last executing test programs:

2m24.52394032s ago: executing program 1 (id=94):
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0)
ioctl$ASHMEM_GET_NAME(r0, 0x40047703, 0x0)
r1 = memfd_create(&(0x7f0000000000)='cgroup.events\x00', 0x0)
ioctl$BTRFS_IOC_DEV_INFO(r1, 0xd000941e, &(0x7f0000000180)={0x0, "97232f30eced03df11727d40a35365d1"}) (async)
socket$inet_icmp_raw(0x2, 0x3, 0x1)

2m24.462515536s ago: executing program 1 (id=95):
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) (async)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) (async)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x0, 0x3032, 0xffffffffffffffff, 0x1263b000)
socket$inet6_tcp(0xa, 0x1, 0x0) (async)
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x165342, 0x0)
write(r0, &(0x7f0000000400)="547bbee68789313efe846d6698abfeac0d12b144933fa6f684f1ba13b34680bf4b9ea70f71faa2a82a45ab47458c1f827355ad34033fbb8b9699eb0b279252dfcf29e377e14dcfbde42857cbf2aa88d3dad8ec2deea7afe4e747fa392fe01d425970fb2dd7a000ea3889f0d9021f347818106963e18c256e3df26b41c61d30284a8ad61c6269756119d62e3a7a24c1dcd09d3eb35dfee6ec945ac190c4797988e0d7f6f38bf9b124431dd8208a9208195a70c8e558c216e78d5f5b3f6df6f155e16bf7dd8f4e9eaf61d5142a82da7a87aeca19c25b631cd8a14ce9f2fc8dbcd05f51dc9260abc82d780c9358bd6411ebf48520694d413024432d0bfc3759a620289c9c8705009fd829da6eb5b72b454436b0af8e9dc4941ca2cff92561cad984e15849dcd73f04c7f70a30304da2fbc17f421767ad5ce47ed79d6698428eada9a39faa02f978699bc8c482224a2d5f85cc1135ea92ac1c610e32f1e7c82da6d91e0c8634da679760c32c3e891db352b76b61a65bbdd023e093a8e0d37fd8cd00679cb1bceaac84b05861740c221b2cb4afa1ce8b091c815fc4bd83995b5bf5dcdf2912572cf6180ec27445404917ff9e8e6604e2afc19a1bb3745914f0a101e03e44ea5f64d40402f12a81310c97086fb01d04e82799c40f29348eb283ad58a40d608a47fbf9a25dbb308aa03b2425ffa896e1a70a37cf49e6dbdeda39ee88aadb26811eba78a0dfe5400a51428c31582edcc5f75b5dd963707a54b9b1e35f9966995d6474acbf7094124cecf38369aba3f6a5e3ad071f5e3df902843a3947623fe01571d97625c3e27721b08a6f85fd7b879acd400de5beabdd2603d566fdb4018bf8bd74c3ea1ae67c988992c7dab4ebcf501a73815e1b527d3ff1cf9e729d55127118565f794d253fef25609e5a415615d1b5fca5381b49446d9b9e75fbfcdd9218b0d8d8d965871b897544e32fd0b4cb5600ffdcdb0056bcad75216759590f8a94db82b0acd2a5a34e5c34241a19f1a7a7cceb894341f55c6b474f3cc052f9863a67519dfadee6576f08d7448929424c13e845e2e636b87dc14e1ab4ad05d69f896ca1bc5c1267befb686c4207e21aa30bdae1d1602d3e4080784834e213c426ba5446f90d3b3885a5d6942c6b0e637f5bb9c7908460bd7d04497ab054c8fc7f89068f7535976ad051bfe94c243ce7604a63b2099b69f1ed73590a318fad9a170fa0cddfe60e981a92de2e1aab3465b11a968108e08deadfa1fa546c4cbc0c34ac28597848562583ae8d93cb60f2e06c7a1f743add51eb8cd732b40d48fde00117cb2d654100dfcc66b7c9fefac80e137caa5cf43ae897780251a3ebbc4ddd3b003168963c9e2c9446cb29731fc4bbb5e551aca6913f7b8576ce34012581b5a363917970399ca369688e637cf06ff3c8114383d2fcbf9c69f1ca63cd21695254a440df5ef0a8abfdbd0a651a533b6cdb82382e3bd70f87c1d3eb0a6e22452605026fafe6d35158c0728c1050a39330c80ee2ee0b09366fc6382883ecd0796feec657b36aee4091471e406e9faffd5ede27943e5fbf1b7249ab8bad71f60063697f04db52e980a9fb3eb5e53b89be8a5f0e6afea7435789ecd444c28eb411cdc2158e434178749f36cc957dbd17efb2b218592f78d6864f2708e8c6db2da0d3f6de53959afec0c90d3d62a13a0bc3857bce58d81223eddd05cf3c1ec6b3fc5307d0f16d470f2065300295197e9fa81d2e5574b2c7b18f1c6c85156a9b1174d62dcd3cb026f4b67e6babd66c8f427b9687585f37b18c82e0100507035e78ce010b78ea1b5d3884db25df36ae929dd535a854a31cba5e47655873df72be7463c600b704e9da0e7cb2d61d0710248814ecced2eef8f227c8aec308c2c9d0a39d1a6b306080e8eaef8edece0f6d0d1612c582d70c3999a1a6bd529538f51ba4869ce74bc8509a7126d96db118cdb55411a36f4361d53c8027c12a7486e9c84e4de445b454630be27bdc2ec268702d9c1890297bdd1fc7a235f1a47f4645d286146f3cb9a7ce650f4157a1e7f134eb1815001d59905d3103efad3c66479330e8a5da941c9c38bf21bc0770e3fd56cafa19ad6e9d51f94ed4f900062b5602653aacdcc956aeecfb1dd613caf918e1ca8ef2e1504c42768e77df43569d5fe4b48c237cad5285c578b26b4e47c8ce06fd2686e17eb6d5df5645d0fdde7782216be07a1135dabc3a59598bdbab249c5391832f18ac5163aa7a1a890128a4520835a53eb750604c5e328ecb3216516b3eba3f97652caeb4327da8865880a932dc8e7668666ac3b76a2a424ca37b5dfb52495710611e20790427a9f9e7ac59bb86f0fb7a17a5def347a98dd8e733b784d78d5c7f16f327a2606d4252411457465540a60b0757802f470d08337c0fe4eee5f5cfe4f296d0f7068e80828a022c95632beb7b7f802135e246b1adebebf24c821dee7205e9fe1a437b16aaa8dcb4a58b0bdbc8dbc2fce09271c27430cc9ca8141955ec5ff4228627c3816cfe1bb2c0f40f6a61e8bfa4e2dd744e41ed80b83e9aef77119f4b062b98e86690711e83e795bafa7a8db16f241cee76aa01ff749100c113fda966aa8c83ebe975f760c18e3864065a5de6e8028a9e3199f4acff11e14bb13bc50faf97fdeab46edc371e55cab78841a2de17ca116b0183ac38b658c57a64ab11bb0de071c971a7a5175ad0bac6ac1d1118230a5412a35bd005b369df0e04e749ea93d7e56f713b9ceff580547a2a76ea4753a78b4a5cd0311024c5536b536c8ede63bac8e8b4c5851248d9098a7c6bcc3d5f209178b45aef3c1afa4ab73d8feac3e1f771626d73d85f72dc15d16bd3b7b93e622626f6f3d96b4425d328236cf1579f1ca834a7b318b012e27b9a2dc528189cf1eb3705d90de50ce7ac0c256b7e41500113e164fb7d53c74c6f829552a5bce73eeab9a46d01551bdab18fd3a7e82b036872f1e876b12c5676f63a6ef0c6ff159788a0c2fc40f179a259c656e8aba9295e90027e74ef910ce3c56d6e2de917947410b05603b6a5052453f13e6ac058b3f621573bfe6224bad8c3a5f575e1eb774839cb554c53c9b3ad623df6c5c9627cce856f9ba5847557bc9f854cbb37a936f20a733ba352ee5b343b941290a399fb862434d1b551da420053cad3bad65195cde40b345740e30e9a22619add8aedb763473b729c0649f7a1ea45325534c9b629a1fe3a54a78fe44969715182c6df5c9ecf6878380831b2996579332ac37286e72ab16824c3fc9ef8d74a7f1f5cf80fa37f6bb990db3a7a70139887a4eba0763247c58f4fe770a0496a5ef49a3ba4d62bb900644d49b5fba7e58d58af6ae50c96da346618434ed46b8f4c27cde5e8863d5b090dc117f3b16db2c4273fa84f8b06d3df436bf4a8cfa6d33d7f0e78ef422d5d7640c821398c9adf4d6ccb1b2f7cd0e497023cfdd6b5bb9ad6a29edb8b78fb3322414cad1458eb12699853acb165076db7088f518386380850c111cbe74034ddbfe217db714325ebc4d6b46eba640cf125b87eed0832077ab775e475e431079756b3da6f9bb3c861ce7eabf6adf70b76eb9642a1bab3d7afef2d7b40c8a19b98123ad7449c1039c494e73bc91a86e8e92c39a9482cf60605b9e5c209262c4fcfde76ee370bd6a78253b64c5cbb19a11b34c5a9ccf634c52751277268cd97e795b43867af5a4db51bd631ac547906fd52aff43eb98edacecf08f94a060902b5cb82e87ec856305005bd1150e581d9717460e31ba724da5e7ad72fa580f8509fe838dbc1bfbbf53e29688f25ca602d2de702e4411d3d133e2ab2f454f71f98efc2cd0eb468544cacf608c6689ef122009cf61e813e26b7b2b1695143fcd510f509ec2bf7205e674ba6767eaa29605c51e434c298bde0969617292e960d22b085632d241aa2a8e0f6ac6f2d56d0ed2c6bd3eca306a3224915065894480e737c7d7a11901bb7f977525cfcab652476baab0fd3b68dc59fd14ccdd6248bd5c5a0ab1dbae28a848b2d4ad0d973bb149ff4115b0436b7d145a6f8081d314039131f60dc8ed0ccf2c4971f0a59a65b3b1ef638e6d009dff793a4b7266c58f88bb117d665cae8fc6f6c2840470333bdbc8df12c6633a6ac7b664e089a85dc6d49f52459dd2df1be552194eef6027c1b45f62b97647788c3325f05609c1e02cbc9a18be72e4b502df719e4f9cb82615e3a03b5732328e552023dbfdcf91ed5ab51242e7d09a9b73674f0946976d8a8fa9288dce4d54d5820a0f0053b892685f79a6c8dbac724fce4d24a7b75e383f54ac58af3951d666a22f158637acc4f0e09e248e85f8e1439501afc0d5b7e9eab40fa737ae93482a1e29f3e327fa31d0d764c65ab976af1eb91fe08c5bc10a48b93453ad192d1d538cf93b792a70246bde99f46a78b670edea552840e08c787c928ee311f954b73d07287a59b470e38d4e624ddba8e4b21a74d7c07cc684b0ea82212129901029e74312866722dfa2dc53de3e8ddc00adc21deb7510ed15c50d139296297408da3d6beb589e7bb3f1d74e4e8dddec14b9cdf371d7f142136cdca5644d09edd97228a0abcd2e7b402c5cc68683cb980f50ca7aea8338dc5990a6ebb2d2b95a3deecc45f5a4f4e0e40a57e29f3e227c41db00e17dc962e2ea3184b5057c89974bcab651a22e588a527d7d8ec695e7ab5622c1ad3763d045a8393b7acfa04488556ac957777d1aebfc5d0e2a8150a6984d5607ac2400789d8f622c837d6a9b78fcc2d8aa872949edde53e3a99b5f5bf35bff5f0db7874ad3f172f9d8dd6cbb17a770b1482c79b9a15605cd0d89c6bae9aa6db8e886cfff8f843b99df95dde88c96202ae6ced4d539a3f70997ee7b2bdb7bbe529f9bc55b143066de8d9dcd7fa38c54094f2235e4a17ef8e910b4d48c373ce5e6fc9824ca8f115e579b002df16c591557cd6cac1363b8d8fc656075ca703a87f1efa76e4122eb7358389f659681fb49cb82215f73b284a7678b8b1528472d0cfab1980ee3d4410bdc1c31f1f798c3ca5744077e2f6cb4ca6e415f1e3afc8c00dd95d3307de5428883513f01ed19dde487e1c103619fd78583f09d02982512e0ee20a670b3b24986dcb7431f1ef3fd12e801bb2454213ff7b1962a464647eb4c8125cf2ed098160da880024a98add9b2917e133dcee7a8e25387fd5bf2b3f8fb05b2f7ed5f719b30b9cca4b1754e31d48bd2ec79e7e9c155130ea5f0876f3bb4d94ac74b209633ecb03deb8b9448e8cf4b4bcb04ffdb38ac457881f84636246a4e5e7773166129fb8b7803c6dde0ee69fd1f76f1d93b729eacc9d8dbd6e61e638a3f8de972a824936b1d869a15daaa21db04760e9110c5b7c736671d31a72fcd57a6f7424c898791cafa21a48921215a78d60a367aa7c6284a1aaa1fee0c5291bdc91bf8c032c9917fd28e68fc046ea4b17952f1abbe01af5f19e4fa99fc6a985f6264f9efbb208e6146d3465cc603ef36d3d59b5197bca1696bf5658b60cf0e0455cb1e174e52c4acb712a3ed9202a1ae334427b93305939c7f15e9e5eed09b5fc8d1e3836720d46d133841d4482ec2427d3002d95bce996b4b2d5b59b2a43970afe35517674bfdd8807931697422045f60641138fefa27865b9d477ef04847dd02d305e8f15e228522e54d1ffda6d5b26ad831146c66e6f9153ebeb0785ea75283df66816d771c7e4297c1686d06494a59046313169f2e2b4988a2758198fcb166d9d112d187a4456503e6c0bdfb390c89dcebf3cb8260a27fdebddbc6071857010ad4c59c062db35a4", 0x1f000)

