a sanity check and show a quick overview of the environment. Essentially, it is quick way to look for "low hanging fruit" to see how the data presents itself. It also allows quick investigation of patterns, which are useful. If this yields promising results, it might offer an immediate solution, or at least a starting point for more sophisticated analysis. We're thinking, what's quick and dirty before we pull out the big guns.

map[Dir:drivers/net/wireless/ralink/rt2x00/]

map[Files:[rt2400pci.c rt2400pci.h rt2500pci.c rt2500pci.h rt2500usb.c rt2500usb.h rt2800.h rt2800lib.c rt2800lib.h rt2800mmio.c rt2800mmio.h rt2800pci.c rt2800pci.h rt2800soc.c rt2800usb.c rt2800usb.h rt2x00.h rt2x00config.c rt2x00crypto.c rt2x00debug.c rt2x00debug.h rt2x00dev.c rt2x00dump.h rt2x00firmware.c rt2x00leds.c rt2x00leds.h rt2x00lib.h rt2x00link.c rt2x00mac.c rt2x00mmio.c rt2x00mmio.h rt2x00pci.c rt2x00pci.h rt2x00queue.c rt2x00queue.h rt2x00reg.h rt2x00usb.c rt2x00usb.h rt61pci.c rt61pci.h rt73usb.c rt73usb.h] Subdirs:<nil>]

gemini-3-flash-preview

							input: 39974
							output: 60
							thoughts: 29
						

Here's my take on the process, crafted as a first-person account assuming expertise in kernel development and networking:

**Diving into the rt2500usb.c Driver**

Okay, so we need to look at the USB implementation of the RT2500 wireless chipset. Let's start with `drivers/net/wireless/ralink/rt2x00/rt2500usb.c`. This is where the core interaction with the USB bus for this specific device family should reside. I'll need to understand how the USB endpoints are configured, how data is transferred, and how the driver interacts with the rt2x00 core to manage the wireless functionality. It's likely that a lot of the standard rt2x00 framework is utilized here, but the USB-specific initialization and data transfer routines are what I'm most interested in at the moment. Time to see how they've handled the asynchronous transfer methods and if there are any potential bottlenecks there. Specifically, are they using URBs effectively? Also, I'll pay attention to any power management considerations and how the USB suspend/resume cycle is handled in relation to the wireless state. Let's see if there are any obvious areas for optimization. This will be the starting point.

log-in to see details

map[ContextFile:drivers/net/wireless/ralink/rt2x00/rt2500usb.c IncludeLines:true Name:rt2500usb_ids]

map[SourceCode: SourceFile:]

gemini-3-flash-preview

							input: 40353
							output: 38
							thoughts: 9
						

Okay, here's the summary, assuming I'm the expert you describe:

**Initial Assessment: File Inspection**

Alright, let's get down to brass tacks. First thing's first, I need to get a handle on what's actually *in* the file. No assumptions, no preconceived notions. I'll need to meticulously examine the raw content. I'm going to start by getting a clear picture of its format, structure, and any immediately obvious characteristics. Is it textual, binary, structured data, or something else entirely? Any clues as to the technology or system it's associated with will be valuable. This initial reconnaissance is key before even thinking about how to proceed. It's the groundwork; the foundation I need to build on. This is where I'll begin to form my mental model of what I'm dealing with.

map[File:drivers/net/wireless/ralink/rt2x00/rt2500usb.c]

map[Contents:// SPDX-License-Identifier: GPL-2.0-or-later
/*
	Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
	<http://rt2x00.serialmonkey.com>

 */

/*
	Module: rt2500usb
	Abstract: rt2500usb device specific routines.
	Supported chipsets: RT2570.
 */

#include <linux/delay.h>
#include <linux/etherdevice.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/slab.h>
#include <linux/usb.h>

#include "rt2x00.h"
#include "rt2x00usb.h"
#include "rt2500usb.h"

/*
 * Allow hardware encryption to be disabled.
 */
static bool modparam_nohwcrypt;
module_param_named(nohwcrypt, modparam_nohwcrypt, bool, 0444);
MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");

/*
 * Register access.
 * All access to the CSR registers will go through the methods
 * rt2500usb_register_read and rt2500usb_register_write.
 * BBP and RF register require indirect register access,
 * and use the CSR registers BBPCSR and RFCSR to achieve this.
 * These indirect registers work with busy bits,
 * and we will try maximal REGISTER_USB_BUSY_COUNT times to access
 * the register while taking a REGISTER_BUSY_DELAY us delay
 * between each attampt. When the busy bit is still set at that time,
 * the access attempt is considered to have failed,
 * and we will print an error.
 * If the csr_mutex is already held then the _lock variants must
 * be used instead.
 */
static u16 rt2500usb_register_read(struct rt2x00_dev *rt2x00dev,
				   const unsigned int offset)
{
	__le16 reg;
	rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_READ,
				      USB_VENDOR_REQUEST_IN, offset,
				      &reg, sizeof(reg));
	return le16_to_cpu(reg);
}

static u16 rt2500usb_register_read_lock(struct rt2x00_dev *rt2x00dev,
					const unsigned int offset)
{
	__le16 reg;
	rt2x00usb_vendor_req_buff_lock(rt2x00dev, USB_MULTI_READ,
				       USB_VENDOR_REQUEST_IN, offset,
				       &reg, sizeof(reg), REGISTER_TIMEOUT);
	return le16_to_cpu(reg);
}

static void rt2500usb_register_write(struct rt2x00_dev *rt2x00dev,
					    const unsigned int offset,
					    u16 value)
{
	__le16 reg = cpu_to_le16(value);
	rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_WRITE,
				      USB_VENDOR_REQUEST_OUT, offset,
				      &reg, sizeof(reg));
}

static void rt2500usb_register_write_lock(struct rt2x00_dev *rt2x00dev,
						 const unsigned int offset,
						 u16 value)
{
	__le16 reg = cpu_to_le16(value);
	rt2x00usb_vendor_req_buff_lock(rt2x00dev, USB_MULTI_WRITE,
				       USB_VENDOR_REQUEST_OUT, offset,
				       &reg, sizeof(reg), REGISTER_TIMEOUT);
}

static void rt2500usb_register_multiwrite(struct rt2x00_dev *rt2x00dev,
						 const unsigned int offset,
						 void *value, const u16 length)
{
	rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_WRITE,
				      USB_VENDOR_REQUEST_OUT, offset,
				      value, length);
}

static int rt2500usb_regbusy_read(struct rt2x00_dev *rt2x00dev,
				  const unsigned int offset,
				  struct rt2x00_field16 field,
				  u16 *reg)
{
	unsigned int i;

	for (i = 0; i < REGISTER_USB_BUSY_COUNT; i++) {
		*reg = rt2500usb_register_read_lock(rt2x00dev, offset);
		if (!rt2x00_get_field16(*reg, field))
			return 1;
		udelay(REGISTER_BUSY_DELAY);
	}

	rt2x00_err(rt2x00dev, "Indirect register access failed: offset=0x%.08x, value=0x%.08x\n",
		   offset, *reg);
	*reg = ~0;

	return 0;
}

#define WAIT_FOR_BBP(__dev, __reg) \
	rt2500usb_regbusy_read((__dev), PHY_CSR8, PHY_CSR8_BUSY, (__reg))
#define WAIT_FOR_RF(__dev, __reg) \
	rt2500usb_regbusy_read((__dev), PHY_CSR10, PHY_CSR10_RF_BUSY, (__reg))

static void rt2500usb_bbp_write(struct rt2x00_dev *rt2x00dev,
				const unsigned int word, const u8 value)
{
	u16 reg;

	mutex_lock(&rt2x00dev->csr_mutex);

	/*
	 * Wait until the BBP becomes available, afterwards we
	 * can safely write the new data into the register.
	 */
	if (WAIT_FOR_BBP(rt2x00dev, &reg)) {
		reg = 0;
		rt2x00_set_field16(&reg, PHY_CSR7_DATA, value);
		rt2x00_set_field16(&reg, PHY_CSR7_REG_ID, word);
		rt2x00_set_field16(&reg, PHY_CSR7_READ_CONTROL, 0);

		rt2500usb_register_write_lock(rt2x00dev, PHY_CSR7, reg);
	}

	mutex_unlock(&rt2x00dev->csr_mutex);
}

static u8 rt2500usb_bbp_read(struct rt2x00_dev *rt2x00dev,
			     const unsigned int word)
{
	u16 reg;
	u8 value;

	mutex_lock(&rt2x00dev->csr_mutex);

	/*
	 * Wait until the BBP becomes available, afterwards we
	 * can safely write the read request into the register.
	 * After the data has been written, we wait until hardware
	 * returns the correct value, if at any time the register
	 * doesn't become available in time, reg will be 0xffffffff
	 * which means we return 0xff to the caller.
	 */
	if (WAIT_FOR_BBP(rt2x00dev, &reg)) {
		reg = 0;
		rt2x00_set_field16(&reg, PHY_CSR7_REG_ID, word);
		rt2x00_set_field16(&reg, PHY_CSR7_READ_CONTROL, 1);

		rt2500usb_register_write_lock(rt2x00dev, PHY_CSR7, reg);

		if (WAIT_FOR_BBP(rt2x00dev, &reg))
			reg = rt2500usb_register_read_lock(rt2x00dev, PHY_CSR7);
	}

	value = rt2x00_get_field16(reg, PHY_CSR7_DATA);

	mutex_unlock(&rt2x00dev->csr_mutex);

	return value;
}

static void rt2500usb_rf_write(struct rt2x00_dev *rt2x00dev,
			       const unsigned int word, const u32 value)
{
	u16 reg;

	mutex_lock(&rt2x00dev->csr_mutex);

	/*
	 * Wait until the RF becomes available, afterwards we
	 * can safely write the new data into the register.
	 */
	if (WAIT_FOR_RF(rt2x00dev, &reg)) {
		reg = 0;
		rt2x00_set_field16(&reg, PHY_CSR9_RF_VALUE, value);
		rt2500usb_register_write_lock(rt2x00dev, PHY_CSR9, reg);

		reg = 0;
		rt2x00_set_field16(&reg, PHY_CSR10_RF_VALUE, value >> 16);
		rt2x00_set_field16(&reg, PHY_CSR10_RF_NUMBER_OF_BITS, 20);
		rt2x00_set_field16(&reg, PHY_CSR10_RF_IF_SELECT, 0);
		rt2x00_set_field16(&reg, PHY_CSR10_RF_BUSY, 1);

		rt2500usb_register_write_lock(rt2x00dev, PHY_CSR10, reg);
		rt2x00_rf_write(rt2x00dev, word, value);
	}

	mutex_unlock(&rt2x00dev->csr_mutex);
}

#ifdef CONFIG_RT2X00_LIB_DEBUGFS
static u32 _rt2500usb_register_read(struct rt2x00_dev *rt2x00dev,
				     const unsigned int offset)
{
	return rt2500usb_register_read(rt2x00dev, offset);
}

static void _rt2500usb_register_write(struct rt2x00_dev *rt2x00dev,
				      const unsigned int offset,
				      u32 value)
{
	rt2500usb_register_write(rt2x00dev, offset, value);
}

static const struct rt2x00debug rt2500usb_rt2x00debug = {
	.owner	= THIS_MODULE,
	.csr	= {
		.read		= _rt2500usb_register_read,
		.write		= _rt2500usb_register_write,
		.flags		= RT2X00DEBUGFS_OFFSET,
		.word_base	= CSR_REG_BASE,
		.word_size	= sizeof(u16),
		.word_count	= CSR_REG_SIZE / sizeof(u16),
	},
	.eeprom	= {
		.read		= rt2x00_eeprom_read,
		.write		= rt2x00_eeprom_write,
		.word_base	= EEPROM_BASE,
		.word_size	= sizeof(u16),
		.word_count	= EEPROM_SIZE / sizeof(u16),
	},
	.bbp	= {
		.read		= rt2500usb_bbp_read,
		.write		= rt2500usb_bbp_write,
		.word_base	= BBP_BASE,
		.word_size	= sizeof(u8),
		.word_count	= BBP_SIZE / sizeof(u8),
	},
	.rf	= {
		.read		= rt2x00_rf_read,
		.write		= rt2500usb_rf_write,
		.word_base	= RF_BASE,
		.word_size	= sizeof(u32),
		.word_count	= RF_SIZE / sizeof(u32),
	},
};
#endif /* CONFIG_RT2X00_LIB_DEBUGFS */

static int rt2500usb_rfkill_poll(struct rt2x00_dev *rt2x00dev)
{
	u16 reg;

	reg = rt2500usb_register_read(rt2x00dev, MAC_CSR19);
	return rt2x00_get_field16(reg, MAC_CSR19_VAL7);
}

#ifdef CONFIG_RT2X00_LIB_LEDS
static void rt2500usb_brightness_set(struct led_classdev *led_cdev,
				     enum led_brightness brightness)
{
	struct rt2x00_led *led =
	    container_of(led_cdev, struct rt2x00_led, led_dev);
	unsigned int enabled = brightness != LED_OFF;
	u16 reg;

	reg = rt2500usb_register_read(led->rt2x00dev, MAC_CSR20);

	if (led->type == LED_TYPE_RADIO || led->type == LED_TYPE_ASSOC)
		rt2x00_set_field16(&reg, MAC_CSR20_LINK, enabled);
	else if (led->type == LED_TYPE_ACTIVITY)
		rt2x00_set_field16(&reg, MAC_CSR20_ACTIVITY, enabled);

	rt2500usb_register_write(led->rt2x00dev, MAC_CSR20, reg);
}

static int rt2500usb_blink_set(struct led_classdev *led_cdev,
			       unsigned long *delay_on,
			       unsigned long *delay_off)
{
	struct rt2x00_led *led =
	    container_of(led_cdev, struct rt2x00_led, led_dev);
	u16 reg;

	reg = rt2500usb_register_read(led->rt2x00dev, MAC_CSR21);
	rt2x00_set_field16(&reg, MAC_CSR21_ON_PERIOD, *delay_on);
	rt2x00_set_field16(&reg, MAC_CSR21_OFF_PERIOD, *delay_off);
	rt2500usb_register_write(led->rt2x00dev, MAC_CSR21, reg);

	return 0;
}

static void rt2500usb_init_led(struct rt2x00_dev *rt2x00dev,
			       struct rt2x00_led *led,
			       enum led_type type)
{
	led->rt2x00dev = rt2x00dev;
	led->type = type;
	led->led_dev.brightness_set = rt2500usb_brightness_set;
	led->led_dev.blink_set = rt2500usb_blink_set;
	led->flags = LED_INITIALIZED;
}
#endif /* CONFIG_RT2X00_LIB_LEDS */

/*
 * Configuration handlers.
 */

/*
 * rt2500usb does not differentiate between shared and pairwise
 * keys, so we should use the same function for both key types.
 */
static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev,
				struct rt2x00lib_crypto *crypto,
				struct ieee80211_key_conf *key)
{
	u32 mask;
	u16 reg;
	enum cipher curr_cipher;

	if (crypto->cmd == SET_KEY) {
		/*
		 * Disallow to set WEP key other than with index 0,
		 * it is known that not work at least on some hardware.
		 * SW crypto will be used in that case.
		 */
		if ((key->cipher == WLAN_CIPHER_SUITE_WEP40 ||
		     key->cipher == WLAN_CIPHER_SUITE_WEP104) &&
		    key->keyidx != 0)
			return -EOPNOTSUPP;

		/*
		 * Pairwise key will always be entry 0, but this
		 * could collide with a shared key on the same
		 * position...
		 */
		mask = TXRX_CSR0_KEY_ID.bit_mask;

		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR0);
		curr_cipher = rt2x00_get_field16(reg, TXRX_CSR0_ALGORITHM);
		reg &= mask;

		if (reg && reg == mask)
			return -ENOSPC;

		reg = rt2x00_get_field16(reg, TXRX_CSR0_KEY_ID);

		key->hw_key_idx += reg ? ffz(reg) : 0;
		/*
		 * Hardware requires that all keys use the same cipher
		 * (e.g. TKIP-only, AES-only, but not TKIP+AES).
		 * If this is not the first key, compare the cipher with the
		 * first one and fall back to SW crypto if not the same.
		 */
		if (key->hw_key_idx > 0 && crypto->cipher != curr_cipher)
			return -EOPNOTSUPP;

		rt2500usb_register_multiwrite(rt2x00dev, KEY_ENTRY(key->hw_key_idx),
					      crypto->key, sizeof(crypto->key));

		/*
		 * The driver does not support the IV/EIV generation
		 * in hardware. However it demands the data to be provided
		 * both separately as well as inside the frame.
		 * We already provided the CONFIG_CRYPTO_COPY_IV to rt2x00lib
		 * to ensure rt2x00lib will not strip the data from the
		 * frame after the copy, now we must tell mac80211
		 * to generate the IV/EIV data.
		 */
		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
		key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
	}

	/*
	 * TXRX_CSR0_KEY_ID contains only single-bit fields to indicate
	 * a particular key is valid.
	 */
	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR0);
	rt2x00_set_field16(&reg, TXRX_CSR0_ALGORITHM, crypto->cipher);
	rt2x00_set_field16(&reg, TXRX_CSR0_IV_OFFSET, IEEE80211_HEADER);

	mask = rt2x00_get_field16(reg, TXRX_CSR0_KEY_ID);
	if (crypto->cmd == SET_KEY)
		mask |= 1 << key->hw_key_idx;
	else if (crypto->cmd == DISABLE_KEY)
		mask &= ~(1 << key->hw_key_idx);
	rt2x00_set_field16(&reg, TXRX_CSR0_KEY_ID, mask);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR0, reg);

	return 0;
}

static void rt2500usb_config_filter(struct rt2x00_dev *rt2x00dev,
				    const unsigned int filter_flags)
{
	u16 reg;

	/*
	 * Start configuration steps.
	 * Note that the version error will always be dropped
	 * and broadcast frames will always be accepted since
	 * there is no filter for it at this time.
	 */
	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR2);
	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_CRC,
			   !(filter_flags & FIF_FCSFAIL));
	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_PHYSICAL,
			   !(filter_flags & FIF_PLCPFAIL));
	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_CONTROL,
			   !(filter_flags & FIF_CONTROL));
	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_NOT_TO_ME,
			   !test_bit(CONFIG_MONITORING, &rt2x00dev->flags));
	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_TODS,
			   !test_bit(CONFIG_MONITORING, &rt2x00dev->flags) &&
			   !rt2x00dev->intf_ap_count);
	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_VERSION_ERROR, 1);
	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_MULTICAST,
			   !(filter_flags & FIF_ALLMULTI));
	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_BROADCAST, 0);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR2, reg);
}

static void rt2500usb_config_intf(struct rt2x00_dev *rt2x00dev,
				  struct rt2x00_intf *intf,
				  struct rt2x00intf_conf *conf,
				  const unsigned int flags)
{
	unsigned int bcn_preload;
	u16 reg;

	if (flags & CONFIG_UPDATE_TYPE) {
		/*
		 * Enable beacon config
		 */
		bcn_preload = PREAMBLE + GET_DURATION(IEEE80211_HEADER, 20);
		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR20);
		rt2x00_set_field16(&reg, TXRX_CSR20_OFFSET, bcn_preload >> 6);
		rt2x00_set_field16(&reg, TXRX_CSR20_BCN_EXPECT_WINDOW,
				   2 * (conf->type != NL80211_IFTYPE_STATION));
		rt2500usb_register_write(rt2x00dev, TXRX_CSR20, reg);

		/*
		 * Enable synchronisation.
		 */
		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR18);
		rt2x00_set_field16(&reg, TXRX_CSR18_OFFSET, 0);
		rt2500usb_register_write(rt2x00dev, TXRX_CSR18, reg);

		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR19);
		rt2x00_set_field16(&reg, TXRX_CSR19_TSF_SYNC, conf->sync);
		rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
	}

	if (flags & CONFIG_UPDATE_MAC)
		rt2500usb_register_multiwrite(rt2x00dev, MAC_CSR2, conf->mac,
					      (3 * sizeof(__le16)));

	if (flags & CONFIG_UPDATE_BSSID)
		rt2500usb_register_multiwrite(rt2x00dev, MAC_CSR5, conf->bssid,
					      (3 * sizeof(__le16)));
}

static void rt2500usb_config_erp(struct rt2x00_dev *rt2x00dev,
				 struct rt2x00lib_erp *erp,
				 u32 changed)
{
	u16 reg;

	if (changed & BSS_CHANGED_ERP_PREAMBLE) {
		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR10);
		rt2x00_set_field16(&reg, TXRX_CSR10_AUTORESPOND_PREAMBLE,
				   !!erp->short_preamble);
		rt2500usb_register_write(rt2x00dev, TXRX_CSR10, reg);
	}

	if (changed & BSS_CHANGED_BASIC_RATES)
		rt2500usb_register_write(rt2x00dev, TXRX_CSR11,
					 erp->basic_rates);

	if (changed & BSS_CHANGED_BEACON_INT) {
		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR18);
		rt2x00_set_field16(&reg, TXRX_CSR18_INTERVAL,
				   erp->beacon_int * 4);
		rt2500usb_register_write(rt2x00dev, TXRX_CSR18, reg);
	}

	if (changed & BSS_CHANGED_ERP_SLOT) {
		rt2500usb_register_write(rt2x00dev, MAC_CSR10, erp->slot_time);
		rt2500usb_register_write(rt2x00dev, MAC_CSR11, erp->sifs);
		rt2500usb_register_write(rt2x00dev, MAC_CSR12, erp->eifs);
	}
}

static void rt2500usb_config_ant(struct rt2x00_dev *rt2x00dev,
				 struct antenna_setup *ant)
{
	u8 r2;
	u8 r14;
	u16 csr5;
	u16 csr6;

	/*
	 * We should never come here because rt2x00lib is supposed
	 * to catch this and send us the correct antenna explicitely.
	 */
	BUG_ON(ant->rx == ANTENNA_SW_DIVERSITY ||
	       ant->tx == ANTENNA_SW_DIVERSITY);

	r2 = rt2500usb_bbp_read(rt2x00dev, 2);
	r14 = rt2500usb_bbp_read(rt2x00dev, 14);
	csr5 = rt2500usb_register_read(rt2x00dev, PHY_CSR5);
	csr6 = rt2500usb_register_read(rt2x00dev, PHY_CSR6);

	/*
	 * Configure the TX antenna.
	 */
	switch (ant->tx) {
	case ANTENNA_HW_DIVERSITY:
		rt2x00_set_field8(&r2, BBP_R2_TX_ANTENNA, 1);
		rt2x00_set_field16(&csr5, PHY_CSR5_CCK, 1);
		rt2x00_set_field16(&csr6, PHY_CSR6_OFDM, 1);
		break;
	case ANTENNA_A:
		rt2x00_set_field8(&r2, BBP_R2_TX_ANTENNA, 0);
		rt2x00_set_field16(&csr5, PHY_CSR5_CCK, 0);
		rt2x00_set_field16(&csr6, PHY_CSR6_OFDM, 0);
		break;
	case ANTENNA_B:
	default:
		rt2x00_set_field8(&r2, BBP_R2_TX_ANTENNA, 2);
		rt2x00_set_field16(&csr5, PHY_CSR5_CCK, 2);
		rt2x00_set_field16(&csr6, PHY_CSR6_OFDM, 2);
		break;
	}

	/*
	 * Configure the RX antenna.
	 */
	switch (ant->rx) {
	case ANTENNA_HW_DIVERSITY:
		rt2x00_set_field8(&r14, BBP_R14_RX_ANTENNA, 1);
		break;
	case ANTENNA_A:
		rt2x00_set_field8(&r14, BBP_R14_RX_ANTENNA, 0);
		break;
	case ANTENNA_B:
	default:
		rt2x00_set_field8(&r14, BBP_R14_RX_ANTENNA, 2);
		break;
	}

	/*
	 * RT2525E and RT5222 need to flip TX I/Q
	 */
	if (rt2x00_rf(rt2x00dev, RF2525E) || rt2x00_rf(rt2x00dev, RF5222)) {
		rt2x00_set_field8(&r2, BBP_R2_TX_IQ_FLIP, 1);
		rt2x00_set_field16(&csr5, PHY_CSR5_CCK_FLIP, 1);
		rt2x00_set_field16(&csr6, PHY_CSR6_OFDM_FLIP, 1);

		/*
		 * RT2525E does not need RX I/Q Flip.
		 */
		if (rt2x00_rf(rt2x00dev, RF2525E))
			rt2x00_set_field8(&r14, BBP_R14_RX_IQ_FLIP, 0);
	} else {
		rt2x00_set_field16(&csr5, PHY_CSR5_CCK_FLIP, 0);
		rt2x00_set_field16(&csr6, PHY_CSR6_OFDM_FLIP, 0);
	}

	rt2500usb_bbp_write(rt2x00dev, 2, r2);
	rt2500usb_bbp_write(rt2x00dev, 14, r14);
	rt2500usb_register_write(rt2x00dev, PHY_CSR5, csr5);
	rt2500usb_register_write(rt2x00dev, PHY_CSR6, csr6);
}

static void rt2500usb_config_channel(struct rt2x00_dev *rt2x00dev,
				     struct rf_channel *rf, const int txpower)
{
	/*
	 * Set TXpower.
	 */
	rt2x00_set_field32(&rf->rf3, RF3_TXPOWER, TXPOWER_TO_DEV(txpower));

	/*
	 * For RT2525E we should first set the channel to half band higher.
	 */
	if (rt2x00_rf(rt2x00dev, RF2525E)) {
		static const u32 vals[] = {
			0x000008aa, 0x000008ae, 0x000008ae, 0x000008b2,
			0x000008b2, 0x000008b6, 0x000008b6, 0x000008ba,
			0x000008ba, 0x000008be, 0x000008b7, 0x00000902,
			0x00000902, 0x00000906
		};

		rt2500usb_rf_write(rt2x00dev, 2, vals[rf->channel - 1]);
		if (rf->rf4)
			rt2500usb_rf_write(rt2x00dev, 4, rf->rf4);
	}

	rt2500usb_rf_write(rt2x00dev, 1, rf->rf1);
	rt2500usb_rf_write(rt2x00dev, 2, rf->rf2);
	rt2500usb_rf_write(rt2x00dev, 3, rf->rf3);
	if (rf->rf4)
		rt2500usb_rf_write(rt2x00dev, 4, rf->rf4);
}

static void rt2500usb_config_txpower(struct rt2x00_dev *rt2x00dev,
				     const int txpower)
{
	u32 rf3;

	rf3 = rt2x00_rf_read(rt2x00dev, 3);
	rt2x00_set_field32(&rf3, RF3_TXPOWER, TXPOWER_TO_DEV(txpower));
	rt2500usb_rf_write(rt2x00dev, 3, rf3);
}

static void rt2500usb_config_ps(struct rt2x00_dev *rt2x00dev,
				struct rt2x00lib_conf *libconf)
{
	enum dev_state state =
	    (libconf->conf->flags & IEEE80211_CONF_PS) ?
		STATE_SLEEP : STATE_AWAKE;
	u16 reg;

	if (state == STATE_SLEEP) {
		reg = rt2500usb_register_read(rt2x00dev, MAC_CSR18);
		rt2x00_set_field16(&reg, MAC_CSR18_DELAY_AFTER_BEACON,
				   rt2x00dev->beacon_int - 20);
		rt2x00_set_field16(&reg, MAC_CSR18_BEACONS_BEFORE_WAKEUP,
				   libconf->conf->listen_interval - 1);

		/* We must first disable autowake before it can be enabled */
		rt2x00_set_field16(&reg, MAC_CSR18_AUTO_WAKE, 0);
		rt2500usb_register_write(rt2x00dev, MAC_CSR18, reg);

		rt2x00_set_field16(&reg, MAC_CSR18_AUTO_WAKE, 1);
		rt2500usb_register_write(rt2x00dev, MAC_CSR18, reg);
	} else {
		reg = rt2500usb_register_read(rt2x00dev, MAC_CSR18);
		rt2x00_set_field16(&reg, MAC_CSR18_AUTO_WAKE, 0);
		rt2500usb_register_write(rt2x00dev, MAC_CSR18, reg);
	}

	rt2x00dev->ops->lib->set_device_state(rt2x00dev, state);
}

static void rt2500usb_config(struct rt2x00_dev *rt2x00dev,
			     struct rt2x00lib_conf *libconf,
			     const unsigned int flags)
{
	if (flags & IEEE80211_CONF_CHANGE_CHANNEL)
		rt2500usb_config_channel(rt2x00dev, &libconf->rf,
					 libconf->conf->power_level);
	if ((flags & IEEE80211_CONF_CHANGE_POWER) &&
	    !(flags & IEEE80211_CONF_CHANGE_CHANNEL))
		rt2500usb_config_txpower(rt2x00dev,
					 libconf->conf->power_level);
	if (flags & IEEE80211_CONF_CHANGE_PS)
		rt2500usb_config_ps(rt2x00dev, libconf);
}

/*
 * Link tuning
 */
static void rt2500usb_link_stats(struct rt2x00_dev *rt2x00dev,
				 struct link_qual *qual)
{
	u16 reg;

	/*
	 * Update FCS error count from register.
	 */
	reg = rt2500usb_register_read(rt2x00dev, STA_CSR0);
	qual->rx_failed = rt2x00_get_field16(reg, STA_CSR0_FCS_ERROR);

	/*
	 * Update False CCA count from register.
	 */
	reg = rt2500usb_register_read(rt2x00dev, STA_CSR3);
	qual->false_cca = rt2x00_get_field16(reg, STA_CSR3_FALSE_CCA_ERROR);
}

static void rt2500usb_reset_tuner(struct rt2x00_dev *rt2x00dev,
				  struct link_qual *qual)
{
	u16 eeprom;
	u16 value;

	eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R24);
	value = rt2x00_get_field16(eeprom, EEPROM_BBPTUNE_R24_LOW);
	rt2500usb_bbp_write(rt2x00dev, 24, value);

	eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R25);
	value = rt2x00_get_field16(eeprom, EEPROM_BBPTUNE_R25_LOW);
	rt2500usb_bbp_write(rt2x00dev, 25, value);

	eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R61);
	value = rt2x00_get_field16(eeprom, EEPROM_BBPTUNE_R61_LOW);
	rt2500usb_bbp_write(rt2x00dev, 61, value);

	eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_VGC);
	value = rt2x00_get_field16(eeprom, EEPROM_BBPTUNE_VGCUPPER);
	rt2500usb_bbp_write(rt2x00dev, 17, value);

	qual->vgc_level = value;
}

/*
 * Queue handlers.
 */
static void rt2500usb_start_queue(struct data_queue *queue)
{
	struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
	u16 reg;

	switch (queue->qid) {
	case QID_RX:
		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR2);
		rt2x00_set_field16(&reg, TXRX_CSR2_DISABLE_RX, 0);
		rt2500usb_register_write(rt2x00dev, TXRX_CSR2, reg);
		break;
	case QID_BEACON:
		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR19);
		rt2x00_set_field16(&reg, TXRX_CSR19_TSF_COUNT, 1);
		rt2x00_set_field16(&reg, TXRX_CSR19_TBCN, 1);
		rt2x00_set_field16(&reg, TXRX_CSR19_BEACON_GEN, 1);
		rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
		break;
	default:
		break;
	}
}

static void rt2500usb_stop_queue(struct data_queue *queue)
{
	struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
	u16 reg;

	switch (queue->qid) {
	case QID_RX:
		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR2);
		rt2x00_set_field16(&reg, TXRX_CSR2_DISABLE_RX, 1);
		rt2500usb_register_write(rt2x00dev, TXRX_CSR2, reg);
		break;
	case QID_BEACON:
		reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR19);
		rt2x00_set_field16(&reg, TXRX_CSR19_TSF_COUNT, 0);
		rt2x00_set_field16(&reg, TXRX_CSR19_TBCN, 0);
		rt2x00_set_field16(&reg, TXRX_CSR19_BEACON_GEN, 0);
		rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
		break;
	default:
		break;
	}
}

/*
 * Initialization functions.
 */
static int rt2500usb_init_registers(struct rt2x00_dev *rt2x00dev)
{
	u16 reg;

	rt2x00usb_vendor_request_sw(rt2x00dev, USB_DEVICE_MODE, 0x0001,
				    USB_MODE_TEST, REGISTER_TIMEOUT);
	rt2x00usb_vendor_request_sw(rt2x00dev, USB_SINGLE_WRITE, 0x0308,
				    0x00f0, REGISTER_TIMEOUT);

	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR2);
	rt2x00_set_field16(&reg, TXRX_CSR2_DISABLE_RX, 1);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR2, reg);

	rt2500usb_register_write(rt2x00dev, MAC_CSR13, 0x1111);
	rt2500usb_register_write(rt2x00dev, MAC_CSR14, 0x1e11);

	reg = rt2500usb_register_read(rt2x00dev, MAC_CSR1);
	rt2x00_set_field16(&reg, MAC_CSR1_SOFT_RESET, 1);
	rt2x00_set_field16(&reg, MAC_CSR1_BBP_RESET, 1);
	rt2x00_set_field16(&reg, MAC_CSR1_HOST_READY, 0);
	rt2500usb_register_write(rt2x00dev, MAC_CSR1, reg);

	reg = rt2500usb_register_read(rt2x00dev, MAC_CSR1);
	rt2x00_set_field16(&reg, MAC_CSR1_SOFT_RESET, 0);
	rt2x00_set_field16(&reg, MAC_CSR1_BBP_RESET, 0);
	rt2x00_set_field16(&reg, MAC_CSR1_HOST_READY, 0);
	rt2500usb_register_write(rt2x00dev, MAC_CSR1, reg);

	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR5);
	rt2x00_set_field16(&reg, TXRX_CSR5_BBP_ID0, 13);
	rt2x00_set_field16(&reg, TXRX_CSR5_BBP_ID0_VALID, 1);
	rt2x00_set_field16(&reg, TXRX_CSR5_BBP_ID1, 12);
	rt2x00_set_field16(&reg, TXRX_CSR5_BBP_ID1_VALID, 1);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR5, reg);

	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR6);
	rt2x00_set_field16(&reg, TXRX_CSR6_BBP_ID0, 10);
	rt2x00_set_field16(&reg, TXRX_CSR6_BBP_ID0_VALID, 1);
	rt2x00_set_field16(&reg, TXRX_CSR6_BBP_ID1, 11);
	rt2x00_set_field16(&reg, TXRX_CSR6_BBP_ID1_VALID, 1);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR6, reg);

	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR7);
	rt2x00_set_field16(&reg, TXRX_CSR7_BBP_ID0, 7);
	rt2x00_set_field16(&reg, TXRX_CSR7_BBP_ID0_VALID, 1);
	rt2x00_set_field16(&reg, TXRX_CSR7_BBP_ID1, 6);
	rt2x00_set_field16(&reg, TXRX_CSR7_BBP_ID1_VALID, 1);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR7, reg);

	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR8);
	rt2x00_set_field16(&reg, TXRX_CSR8_BBP_ID0, 5);
	rt2x00_set_field16(&reg, TXRX_CSR8_BBP_ID0_VALID, 1);
	rt2x00_set_field16(&reg, TXRX_CSR8_BBP_ID1, 0);
	rt2x00_set_field16(&reg, TXRX_CSR8_BBP_ID1_VALID, 0);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR8, reg);

	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR19);
	rt2x00_set_field16(&reg, TXRX_CSR19_TSF_COUNT, 0);
	rt2x00_set_field16(&reg, TXRX_CSR19_TSF_SYNC, 0);
	rt2x00_set_field16(&reg, TXRX_CSR19_TBCN, 0);
	rt2x00_set_field16(&reg, TXRX_CSR19_BEACON_GEN, 0);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);

	rt2500usb_register_write(rt2x00dev, TXRX_CSR21, 0xe78f);
	rt2500usb_register_write(rt2x00dev, MAC_CSR9, 0xff1d);

	if (rt2x00dev->ops->lib->set_device_state(rt2x00dev, STATE_AWAKE))
		return -EBUSY;

	reg = rt2500usb_register_read(rt2x00dev, MAC_CSR1);
	rt2x00_set_field16(&reg, MAC_CSR1_SOFT_RESET, 0);
	rt2x00_set_field16(&reg, MAC_CSR1_BBP_RESET, 0);
	rt2x00_set_field16(&reg, MAC_CSR1_HOST_READY, 1);
	rt2500usb_register_write(rt2x00dev, MAC_CSR1, reg);

	if (rt2x00_rev(rt2x00dev) >= RT2570_VERSION_C) {
		reg = rt2500usb_register_read(rt2x00dev, PHY_CSR2);
		rt2x00_set_field16(&reg, PHY_CSR2_LNA, 0);
	} else {
		reg = 0;
		rt2x00_set_field16(&reg, PHY_CSR2_LNA, 1);
		rt2x00_set_field16(&reg, PHY_CSR2_LNA_MODE, 3);
	}
	rt2500usb_register_write(rt2x00dev, PHY_CSR2, reg);

	rt2500usb_register_write(rt2x00dev, MAC_CSR11, 0x0002);
	rt2500usb_register_write(rt2x00dev, MAC_CSR22, 0x0053);
	rt2500usb_register_write(rt2x00dev, MAC_CSR15, 0x01ee);
	rt2500usb_register_write(rt2x00dev, MAC_CSR16, 0x0000);

	reg = rt2500usb_register_read(rt2x00dev, MAC_CSR8);
	rt2x00_set_field16(&reg, MAC_CSR8_MAX_FRAME_UNIT,
			   rt2x00dev->rx->data_size);
	rt2500usb_register_write(rt2x00dev, MAC_CSR8, reg);

	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR0);
	rt2x00_set_field16(&reg, TXRX_CSR0_ALGORITHM, CIPHER_NONE);
	rt2x00_set_field16(&reg, TXRX_CSR0_IV_OFFSET, IEEE80211_HEADER);
	rt2x00_set_field16(&reg, TXRX_CSR0_KEY_ID, 0);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR0, reg);

	reg = rt2500usb_register_read(rt2x00dev, MAC_CSR18);
	rt2x00_set_field16(&reg, MAC_CSR18_DELAY_AFTER_BEACON, 90);
	rt2500usb_register_write(rt2x00dev, MAC_CSR18, reg);

	reg = rt2500usb_register_read(rt2x00dev, PHY_CSR4);
	rt2x00_set_field16(&reg, PHY_CSR4_LOW_RF_LE, 1);
	rt2500usb_register_write(rt2x00dev, PHY_CSR4, reg);

	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR1);
	rt2x00_set_field16(&reg, TXRX_CSR1_AUTO_SEQUENCE, 1);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR1, reg);

	return 0;
}

static int rt2500usb_wait_bbp_ready(struct rt2x00_dev *rt2x00dev)
{
	unsigned int i;
	u8 value;

	for (i = 0; i < REGISTER_USB_BUSY_COUNT; i++) {
		value = rt2500usb_bbp_read(rt2x00dev, 0);
		if ((value != 0xff) && (value != 0x00))
			return 0;
		udelay(REGISTER_BUSY_DELAY);
	}

	rt2x00_err(rt2x00dev, "BBP register access failed, aborting\n");
	return -EACCES;
}

static int rt2500usb_init_bbp(struct rt2x00_dev *rt2x00dev)
{
	unsigned int i;
	u16 eeprom;
	u8 value;
	u8 reg_id;

	if (unlikely(rt2500usb_wait_bbp_ready(rt2x00dev)))
		return -EACCES;

	rt2500usb_bbp_write(rt2x00dev, 3, 0x02);
	rt2500usb_bbp_write(rt2x00dev, 4, 0x19);
	rt2500usb_bbp_write(rt2x00dev, 14, 0x1c);
	rt2500usb_bbp_write(rt2x00dev, 15, 0x30);
	rt2500usb_bbp_write(rt2x00dev, 16, 0xac);
	rt2500usb_bbp_write(rt2x00dev, 18, 0x18);
	rt2500usb_bbp_write(rt2x00dev, 19, 0xff);
	rt2500usb_bbp_write(rt2x00dev, 20, 0x1e);
	rt2500usb_bbp_write(rt2x00dev, 21, 0x08);
	rt2500usb_bbp_write(rt2x00dev, 22, 0x08);
	rt2500usb_bbp_write(rt2x00dev, 23, 0x08);
	rt2500usb_bbp_write(rt2x00dev, 24, 0x80);
	rt2500usb_bbp_write(rt2x00dev, 25, 0x50);
	rt2500usb_bbp_write(rt2x00dev, 26, 0x08);
	rt2500usb_bbp_write(rt2x00dev, 27, 0x23);
	rt2500usb_bbp_write(rt2x00dev, 30, 0x10);
	rt2500usb_bbp_write(rt2x00dev, 31, 0x2b);
	rt2500usb_bbp_write(rt2x00dev, 32, 0xb9);
	rt2500usb_bbp_write(rt2x00dev, 34, 0x12);
	rt2500usb_bbp_write(rt2x00dev, 35, 0x50);
	rt2500usb_bbp_write(rt2x00dev, 39, 0xc4);
	rt2500usb_bbp_write(rt2x00dev, 40, 0x02);
	rt2500usb_bbp_write(rt2x00dev, 41, 0x60);
	rt2500usb_bbp_write(rt2x00dev, 53, 0x10);
	rt2500usb_bbp_write(rt2x00dev, 54, 0x18);
	rt2500usb_bbp_write(rt2x00dev, 56, 0x08);
	rt2500usb_bbp_write(rt2x00dev, 57, 0x10);
	rt2500usb_bbp_write(rt2x00dev, 58, 0x08);
	rt2500usb_bbp_write(rt2x00dev, 61, 0x60);
	rt2500usb_bbp_write(rt2x00dev, 62, 0x10);
	rt2500usb_bbp_write(rt2x00dev, 75, 0xff);

	for (i = 0; i < EEPROM_BBP_SIZE; i++) {
		eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBP_START + i);

		if (eeprom != 0xffff && eeprom != 0x0000) {
			reg_id = rt2x00_get_field16(eeprom, EEPROM_BBP_REG_ID);
			value = rt2x00_get_field16(eeprom, EEPROM_BBP_VALUE);
			rt2500usb_bbp_write(rt2x00dev, reg_id, value);
		}
	}

	return 0;
}

/*
 * Device state switch handlers.
 */
static int rt2500usb_enable_radio(struct rt2x00_dev *rt2x00dev)
{
	/*
	 * Initialize all registers.
	 */
	if (unlikely(rt2500usb_init_registers(rt2x00dev) ||
		     rt2500usb_init_bbp(rt2x00dev)))
		return -EIO;

	return 0;
}

static void rt2500usb_disable_radio(struct rt2x00_dev *rt2x00dev)
{
	rt2500usb_register_write(rt2x00dev, MAC_CSR13, 0x2121);
	rt2500usb_register_write(rt2x00dev, MAC_CSR14, 0x2121);

	/*
	 * Disable synchronisation.
	 */
	rt2500usb_register_write(rt2x00dev, TXRX_CSR19, 0);

	rt2x00usb_disable_radio(rt2x00dev);
}

static int rt2500usb_set_state(struct rt2x00_dev *rt2x00dev,
			       enum dev_state state)
{
	u16 reg;
	u16 reg2;
	unsigned int i;
	bool put_to_sleep;
	u8 bbp_state;
	u8 rf_state;

	put_to_sleep = (state != STATE_AWAKE);

	reg = 0;
	rt2x00_set_field16(&reg, MAC_CSR17_BBP_DESIRE_STATE, state);
	rt2x00_set_field16(&reg, MAC_CSR17_RF_DESIRE_STATE, state);
	rt2x00_set_field16(&reg, MAC_CSR17_PUT_TO_SLEEP, put_to_sleep);
	rt2500usb_register_write(rt2x00dev, MAC_CSR17, reg);
	rt2x00_set_field16(&reg, MAC_CSR17_SET_STATE, 1);
	rt2500usb_register_write(rt2x00dev, MAC_CSR17, reg);

	/*
	 * Device is not guaranteed to be in the requested state yet.
	 * We must wait until the register indicates that the
	 * device has entered the correct state.
	 */
	for (i = 0; i < REGISTER_USB_BUSY_COUNT; i++) {
		reg2 = rt2500usb_register_read(rt2x00dev, MAC_CSR17);
		bbp_state = rt2x00_get_field16(reg2, MAC_CSR17_BBP_CURR_STATE);
		rf_state = rt2x00_get_field16(reg2, MAC_CSR17_RF_CURR_STATE);
		if (bbp_state == state && rf_state == state)
			return 0;
		rt2500usb_register_write(rt2x00dev, MAC_CSR17, reg);
		msleep(30);
	}

	return -EBUSY;
}

static int rt2500usb_set_device_state(struct rt2x00_dev *rt2x00dev,
				      enum dev_state state)
{
	int retval = 0;

	switch (state) {
	case STATE_RADIO_ON:
		retval = rt2500usb_enable_radio(rt2x00dev);
		break;
	case STATE_RADIO_OFF:
		rt2500usb_disable_radio(rt2x00dev);
		break;
	case STATE_RADIO_IRQ_ON:
	case STATE_RADIO_IRQ_OFF:
		/* No support, but no error either */
		break;
	case STATE_DEEP_SLEEP:
	case STATE_SLEEP:
	case STATE_STANDBY:
	case STATE_AWAKE:
		retval = rt2500usb_set_state(rt2x00dev, state);
		break;
	default:
		retval = -ENOTSUPP;
		break;
	}

	if (unlikely(retval))
		rt2x00_err(rt2x00dev, "Device failed to enter state %d (%d)\n",
			   state, retval);

	return retval;
}

/*
 * TX descriptor initialization
 */
static void rt2500usb_write_tx_desc(struct queue_entry *entry,
				    struct txentry_desc *txdesc)
{
	struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
	__le32 *txd = (__le32 *) entry->skb->data;
	u32 word;

	/*
	 * Start writing the descriptor words.
	 */
	word = rt2x00_desc_read(txd, 0);
	rt2x00_set_field32(&word, TXD_W0_RETRY_LIMIT, txdesc->retry_limit);
	rt2x00_set_field32(&word, TXD_W0_MORE_FRAG,
			   test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
	rt2x00_set_field32(&word, TXD_W0_ACK,
			   test_bit(ENTRY_TXD_ACK, &txdesc->flags));
	rt2x00_set_field32(&word, TXD_W0_TIMESTAMP,
			   test_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags));
	rt2x00_set_field32(&word, TXD_W0_OFDM,
			   (txdesc->rate_mode == RATE_MODE_OFDM));
	rt2x00_set_field32(&word, TXD_W0_NEW_SEQ,
			   test_bit(ENTRY_TXD_FIRST_FRAGMENT, &txdesc->flags));
	rt2x00_set_field32(&word, TXD_W0_IFS, txdesc->u.plcp.ifs);
	rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, txdesc->length);
	rt2x00_set_field32(&word, TXD_W0_CIPHER, !!txdesc->cipher);
	rt2x00_set_field32(&word, TXD_W0_KEY_ID, txdesc->key_idx);
	rt2x00_desc_write(txd, 0, word);

	word = rt2x00_desc_read(txd, 1);
	rt2x00_set_field32(&word, TXD_W1_IV_OFFSET, txdesc->iv_offset);
	rt2x00_set_field32(&word, TXD_W1_AIFS, entry->queue->aifs);
	rt2x00_set_field32(&word, TXD_W1_CWMIN, entry->queue->cw_min);
	rt2x00_set_field32(&word, TXD_W1_CWMAX, entry->queue->cw_max);
	rt2x00_desc_write(txd, 1, word);

	word = rt2x00_desc_read(txd, 2);
	rt2x00_set_field32(&word, TXD_W2_PLCP_SIGNAL, txdesc->u.plcp.signal);
	rt2x00_set_field32(&word, TXD_W2_PLCP_SERVICE, txdesc->u.plcp.service);
	rt2x00_set_field32(&word, TXD_W2_PLCP_LENGTH_LOW,
			   txdesc->u.plcp.length_low);
	rt2x00_set_field32(&word, TXD_W2_PLCP_LENGTH_HIGH,
			   txdesc->u.plcp.length_high);
	rt2x00_desc_write(txd, 2, word);

	if (test_bit(ENTRY_TXD_ENCRYPT, &txdesc->flags)) {
		_rt2x00_desc_write(txd, 3, skbdesc->iv[0]);
		_rt2x00_desc_write(txd, 4, skbdesc->iv[1]);
	}

	/*
	 * Register descriptor details in skb frame descriptor.
	 */
	skbdesc->flags |= SKBDESC_DESC_IN_SKB;
	skbdesc->desc = txd;
	skbdesc->desc_len = TXD_DESC_SIZE;
}

/*
 * TX data initialization
 */
static void rt2500usb_beacondone(struct urb *urb);

static void rt2500usb_write_beacon(struct queue_entry *entry,
				   struct txentry_desc *txdesc)
{
	struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
	struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev);
	struct queue_entry_priv_usb_bcn *bcn_priv = entry->priv_data;
	int pipe = usb_sndbulkpipe(usb_dev, entry->queue->usb_endpoint);
	int length;
	u16 reg, reg0;

	/*
	 * Disable beaconing while we are reloading the beacon data,
	 * otherwise we might be sending out invalid data.
	 */
	reg = rt2500usb_register_read(rt2x00dev, TXRX_CSR19);
	rt2x00_set_field16(&reg, TXRX_CSR19_BEACON_GEN, 0);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);

	/*
	 * Add space for the descriptor in front of the skb.
	 */
	skb_push(entry->skb, TXD_DESC_SIZE);
	memset(entry->skb->data, 0, TXD_DESC_SIZE);

	/*
	 * Write the TX descriptor for the beacon.
	 */
	rt2500usb_write_tx_desc(entry, txdesc);

	/*
	 * Dump beacon to userspace through debugfs.
	 */
	rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_BEACON, entry);

	/*
	 * USB devices cannot blindly pass the skb->len as the
	 * length of the data to usb_fill_bulk_urb. Pass the skb
	 * to the driver to determine what the length should be.
	 */
	length = rt2x00dev->ops->lib->get_tx_data_len(entry);

	usb_fill_bulk_urb(bcn_priv->urb, usb_dev, pipe,
			  entry->skb->data, length, rt2500usb_beacondone,
			  entry);

	/*
	 * Second we need to create the guardian byte.
	 * We only need a single byte, so lets recycle
	 * the 'flags' field we are not using for beacons.
	 */
	bcn_priv->guardian_data = 0;
	usb_fill_bulk_urb(bcn_priv->guardian_urb, usb_dev, pipe,
			  &bcn_priv->guardian_data, 1, rt2500usb_beacondone,
			  entry);

	/*
	 * Send out the guardian byte.
	 */
	usb_submit_urb(bcn_priv->guardian_urb, GFP_ATOMIC);

	/*
	 * Enable beaconing again.
	 */
	rt2x00_set_field16(&reg, TXRX_CSR19_TSF_COUNT, 1);
	rt2x00_set_field16(&reg, TXRX_CSR19_TBCN, 1);
	reg0 = reg;
	rt2x00_set_field16(&reg, TXRX_CSR19_BEACON_GEN, 1);
	/*
	 * Beacon generation will fail initially.
	 * To prevent this we need to change the TXRX_CSR19
	 * register several times (reg0 is the same as reg
	 * except for TXRX_CSR19_BEACON_GEN, which is 0 in reg0
	 * and 1 in reg).
	 */
	rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg0);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg0);
	rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
}

static int rt2500usb_get_tx_data_len(struct queue_entry *entry)
{
	int length;

	/*
	 * The length _must_ be a multiple of 2,
	 * but it must _not_ be a multiple of the USB packet size.
	 */
	length = roundup(entry->skb->len, 2);
	length += (2 * !(length % entry->queue->usb_maxpacket));

	return length;
}

/*
 * RX control handlers
 */
static void rt2500usb_fill_rxdone(struct queue_entry *entry,
				  struct rxdone_entry_desc *rxdesc)
{
	struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
	struct queue_entry_priv_usb *entry_priv = entry->priv_data;
	struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
	__le32 *rxd =
	    (__le32 *)(entry->skb->data +
		       (entry_priv->urb->actual_length -
			entry->queue->desc_size));
	u32 word0;
	u32 word1;

	/*
	 * Copy descriptor to the skbdesc->desc buffer, making it safe from moving of
	 * frame data in rt2x00usb.
	 */
	memcpy(skbdesc->desc, rxd, skbdesc->desc_len);
	rxd = (__le32 *)skbdesc->desc;

	/*
	 * It is now safe to read the descriptor on all architectures.
	 */
	word0 = rt2x00_desc_read(rxd, 0);
	word1 = rt2x00_desc_read(rxd, 1);

	if (rt2x00_get_field32(word0, RXD_W0_CRC_ERROR))
		rxdesc->flags |= RX_FLAG_FAILED_FCS_CRC;
	if (rt2x00_get_field32(word0, RXD_W0_PHYSICAL_ERROR))
		rxdesc->flags |= RX_FLAG_FAILED_PLCP_CRC;

	rxdesc->cipher = rt2x00_get_field32(word0, RXD_W0_CIPHER);
	if (rt2x00_get_field32(word0, RXD_W0_CIPHER_ERROR))
		rxdesc->cipher_status = RX_CRYPTO_FAIL_KEY;

	if (rxdesc->cipher != CIPHER_NONE) {
		rxdesc->iv[0] = _rt2x00_desc_read(rxd, 2);
		rxdesc->iv[1] = _rt2x00_desc_read(rxd, 3);
		rxdesc->dev_flags |= RXDONE_CRYPTO_IV;

		/* ICV is located at the end of frame */

		rxdesc->flags |= RX_FLAG_MMIC_STRIPPED;
		if (rxdesc->cipher_status == RX_CRYPTO_SUCCESS)
			rxdesc->flags |= RX_FLAG_DECRYPTED;
		else if (rxdesc->cipher_status == RX_CRYPTO_FAIL_MIC)
			rxdesc->flags |= RX_FLAG_MMIC_ERROR;
	}

	/*
	 * Obtain the status about this packet.
	 * When frame was received with an OFDM bitrate,
	 * the signal is the PLCP value. If it was received with
	 * a CCK bitrate the signal is the rate in 100kbit/s.
	 */
	rxdesc->signal = rt2x00_get_field32(word1, RXD_W1_SIGNAL);
	rxdesc->rssi =
	    rt2x00_get_field32(word1, RXD_W1_RSSI) - rt2x00dev->rssi_offset;
	rxdesc->size = rt2x00_get_field32(word0, RXD_W0_DATABYTE_COUNT);

	if (rt2x00_get_field32(word0, RXD_W0_OFDM))
		rxdesc->dev_flags |= RXDONE_SIGNAL_PLCP;
	else
		rxdesc->dev_flags |= RXDONE_SIGNAL_BITRATE;
	if (rt2x00_get_field32(word0, RXD_W0_MY_BSS))
		rxdesc->dev_flags |= RXDONE_MY_BSS;

	/*
	 * Adjust the skb memory window to the frame boundaries.
	 */
	skb_trim(entry->skb, rxdesc->size);
}

/*
 * Interrupt functions.
 */
static void rt2500usb_beacondone(struct urb *urb)
{
	struct queue_entry *entry = (struct queue_entry *)urb->context;
	struct queue_entry_priv_usb_bcn *bcn_priv = entry->priv_data;

	if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &entry->queue->rt2x00dev->flags))
		return;

	/*
	 * Check if this was the guardian beacon,
	 * if that was the case we need to send the real beacon now.
	 * Otherwise we should free the sk_buffer, the device
	 * should be doing the rest of the work now.
	 */
	if (bcn_priv->guardian_urb == urb) {
		usb_submit_urb(bcn_priv->urb, GFP_ATOMIC);
	} else if (bcn_priv->urb == urb) {
		dev_kfree_skb(entry->skb);
		entry->skb = NULL;
	}
}

/*
 * Device probe functions.
 */
static int rt2500usb_validate_eeprom(struct rt2x00_dev *rt2x00dev)
{
	u16 word;
	u8 *mac;
	u8 bbp;

	rt2x00usb_eeprom_read(rt2x00dev, rt2x00dev->eeprom, EEPROM_SIZE);

	/*
	 * Start validation of the data that has been read.
	 */
	mac = rt2x00_eeprom_addr(rt2x00dev, EEPROM_MAC_ADDR_0);
	rt2x00lib_set_mac_address(rt2x00dev, mac);

	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA);
	if (word == 0xffff) {
		rt2x00_set_field16(&word, EEPROM_ANTENNA_NUM, 2);
		rt2x00_set_field16(&word, EEPROM_ANTENNA_TX_DEFAULT,
				   ANTENNA_SW_DIVERSITY);
		rt2x00_set_field16(&word, EEPROM_ANTENNA_RX_DEFAULT,
				   ANTENNA_SW_DIVERSITY);
		rt2x00_set_field16(&word, EEPROM_ANTENNA_LED_MODE,
				   LED_MODE_DEFAULT);
		rt2x00_set_field16(&word, EEPROM_ANTENNA_DYN_TXAGC, 0);
		rt2x00_set_field16(&word, EEPROM_ANTENNA_HARDWARE_RADIO, 0);
		rt2x00_set_field16(&word, EEPROM_ANTENNA_RF_TYPE, RF2522);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_ANTENNA, word);
		rt2x00_eeprom_dbg(rt2x00dev, "Antenna: 0x%04x\n", word);
	}

	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC);
	if (word == 0xffff) {
		rt2x00_set_field16(&word, EEPROM_NIC_CARDBUS_ACCEL, 0);
		rt2x00_set_field16(&word, EEPROM_NIC_DYN_BBP_TUNE, 0);
		rt2x00_set_field16(&word, EEPROM_NIC_CCK_TX_POWER, 0);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_NIC, word);
		rt2x00_eeprom_dbg(rt2x00dev, "NIC: 0x%04x\n", word);
	}

	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_CALIBRATE_OFFSET);
	if (word == 0xffff) {
		rt2x00_set_field16(&word, EEPROM_CALIBRATE_OFFSET_RSSI,
				   DEFAULT_RSSI_OFFSET);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_CALIBRATE_OFFSET, word);
		rt2x00_eeprom_dbg(rt2x00dev, "Calibrate offset: 0x%04x\n",
				  word);
	}

	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE);
	if (word == 0xffff) {
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_THRESHOLD, 45);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE, word);
		rt2x00_eeprom_dbg(rt2x00dev, "BBPtune: 0x%04x\n", word);
	}

	/*
	 * Switch lower vgc bound to current BBP R17 value,
	 * lower the value a bit for better quality.
	 */
	bbp = rt2500usb_bbp_read(rt2x00dev, 17);
	bbp -= 6;

	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_VGC);
	if (word == 0xffff) {
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_VGCUPPER, 0x40);
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_VGCLOWER, bbp);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_VGC, word);
		rt2x00_eeprom_dbg(rt2x00dev, "BBPtune vgc: 0x%04x\n", word);
	} else {
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_VGCLOWER, bbp);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_VGC, word);
	}

	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R17);
	if (word == 0xffff) {
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_R17_LOW, 0x48);
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_R17_HIGH, 0x41);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_R17, word);
		rt2x00_eeprom_dbg(rt2x00dev, "BBPtune r17: 0x%04x\n", word);
	}

	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R24);
	if (word == 0xffff) {
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_R24_LOW, 0x40);
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_R24_HIGH, 0x80);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_R24, word);
		rt2x00_eeprom_dbg(rt2x00dev, "BBPtune r24: 0x%04x\n", word);
	}

	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R25);
	if (word == 0xffff) {
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_R25_LOW, 0x40);
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_R25_HIGH, 0x50);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_R25, word);
		rt2x00_eeprom_dbg(rt2x00dev, "BBPtune r25: 0x%04x\n", word);
	}

	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R61);
	if (word == 0xffff) {
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_R61_LOW, 0x60);
		rt2x00_set_field16(&word, EEPROM_BBPTUNE_R61_HIGH, 0x6d);
		rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_R61, word);
		rt2x00_eeprom_dbg(rt2x00dev, "BBPtune r61: 0x%04x\n", word);
	}

	return 0;
}

static int rt2500usb_init_eeprom(struct rt2x00_dev *rt2x00dev)
{
	u16 reg;
	u16 value;
	u16 eeprom;

	/*
	 * Read EEPROM word for configuration.
	 */
	eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA);