2m24.462007396s ago: executing program 1 (id=96):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_FEATURES_SET(r1, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f00000001c0)={0xc0, r2, 0x1, 0x70bd28, 0x0, {}, [@ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}]}, @ETHTOOL_A_FEATURES_WANTED={0x94, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x90, 0x3, 0x0, 0x1, [{0x88, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x84, 0x2, '\x00\x91P{5\x057\x97:\xf1\xa0\x9fj\n\"\xf8\xcf\\\xc6/\xed\xe9\xe3Z\x9c\x8bK(\v|\xc0!\xfe\x04\xa3)\xc2\xb4\xe0j\x9ej)\a\x83~\x0e\x13\xaaF\x00\x00\x00\x00\x00\x00\x00o\xfao\xfe\x18\xe2\xbf\x15Q\xe8W*\x85N\x80\t\xd2n\x87\xf1|%.\x94\xea^[\xf37\xab\x9a\xf0 \xd3\x94H\x05\x1a\n8\xe95w\a<y\x17p\x7f\xe9\xbc\xe1B\xb8\x97\x1a_+\xe0\xa4\xb07\xa8|X\xf5s\xde\xd7$\a'}]}, {0x4}]}]}]}, 0xc0}}, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0)
mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500), 0xffffffffffffffff)
sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x30, r5, 0x1, 0x70bd2d, 0x25dfdbfc, {{}, {}, {0x14, 0x19, {0xffffffff, 0x5, 0x6f0, 0x4}}}}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x8044)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3})
mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_GET(r6, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=r7, @ANYBLOB="0303000000003446df2513000000"], 0x14}, 0x1, 0x0, 0x0, 0x48045}, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfee, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x40000000000000, 0x18}, @ptr={0x70742a85, 0xfffffffc, &(0x7f00000029c0)=""/201, 0xc9, 0x1, 0x31}, @flat=@binder={0x73622a85, 0x1001, 0x3}}, &(0x7f0000000180)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0})
ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x10200, 0x5, 0x2, 0x1000, &(0x7f0000003000/0x1000)=nil})

2m24.458037376s ago: executing program 1 (id=97):
r0 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c)
setsockopt$inet6_int(r0, 0x29, 0x3, &(0x7f0000004240)=0x40000006, 0x4)
recvmmsg(r0, &(0x7f0000000480)=[{{&(0x7f0000000040)=@ax25={{0x3, @null}, [@remote, @bcast, @netrom, @remote, @default, @bcast, @bcast, @rose]}, 0x80, &(0x7f0000000340)=[{&(0x7f00000000c0)=""/76, 0x4c}, {&(0x7f0000000140)=""/184, 0xb8}, {&(0x7f0000000200)=""/53, 0x35}, {&(0x7f0000000240)=""/158, 0x9e}], 0x11f1, &(0x7f0000000380)=""/220, 0xdc}, 0x7}], 0x1, 0x2, 0x0)
sendto$inet6(r0, 0x0, 0x0, 0x20000001, &(0x7f0000000300)={0xa, 0x4e20, 0x5, @mcast1}, 0x1c)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom0\x00', 0x2, 0x0)

2m24.439984847s ago: executing program 1 (id=98):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs2/binder1\x00', 0x0, 0x0)
mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x2000003, 0x6031, 0xffffffffffffffff, 0x0)
mremap(&(0x7f0000ceb000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
ioctl$KVM_CAP_DIRTY_LOG_RING(r3, 0x4068aea3, &(0x7f0000000000)={0xc0, 0x0, 0x4000})
munlock(&(0x7f00004bb000/0x3000)=nil, 0x3000)
mlock2(&(0x7f0000f69000/0x1000)=nil, 0x1000, 0x1)
munlockall()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3})
mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x51)
ioctl$FS_IOC_FSSETXATTR(r4, 0x401c5820, &(0x7f0000000080)={0x8})
open(&(0x7f0000000080)='./file1\x00', 0x18f342, 0x1a1)
munlockall()
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x4}, @fda={0x66646185, 0xfffffffffffffffd, 0x2, 0xe}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000080)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0})

2m24.223973985s ago: executing program 1 (id=99):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @broadcast}, 0x10)
sendto$inet(r0, &(0x7f0000000000)="9636312d131e58c453240b43a8b7e17c9ff82e76390349f2e1afa31dfb01b87f4b49b01e344354ce79148dc4bcde32c2dea1a9397f00fd82333334de03f0e2c25a586123df8850e59f529c9c720eab690c49f66c08da3739bfb3c7", 0x5b, 0x0, &(0x7f0000000100)={0x2, 0x4e20}, 0x10)
recvfrom(r0, 0x0, 0x0, 0x40000615, 0x0, 0x0)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002})
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r3 = dup3(r2, r1, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x10, 0x0, &(0x7f0000000180)=[@clear_death={0x400c630f, 0x2}], 0x0, 0x0, 0x0})

2m9.240830095s ago: executing program 32 (id=99):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @broadcast}, 0x10)
sendto$inet(r0, &(0x7f0000000000)="9636312d131e58c453240b43a8b7e17c9ff82e76390349f2e1afa31dfb01b87f4b49b01e344354ce79148dc4bcde32c2dea1a9397f00fd82333334de03f0e2c25a586123df8850e59f529c9c720eab690c49f66c08da3739bfb3c7", 0x5b, 0x0, &(0x7f0000000100)={0x2, 0x4e20}, 0x10)
recvfrom(r0, 0x0, 0x0, 0x40000615, 0x0, 0x0)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002})
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r3 = dup3(r2, r1, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x10, 0x0, &(0x7f0000000180)=[@clear_death={0x400c630f, 0x2}], 0x0, 0x0, 0x0})

2m2.557977484s ago: executing program 0 (id=230):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0)
socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet(0x2, 0x1, 0x0)
getsockopt$inet_udp_int(r1, 0x11, 0xb, &(0x7f0000000080), &(0x7f0000000580)=0x4)
setsockopt$sock_int(r1, 0x1, 0x2, &(0x7f0000000040)=0x7f, 0x4)
r2 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r3 = fsmount(r2, 0x0, 0x0)
fchdir(r3)
mkdir(&(0x7f00000008c0)='./bus\x00', 0x0)
r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108)
getdents64(r4, &(0x7f00000000c0)=""/55, 0x37)
rename(&(0x7f0000000180)='./bus\x00', &(0x7f00000001c0)='./file0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0)
lseek(r5, 0x3, 0x1)
getdents64(r5, 0x0, 0x22)
listen(r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0)
r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$uinput_user_dev(r6, &(0x7f0000000100)={'syz1\x00', {0x7, 0x6, 0x7, 0x401}, 0x17, [0xb, 0x3f, 0x9, 0xfffff8c7, 0xffff0001, 0x6, 0xfffffff9, 0x1ff, 0x2, 0x2, 0x6864741f, 0x7, 0x80000000, 0x10, 0x8001, 0x4de, 0xffffffff, 0x10, 0x59f, 0x7, 0x3ff, 0x5, 0x1c000000, 0xc, 0x3, 0x9c, 0x4, 0x9, 0x2, 0x6, 0x4, 0x5, 0x8, 0x65bd, 0xe, 0xf39, 0x6, 0x60, 0x0, 0x8000, 0x3, 0xdb, 0x4, 0x9, 0x2, 0x5, 0x3, 0x613, 0xff, 0x0, 0x3, 0xe5, 0x9, 0x7, 0x4aef, 0x8, 0x7f, 0x9, 0x3ff, 0x8, 0x5, 0x7ff, 0x7, 0x7], [0x6, 0x401, 0x3, 0x1000, 0x101, 0x6, 0x3, 0x6b, 0x4, 0x5, 0x8000, 0x8, 0x8, 0x7, 0x6, 0xf31f, 0x3, 0x7, 0x1, 0x3, 0x4, 0x3ff, 0x7, 0x5, 0x3, 0x0, 0x8, 0xb3cc, 0x1, 0x5, 0x64fa, 0x4, 0x8, 0xdbce, 0x53, 0x4, 0x1, 0x6, 0xfffffb47, 0x80000000, 0x2, 0x2, 0x9, 0x583a0814, 0x8, 0x0, 0xfc, 0x7, 0x0, 0x80000000, 0x9, 0x5, 0x9, 0x7ff, 0xffffffff, 0x7, 0x80000001, 0x8000, 0x1, 0xfff, 0x48, 0x800, 0x9, 0x5], [0x7, 0x7fff, 0x0, 0xfffffffa, 0x6, 0xfffffffd, 0x0, 0x5, 0x3, 0x9, 0x1000, 0x2, 0x76, 0xaf, 0x8, 0x4, 0xc51, 0xec4, 0xfffeffff, 0x2, 0x0, 0x7fffffff, 0x2, 0x8, 0x7e073c81, 0x4, 0x1e, 0x3, 0x4, 0x9, 0x7, 0x53, 0x4, 0x2f, 0x9, 0x40, 0x0, 0x7, 0x8001, 0x0, 0xffff, 0x400, 0x3, 0x7342, 0x5bb, 0x6, 0x3, 0x0, 0xb, 0x1c8, 0x7ff, 0xfff, 0x3, 0xfffffffa, 0x1, 0xf, 0x3, 0xfffffffc, 0x48, 0x7, 0x5, 0x7f, 0x1ff, 0x7], [0x4, 0xe, 0x9, 0x7, 0xa, 0x0, 0xdc75, 0x2, 0x101, 0x0, 0x7, 0x3, 0x0, 0x1, 0xf, 0x7, 0x0, 0x5, 0x3, 0x241, 0xc, 0x21, 0x7, 0x9, 0x6, 0xe, 0x4, 0x2, 0x8447, 0xffff, 0x3ff, 0x8, 0xd46b, 0x9, 0xfffffff8, 0x3, 0x80, 0x4, 0x7, 0x8aec, 0x7fff, 0x0, 0x8, 0xffff, 0x7, 0xfffffff7, 0xad, 0x3, 0x6, 0x9, 0x7, 0x69, 0xbb, 0xfffffffc, 0x0, 0x7, 0xe64b, 0x6, 0x8000, 0x6, 0x9f2f, 0x49, 0xffff0000, 0x3]}, 0x45c)
openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) (async)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
socket$inet(0x2, 0x1, 0x0) (async)
getsockopt$inet_udp_int(r1, 0x11, 0xb, &(0x7f0000000080), &(0x7f0000000580)=0x4) (async)
setsockopt$sock_int(r1, 0x1, 0x2, &(0x7f0000000040)=0x7f, 0x4) (async)
fsopen(&(0x7f0000000240)='ramfs\x00', 0x1) (async)
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) (async)
fsmount(r2, 0x0, 0x0) (async)
fchdir(r3) (async)
mkdir(&(0x7f00000008c0)='./bus\x00', 0x0) (async)
openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) (async)
getdents64(r4, &(0x7f00000000c0)=""/55, 0x37) (async)
rename(&(0x7f0000000180)='./bus\x00', &(0x7f00000001c0)='./file0\x00') (async)
openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) (async)
lseek(r5, 0x3, 0x1) (async)
getdents64(r5, 0x0, 0x22) (async)
listen(r1, 0x0) (async)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) (async)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
write$uinput_user_dev(r6, &(0x7f0000000100)={'syz1\x00', {0x7, 0x6, 0x7, 0x401}, 0x17, [0xb, 0x3f, 0x9, 0xfffff8c7, 0xffff0001, 0x6, 0xfffffff9, 0x1ff, 0x2, 0x2, 0x6864741f, 0x7, 0x80000000, 0x10, 0x8001, 0x4de, 0xffffffff, 0x10, 0x59f, 0x7, 0x3ff, 0x5, 0x1c000000, 0xc, 0x3, 0x9c, 0x4, 0x9, 0x2, 0x6, 0x4, 0x5, 0x8, 0x65bd, 0xe, 0xf39, 0x6, 0x60, 0x0, 0x8000, 0x3, 0xdb, 0x4, 0x9, 0x2, 0x5, 0x3, 0x613, 0xff, 0x0, 0x3, 0xe5, 0x9, 0x7, 0x4aef, 0x8, 0x7f, 0x9, 0x3ff, 0x8, 0x5, 0x7ff, 0x7, 0x7], [0x6, 0x401, 0x3, 0x1000, 0x101, 0x6, 0x3, 0x6b, 0x4, 0x5, 0x8000, 0x8, 0x8, 0x7, 0x6, 0xf31f, 0x3, 0x7, 0x1, 0x3, 0x4, 0x3ff, 0x7, 0x5, 0x3, 0x0, 0x8, 0xb3cc, 0x1, 0x5, 0x64fa, 0x4, 0x8, 0xdbce, 0x53, 0x4, 0x1, 0x6, 0xfffffb47, 0x80000000, 0x2, 0x2, 0x9, 0x583a0814, 0x8, 0x0, 0xfc, 0x7, 0x0, 0x80000000, 0x9, 0x5, 0x9, 0x7ff, 0xffffffff, 0x7, 0x80000001, 0x8000, 0x1, 0xfff, 0x48, 0x800, 0x9, 0x5], [0x7, 0x7fff, 0x0, 0xfffffffa, 0x6, 0xfffffffd, 0x0, 0x5, 0x3, 0x9, 0x1000, 0x2, 0x76, 0xaf, 0x8, 0x4, 0xc51, 0xec4, 0xfffeffff, 0x2, 0x0, 0x7fffffff, 0x2, 0x8, 0x7e073c81, 0x4, 0x1e, 0x3, 0x4, 0x9, 0x7, 0x53, 0x4, 0x2f, 0x9, 0x40, 0x0, 0x7, 0x8001, 0x0, 0xffff, 0x400, 0x3, 0x7342, 0x5bb, 0x6, 0x3, 0x0, 0xb, 0x1c8, 0x7ff, 0xfff, 0x3, 0xfffffffa, 0x1, 0xf, 0x3, 0xfffffffc, 0x48, 0x7, 0x5, 0x7f, 0x1ff, 0x7], [0x4, 0xe, 0x9, 0x7, 0xa, 0x0, 0xdc75, 0x2, 0x101, 0x0, 0x7, 0x3, 0x0, 0x1, 0xf, 0x7, 0x0, 0x5, 0x3, 0x241, 0xc, 0x21, 0x7, 0x9, 0x6, 0xe, 0x4, 0x2, 0x8447, 0xffff, 0x3ff, 0x8, 0xd46b, 0x9, 0xfffffff8, 0x3, 0x80, 0x4, 0x7, 0x8aec, 0x7fff, 0x0, 0x8, 0xffff, 0x7, 0xfffffff7, 0xad, 0x3, 0x6, 0x9, 0x7, 0x69, 0xbb, 0xfffffffc, 0x0, 0x7, 0xe64b, 0x6, 0x8000, 0x6, 0x9f2f, 0x49, 0xffff0000, 0x3]}, 0x45c) (async)

2m2.544788045s ago: executing program 0 (id=231):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x20002, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x11, r0, 0x45809000) (async)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00')
setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) (async, rerun: 64)
prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) (rerun: 64)
getdents64(r1, 0x0, 0x0)
r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x1cbd81, 0x0)
ioctl$BLKRRPART(r2, 0x125f, 0x0) (async)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)

2m1.686021095s ago: executing program 0 (id=234):
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r0=>0xffffffffffffffff})
fstat(r0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
setreuid(0x0, r1)
mount$binderfs(0x0, &(0x7f0000000040)='./binderfs\x00', &(0x7f0000000140), 0x4800, &(0x7f0000000080)={[], [{@uid_eq={'uid', 0x3d, r1}}]})