	/*
	 * Identify RF chipset.
	 */
	value = rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RF_TYPE);
	reg = rt2500usb_register_read(rt2x00dev, MAC_CSR0);
	rt2x00_set_chip(rt2x00dev, RT2570, value, reg);

	if (((reg & 0xfff0) != 0) || ((reg & 0x0000000f) == 0)) {
		rt2x00_err(rt2x00dev, "Invalid RT chipset detected\n");
		return -ENODEV;
	}

	if (!rt2x00_rf(rt2x00dev, RF2522) &&
	    !rt2x00_rf(rt2x00dev, RF2523) &&
	    !rt2x00_rf(rt2x00dev, RF2524) &&
	    !rt2x00_rf(rt2x00dev, RF2525) &&
	    !rt2x00_rf(rt2x00dev, RF2525E) &&
	    !rt2x00_rf(rt2x00dev, RF5222)) {
		rt2x00_err(rt2x00dev, "Invalid RF chipset detected\n");
		return -ENODEV;
	}

	/*
	 * Identify default antenna configuration.
	 */
	rt2x00dev->default_ant.tx =
	    rt2x00_get_field16(eeprom, EEPROM_ANTENNA_TX_DEFAULT);
	rt2x00dev->default_ant.rx =
	    rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RX_DEFAULT);

	/*
	 * When the eeprom indicates SW_DIVERSITY use HW_DIVERSITY instead.
	 * I am not 100% sure about this, but the legacy drivers do not
	 * indicate antenna swapping in software is required when
	 * diversity is enabled.
	 */
	if (rt2x00dev->default_ant.tx == ANTENNA_SW_DIVERSITY)
		rt2x00dev->default_ant.tx = ANTENNA_HW_DIVERSITY;
	if (rt2x00dev->default_ant.rx == ANTENNA_SW_DIVERSITY)
		rt2x00dev->default_ant.rx = ANTENNA_HW_DIVERSITY;

	/*
	 * Store led mode, for correct led behaviour.
	 */
#ifdef CONFIG_RT2X00_LIB_LEDS
	value = rt2x00_get_field16(eeprom, EEPROM_ANTENNA_LED_MODE);

	rt2500usb_init_led(rt2x00dev, &rt2x00dev->led_radio, LED_TYPE_RADIO);
	if (value == LED_MODE_TXRX_ACTIVITY ||
	    value == LED_MODE_DEFAULT ||
	    value == LED_MODE_ASUS)
		rt2500usb_init_led(rt2x00dev, &rt2x00dev->led_qual,
				   LED_TYPE_ACTIVITY);
#endif /* CONFIG_RT2X00_LIB_LEDS */

	/*
	 * Detect if this device has an hardware controlled radio.
	 */
	if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO))
		__set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags);

	/*
	 * Read the RSSI <-> dBm offset information.
	 */
	eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_CALIBRATE_OFFSET);
	rt2x00dev->rssi_offset =
	    rt2x00_get_field16(eeprom, EEPROM_CALIBRATE_OFFSET_RSSI);

	return 0;
}

/*
 * RF value list for RF2522
 * Supports: 2.4 GHz
 */
static const struct rf_channel rf_vals_bg_2522[] = {
	{ 1,  0x00002050, 0x000c1fda, 0x00000101, 0 },
	{ 2,  0x00002050, 0x000c1fee, 0x00000101, 0 },
	{ 3,  0x00002050, 0x000c2002, 0x00000101, 0 },
	{ 4,  0x00002050, 0x000c2016, 0x00000101, 0 },
	{ 5,  0x00002050, 0x000c202a, 0x00000101, 0 },
	{ 6,  0x00002050, 0x000c203e, 0x00000101, 0 },
	{ 7,  0x00002050, 0x000c2052, 0x00000101, 0 },
	{ 8,  0x00002050, 0x000c2066, 0x00000101, 0 },
	{ 9,  0x00002050, 0x000c207a, 0x00000101, 0 },
	{ 10, 0x00002050, 0x000c208e, 0x00000101, 0 },
	{ 11, 0x00002050, 0x000c20a2, 0x00000101, 0 },
	{ 12, 0x00002050, 0x000c20b6, 0x00000101, 0 },
	{ 13, 0x00002050, 0x000c20ca, 0x00000101, 0 },
	{ 14, 0x00002050, 0x000c20fa, 0x00000101, 0 },
};

/*
 * RF value list for RF2523
 * Supports: 2.4 GHz
 */
static const struct rf_channel rf_vals_bg_2523[] = {
	{ 1,  0x00022010, 0x00000c9e, 0x000e0111, 0x00000a1b },
	{ 2,  0x00022010, 0x00000ca2, 0x000e0111, 0x00000a1b },
	{ 3,  0x00022010, 0x00000ca6, 0x000e0111, 0x00000a1b },
	{ 4,  0x00022010, 0x00000caa, 0x000e0111, 0x00000a1b },
	{ 5,  0x00022010, 0x00000cae, 0x000e0111, 0x00000a1b },
	{ 6,  0x00022010, 0x00000cb2, 0x000e0111, 0x00000a1b },
	{ 7,  0x00022010, 0x00000cb6, 0x000e0111, 0x00000a1b },
	{ 8,  0x00022010, 0x00000cba, 0x000e0111, 0x00000a1b },
	{ 9,  0x00022010, 0x00000cbe, 0x000e0111, 0x00000a1b },
	{ 10, 0x00022010, 0x00000d02, 0x000e0111, 0x00000a1b },
	{ 11, 0x00022010, 0x00000d06, 0x000e0111, 0x00000a1b },
	{ 12, 0x00022010, 0x00000d0a, 0x000e0111, 0x00000a1b },
	{ 13, 0x00022010, 0x00000d0e, 0x000e0111, 0x00000a1b },
	{ 14, 0x00022010, 0x00000d1a, 0x000e0111, 0x00000a03 },
};

/*
 * RF value list for RF2524
 * Supports: 2.4 GHz
 */
static const struct rf_channel rf_vals_bg_2524[] = {
	{ 1,  0x00032020, 0x00000c9e, 0x00000101, 0x00000a1b },
	{ 2,  0x00032020, 0x00000ca2, 0x00000101, 0x00000a1b },
	{ 3,  0x00032020, 0x00000ca6, 0x00000101, 0x00000a1b },
	{ 4,  0x00032020, 0x00000caa, 0x00000101, 0x00000a1b },
	{ 5,  0x00032020, 0x00000cae, 0x00000101, 0x00000a1b },
	{ 6,  0x00032020, 0x00000cb2, 0x00000101, 0x00000a1b },
	{ 7,  0x00032020, 0x00000cb6, 0x00000101, 0x00000a1b },
	{ 8,  0x00032020, 0x00000cba, 0x00000101, 0x00000a1b },
	{ 9,  0x00032020, 0x00000cbe, 0x00000101, 0x00000a1b },
	{ 10, 0x00032020, 0x00000d02, 0x00000101, 0x00000a1b },
	{ 11, 0x00032020, 0x00000d06, 0x00000101, 0x00000a1b },
	{ 12, 0x00032020, 0x00000d0a, 0x00000101, 0x00000a1b },
	{ 13, 0x00032020, 0x00000d0e, 0x00000101, 0x00000a1b },
	{ 14, 0x00032020, 0x00000d1a, 0x00000101, 0x00000a03 },
};

/*
 * RF value list for RF2525
 * Supports: 2.4 GHz
 */
static const struct rf_channel rf_vals_bg_2525[] = {
	{ 1,  0x00022020, 0x00080c9e, 0x00060111, 0x00000a1b },
	{ 2,  0x00022020, 0x00080ca2, 0x00060111, 0x00000a1b },
	{ 3,  0x00022020, 0x00080ca6, 0x00060111, 0x00000a1b },
	{ 4,  0x00022020, 0x00080caa, 0x00060111, 0x00000a1b },
	{ 5,  0x00022020, 0x00080cae, 0x00060111, 0x00000a1b },
	{ 6,  0x00022020, 0x00080cb2, 0x00060111, 0x00000a1b },
	{ 7,  0x00022020, 0x00080cb6, 0x00060111, 0x00000a1b },
	{ 8,  0x00022020, 0x00080cba, 0x00060111, 0x00000a1b },
	{ 9,  0x00022020, 0x00080cbe, 0x00060111, 0x00000a1b },
	{ 10, 0x00022020, 0x00080d02, 0x00060111, 0x00000a1b },
	{ 11, 0x00022020, 0x00080d06, 0x00060111, 0x00000a1b },
	{ 12, 0x00022020, 0x00080d0a, 0x00060111, 0x00000a1b },
	{ 13, 0x00022020, 0x00080d0e, 0x00060111, 0x00000a1b },
	{ 14, 0x00022020, 0x00080d1a, 0x00060111, 0x00000a03 },
};

/*
 * RF value list for RF2525e
 * Supports: 2.4 GHz
 */
static const struct rf_channel rf_vals_bg_2525e[] = {
	{ 1,  0x00022010, 0x0000089a, 0x00060111, 0x00000e1b },
	{ 2,  0x00022010, 0x0000089e, 0x00060111, 0x00000e07 },
	{ 3,  0x00022010, 0x0000089e, 0x00060111, 0x00000e1b },
	{ 4,  0x00022010, 0x000008a2, 0x00060111, 0x00000e07 },
	{ 5,  0x00022010, 0x000008a2, 0x00060111, 0x00000e1b },
	{ 6,  0x00022010, 0x000008a6, 0x00060111, 0x00000e07 },
	{ 7,  0x00022010, 0x000008a6, 0x00060111, 0x00000e1b },
	{ 8,  0x00022010, 0x000008aa, 0x00060111, 0x00000e07 },
	{ 9,  0x00022010, 0x000008aa, 0x00060111, 0x00000e1b },
	{ 10, 0x00022010, 0x000008ae, 0x00060111, 0x00000e07 },
	{ 11, 0x00022010, 0x000008ae, 0x00060111, 0x00000e1b },
	{ 12, 0x00022010, 0x000008b2, 0x00060111, 0x00000e07 },
	{ 13, 0x00022010, 0x000008b2, 0x00060111, 0x00000e1b },
	{ 14, 0x00022010, 0x000008b6, 0x00060111, 0x00000e23 },
};

/*
 * RF value list for RF5222
 * Supports: 2.4 GHz & 5.2 GHz
 */
static const struct rf_channel rf_vals_5222[] = {
	{ 1,  0x00022020, 0x00001136, 0x00000101, 0x00000a0b },
	{ 2,  0x00022020, 0x0000113a, 0x00000101, 0x00000a0b },
	{ 3,  0x00022020, 0x0000113e, 0x00000101, 0x00000a0b },
	{ 4,  0x00022020, 0x00001182, 0x00000101, 0x00000a0b },
	{ 5,  0x00022020, 0x00001186, 0x00000101, 0x00000a0b },
	{ 6,  0x00022020, 0x0000118a, 0x00000101, 0x00000a0b },
	{ 7,  0x00022020, 0x0000118e, 0x00000101, 0x00000a0b },
	{ 8,  0x00022020, 0x00001192, 0x00000101, 0x00000a0b },
	{ 9,  0x00022020, 0x00001196, 0x00000101, 0x00000a0b },
	{ 10, 0x00022020, 0x0000119a, 0x00000101, 0x00000a0b },
	{ 11, 0x00022020, 0x0000119e, 0x00000101, 0x00000a0b },
	{ 12, 0x00022020, 0x000011a2, 0x00000101, 0x00000a0b },
	{ 13, 0x00022020, 0x000011a6, 0x00000101, 0x00000a0b },
	{ 14, 0x00022020, 0x000011ae, 0x00000101, 0x00000a1b },

	/* 802.11 UNI / HyperLan 2 */
	{ 36, 0x00022010, 0x00018896, 0x00000101, 0x00000a1f },
	{ 40, 0x00022010, 0x0001889a, 0x00000101, 0x00000a1f },
	{ 44, 0x00022010, 0x0001889e, 0x00000101, 0x00000a1f },
	{ 48, 0x00022010, 0x000188a2, 0x00000101, 0x00000a1f },
	{ 52, 0x00022010, 0x000188a6, 0x00000101, 0x00000a1f },
	{ 66, 0x00022010, 0x000188aa, 0x00000101, 0x00000a1f },
	{ 60, 0x00022010, 0x000188ae, 0x00000101, 0x00000a1f },
	{ 64, 0x00022010, 0x000188b2, 0x00000101, 0x00000a1f },

	/* 802.11 HyperLan 2 */
	{ 100, 0x00022010, 0x00008802, 0x00000101, 0x00000a0f },
	{ 104, 0x00022010, 0x00008806, 0x00000101, 0x00000a0f },
	{ 108, 0x00022010, 0x0000880a, 0x00000101, 0x00000a0f },
	{ 112, 0x00022010, 0x0000880e, 0x00000101, 0x00000a0f },
	{ 116, 0x00022010, 0x00008812, 0x00000101, 0x00000a0f },
	{ 120, 0x00022010, 0x00008816, 0x00000101, 0x00000a0f },
	{ 124, 0x00022010, 0x0000881a, 0x00000101, 0x00000a0f },
	{ 128, 0x00022010, 0x0000881e, 0x00000101, 0x00000a0f },
	{ 132, 0x00022010, 0x00008822, 0x00000101, 0x00000a0f },
	{ 136, 0x00022010, 0x00008826, 0x00000101, 0x00000a0f },

	/* 802.11 UNII */
	{ 140, 0x00022010, 0x0000882a, 0x00000101, 0x00000a0f },
	{ 149, 0x00022020, 0x000090a6, 0x00000101, 0x00000a07 },
	{ 153, 0x00022020, 0x000090ae, 0x00000101, 0x00000a07 },
	{ 157, 0x00022020, 0x000090b6, 0x00000101, 0x00000a07 },
	{ 161, 0x00022020, 0x000090be, 0x00000101, 0x00000a07 },
};

static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
{
	struct hw_mode_spec *spec = &rt2x00dev->spec;
	struct channel_info *info;
	u8 *tx_power;
	unsigned int i;

	/*
	 * Initialize all hw fields.
	 *
	 * Don't set IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING unless we are
	 * capable of sending the buffered frames out after the DTIM
	 * transmission using rt2x00lib_beacondone. This will send out
	 * multicast and broadcast traffic immediately instead of buffering it
	 * infinitly and thus dropping it after some time.
	 */
	ieee80211_hw_set(rt2x00dev->hw, PS_NULLFUNC_STACK);
	ieee80211_hw_set(rt2x00dev->hw, SUPPORTS_PS);
	ieee80211_hw_set(rt2x00dev->hw, RX_INCLUDES_FCS);
	ieee80211_hw_set(rt2x00dev->hw, SIGNAL_DBM);

	/*
	 * Disable powersaving as default.
	 */
	rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;

	SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
	SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
				rt2x00_eeprom_addr(rt2x00dev,
						   EEPROM_MAC_ADDR_0));

	/*
	 * Initialize hw_mode information.
	 */
	spec->supported_bands = SUPPORT_BAND_2GHZ;
	spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;

	if (rt2x00_rf(rt2x00dev, RF2522)) {
		spec->num_channels = ARRAY_SIZE(rf_vals_bg_2522);
		spec->channels = rf_vals_bg_2522;
	} else if (rt2x00_rf(rt2x00dev, RF2523)) {
		spec->num_channels = ARRAY_SIZE(rf_vals_bg_2523);
		spec->channels = rf_vals_bg_2523;
	} else if (rt2x00_rf(rt2x00dev, RF2524)) {
		spec->num_channels = ARRAY_SIZE(rf_vals_bg_2524);
		spec->channels = rf_vals_bg_2524;
	} else if (rt2x00_rf(rt2x00dev, RF2525)) {
		spec->num_channels = ARRAY_SIZE(rf_vals_bg_2525);
		spec->channels = rf_vals_bg_2525;
	} else if (rt2x00_rf(rt2x00dev, RF2525E)) {
		spec->num_channels = ARRAY_SIZE(rf_vals_bg_2525e);
		spec->channels = rf_vals_bg_2525e;
	} else if (rt2x00_rf(rt2x00dev, RF5222)) {
		spec->supported_bands |= SUPPORT_BAND_5GHZ;
		spec->num_channels = ARRAY_SIZE(rf_vals_5222);
		spec->channels = rf_vals_5222;
	}

	/*
	 * Create channel information array
	 */
	info = kzalloc_objs(*info, spec->num_channels);
	if (!info)
		return -ENOMEM;

	spec->channels_info = info;

	tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_START);
	for (i = 0; i < 14; i++) {
		info[i].max_power = MAX_TXPOWER;
		info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
	}

	if (spec->num_channels > 14) {
		for (i = 14; i < spec->num_channels; i++) {
			info[i].max_power = MAX_TXPOWER;
			info[i].default_power1 = DEFAULT_TXPOWER;
		}
	}

	return 0;
}

static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev)
{
	int retval;
	u16 reg;

	/*
	 * Allocate eeprom data.
	 */
	retval = rt2500usb_validate_eeprom(rt2x00dev);
	if (retval)
		return retval;

	retval = rt2500usb_init_eeprom(rt2x00dev);
	if (retval)
		return retval;

	/*
	 * Enable rfkill polling by setting GPIO direction of the
	 * rfkill switch GPIO pin correctly.
	 */
	reg = rt2500usb_register_read(rt2x00dev, MAC_CSR19);
	rt2x00_set_field16(&reg, MAC_CSR19_DIR0, 0);
	rt2500usb_register_write(rt2x00dev, MAC_CSR19, reg);

	/*
	 * Initialize hw specifications.
	 */
	retval = rt2500usb_probe_hw_mode(rt2x00dev);
	if (retval)
		return retval;

	/*
	 * This device requires the atim queue
	 */
	__set_bit(REQUIRE_ATIM_QUEUE, &rt2x00dev->cap_flags);
	__set_bit(REQUIRE_BEACON_GUARD, &rt2x00dev->cap_flags);
	if (!modparam_nohwcrypt) {
		__set_bit(CAPABILITY_HW_CRYPTO, &rt2x00dev->cap_flags);
		__set_bit(REQUIRE_COPY_IV, &rt2x00dev->cap_flags);
	}
	__set_bit(REQUIRE_SW_SEQNO, &rt2x00dev->cap_flags);
	__set_bit(REQUIRE_PS_AUTOWAKE, &rt2x00dev->cap_flags);

	/*
	 * Set the rssi offset.
	 */
	rt2x00dev->rssi_offset = DEFAULT_RSSI_OFFSET;

	return 0;
}

static const struct ieee80211_ops rt2500usb_mac80211_ops = {
	.add_chanctx = ieee80211_emulate_add_chanctx,
	.remove_chanctx = ieee80211_emulate_remove_chanctx,
	.change_chanctx = ieee80211_emulate_change_chanctx,
	.switch_vif_chanctx = ieee80211_emulate_switch_vif_chanctx,
	.tx			= rt2x00mac_tx,
	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
	.start			= rt2x00mac_start,
	.stop			= rt2x00mac_stop,
	.add_interface		= rt2x00mac_add_interface,
	.remove_interface	= rt2x00mac_remove_interface,
	.config			= rt2x00mac_config,
	.configure_filter	= rt2x00mac_configure_filter,
	.set_tim		= rt2x00mac_set_tim,
	.set_key		= rt2x00mac_set_key,
	.sw_scan_start		= rt2x00mac_sw_scan_start,
	.sw_scan_complete	= rt2x00mac_sw_scan_complete,
	.get_stats		= rt2x00mac_get_stats,
	.bss_info_changed	= rt2x00mac_bss_info_changed,
	.conf_tx		= rt2x00mac_conf_tx,
	.rfkill_poll		= rt2x00mac_rfkill_poll,
	.flush			= rt2x00mac_flush,
	.set_antenna		= rt2x00mac_set_antenna,
	.get_antenna		= rt2x00mac_get_antenna,
	.get_ringparam		= rt2x00mac_get_ringparam,
	.tx_frames_pending	= rt2x00mac_tx_frames_pending,
};

static const struct rt2x00lib_ops rt2500usb_rt2x00_ops = {
	.probe_hw		= rt2500usb_probe_hw,
	.initialize		= rt2x00usb_initialize,
	.uninitialize		= rt2x00usb_uninitialize,
	.clear_entry		= rt2x00usb_clear_entry,
	.set_device_state	= rt2500usb_set_device_state,
	.rfkill_poll		= rt2500usb_rfkill_poll,
	.link_stats		= rt2500usb_link_stats,
	.reset_tuner		= rt2500usb_reset_tuner,
	.watchdog		= rt2x00usb_watchdog,
	.start_queue		= rt2500usb_start_queue,
	.kick_queue		= rt2x00usb_kick_queue,
	.stop_queue		= rt2500usb_stop_queue,
	.flush_queue		= rt2x00usb_flush_queue,
	.write_tx_desc		= rt2500usb_write_tx_desc,
	.write_beacon		= rt2500usb_write_beacon,
	.get_tx_data_len	= rt2500usb_get_tx_data_len,
	.fill_rxdone		= rt2500usb_fill_rxdone,
	.config_shared_key	= rt2500usb_config_key,
	.config_pairwise_key	= rt2500usb_config_key,
	.config_filter		= rt2500usb_config_filter,
	.config_intf		= rt2500usb_config_intf,
	.config_erp		= rt2500usb_config_erp,
	.config_ant		= rt2500usb_config_ant,
	.config			= rt2500usb_config,
};

static void rt2500usb_queue_init(struct data_queue *queue)
{
	switch (queue->qid) {
	case QID_RX:
		queue->limit = 32;
		queue->data_size = DATA_FRAME_SIZE;
		queue->desc_size = RXD_DESC_SIZE;
		queue->priv_size = sizeof(struct queue_entry_priv_usb);
		break;

	case QID_AC_VO:
	case QID_AC_VI:
	case QID_AC_BE:
	case QID_AC_BK:
		queue->limit = 32;
		queue->data_size = DATA_FRAME_SIZE;
		queue->desc_size = TXD_DESC_SIZE;
		queue->priv_size = sizeof(struct queue_entry_priv_usb);
		break;

	case QID_BEACON:
		queue->limit = 1;
		queue->data_size = MGMT_FRAME_SIZE;
		queue->desc_size = TXD_DESC_SIZE;
		queue->priv_size = sizeof(struct queue_entry_priv_usb_bcn);
		break;

	case QID_ATIM:
		queue->limit = 8;
		queue->data_size = DATA_FRAME_SIZE;
		queue->desc_size = TXD_DESC_SIZE;
		queue->priv_size = sizeof(struct queue_entry_priv_usb);
		break;

	default:
		BUG();
		break;
	}
}

static const struct rt2x00_ops rt2500usb_ops = {
	.name			= KBUILD_MODNAME,
	.max_ap_intf		= 1,
	.eeprom_size		= EEPROM_SIZE,
	.rf_size		= RF_SIZE,
	.tx_queues		= NUM_TX_QUEUES,
	.queue_init		= rt2500usb_queue_init,
	.lib			= &rt2500usb_rt2x00_ops,
	.hw			= &rt2500usb_mac80211_ops,
#ifdef CONFIG_RT2X00_LIB_DEBUGFS
	.debugfs		= &rt2500usb_rt2x00debug,
#endif /* CONFIG_RT2X00_LIB_DEBUGFS */
};

/*
 * rt2500usb module information.
 */
static const struct usb_device_id rt2500usb_device_table[] = {
	/* ASUS */
	{ USB_DEVICE(0x0b05, 0x1706) },
	{ USB_DEVICE(0x0b05, 0x1707) },
	/* Belkin */
	{ USB_DEVICE(0x050d, 0x7050) },	/* FCC ID: K7SF5D7050A ver. 2.x */
	{ USB_DEVICE(0x050d, 0x7051) },
	/* Cisco Systems */
	{ USB_DEVICE(0x13b1, 0x000d) },
	{ USB_DEVICE(0x13b1, 0x0011) },
	{ USB_DEVICE(0x13b1, 0x001a) },
	/* Conceptronic */
	{ USB_DEVICE(0x14b2, 0x3c02) },
	/* D-LINK */
	{ USB_DEVICE(0x2001, 0x3c00) },
	/* Gigabyte */
	{ USB_DEVICE(0x1044, 0x8001) },
	{ USB_DEVICE(0x1044, 0x8007) },
	/* Hercules */
	{ USB_DEVICE(0x06f8, 0xe000) },
	/* Melco */
	{ USB_DEVICE(0x0411, 0x005e) },
	{ USB_DEVICE(0x0411, 0x0066) },
	{ USB_DEVICE(0x0411, 0x0067) },
	{ USB_DEVICE(0x0411, 0x008b) },
	{ USB_DEVICE(0x0411, 0x0097) },
	/* MSI */
	{ USB_DEVICE(0x0db0, 0x6861) },
	{ USB_DEVICE(0x0db0, 0x6865) },
	{ USB_DEVICE(0x0db0, 0x6869) },
	/* Ralink */
	{ USB_DEVICE(0x148f, 0x1706) },
	{ USB_DEVICE(0x148f, 0x2570) },
	{ USB_DEVICE(0x148f, 0x9020) },
	/* Sagem */
	{ USB_DEVICE(0x079b, 0x004b) },
	/* Siemens */
	{ USB_DEVICE(0x0681, 0x3c06) },
	/* SMC */
	{ USB_DEVICE(0x0707, 0xee13) },
	/* Spairon */
	{ USB_DEVICE(0x114b, 0x0110) },
	/* SURECOM */
	{ USB_DEVICE(0x0769, 0x11f3) },
	/* Trust */
	{ USB_DEVICE(0x0eb0, 0x9020) },
	/* VTech */
	{ USB_DEVICE(0x0f88, 0x3012) },
	/* Zinwell */
	{ USB_DEVICE(0x5a57, 0x0260) },
	{ 0, }
};

MODULE_AUTHOR(DRV_PROJECT);
MODULE_VERSION(DRV_VERSION);
MODULE_DESCRIPTION("Ralink RT2500 USB Wireless LAN driver.");
MODULE_DEVICE_TABLE(usb, rt2500usb_device_table);
MODULE_LICENSE("GPL");

static int rt2500usb_probe(struct usb_interface *usb_intf,
			   const struct usb_device_id *id)
{
	return rt2x00usb_probe(usb_intf, &rt2500usb_ops);
}

static struct usb_driver rt2500usb_driver = {
	.name		= KBUILD_MODNAME,
	.id_table	= rt2500usb_device_table,
	.probe		= rt2500usb_probe,
	.disconnect	= rt2x00usb_disconnect,
	.suspend	= rt2x00usb_suspend,
	.resume		= rt2x00usb_resume,
	.reset_resume	= rt2x00usb_resume,
	.disable_hub_initiated_lpm = 1,
};

module_usb_driver(rt2500usb_driver);
]

gemini-3-flash-preview

							input: 73112
							output: 23
							thoughts: 512
						

**Analyzing the USB Device Driver Conundrum**

Okay, so I've confirmed that `0x0db0:0x6869` is definitely in the `rt2500usb_device_table` – that's line 1018, easy enough. But the second device is all zeros... which, of course, shouldn't match any driver. That's a null match.

Now, the user mentions that their C reproducer calls `syz_usb_control_io` for that second, zeroed device with responses intended for the `asix` driver. And the puzzle deepens because they're rightfully asking, "How can `asix` be probed if `idVendor` is zero?" It can't! Or at least, it shouldn't be.

My initial thought was maybe the second device isn't really the second device; perhaps the intended target is actually the `asix` device. I am trying to understand the order of operations if the reproducer is doing the following:

1.  `syz_usb_connect(0, ...)` for `0x0db0:0x6869` (rt2500usb)
2.  `syz_usb_connect(1, ...)` for all zeros
3.  `syz_usb_connect(2, ...)` for `0x0bda:0x5088` (rtl8192cu)

Then, `syz_usb_control_io(1, ...)` with `asix` responses. But that zeroed device should not, cannot, be the `asix` driver.

Wait a second... could it be that `syz_usb_connect` with all zeros isn't a straightforward null device? In Syzkaller, it's pretty common for `syz_usb_connect` to take a pointer to a struct. If that pointer is NULL or pointing to a region of zeroed memory, maybe it has some special meaning? Maybe it's not a device, but something else entirely. We need to consider how `syz_usb_connect` handles NULL pointers or zeroed structs as input.

I'm going to shift gears. Let's look at the `asix` driver's `probe` function. Maybe it's being called for one of the other devices: `0x0db0:0x6869` (rt2500usb) or `0x0bda:0x5088` (rtl8192cu). But, neither of those match. So, that can't be it.

Okay, I might have missed something. I need to make sure I'm not overlooking anything in the `asix` ID table. I'll go back and check `drivers/net/usb/asix_devices.c` again. I'm going to search that file for `0x0db0` and `0x0bda` to be absolutely certain. It would be easy to miss something if the ID table is long or complex. I'll be sure to read through the file again to confirm I am not missing anything.

log-in to see details

map[Name:0x0db0]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 74360
							output: 27
							thoughts: 27
						

Okay, here's my summary, presented as a stream of thought:

**Finding the Needle in the Driver Haystack**

Right, so I'm on a hunt. I need to find the specific point in `drivers/net/usb/asix_devices.c` that's referencing `0x0db0`. It's likely a hardware ID, perhaps a vendor ID or device ID, related to an ASIX-based USB Ethernet adapter. Given my experience, I'm expecting this is probably within a device table or probe function. I'll get to it with some simple grep command, and then narrow it down with the results. I am looking for a direct match. Let's see what turns up. Let's start the search.

map[File:drivers/net/usb/asix_devices.c]

map[Contents:// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * ASIX AX8817X based USB 2.0 Ethernet Devices
 * Copyright (C) 2003-2006 David Hollis <dhollis@davehollis.com>
 * Copyright (C) 2005 Phil Chang <pchang23@sbcglobal.net>
 * Copyright (C) 2006 James Painter <jamie.painter@iname.com>
 * Copyright (c) 2002-2003 TiVo Inc.
 */

#include "asix.h"

#define PHY_MODE_MARVELL	0x0000
#define MII_MARVELL_LED_CTRL	0x0018
#define MII_MARVELL_STATUS	0x001b
#define MII_MARVELL_CTRL	0x0014

#define MARVELL_LED_MANUAL	0x0019

#define MARVELL_STATUS_HWCFG	0x0004

#define MARVELL_CTRL_TXDELAY	0x0002
#define MARVELL_CTRL_RXDELAY	0x0080

#define	PHY_MODE_RTL8211CL	0x000C

#define AX88772A_PHY14H		0x14
#define AX88772A_PHY14H_DEFAULT 0x442C

#define AX88772A_PHY15H		0x15
#define AX88772A_PHY15H_DEFAULT 0x03C8

#define AX88772A_PHY16H		0x16
#define AX88772A_PHY16H_DEFAULT 0x4044

struct ax88172_int_data {
	__le16 res1;
	u8 link;
	__le16 res2;
	u8 status;
	__le16 res3;
} __packed;

static void asix_status(struct usbnet *dev, struct urb *urb)
{
	struct ax88172_int_data *event;
	int link;

	if (urb->actual_length < 8)
		return;

	event = urb->transfer_buffer;
	link = event->link & 0x01;
	if (netif_carrier_ok(dev->net) != link) {
		usbnet_link_change(dev, link, 1);
		netdev_dbg(dev->net, "Link Status is: %d\n", link);
	}
}

static void asix_set_netdev_dev_addr(struct usbnet *dev, u8 *addr)
{
	if (is_valid_ether_addr(addr)) {
		eth_hw_addr_set(dev->net, addr);
	} else {
		netdev_info(dev->net, "invalid hw address, using random\n");
		eth_hw_addr_random(dev->net);
	}
}

/* Get the PHY Identifier from the PHYSID1 & PHYSID2 MII registers */
static u32 asix_get_phyid(struct usbnet *dev)
{
	int phy_reg;
	u32 phy_id;
	int i;

	/* Poll for the rare case the FW or phy isn't ready yet.  */
	for (i = 0; i < 100; i++) {
		phy_reg = asix_mdio_read(dev->net, dev->mii.phy_id, MII_PHYSID1);
		if (phy_reg < 0)
			return 0;
		if (phy_reg != 0 && phy_reg != 0xFFFF)
			break;
		mdelay(1);
	}

	if (phy_reg <= 0 || phy_reg == 0xFFFF)
		return 0;

	phy_id = (phy_reg & 0xffff) << 16;

	phy_reg = asix_mdio_read(dev->net, dev->mii.phy_id, MII_PHYSID2);
	if (phy_reg < 0)
		return 0;

	phy_id |= (phy_reg & 0xffff);

	return phy_id;
}

/* We need to override some ethtool_ops so we require our
   own structure so we don't interfere with other usbnet
   devices that may be connected at the same time. */
static const struct ethtool_ops ax88172_ethtool_ops = {
	.get_drvinfo		= usbnet_get_drvinfo,
	.get_link		= usbnet_get_link,
	.get_msglevel		= usbnet_get_msglevel,
	.set_msglevel		= usbnet_set_msglevel,
	.get_wol		= asix_get_wol,
	.set_wol		= asix_set_wol,
	.get_eeprom_len		= asix_get_eeprom_len,
	.get_eeprom		= asix_get_eeprom,
	.set_eeprom		= asix_set_eeprom,
	.nway_reset		= usbnet_nway_reset,
	.get_link_ksettings	= usbnet_get_link_ksettings_mii,
	.set_link_ksettings	= usbnet_set_link_ksettings_mii,
};

static void ax88172_set_multicast(struct net_device *net)
{
	struct usbnet *dev = netdev_priv(net);
	struct asix_data *data = (struct asix_data *)&dev->data;
	u8 rx_ctl = 0x8c;

	if (net->flags & IFF_PROMISC) {
		rx_ctl |= 0x01;
	} else if (net->flags & IFF_ALLMULTI ||
		   netdev_mc_count(net) > AX_MAX_MCAST) {
		rx_ctl |= 0x02;
	} else if (netdev_mc_empty(net)) {
		/* just broadcast and directed */
	} else {
		/* We use the 20 byte dev->data
		 * for our 8 byte filter buffer
		 * to avoid allocating memory that
		 * is tricky to free later */
		struct netdev_hw_addr *ha;
		u32 crc_bits;

		memset(data->multi_filter, 0, AX_MCAST_FILTER_SIZE);

		/* Build the multicast hash filter. */
		netdev_for_each_mc_addr(ha, net) {
			crc_bits = ether_crc(ETH_ALEN, ha->addr) >> 26;
			data->multi_filter[crc_bits >> 3] |=
			    1 << (crc_bits & 7);
		}

		asix_write_cmd_async(dev, AX_CMD_WRITE_MULTI_FILTER, 0, 0,
				   AX_MCAST_FILTER_SIZE, data->multi_filter);

		rx_ctl |= 0x10;
	}

	asix_write_cmd_async(dev, AX_CMD_WRITE_RX_CTL, rx_ctl, 0, 0, NULL);
}

static int ax88172_link_reset(struct usbnet *dev)
{
	u8 mode;
	struct ethtool_cmd ecmd = { .cmd = ETHTOOL_GSET };

	mii_check_media(&dev->mii, 1, 1);
	mii_ethtool_gset(&dev->mii, &ecmd);
	mode = AX88172_MEDIUM_DEFAULT;

	if (ecmd.duplex != DUPLEX_FULL)
		mode |= ~AX88172_MEDIUM_FD;

	netdev_dbg(dev->net, "ax88172_link_reset() speed: %u duplex: %d setting mode to 0x%04x\n",
		   ethtool_cmd_speed(&ecmd), ecmd.duplex, mode);

	asix_write_medium_mode(dev, mode, 0);

	return 0;
}

static const struct net_device_ops ax88172_netdev_ops = {
	.ndo_open		= usbnet_open,
	.ndo_stop		= usbnet_stop,
	.ndo_start_xmit		= usbnet_start_xmit,
	.ndo_tx_timeout		= usbnet_tx_timeout,
	.ndo_change_mtu		= usbnet_change_mtu,
	.ndo_get_stats64	= dev_get_tstats64,
	.ndo_set_mac_address 	= eth_mac_addr,
	.ndo_validate_addr	= eth_validate_addr,
	.ndo_eth_ioctl		= usbnet_mii_ioctl,
	.ndo_set_rx_mode	= ax88172_set_multicast,
};

static void asix_phy_reset(struct usbnet *dev, unsigned int reset_bits)
{
	unsigned int timeout = 5000;

	asix_mdio_write(dev->net, dev->mii.phy_id, MII_BMCR, reset_bits);

	/* give phy_id a chance to process reset */
	udelay(500);

	/* See IEEE 802.3 "22.2.4.1.1 Reset": 500ms max */
	while (timeout--) {
		if (asix_mdio_read(dev->net, dev->mii.phy_id, MII_BMCR)
							& BMCR_RESET)
			udelay(100);
		else
			return;
	}

	netdev_err(dev->net, "BMCR_RESET timeout on phy_id %d\n",
		   dev->mii.phy_id);
}

static int ax88172_bind(struct usbnet *dev, struct usb_interface *intf)
{
	int ret = 0;
	u8 buf[ETH_ALEN] = {0};
	int i;
	unsigned long gpio_bits = dev->driver_info->data;

	ret = usbnet_get_endpoints(dev, intf);
	if (ret)
		goto out;

	/* Toggle the GPIOs in a manufacturer/model specific way */
	for (i = 2; i >= 0; i--) {
		ret = asix_write_cmd(dev, AX_CMD_WRITE_GPIOS,
				(gpio_bits >> (i * 8)) & 0xff, 0, 0, NULL, 0);
		if (ret < 0)
			goto out;
		msleep(5);
	}

	ret = asix_write_rx_ctl(dev, 0x80, 0);
	if (ret < 0)
		goto out;

	/* Get the MAC address */
	ret = asix_read_cmd(dev, AX88172_CMD_READ_NODE_ID,
			    0, 0, ETH_ALEN, buf, 0);
	if (ret < 0) {
		netdev_dbg(dev->net, "read AX_CMD_READ_NODE_ID failed: %d\n",
			   ret);
		goto out;
	}

	asix_set_netdev_dev_addr(dev, buf);

	/* Initialize MII structure */
	dev->mii.dev = dev->net;
	dev->mii.mdio_read = asix_mdio_read;
	dev->mii.mdio_write = asix_mdio_write;
	dev->mii.phy_id_mask = 0x3f;
	dev->mii.reg_num_mask = 0x1f;

	dev->mii.phy_id = asix_read_phy_addr(dev, true);
	if (dev->mii.phy_id < 0)
		return dev->mii.phy_id;

	dev->net->netdev_ops = &ax88172_netdev_ops;
	dev->net->ethtool_ops = &ax88172_ethtool_ops;
	dev->net->needed_headroom = 4; /* cf asix_tx_fixup() */
	dev->net->needed_tailroom = 4; /* cf asix_tx_fixup() */

	asix_phy_reset(dev, BMCR_RESET);
	asix_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE,
		ADVERTISE_ALL | ADVERTISE_CSMA | ADVERTISE_PAUSE_CAP);
	mii_nway_restart(&dev->mii);

	return 0;

out:
	return ret;
}

static void ax88772_ethtool_get_strings(struct net_device *netdev, u32 sset,
					u8 *data)
{
	switch (sset) {
	case ETH_SS_TEST:
		net_selftest_get_strings(data);
		break;
	}
}

static int ax88772_ethtool_get_sset_count(struct net_device *ndev, int sset)
{
	switch (sset) {
	case ETH_SS_TEST:
		return net_selftest_get_count();
	default:
		return -EOPNOTSUPP;
	}
}

static void ax88772_ethtool_get_pauseparam(struct net_device *ndev,
					  struct ethtool_pauseparam *pause)
{
	struct usbnet *dev = netdev_priv(ndev);
	struct asix_common_private *priv = dev->driver_priv;

	phylink_ethtool_get_pauseparam(priv->phylink, pause);
}

static int ax88772_ethtool_set_pauseparam(struct net_device *ndev,
					 struct ethtool_pauseparam *pause)
{
	struct usbnet *dev = netdev_priv(ndev);
	struct asix_common_private *priv = dev->driver_priv;

	return phylink_ethtool_set_pauseparam(priv->phylink, pause);
}

static const struct ethtool_ops ax88772_ethtool_ops = {
	.get_drvinfo		= usbnet_get_drvinfo,
	.get_link		= usbnet_get_link,
	.get_msglevel		= usbnet_get_msglevel,
	.set_msglevel		= usbnet_set_msglevel,
	.get_wol		= asix_get_wol,
	.set_wol		= asix_set_wol,
	.get_eeprom_len		= asix_get_eeprom_len,
	.get_eeprom		= asix_get_eeprom,
	.set_eeprom		= asix_set_eeprom,
	.nway_reset		= phy_ethtool_nway_reset,
	.get_link_ksettings	= phy_ethtool_get_link_ksettings,
	.set_link_ksettings	= phy_ethtool_set_link_ksettings,
	.self_test		= net_selftest,
	.get_strings		= ax88772_ethtool_get_strings,
	.get_sset_count		= ax88772_ethtool_get_sset_count,
	.get_pauseparam		= ax88772_ethtool_get_pauseparam,
	.set_pauseparam		= ax88772_ethtool_set_pauseparam,
};

static int ax88772_reset(struct usbnet *dev)
{
	struct asix_data *data = (struct asix_data *)&dev->data;
	struct asix_common_private *priv = dev->driver_priv;
	int ret;

	/* Rewrite MAC address */
	ether_addr_copy(data->mac_addr, dev->net->dev_addr);
	ret = asix_write_cmd(dev, AX_CMD_WRITE_NODE_ID, 0, 0,
			     ETH_ALEN, data->mac_addr, 0);
	if (ret < 0)
		goto out;

	/* Set RX_CTL to default values with 2k buffer, and enable cactus */
	ret = asix_write_rx_ctl(dev, AX_DEFAULT_RX_CTL, 0);
	if (ret < 0)
		goto out;

	ret = asix_write_medium_mode(dev, AX88772_MEDIUM_DEFAULT, 0);
	if (ret < 0)
		goto out;

	phylink_start(priv->phylink);

	return 0;

out:
	return ret;
}

static int ax88772_hw_reset(struct usbnet *dev, int in_pm)
{
	struct asix_data *data = (struct asix_data *)&dev->data;
	struct asix_common_private *priv = dev->driver_priv;
	u16 rx_ctl;
	int ret;

	ret = asix_write_gpio(dev, AX_GPIO_RSE | AX_GPIO_GPO_2 |
			      AX_GPIO_GPO2EN, 5, in_pm);
	if (ret < 0)
		goto out;

	ret = asix_write_cmd(dev, AX_CMD_SW_PHY_SELECT, priv->embd_phy,
			     0, 0, NULL, in_pm);
	if (ret < 0) {
		netdev_dbg(dev->net, "Select PHY #1 failed: %d\n", ret);
		goto out;
	}

	if (priv->embd_phy) {
		ret = asix_sw_reset(dev, AX_SWRESET_IPPD, in_pm);
		if (ret < 0)
			goto out;

		usleep_range(10000, 11000);

		ret = asix_sw_reset(dev, AX_SWRESET_CLEAR, in_pm);
		if (ret < 0)
			goto out;

		msleep(60);

		ret = asix_sw_reset(dev, AX_SWRESET_IPRL | AX_SWRESET_PRL,
				    in_pm);
		if (ret < 0)
			goto out;
	} else {
		ret = asix_sw_reset(dev, AX_SWRESET_IPPD | AX_SWRESET_PRL,
				    in_pm);
		if (ret < 0)
			goto out;
	}

	msleep(150);

	if (in_pm && (!asix_mdio_read_nopm(dev->net, dev->mii.phy_id,
					   MII_PHYSID1))){
		ret = -EIO;
		goto out;
	}

	ret = asix_write_rx_ctl(dev, AX_DEFAULT_RX_CTL, in_pm);
	if (ret < 0)
		goto out;

	ret = asix_write_medium_mode(dev, AX88772_MEDIUM_DEFAULT, in_pm);
	if (ret < 0)
		goto out;

	ret = asix_write_cmd(dev, AX_CMD_WRITE_IPG0,
			     AX88772_IPG0_DEFAULT | AX88772_IPG1_DEFAULT,
			     AX88772_IPG2_DEFAULT, 0, NULL, in_pm);
	if (ret < 0) {
		netdev_dbg(dev->net, "Write IPG,IPG1,IPG2 failed: %d\n", ret);
		goto out;
	}

	/* Rewrite MAC address */
	ether_addr_copy(data->mac_addr, dev->net->dev_addr);
	ret = asix_write_cmd(dev, AX_CMD_WRITE_NODE_ID, 0, 0,
			     ETH_ALEN, data->mac_addr, in_pm);
	if (ret < 0)
		goto out;

	/* Set RX_CTL to default values with 2k buffer, and enable cactus */
	ret = asix_write_rx_ctl(dev, AX_DEFAULT_RX_CTL, in_pm);
	if (ret < 0)
		goto out;

	rx_ctl = asix_read_rx_ctl(dev, in_pm);
	netdev_dbg(dev->net, "RX_CTL is 0x%04x after all initializations\n",
		   rx_ctl);

	rx_ctl = asix_read_medium_status(dev, in_pm);
	netdev_dbg(dev->net,
		   "Medium Status is 0x%04x after all initializations\n",
		   rx_ctl);

	return 0;

out:
	return ret;
}

static int ax88772a_hw_reset(struct usbnet *dev, int in_pm)
{
	struct asix_data *data = (struct asix_data *)&dev->data;
	struct asix_common_private *priv = dev->driver_priv;
	u16 rx_ctl, phy14h, phy15h, phy16h;
	int ret;

	ret = asix_write_gpio(dev, AX_GPIO_RSE, 5, in_pm);
	if (ret < 0)
		goto out;

	ret = asix_write_cmd(dev, AX_CMD_SW_PHY_SELECT, priv->embd_phy |
			     AX_PHYSEL_SSEN, 0, 0, NULL, in_pm);
	if (ret < 0) {
		netdev_dbg(dev->net, "Select PHY #1 failed: %d\n", ret);
		goto out;
	}
	usleep_range(10000, 11000);

	ret = asix_sw_reset(dev, AX_SWRESET_IPPD | AX_SWRESET_IPRL, in_pm);
	if (ret < 0)
		goto out;

	usleep_range(10000, 11000);

	ret = asix_sw_reset(dev, AX_SWRESET_IPRL, in_pm);
	if (ret < 0)
		goto out;

	msleep(160);

	ret = asix_sw_reset(dev, AX_SWRESET_CLEAR, in_pm);
	if (ret < 0)
		goto out;

	ret = asix_sw_reset(dev, AX_SWRESET_IPRL, in_pm);
	if (ret < 0)
		goto out;

	msleep(200);

	if (in_pm && (!asix_mdio_read_nopm(dev->net, dev->mii.phy_id,
					   MII_PHYSID1))) {
		ret = -1;
		goto out;
	}

	if (priv->chipcode == AX_AX88772B_CHIPCODE) {
		ret = asix_write_cmd(dev, AX_QCTCTRL, 0x8000, 0x8001,
				     0, NULL, in_pm);
		if (ret < 0) {
			netdev_dbg(dev->net, "Write BQ setting failed: %d\n",
				   ret);
			goto out;
		}
	} else if (priv->chipcode == AX_AX88772A_CHIPCODE) {
		/* Check if the PHY registers have default settings */
		phy14h = asix_mdio_read_nopm(dev->net, dev->mii.phy_id,
					     AX88772A_PHY14H);
		phy15h = asix_mdio_read_nopm(dev->net, dev->mii.phy_id,
					     AX88772A_PHY15H);
		phy16h = asix_mdio_read_nopm(dev->net, dev->mii.phy_id,
					     AX88772A_PHY16H);

		netdev_dbg(dev->net,
			   "772a_hw_reset: MR20=0x%x MR21=0x%x MR22=0x%x\n",
			   phy14h, phy15h, phy16h);

		/* Restore PHY registers default setting if not */
		if (phy14h != AX88772A_PHY14H_DEFAULT)
			asix_mdio_write_nopm(dev->net, dev->mii.phy_id,
					     AX88772A_PHY14H,
					     AX88772A_PHY14H_DEFAULT);
		if (phy15h != AX88772A_PHY15H_DEFAULT)
			asix_mdio_write_nopm(dev->net, dev->mii.phy_id,
					     AX88772A_PHY15H,
					     AX88772A_PHY15H_DEFAULT);
		if (phy16h != AX88772A_PHY16H_DEFAULT)
			asix_mdio_write_nopm(dev->net, dev->mii.phy_id,
					     AX88772A_PHY16H,
					     AX88772A_PHY16H_DEFAULT);
	}

	ret = asix_write_cmd(dev, AX_CMD_WRITE_IPG0,
				AX88772_IPG0_DEFAULT | AX88772_IPG1_DEFAULT,
				AX88772_IPG2_DEFAULT, 0, NULL, in_pm);
	if (ret < 0) {
		netdev_dbg(dev->net, "Write IPG,IPG1,IPG2 failed: %d\n", ret);
		goto out;
	}

	/* Rewrite MAC address */
	memcpy(data->mac_addr, dev->net->dev_addr, ETH_ALEN);
	ret = asix_write_cmd(dev, AX_CMD_WRITE_NODE_ID, 0, 0, ETH_ALEN,
							data->mac_addr, in_pm);
	if (ret < 0)
		goto out;

	/* Set RX_CTL to default values with 2k buffer, and enable cactus */
	ret = asix_write_rx_ctl(dev, AX_DEFAULT_RX_CTL, in_pm);
	if (ret < 0)
		goto out;

	ret = asix_write_medium_mode(dev, AX88772_MEDIUM_DEFAULT, in_pm);
	if (ret < 0)
		return ret;

	/* Set RX_CTL to default values with 2k buffer, and enable cactus */
	ret = asix_write_rx_ctl(dev, AX_DEFAULT_RX_CTL, in_pm);
	if (ret < 0)
		goto out;

	rx_ctl = asix_read_rx_ctl(dev, in_pm);
	netdev_dbg(dev->net, "RX_CTL is 0x%04x after all initializations\n",
		   rx_ctl);

	rx_ctl = asix_read_medium_status(dev, in_pm);
	netdev_dbg(dev->net,
		   "Medium Status is 0x%04x after all initializations\n",
		   rx_ctl);

	return 0;

out:
	return ret;
}

static const struct net_device_ops ax88772_netdev_ops = {
	.ndo_open		= usbnet_open,
	.ndo_stop		= usbnet_stop,
	.ndo_start_xmit		= usbnet_start_xmit,
	.ndo_tx_timeout		= usbnet_tx_timeout,
	.ndo_change_mtu		= usbnet_change_mtu,
	.ndo_get_stats64	= dev_get_tstats64,
	.ndo_set_mac_address 	= asix_set_mac_address,
	.ndo_validate_addr	= eth_validate_addr,
	.ndo_eth_ioctl		= phy_do_ioctl_running,
	.ndo_set_rx_mode        = asix_set_multicast,
};

static void ax88772_suspend(struct usbnet *dev)
{
	struct asix_common_private *priv = dev->driver_priv;
	u16 medium;

	if (netif_running(dev->net)) {
		rtnl_lock();
		phylink_suspend(priv->phylink, false);
		rtnl_unlock();
	}

	/* Stop MAC operation */
	medium = asix_read_medium_status(dev, 1);
	medium &= ~AX_MEDIUM_RE;
	asix_write_medium_mode(dev, medium, 1);

	netdev_dbg(dev->net, "ax88772_suspend: medium=0x%04x\n",
		   asix_read_medium_status(dev, 1));
}

/* Notes on PM callbacks and locking context:
 *
 * - asix_suspend()/asix_resume() are invoked for both runtime PM and
 *   system-wide suspend/resume. For struct usb_driver the ->resume()
 *   callback does not receive pm_message_t, so the resume type cannot
 *   be distinguished here.
 *
 * - The MAC driver must hold RTNL when calling phylink interfaces such as
 *   phylink_suspend()/resume(). Those calls will also perform MDIO I/O.
 *
 * - Taking RTNL and doing MDIO from a runtime-PM resume callback (while
 *   the USB PM lock is held) is fragile. Since autosuspend brings no
 *   measurable power saving here, we block it by holding a PM usage
 *   reference in ax88772_bind().
 */
static int asix_suspend(struct usb_interface *intf, pm_message_t message)
{
	struct usbnet *dev = usb_get_intfdata(intf);
	struct asix_common_private *priv = dev->driver_priv;

	if (priv && priv->suspend)
		priv->suspend(dev);

	return usbnet_suspend(intf, message);
}

static void ax88772_resume(struct usbnet *dev)
{
	struct asix_common_private *priv = dev->driver_priv;
	int i;

	for (i = 0; i < 3; i++)
		if (!priv->reset(dev, 1))
			break;

	if (netif_running(dev->net)) {
		rtnl_lock();
		phylink_resume(priv->phylink);
		rtnl_unlock();
	}
}

static int asix_resume(struct usb_interface *intf)
{
	struct usbnet *dev = usb_get_intfdata(intf);
	struct asix_common_private *priv = dev->driver_priv;

	if (priv && priv->resume)
		priv->resume(dev);

	return usbnet_resume(intf);
}

static int ax88772_init_mdio(struct usbnet *dev)
{
	struct asix_common_private *priv = dev->driver_priv;
	int ret;

	priv->mdio = mdiobus_alloc();
	if (!priv->mdio)
		return -ENOMEM;

	priv->mdio->priv = dev;
	priv->mdio->read = &asix_mdio_bus_read;
	priv->mdio->write = &asix_mdio_bus_write;
	priv->mdio->name = "Asix MDIO Bus";
	priv->mdio->phy_mask = ~(BIT(priv->phy_addr & 0x1f) | BIT(AX_EMBD_PHY_ADDR));
	/* mii bus name is usb-<usb bus number>-<usb device number> */
	snprintf(priv->mdio->id, MII_BUS_ID_SIZE, "usb-%03d:%03d",
		 dev->udev->bus->busnum, dev->udev->devnum);

	ret = mdiobus_register(priv->mdio);
	if (ret) {
		netdev_err(dev->net, "Could not register MDIO bus (err %d)\n", ret);
		mdiobus_free(priv->mdio);
		priv->mdio = NULL;
	}

	return ret;
}

static void ax88772_mdio_unregister(struct asix_common_private *priv)
{
	mdiobus_unregister(priv->mdio);
	mdiobus_free(priv->mdio);
}

static int ax88772_init_phy(struct usbnet *dev)
{
	struct asix_common_private *priv = dev->driver_priv;
	int ret;

	priv->phydev = mdiobus_get_phy(priv->mdio, priv->phy_addr);
	if (!priv->phydev) {
		netdev_err(dev->net, "Could not find PHY\n");
		return -ENODEV;
	}

	ret = phylink_connect_phy(priv->phylink, priv->phydev);
	if (ret) {
		netdev_err(dev->net, "Could not connect PHY\n");
		return ret;
	}

	phy_suspend(priv->phydev);
	priv->phydev->mac_managed_pm = true;

	phy_attached_info(priv->phydev);

	if (priv->embd_phy)
		return 0;

	/* In case main PHY is not the embedded PHY and MAC is RMII clock
	 * provider, we need to suspend embedded PHY by keeping PLL enabled
	 * (AX_SWRESET_IPPD == 0).
	 */
	priv->phydev_int = mdiobus_get_phy(priv->mdio, AX_EMBD_PHY_ADDR);
	if (!priv->phydev_int) {
		rtnl_lock();
		phylink_disconnect_phy(priv->phylink);
		rtnl_unlock();
		netdev_err(dev->net, "Could not find internal PHY\n");
		return -ENODEV;
	}

	priv->phydev_int->mac_managed_pm = true;
	phy_suspend(priv->phydev_int);

	return 0;
}

static void ax88772_mac_config(struct phylink_config *config, unsigned int mode,
			      const struct phylink_link_state *state)
{
	/* Nothing to do */
}

static void ax88772_mac_link_down(struct phylink_config *config,
				 unsigned int mode, phy_interface_t interface)
{
	struct usbnet *dev = netdev_priv(to_net_dev(config->dev));

	asix_write_medium_mode(dev, 0, 0);
	usbnet_link_change(dev, false, false);
}

static void ax88772_mac_link_up(struct phylink_config *config,
			       struct phy_device *phy,
			       unsigned int mode, phy_interface_t interface,
			       int speed, int duplex,
			       bool tx_pause, bool rx_pause)
{
	struct usbnet *dev = netdev_priv(to_net_dev(config->dev));
	u16 m = AX_MEDIUM_AC | AX_MEDIUM_RE;

	m |= duplex ? AX_MEDIUM_FD : 0;

	switch (speed) {
	case SPEED_100:
		m |= AX_MEDIUM_PS;
		break;
	case SPEED_10:
		break;
	default:
		return;
	}

	if (tx_pause)
		m |= AX_MEDIUM_TFC;

	if (rx_pause)
		m |= AX_MEDIUM_RFC;

	asix_write_medium_mode(dev, m, 0);
	usbnet_link_change(dev, true, false);
}

static const struct phylink_mac_ops ax88772_phylink_mac_ops = {
	.mac_config = ax88772_mac_config,
	.mac_link_down = ax88772_mac_link_down,
	.mac_link_up = ax88772_mac_link_up,
};

static int ax88772_phylink_setup(struct usbnet *dev)
{
	struct asix_common_private *priv = dev->driver_priv;
	phy_interface_t phy_if_mode;
	struct phylink *phylink;

	priv->phylink_config.dev = &dev->net->dev;
	priv->phylink_config.type = PHYLINK_NETDEV;
	priv->phylink_config.mac_capabilities = MAC_SYM_PAUSE | MAC_ASYM_PAUSE |
		MAC_10 | MAC_100;

	__set_bit(PHY_INTERFACE_MODE_INTERNAL,
		  priv->phylink_config.supported_interfaces);
	__set_bit(PHY_INTERFACE_MODE_RMII,
		  priv->phylink_config.supported_interfaces);

	if (priv->embd_phy)
		phy_if_mode = PHY_INTERFACE_MODE_INTERNAL;
	else
		phy_if_mode = PHY_INTERFACE_MODE_RMII;

	phylink = phylink_create(&priv->phylink_config, dev->net->dev.fwnode,
				 phy_if_mode, &ax88772_phylink_mac_ops);
	if (IS_ERR(phylink))
		return PTR_ERR(phylink);

	priv->phylink = phylink;
	return 0;
}

static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf)
{
	struct asix_common_private *priv;
	u8 buf[ETH_ALEN] = {0};
	int ret, i;

	priv = devm_kzalloc(&dev->udev->dev, sizeof(*priv), GFP_KERNEL);
	if (!priv)
		return -ENOMEM;

	dev->driver_priv = priv;

	ret = usbnet_get_endpoints(dev, intf);
	if (ret)
		return ret;

	/* Maybe the boot loader passed the MAC address via device tree */
	if (!eth_platform_get_mac_address(&dev->udev->dev, buf)) {
		netif_dbg(dev, ifup, dev->net,
			  "MAC address read from device tree");
	} else {
		/* Try getting the MAC address from EEPROM */
		if (dev->driver_info->data & FLAG_EEPROM_MAC) {
			for (i = 0; i < (ETH_ALEN >> 1); i++) {
				ret = asix_read_cmd(dev, AX_CMD_READ_EEPROM,
						    0x04 + i, 0, 2, buf + i * 2,
						    0);
				if (ret < 0)
					break;
			}
		} else {
			ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID,
					    0, 0, ETH_ALEN, buf, 0);
		}

		if (ret < 0) {
			netdev_dbg(dev->net, "Failed to read MAC address: %d\n",
				   ret);
			return ret;
		}
	}

	asix_set_netdev_dev_addr(dev, buf);

	dev->net->netdev_ops = &ax88772_netdev_ops;
	dev->net->ethtool_ops = &ax88772_ethtool_ops;
	dev->net->needed_headroom = 4; /* cf asix_tx_fixup() */
	dev->net->needed_tailroom = 4; /* cf asix_tx_fixup() */

	ret = asix_read_phy_addr(dev, true);
	if (ret < 0)
		return ret;

	priv->phy_addr = ret;
	priv->embd_phy = ((priv->phy_addr & 0x1f) == AX_EMBD_PHY_ADDR);

	ret = asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG, 0, 0, 1,
			    &priv->chipcode, 0);
	if (ret < 0) {
		netdev_dbg(dev->net, "Failed to read STATMNGSTS_REG: %d\n", ret);
		return ret;
	}

	priv->chipcode &= AX_CHIPCODE_MASK;

	priv->resume = ax88772_resume;
	priv->suspend = ax88772_suspend;
	if (priv->chipcode == AX_AX88772_CHIPCODE)
		priv->reset = ax88772_hw_reset;
	else
		priv->reset = ax88772a_hw_reset;

	ret = priv->reset(dev, 0);
	if (ret < 0) {
		netdev_dbg(dev->net, "Failed to reset AX88772: %d\n", ret);
		return ret;
	}