2m1.680402616s ago: executing program 0 (id=235):
r0 = getpgrp(0x0)
syz_pidfd_open(r0, 0x0)
r1 = fsopen(&(0x7f0000000000)='debugfs\x00', 0x0)
r2 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x7d, 0x9, 0x0, 0x7f}, 0x10)
sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="160000001600010a87"], 0x20}}, 0x40816)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0)
r3 = fsmount(r1, 0x0, 0x87)
fchdir(r3)
r4 = syz_open_procfs$namespace(r0, &(0x7f0000000040)='ns/cgroup\x00')
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
r7 = eventfd2(0x6, 0x80800)
r8 = gettid()
sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f0000001bc0)=ANY=[@ANYBLOB="3416000014080101261affc201dbdf2500004000238002000a800400a300080013006446045c001f2b066ce8512cdfdffe78b60e68b3093a981567feae44cd5175580400dd8004004d8008008f73f1893595e6982a4738a3f474994bdfc8a008889b2e272e2c2dd79e25bb4481aca8ec085b67281af89efda9feac39a84ddc6cbed3f9e60a38889b4fba5605f2977ac42ef4a627f500"/162, @ANYRES32=r8, @ANYBLOB="0c00ae000a000000000000000400438014004900000000000000000000000000000000018300a70054489f1a263bd920f918d061fd1465a98412168f07406ececeee75e31d91e247fc290248bb315033f09bf5753cde8296cb48ff816dbc5dbc702d33cdd62eae097deb7c87658bde749951cee46cb7567896f686364cd1031fc7affaad060ef84c740dacce9bef754495abf20350ca2a0ece3c9df24810096bc2186f2023b507000800a300ac141434960197800400c7800ac6f6f5ca74c8fa8190cd6ebcab7b388beb6eb70fc9fb3a97487999d8facad8f797ed4bf85177451fea05c12a2402c2e678354b8ab66bb0764f19caaf9073f2361a58475e9b0c30d61ba5cd7e4f73c91bcbfbe043201e7948b7e37328506901287d7333cc1ea7bf029ac1c008ca3aef0c70e2d7fdd475fd413722b5a2eb76001e62ba25b529b1bb577c47c2c351167881ff88626536969e291c06ed0ce4a21c382ce14e49c0ceb8263f1dd0c52e90110e5e1a68410800060000000000992422f250400422cb9c0e303ad88fcd442191d0accee1560b1f996775413bd3b88ac66190cfbcec2ca81470706e8fd85af043916127c9fbb43f84e00499710c084b752251a3cde1eecf32b13576054ff9e5174dc771e05bf8f7b84eac10f95d2ed15fa74956a99d3735c720f9c2cbede44795576114442de667dbd41763d1e43dcb4843cd81ffdd7b3860e4f77fe6a4e4ef1dcadc6f150ec1e500c3e39cba04e14e581eae7ee8cc2068cacd51c215855ae66800a9bfb2cebe308c9724639cec1be8c13cfb13076a00eaf672fec8e2bb0800007bfa0ac363a18f5a706e93286dd061a2925fe8df62183ecadefef10f22c4c3ec54167b73202bbc83e49a6e39ff65a6180db0c87dca7455e3eb367a5faa1fa5fb82d7103a007e4e41d901ae2d3acda3e560bec33843693afae19ea158e4ff8c0766f5c6242bf3635911217602c337d054124540a7f8c0b9b7fc96d031b8fa407f7113f8980aee830fe0e00080012b800c006600fbffffffffffffff436a49b74e1cbdcc13057f46a5ffbd83de3609a4722d2b58c0796735b25ed97658a7a1f9309d0f8ddfd6524d5be731187957e0640db3c21ec90734705fa89224ab819946f47b164e8f13123b35fe48a15bb373166b4ec89bf62648196eaf3958e73f1c9096f2795aaaf443c1a7d7c9e0c47296109ba19c804a516283a022210904cd0a62f1f9c198625257b395d5cda7fae5b8d0f3241ad0c9c80845c48d37a6f964b779e70c84dc9220012d41ee8b32e3f639db0f881763b319e40256142f698af3acff724d408bf3d2d48212e0ea89e42d8ff961df1b7fd4d308000900070000000400f1001707e90d526a17fc39e11bde82747eed711da3ba7fa33f1f883c2e20563d1f0ecabcc7506150c024d8d62463a15e10724c4dff254a56b4a098b27e4a20863c0423ad023087c1168e152c2ead85e9b7ec7c06b709a768d9680122c9937a1f7450dd8479ccc9a0392fab77504647829b0b3737388ca86df50101905ad51515aed6911ac58648c99192ffda49eba0cbe0bcd28c3bee891d25344e6d8b4ba6bd8ee4f5f8c03af40e1042c891ea00cd00ada7beffc8af2198ffd79ce465ced149fca0761ea7ab712baac39bf8471b94de0d687b02cfc3363994a16f45f4aece64ce2353668f5e07f7282f9d51a9d820cefc30367e0b8ce6e4b7f01f795898781c74539f6426edbbfbd4a72981ce8042e3eff10b6fe1386d2344783aa3186581fdcca11942e3c00d82329b7dc7068a767e4df721f2dcd317a4a87c3bd00e052b57334e975aa8bff2127e8ca030b15c5752e43983401254186b91fdd55e914c11b290b61ddf95a67f9ebaf5dd42fcaa00a9dda1d9a2a807c0ead1bd9611afe5500fef329fa0e7b4ec67fc31794cdeff9fa9f59fb29d86bc65ca400cf17dc57762551980b604d7ad38468aa38993471942570b640f039005378be1ff9a3a25e8edc34e95bb287b42f41b5e8c3c97b10e6e3787b94947f175fc261e98693c9ee2db73ddf4c885ce9be6f822dbca7b765eb3dc2459b379d7c0f138e2153610c6c860e8af651810c377d7f24cbb4723aaff6a8d7a73af051fafee8c2cd7e2b0ac6ee29e0be12e79f917164cbdb6f94f0ae2f93013a3c2db8c570679e191f29b703a6c588e33c50730b3140d70d257d522ff3c17774b640b430e077d298676ad821b73538bc55461c387d205ddaea190dd348c313bcde53d35d2c68d6977bc2ea34d6b2582b3c63c44071733361ebdbb5c0599f1a7a1b1e9c06df1f08ba934aad3a0162dbe21cd60226f73514747c3fa242e50ca573c494a7ef62289240e1c565de753710382b4554a12a142c3193827e392ddefc4deef903e91f0caac7952c3df7a9f003662213ca58745a86f0a39351d5ab567aecc7de6aa02ea54846d81880a5a53ac9d5f4ec2891a888322e3e236be6e865fb05e87b0109b13bc571b8c901f4b76883526e4dbafe24ae6d3476cc0bd14eae56dcf17680d9a865b416b855d1e2e355fc071abb903bcf55722bab1c097a070ea641a19aabe21d38d66094b734a769fa03e65075fe0ea38894baac85a9d7427e234c43378a63bc1761d42309e5c7f4ece14fbda6870d14f8d94f4ed3b7c9a6f5d0255cb6a11f95dc0af71efccc0875ccc3f3ffb5aa9b2806f7d2bd9e5062af3fa674261e0b43adb044f1da5544736e0e180741bdff1fe95dd7f025019005e903013dc255d5d0afc7200592ae70c34a2cd21647fd6452af9edfb26c530c37e23949fe9ffa8f80b5286b46087ffac7fafcee865d05494e34974f70d01c8a14cb15f10ac62dec7c1a56a83bd1d081fab31d5f46c8703f204b6724893b23e9e8e83fd427e6dd651ab08697f3d840aa39887c7d93655e604f493a8360be7fbbbd20b59b973ea837af5f4d86d58ca7888f78920507d2bdd2196132049ad2df573b4041a14ee6a260ece7764602e5a75c87f1232c4623d2c8fbc887f2c16923a8155af6172d7d666bf774b311f868f5e76e8f3fd90c75dfb1d2506ce93074712ccfd9fd318a44a3e68b12faaf5f3d95c01797e7fc0bca32467873fb8b3f0ad8389d3681bae65b251b1b78cfe543c30f4676b8313e4da186a64743d3390be1486eda6254a6ed34e3f44361a849630d099d1d9ace2b66d4a21186c5d99ce775aac2dfc49070a32af4f4bb66d6e8214635faff4beb4e2c502acf068046883bbe4019bfd9bf6b4e4fcc694e3cf63ec9a5792b93e8eba6063ba135d97547773b972a16458003594561cffe8ee491716b893f1550f7ea8b80736749d037816bb508f88e60f573a7fd72d3c7835536a3bd63d4c41e93d3940f9ca1a0859b44aabccef1889b2648002dbca4bc71618c9ebb174b168b6b570d31d91da22b4ce6debd04727ffe6d35818a9721c1cf0b36cd7de7b91896b9dde391f042a29a13a7b55be4d76d1285cb243f334496029fd5dfbe38f0a02d7a27d1688cd2223014421f24277ac8ed6c98568af442a63c134eda4808ad50e497365896a2df7f1c5a698af6f15d6c4c4d41424174efe5cf371acb674cca2e30ddeca7b2611a14ee093ec70d32e64bd4025d29108225fb7eddb04c1aea3f1353dcabd5a33bb42f08dd0ca89b1cb1a11ddd32ea35f0cb31faf1e08d7fbb81f211427e89b65abb1e3326341251880353e076e8f551ae5fe36436efbd4d958ae3417e44ca606db20402ea89bfeee15dcdbc5e77fb8aecf1bc611c334882fd792b0117a3db657c1cf3f5abe4fd5d2ad2f8373106ee3bea00bcf168c3cc6b549cf1f880724d5448793b33010fc1a04d4ee468d85b2cca34613f9a0059aaaaf3415f6e35b2015801fc406e8a92a748e1e1160b2391454ecef8d996e3264a782a0ed9582d3594dc6aa624f6a90c8f5ec9256d2ad1d8b09d3a996a8216f9c8b88cc1650424394d0c83cb5869bac249d64f855754b288c2f2d77c258dadfe829a0c795d0415309aca97286d4f5206bc3d63490975a873990a872ff780b1167fa594b9df4bec0899ced81241f7c49ec8032a7e51c6a1b311a4ab4f66750a0e5558978302afdbc515457c7d6663aabf2b7b9daf3accf0d9830a3cd6f040f9194365680ce1b697f47e372c22db21a8837edfad13bebb1460e94d357aabd8872d50769c4033e021bc9751a333d0f472d488c563e2fde76c286fb0380ffc8069b4cd3585115d883c7c6ab96be4e6daeebb06799c7bdc75a645efce0cbe6da1fb294dce83f86c715230c32e5c7114268dc1d34efa99fd468daec03bfe2c75202d768a6707e1bc1708b56ab0efed237e29dc45bd8ff9d3facf5878804129ddf83f9a7082d6efb2d18c83f14fd509bc49dfbd22aa04d566b99c7bcb9f1d3d54809e2c5ec4dab42da0ac010a3bea064c41fa3c1d710301062c8d2e5a0eaecdd189029ff604cd48af2fa3496572ceb03d7fb3d11b984ed36704fcf4d5976b77ec3413f6da05aaa1031768d68ccebe5bdfdd5da1a46027092abee9822a7ef26e1ddd1236032a51af2501299e1733f843add20ca97ee879e020aad9171e35b1869807d420222e5057247c3c2688dd623c02d70a19a3ae8342ddbbf027f747ab2856030e273e03e2c78ce41981bb5beaf0b41996e87678918c2fad88406cbd2f19628cfa4a2d37ebec827dc8caf308a5296f863fff16d7a5fc4a9472258faf121f8733c7d47748feef5819bcc0a07a7c9188588ae6d35263ecfae672d1c2c038bea09f601a354ca8ee2d83ff3148363532340d8d1d8b17ea37ef0f896c9e44c54488634bc2f4aa3278052a65da2addda07279c4b5c66358a24ad61b8664c4cfef44ddb6e366b28119be77c4597cf7cbfd8b73e3ad0243d4eb426ab8af1d113feb5ec90f3cd574919f64506b7734102814455e26bda493da8a365d6b44b42c2836ec8a7d06202066b8c9ffc6ffe6c8ab317fa42c6ffabbfcd9b142555cf30b5a4627d0bf05d8f0bbb64f965a07e6f237a8659fe968cf6eb27a172915502dee0c686c94b46f76f02b8c57c516a1fa21fe1000de551731f811ad9d3ee96288b2b0891b9c93afd249bf903747700dcdefb93f8ea65fede4e03c4db650e6f9c9ead38ea338371d8a5675ad06e5d1735f01f315cd52e5143692fd69634ab22cf6d4652ba526174177482f9a65ee7c4f41d8e31f8b2a23f917084941672d482de5a7bf7a7ff6736cbef4d253cf639e5a9b62156ab3e1d9890d07ffd785583e81126dcba1459456a9994fee17c54c2bc953dcb1a3af7d6dd013e6a4a2012c2250171ffd062cd687251ef067657d3092029ce0182b0de7c88fc0a40e9c2919cf14585d7f29f4c1e3991054650d0a27cfbd28def01843fcabda4bda604d623e2f7daed518188536c3499b7588a5ca2ac3f7c36c7347458d5e4b5dfe8f2d9704578785553968917e21573917fe84f5610152f05fd671b78c3e2de9ba7eec6bf64af08248a13ea0bf89d3ce230db51bf8e901af8799dfd03ca7bf84146e38a7de6ad83f31f3893d9cf787e7b451c6913fd7615c8026fc23092509aef2a8f443ad11d44a32f9db93c8a86b6da6f63fc202f952358d70d8ff08a5e0a1e532a2023690bb869fedff74aae37dddd895e1afc54b530476c1eee21d652f5a18f36c08bee2f4aea030f92ae4399c1bb60d24f4a78ac5fef5c0707ff18c4e897792b23c98b7f7c76ccf5d09c4cb2e4141becd14ed724c0b245a0b9dd86ee5dce43fa777c3d7edce67c94ee15239814edd7ac49dceb5648ed6e95e76abf467dd75ffbf02356e7724eca25fd2c3947e6cc4b6582d5e043d4f3187b80cbdee1b1236f1afc64abdf45d4ba5fd427791161ea571ce83c6fe31e2baf006de89275841809d25de314816f0bbf0067384ab1dafafa1c6fdbd8064f93e42f36892b42980f961ef057aa25f140d0a4298b7b9f8526d83df3bb3bbdec403728882f3b58c4ca9f3ac8fa8fcc33d091c141137252f3717923988d3aaf0bd7ab4bb5259be1910db42f92c62f141276aa26614f95edd788ab2595b840d24cd92c0bc244edd51a464f874513dd5706dbe6f3f67f25d4b425ccb6215daf35259dcd7823ee34dd93540194325536f85bad6c69f9ff4810835cbfc05f4a38d2ac97f0b79cc4e234c67f27f7bf1c01fcd838bdc1635fdd1125844db7df094380a573d18b0479a5354227b60df71fd725c9bcf5a7c79ef57fe6f7843fcd69608e5d34e63e9faee51ddf17ef2d30cb243ac06fbd2763ca2d3c2ceca25674fa2280c8263023694d2d0081b3edd39cb544406ba32a6d37289eaee417e7d575006cc93bfea7fc2ced7e5a3b3d059eed686a33e27654212470bc683b0595e0fa478aaab4ad7e8ec50b8f6a944a64f3918f2abea22b003f25849e1a6cd61a1d33903c44ec24e66c5703a030dcf207ef5076c595756c66e5384ccb94af79ba4ba774b900afdde976f480cd3ff3075fecd99a69679f247db4b2d21602bb1cb21c90970a773fb7bc5a8bd0523dc21293804c4d7983bcafa79355d06eb3e03741774237c861dc243fc5c07c24b5b89ebf71715a78bff77279a217513c89496e14875cde4497e81f5daf854e8d534e2af20bbbfad84d64d9c9d453c346f9fba6b4390a2c116d182f05a49213009b038cd8a289dbe194cf825c3d5f928503ccdd2970a97cf92943741eab29160a4fd25322e43a20dfb2ade65e8c13960ee0348249edcb5d4b786f8186c209b6e6408044e7e3d41ed8e9a663ade5b71fcd5a658e66c4cf79856a42864a46c850c73629f2f50a64edc63d85bcd91ff7d2932557a53ffbaa9c24b1d5bc84ef047395905f4eb473363730ecd141af2a8a76d3c0b16c2ae86a0439653f3a7032da4eb3b7006f3c44e2bfab2cede9ee2daa21ce39b66d3839489d1fb65cd8ab69e833b578fa3fbe969b1f9ecf3dc3283634f640d8eb7544d0cf209fae5db4eaad905c3ecfdd4af256dc83c6a035548957aedd6f10b00dfb5145e4dd84e56581669946080d69239e73550c18e9a5d5f079047f34361f5144a7abdd5c9718911d60b6f4c7c73b82db109070a2b2d6492bd64a2e95e1375682e04daaaf3ce78424ee3af8a3ddf823af8ab8ff880be82cb8ea8c26e3132d32ab6cee069f911fe6970722d4105f1e4351f37a13b9f10d6ce3816f56ffbb4e01c86a0ad1b6f22c3da9060d662cce526d442d6414d0173839ddb95fc0dbd0a5f53fbecac0d1e59a5fc0742609e1780b165fcc6784b2db804f7995b77869208d2a7c7fe52f048751d44635214a529b3bbe5c88b00e329512b3bde3a6a3d854f2a47b660b54104ead173a2cc6f22633e03b622e7b28983ec2db799d7fa65ee9ec9f6782ede6fb0667e1bf1527f10b2123538e479ecf689a348cf8e73707f9e844ba9ad0ab1d6de51de59bb0e52934ecd4dec2c602149d5409924334b1e37e1125400a37fee5189ad223e8a114c781d41c39624eeb25e80406b15878b171f2af74bc6ca9a6ca5ca03afdc14b0d9cc1e6a005d53538df9b6f237c13e6a9a7e7ed2c37c40b70633d0d651c181c976996d20e70f6028aea8454d88ab9cc9c0c466140ac4b0f7aaf9d3f98befbe77046116c258de903cda3aa885938357783e36447066ee006a80e83137224e15dab5c8a443ae44e17c46fba406bb9f724d4b01851a7a2c2574c4427a3b727b1ad3c40f1804c31b4a3aab2d7901b13dc22a49dd769430e43ec236d6f4928d44a329913e8e0460f5946f62ab19e5b9cc6e4be75b572dfe6d12aec70f427f34135f039ec9ba8462bd0b73602105229af91f691b2eb08e43fd380f0b35b5c17a6e6cbc5854def5b8b877e83d841e2078ab833b8bacd699817f1ceb98f5bc3132fb1a5bfb402762b66c5ca31d2e137f4bd71029566b40030ecdaeb717f23700758548c1326034680f2624b3d4ace38915133bd2a177be90d78e4c54fea4e94f027040ef2bb755000000"], 0x1634}, 0x1, 0x0, 0x0, 0x48105}, 0x2000000)
ioctl$KVM_HYPERV_EVENTFD(r6, 0x4018aebd, &(0x7f0000000040)={0x3, r7})
r9 = eventfd(0xfffffc71)
ioctl$KVM_HYPERV_EVENTFD(r6, 0x4018aebd, &(0x7f0000000000)={0x3, r9})
setns(r4, 0x40000000)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
move_mount(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x141)
r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r10, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x38a, 0x3})
sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, 0x0, 0x800)
r11 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$RTC_WKALM_SET(r11, 0x40187013, &(0x7f0000000040)={0x1, 0x0, {0x0, 0xfffffffb, 0xffffffff, 0x12, 0x5, 0xfffffffc}})
mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r10, 0x0)
ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x200, 0x0, 0x0, 0x0, 0x4}, @fda={0x66646185, 0x0, 0x0, 0x14}, @flat=@binder={0x73622a85, 0x134efe4ac76e8b6f, 0x3}}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0})