	/* Asix framing packs multiple eth frames into a 2K usb bulk transfer */
	if (dev->driver_info->flags & FLAG_FRAMING_AX) {
		/* hard_mtu  is still the default - the device does not support
		   jumbo eth frames */
		dev->rx_urb_size = 2048;
	}

	priv->presvd_phy_bmcr = 0;
	priv->presvd_phy_advertise = 0;

	ret = ax88772_init_mdio(dev);
	if (ret)
		goto mdio_err;

	ret = ax88772_phylink_setup(dev);
	if (ret)
		goto phylink_err;

	ret = ax88772_init_phy(dev);
	if (ret)
		goto initphy_err;

	/* Keep this interface runtime-PM active by taking a usage ref.
	 * Prevents runtime suspend while bound and avoids resume paths
	 * that could deadlock (autoresume under RTNL while USB PM lock
	 * is held, phylink/MDIO wants RTNL).
	 */
	pm_runtime_get_noresume(&intf->dev);

	return 0;

initphy_err:
	phylink_destroy(priv->phylink);
phylink_err:
	ax88772_mdio_unregister(priv);
mdio_err:
	return ret;
}

static int ax88772_stop(struct usbnet *dev)
{
	struct asix_common_private *priv = dev->driver_priv;

	phylink_stop(priv->phylink);

	return 0;
}

static void ax88772_unbind(struct usbnet *dev, struct usb_interface *intf)
{
	struct asix_common_private *priv = dev->driver_priv;

	rtnl_lock();
	phylink_disconnect_phy(priv->phylink);
	rtnl_unlock();
	phylink_destroy(priv->phylink);
	ax88772_mdio_unregister(priv);
	asix_rx_fixup_common_free(dev->driver_priv);
	/* Drop the PM usage ref taken in bind() */
	pm_runtime_put(&intf->dev);
}

static void ax88178_unbind(struct usbnet *dev, struct usb_interface *intf)
{
	asix_rx_fixup_common_free(dev->driver_priv);
	kfree(dev->driver_priv);
}

static const struct ethtool_ops ax88178_ethtool_ops = {
	.get_drvinfo		= usbnet_get_drvinfo,
	.get_link		= usbnet_get_link,
	.get_msglevel		= usbnet_get_msglevel,
	.set_msglevel		= usbnet_set_msglevel,
	.get_wol		= asix_get_wol,
	.set_wol		= asix_set_wol,
	.get_eeprom_len		= asix_get_eeprom_len,
	.get_eeprom		= asix_get_eeprom,
	.set_eeprom		= asix_set_eeprom,
	.nway_reset		= usbnet_nway_reset,
	.get_link_ksettings	= usbnet_get_link_ksettings_mii,
	.set_link_ksettings	= usbnet_set_link_ksettings_mii,
};

static int marvell_phy_init(struct usbnet *dev)
{
	struct asix_data *data = (struct asix_data *)&dev->data;
	u16 reg;

	netdev_dbg(dev->net, "marvell_phy_init()\n");

	reg = asix_mdio_read(dev->net, dev->mii.phy_id, MII_MARVELL_STATUS);
	netdev_dbg(dev->net, "MII_MARVELL_STATUS = 0x%04x\n", reg);

	asix_mdio_write(dev->net, dev->mii.phy_id, MII_MARVELL_CTRL,
			MARVELL_CTRL_RXDELAY | MARVELL_CTRL_TXDELAY);

	if (data->ledmode) {
		reg = asix_mdio_read(dev->net, dev->mii.phy_id,
			MII_MARVELL_LED_CTRL);
		netdev_dbg(dev->net, "MII_MARVELL_LED_CTRL (1) = 0x%04x\n", reg);

		reg &= 0xf8ff;
		reg |= (1 + 0x0100);
		asix_mdio_write(dev->net, dev->mii.phy_id,
			MII_MARVELL_LED_CTRL, reg);

		reg = asix_mdio_read(dev->net, dev->mii.phy_id,
			MII_MARVELL_LED_CTRL);
		netdev_dbg(dev->net, "MII_MARVELL_LED_CTRL (2) = 0x%04x\n", reg);
	}

	return 0;
}

static int rtl8211cl_phy_init(struct usbnet *dev)
{
	struct asix_data *data = (struct asix_data *)&dev->data;

	netdev_dbg(dev->net, "rtl8211cl_phy_init()\n");

	asix_mdio_write (dev->net, dev->mii.phy_id, 0x1f, 0x0005);
	asix_mdio_write (dev->net, dev->mii.phy_id, 0x0c, 0);
	asix_mdio_write (dev->net, dev->mii.phy_id, 0x01,
		asix_mdio_read (dev->net, dev->mii.phy_id, 0x01) | 0x0080);
	asix_mdio_write (dev->net, dev->mii.phy_id, 0x1f, 0);

	if (data->ledmode == 12) {
		asix_mdio_write (dev->net, dev->mii.phy_id, 0x1f, 0x0002);
		asix_mdio_write (dev->net, dev->mii.phy_id, 0x1a, 0x00cb);
		asix_mdio_write (dev->net, dev->mii.phy_id, 0x1f, 0);
	}

	return 0;
}

static int marvell_led_status(struct usbnet *dev, u16 speed)
{
	u16 reg = asix_mdio_read(dev->net, dev->mii.phy_id, MARVELL_LED_MANUAL);

	netdev_dbg(dev->net, "marvell_led_status() read 0x%04x\n", reg);

	/* Clear out the center LED bits - 0x03F0 */
	reg &= 0xfc0f;

	switch (speed) {
		case SPEED_1000:
			reg |= 0x03e0;
			break;
		case SPEED_100:
			reg |= 0x03b0;
			break;
		default:
			reg |= 0x02f0;
	}

	netdev_dbg(dev->net, "marvell_led_status() writing 0x%04x\n", reg);
	asix_mdio_write(dev->net, dev->mii.phy_id, MARVELL_LED_MANUAL, reg);

	return 0;
}

static int ax88178_reset(struct usbnet *dev)
{
	struct asix_data *data = (struct asix_data *)&dev->data;
	int ret;
	__le16 eeprom;
	u8 status;
	int gpio0 = 0;
	u32 phyid;

	ret = asix_read_cmd(dev, AX_CMD_READ_GPIOS, 0, 0, 1, &status, 0);
	if (ret < 0) {
		netdev_dbg(dev->net, "Failed to read GPIOS: %d\n", ret);
		return ret;
	}

	netdev_dbg(dev->net, "GPIO Status: 0x%04x\n", status);

	asix_write_cmd(dev, AX_CMD_WRITE_ENABLE, 0, 0, 0, NULL, 0);
	ret = asix_read_cmd(dev, AX_CMD_READ_EEPROM, 0x0017, 0, 2, &eeprom, 0);
	if (ret < 0) {
		netdev_dbg(dev->net, "Failed to read EEPROM: %d\n", ret);
		return ret;
	}

	asix_write_cmd(dev, AX_CMD_WRITE_DISABLE, 0, 0, 0, NULL, 0);

	netdev_dbg(dev->net, "EEPROM index 0x17 is 0x%04x\n", eeprom);

	if (eeprom == cpu_to_le16(0xffff)) {
		data->phymode = PHY_MODE_MARVELL;
		data->ledmode = 0;
		gpio0 = 1;
	} else {
		data->phymode = le16_to_cpu(eeprom) & 0x7F;
		data->ledmode = le16_to_cpu(eeprom) >> 8;
		gpio0 = (le16_to_cpu(eeprom) & 0x80) ? 0 : 1;
	}
	netdev_dbg(dev->net, "GPIO0: %d, PhyMode: %d\n", gpio0, data->phymode);

	/* Power up external GigaPHY through AX88178 GPIO pin */
	asix_write_gpio(dev, AX_GPIO_RSE | AX_GPIO_GPO_1 |
			AX_GPIO_GPO1EN, 40, 0);
	if ((le16_to_cpu(eeprom) >> 8) != 1) {
		asix_write_gpio(dev, 0x003c, 30, 0);
		asix_write_gpio(dev, 0x001c, 300, 0);
		asix_write_gpio(dev, 0x003c, 30, 0);
	} else {
		netdev_dbg(dev->net, "gpio phymode == 1 path\n");
		asix_write_gpio(dev, AX_GPIO_GPO1EN, 30, 0);
		asix_write_gpio(dev, AX_GPIO_GPO1EN | AX_GPIO_GPO_1, 30, 0);
	}

	/* Read PHYID register *AFTER* powering up PHY */
	phyid = asix_get_phyid(dev);
	netdev_dbg(dev->net, "PHYID=0x%08x\n", phyid);

	/* Set AX88178 to enable MII/GMII/RGMII interface for external PHY */
	asix_write_cmd(dev, AX_CMD_SW_PHY_SELECT, 0, 0, 0, NULL, 0);

	asix_sw_reset(dev, 0, 0);
	msleep(150);

	asix_sw_reset(dev, AX_SWRESET_PRL | AX_SWRESET_IPPD, 0);
	msleep(150);

	asix_write_rx_ctl(dev, 0, 0);

	if (data->phymode == PHY_MODE_MARVELL) {
		marvell_phy_init(dev);
		msleep(60);
	} else if (data->phymode == PHY_MODE_RTL8211CL)
		rtl8211cl_phy_init(dev);

	asix_phy_reset(dev, BMCR_RESET | BMCR_ANENABLE);
	asix_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE,
			ADVERTISE_ALL | ADVERTISE_CSMA | ADVERTISE_PAUSE_CAP);
	asix_mdio_write(dev->net, dev->mii.phy_id, MII_CTRL1000,
			ADVERTISE_1000FULL);

	asix_write_medium_mode(dev, AX88178_MEDIUM_DEFAULT, 0);
	mii_nway_restart(&dev->mii);

	/* Rewrite MAC address */
	memcpy(data->mac_addr, dev->net->dev_addr, ETH_ALEN);
	ret = asix_write_cmd(dev, AX_CMD_WRITE_NODE_ID, 0, 0, ETH_ALEN,
							data->mac_addr, 0);
	if (ret < 0)
		return ret;

	ret = asix_write_rx_ctl(dev, AX_DEFAULT_RX_CTL, 0);
	if (ret < 0)
		return ret;

	return 0;
}

static int ax88178_link_reset(struct usbnet *dev)
{
	u16 mode;
	struct ethtool_cmd ecmd = { .cmd = ETHTOOL_GSET };
	struct asix_data *data = (struct asix_data *)&dev->data;
	u32 speed;

	netdev_dbg(dev->net, "ax88178_link_reset()\n");

	mii_check_media(&dev->mii, 1, 1);
	mii_ethtool_gset(&dev->mii, &ecmd);
	mode = AX88178_MEDIUM_DEFAULT;
	speed = ethtool_cmd_speed(&ecmd);

	if (speed == SPEED_1000)
		mode |= AX_MEDIUM_GM;
	else if (speed == SPEED_100)
		mode |= AX_MEDIUM_PS;
	else
		mode &= ~(AX_MEDIUM_PS | AX_MEDIUM_GM);

	mode |= AX_MEDIUM_ENCK;

	if (ecmd.duplex == DUPLEX_FULL)
		mode |= AX_MEDIUM_FD;
	else
		mode &= ~AX_MEDIUM_FD;

	netdev_dbg(dev->net, "ax88178_link_reset() speed: %u duplex: %d setting mode to 0x%04x\n",
		   speed, ecmd.duplex, mode);

	asix_write_medium_mode(dev, mode, 0);

	if (data->phymode == PHY_MODE_MARVELL && data->ledmode)
		marvell_led_status(dev, speed);

	return 0;
}

static void ax88178_set_mfb(struct usbnet *dev)
{
	u16 mfb = AX_RX_CTL_MFB_16384;
	u16 rxctl;
	u16 medium;
	int old_rx_urb_size = dev->rx_urb_size;

	if (dev->hard_mtu < 2048) {
		dev->rx_urb_size = 2048;
		mfb = AX_RX_CTL_MFB_2048;
	} else if (dev->hard_mtu < 4096) {
		dev->rx_urb_size = 4096;
		mfb = AX_RX_CTL_MFB_4096;
	} else if (dev->hard_mtu < 8192) {
		dev->rx_urb_size = 8192;
		mfb = AX_RX_CTL_MFB_8192;
	} else if (dev->hard_mtu < 16384) {
		dev->rx_urb_size = 16384;
		mfb = AX_RX_CTL_MFB_16384;
	}

	rxctl = asix_read_rx_ctl(dev, 0);
	asix_write_rx_ctl(dev, (rxctl & ~AX_RX_CTL_MFB_16384) | mfb, 0);

	medium = asix_read_medium_status(dev, 0);
	if (dev->net->mtu > 1500)
		medium |= AX_MEDIUM_JFE;
	else
		medium &= ~AX_MEDIUM_JFE;
	asix_write_medium_mode(dev, medium, 0);

	if (dev->rx_urb_size > old_rx_urb_size)
		usbnet_unlink_rx_urbs(dev);
}

static int ax88178_change_mtu(struct net_device *net, int new_mtu)
{
	struct usbnet *dev = netdev_priv(net);
	int ll_mtu = new_mtu + net->hard_header_len + 4;

	netdev_dbg(dev->net, "ax88178_change_mtu() new_mtu=%d\n", new_mtu);

	if ((ll_mtu % dev->maxpacket) == 0)
		return -EDOM;

	WRITE_ONCE(net->mtu, new_mtu);
	dev->hard_mtu = net->mtu + net->hard_header_len;
	ax88178_set_mfb(dev);

	/* max qlen depend on hard_mtu and rx_urb_size */
	usbnet_update_max_qlen(dev);

	return 0;
}

static const struct net_device_ops ax88178_netdev_ops = {
	.ndo_open		= usbnet_open,
	.ndo_stop		= usbnet_stop,
	.ndo_start_xmit		= usbnet_start_xmit,
	.ndo_tx_timeout		= usbnet_tx_timeout,
	.ndo_get_stats64	= dev_get_tstats64,
	.ndo_set_mac_address 	= asix_set_mac_address,
	.ndo_validate_addr	= eth_validate_addr,
	.ndo_set_rx_mode	= asix_set_multicast,
	.ndo_eth_ioctl		= usbnet_mii_ioctl,
	.ndo_change_mtu 	= ax88178_change_mtu,
};

static int ax88178_bind(struct usbnet *dev, struct usb_interface *intf)
{
	int ret;
	u8 buf[ETH_ALEN] = {0};

	ret = usbnet_get_endpoints(dev, intf);
	if (ret)
		return ret;

	/* Get the MAC address */
	ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0);
	if (ret < 0) {
		netdev_dbg(dev->net, "Failed to read MAC address: %d\n", ret);
		return ret;
	}

	asix_set_netdev_dev_addr(dev, buf);

	/* Initialize MII structure */
	dev->mii.dev = dev->net;
	dev->mii.mdio_read = asix_mdio_read;
	dev->mii.mdio_write = asix_mdio_write;
	dev->mii.phy_id_mask = 0x1f;
	dev->mii.reg_num_mask = 0xff;
	dev->mii.supports_gmii = 1;

	dev->mii.phy_id = asix_read_phy_addr(dev, true);
	if (dev->mii.phy_id < 0)
		return dev->mii.phy_id;

	dev->net->netdev_ops = &ax88178_netdev_ops;
	dev->net->ethtool_ops = &ax88178_ethtool_ops;
	dev->net->max_mtu = 16384 - (dev->net->hard_header_len + 4);

	/* Blink LEDS so users know driver saw dongle */
	asix_sw_reset(dev, 0, 0);
	msleep(150);

	asix_sw_reset(dev, AX_SWRESET_PRL | AX_SWRESET_IPPD, 0);
	msleep(150);

	/* Asix framing packs multiple eth frames into a 2K usb bulk transfer */
	if (dev->driver_info->flags & FLAG_FRAMING_AX) {
		/* hard_mtu  is still the default - the device does not support
		   jumbo eth frames */
		dev->rx_urb_size = 2048;
	}

	dev->driver_priv = kzalloc_obj(struct asix_common_private);
	if (!dev->driver_priv)
			return -ENOMEM;

	return 0;
}

static const struct driver_info ax8817x_info = {
	.description = "ASIX AX8817x USB 2.0 Ethernet",
	.bind = ax88172_bind,
	.status = asix_status,
	.link_reset = ax88172_link_reset,
	.reset = ax88172_link_reset,
	.flags =  FLAG_ETHER | FLAG_LINK_INTR,
	.data = 0x00130103,
};

static const struct driver_info dlink_dub_e100_info = {
	.description = "DLink DUB-E100 USB Ethernet",
	.bind = ax88172_bind,
	.status = asix_status,
	.link_reset = ax88172_link_reset,
	.reset = ax88172_link_reset,
	.flags =  FLAG_ETHER | FLAG_LINK_INTR,
	.data = 0x009f9d9f,
};

static const struct driver_info netgear_fa120_info = {
	.description = "Netgear FA-120 USB Ethernet",
	.bind = ax88172_bind,
	.status = asix_status,
	.link_reset = ax88172_link_reset,
	.reset = ax88172_link_reset,
	.flags =  FLAG_ETHER | FLAG_LINK_INTR,
	.data = 0x00130103,
};

static const struct driver_info hawking_uf200_info = {
	.description = "Hawking UF200 USB Ethernet",
	.bind = ax88172_bind,
	.status = asix_status,
	.link_reset = ax88172_link_reset,
	.reset = ax88172_link_reset,
	.flags =  FLAG_ETHER | FLAG_LINK_INTR,
	.data = 0x001f1d1f,
};

static const struct driver_info ax88772_info = {
	.description = "ASIX AX88772 USB 2.0 Ethernet",
	.bind = ax88772_bind,
	.unbind = ax88772_unbind,
	.reset = ax88772_reset,
	.stop = ax88772_stop,
	.flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_MULTI_PACKET,
	.rx_fixup = asix_rx_fixup_common,
	.tx_fixup = asix_tx_fixup,
};

static const struct driver_info ax88772b_info = {
	.description = "ASIX AX88772B USB 2.0 Ethernet",
	.bind = ax88772_bind,
	.unbind = ax88772_unbind,
	.reset = ax88772_reset,
	.stop = ax88772_stop,
	.flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_MULTI_PACKET,
	.rx_fixup = asix_rx_fixup_common,
	.tx_fixup = asix_tx_fixup,
	.data = FLAG_EEPROM_MAC,
};

static const struct driver_info lxausb_t1l_info = {
	.description = "Linux Automation GmbH USB 10Base-T1L",
	.bind = ax88772_bind,
	.unbind = ax88772_unbind,
	.reset = ax88772_reset,
	.stop = ax88772_stop,
	.flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_MULTI_PACKET,
	.rx_fixup = asix_rx_fixup_common,
	.tx_fixup = asix_tx_fixup,
	.data = FLAG_EEPROM_MAC,
};

static const struct driver_info ax88178_info = {
	.description = "ASIX AX88178 USB 2.0 Ethernet",
	.bind = ax88178_bind,
	.unbind = ax88178_unbind,
	.status = asix_status,
	.link_reset = ax88178_link_reset,
	.reset = ax88178_reset,
	.flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR |
		 FLAG_MULTI_PACKET,
	.rx_fixup = asix_rx_fixup_common,
	.tx_fixup = asix_tx_fixup,
};

/*
 * USBLINK 20F9 "USB 2.0 LAN" USB ethernet adapter, typically found in
 * no-name packaging.
 * USB device strings are:
 *   1: Manufacturer: USBLINK
 *   2: Product: HG20F9 USB2.0
 *   3: Serial: 000003
 * Appears to be compatible with Asix 88772B.
 */
static const struct driver_info hg20f9_info = {
	.description = "HG20F9 USB 2.0 Ethernet",
	.bind = ax88772_bind,
	.unbind = ax88772_unbind,
	.reset = ax88772_reset,
	.flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_MULTI_PACKET,
	.rx_fixup = asix_rx_fixup_common,
	.tx_fixup = asix_tx_fixup,
	.data = FLAG_EEPROM_MAC,
};

static const struct driver_info lyconsys_fibergecko100_info = {
	.description = "LyconSys FiberGecko 100 USB 2.0 to SFP Adapter",
	.bind = ax88178_bind,
	.status = asix_status,
	.link_reset = ax88178_link_reset,
	.reset = ax88178_link_reset,
	.flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR |
		 FLAG_MULTI_PACKET,
	.rx_fixup = asix_rx_fixup_common,
	.tx_fixup = asix_tx_fixup,
	.data = 0x20061201,
};

static const struct usb_device_id	products [] = {
{
	// Linksys USB200M
	USB_DEVICE (0x077b, 0x2226),
	.driver_info =	(unsigned long) &ax8817x_info,
}, {
	// Netgear FA120
	USB_DEVICE (0x0846, 0x1040),
	.driver_info =  (unsigned long) &netgear_fa120_info,
}, {
	// DLink DUB-E100
	USB_DEVICE (0x2001, 0x1a00),
	.driver_info =  (unsigned long) &dlink_dub_e100_info,
}, {
	// Intellinet, ST Lab USB Ethernet
	USB_DEVICE (0x0b95, 0x1720),
	.driver_info =  (unsigned long) &ax8817x_info,
}, {
	// Hawking UF200, TrendNet TU2-ET100
	USB_DEVICE (0x07b8, 0x420a),
	.driver_info =  (unsigned long) &hawking_uf200_info,
}, {
	// Billionton Systems, USB2AR
	USB_DEVICE (0x08dd, 0x90ff),
	.driver_info =  (unsigned long) &ax8817x_info,
}, {
	// Billionton Systems, GUSB2AM-1G-B
	USB_DEVICE(0x08dd, 0x0114),
	.driver_info =  (unsigned long) &ax88178_info,
}, {
	// ATEN UC210T
	USB_DEVICE (0x0557, 0x2009),
	.driver_info =  (unsigned long) &ax8817x_info,
}, {
	// Buffalo LUA-U2-KTX
	USB_DEVICE (0x0411, 0x003d),
	.driver_info =  (unsigned long) &ax8817x_info,
}, {
	// Buffalo LUA-U2-GT 10/100/1000
	USB_DEVICE (0x0411, 0x006e),
	.driver_info =  (unsigned long) &ax88178_info,
}, {
	// Sitecom LN-029 "USB 2.0 10/100 Ethernet adapter"
	USB_DEVICE (0x6189, 0x182d),
	.driver_info =  (unsigned long) &ax8817x_info,
}, {
	// Sitecom LN-031 "USB 2.0 10/100/1000 Ethernet adapter"
	USB_DEVICE (0x0df6, 0x0056),
	.driver_info =  (unsigned long) &ax88178_info,
}, {
	// Sitecom LN-028 "USB 2.0 10/100/1000 Ethernet adapter"
	USB_DEVICE (0x0df6, 0x061c),
	.driver_info =  (unsigned long) &ax88178_info,
}, {
	// corega FEther USB2-TX
	USB_DEVICE (0x07aa, 0x0017),
	.driver_info =  (unsigned long) &ax8817x_info,
}, {
	// Surecom EP-1427X-2
	USB_DEVICE (0x1189, 0x0893),
	.driver_info = (unsigned long) &ax8817x_info,
}, {
	// goodway corp usb gwusb2e
	USB_DEVICE (0x1631, 0x6200),
	.driver_info = (unsigned long) &ax8817x_info,
}, {
	// JVC MP-PRX1 Port Replicator
	USB_DEVICE (0x04f1, 0x3008),
	.driver_info = (unsigned long) &ax8817x_info,
}, {
	// Lenovo U2L100P 10/100
	USB_DEVICE (0x17ef, 0x7203),
	.driver_info = (unsigned long)&ax88772b_info,
}, {
	// ASIX AX88772B 10/100
	USB_DEVICE (0x0b95, 0x772b),
	.driver_info = (unsigned long) &ax88772b_info,
}, {
	// ASIX AX88772 10/100
	USB_DEVICE (0x0b95, 0x7720),
	.driver_info = (unsigned long) &ax88772_info,
}, {
	// ASIX AX88178 10/100/1000
	USB_DEVICE (0x0b95, 0x1780),
	.driver_info = (unsigned long) &ax88178_info,
}, {
	// Logitec LAN-GTJ/U2A
	USB_DEVICE (0x0789, 0x0160),
	.driver_info = (unsigned long) &ax88178_info,
}, {
	// Linksys USB200M Rev 2
	USB_DEVICE (0x13b1, 0x0018),
	.driver_info = (unsigned long) &ax88772_info,
}, {
	// 0Q0 cable ethernet
	USB_DEVICE (0x1557, 0x7720),
	.driver_info = (unsigned long) &ax88772_info,
}, {
	// DLink DUB-E100 H/W Ver B1
	USB_DEVICE (0x07d1, 0x3c05),
	.driver_info = (unsigned long) &ax88772_info,
}, {
	// DLink DUB-E100 H/W Ver B1 Alternate
	USB_DEVICE (0x2001, 0x3c05),
	.driver_info = (unsigned long) &ax88772_info,
}, {
       // DLink DUB-E100 H/W Ver C1
       USB_DEVICE (0x2001, 0x1a02),
       .driver_info = (unsigned long) &ax88772_info,
}, {
	// Linksys USB1000
	USB_DEVICE (0x1737, 0x0039),
	.driver_info = (unsigned long) &ax88178_info,
}, {
	// IO-DATA ETG-US2
	USB_DEVICE (0x04bb, 0x0930),
	.driver_info = (unsigned long) &ax88178_info,
}, {
	// Belkin F5D5055
	USB_DEVICE(0x050d, 0x5055),
	.driver_info = (unsigned long) &ax88178_info,
}, {
	// Apple USB Ethernet Adapter
	USB_DEVICE(0x05ac, 0x1402),
	.driver_info = (unsigned long) &ax88772_info,
}, {
	// Cables-to-Go USB Ethernet Adapter
	USB_DEVICE(0x0b95, 0x772a),
	.driver_info = (unsigned long) &ax88772_info,
}, {
	// ABOCOM for pci
	USB_DEVICE(0x14ea, 0xab11),
	.driver_info = (unsigned long) &ax88178_info,
}, {
	// ASIX 88772a
	USB_DEVICE(0x0db0, 0xa877),
	.driver_info = (unsigned long) &ax88772_info,
}, {
	// Asus USB Ethernet Adapter
	USB_DEVICE (0x0b95, 0x7e2b),
	.driver_info = (unsigned long)&ax88772b_info,
}, {
	/* ASIX 88172a demo board */
	USB_DEVICE(0x0b95, 0x172a),
	.driver_info = (unsigned long) &ax88172a_info,
}, {
	/*
	 * USBLINK HG20F9 "USB 2.0 LAN"
	 * Appears to have gazumped Linksys's manufacturer ID but
	 * doesn't (yet) conflict with any known Linksys product.
	 */
	USB_DEVICE(0x066b, 0x20f9),
	.driver_info = (unsigned long) &hg20f9_info,
}, {
	// Linux Automation GmbH USB 10Base-T1L
	USB_DEVICE(0x33f7, 0x0004),
	.driver_info = (unsigned long) &lxausb_t1l_info,
}, {
	/* LyconSys FiberGecko 100 */
	USB_DEVICE(0x1d2a, 0x0801),
	.driver_info = (unsigned long) &lyconsys_fibergecko100_info,
},
	{ },		// END
};
MODULE_DEVICE_TABLE(usb, products);

static struct usb_driver asix_driver = {
	.name =		DRIVER_NAME,
	.id_table =	products,
	.probe =	usbnet_probe,
	.suspend =	asix_suspend,
	.resume =	asix_resume,
	.reset_resume =	asix_resume,
	.disconnect =	usbnet_disconnect,
	/* usbnet enables autosuspend by default (supports_autosuspend=1).
	 * We keep runtime-PM active for AX88772* by taking a PM usage
	 * reference in ax88772_bind() (pm_runtime_get_noresume()) and
	 * dropping it in unbind(), which effectively blocks autosuspend.
	 */
	.supports_autosuspend = 1,
	.disable_hub_initiated_lpm = 1,
};

module_usb_driver(asix_driver);

MODULE_AUTHOR("David Hollis");
MODULE_DESCRIPTION("ASIX AX8817X based USB 2.0 Ethernet Devices");
MODULE_LICENSE("GPL");
]

gemini-3-flash-preview

							input: 94307
							output: 21
							thoughts: 519
						

**Analyzing the USB Device Driver Issue**

Okay, so I'm diving into this USB driver issue, and initially, I was puzzled because I couldn't immediately locate the device identifiers `0x0db0:0x6869` or `0x0bda:0x5088` in `asix_devices.c`. But then the user's comment about the C reproducer calling `syz_usb_control_io` for the *second* device and mentioning responses for the `asix` driver started things clicking.

The assumption was the second device, supposedly all zeros, shouldn't be associated with the `asix` driver. My initial thought was perhaps the user was describing the devices incorrectly, or that something else was at play.

Then, the user clarified device assignments: first is `0x0db0:0x6869` (rt2500usb), second is uninitialized (all zeros), and third is `0x0bda:0x5088` (rtl8192cu). A device with vendor ID and product ID as all zeroes, means `idVendor=0, idProduct=0`. My first thought was whether there's a driver matching with those IDs, thinking perhaps a `USB_DEVICE_INFO` match based on class/subclass/protocol. But with all zeros, that usually means a default, "look at interface descriptors" scenario.

If those descriptors are also all zeros (as it seems), we're left with class=0, subclass=0, and protocol=0. Not a very specific match. It's when the user then reveals something key: the C reproducer *only* initializes the first nine bytes of the config descriptor, leaving the `usb_interface_descriptor` all zeros. This means the `bLength` of the interface descriptor is effectively zero, and thus, `usb_parse_configuration` skips the descriptor, and sets `bNumInterfaces = 0`. This aligns perfectly with my understanding of how `usb_parse_configuration` works.

Now the question is: is this resulting `bNumInterfaces = 0` the root cause? The user is asking if there's a known bug in the USB core, or specifically in the relevant drivers, where a configuration with *zero* interfaces leads to a crash. It seems a crash at that point is likely. My next step will be to search for related bugs or commits. I'll focus on terms like "bNumInterfaces" alongside keywords like "crash" or "null pointer."

log-in to see details

map[Name:bNumInterfaces]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 95414
							output: 21
							thoughts: 14
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and presented as if it were my own:

**Initial Investigation: "bNumInterfaces" as a String**

Right, so, I'm starting a debugging session, or perhaps diving into unfamiliar code. The first thing I'm doing is a search, specifically a string search. I'm going to look for instances of the identifier "bNumInterfaces" within the codebase. It's a pragmatic, broad approach to pinpointing areas related to interface counts. Given my experience, I know this is often a good first step to locate where this parameter is defined, used, or potentially misconfigured. A simple string search avoids the complexity of jumping straight to symbol resolution, which is sometimes too restrictive and dependent on build and environment. By looking for the string itself, I'm casting a wide net, ensuring I don't miss any edge cases where it's being used in a non-standard way (e.g., in a comment or a dynamically-generated string). From here I should get a solid footing from which to dive deeper. I'm assuming that this is a critical parameter related to interface management so a thorough search is the best initial approach to begin.

log-in to see details

map[Name:bNumInterfaces]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 95730
							output: 24
							thoughts: 83
						

Okay, here's my thought process on how I'd approach this, considering my expertise:

**My Approach to Code Search**

Alright, so `grep` through the code base is the default, but since I'm trying to be efficient, I know using `codesearch-find-references` would be ideal. However, since it's giving me a heads up that it's just for entities and not plain text, that's not going to cut it this time. If I was looking for a function definition, I'd jump right to `codesearch-find-references`, but this requires me to search for some text, plain and simple.

So, I'll need to use `codesearch-dir-index` and read files if I can't just use the search tool directly. I'll need to figure out the right way to query the index and process the results. Honestly, the regular search tool is probably the right move here.

Now, the actual search. I'm looking for "bNumInterfaces", and since this relates to USB device configuration, I'll restrict my search to `drivers/usb/core/`. This should quickly narrow down the results to the most relevant code and I can get a better sense of what I need to do next.

map[Dir:drivers/usb/core/]

map[Files:[buffer.c config.c devices.c devio.c driver.c endpoint.c file.c generic.c hcd-pci.c hcd.c hub.c hub.h ledtrig-usbport.c message.c notify.c of.c offload.c otg_productlist.h phy.c phy.h port.c quirks.c sysfs.c trace.c trace.h urb.c usb-acpi.c usb.c usb.h] Subdirs:<nil>]

gemini-3-flash-preview

							input: 96317
							output: 46
							thoughts: 130
						

**USB Interface Number Mapping: A Quick Review**

Okay, so I need to make sure this zero `bNumInterfaces` thing isn't going to bite us in the butt. My first thought was to scan `drivers/usb/core/hub.c` looking for any uses of `bNumInterfaces` where a value of zero could cause an issue. I *did* already glance at `usb_set_configuration`, and it looked like it handled the `nintf = 0` case properly.

But then it hit me: what about `usb_ifnum_to_if`? If `bNumInterfaces` is zero, the `dev->actconfig->interface` list could be empty, which is a potential problem. Time to dig into the source. I need to take a look at the implementation of `usb_ifnum_to_if` to see exactly how it handles that scenario. I'll find it in `drivers/usb/core/usb.c`. Let's see what's what.

map[ContextFile:drivers/usb/core/usb.c IncludeLines:true Name:usb_ifnum_to_if]

map[SourceCode: 328:	/**
 329:	 * usb_ifnum_to_if - get the interface object with a given interface number
 330:	 * @dev: the device whose current configuration is considered
 331:	 * @ifnum: the desired interface
 332:	 *
 333:	 * This walks the device descriptor for the currently active configuration
 334:	 * to find the interface object with the particular interface number.
 335:	 *
 336:	 * Note that configuration descriptors are not required to assign interface
 337:	 * numbers sequentially, so that it would be incorrect to assume that
 338:	 * the first interface in that descriptor corresponds to interface zero.
 339:	 * This routine helps device drivers avoid such mistakes.
 340:	 * However, you should make sure that you do the right thing with any
 341:	 * alternate settings available for this interfaces.
 342:	 *
 343:	 * Don't call this function unless you are bound to one of the interfaces
 344:	 * on this device or you have locked the device!
 345:	 *
 346:	 * Return: A pointer to the interface that has @ifnum as interface number,
 347:	 * if found. %NULL otherwise.
 348:	 */
 349:	struct usb_interface *usb_ifnum_to_if(const struct usb_device *dev,
 350:					      unsigned ifnum)
 351:	{
 352:		struct usb_host_config *config = dev->actconfig;
 353:		int i;
 354:	
 355:		if (!config)
 356:			return NULL;
 357:		for (i = 0; i < config->desc.bNumInterfaces; i++)
 358:			if (config->interface[i]->altsetting[0]
 359:					.desc.bInterfaceNumber == ifnum)
 360:				return config->interface[i];
 361:	
 362:		return NULL;
 363:	}
 SourceFile:drivers/usb/core/usb.c]

gemini-3-flash-preview

							input: 97289
							output: 47
							thoughts: 38
						

Okay, here's my take on those thoughts, framed as my own:

**Analyzing Interface Handling in USB Device Code**

Alright, let's see, if `bNumInterfaces` is zero, meaning there are no interfaces to deal with, the code correctly skips the loop and returns `NULL`. That's good, that's the safe path – no potential for an out-of-bounds error there. That's a sensible check to prevent any issues with iterating over a nonexistent array. Now, the next thing that pops into mind...how does this interact with `usb_altnum_to_altsetting`? I need to think through how that function fits into the overall scheme and whether there are any potential vulnerabilities or logical flaws related to how alternative settings are handled in this context, especially when dealing with a device with a zero interface count.

map[ContextFile:drivers/usb/core/usb.c IncludeLines:true Name:usb_altnum_to_altsetting]

map[SourceCode: 366:	/**
 367:	 * usb_altnum_to_altsetting - get the altsetting structure with a given alternate setting number.
 368:	 * @intf: the interface containing the altsetting in question
 369:	 * @altnum: the desired alternate setting number
 370:	 *
 371:	 * This searches the altsetting array of the specified interface for
 372:	 * an entry with the correct bAlternateSetting value.
 373:	 *
 374:	 * Note that altsettings need not be stored sequentially by number, so
 375:	 * it would be incorrect to assume that the first altsetting entry in
 376:	 * the array corresponds to altsetting zero.  This routine helps device
 377:	 * drivers avoid such mistakes.
 378:	 *
 379:	 * Don't call this function unless you are bound to the intf interface
 380:	 * or you have locked the device!
 381:	 *
 382:	 * Return: A pointer to the entry of the altsetting array of @intf that
 383:	 * has @altnum as the alternate setting number. %NULL if not found.
 384:	 */
 385:	struct usb_host_interface *usb_altnum_to_altsetting(
 386:						const struct usb_interface *intf,
 387:						unsigned int altnum)
 388:	{
 389:		int i;
 390:	
 391:		for (i = 0; i < intf->num_altsetting; i++) {
 392:			if (intf->altsetting[i].desc.bAlternateSetting == altnum)
 393:				return &intf->altsetting[i];
 394:		}
 395:		return NULL;
 396:	}
 SourceFile:drivers/usb/core/usb.c]

gemini-3-flash-preview

							input: 98072
							output: 45
							thoughts: 175
						

**Analyzing a Potential Kernel Bug**

Okay, so I'm thinking... this should be safe, right? But then the user mentioned something intriguing: a potential crash linked to `syz_usb_connect` and an all-zeros device descriptor. Hmm, that’s got my attention.

Let me break this down. If `syz_usb_connect` is called with an all-zeros device descriptor, then `bLength` is going to be zero. Now, looking at the code, specifically in `hub_port_init`, I see it calls `usb_get_device_descriptor(udev)`. Okay, and then at line 5185, we see: `udev->descriptor = *descr;` So, if `descr->bLength` is indeed zero, then `udev->descriptor.bLength` will also be zero.

Then, `usb_detect_quirks(udev)` gets called. That's where things could get interesting. I need to dig into `usb_detect_quirks` and see what it does. That's going to be in `drivers/usb/core/quirks.c`, so I'm going to head over there to check it out.

map[ContextFile:drivers/usb/core/quirks.c IncludeLines:true Name:usb_detect_quirks]

map[SourceCode: 750:	/*
 751:	 * Detect any quirks the device has, and do any housekeeping for it if needed.
 752:	 */
 753:	void usb_detect_quirks(struct usb_device *udev)
 754:	{
 755:		udev->quirks = usb_detect_static_quirks(udev, usb_quirk_list);
 756:	
 757:		/*
 758:		 * Pixart-based mice would trigger remote wakeup issue on AMD
 759:		 * Yangtze chipset, so set them as RESET_RESUME flag.
 760:		 */
 761:		if (usb_amd_resume_quirk(udev))
 762:			udev->quirks |= usb_detect_static_quirks(udev,
 763:					usb_amd_resume_quirk_list);
 764:	
 765:		udev->quirks ^= usb_detect_dynamic_quirks(udev);
 766:	
 767:		if (udev->quirks)
 768:			dev_dbg(&udev->dev, "USB quirks for this device: 0x%x\n",
 769:				udev->quirks);
 770:	
 771:	#ifdef CONFIG_USB_DEFAULT_PERSIST
 772:		if (!(udev->quirks & USB_QUIRK_RESET))
 773:			udev->persist_enabled = 1;
 774:	#else
 775:		/* Hubs are automatically enabled for USB-PERSIST */
 776:		if (udev->descriptor.bDeviceClass == USB_CLASS_HUB)
 777:			udev->persist_enabled = 1;
 778:	#endif	/* CONFIG_USB_DEFAULT_PERSIST */
 779:	}
 SourceFile:drivers/usb/core/quirks.c]

gemini-3-flash-preview

							input: 99059
							output: 27
							thoughts: 690
						

**Analyzing the USB Device Enumeration and Driver Probing**

Okay, this seems like a relatively straightforward case at first glance. We're looking at a scenario with a device that presents as "all zeros." Initially, my assessment was that it would fail to enumerate safely. Then I thought about `usb_get_configuration`. It immediately triggered a more in-depth line of reasoning about the error conditions. Specifically, the check:

```c
 934:		} else if (ncfg < 1) {
 935:			dev_err(ddev, "no configurations\n");
 936:			return -EINVAL;
 937:		}
```

If `bNumConfigurations` is zero, we get `-EINVAL`. This gets returned through `usb_enumerate_device`, then `hub_port_init`, ultimately resulting in a failure to initialize within `hub_port_connect`.

My first assumption was this would then make it impossible to use `syz_usb_control_io` on that device. But then I realized: Wait, `syz_usb_control_io` is *how* the descriptors are provided during enumeration! This is how syzkaller operates, so there might be a race condition.

I had to clarify my train of thought. If the kernel's requesting the device descriptor for a "all zeros" device, the executor, or `syz_usb_connect`, provides an all-zeros descriptor. The kernel then sees `bLength = 0` in the descriptor, and that could lead to a failure in enumeration.

I then followed the execution path further. `usb_get_device_descriptor` pulls those 18 bytes of zeros:

```c
1125:		ret = usb_get_descriptor(udev, USB_DT_DEVICE, 0, desc, sizeof(*desc));
1126:		if (ret == sizeof(*desc))
1127:			return desc;
```

It returns those zeroes. Then `hub_port_init` sets `udev->descriptor`.  Then `usb_get_configuration` is called, sees `ncfg = 0`, and returns `-EINVAL`. So, the all-zeros device *should* fail to enumerate.

That's where the user's data gets interesting, because the C reproducer calls `syz_usb_control_io` for the second device *and* they mention the `asix` driver. Now, the `asix` driver relies on getting a working device.  If the second device in the reproducer is the all-zeros device, as I've been assuming, the `asix` driver shouldn't be probed for it.

Then I realized a possibility: is the "second device" actually the third? The user listed them as `0x0db0:0x6869` (rt2500usb), then uninitialized (all zeros), then `0x0bda:0x5088` (rtl8192cu). If `syz_usb_control_io(1, ...)` is called (zero-indexed), it's indeed the second device.

So I need to confirm: is there a driver that matches the `0000:0000`? I need to search for `USB_DEVICE(0, 0)` or something similar to make sure. Let me start searching...

log-in to see details

map[Name:USB_DEVICE(0, 0)]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 100544
							output: 37
							thoughts: 26
						

Here's my thought process, summarized as you requested:

**Searching for a Specific USB Device**

Okay, so I need to find information about a very specific USB device, defined by its Vendor ID and Product ID. The IDs are `0x0000, 0x0000`. My immediate thought is to start with a search query using those identifiers. I'll frame it with "USB_DEVICE" to narrow down the results, as that's generally how this information is formatted in documentation and code. I'm expecting this will quickly lead me to the relevant driver, firmware documentation, or device configuration details that I'm after. I'm not expecting a direct hit, but the combination of terms should give me a good starting point for more precise investigation. Let's see what comes up.

log-in to see details

map[Name:USB_DEVICE(0x0000, 0x0000)]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 100801
							output: 38
							thoughts: 439
						

**Analyzing the USB Device Driver Interaction**

Okay, so I'm thinking about this `USB_DEVICE_INFO(0, 0, 0)` – could that be a potential match, or any driver matching a broad ID? Hold on, some drivers can be *very* broad in their matching criteria, but I know `asix` definitely isn't.

Ah, but the user's saying the issue lies with the config descriptor – specifically, it seems like the reproducer is only initializing the first 9 bytes and then leaving the interface descriptor with `bLength` as zero. Right, so this means the device *does* have a valid config descriptor (`bNumConfigurations > 0`), but the interface descriptor within it is invalid. So, `usb_get_configuration` should succeed, then `usb_parse_configuration` runs and sets `bNumInterfaces = 0`. Then, when `usb_set_configuration` is called, we get `nintf = 0`.  No interfaces are registered, therefore no drivers will be probed.

So how could the `asix` driver even be involved in this scenario? Maybe it's being probed for *another* device that is present? I already checked the IDs and they don't seem to match.

Wait a second...I'm seeing `0x0db0:0x6869` (rt2500usb) in relation to this, and I remember seeing `0x0db0:0xa877` in `asix_devices.c`. Is it *possible* that `0x0db0:0x6869` is also an `asix` device? I didn't see it in the `products` table I reviewed before... I need to check the IDs against the `rtl8192cu` IDs. I should be able to find those in `/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/`.

map[Dir:drivers/net/wireless/realtek/rtlwifi/rtl8192cu/]

map[Files:[def.h dm.c dm.h hw.c hw.h led.c led.h mac.c mac.h phy.c phy.h reg.h rf.c rf.h sw.c table.c table.h trx.c trx.h] Subdirs:<nil>]

gemini-3-flash-preview

							input: 101830
							output: 38
							thoughts: 14
						

Okay, here's my summary, tailored as if I'm an expert in the field thinking through this:

**Locating the ID Table**

Right, let's get down to it. I need to find the ID table. Based on the usual naming conventions and project structure, the most likely candidate for housing it is `sw.c`. That file is where I'd expect to find the core switch configuration or management code, and a data structure like an ID table would typically reside alongside the functions that utilize it. Going straight to `sw.c` seems like the most efficient first step to quickly locate and understand its structure. I'll start there.

map[File:drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c]

map[Contents:// SPDX-License-Identifier: GPL-2.0
/* Copyright(c) 2009-2012  Realtek Corporation.*/

#include "../wifi.h"
#include "../core.h"
#include "../usb.h"
#include "../efuse.h"
#include "../base.h"
#include "reg.h"
#include "def.h"
#include "phy.h"
#include "mac.h"
#include "dm.h"
#include "rf.h"
#include "trx.h"
#include "led.h"
#include "hw.h"
#include "../rtl8192c/fw_common.h"
#include <linux/module.h>

MODULE_AUTHOR("Georgia		<georgia@realtek.com>");
MODULE_AUTHOR("Ziv Huang	<ziv_huang@realtek.com>");
MODULE_AUTHOR("Larry Finger	<Larry.Finger@lwfinger.net>");
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Realtek 8192C/8188C 802.11n USB wireless");
MODULE_FIRMWARE("rtlwifi/rtl8192cufw.bin");
MODULE_FIRMWARE("rtlwifi/rtl8192cufw_A.bin");
MODULE_FIRMWARE("rtlwifi/rtl8192cufw_B.bin");
MODULE_FIRMWARE("rtlwifi/rtl8192cufw_TMSC.bin");

static int rtl92cu_init_sw_vars(struct ieee80211_hw *hw)
{
	struct rtl_priv *rtlpriv = rtl_priv(hw);
	int err;
	char *fw_name;

	rtlpriv->dm.dm_initialgain_enable = true;
	rtlpriv->dm.dm_flag = 0;
	rtlpriv->dm.disable_framebursting = false;
	rtlpriv->dm.thermalvalue = 0;

	/* for firmware buf */
	rtlpriv->rtlhal.pfirmware = kmalloc(0x4000, GFP_KERNEL);
	if (!rtlpriv->rtlhal.pfirmware) {
		pr_err("Can't alloc buffer for fw\n");
		return 1;
	}
	if (IS_VENDOR_UMC_A_CUT(rtlpriv->rtlhal.version) &&
	    !IS_92C_SERIAL(rtlpriv->rtlhal.version)) {
		fw_name = "rtlwifi/rtl8192cufw_A.bin";
	} else if (IS_81XXC_VENDOR_UMC_B_CUT(rtlpriv->rtlhal.version)) {
		fw_name = "rtlwifi/rtl8192cufw_B.bin";
	} else {
		fw_name = "rtlwifi/rtl8192cufw_TMSC.bin";
	}
	pr_info("Loading firmware %s\n", fw_name);
	rtlpriv->max_fw_size = 0x4000;
	err = request_firmware_nowait(THIS_MODULE, 1,
				      fw_name, rtlpriv->io.dev,
				      GFP_KERNEL, hw, rtl_fw_cb);
	if (err) {
		kfree(rtlpriv->rtlhal.pfirmware);
		rtlpriv->rtlhal.pfirmware = NULL;
	}
	return err;
}

static void rtl92cu_deinit_sw_vars(struct ieee80211_hw *hw)
{
	struct rtl_priv *rtlpriv = rtl_priv(hw);

	if (rtlpriv->rtlhal.pfirmware) {
		kfree(rtlpriv->rtlhal.pfirmware);
		rtlpriv->rtlhal.pfirmware = NULL;
	}
}

/* get bt coexist status */
static bool rtl92cu_get_btc_status(void)
{
	return false;
}

static const struct rtl_hal_ops rtl8192cu_hal_ops = {
	.init_sw_vars = rtl92cu_init_sw_vars,
	.deinit_sw_vars = rtl92cu_deinit_sw_vars,
	.read_chip_version = rtl92c_read_chip_version,
	.read_eeprom_info = rtl92cu_read_eeprom_info,
	.enable_interrupt = rtl92c_enable_interrupt,
	.disable_interrupt = rtl92c_disable_interrupt,
	.hw_init = rtl92cu_hw_init,
	.hw_disable = rtl92cu_card_disable,
	.set_network_type = rtl92cu_set_network_type,
	.set_chk_bssid = rtl92cu_set_check_bssid,
	.set_qos = rtl92c_set_qos,
	.set_bcn_reg = rtl92cu_set_beacon_related_registers,
	.set_bcn_intv = rtl92cu_set_beacon_interval,
	.update_interrupt_mask = rtl92cu_update_interrupt_mask,
	.get_hw_reg = rtl92cu_get_hw_reg,
	.set_hw_reg = rtl92cu_set_hw_reg,
	.update_rate_tbl = rtl92cu_update_hal_rate_tbl,
	.fill_tx_desc = rtl92cu_tx_fill_desc,
	.fill_tx_cmddesc = rtl92cu_tx_fill_cmddesc,
	.query_rx_desc = rtl92cu_rx_query_desc,
	.set_channel_access = rtl92cu_update_channel_access_setting,
	.radio_onoff_checking = rtl92cu_gpio_radio_on_off_checking,
	.set_bw_mode = rtl92c_phy_set_bw_mode,
	.switch_channel = rtl92c_phy_sw_chnl,
	.dm_watchdog = rtl92c_dm_watchdog,
	.scan_operation_backup = rtl_phy_scan_operation_backup,
	.set_rf_power_state = rtl92cu_phy_set_rf_power_state,
	.led_control = rtl92cu_led_control,
	.enable_hw_sec = rtl92cu_enable_hw_security_config,
	.set_key = rtl92c_set_key,
	.get_bbreg = rtl92c_phy_query_bb_reg,
	.set_bbreg = rtl92c_phy_set_bb_reg,
	.get_rfreg = rtl92cu_phy_query_rf_reg,
	.set_rfreg = rtl92cu_phy_set_rf_reg,
	.phy_rf6052_config = rtl92cu_phy_rf6052_config,
	.phy_rf6052_set_cck_txpower = rtl92cu_phy_rf6052_set_cck_txpower,
	.phy_rf6052_set_ofdm_txpower = rtl92cu_phy_rf6052_set_ofdm_txpower,
	.config_bb_with_headerfile = _rtl92cu_phy_config_bb_with_headerfile,
	.config_bb_with_pgheaderfile = _rtl92cu_phy_config_bb_with_pgheaderfile,
	.phy_lc_calibrate = _rtl92cu_phy_lc_calibrate,
	.phy_set_bw_mode_callback = rtl92cu_phy_set_bw_mode_callback,
	.dm_dynamic_txpower = rtl92cu_dm_dynamic_txpower,
	.fill_h2c_cmd = rtl92c_fill_h2c_cmd,
	.get_btc_status = rtl92cu_get_btc_status,
};

static struct rtl_mod_params rtl92cu_mod_params = {
	.sw_crypto = 0,
	.debug_level = 0,
	.debug_mask = 0,
};

module_param_named(swenc, rtl92cu_mod_params.sw_crypto, bool, 0444);
module_param_named(debug_level, rtl92cu_mod_params.debug_level, int, 0644);
module_param_named(debug_mask, rtl92cu_mod_params.debug_mask, ullong, 0644);
MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n");
MODULE_PARM_DESC(debug_level, "Set debug level (0-5) (default 0)");
MODULE_PARM_DESC(debug_mask, "Set debug mask (default 0)");

static struct rtl_hal_usbint_cfg rtl92cu_interface_cfg = {
	/* rx */
	.rx_urb_num = RTL92C_NUM_RX_URBS,
	.rx_max_size = RTL92C_SIZE_MAX_RX_BUFFER,
	.usb_rx_hdl = rtl8192cu_rx_hdl,
	.usb_rx_segregate_hdl = NULL,
	/* tx */
	.usb_tx_cleanup = rtl8192c_tx_cleanup,
	.usb_tx_post_hdl = rtl8192c_tx_post_hdl,
	.usb_tx_aggregate_hdl = rtl8192c_tx_aggregate_hdl,
	/* endpoint mapping */
	.usb_endpoint_mapping = rtl8192cu_endpoint_mapping,
	.usb_mq_to_hwq = rtl8192cu_mq_to_hwq,
};

static const struct rtl_hal_cfg rtl92cu_hal_cfg = {
	.name = "rtl92c_usb",
	.alt_fw_name = "rtlwifi/rtl8192cufw.bin",
	.ops = &rtl8192cu_hal_ops,
	.mod_params = &rtl92cu_mod_params,
	.usb_interface_cfg = &rtl92cu_interface_cfg,

	.maps[SYS_ISO_CTRL] = REG_SYS_ISO_CTRL,
	.maps[SYS_FUNC_EN] = REG_SYS_FUNC_EN,
	.maps[SYS_CLK] = REG_SYS_CLKR,
	.maps[MAC_RCR_AM] = AM,
	.maps[MAC_RCR_AB] = AB,
	.maps[MAC_RCR_ACRC32] = ACRC32,
	.maps[MAC_RCR_ACF] = ACF,
	.maps[MAC_RCR_AAP] = AAP,

	.maps[EFUSE_TEST] = REG_EFUSE_TEST,
	.maps[EFUSE_CTRL] = REG_EFUSE_CTRL,
	.maps[EFUSE_CLK] = 0,
	.maps[EFUSE_CLK_CTRL] = REG_EFUSE_CTRL,
	.maps[EFUSE_PWC_EV12V] = PWC_EV12V,
	.maps[EFUSE_FEN_ELDR] = FEN_ELDR,
	.maps[EFUSE_LOADER_CLK_EN] = LOADER_CLK_EN,
	.maps[EFUSE_ANA8M] = EFUSE_ANA8M,
	.maps[EFUSE_HWSET_MAX_SIZE] = HWSET_MAX_SIZE,
	.maps[EFUSE_MAX_SECTION_MAP] = EFUSE_MAX_SECTION,
	.maps[EFUSE_REAL_CONTENT_SIZE] = EFUSE_REAL_CONTENT_LEN,

	.maps[RWCAM] = REG_CAMCMD,
	.maps[WCAMI] = REG_CAMWRITE,
	.maps[RCAMO] = REG_CAMREAD,
	.maps[CAMDBG] = REG_CAMDBG,
	.maps[SECR] = REG_SECCFG,
	.maps[SEC_CAM_NONE] = CAM_NONE,
	.maps[SEC_CAM_WEP40] = CAM_WEP40,
	.maps[SEC_CAM_TKIP] = CAM_TKIP,
	.maps[SEC_CAM_AES] = CAM_AES,
	.maps[SEC_CAM_WEP104] = CAM_WEP104,

	.maps[RTL_IMR_BCNDMAINT6] = IMR_BCNDMAINT6,
	.maps[RTL_IMR_BCNDMAINT5] = IMR_BCNDMAINT5,
	.maps[RTL_IMR_BCNDMAINT4] = IMR_BCNDMAINT4,
	.maps[RTL_IMR_BCNDMAINT3] = IMR_BCNDMAINT3,
	.maps[RTL_IMR_BCNDMAINT2] = IMR_BCNDMAINT2,
	.maps[RTL_IMR_BCNDMAINT1] = IMR_BCNDMAINT1,
	.maps[RTL_IMR_BCNDOK8] = IMR_BCNDOK8,
	.maps[RTL_IMR_BCNDOK7] = IMR_BCNDOK7,
	.maps[RTL_IMR_BCNDOK6] = IMR_BCNDOK6,
	.maps[RTL_IMR_BCNDOK5] = IMR_BCNDOK5,
	.maps[RTL_IMR_BCNDOK4] = IMR_BCNDOK4,
	.maps[RTL_IMR_BCNDOK3] = IMR_BCNDOK3,
	.maps[RTL_IMR_BCNDOK2] = IMR_BCNDOK2,
	.maps[RTL_IMR_BCNDOK1] = IMR_BCNDOK1,
	.maps[RTL_IMR_TIMEOUT2] = IMR_TIMEOUT2,
	.maps[RTL_IMR_TIMEOUT1] = IMR_TIMEOUT1,

	.maps[RTL_IMR_TXFOVW] = IMR_TXFOVW,
	.maps[RTL_IMR_PSTIMEOUT] = IMR_PSTIMEOUT,
	.maps[RTL_IMR_BCNINT] = IMR_BCNINT,
	.maps[RTL_IMR_RXFOVW] = IMR_RXFOVW,
	.maps[RTL_IMR_RDU] = IMR_RDU,
	.maps[RTL_IMR_ATIMEND] = IMR_ATIMEND,
	.maps[RTL_IMR_BDOK] = IMR_BDOK,
	.maps[RTL_IMR_MGNTDOK] = IMR_MGNTDOK,
	.maps[RTL_IMR_TBDER] = IMR_TBDER,
	.maps[RTL_IMR_HIGHDOK] = IMR_HIGHDOK,
	.maps[RTL_IMR_TBDOK] = IMR_TBDOK,
	.maps[RTL_IMR_BKDOK] = IMR_BKDOK,
	.maps[RTL_IMR_BEDOK] = IMR_BEDOK,
	.maps[RTL_IMR_VIDOK] = IMR_VIDOK,
	.maps[RTL_IMR_VODOK] = IMR_VODOK,
	.maps[RTL_IMR_ROK] = IMR_ROK,
	.maps[RTL_IBSS_INT_MASKS] = (IMR_BCNINT | IMR_TBDOK | IMR_TBDER),

	.maps[RTL_RC_CCK_RATE1M] = DESC_RATE1M,
	.maps[RTL_RC_CCK_RATE2M] = DESC_RATE2M,
	.maps[RTL_RC_CCK_RATE5_5M] = DESC_RATE5_5M,
	.maps[RTL_RC_CCK_RATE11M] = DESC_RATE11M,
	.maps[RTL_RC_OFDM_RATE6M] = DESC_RATE6M,
	.maps[RTL_RC_OFDM_RATE9M] = DESC_RATE9M,
	.maps[RTL_RC_OFDM_RATE12M] = DESC_RATE12M,
	.maps[RTL_RC_OFDM_RATE18M] = DESC_RATE18M,
	.maps[RTL_RC_OFDM_RATE24M] = DESC_RATE24M,
	.maps[RTL_RC_OFDM_RATE36M] = DESC_RATE36M,
	.maps[RTL_RC_OFDM_RATE48M] = DESC_RATE48M,
	.maps[RTL_RC_OFDM_RATE54M] = DESC_RATE54M,
	.maps[RTL_RC_HT_RATEMCS7] = DESC_RATEMCS7,
	.maps[RTL_RC_HT_RATEMCS15] = DESC_RATEMCS15,
};

#define USB_VENDOR_ID_REALTEK		0x0bda

/* 2010-10-19 DID_USB_V3.4 */
static const struct usb_device_id rtl8192c_usb_ids[] = {

	/*=== Realtek demoboard ===*/
	/* Default ID */
	{RTL_USB_DEVICE(USB_VENDOR_ID_REALTEK, 0x8191, rtl92cu_hal_cfg)},