2m1.599793502s ago: executing program 0 (id=238):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
mount$binderfs(0x0, &(0x7f0000000300)='./binderfs\x00', 0x0, 0x100000, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x14)
sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x20, 0x18, 0x1, 0x0, 0x10, {0xa}, [@typed={0x8, 0x0, 0x0, 0x0, @ipv4=@local}, @nested={0x4, 0x16}]}, 0x20}, 0x1, 0x0, 0x0, 0x14}, 0x0)
r3 = getpgrp(r1)
ptrace$setregset(0x4205, r3, 0x203, &(0x7f0000000000)={&(0x7f0000000200)="a063a5635aedb2c6f6be571ddd68662e48c8ad6d3ea36dfbde7461a91b3121ec2d7caf51d2e11e6e80f8a38678c0053adfb83c87bbf6525a9b32ea636e536e588f0b1f16e3c5ae5c952aa365418804be9d24d68f37b26188f10785bbe355ecdc2c265a18404a54df1c1c9679145ee807313926a489e6e85de01a8efc22eacf83d91a8cb7ae6f7450d8ef9975f602d2f1436ad7b33c17ea9c533d2d3e9b8d591337d3ce2bbe743f5178a1", 0xaa})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000180)="19cd39079813b029bd090ba2746300134848c60dfe02f43519e8af3b701bcbc9779fc33d57baab260f68850e7f88f6a40a12070f0b435299d80c7379fbda0ea0b2e006e584cc562038ed2cfa002ae700"})

2m1.407648387s ago: executing program 0 (id=246):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0)
r2 = creat(&(0x7f0000000140)='./file0\x00', 0x0)
pipe2$9p(&(0x7f0000000240)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
write$P9_RVERSION(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="1500000067ffff001000000800395032303030"], 0x15)
r5 = dup(r2)
write$FUSE_BMAP(r5, &(0x7f0000000100)={0x18}, 0x18)
write$FUSE_INIT(r5, &(0x7f0000001740)={0x50, 0x0, 0x0, {0x7, 0x21, 0x0, 0x0, 0x6f, 0x0, 0x0, 0x804, 0x0, 0x0, 0x8}}, 0x50)
mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000069c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=r5])
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x2, &(0x7f0000000000)=[{0x20, 0x6}, {0x6}]})
mount(0x0, 0x0, 0x0, 0x0, 0x0)
mount$tmpfs(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x820061, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f})
r6 = mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
r7 = userfaultfd(0x1)
ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000000080))
ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x11c, &(0x7f0000000040)=0x6, 0x0, 0x4)
ioctl$UFFDIO_COPY(r7, 0xc028aa03, &(0x7f0000000400)={&(0x7f000092b000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x1000})
ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000280)={'veth1_to_bridge\x00', 0x400})
write$cgroup_subtree(r5, &(0x7f0000000200)={[{0x2d, 'devices'}, {0x2d, 'rlimit'}, {0x2d, 'devices'}, {0x2b, 'cpu'}]}, 0x1f)
r8 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r8}, &(0x7f0000bbdffc)=<r9=>0x0)
timer_settime(r9, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0)
r10 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x20080)
ioctl$MON_IOCX_MFETCH(r10, 0xc0109207, &(0x7f00000001c0)={0x0, 0x0, 0xfffffff4})
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x7ffff000)
ioctl$TUNSETSNDBUF(r1, 0x400454d4, &(0x7f0000000040)=0x7)
ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0)

1m46.26818652s ago: executing program 33 (id=246):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0)
r2 = creat(&(0x7f0000000140)='./file0\x00', 0x0)
pipe2$9p(&(0x7f0000000240)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
write$P9_RVERSION(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="1500000067ffff001000000800395032303030"], 0x15)
r5 = dup(r2)
write$FUSE_BMAP(r5, &(0x7f0000000100)={0x18}, 0x18)
write$FUSE_INIT(r5, &(0x7f0000001740)={0x50, 0x0, 0x0, {0x7, 0x21, 0x0, 0x0, 0x6f, 0x0, 0x0, 0x804, 0x0, 0x0, 0x8}}, 0x50)
mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000069c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=r5])
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x2, &(0x7f0000000000)=[{0x20, 0x6}, {0x6}]})
mount(0x0, 0x0, 0x0, 0x0, 0x0)
mount$tmpfs(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x820061, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f})
r6 = mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
r7 = userfaultfd(0x1)
ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000000080))
ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x11c, &(0x7f0000000040)=0x6, 0x0, 0x4)
ioctl$UFFDIO_COPY(r7, 0xc028aa03, &(0x7f0000000400)={&(0x7f000092b000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x1000})
ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000280)={'veth1_to_bridge\x00', 0x400})
write$cgroup_subtree(r5, &(0x7f0000000200)={[{0x2d, 'devices'}, {0x2d, 'rlimit'}, {0x2d, 'devices'}, {0x2b, 'cpu'}]}, 0x1f)
r8 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r8}, &(0x7f0000bbdffc)=<r9=>0x0)
timer_settime(r9, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0)
r10 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x20080)
ioctl$MON_IOCX_MFETCH(r10, 0xc0109207, &(0x7f00000001c0)={0x0, 0x0, 0xfffffff4})
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x7ffff000)
ioctl$TUNSETSNDBUF(r1, 0x400454d4, &(0x7f0000000040)=0x7)
ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0)

1m36.295942245s ago: executing program 5 (id=428):
setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) (async)
sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x4, 0x0, 0x0) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') (async)
mount$binderfs(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='max=0']) (async)
mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='devpts\x00', 0x0, &(0x7f0000000100)) (async)
r1 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000000140)=ANY=[], 0x8) (async)
bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) (async)
setsockopt$inet6_IPV6_DSTOPTS(r1, 0x29, 0x3b, &(0x7f0000000080)=ANY=[], 0x8) (async)
setsockopt$inet6_int(r1, 0x29, 0x38, &(0x7f0000000040)=0xa, 0x4) (async)
sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c)
recvmmsg(r1, &(0x7f0000002a40)=[{{0x0, 0x0, 0x0}, 0x10}], 0x1, 0x0, 0x0) (async)
read$FUSE(r0, &(0x7f0000000980)={0x2020}, 0x2020)

1m36.295801425s ago: executing program 5 (id=429):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x60a00, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x57789000)
setsockopt$MRT_ASSERT(0xffffffffffffffff, 0x0, 0xcf, 0x0, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1)
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'vcan0\x00'})
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000003300)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4d000)
r1 = socket(0x1e, 0x1, 0x0)
cachestat(r0, &(0x7f0000000080)={0xba, 0x8001}, &(0x7f00000000c0), 0x0)
connect$tipc(r1, &(0x7f0000000000)=@id={0x1e, 0x3, 0x3, {0x4e24, 0x4}}, 0xfffffffffffffed3)
write$binfmt_misc(r1, &(0x7f0000000340), 0x2000011a)
sched_setscheduler(0x0, 0x5, &(0x7f0000001580)=0xfffffff7)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)

1m36.211503632s ago: executing program 5 (id=430):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) (async)
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
pipe2(&(0x7f0000000040)={<r2=>0xffffffffffffffff}, 0x4080)
ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000100)={{}, 'syz1\x00', 0x10})
bind$bt_l2cap(0xffffffffffffffff, 0x0, 0x0)
ioctl$UI_DEV_CREATE(r1, 0x5501) (async, rerun: 64)
keyctl$invalidate(0x15, 0x0) (async, rerun: 64)
syz_open_dev$evdev(&(0x7f0000000340), 0xb, 0x0) (async)
read$FUSE(0xffffffffffffffff, 0x0, 0x0) (async)
close_range(r0, 0xffffffffffffffff, 0x0)

1m36.192885303s ago: executing program 5 (id=431):
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x240, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0xf)
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x3, &(0x7f0000000000)=[{0x200000000006, 0x7e, 0x5, 0x7ffc0002}, {0x1, 0x4, 0x2}, {0x6, 0x3, 0x0, 0x800}]})
ioctl$TCFLSH(r0, 0x400455c8, 0x4) (async)
socket$inet_tcp(0x2, 0x1, 0x0) (async)
syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) (async)
socket(0x2, 0x80805, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async)
r1 = open(&(0x7f0000000100)='./file0\x00', 0x80ff, 0x36)
epoll_wait(r1, &(0x7f0000000140)=[{}], 0x1, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) (async)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) (async)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
read$msr(0xffffffffffffffff, 0x0, 0x0) (async)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f000801}, 0x0)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000040)=0x33)

1m34.12004082s ago: executing program 5 (id=442):
mount$binderfs(0x0, &(0x7f0000000040)='./binderfs\x00', &(0x7f00000000c0), 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB='max=\x00'])
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x51)
ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000080)={0x8})
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000200)={{{@in6=@private0, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{@in=@initdev}, 0x0, @in6=@dev}}, &(0x7f0000000100)=0xe8)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0, <r2=>0x0}, &(0x7f0000000180)=0xc)
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000440), 0x400000, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDELPRL(r3, 0x89f6, &(0x7f00000004c0)={'sit0\x00', &(0x7f0000000480)={@local, 0x1, 0x0, 0x30, 0x0, [{@dev}, {@initdev}, {@loopback}]}})
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x20000, &(0x7f0000000300)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@default_permissions}, {@default_permissions}], [{@smackfsroot={'smackfsroot', 0x3d, '%,=\xd9]%.,}@*&{'}}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x64, 0x30, 0x64, 0x31, 0x61, 0x64, 0x31, 0x31], 0x2d, [0x35, 0x30, 0x75, 0x36], 0x2d, [0x62, 0x63, 0x64, 0x63], 0x2d, [0x31, 0x34, 0x39, 0x61], 0x2d, [0x36, 0x37, 0x34, 0x61, 0x33, 0x65, 0x64, 0x30]}}}, {@fsuuid={'fsuuid', 0x3d, {[0x64, 0x37, 0x61, 0x36, 0x30, 0x30, 0x64, 0x35], 0x2d, [0x1, 0x37, 0x38, 0x62], 0x2d, [0x5d, 0x64, 0x66], 0x2d, [0x57, 0x34, 0x61, 0x34], 0x2d, [0x37, 0x0, 0x31, 0x62, 0x0, 0x64, 0x34, 0x62]}}}, {@subj_user={'subj_user', 0x3d, './binderfs\x00'}}]}})

1m34.118208271s ago: executing program 5 (id=443):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000180)='./bus\x00', 0x14d27e, 0x0)
ioctl$EXT4_IOC_GET_ES_CACHE(r1, 0xc020660b, 0x0)
socketpair(0x20, 0x0, 0x7, &(0x7f0000000080))
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x0, 0x80000000403})
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ioprio_get$pid(0x2, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000200)=[@enter_looper], 0x50, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"})
r2 = socket$inet6(0xa, 0x2, 0x3a)
connect$inet6(r2, &(0x7f0000000640)={0xa, 0x4e23, 0x80, @local, 0x9}, 0x1c)
r3 = dup(r2)
bind$inet6(r3, &(0x7f0000000240)={0xa, 0x2, 0x10000, @empty}, 0x1c)
r4 = syz_clone(0x25000200, &(0x7f0000002400), 0x0, 0x0, 0x0, 0x0)
process_vm_writev(r4, &(0x7f00000029c0)=[{&(0x7f0000002640)=""/255, 0xff}], 0x1, &(0x7f0000002bc0)=[{&(0x7f0000002a40)=""/28, 0x1c}, {0x0}], 0x2, 0x0)
r5 = mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xffffffffffffff6d, 0x0, &(0x7f0000000080)=[@increfs_done={0x40106308, 0x2}, @release, @free_buffer={0x40086303, r5}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

1m19.13815135s ago: executing program 34 (id=443):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000180)='./bus\x00', 0x14d27e, 0x0)
ioctl$EXT4_IOC_GET_ES_CACHE(r1, 0xc020660b, 0x0)
socketpair(0x20, 0x0, 0x7, &(0x7f0000000080))
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x0, 0x80000000403})
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ioprio_get$pid(0x2, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000200)=[@enter_looper], 0x50, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"})
r2 = socket$inet6(0xa, 0x2, 0x3a)
connect$inet6(r2, &(0x7f0000000640)={0xa, 0x4e23, 0x80, @local, 0x9}, 0x1c)
r3 = dup(r2)
bind$inet6(r3, &(0x7f0000000240)={0xa, 0x2, 0x10000, @empty}, 0x1c)
r4 = syz_clone(0x25000200, &(0x7f0000002400), 0x0, 0x0, 0x0, 0x0)
process_vm_writev(r4, &(0x7f00000029c0)=[{&(0x7f0000002640)=""/255, 0xff}], 0x1, &(0x7f0000002bc0)=[{&(0x7f0000002a40)=""/28, 0x1c}, {0x0}], 0x2, 0x0)
r5 = mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xffffffffffffff6d, 0x0, &(0x7f0000000080)=[@increfs_done={0x40106308, 0x2}, @release, @free_buffer={0x40086303, r5}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

1m10.899540375s ago: executing program 3 (id=647):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4, 0x20011, r0, 0xd6baf000)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
r2 = openat$binfmt_format(0xffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0)
write$binfmt_format(r2, &(0x7f0000000000)='0\x00', 0x1)
getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, 0x0, &(0x7f0000000980))

1m10.899107665s ago: executing program 3 (id=648):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0)
r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x56a, 0x20, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0xb1, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x101, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0xc}}}}}]}}]}}, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io(r1, &(0x7f0000000340)={0x2c, &(0x7f0000000040)={0x0, 0x7, 0x7, {0x7, 0x0, "00f4000000"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000080)={0x14, &(0x7f0000000100)={0x0, 0x8, 0xc9, {0xc9, 0xf, "678da0c5e9a37f703f5fd82ed0b052e5ee6be2ce7cfca734390ba29f3e9ed01a7f205c45299e8be73d8296ca8189989eef2ecc801619223fa895261b8299c240dcf2ffb6837dee5a8f6ad9c22c6f527e115efb2d36e8bca3221dc675e78b7938ffc517007647a81f7e10d1b086cd84cca4e2d6a0c6e4ae3e0c228b28adc7c675aafee6318594f6024f76b50807aa0ade684371f9493296c90266e62d59fcfe2978d81335640c510539a01b8cf25d0225071a5e605cfdfb54c098ac0e41da14b5d773d7470a1408"}}, &(0x7f0000000000)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1036}}}, &(0x7f0000000580)={0x44, &(0x7f0000000380)={0x20, 0x14, 0xf3, "178a5d1ea11e50c8ffc3b36dcaaa4f551c183a9cf29c002c36b8e290959ac08b8bf82ad7b6329a40200961352147e8f61527e2ca63e7ab06fb42cde93252ad38f66a1d805b44107ed8f5774d1dea34963acee8e5d55320fba4d9c23ec41a2073b8be62a76426f443d5292dad6131d44902c7558ed2eb306e75beaaf74d0ee7f327c8aad87eedffa36cf739b649db733e6b8bf3150fe166a098215abd95deb03f57003241590b80e77b24a99dcb13815da5413d01f0fe1c8f117a76ae91527edb6b93789d17182fd019f5332bd6f48ea8d1a087cf508ba819018b914bb9dbf71d501159f9a70326fd3e9fbbf0948708fc7e240f"}, &(0x7f0000000200)={0x0, 0xa, 0x1, 0x2}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0xc}, &(0x7f0000000300)={0x20, 0x81, 0x3, "109e72"}, &(0x7f0000000480)={0x20, 0x82, 0x1, "dc"}, &(0x7f00000004c0)={0x20, 0x83, 0x1, 'X'}, &(0x7f0000000500)={0x20, 0x84, 0x3, "7a0f6a"}, &(0x7f0000000540)={0x20, 0x85, 0x3, "c4791d"}})
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000140)={'team_slave_0\x00', <r4=>0x0})
sendmsg$nl_route_sched_retired(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=@newchain={0x24, 0x64, 0x1, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0xffe0, 0xffe0}, {0xfff0, 0x6}, {0x4, 0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x8080}, 0x9080)
syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0xa242)
r5 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f0000000640)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x56a, 0x26, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0xa0, 0x3, [{{0x9, 0x4, 0x0, 0x77, 0x1, 0x3, 0x1, 0x0, 0x3, {0x9, 0x21, 0x8, 0x2, 0x1, {0x22, 0x6d3}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x42, 0x9, 0x2}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0x1d, 0x7, 0x4}}]}}}]}}]}}, &(0x7f0000000880)={0xa, &(0x7f0000000680)={0xa, 0x6, 0x200, 0x3, 0x5, 0x10, 0x40, 0x9}, 0x19, &(0x7f00000006c0)={0x5, 0xf, 0x19, 0x1, [@ssp_cap={0x14, 0x10, 0xa, 0x7, 0x2, 0xb, 0x0, 0x3, [0xff00f0, 0xc000]}]}, 0x3, [{0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0x3001}}, {0xe0, &(0x7f0000000740)=@string={0xe0, 0x3, "63288dedf33ef76e3db3a528f089fcaa7e5d2dcdf3ef6d6c6d5301302425d61a7ed3432a8de89e2f6b0a2c1f3a6d6331f87883953efd8a3fcc71b0fabe444e86be148d103ef7bf516cc2fe4cf8dcf548e78e761e6eac5c37f235a60cde5acd5887bd6c03411ae03cf3304b5e7145f287e044991ed6a60f23b0e4b571d8155b41ea7b9c0c8a1468a997c5214d5ce0730101f845e12f90883c63c4343a35803009b4cd0e8ee4dd018c0ed900c514415e1eb091e1a7fa7f511f7a6b540579d9289893380dc37e02f48ce32eb71a2580c3bb620429662f2c11a210a043cf0526"}}, {0x2a, &(0x7f0000000840)=@string={0x2a, 0x3, "ba66c039e677f04f3f6402469dbf17a68e9d8df0a23c46111c8669b4a377c1403ccf8bc3a9014b68"}}]})
syz_usb_control_io$hid(r5, &(0x7f00000009c0)={0x24, &(0x7f00000008c0)={0x20, 0x21, 0x2d, {0x2d, 0x30, "ffe517a47b1ee5fc1d7f98866ef8e54deaff1df36a902c3dd1900f9b6e0bc51cb4c2765fb01c880701cee1"}}, &(0x7f0000000900)={0x0, 0x3, 0x2a, @string={0x2a, 0x3, "fd9912ad1145209eaeb136497ebd9f52e496094d3c1366d9997e178a3209fb6b85fbdd4ddc199e46"}}, &(0x7f0000000940)={0x0, 0x22, 0x2, {[@local=@item_012={0x1, 0x2, 0x9, '1'}]}}, &(0x7f0000000980)={0x0, 0x21, 0x9, {0x9, 0x21, 0x9, 0x7, 0x1, {0x22, 0x11d}}}}, &(0x7f0000000bc0)={0x2c, &(0x7f0000000a00)={0x20, 0x8, 0x76, "af771b02c6d3ec9e84fa2f02d8e4b838ebd63b1b1c8c6ef49a79f5dcb6abf81096ab8df8b2551cdc0e2c73b6222278c4ae7b52d55e3b81219f77e0475844e0ef8b51e4c3d875deecb8e15ffdb8d9cb78a09eb151d1444750a3e6b5779f66a2ad3f703e183ce7fa6a95e5639e29c5dab844132ff6ec53"}, &(0x7f0000000a80)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000ac0)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000b00)={0x20, 0x1, 0x5e, "3d04af17d2a1ee31fd4d214e6ccbcf3d7cf4d8c66b15664d3a6abfc24fc7c41160265cfc0e56a9663dcede745d7eb74d937308cf8db4f24fd349a776d59e3313dca62074fc23e58fdbe04088ab6ae05ac906eb84dd343a1f915b165c201f"}, &(0x7f0000000b80)={0x20, 0x3, 0x1, 0xe1}})
r6 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r6)
ptrace$peekuser(0x3, r6, 0x128)
syz_usb_disconnect(r1)
close_range(r0, 0xffffffffffffffff, 0x0)

1m10.111190219s ago: executing program 3 (id=658):
r0 = socket$packet(0x11, 0x2, 0x300)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_GET(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x14, r4, 0x303, 0x4, 0x25dfdbfd, {0x3d}}, 0x14}, 0x1, 0x0, 0x0, 0x880}, 0x44000080)
sendmsg$netlink(r1, &(0x7f0000008dc0)={0x0, 0x0, &(0x7f0000001c80)=[{&(0x7f0000001e00)={0x10, 0x1d, 0x10, 0x70bd2d, 0x25dfdbfc}, 0x10}], 0x1, &(0x7f0000008d80)=[@cred={{0x1c, 0x1, 0x2, {r2, 0xee01}}}], 0x20, 0x24000001}, 0x0)
getpeername$packet(r0, 0x0, 0x0)
r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x50, 0x0, &(0x7f00000002c0)="dd3dcb8ed3596fb60a52f56e1a2d06c921decd52342f658f94085fea462fbe4380e50f0d78e28babedd9607a2d2769cd2b76b86d7a93bd5d36a28631a10f3ca9e13d62b95ef3d9eafed8e5b5bd73f5f4"})
r6 = socket$inet_udp(0x2, 0x2, 0x0)
ptrace$pokeuser(0x6, r2, 0x8, 0x10000)
sendmmsg$inet(r6, &(0x7f0000000280)=[{{&(0x7f0000000080)={0x2, 0x4e21, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000140)=[@ip_retopts={{0x14, 0x0, 0x7, {[@generic={0x89, 0x2}]}}}], 0x18}}], 0x1, 0xf00)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x381, 0x3})
r7 = mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r5, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0})
r8 = socket$netlink(0x10, 0x3, 0x0)
preadv2(r8, 0x0, 0x0, 0xffffffff, 0x8000, 0x10)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0xc, 0x0, &(0x7f0000000240)=[@free_buffer={0x40086303, r7}], 0x0, 0x0, 0x0})