	/****** 8188CU ********/
	/* RTL8188CTV */
	{RTL_USB_DEVICE(USB_VENDOR_ID_REALTEK, 0x018a, rtl92cu_hal_cfg)},
	/* 8188CE-VAU USB minCard */
	{RTL_USB_DEVICE(USB_VENDOR_ID_REALTEK, 0x8170, rtl92cu_hal_cfg)},
	/* 8188cu 1*1 dongle */
	{RTL_USB_DEVICE(USB_VENDOR_ID_REALTEK, 0x8176, rtl92cu_hal_cfg)},
	/* 8188cu 1*1 dongle, (b/g mode only) */
	{RTL_USB_DEVICE(USB_VENDOR_ID_REALTEK, 0x8177, rtl92cu_hal_cfg)},
	/* 8188cu Slim Solo */
	{RTL_USB_DEVICE(USB_VENDOR_ID_REALTEK, 0x817a, rtl92cu_hal_cfg)},
	/* 8188cu Slim Combo */
	{RTL_USB_DEVICE(USB_VENDOR_ID_REALTEK, 0x817b, rtl92cu_hal_cfg)},
	/* 8188RU High-power USB Dongle */
	{RTL_USB_DEVICE(USB_VENDOR_ID_REALTEK, 0x817d, rtl92cu_hal_cfg)},
	/* 8188CE-VAU USB minCard (b/g mode only) */
	{RTL_USB_DEVICE(USB_VENDOR_ID_REALTEK, 0x817e, rtl92cu_hal_cfg)},
	/* 8188RU in Alfa AWUS036NHR */
	{RTL_USB_DEVICE(USB_VENDOR_ID_REALTEK, 0x817f, rtl92cu_hal_cfg)},
	/* RTL8188CUS-VL */
	{RTL_USB_DEVICE(USB_VENDOR_ID_REALTEK, 0x818a, rtl92cu_hal_cfg)},
	{RTL_USB_DEVICE(USB_VENDOR_ID_REALTEK, 0x819a, rtl92cu_hal_cfg)},
	/* 8188 Combo for BC4 */
	{RTL_USB_DEVICE(USB_VENDOR_ID_REALTEK, 0x8754, rtl92cu_hal_cfg)},

	/****** 8192CU ********/
	/* 8192cu 2*2 */
	{RTL_USB_DEVICE(USB_VENDOR_ID_REALTEK, 0x8178, rtl92cu_hal_cfg)},
	/* 8192CE-VAU USB minCard */
	{RTL_USB_DEVICE(USB_VENDOR_ID_REALTEK, 0x817c, rtl92cu_hal_cfg)},

	/*=== Customer ID ===*/
	/****** 8188CU ********/
	{RTL_USB_DEVICE(0x050d, 0x1102, rtl92cu_hal_cfg)}, /*Belkin - Edimax*/
	{RTL_USB_DEVICE(0x050d, 0x11f2, rtl92cu_hal_cfg)}, /*Belkin - ISY*/
	{RTL_USB_DEVICE(0x06f8, 0xe033, rtl92cu_hal_cfg)}, /*Hercules - Edimax*/
	{RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/
	{RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/
	{RTL_USB_DEVICE(0x0846, 0x9043, rtl92cu_hal_cfg)}, /*NG WNA1000Mv2*/
	{RTL_USB_DEVICE(0x0b05, 0x17ba, rtl92cu_hal_cfg)}, /*ASUS-Edimax*/
	{RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
	{RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
	{RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
	{RTL_USB_DEVICE(0x0df6, 0x0070, rtl92cu_hal_cfg)}, /*Sitecom - 150N */
	{RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/
	{RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
	{RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
	/* HP - Lite-On ,8188CUS Slim Combo */
	{RTL_USB_DEVICE(0x103c, 0x1629, rtl92cu_hal_cfg)},
	{RTL_USB_DEVICE(0x13d3, 0x3357, rtl92cu_hal_cfg)}, /* AzureWave */
	{RTL_USB_DEVICE(0x2001, 0x3308, rtl92cu_hal_cfg)}, /*D-Link - Alpha*/
	{RTL_USB_DEVICE(0x2019, 0x4902, rtl92cu_hal_cfg)}, /*Planex - Etop*/
	{RTL_USB_DEVICE(0x2019, 0xab2a, rtl92cu_hal_cfg)}, /*Planex - Abocom*/
	/*SW-WF02-AD15 -Abocom*/
	{RTL_USB_DEVICE(0x2019, 0xab2e, rtl92cu_hal_cfg)},
	{RTL_USB_DEVICE(0x2019, 0xed17, rtl92cu_hal_cfg)}, /*PCI - Edimax*/
	{RTL_USB_DEVICE(0x20f4, 0x648b, rtl92cu_hal_cfg)}, /*TRENDnet - Cameo*/
	{RTL_USB_DEVICE(0x7392, 0x7811, rtl92cu_hal_cfg)}, /*Edimax - Edimax*/
	{RTL_USB_DEVICE(0x13d3, 0x3358, rtl92cu_hal_cfg)}, /*Azwave 8188CE-VAU*/
	/* Russian customer -Azwave (8188CE-VAU  b/g mode only) */
	{RTL_USB_DEVICE(0x13d3, 0x3359, rtl92cu_hal_cfg)},
	{RTL_USB_DEVICE(0x4855, 0x0090, rtl92cu_hal_cfg)}, /* Feixun */
	{RTL_USB_DEVICE(0x4855, 0x0091, rtl92cu_hal_cfg)}, /* NetweeN-Feixun */
	{RTL_USB_DEVICE(0x9846, 0x9041, rtl92cu_hal_cfg)}, /* Netgear Cameo */

	/****** 8188 RU ********/
	/* Netcore */
	{RTL_USB_DEVICE(USB_VENDOR_ID_REALTEK, 0x317f, rtl92cu_hal_cfg)},

	/****** 8188CUS Slim Solo********/
	{RTL_USB_DEVICE(0x04f2, 0xaff7, rtl92cu_hal_cfg)}, /*Xavi*/
	{RTL_USB_DEVICE(0x04f2, 0xaff9, rtl92cu_hal_cfg)}, /*Xavi*/
	{RTL_USB_DEVICE(0x04f2, 0xaffa, rtl92cu_hal_cfg)}, /*Xavi*/
	{RTL_USB_DEVICE(0x0846, 0x9042, rtl92cu_hal_cfg)}, /*On Netwrks N150MA*/

	/****** 8188CUS Slim Combo ********/
	{RTL_USB_DEVICE(0x04f2, 0xaff8, rtl92cu_hal_cfg)}, /*Xavi*/
	{RTL_USB_DEVICE(0x04f2, 0xaffb, rtl92cu_hal_cfg)}, /*Xavi*/
	{RTL_USB_DEVICE(0x04f2, 0xaffc, rtl92cu_hal_cfg)}, /*Xavi*/
	{RTL_USB_DEVICE(0x2019, 0x1201, rtl92cu_hal_cfg)}, /*Planex-Vencer*/

	/****** 8192CU ********/
	{RTL_USB_DEVICE(0x050d, 0x1004, rtl92cu_hal_cfg)}, /*Belcom-SurfN300*/
	{RTL_USB_DEVICE(0x050d, 0x2102, rtl92cu_hal_cfg)}, /*Belcom-Sercomm*/
	{RTL_USB_DEVICE(0x050d, 0x2103, rtl92cu_hal_cfg)}, /*Belcom-Edimax*/
	{RTL_USB_DEVICE(0x0586, 0x341f, rtl92cu_hal_cfg)}, /*Zyxel -Abocom*/
	{RTL_USB_DEVICE(0x07aa, 0x0056, rtl92cu_hal_cfg)}, /*ATKK-Gemtek*/
	{RTL_USB_DEVICE(0x07b8, 0x8178, rtl92cu_hal_cfg)}, /*Funai -Abocom*/
	{RTL_USB_DEVICE(0x0846, 0x9021, rtl92cu_hal_cfg)}, /*Netgear-Sercomm*/
	{RTL_USB_DEVICE(0x0846, 0xf001, rtl92cu_hal_cfg)}, /*On Netwrks N300MA*/
	{RTL_USB_DEVICE(0x0b05, 0x17ab, rtl92cu_hal_cfg)}, /*ASUS-Edimax*/
	{RTL_USB_DEVICE(0x0bda, 0x8186, rtl92cu_hal_cfg)}, /*Realtek 92CE-VAU*/
	{RTL_USB_DEVICE(0x0df6, 0x0061, rtl92cu_hal_cfg)}, /*Sitecom-Edimax*/
	{RTL_USB_DEVICE(0x0e66, 0x0019, rtl92cu_hal_cfg)}, /*Hawking-Edimax*/
	{RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
	{RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
	{RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
	{RTL_USB_DEVICE(0x2001, 0x330d, rtl92cu_hal_cfg)}, /*D-Link DWA-131 */
	{RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/
	{RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/
	{RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/
	{RTL_USB_DEVICE(0x7392, 0x7822, rtl92cu_hal_cfg)}, /*Edimax -Edimax*/
	{}
};

MODULE_DEVICE_TABLE(usb, rtl8192c_usb_ids);

static int rtl8192cu_probe(struct usb_interface *intf,
			   const struct usb_device_id *id)
{
	return rtl_usb_probe(intf, id, &rtl92cu_hal_cfg);
}

static struct usb_driver rtl8192cu_driver = {
	.name = "rtl8192cu",
	.probe = rtl8192cu_probe,
	.disconnect = rtl_usb_disconnect,
	.id_table = rtl8192c_usb_ids,

#ifdef CONFIG_PM
	/* .suspend = rtl_usb_suspend, */
	/* .resume = rtl_usb_resume, */
	/* .reset_resume = rtl8192c_resume, */
#endif /* CONFIG_PM */
	.disable_hub_initiated_lpm = 1,
};

module_usb_driver(rtl8192cu_driver);
]

gemini-3-flash-preview

							input: 109823
							output: 47
							thoughts: 877
						

**Analyzing a USB Driver Issue**

Okay, so I'm looking at this issue where a C reproducer seems to be causing problems with USB drivers, specifically concerning devices with zero interfaces. Let me break down my thought process:

First, I see the initial device IDs that are relevant: `0x0db0:0x6869` which maps to `rt2500usb`, then `0x0000:0x0000` which has no driver. Finally, `0x0bda:0x5088` matches `rtl8192cu`. So far, so good.

The user mentions a `syz_usb_control_io` call on the "second device" with `asix` responses. That's immediately a red flag. The second device is supposedly `0x0000:0x0000`, so why would it be talking `asix`? Something doesn't add up.

I wonder if the user's listing order is off. Maybe they're thinking of it like this: `rt2500usb`, then `asix`, and then `rtl8192cu`.

The reproducer calls `syz_usb_connect` for three devices, and the second is all zeros. So, if the second device is all zeros, but the code is seeing `asix`, then the kernel must *think* it's an `asix` device somehow.

Now, how could that be? Only if the `idVendor` and `idProduct` aren't zero, but the user says the device is uninitialized. Hold on – if it's "uninitialized" in the C code, it's probably being passed to `syz_usb_connect` as a zeroed buffer. This means the device descriptor presented to the kernel is entirely zeros. That's a crucial clue.

Okay, let's see. Wait, I see something interesting in `asix_devices.c`:

```c
1582:		// ASIX 88772a
1583:		USB_DEVICE(0x0db0, 0xa877),
1584:		.driver_info = (unsigned long) &ax88772_info,
```

And in `rt2500usb`:

```c
1018:	{ USB_DEVICE(0x0db0, 0x6869) },
```

Both use `0x0db0` as the Vendor ID! Is that significant? Maybe.

The user provides another crucial point: "The C reproducer only initializes the first 9 bytes of the config descriptor, leaving the `usb_interface_descriptor` as all zeros. Therefore the `bLength` of the interface descriptor will be 0, and `usb_parse_configuration` will skip it and set `bNumInterfaces = 0`. If `bNumInterfaces = 0`, no driver is probed." Bingo! Now we know why no driver is being loaded.

This makes more sense now. Because it sounds like the issue is related to the zero interface count, it shouldn't crash in a specific driver. The question is if there is some crash in the USB core related to a configuration of 0 interfaces. The code likely won't get to the driver if the interface count is zero.

The `usb_set_configuration` function calls `device_add` for each interface. If `nintf = 0`, it adds no interfaces. It still adds the `usb_device`.

I have to wonder, is there any code in the USB core or any driver that makes an invalid assumption like `bNumInterfaces > 0`? The key area I should check is `usb_detect_interface_quirks`. That's where I need to focus my attention.

map[ContextFile:drivers/usb/core/quirks.c IncludeLines:true Name:usb_detect_interface_quirks]

map[SourceCode: 781:	void usb_detect_interface_quirks(struct usb_device *udev)
 782:	{
 783:		u32 quirks;
 784:	
 785:		quirks = usb_detect_static_quirks(udev, usb_interface_quirk_list);
 786:		if (quirks == 0)
 787:			return;
 788:	
 789:		dev_dbg(&udev->dev, "USB interface quirks for this device: %x\n",
 790:			quirks);
 791:		udev->quirks |= quirks;
 792:	}
 SourceFile:drivers/usb/core/quirks.c]

gemini-3-flash-preview

							input: 111795
							output: 23
							thoughts: 380
						

**Analyzing Potential USB Driver Vulnerability**

Okay, I'm thinking... safe, for now. But then, my mind jumps to `usb_new_device`. That function seems like a good place to start digging. It calls `usb_enumerate_device` and then `device_add(&udev->dev)`.

The question that arises is: what happens if `bNumInterfaces` is zero in the device descriptor? That could be problematic. Looking deeper, in `usb_set_configuration`, I see this allocation:

```c
2091:			new_interfaces = kmalloc_objs(*new_interfaces, nintf, GFP_NOIO);
```

If `nintf` (which represents the number of interfaces) is zero, `kmalloc_objs` (which I assume is probably something like `kmalloc_array` or similar) might return `ZERO_SIZE_PTR`. Then the loop at line 2095: `for (; n < nintf; ++n)` would never execute. The function then calls `kfree(new_interfaces)` at line 2207.

The thought then comes, the `cp->interface` is an array of pointers.

```c
2165:			cp->interface[i] = intf = new_interfaces[i];
```

If `nintf` is zero, this line wouldn't execute at all!

Now I need to understand where `cp->interface` is allocated in the first place... Let's see... Is it in `usb_parse_configuration`? Nope. Not there... `usb_get_configuration`? Aha!

```c
 939:		length = ncfg * sizeof(struct usb_host_config);
 940:		dev->config = kzalloc(length, GFP_KERNEL);
```

That's where the host configuration is allocated. And `struct usb_host_config` has the definition: `struct usb_interface *interface[USB_MAXINTERFACES];`... it's a fixed size array! That's interesting. I need to make sure I completely understand how that interacts with the allocation and possible zero-length interfaces.

map[Name:usb_host_config]

map[Fields:[map[Name:desc OffsetBits:0 SizeBits:72] map[Name:string OffsetBits:128 SizeBits:64] map[Name:intf_assoc OffsetBits:192 SizeBits:1024] map[Name:interface OffsetBits:1216 SizeBits:2048] map[Name:intf_cache OffsetBits:3264 SizeBits:2048] map[Name:extra OffsetBits:5312 SizeBits:64] map[Name:extralen OffsetBits:5376 SizeBits:32]]]

gemini-3-flash-preview

							input: 112839
							output: 23
							thoughts: 1288
						

**Analyzing the USB Device Enumeration Issue**

Okay, let's break this down. My initial thought process revolves around understanding the structure of the `interface` field. Based on the provided bit counts, it seems like `interface` is a fixed-size array of pointers, likely with `USB_MAXINTERFACES` elements, probably 32. If `bNumInterfaces` is zero, these pointers would all be NULL.

The user's statement about `syz_usb_control_io` being called with `asix` responses for a zero-initialized device is key. It's making me consider if the issue is with device 2 or if the focus is misdirected. Device 1 is `0x0db0:0x6869`, rt2500usb. That's a real device. It's the *second* device that's all zeros. The question I have is, how is the `asix` driver even involved with an uninitialized device? The `asix` driver shouldn't probe if it doesn't match an id, right? The user's specific comment: "But how can `asix` be probed if `idVendor=0`?" is what's making me wonder about `usb_match_id` or other potential matching logic.

Is it possible that not the entire device descriptor is zero, but just the config/interface descriptors? That's when I recall syzkaller's `syz_usb_connect` is pseudo and the executor may set defaults.

I need to revisit the `asix` driver's `probe` function. It seems to use `usbnet_probe`, which in turn calls `dev->driver_info->bind`. The `asix` bind functions are `ax88772_bind`, `ax88172_bind` or `ax88178_bind`. Let's look at `ax88772_bind`. It calls `asix_read_cmd`, which then calls `usbnet_read_cmd`, which ultimately involves `syz_usb_control_io` for the emulated device.

But I'm still stuck on how the `asix` functions get called for a device that seems unmatched. Is there a driver that matches a `0x0000:0x0000`? I'll look at the `generic.c` driver. The generic driver matches anything, but I don't see any `asix` function calls in there.

Maybe the "second device" the user mentions *isn't* the target of the `syz_usb_control_io` calls. Let's revisit the order:
```c
syz_usb_connect(..., &dev1);
syz_usb_connect(..., &dev2);
syz_usb_connect(..., &dev3);
```
If `dev2` is zeros, it fails enumeration. If it fails, the kernel *shouldn't* send control messages to it, *except* those during enumeration. The user is telling me that the reproducer has `syz_usb_control_io(1, ...)`, which is for `dev2`. Perhaps the executor is providing all zeros for Get Device Descriptor? If `bLength` is 0 in that descriptor, enumeration fails, which fits with the user's description.

If the buffer is all zeros then `bLength` is zero.

I recall some bug reports that are similar to the "KASAN: null-ptr-deref in asix_suspend" message. Now, I'm going to search for "asix" and "null-ptr-deref". That will give more context.

map[Name:asix_suspend]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 114975
							output: 24
							thoughts: 592
						

**Analyzing the `asix_suspend` Function and Potential Issues**

Okay, so I'm looking at `drivers/net/usb/asix_devices.c` and specifically the `asix_suspend` function. My initial thought is to trace the execution path. Let's see... it retrieves the `usbnet` structure using `usb_get_intfdata(intf)`. This function is critical; it returns `intf->dev.driver_data`, which, as I recall, should be set during `usbnet_probe`. Now, a quick check tells me that if `dev` turns out to be `NULL`, dereferencing `dev->driver_priv` would lead to a crash, which is something to keep in mind.

But wait, hold on. `asix_suspend` is only called if the driver is actually bound to an interface. So, how could `dev` be `NULL`? Unless the probe failed entirely...

Ah, what about the `bNumInterfaces` field in the USB device descriptor? If it's zero, then no interfaces are created, and therefore `asix_suspend` can never be called. That simplifies things a bit. Let's not get ahead of ourselves, though. I should review the `asix` driver's `id_table` again, just to be sure there's absolutely no way a zeroed device could be accidentally matched. No, that's not it.

Okay, let's step back and consider the problem statement more carefully. The user mentions that a reproducer calls `syz_usb_control_io` for the "second device" with responses for the `asix` driver. The user *claims* the second device is uninitialized. My mind wanders to possibilities. Could the "second device" actually be an `asix` device but not initialized somehow? The issue must lie in an assumption that the device is uninitialized. The user's statement must be correct: "The second device is uninitialized (all zeros)."

Alright, so the second device is all zeros. The reproducer calls `syz_usb_control_io` for this uninitialized device *with `asix` responses*... This triggers a thought. Could the first device actually be the `asix` device in this scenario? I remember the first device being `0x0db0:0x6869` (rt2500usb). Wait, I thought `0x0db0:0xa877` was `asix`. Could `0x6869` also be `asix`? I checked the `products` table and didn't find it. Time to run a broader search for device IDs in the tree.

log-in to see details

map[Name:0x6869]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 116200
							output: 22
							thoughts: 15
						

Okay, here's my summary, in the first person, as requested, assuming the user is an expert:

**Internal Search Strategy**

Alright, let's get down to it. My first instinct here is to treat the search term, `6869`, as a literal *string*. I'm going to initiate a search directly for that exact sequence of characters. My initial thought process is to bypass any immediate attempt at numerical interpretation, any pre-processing or type conversions. This might be a direct lookup in a data set, perhaps a pattern-matching exercise within a larger text, or a key search within a database. This is a baseline, a quick and dirty way to establish a presence of the target data, which I know is a good starting point to quickly validate any initial hypothesis.

log-in to see details

map[Name:6869]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 116424
							output: 43
							thoughts: 224
						

**Analyzing the `asix` Driver's Binding Process**

Alright, let's dive back into the `ax88772_bind` function within the `asix` driver. I need to refresh my understanding of the resource allocation process. Line 450 immediately catches my eye: `priv = devm_kzalloc(&dev->udev->dev, sizeof(*priv), GFP_KERNEL);`. Okay, so it's allocating memory for `priv` using `devm_kzalloc`, which is good – memory managed, handles potential failures. Then, line 454 assigns `priv` to `dev->driver_priv`. Pretty standard, the driver-specific private data is hooked up to the USB network device.

Now, here's the crucial question: what happens if `usbnet_probe` fails *after* `ax88772_bind` has already run? Remember the driver's initialization sequence: `usbnet_probe` calls `bind` as part of its startup. If `usbnet_probe` can't complete successfully after `bind` is called, there could be resource leaks. I need to verify how these resources are properly cleaned up. Let's shift our focus to `usbnet_probe` in `drivers/net/usb/usbnet.c`. I need to understand its control flow to be certain about the failure scenario's implications.

map[ContextFile:drivers/net/usb/usbnet.c IncludeLines:true Name:usbnet_probe]

map[SourceCode:1729:	int
1730:	usbnet_probe(struct usb_interface *udev, const struct usb_device_id *prod)
1731:	{
1732:		struct usbnet			*dev;
1733:		struct net_device		*net;
1734:		struct usb_host_interface	*interface;
1735:		const struct driver_info	*info;
1736:		struct usb_device		*xdev;
1737:		int				status;
1738:		const char			*name;
1739:		struct usb_driver 	*driver = to_usb_driver(udev->dev.driver);
1740:	
1741:		/* usbnet already took usb runtime pm, so have to enable the feature
1742:		 * for usb interface, otherwise usb_autopm_get_interface may return
1743:		 * failure if RUNTIME_PM is enabled.
1744:		 */
1745:		if (!driver->supports_autosuspend) {
1746:			driver->supports_autosuspend = 1;
1747:			pm_runtime_enable(&udev->dev);
1748:		}
1749:	
1750:		name = udev->dev.driver->name;
1751:		info = (const struct driver_info *) prod->driver_info;
1752:		if (!info) {
1753:			dev_dbg (&udev->dev, "blacklisted by %s\n", name);
1754:			return -ENODEV;
1755:		}
1756:		xdev = interface_to_usbdev(udev);
1757:		interface = udev->cur_altsetting;
1758:	
1759:		status = -ENOMEM;
1760:	
1761:		// set up our own records
1762:		net = alloc_etherdev(sizeof(*dev));
1763:		if (!net)
1764:			goto out;
1765:	
1766:		/* netdev_printk() needs this so do it as early as possible */
1767:		SET_NETDEV_DEV(net, &udev->dev);
1768:	
1769:		dev = netdev_priv(net);
1770:		dev->udev = xdev;
1771:		dev->intf = udev;
1772:		dev->driver_info = info;
1773:		dev->driver_name = name;
1774:		dev->rx_speed = SPEED_UNSET;
1775:		dev->tx_speed = SPEED_UNSET;
1776:	
1777:		dev->msg_enable = netif_msg_init (msg_level, NETIF_MSG_DRV
1778:					| NETIF_MSG_PROBE | NETIF_MSG_LINK);
1779:		init_waitqueue_head(&dev->wait);
1780:		skb_queue_head_init (&dev->rxq);
1781:		skb_queue_head_init (&dev->txq);
1782:		skb_queue_head_init (&dev->done);
1783:		skb_queue_head_init(&dev->rxq_pause);
1784:		spin_lock_init(&dev->bql_spinlock);
1785:		INIT_WORK(&dev->bh_work, usbnet_bh_work);
1786:		INIT_WORK(&dev->kevent, usbnet_deferred_kevent);
1787:		init_usb_anchor(&dev->deferred);
1788:		timer_setup(&dev->delay, usbnet_bh, 0);
1789:		mutex_init(&dev->phy_mutex);
1790:		mutex_init(&dev->interrupt_mutex);
1791:		dev->interrupt_count = 0;
1792:	
1793:		dev->net = net;
1794:		strscpy(net->name, "usb%d", sizeof(net->name));
1795:	
1796:		/* rx and tx sides can use different message sizes;
1797:		 * bind() should set rx_urb_size in that case.
1798:		 */
1799:		dev->hard_mtu = net->mtu + net->hard_header_len;
1800:		net->min_mtu = 0;
1801:		net->max_mtu = ETH_MAX_MTU;
1802:	
1803:		net->netdev_ops = &usbnet_netdev_ops;
1804:		net->watchdog_timeo = TX_TIMEOUT_JIFFIES;
1805:		net->ethtool_ops = &usbnet_ethtool_ops;
1806:		net->pcpu_stat_type = NETDEV_PCPU_STAT_TSTATS;
1807:	
1808:		// allow device-specific bind/init procedures
1809:		// NOTE net->name still not usable ...
1810:		if (info->bind) {
1811:			status = info->bind(dev, udev);
1812:			if (status < 0)
1813:				goto out1;
1814:	
1815:			/* heuristic: rename to "eth%d" if we are not sure this link
1816:			 * is two-host (these links keep "usb%d")
1817:			 */
1818:			if ((dev->driver_info->flags & FLAG_ETHER) != 0 &&
1819:			    !usbnet_needs_usb_name_format(dev, net))
1820:				strscpy(net->name, "eth%d", sizeof(net->name));
1821:			/* WLAN devices should always be named "wlan%d" */
1822:			if ((dev->driver_info->flags & FLAG_WLAN) != 0)
1823:				strscpy(net->name, "wlan%d", sizeof(net->name));
1824:			/* WWAN devices should always be named "wwan%d" */
1825:			if ((dev->driver_info->flags & FLAG_WWAN) != 0)
1826:				strscpy(net->name, "wwan%d", sizeof(net->name));
1827:	
1828:			/* devices that cannot do ARP */
1829:			if ((dev->driver_info->flags & FLAG_NOARP) != 0)
1830:				net->flags |= IFF_NOARP;
1831:	
1832:			if ((dev->driver_info->flags & FLAG_NOMAXMTU) == 0 &&
1833:			    net->max_mtu > (dev->hard_mtu - net->hard_header_len))
1834:				net->max_mtu = dev->hard_mtu - net->hard_header_len;
1835:	
1836:			if (net->mtu > (dev->hard_mtu - net->hard_header_len))
1837:				net->mtu = dev->hard_mtu - net->hard_header_len;
1838:	
1839:		} else if (!info->in || !info->out)
1840:			status = usbnet_get_endpoints(dev, udev);
1841:		else {
1842:			u8 ep_addrs[3] = {
1843:				info->in + USB_DIR_IN, info->out + USB_DIR_OUT, 0
1844:			};
1845:	
1846:			dev->in = usb_rcvbulkpipe(xdev, info->in);
1847:			dev->out = usb_sndbulkpipe(xdev, info->out);
1848:			if (!(info->flags & FLAG_NO_SETINT))
1849:				status = usb_set_interface(xdev,
1850:							   interface->desc.bInterfaceNumber,
1851:							   interface->desc.bAlternateSetting);
1852:			else
1853:				status = 0;
1854:	
1855:			if (status == 0 && !usb_check_bulk_endpoints(udev, ep_addrs))
1856:				status = -EINVAL;
1857:		}
1858:		if (status >= 0 && dev->status)
1859:			status = init_status(dev, udev);
1860:		if (status < 0)
1861:			goto out3;
1862:	
1863:		if (!dev->rx_urb_size)
1864:			dev->rx_urb_size = dev->hard_mtu;
1865:		dev->maxpacket = usb_maxpacket(dev->udev, dev->out);
1866:		if (dev->maxpacket == 0) {
1867:			/* that is a broken device */
1868:			status = -ENODEV;
1869:			goto out4;
1870:		}
1871:	
1872:		/* this flags the device for user space */
1873:		if (!is_valid_ether_addr(net->dev_addr))
1874:			eth_hw_addr_random(net);
1875:	
1876:		if ((dev->driver_info->flags & FLAG_WLAN) != 0)
1877:			SET_NETDEV_DEVTYPE(net, &wlan_type);
1878:		if ((dev->driver_info->flags & FLAG_WWAN) != 0)
1879:			SET_NETDEV_DEVTYPE(net, &wwan_type);
1880:	
1881:		/* initialize max rx_qlen and tx_qlen */
1882:		usbnet_update_max_qlen(dev);
1883:	
1884:		if (dev->can_dma_sg && !(info->flags & FLAG_SEND_ZLP) &&
1885:			!(info->flags & FLAG_MULTI_PACKET)) {
1886:			dev->padding_pkt = kzalloc(1, GFP_KERNEL);
1887:			if (!dev->padding_pkt) {
1888:				status = -ENOMEM;
1889:				goto out4;
1890:			}
1891:		}
1892:	
1893:		status = register_netdev(net);
1894:		if (status)
1895:			goto out5;
1896:		netif_info(dev, probe, dev->net,
1897:			   "register '%s' at usb-%s-%s, %s, %pM\n",
1898:			   udev->dev.driver->name,
1899:			   xdev->bus->bus_name, xdev->devpath,
1900:			   dev->driver_info->description,
1901:			   net->dev_addr);
1902:	
1903:		// ok, it's ready to go.
1904:		usb_set_intfdata(udev, dev);
1905:	
1906:		netif_device_attach(net);
1907:	
1908:		if (dev->driver_info->flags & FLAG_LINK_INTR)
1909:			usbnet_link_change(dev, 0, 0);
1910:	
1911:		return 0;
1912:	
1913:	out5:
1914:		kfree(dev->padding_pkt);
1915:	out4:
1916:		usb_free_urb(dev->interrupt);
1917:	out3:
1918:		if (info->unbind)
1919:			info->unbind(dev, udev);
1920:	out1:
1921:		/* subdrivers must undo all they did in bind() if they
1922:		 * fail it, but we may fail later and a deferred kevent
1923:		 * may trigger an error resubmitting itself and, worse,
1924:		 * schedule a timer. So we kill it all just in case.
1925:		 */
1926:		usbnet_mark_going_away(dev);
1927:		cancel_work_sync(&dev->kevent);
1928:		timer_delete_sync(&dev->delay);
1929:		free_netdev(net);
1930:	out:
1931:		return status;
1932:	}
 SourceFile:drivers/net/usb/usbnet.c]

gemini-3-flash-preview

							input: 120378
							output: 23
							thoughts: 269
						

**Analyzing a Potential NULL Pointer Dereference in the ASIX Driver**

Okay, let's break this down. I'm looking at a possible NULL pointer dereference, specifically within the ASIX driver's interaction with the USB subsystem. My train of thought starts with `usbnet_probe`. Line 1904, I see `usb_set_intfdata(udev, dev)`. The critical thing here is that if `usbnet_probe` fails *before* that call, the `intfdata` isn't set. The problem arises because `asix_suspend` later calls `usb_get_intfdata(intf)`. If `intfdata` remains `NULL`, then `dev` will be `NULL`. From there, the code tries to access `struct asix_common_private *priv = dev->driver_priv;`, which is an immediate crash waiting to happen.