1m10.047924924s ago: executing program 3 (id=660):
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19)
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000100))
ioctl$PPPIOCGNPMODE(r0, 0xc008744c, &(0x7f0000000080)={0x21})
mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)
write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15)
pipe2$9p(&(0x7f00000001c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x0)
write$P9_RVERSION(r2, &(0x7f0000000300)=ANY=[], 0x15)
r3 = dup(r2)
write$FUSE_BMAP(r3, &(0x7f0000000140)={0x18, 0x0, 0x0, {0x4}}, 0x18)
write$FUSE_DIRENTPLUS(r3, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0)
write$FUSE_GETXATTR(r3, &(0x7f0000000480)={0x18}, 0x18)
write$FUSE_INIT(r3, &(0x7f0000000600)={0x50, 0x0, 0x0, {0x7, 0x29, 0x3, 0x0, 0x4, 0x53b, 0x7, 0x0, 0x0, 0x0, 0xa0, 0x200}}, 0x50)
mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x80, &(0x7f0000000340)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r3])
r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0)
write$FUSE_INIT(r4, &(0x7f0000000200)={0x50, 0x0, 0x0, {0x7, 0x29, 0x1282, 0x800008, 0x5, 0x8, 0x10, 0xc40b, 0x0, 0x0, 0x10, 0x6}}, 0x50)
r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x165342, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
write(r5, &(0x7f0000002400)="547bbee68789313efe846d6698abfeac0d12b144933fa6f684f1ba13b34680bf4b9ea70f71faa2a82a45ab47458c1f827355ad34033fbb8b9699eb0b279252dfcf29e377e14dcfbde42857cbf2aa88d3dad8ec2deea7afe4e747fa392fe01d425970fb2dd7a000ea3889f0d9021f347818106963e18c256e3df26b41c61d30284a8ad61c6269756119d62e3a7a24c1dcd09d3eb35dfee6ec945ac190c4797988e0d7f6f38bf9b124431dd8208a9208195a70c8e558c216e78d5f5b3f6df6f155e16bf7dd8f4e9eaf61d5142a82da7a87aeca19c25b631cd8a14ce9f2fc8dbcd05f51dc9260abc82d780c9358bd6411ebf48520694d413024432d0bfc3759a620289c9c8705009fd829da6eb5b72b454436b0af8e9dc4941ca2cff92561cad984e15849dcd73f04c7f70a30304da2fbc17f421767ad5ce47ed79d6798428eada9a39faa02f978699bc8c482224a2d5f85cc1135ea92ac1c610e32f1e7c82da6d91e0c8634da679760c32c3e891db352b76b61a65bbdd023e093a8e0d37fd8cd00679cb1bceaac84b05861740c221b2cb4afa1ce8b091c815fc4bd83995b5bf5dcdf2912572cf6180ec27445404917ff9e8e6604e2afc19a1bb3745914f0a101e03e44ea5f64d40402f12a81310c97086fb01d04e82799c40f29348eb283ad58a40d608a47fbf9a25dbb308aa03b2425ffa896e1a70a37cf49e6dbdeda39ee88aadb26811eba78a0dfe5400a51428c31582edcc5f75b5dd963707a54b9b1e35f9966995d6474acbf7094124cecf38369aba3f6a5e3ad071f5e3df902843a3947623fe01571d97625c3e27721b08a6f85fd7b879acd400de5beabdd2603d566fdb4018bf8bd74c3ea1ae67c988992c7dab4ebcf501a73815e1b527d3ff1cf9e729d55127118565f794d253fef25609e5a415615d1b5fca5381b49446d9b9e75fbfcdd9218b0d8d8d965871b897544e32fd0b4cb5600ffdcdb0056bcad75216759590f8a94db82b0acd2a5a34e5c34241a19f1a7a7cceb894341f55c6b474f3cc000f9863a67519dfadee6576f08d7448929424c13e845e2e636b87dc14e1ab4ad05d69f896ca1bc5c1267befb68ec4207e21aa30bdae1d1602d3e4080784834e213c426ba5446f90d3b3885a5d6942c6b0e637f5bb9c7908460bd7d04497ab054c8fc7f89068f7535976ad051bfe94c243ce7604a63b2099b69f1ed73590a318fad9a170fa0cddfe60e981a92de2e1aab3465b11a968108e08deadfa1fa546c4cbc0c34ac28597848562583ae8d93cb60f2e06c7a1f743add51eb8cd732b40d48fde00117cb2d654100dfcc66b7c9fefac80e137caa5cf43ae897780251a3ebbc4ddd3b003168963c9e2c9446cb29731fc4bbb5e551aca6913f7b8576ce34012581b5a363917970399ca369688e637cf06ff3c8114383d2fcbf9c69f1ca63cd21695254a440df5ef0a8abfdbd0a651a533b6cdb82382e3bd70f87c1d3eb0a6e22452605026fafe6d35158c0728c1050a39330c80ee2ee0b09366fc6382883ecd0796feec657b330e7735bf1c7e0e26aee4091471e406e9faffd5ede27943e5fbf1b7249ab8bad71f60063697f04db52e980a9fb3eb5e53b89be8a5f0e6afea7435789ecd444c28eb411cdc2158e434178749f36cc957dbd17efb2b218592f78d6864f2708e8c6db2da0d3f6de53959afec0c90d3d62a13a0bc3857bce58d81223eddd05cf3c1ec6b3fc5307d0f16d470f2065300295197e9fa81d2e5574b2c7b18f1c6c85156a9b1174d62dcd3cb026f4b67e6babd66c8f427b9687585f37b18c82e0100507035e78ce010b78ea1b5d3884db25df36ae929dd535a854a31cba5e47655873df72be7463c600b704e9da0e7cb2d61d0710248814ecced2eef8f227c8aec308c2c9d0a39d1a6b306080e8eaef8edece0f6d0d1612c582d70c3999a1a6bd529538f51ba4869ce74bc8509a7126d96db118cdb55411a36f4361d53c8027c12a7486e9c84e4de445b454630be27bdc2ec268702d9c1890297bdd1fc7a235f1a47f4645d286146f3cb9a7ce650f4157a1e7f134eb1815001d59905d3103efad3c66479330e8a5da941c9c38bf21bc0770e3fd56cafa19ad6e9d51f94ed4f900062b5602653aacdcc956aeecfb1dd613caf918e1ca8ef2e1504c42768e77df43569d5fe4b48c237cad5285c578b26b4e47c8ce06fd2686e17eb6d5df5645d0fdde7782216be07a1135dabc3a59598bdbab249c5391832f18ac5163aa7a1a890128a4520835a53eb750604c5e328ecb3216516b3eba3f97652caeb4327da8865880a932dc8e7668666ac3b76a2a424ca37b5dfb52495710611e20790427a9f9e7ac59bb86f0fb7a17a5def347a98dd8e733b784d78d5c7f16f327a2606d4252411457465540a60b0757802f470d08337c0fe4eee5f5cfe4f296d0f7068e80828a022c95632beb7b7f802135e246b1adebebf24c821dee7205e9fe1a437b16aaa8dcb4a58b0bdbc8dbc2fce09271c27430cc9ca8141955ec5ff4228627c3816cfe1bb2c0f40f6a61e8bfa4e2dd744e41ed80b83e9aef77119f4b062b98e86690711e83e795bafa7a8db16f241cee76aa01ff749100c113fda966aa8c83ebe975f760c18e3864065a5de6e8028a9e3199f4acff11e14bb13bc50faf97fdeab46edc371e55cab78841a2de17ca116b0183ac38b658c57a64ab11bb0de071c971a7a5175ad0bac6ac1d1118230a5412a35bd005b369df0e04e749ea93d7e56f713b9ceff580547a2a76ea4753a78b4a5cd0311024c5536b536c8ede63bac8e8b4c5851248d9098a7c6bcc3d5f209178b45aef3c1afa4ab73d8feac3e1f771626d73d85f72dc15d16bd3b7b93e622626f6f3d96b4425d328236cf1579f1ca834a7b318b012e27b9a2dc528189cf1eb3705d90de50ce7ac0c256b7e41500113e164fb7d53c74c6f829552a5bce73eeab9a46d01551bdab18fd3a7e82b036872f1e876b12c5676f63a6ef0c6ff159788a0c2fc40f179a259c656e8aba9295e90027e74ef910ce3c56d6e2de917947410b05603b6a5052453f13e6ac058b3f621573bfe6224bad8c3a5f575e1eb774839cb554c53c9b3ad623df6c5c9627cce856f9ba5847557bc9f854cbb37a936f20a733ba352ee5b343b941290a399fb862434d1b551da420053cad3bad65195cde40b345740e30e9a22619add8aedb763473b729c0649f7a1ea45325534c9b629a1fe3a54a78fe44969715182c6df5c9ecf6878380831b2996579332ac37286e72ab16824c3fc9ef8d74a7f1f5cf80fa37f6bb990db3a7a70139887a4eba0763247c58f4fe770a0496a5ef49a3ba4d62bb900644d49b5fba7e58d58af6ae50c96da346618434ed46b8f4c27cde5e8863d5b090dc117f3b16db2c4273fa84f8b06d3df436bf4a8cfa6d33d7f0e78ef422d5d7640c821398c9adf4d6ccb1b2f7cd0e497023cfdd6b5bb9ad6a29edb8b78fb3322414cad1458eb12699853acb165076db7088f518386380850c111cbe74034ddbfe217db714325ebc4d6b46eba640cf125b87eed0832077ab775e475e431079756b3da6f9bb3c861ce7eabf6adf70b76eb9642a1bab3d7afef2d7b40c8a19b98123ad7449c1039c494e73bc91a86e8e92c39a9482cf60605b9e5c209262c4fcfde76ee370bd6a78253b64c5cbb19a11b34c5a9ccf634c52751277268cd97e795b43867af5a4db51bd631ac547906fd52aff43eb98edacecf08f94a060902b5cb82e87ec856305005bd1150e581d9717460e31ba724da5e7ad72fa580f8509fe838dbc1bfbbf53e29688f25ca602d2de702e4411d3d133e2ab2f454f71f98efc2cd0eb468544cacf608c6689ef122009cf61e813e26b7b2b1695143fcd510f509ec2bf7205e674ba6767eaa29605c51e434c298bde0969617292e960d22b085632d241aa2a8e0f6ac6f2d56d0ed2c6bd3eca306a3224915065894480e737c7d7a11901bb7f977525cfcab652476baab0fd3b68dc59fd14ccdd6248bd5c5a0ab1dbae28a848b2d4ad0d973bb149ff4115b0436b7d145a6f8081d314039131f60dc8ed0ccf2c4971f0a59a65b3b1ef638e6d009dff793a4b7266c58f88bb117d665cae8fc6f6c2840470333bdbc8df12c6633a6ac7b664e089a85dc6d49f52459dd2df1be552194eef6027c1b45f62b97647788c3325f05609c1e02cbc9a18be72e4b502df719e4f9cb82615e3a03b5732328e552023dbfdcf91ed5ab51242e7d09a9b73674f0946976d8a8fa9288dce4d54d5820a0f0053b892685f79a6c8dbac724fce4d24a7b75e383f54ac58af3951d666a22f158637acc4f0e09e248e85f8e1439501afc0d5b7e9eab40fa737ae93482a1e29f3e327fa31d0d764c65ab976af1eb91fe08c5bc10a48b93453ad192d1d538cf93b792a70246bde99f46a78b670edea552840e08c787c928ee311f954b73d07287a59b470e38d4e624ddba8e4b21a74d7c07cc684b0ea82212129901029e74312866722dfa2dc53de3e8ddc00adc21deb7510ed15c50d139296297408da3d6beb589e7bb3f1d74e4e8dddec14b9cdf371d7f142136cdca5644d09edd97228a0abcd2e7b402c5cc68683cb980f50ca7aea8338dc5990a6ebb2d2b95a3deecc45f5a4f4e0e40a57e29f3e227c41db00e17dc962e2ea3184b5057c89974bcab651a22e588a527d7d8ec695e7ab5622c1ad3763d045a8393b7acfa04488556ac957777d1aebfc5d0e2a8150a6984d5607ac2400789d8f622c837d6a9b78fcc2d8aa872949edde53e3a99b5f5bf35bff5f0db7874ad3f172f9d8dd6cbb17a770b1482c79b9a15605cd0d89c6bae9aa6db8e886cfff8f843b99df95dde88c96202ae6ced4d539a3f70997ee7b2bdb7bbe529f9bc55b143066de8d9dcd7fa38c54094f2235e4a17ef8e910b4d48c373ce5e6fc9824ca8f115e579b002df16c591557cd6cac1363b8d8fc656075ca703a87f1efa76e4122eb7358389f659681fb49cb82215f73b284a7678b8b1528472d0cfab1980ee3d4410bdc1c31f1f798c3ca5744077e2f6cb4ca6e415f1e3afc8c00dd95d3307de5428883513f01ed19dde487e1c103619fd78583f09d02982512e0ee20a670b3b24986dcb7431f1ef3fd12e801bb2454213ff7b1962a464647eb4c8125cf2ed098160da880024a98add9b2917e133dcee7a8e25387fd5bf2b3f8fb05b2f7ed5f719b30b9cca4b1754e31d48bd2ec79e7e9c155130ea5f0876f3bb4d94ac74b209633ecb03deb8b9448e8cf4b4bcb04ffdb38ac457881f84636246a4e5e7773166129fb8b7803c6dde0ee69fd1f76f1d93b729eacc9d8dbd6e61e638a3f8de972a824936b1d869a15daaa21db04760e9110c5b7c736671d31a72fcd57a6f7424c898791cafa21a48921215a78d60a367aa7c6284a1aaa1fee0c5291bdc91bf8c032c9917fd28e68fc046ea4b17952f1abbe01af5f19e4fa99fc6a985f6264f9efbb208e6146d3465cc603ef36d3d59b5197bca1696bf5658b60cf0e0455cb1e174e52c4acb712a3ed9202a1ae334427b93305939c7f15e9e5eed09b5fc8d1e3836720d46d133841d4482ec2427d3002d95bce996b4b2d5b59b2a43970afe35517674bfdd8807931697422045f60641138fefa27865b9d477ef04847dd02d305e8f15e228522e54d1ffda6d5b26ad831146c66e6f9153ebeb0785ea75283df66816d771c7e4297c1686d06494a59046313169f2e2b4988a2758198fcb166d9d112d187a4456503e6c0bdfb390c89dcebf3cb8260a27fdebddbc6071857010", 0x1000)

1m10.047618674s ago: executing program 3 (id=661):
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES64], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0)
syz_usb_disconnect(r1)
syz_usb_connect(0x4, 0x24, &(0x7f0000000400)=ANY=[], 0x0)
ioctl$EVIOCRMFF(r1, 0x40045506, 0x0)
r2 = socket$vsock_stream(0x28, 0x1, 0x0)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x1000)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r4, 0x29, 0x7, &(0x7f0000000000)=0x7fffffff, 0x4)
setsockopt$inet6_int(r4, 0x29, 0x33, &(0x7f0000000040)=0x2, 0x4)
getsockopt$inet6_buf(r4, 0x29, 0x2c, &(0x7f00000000c0)=""/34, &(0x7f0000000240)=0x22)
bind$vsock_stream(r2, &(0x7f0000000440), 0x10)
listen(r2, 0x1000)
r5 = socket$vsock_stream(0x28, 0x1, 0x0)
connect$vsock_stream(r5, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10)
write(r5, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f00000009003d"], 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_open_dev$hiddev(&(0x7f0000000100), 0x0, 0x0)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0)
r7 = socket$nl_audit(0x10, 0x3, 0x9)
ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000380)={'team_slave_0\x00', &(0x7f0000000080)=@ethtool_rxfh={0x47, 0xfffffffb, 0x3, 0xffffffff, 0x3, "5e94fb", 0x3, [0x4, 0xb, 0x3ff, 0x0, 0xf, 0xff10, 0x1]}})
setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, 0x0, 0x0)
write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0)
r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2})
ppoll(&(0x7f0000000140), 0x2000000000000270, 0x0, 0x0, 0x0)

1m9.915031725s ago: executing program 3 (id=664):
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='vfat\x00', 0x200000, 0x0)
pipe(&(0x7f0000000140)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000200)="3d4077e50823258d495dc9d2c2a25bc7dc0b11bde0d15d0770675db1790111e7", 0x20}, {&(0x7f0000000240)="b28231adddba8ed6f23bf98ca8caa015ab797f57353ec4ceacbd4995a9a6", 0x1e}], 0x2, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12014101f2c59620d016b8108ede01020301f8011200010000101d09040002000083ec00"], 0x0)
r1 = socket(0x10, 0x3, 0x0)
sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="200000002000010000ffffffffffffff81"], 0x20}}, 0x0)
read$FUSE(r0, &(0x7f0000000280)={0x2020}, 0x2020)
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='vfat\x00', 0x200000, 0x0) (async)
pipe(&(0x7f0000000140)) (async)
vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000200)="3d4077e50823258d495dc9d2c2a25bc7dc0b11bde0d15d0770675db1790111e7", 0x20}, {&(0x7f0000000240)="b28231adddba8ed6f23bf98ca8caa015ab797f57353ec4ceacbd4995a9a6", 0x1e}], 0x2, 0x0) (async)
syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12014101f2c59620d016b8108ede01020301f8011200010000101d09040002000083ec00"], 0x0) (async)
socket(0x10, 0x3, 0x0) (async)
sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="200000002000010000ffffffffffffff81"], 0x20}}, 0x0) (async)
read$FUSE(r0, &(0x7f0000000280)={0x2020}, 0x2020) (async)

1m9.893393796s ago: executing program 35 (id=664):
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='vfat\x00', 0x200000, 0x0)
pipe(&(0x7f0000000140)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000200)="3d4077e50823258d495dc9d2c2a25bc7dc0b11bde0d15d0770675db1790111e7", 0x20}, {&(0x7f0000000240)="b28231adddba8ed6f23bf98ca8caa015ab797f57353ec4ceacbd4995a9a6", 0x1e}], 0x2, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12014101f2c59620d016b8108ede01020301f8011200010000101d09040002000083ec00"], 0x0)
r1 = socket(0x10, 0x3, 0x0)
sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="200000002000010000ffffffffffffff81"], 0x20}}, 0x0)
read$FUSE(r0, &(0x7f0000000280)={0x2020}, 0x2020)
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='vfat\x00', 0x200000, 0x0) (async)
pipe(&(0x7f0000000140)) (async)
vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000200)="3d4077e50823258d495dc9d2c2a25bc7dc0b11bde0d15d0770675db1790111e7", 0x20}, {&(0x7f0000000240)="b28231adddba8ed6f23bf98ca8caa015ab797f57353ec4ceacbd4995a9a6", 0x1e}], 0x2, 0x0) (async)
syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12014101f2c59620d016b8108ede01020301f8011200010000101d09040002000083ec00"], 0x0) (async)
socket(0x10, 0x3, 0x0) (async)
sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="200000002000010000ffffffffffffff81"], 0x20}}, 0x0) (async)
read$FUSE(r0, &(0x7f0000000280)={0x2020}, 0x2020) (async)

32.589109928s ago: executing program 6 (id=985):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000000)=@generic={0x2, 0x1})
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r1, 0x6, 0x24, &(0x7f0000000bc0)=0x6, 0x4)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x88842, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000140)="d8df0f23b3b9ce000000b807000000baa4905d0000000000658154fea900600000660f013882efbec182fd3f0000c8b950020000b801000000ba000000000f300fc79d53bf0000c4e16dd30166baf80cb82556ce8bef66bafc0cec", 0x5b}], 0x1, 0x4d, 0x0, 0x0)
ioctl$KVM_RUN(r4, 0xae80, 0x0)
r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0)
pipe(&(0x7f00000004c0)={<r6=>0xffffffffffffffff})
fcntl$setpipe(r6, 0x407, 0x401)
r7 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000380)=ANY=[@ANYBLOB="1201000000000010380713170000000000010902240001000840b109040000020300030909210201000122020009058103ff03100000f7b869de905c13714060227522f70df51fc09f7b9dcf903186a9685c2e95739b760045f125be844cae0764e05cd1b4f1826c99f3d0ea8526aabd73c1d69882acefd8d7b547e065d1f56d42a710b315713dc49500fddddeb764579e90bf8ab9d0d186b8ecce448a7dd652686557ab876b0dc09e96e66c8b999c40090e79198a135043345823ef0e2067c2a1397047dfd46e5d59c4546433fc8142407bbf3aec9fe2acd9cfa080a367ea8526a30e4f3dee31"], 0x0)
utime(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x8, 0xffffffffffffff29})
syz_usb_control_io(r7, 0x0, 0x0)
openat$selinux_relabel(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
r8 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r8, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r8, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
connect$inet(r8, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r8, 0x6, 0x16, &(0x7f0000000340)=[@sack_perm, @window={0x3, 0x6, 0x7}, @mss={0x2, 0x7}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @timestamp, @window={0x3, 0xfffe}, @sack_perm], 0x200000000000005e)
sendto$inet(r8, &(0x7f0000000780)="25d7fe", 0x3, 0x1, 0x0, 0x0)
ioctl$BTRFS_IOC_DEV_INFO(r1, 0xd000941e, &(0x7f0000002c00)={<r9=>0x0, "c4170900000000080000000800"})
ioctl$BTRFS_IOC_DEV_INFO(r8, 0xd000941e, &(0x7f0000001c00)={r9, "d526703746a46a87d0f4f82f0eca980a"})
syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0)
ioctl$USBDEVFS_RESETEP(0xffffffffffffffff, 0x80045503, &(0x7f0000000080)={0x9, 0x1})
syz_usb_control_io(r7, &(0x7f0000000340)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="000f00000000000000f4000000539990549215370d6e6587ca761be388f92ad731231a36eb6af094fd1550d27d7ea324f65a8def152e708a429426c350e5321864dbb77dc232698952eddddc5d79d13c787a3d7b5a9316e48cebc396ee5b6d21a259884b9f8150ce519007ef02014d192fda8177c6d7d135a3aed2322b0ea3ffcc567d37faf28d4c5a7f4d0ade5abc2f639ad19a799bea0a79a763a78c56ead889"], 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2)
syz_usb_disconnect(r7)
close_range(r5, 0xffffffffffffffff, 0x0)

30.945108421s ago: executing program 6 (id=1004):
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00')
r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022d000100000000090400001503000000092140000001220f000905", @ANYRES32], 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f00000009003d140f3c369197d09647190890"], 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x22f, &(0x7f0000000080)={0x0, 0x5325, 0x10000, 0x1, 0x100002cf}, 0x0, 0x0)
r2 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r2, 0x501c4814, &(0x7f00000000c0)={0x2, 0x100, 0x0, 0x2, 0x1947, 0xf})
mkdir(&(0x7f0000000040)='./file0\x00', 0x1)
ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000180))
syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f00000003c0)={0x14, &(0x7f0000000240)={0x0, 0x4, 0xf0, {0xf0, 0x5, "3181e44174887acd686918e4261a22ed6cae3e263ce4fab31ccaf5570f1f4ac99b709baa9bb4d31ccf4b527683291071187d5cd4bacf2e943cf1936659452c3b5d089cdc2ade7b36e2e304f24dd1b6b1d7f967d77e5a4ae8f3aeea4dbbd39789f30d1a0cf60ad45f9e8385bb987a46b1a32cdfc5b61a836946aaff816e5e458b285f9b0d01216ec3be47f2b777bf255e9edf4559a14e10298ff00befcdea9a7e03c5414e5189f8b486a6c2838e672793be911b219e93548abec4e64b5e6b2cefd1a12beb0f001927bfdcb704cba8242173c1435d5f6c4cb86dab1563262f85190b0b626abe3d4aca2b132822ddcf"}}, &(0x7f0000000380)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x200a}}}, &(0x7f0000002700)={0x44, &(0x7f0000000400)={0x40, 0x6, 0xd4, "0407a8de0805fa408afc3090a9bb2a8a41734900622a2823727694c5f61070d5f4219268dcc67f4aa86dd5f486aefe1beac29ce1a26fdb4266d52700a39c08116bca0ff8cfef935a99f07139125b2828445f9dc008c87ded2ec67b1cf9c22b53bbf64bb04b7ac3a72e91df9509a5232d4e00b9fd2b6683af3e58587da274eba64036fa80054c37ef43d6ad2bf21bc2fcf30863e4aae7c087bcae4b9310e9d9b57a2a3c3464336473136db8f3f73148cb18862fd2cad4922f07bbbe1f79762d5bc85cd868dd94b816ed38a7f3dc180f24144d7e4c"}, &(0x7f0000000500)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000540)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000580)={0x20, 0x81, 0x1, "c5"}, &(0x7f0000002600)={0x20, 0x82, 0x1, "8c"}, &(0x7f0000002640)={0x20, 0x83, 0x3, "5c8554"}, &(0x7f0000002680)={0x20, 0x84, 0x3, "fcc63c"}, &(0x7f00000026c0)={0x20, 0x85, 0x3, "66f361"}})
mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='debugfs\x00', 0x0, 0x0)
mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0)
mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x1c0)
mount$bind(&(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000140)='./file0/file0\x00', 0x0, 0x182d00e, 0x0)
mount$fuse(0x0, &(0x7f00000005c0)='./file0/file0\x00', 0x0, 0x80000, 0x0)
read$FUSE(r0, &(0x7f00000005c0)={0x2020}, 0x2020)

28.921029914s ago: executing program 6 (id=1029):
mkdir(&(0x7f00000020c0)='./file0\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mkdir(&(0x7f0000000200)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x79, &(0x7f0000000500)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@uuid_on}]})

28.907862616s ago: executing program 6 (id=1030):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) (async)
arch_prctl$ARCH_GET_CPUID(0x1011) (async)
socket$can_bcm(0x1d, 0x2, 0x2) (async)
r1 = fsopen(&(0x7f0000000080)='ext3\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v1\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) (async)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x11) (async)
close_range(r0, 0xffffffffffffffff, 0x0)

28.84385284s ago: executing program 6 (id=1031):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x4002, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000008)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)={0x24, 0x1a, 0x1, 0x0, 0x25dfdbff, "", [@typed={0xa, 0x3ffc, 0x0, 0x0, @str=':*^${\x00'}, @nested={0x8, 0x1c, 0x0, 0x1, [@typed={0x4}]}]}, 0x24}], 0x1}, 0x0)
r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r3, 0x0)
io_setup(0xc, &(0x7f0000000180)=<r4=>0x0)
io_submit(r4, 0x1, &(0x7f00000000c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x0, r3, 0x0}])
io_cancel(r4, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x3, 0xfff2, 0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0, 0x1}, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000340)={0x2, 0x1, 0x200000000000000, 0x1000, &(0x7f0000ff9000/0x1000)=nil})
r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00')
open_tree(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x51)
ioctl$FS_IOC_FSSETXATTR(r6, 0x401c5820, &(0x7f0000000080)={0x8})
setsockopt$packet_rx_ring(r6, 0x107, 0x5, &(0x7f00000001c0)=@req={0x10, 0xf, 0x6, 0x9}, 0x10)
openat2$dir(0xffffffffffffff9c, 0x0, &(0x7f0000000140)={0x0, 0x0, 0x1}, 0x18)
syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00')
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='smaps_rollup\x00')
openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', &(0x7f0000000140)={0x474082, 0x5c, 0x8}, 0x18)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r5, 0xc018620b, &(0x7f0000000040)={0x2})

28.829568642s ago: executing program 6 (id=1032):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0)
r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
waitid(0x1, r1, &(0x7f0000000300), 0x1, &(0x7f0000000080))
ptrace(0x10, r1)
socket$nl_route(0x10, 0x3, 0x0) (async)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r4, 0x1, 0x0, 0xffffffff, {{}, {@void, @val={0xc, 0x99, {0x2001, 0x56}}}}, [@NL80211_ATTR_TX_RATES={0x4, 0x10d}]}, 0x24}, 0x1, 0x0, 0x0, 0x4008075}, 0x0) (async)
sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r4, 0x1, 0x0, 0xffffffff, {{}, {@void, @val={0xc, 0x99, {0x2001, 0x56}}}}, [@NL80211_ATTR_TX_RATES={0x4, 0x10d}]}, 0x24}, 0x1, 0x0, 0x0, 0x4008075}, 0x0)
socket$inet_udp(0x2, 0x2, 0x0) (async)
r5 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_int(r5, 0x1, 0x5, 0x0, &(0x7f00000009c0))
sendmsg$netlink(r2, 0x0, 0x40)
ptrace$getregset(0x4205, r1, 0x1, 0x0)
r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140), 0x254b00, 0x0)
ioctl$RTC_UIE_ON(r6, 0x7003)
syz_clone(0x521de011, 0x0, 0x0, 0x0, 0x0, 0x0) (async)
syz_clone(0x521de011, 0x0, 0x0, 0x0, 0x0, 0x0)
sendfile(r0, r0, 0x0, 0x7ffff000) (async)
sendfile(r0, r0, 0x0, 0x7ffff000)

13.566827364s ago: executing program 36 (id=1032):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0)
r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
waitid(0x1, r1, &(0x7f0000000300), 0x1, &(0x7f0000000080))
ptrace(0x10, r1)
socket$nl_route(0x10, 0x3, 0x0) (async)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r4, 0x1, 0x0, 0xffffffff, {{}, {@void, @val={0xc, 0x99, {0x2001, 0x56}}}}, [@NL80211_ATTR_TX_RATES={0x4, 0x10d}]}, 0x24}, 0x1, 0x0, 0x0, 0x4008075}, 0x0) (async)
sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r4, 0x1, 0x0, 0xffffffff, {{}, {@void, @val={0xc, 0x99, {0x2001, 0x56}}}}, [@NL80211_ATTR_TX_RATES={0x4, 0x10d}]}, 0x24}, 0x1, 0x0, 0x0, 0x4008075}, 0x0)
socket$inet_udp(0x2, 0x2, 0x0) (async)
r5 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$sock_int(r5, 0x1, 0x5, 0x0, &(0x7f00000009c0))
sendmsg$netlink(r2, 0x0, 0x40)
ptrace$getregset(0x4205, r1, 0x1, 0x0)
r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140), 0x254b00, 0x0)
ioctl$RTC_UIE_ON(r6, 0x7003)
syz_clone(0x521de011, 0x0, 0x0, 0x0, 0x0, 0x0) (async)
syz_clone(0x521de011, 0x0, 0x0, 0x0, 0x0, 0x0)
sendfile(r0, r0, 0x0, 0x7ffff000) (async)
sendfile(r0, r0, 0x0, 0x7ffff000)