However, a quick check reminds me that `asix_suspend` is *only* called if the device is actually bound to the driver. If `usbnet_probe` fails early, binding doesn't happen, and thus `asix_suspend` isn't called, so this scenario shouldn't be possible.

Hang on... I need to consider a different scenario. What if `usbnet_probe` *succeeds* initially, but something else subsequently goes wrong? Then, I read the user's report of a C reproducer. The report mentions calling `syz_usb_control_io` for the *second* device, and it’s providing responses specifically to the ASIX driver. If that second device is reported as all zeros, the enumeration is going to fail.

Then, a lightbulb went off, and I recalled a recent fix to the ASIX driver: "net: usb: asix: fix null-ptr-deref in asix_suspend." I need to find the specific commit. I'm going to track that down and confirm if this is the root cause. This information should clarify what the user observed, and how to verify if it is indeed fixed.

map[Name:asix_suspend]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 121137
							output: 24
							thoughts: 2149
						

**Analyzing a Potential NULL Pointer Dereference in the asix Driver**

Okay, let's break this down. The core issue seems to be a potential null pointer dereference within the `asix_suspend` function. My initial thought was to examine the history of `drivers/net/usb/asix_devices.c` but without direct access, I can look at the code. Specifically, the concern is that `dev` (a `struct usbnet`) might be NULL when `asix_suspend` is called.  This can happen if `usb_set_intfdata` was never called, or if the data was cleared, and it seemed possible the reproducer triggered this somehow.

I then considered what the user, an expert in the field, was saying. They brought up that the C reproducer initializes only the first 9 bytes of the config descriptor, leaving the rest of the interface descriptor as all zeros. This means the `bNumInterfaces` field would be set to zero after the `usb_parse_configuration` function runs. If `bNumInterfaces` is zero, no driver gets probed, so `asix_suspend` shouldn't even be called.

So the user's question, if `bNumInterfaces = 0` causes a crash, makes me look more closely at that scenario. The issue isn't in `usb_set_configuration` because if `bNumInterfaces = 0` then the loop in that function doesn't execute and no interfaces are added. Also, in the `usb_disable_device` function, the loop also doesn't run if `bNumInterfaces` is 0.

My attention then switched to the `usb_parse_configuration` function. Specifically, it seemed interesting that `bNumInterfaces` is set to 0 even if it wasn't originally 0. However, the subsequent analysis of how this impacts other functions seemed to show this was safe.

In `usb_get_configuration` function, this could be an issue because it uses `udev->descriptor.bNumConfigurations`. Then it calls `usb_parse_configuration`. If the number of interfaces is zero, then `usb_set_configuration` will have `nintf = 0`. So, if `bNumInterfaces` is 0, no driver can be probed.

I then considered if there are any other places where `bNumInterfaces` is used, such as `usbnet` in the function `usbnet_probe`. But `usbnet_probe` takes `struct usb_interface *udev` which is created by `usb_set_configuration` and if `nintf` is 0, then no interface is created and `usbnet_probe` would not be called. So, again, it seems safe.

But I've got to consider what the user stated about the `idVendor` field being zero. I realized that if the device is a zero-initialized device, then all fields are 0.

I recall a previous syzkaller bug report: "KASAN: null-ptr-deref in asix_suspend". This reproducer involved multiple `syz_usb_connect` calls and it seems one device was indeed an `asix` device. This suggests that the reproducer setup is key.

To solidify my thinking, I will return to the `asix` driver. My focus is going to be on `ax88772_bind` function. And while I'm at it, I'll also have a look at `drivers/net/usb/asix_common.c`.

map[Dir:drivers/net/usb/]

map[Files:[aqc111.c aqc111.h asix.h asix_common.c asix_devices.c ax88172a.c ax88179_178a.c catc.c cdc-phonet.c cdc_eem.c cdc_ether.c cdc_mbim.c cdc_ncm.c cdc_subset.c ch9200.c cx82310_eth.c dm9601.c gl620a.c hso.c huawei_cdc_ncm.c int51x1.c ipheth.c kalmia.c kaweth.c lan78xx.c lan78xx.h lg-vl600.c mcs7830.c net1080.c pegasus.c pegasus.h plusb.c qmi_wwan.c r8152.c r8153_ecm.c rndis_host.c rtl8150.c sierra_net.c smsc75xx.c smsc75xx.h smsc95xx.c smsc95xx.h sr9700.c sr9700.h sr9800.c sr9800.h usbnet.c zaurus.c] Subdirs:<nil>]

gemini-3-flash-preview

							input: 124537
							output: 27
							thoughts: 12
						

Here's a summary of my thinking, expressed as if these were my internal thoughts:

**Analyzing the Codebase: Diving into `asix_common.c`**

Okay, I need to get a handle on this. My first move is to zero in on `asix_common.c`. This is likely the core, the nexus, of the ASIX-related code. Given the naming convention, I'm expecting this file to hold the common functionalities used across different ASIX-based drivers within this system. It probably contains the low-level register access, hardware initialization routines, interrupt handling, and maybe some buffer management functions that are shared. I need to understand this to have any chance of making a meaningful contribution. Let's see what's in there. I'll start by quickly scanning the function definitions and variable declarations to get a sense of the architecture. Then, I'll dive into the critical routines, focusing on areas where performance is paramount.

map[File:drivers/net/usb/asix_common.c]

map[Contents:// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * ASIX AX8817X based USB 2.0 Ethernet Devices
 * Copyright (C) 2003-2006 David Hollis <dhollis@davehollis.com>
 * Copyright (C) 2005 Phil Chang <pchang23@sbcglobal.net>
 * Copyright (C) 2006 James Painter <jamie.painter@iname.com>
 * Copyright (c) 2002-2003 TiVo Inc.
 */

#include "asix.h"

#define AX_HOST_EN_RETRIES	30

int __must_check asix_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
			       u16 size, void *data, int in_pm)
{
	int ret;
	int (*fn)(struct usbnet *, u8, u8, u16, u16, void *, u16);

	BUG_ON(!dev);

	if (!in_pm)
		fn = usbnet_read_cmd;
	else
		fn = usbnet_read_cmd_nopm;

	ret = fn(dev, cmd, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
		 value, index, data, size);

	if (unlikely(ret < size)) {
		ret = ret < 0 ? ret : -ENODATA;

		netdev_warn(dev->net, "Failed to read reg index 0x%04x: %d\n",
			    index, ret);
	}

	return ret;
}

int asix_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
		   u16 size, void *data, int in_pm)
{
	int ret;
	int (*fn)(struct usbnet *, u8, u8, u16, u16, const void *, u16);

	BUG_ON(!dev);

	if (!in_pm)
		fn = usbnet_write_cmd;
	else
		fn = usbnet_write_cmd_nopm;

	ret = fn(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
		 value, index, data, size);

	if (unlikely(ret < 0))
		netdev_warn(dev->net, "Failed to write reg index 0x%04x: %d\n",
			    index, ret);

	return ret;
}

void asix_write_cmd_async(struct usbnet *dev, u8 cmd, u16 value, u16 index,
			  u16 size, void *data)
{
	usbnet_write_cmd_async(dev, cmd,
			       USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
			       value, index, data, size);
}

static int asix_set_sw_mii(struct usbnet *dev, int in_pm)
{
	int ret;

	ret = asix_write_cmd(dev, AX_CMD_SET_SW_MII, 0x0000, 0, 0, NULL, in_pm);

	if (ret < 0)
		netdev_err(dev->net, "Failed to enable software MII access\n");
	return ret;
}

static int asix_set_hw_mii(struct usbnet *dev, int in_pm)
{
	int ret;

	ret = asix_write_cmd(dev, AX_CMD_SET_HW_MII, 0x0000, 0, 0, NULL, in_pm);
	if (ret < 0)
		netdev_err(dev->net, "Failed to enable hardware MII access\n");
	return ret;
}

static int asix_check_host_enable(struct usbnet *dev, int in_pm)
{
	int i, ret;
	u8 smsr;

	for (i = 0; i < AX_HOST_EN_RETRIES; ++i) {
		ret = asix_set_sw_mii(dev, in_pm);
		if (ret == -ENODEV || ret == -ETIMEDOUT)
			break;
		usleep_range(1000, 1100);
		ret = asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG,
				    0, 0, 1, &smsr, in_pm);
		if (ret == -ENODEV)
			break;
		else if (ret < 0)
			continue;
		else if (smsr & AX_HOST_EN)
			break;
	}

	return i >= AX_HOST_EN_RETRIES ? -ETIMEDOUT : ret;
}

static void reset_asix_rx_fixup_info(struct asix_rx_fixup_info *rx)
{
	/* Reset the variables that have a lifetime outside of
	 * asix_rx_fixup_internal() so that future processing starts from a
	 * known set of initial conditions.
	 */

	if (rx->ax_skb) {
		/* Discard any incomplete Ethernet frame in the netdev buffer */
		kfree_skb(rx->ax_skb);
		rx->ax_skb = NULL;
	}

	/* Assume the Data header 32-bit word is at the start of the current
	 * or next URB socket buffer so reset all the state variables.
	 */
	rx->remaining = 0;
	rx->split_head = false;
	rx->header = 0;
}

int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb,
			   struct asix_rx_fixup_info *rx)
{
	int offset = 0;
	u16 size;

	/* When an Ethernet frame spans multiple URB socket buffers,
	 * do a sanity test for the Data header synchronisation.
	 * Attempt to detect the situation of the previous socket buffer having
	 * been truncated or a socket buffer was missing. These situations
	 * cause a discontinuity in the data stream and therefore need to avoid
	 * appending bad data to the end of the current netdev socket buffer.
	 * Also avoid unnecessarily discarding a good current netdev socket
	 * buffer.
	 */
	if (rx->remaining && (rx->remaining + sizeof(u32) <= skb->len)) {
		offset = ((rx->remaining + 1) & 0xfffe);
		rx->header = get_unaligned_le32(skb->data + offset);
		offset = 0;

		size = (u16)(rx->header & 0x7ff);
		if (size != ((~rx->header >> 16) & 0x7ff)) {
			netdev_err(dev->net, "asix_rx_fixup() Data Header synchronisation was lost, remaining %d\n",
				   rx->remaining);
			reset_asix_rx_fixup_info(rx);
		}
	}

	while (offset + sizeof(u16) <= skb->len) {
		u16 copy_length;

		if (!rx->remaining) {
			if (skb->len - offset == sizeof(u16)) {
				rx->header = get_unaligned_le16(
						skb->data + offset);
				rx->split_head = true;
				offset += sizeof(u16);
				break;
			}

			if (rx->split_head == true) {
				rx->header |= (get_unaligned_le16(
						skb->data + offset) << 16);
				rx->split_head = false;
				offset += sizeof(u16);
			} else {
				rx->header = get_unaligned_le32(skb->data +
								offset);
				offset += sizeof(u32);
			}

			/* take frame length from Data header 32-bit word */
			size = (u16)(rx->header & 0x7ff);
			if (size != ((~rx->header >> 16) & 0x7ff)) {
				netdev_err(dev->net, "asix_rx_fixup() Bad Header Length 0x%x, offset %d\n",
					   rx->header, offset);
				reset_asix_rx_fixup_info(rx);
				return 0;
			}
			if (size > dev->net->mtu + ETH_HLEN + VLAN_HLEN) {
				netdev_dbg(dev->net, "asix_rx_fixup() Bad RX Length %d\n",
					   size);
				reset_asix_rx_fixup_info(rx);
				return 0;
			}

			/* Sometimes may fail to get a netdev socket buffer but
			 * continue to process the URB socket buffer so that
			 * synchronisation of the Ethernet frame Data header
			 * word is maintained.
			 */
			rx->ax_skb = netdev_alloc_skb_ip_align(dev->net, size);

			rx->remaining = size;
		}

		if (rx->remaining > skb->len - offset) {
			copy_length = skb->len - offset;
			rx->remaining -= copy_length;
		} else {
			copy_length = rx->remaining;
			rx->remaining = 0;
		}

		if (rx->ax_skb) {
			skb_put_data(rx->ax_skb, skb->data + offset,
				     copy_length);
			if (!rx->remaining) {
				usbnet_skb_return(dev, rx->ax_skb);
				rx->ax_skb = NULL;
			}
		}

		offset += (copy_length + 1) & 0xfffe;
	}

	if (skb->len != offset) {
		netdev_err(dev->net, "asix_rx_fixup() Bad SKB Length %d, %d\n",
			   skb->len, offset);
		reset_asix_rx_fixup_info(rx);
		return 0;
	}

	return 1;
}

int asix_rx_fixup_common(struct usbnet *dev, struct sk_buff *skb)
{
	struct asix_common_private *dp = dev->driver_priv;
	struct asix_rx_fixup_info *rx = &dp->rx_fixup_info;

	return asix_rx_fixup_internal(dev, skb, rx);
}

void asix_rx_fixup_common_free(struct asix_common_private *dp)
{
	struct asix_rx_fixup_info *rx;

	if (!dp)
		return;

	rx = &dp->rx_fixup_info;

	if (rx->ax_skb) {
		kfree_skb(rx->ax_skb);
		rx->ax_skb = NULL;
	}
}

struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
			      gfp_t flags)
{
	int padlen;
	int headroom = skb_headroom(skb);
	int tailroom = skb_tailroom(skb);
	u32 packet_len;
	u32 padbytes = 0xffff0000;
	void *ptr;

	padlen = ((skb->len + 4) & (dev->maxpacket - 1)) ? 0 : 4;

	/* We need to push 4 bytes in front of frame (packet_len)
	 * and maybe add 4 bytes after the end (if padlen is 4)
	 *
	 * Avoid skb_copy_expand() expensive call, using following rules :
	 * - We are allowed to push 4 bytes in headroom if skb_header_cloned()
	 *   is false (and if we have 4 bytes of headroom)
	 * - We are allowed to put 4 bytes at tail if skb_cloned()
	 *   is false (and if we have 4 bytes of tailroom)
	 *
	 * TCP packets for example are cloned, but __skb_header_release()
	 * was called in tcp stack, allowing us to use headroom for our needs.
	 */
	if (!skb_header_cloned(skb) &&
	    !(padlen && skb_cloned(skb)) &&
	    headroom + tailroom >= 4 + padlen) {
		/* following should not happen, but better be safe */
		if (headroom < 4 ||
		    tailroom < padlen) {
			skb->data = memmove(skb->head + 4, skb->data, skb->len);
			skb_set_tail_pointer(skb, skb->len);
		}
	} else {
		struct sk_buff *skb2;

		skb2 = skb_copy_expand(skb, 4, padlen, flags);
		dev_kfree_skb_any(skb);
		skb = skb2;
		if (!skb)
			return NULL;
	}

	packet_len = ((skb->len ^ 0x0000ffff) << 16) + skb->len;
	ptr = skb_push(skb, 4);
	put_unaligned_le32(packet_len, ptr);

	if (padlen) {
		put_unaligned_le32(padbytes, skb_tail_pointer(skb));
		skb_put(skb, sizeof(padbytes));
	}

	usbnet_set_skb_tx_stats(skb, 1, 0);
	return skb;
}

int asix_read_phy_addr(struct usbnet *dev, bool internal)
{
	int ret, offset;
	u8 buf[2];

	ret = asix_read_cmd(dev, AX_CMD_READ_PHY_ID, 0, 0, 2, buf, 0);
	if (ret < 0)
		goto error;

	if (ret < 2) {
		ret = -EIO;
		goto error;
	}

	offset = (internal ? 1 : 0);
	ret = buf[offset];

	if (ret >= PHY_MAX_ADDR) {
		netdev_err(dev->net, "invalid PHY address: %d\n", ret);
		return -ENODEV;
	}

	netdev_dbg(dev->net, "%s PHY address 0x%x\n",
		   internal ? "internal" : "external", ret);

	return ret;

error:
	netdev_err(dev->net, "Error reading PHY_ID register: %02x\n", ret);

	return ret;
}

int asix_sw_reset(struct usbnet *dev, u8 flags, int in_pm)
{
	int ret;

	ret = asix_write_cmd(dev, AX_CMD_SW_RESET, flags, 0, 0, NULL, in_pm);
	if (ret < 0)
		netdev_err(dev->net, "Failed to send software reset: %02x\n", ret);

	return ret;
}

u16 asix_read_rx_ctl(struct usbnet *dev, int in_pm)
{
	__le16 v;
	int ret = asix_read_cmd(dev, AX_CMD_READ_RX_CTL, 0, 0, 2, &v, in_pm);

	if (ret < 0) {
		netdev_err(dev->net, "Error reading RX_CTL register: %02x\n", ret);
		goto out;
	}
	ret = le16_to_cpu(v);
out:
	return ret;
}

int asix_write_rx_ctl(struct usbnet *dev, u16 mode, int in_pm)
{
	int ret;

	netdev_dbg(dev->net, "asix_write_rx_ctl() - mode = 0x%04x\n", mode);
	ret = asix_write_cmd(dev, AX_CMD_WRITE_RX_CTL, mode, 0, 0, NULL, in_pm);
	if (ret < 0)
		netdev_err(dev->net, "Failed to write RX_CTL mode to 0x%04x: %02x\n",
			   mode, ret);

	return ret;
}

u16 asix_read_medium_status(struct usbnet *dev, int in_pm)
{
	__le16 v;
	int ret = asix_read_cmd(dev, AX_CMD_READ_MEDIUM_STATUS,
				0, 0, 2, &v, in_pm);

	if (ret < 0) {
		netdev_err(dev->net, "Error reading Medium Status register: %02x\n",
			   ret);
		return ret;	/* TODO: callers not checking for error ret */
	}

	return le16_to_cpu(v);

}

int asix_write_medium_mode(struct usbnet *dev, u16 mode, int in_pm)
{
	int ret;

	netdev_dbg(dev->net, "asix_write_medium_mode() - mode = 0x%04x\n", mode);
	ret = asix_write_cmd(dev, AX_CMD_WRITE_MEDIUM_MODE,
			     mode, 0, 0, NULL, in_pm);
	if (ret < 0)
		netdev_err(dev->net, "Failed to write Medium Mode mode to 0x%04x: %02x\n",
			   mode, ret);

	return ret;
}

int asix_write_gpio(struct usbnet *dev, u16 value, int sleep, int in_pm)
{
	int ret;

	netdev_dbg(dev->net, "asix_write_gpio() - value = 0x%04x\n", value);
	ret = asix_write_cmd(dev, AX_CMD_WRITE_GPIOS, value, 0, 0, NULL, in_pm);
	if (ret < 0)
		netdev_err(dev->net, "Failed to write GPIO value 0x%04x: %02x\n",
			   value, ret);

	if (sleep)
		msleep(sleep);

	return ret;
}

/*
 * AX88772 & AX88178 have a 16-bit RX_CTL value
 */
void asix_set_multicast(struct net_device *net)
{
	struct usbnet *dev = netdev_priv(net);
	struct asix_data *data = (struct asix_data *)&dev->data;
	u16 rx_ctl = AX_DEFAULT_RX_CTL;

	if (net->flags & IFF_PROMISC) {
		rx_ctl |= AX_RX_CTL_PRO;
	} else if (net->flags & IFF_ALLMULTI ||
		   netdev_mc_count(net) > AX_MAX_MCAST) {
		rx_ctl |= AX_RX_CTL_AMALL;
	} else if (netdev_mc_empty(net)) {
		/* just broadcast and directed */
	} else {
		/* We use the 20 byte dev->data
		 * for our 8 byte filter buffer
		 * to avoid allocating memory that
		 * is tricky to free later */
		struct netdev_hw_addr *ha;
		u32 crc_bits;

		memset(data->multi_filter, 0, AX_MCAST_FILTER_SIZE);

		/* Build the multicast hash filter. */
		netdev_for_each_mc_addr(ha, net) {
			crc_bits = ether_crc(ETH_ALEN, ha->addr) >> 26;
			data->multi_filter[crc_bits >> 3] |=
			    1 << (crc_bits & 7);
		}

		asix_write_cmd_async(dev, AX_CMD_WRITE_MULTI_FILTER, 0, 0,
				   AX_MCAST_FILTER_SIZE, data->multi_filter);

		rx_ctl |= AX_RX_CTL_AM;
	}

	asix_write_cmd_async(dev, AX_CMD_WRITE_RX_CTL, rx_ctl, 0, 0, NULL);
}

static int __asix_mdio_read(struct net_device *netdev, int phy_id, int loc,
			    bool in_pm)
{
	struct usbnet *dev = netdev_priv(netdev);
	__le16 res;
	int ret;

	mutex_lock(&dev->phy_mutex);

	ret = asix_check_host_enable(dev, in_pm);
	if (ret == -ENODEV || ret == -ETIMEDOUT) {
		mutex_unlock(&dev->phy_mutex);
		return ret;
	}

	ret = asix_read_cmd(dev, AX_CMD_READ_MII_REG, phy_id, (__u16)loc, 2,
			    &res, in_pm);
	if (ret < 0)
		goto out;

	ret = asix_set_hw_mii(dev, in_pm);
out:
	mutex_unlock(&dev->phy_mutex);

	netdev_dbg(dev->net, "asix_mdio_read() phy_id=0x%02x, loc=0x%02x, returns=0x%04x\n",
			phy_id, loc, le16_to_cpu(res));

	return ret < 0 ? ret : le16_to_cpu(res);
}

int asix_mdio_read(struct net_device *netdev, int phy_id, int loc)
{
	return __asix_mdio_read(netdev, phy_id, loc, false);
}

static int __asix_mdio_write(struct net_device *netdev, int phy_id, int loc,
			     int val, bool in_pm)
{
	struct usbnet *dev = netdev_priv(netdev);
	__le16 res = cpu_to_le16(val);
	int ret;

	netdev_dbg(dev->net, "asix_mdio_write() phy_id=0x%02x, loc=0x%02x, val=0x%04x\n",
			phy_id, loc, val);

	mutex_lock(&dev->phy_mutex);

	ret = asix_check_host_enable(dev, in_pm);
	if (ret == -ENODEV)
		goto out;

	ret = asix_write_cmd(dev, AX_CMD_WRITE_MII_REG, phy_id, (__u16)loc, 2,
			     &res, in_pm);
	if (ret < 0)
		goto out;

	ret = asix_set_hw_mii(dev, in_pm);
out:
	mutex_unlock(&dev->phy_mutex);

	return ret < 0 ? ret : 0;
}

void asix_mdio_write(struct net_device *netdev, int phy_id, int loc, int val)
{
	__asix_mdio_write(netdev, phy_id, loc, val, false);
}

/* MDIO read and write wrappers for phylib */
int asix_mdio_bus_read(struct mii_bus *bus, int phy_id, int regnum)
{
	struct usbnet *priv = bus->priv;

	return __asix_mdio_read(priv->net, phy_id, regnum, false);
}

int asix_mdio_bus_write(struct mii_bus *bus, int phy_id, int regnum, u16 val)
{
	struct usbnet *priv = bus->priv;

	return __asix_mdio_write(priv->net, phy_id, regnum, val, false);
}

int asix_mdio_read_nopm(struct net_device *netdev, int phy_id, int loc)
{
	return __asix_mdio_read(netdev, phy_id, loc, true);
}

void
asix_mdio_write_nopm(struct net_device *netdev, int phy_id, int loc, int val)
{
	__asix_mdio_write(netdev, phy_id, loc, val, true);
}

void asix_get_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
{
	struct usbnet *dev = netdev_priv(net);
	u8 opt;

	if (asix_read_cmd(dev, AX_CMD_READ_MONITOR_MODE,
			  0, 0, 1, &opt, 0) < 0) {
		wolinfo->supported = 0;
		wolinfo->wolopts = 0;
		return;
	}
	wolinfo->supported = WAKE_PHY | WAKE_MAGIC;
	wolinfo->wolopts = 0;
	if (opt & AX_MONITOR_LINK)
		wolinfo->wolopts |= WAKE_PHY;
	if (opt & AX_MONITOR_MAGIC)
		wolinfo->wolopts |= WAKE_MAGIC;
}

int asix_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
{
	struct usbnet *dev = netdev_priv(net);
	u8 opt = 0;

	if (wolinfo->wolopts & ~(WAKE_PHY | WAKE_MAGIC))
		return -EINVAL;

	if (wolinfo->wolopts & WAKE_PHY)
		opt |= AX_MONITOR_LINK;
	if (wolinfo->wolopts & WAKE_MAGIC)
		opt |= AX_MONITOR_MAGIC;

	if (asix_write_cmd(dev, AX_CMD_WRITE_MONITOR_MODE,
			      opt, 0, 0, NULL, 0) < 0)
		return -EINVAL;

	return 0;
}

int asix_get_eeprom_len(struct net_device *net)
{
	return AX_EEPROM_LEN;
}

int asix_get_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
		    u8 *data)
{
	struct usbnet *dev = netdev_priv(net);
	u16 *eeprom_buff;
	int first_word, last_word;
	int i;

	if (eeprom->len == 0)
		return -EINVAL;

	eeprom->magic = AX_EEPROM_MAGIC;

	first_word = eeprom->offset >> 1;
	last_word = (eeprom->offset + eeprom->len - 1) >> 1;

	eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
				    GFP_KERNEL);
	if (!eeprom_buff)
		return -ENOMEM;

	/* ax8817x returns 2 bytes from eeprom on read */
	for (i = first_word; i <= last_word; i++) {
		if (asix_read_cmd(dev, AX_CMD_READ_EEPROM, i, 0, 2,
				  &eeprom_buff[i - first_word], 0) < 0) {
			kfree(eeprom_buff);
			return -EIO;
		}
	}

	memcpy(data, (u8 *)eeprom_buff + (eeprom->offset & 1), eeprom->len);
	kfree(eeprom_buff);
	return 0;
}

int asix_set_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
		    u8 *data)
{
	struct usbnet *dev = netdev_priv(net);
	u16 *eeprom_buff;
	int first_word, last_word;
	int i;
	int ret;

	netdev_dbg(net, "write EEPROM len %d, offset %d, magic 0x%x\n",
		   eeprom->len, eeprom->offset, eeprom->magic);

	if (eeprom->len == 0)
		return -EINVAL;

	if (eeprom->magic != AX_EEPROM_MAGIC)
		return -EINVAL;

	first_word = eeprom->offset >> 1;
	last_word = (eeprom->offset + eeprom->len - 1) >> 1;

	eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
				    GFP_KERNEL);
	if (!eeprom_buff)
		return -ENOMEM;

	/* align data to 16 bit boundaries, read the missing data from
	   the EEPROM */
	if (eeprom->offset & 1) {
		ret = asix_read_cmd(dev, AX_CMD_READ_EEPROM, first_word, 0, 2,
				    &eeprom_buff[0], 0);
		if (ret < 0) {
			netdev_err(net, "Failed to read EEPROM at offset 0x%02x.\n", first_word);
			goto free;
		}
	}

	if ((eeprom->offset + eeprom->len) & 1) {
		ret = asix_read_cmd(dev, AX_CMD_READ_EEPROM, last_word, 0, 2,
				    &eeprom_buff[last_word - first_word], 0);
		if (ret < 0) {
			netdev_err(net, "Failed to read EEPROM at offset 0x%02x.\n", last_word);
			goto free;
		}
	}

	memcpy((u8 *)eeprom_buff + (eeprom->offset & 1), data, eeprom->len);

	/* write data to EEPROM */
	ret = asix_write_cmd(dev, AX_CMD_WRITE_ENABLE, 0x0000, 0, 0, NULL, 0);
	if (ret < 0) {
		netdev_err(net, "Failed to enable EEPROM write\n");
		goto free;
	}
	msleep(20);

	for (i = first_word; i <= last_word; i++) {
		netdev_dbg(net, "write to EEPROM at offset 0x%02x, data 0x%04x\n",
			   i, eeprom_buff[i - first_word]);
		ret = asix_write_cmd(dev, AX_CMD_WRITE_EEPROM, i,
				     eeprom_buff[i - first_word], 0, NULL, 0);
		if (ret < 0) {
			netdev_err(net, "Failed to write EEPROM at offset 0x%02x.\n",
				   i);
			goto free;
		}
		msleep(20);
	}

	ret = asix_write_cmd(dev, AX_CMD_WRITE_DISABLE, 0x0000, 0, 0, NULL, 0);
	if (ret < 0) {
		netdev_err(net, "Failed to disable EEPROM write\n");
		goto free;
	}

	ret = 0;
free:
	kfree(eeprom_buff);
	return ret;
}

int asix_set_mac_address(struct net_device *net, void *p)
{
	struct usbnet *dev = netdev_priv(net);
	struct asix_data *data = (struct asix_data *)&dev->data;
	struct sockaddr *addr = p;

	if (netif_running(net))
		return -EBUSY;
	if (!is_valid_ether_addr(addr->sa_data))
		return -EADDRNOTAVAIL;

	eth_hw_addr_set(net, addr->sa_data);

	/* We use the 20 byte dev->data
	 * for our 6 byte mac buffer
	 * to avoid allocating memory that
	 * is tricky to free later */
	memcpy(data->mac_addr, addr->sa_data, ETH_ALEN);
	asix_write_cmd_async(dev, AX_CMD_WRITE_NODE_ID, 0, 0, ETH_ALEN,
							data->mac_addr);

	return 0;
}
]