12.217634573s ago: executing program 2 (id=1144):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x49c45000)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1e)
r1 = syz_clone(0x201200, &(0x7f0000001180)="aeac9d950242490b2c89e3e6affa78845b9d90fe3765488e633a180ced9005bfa1356f7a24a3ffa9996013e5b2caf53a55216137b9848ad0fd32ca35425a1948161cdf1f88125862b1748f41b5242a3690880a131fff389fd51147ca8840813398fe1168335fd75ff835f511646ef9bc57d60807eb99874556c43c27dcecd55851fe47103109e41b25a95b9902fe0226dcb174caa7ec5f1a04eb2865b31db6f4837c63fd872554207a7ca6eeeb0374de917ccdd69edd99ac8222894bf04c139018b33d89ce507fad9d77d06bce3d22914d5fd54e1eb15c460d7e8b3fe24711c598cac56ff221570cde8600acd9b2b7062adb5cddaf3005ca4b7972f77446dd44a0f647821528b0c2719ae00dfcca0ac91dc31e401128428ad9d943d4d645378bdf7d4c6e1a47f483a889e1f6ef60d16068d8cf68ddb33f515a21fa88be1305062d59003c620a539a03e6ae2da4f46fe9bb3859f3af2a3ce63158167078bd216fb1048d0ccf5dea26694d836188ab05302ca3c6316cf4119ddedd3becfc612d456961198c27a4a5d32a12563a15ba2e7430c2b97042a0379c2dfb54cfedb474942722e3154ef79623d29db2d39825e3b677eac0e4b726a088637bec9376cf91f6d78faa741cbfb5892642a14454140a970a0b7f2e96123321b1317e82bf7adc7912b6ad17884dcfa5a2959b9e18f47123928e22b80d9e0371d6195fdc3c0f8e64b18bcf0e294728ea1bffd097f27c3e534a069d8f8871c8ed0ac7b6b1c322e473f04f23a15e0c05dbebd594e1a37ba77b4af1d5e795a64cfb775627111aac5330052ca830712b9092f9f6006701108ce4039eb9877a5d470da59804798bbb511d9658ce5b36f935696f153fc56bf0427c0d4202c57117ec4e61825a71f28e6ba6669b1eebd46b9eaafdf1c2eeb6f19c8367ca99d310b275a305f54798942e03459110e141829b03e811bc3d09f418eb051c3136021586976b341a683a1319597bb58952f4438f8699be588d5102708be8ccdf97950da3050b4d636a7d31296c5b96511bb1387b2e58cb0ccb8081c1a0b82a86815503e867d391cbfb4fbccee8f49ff68baade61be7ded7c074bdfb0ee20e17f616decc3f4aa0da44ac0e3060d560687906be0081f6664db3385eee5b432d3c69e4253ba52135a77157629b54040450f61c708ecb32a81770201c3d1b27e0c610a576177f5dc0c6cee75aede542cda4b21ceb02b1fb8a885a5004395856ee1b499e08379830f42b2e9160ba27c21f959b01c0c669b94d742784ad2c4efd37f3504fb9e13bcf8ccf8798001bcf8c9dc6707fcde644d798ab423eb8d0418bf7dea03916cbf813541272db6c715879c0aaa3d055fffad00b9b87cf1e6184a851f7cbabee8552c6476fa4589b32fb5f44ae66cbf3ab2772f1da39d80385f9e9d1e4fc25e526f185b541fdbb935f555c7db0d9ccf4d9a0b3a71439f93749f8560df60da42d07eea22f9d9107e1a71a7c6b08cf37e2da14c1aedaee99fd4ed9d186186b6267d1329d097e35ef2ffca5ec6e981dd278f225ff5a9f5162d6a9bd8d2ce67c86e650c5d8943e0533e1151366409db6f339f896110dbdc03e1f2ec329f3377dba93f78182a805e366823280976be0556f7ec89556fe5d6948d91b21dc613cf4045c3586112eaff5492f626f4f4ff286676272fa6b6efcd5f7b908ea0fc6895ef81592572f2118e2daea7de21af184c45398aa228f14a80ec98a7099295de0c6faf1c4c4e0e82132a6e8051bfb0203e688f2a87ff2a5638e8fb7b4fb21dbfe3ba7d71af557c25653c32af3ca430adff9144f9565829189129cfd120fb72f91110b255e4054055d97db2adcd1b3be932541dd25617a87a862b12efa65a73a54721002232ac997e572c1ac9414934697c38eea2ac6bf4dd6364e0b3a082894d6ad7e10ff7f6f0c1a444d2fc529078c85912a7cf248a4a064b2c33efff7117e36b485bf693346eb5259de7e7ff423926c3e2bbb15edf7d06b3e4254ed75bdc3c5d47a9b13f9dafe7fb4cbe42d1f363d6749649317683e289ed001764a9a400550a7fc7ed1c0bb322de420d5ae5bb7b488a649fad79de1a77b78e71442d4d0264b12cc9b20db26aa43496f73b232b8bee8f297b15b8e02551fb5efc336f253fe6253906a3e680cc22d0b9eab874198f84c6df98e2bf28df314851c936c7fb221ab090fe037b8b99504648f0e558bd051c361670b202e4bff8d1cb64caf7533bb7a4f13c72feba8da3c010de42a59ba45a12075bb39962ca3d1cd8657a68de67832bda8b5eba08c013b81c99d508685d96ea3a247b1a3267346037b87281b36fd8a39ce225ba46832417ca46a496c521a3d7e976fc43ae211d9fc471d58517a3c0ddea60ceda2f766065a5e4f0ac9d445d1a84d6cc113446a4fd28b65a1ba4c1cb9fe2fc558f00c6c3dd2c11699a0daedcc53d1f514f2de68f26bf35f98d84eef32333a418c6a35e79ae1fb19a4da30c07bba81952077d984139c227aa59ea3f5a2fd4ecd477cacb25a58e5522286324674d9b60364a9d6f99824b4a7859708125734838be54b13a6d5ff6f8a85877136f60ea1aa02c6dd6193ddfeffa77ee9b128be633bc001167d322404bb68aa8747920341bc4722911c68bbc8b2ef4c25b87148f790a0916872f7a4f87a11f988c661570d4e1b6e320523c88edb9d17b616fa79c8f08815a8741b212e4868ebd9da12cc06e383d63c10a502ab9ecfe0a6b69c5d80ba9a9dd2d7949ba8eb31eb9811ff9cb8c0d3acf0cd9c44559847236ebaf34fc94cec202f5eae9cf2509ea936d1add46b221e0da0712ef101b11dab1f119242034b385bde30c2c0ea7353cc7abb2d6dee503f743aa115dd36d88f529e0694f645a58efb764938df705f99dbcc0b3f1780663575a54b826bdf2fec729b92ee715887d41fdbf4edc90a62f34d4b90b8912f6b19c6f29f1fcd03a25f55bdbc49b299d285297110aaf351a132602dc2a3b07fceb9c266363311f74bbdbc98f99b327d801443e4ce17f7574ff4784462267ad713833e947cf8043864f9d42b23cf713744f6c4f34679a2d6d4677d6979885174f92ed4053590d16dddcd9c975419269336df3cb06811a2f6d5e87a2647d71208ba40b731b4951ae34f691853dadfa842a4615fae2c5f55e1b62ecd0cdd5e95878af012a365522a242a6bc596b10b7bf6b6d6764ff1fdc36b5b1d7fc55c9039b1d7862a6db82d19ee32d4cdf88889c37adc0326da40fb741c41a263987fbee26316b8c365b61bb4451209e5f875f96eece95631e1d31e537268d0c76057e6c0666d7ab288de60e118a34b322c8dc3f2d2abc55fae8d810ad6a88c90163966db47ca5a5ead84acdd7e073fd655d0bff28db73b5684b09f286429c1e0030dc34145d229eb4d7cf2dc9eece70c9a9b96aa06bc5ea6d57a6c678ebdec6b1b1132712b4a0bc436972468a27e43413e8237eb8d34fa45513769a58cc67854d439576ad2da6970491913da65d6220e22a790cea2b95ba92a29598d850548e1dec531ece66e02a364d1f4de318ecdd4d4074727961fa09896be8680728d06459fa98d125f8a8d0286e4f499622b3bc42661aa10e44c6558f20243c5f5101e6ceff82542944e78f3f47695410c6375012e9bbf882f4f36e82214431e14e3bb40c7a64a5490fae6f6b300d420049013ffe902a9fa1b9eb958f35baf4b546c6fb5fd59ebb25302100ff0b46ac7e3660b1a96bb2fbc70d6b5c0a7e6642d2d17e30be184f84058c33cd0a2071c6e5850ac5d82e17f1bd929f1f5e02b360d3f822a229d532cc61520735135e5377019ee03aa2764d3cc43a0737ce4e19a7619d4de7113e232a7aa3707507b845950e13a73114e6f7bc4eaf71e4e4e61007b2a5a5e6660492267e225f7e026222d81e27ee96415ae366921ed3305f9de74dba298fc274e5c58bc10c4f3a5de278ff45e4019ad99b8d010593eb74d6aa897eb7f4aa5620c0d73b2cb34f3970d871d37155e387247bf9067e705ae272043dc76f72b2071de7d2147031f61ea5d743e673880b95201c312411b677126e8a0d43f7b220fe94c793c5bc191c9271110658d8e393a684e771d668e5638fa40fc28770995d9a38a559d82d3399a2b76b39aa94f270ddb71daf3e539bef51eb3c05a9ec729180ca579b1e58953dc8ac4510c5ea08ac456b061560f61da7011deb6f01e28968e29d39e302b869e0f210191bf088d49ab2451d3d4c06ee59d8c110abccd8aa32a862f11b0b19704e25bcb313d9f580166e8f206f3291440ccdd5a8289bc3fdee9f485482f61b33db1699d1e372759e5da2aa97647d5f10b0a44ed47dd1ccad694fde6e123b2eab2af00568e72fdc19158d819acdc167c16ee2dc05714a24c6e401737799c86d5f9a902f925120df5b4f0048915a4c766b3b7f898e3f4b0f44ec6490b8ee571cba869f81bed4a366ab6e6364af68a209836eabb3964e66aad9ca61a5063b9b1a5075a2d70e63d24ea7e96f83f49ddbcd21a21bc3fc9d1bf9d0a77c571cc3f84e010b5b82f97e06f2eeb18f10f4f63dd8442bcdfd673ac60bb1030b1a0ac13a91181ea70d6397ee38423b114e5035ab0f24c5ea70765bedc2060558cb95a143d839bb63f932d79051e26f0bd67ae2d99eb990ad277013e7d218234043c2ecd0849879202b291f2a3aa437901596904630226baa64b279440fc2856ee0cec2de21d086b85d93698be574de7d36d52a60eaa0900ed6156f9ad581ff7b9213c04be4c6407044fedd9071125d255b57de2ce7408ffa2e17df0b4a6e1dc4e60d1d1b58c5a59862028d852f11dfc5001dbaf3ea082e5d490a3d8b9810018f233ceb955559bcdf832469c0bc8e61eedd9e0dba0b7532e8a614d5d34500af075756090e0dc33f47f307e311a30465c7988941d4aec51479e58f3c76b912ec4656a3bab356f4d79cde03c012a99f5788f38ce02a20f4a8c2b6cfeb088796dc74b7a72862dfa9c67d56aa21f0e032e3bd767ad3f4dec88aa7a0ffdcc403e3623a6272983b6fdc813df33836feef7e5e8e465822e3ee2c9a960c9b2b01b3a287d5caf99849b011147bc380a30219aa75cb8b1e1bc8cc7ba947c9085f4236171c416e52e144d139c64dc2eaee651aecf08f9c0146528ff19316196c9aa18d60b2a57add4df95fc25729cc128954aaa711c85b4a8b7d2c0969f46cdfd359329860bd331258e89f15f933c5313a19a4ad9e8329f1fd5357c33b98e4f56e8e87a08fd56677677a1aa606627af835b52e9401f799b1a27f794842c9d53352f3568f69f68087e05d8e35659538b933a321277651f6bf45c436c59f8a322d6a6aec7300fc8e2f27fb7a96967fd11aa239af71055f685483f68381c48a7af4c51ac087ae3bd9397321f6e9230ca01e06ceb2b472732f58af71809ba97fa42dfe41aff38a78980893b3fc0cd4a7faa48a6344efb4d525ffa4a86e76fc85f11f6d66081e0341602d61f30188dfa27aa099b124a622f3bb512c80fe61e7eebdd6d1c07e3e2c345188d2cbea0912bf3f3896d546c5f0c73b0a247e1ccb6cbbdc465798173016f1971e28ac4db2c2c788d66ab8ce111697935e7243892f24d04835cc109ba3283097ea3ce21a97347f97c285e0a1e4c6eb2d44a44ebba9a0347959047f244c58e704b7cdfb451fe1a4cb62b88204355469133a7bcb66bd92aea07544cbb423b7998de1549b1df3a423af9cee26f94e61de9b9ce93370ad7e3d94a6ede73a5e785db5726290b9c2c8b8915e06681e264f47c41b0e22e70a63089cdd94bfe19ffbc917e9", 0x1000, &(0x7f0000000040), &(0x7f0000000080), &(0x7f0000000100)="655738888364")
syz_open_procfs(r1, &(0x7f0000000140)='net/netfilter\x00')
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000000)={0x9, 0x0, 0x9, 0xffffffffffffffff, 0x2})
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0)

11.311671306s ago: executing program 2 (id=1150):
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x11, 0xffffffffffffffff, 0x0) (async)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r1, 0x0, 0x0) (async)
r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r3 = dup(r2)
read$hiddev(r3, 0x0, 0x5c) (async)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0})

11.311406016s ago: executing program 2 (id=1151):
open(&(0x7f0000000100)='./cgroup\x00', 0xae502, 0x82)
mount(0x0, &(0x7f0000000500)='./bus\x00', &(0x7f00000000c0)='rootfs\x00', 0x80c000, &(0x7f0000000580)='dax,always')
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r0, &(0x7f00000005c0), 0x10)
recvmmsg(r0, &(0x7f0000001d40)=[{{0x0, 0x0, &(0x7f0000000480)=[{0x0}, {&(0x7f0000000340)=""/97, 0x61}], 0x2}, 0x7f}], 0x1, 0x10103, 0x0)
sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0)
ioctl$SIOCGSTAMPNS(r0, 0x8907, 0x0)
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='exfat\x00', 0x200000, 0x0)

11.181665717s ago: executing program 2 (id=1153):
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0)
mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0)
chdir(&(0x7f00000001c0)='./file0\x00')
r0 = open(&(0x7f00000000c0)='.\x00', 0x4040, 0x1b0)
r1 = socket$inet6(0xa, 0x1, 0x0)
getsockopt$inet6_int(r1, 0x29, 0x38, 0x0, &(0x7f0000000040))
getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8)
arch_prctl$ARCH_MAP_VDSO_X32(0x2001, 0x8)
r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$TIPC_NL_LINK_GET(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010027bd7000fbdbdf25080000001800048013000100"], 0x2c}}, 0x26008890)
ptrace(0x10, r2)
ptrace$PTRACE_SETSIGMASK(0x420b, r2, 0x0, 0x0)
getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8)
r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x60a00, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r5, 0x57789000)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r6 = open(&(0x7f0000000240)='./file1\x00', 0xe142, 0x0)
execveat(r0, &(0x7f00000012c0)='./file0\x00', &(0x7f0000001380)={[&(0x7f0000001300)='\x00', &(0x7f0000001340)='/dev/rnullb0\x00']}, &(0x7f0000001640)={[&(0x7f00000013c0)='\xf3,\'$\\\'\x00', &(0x7f0000001400)='incremental-fs\x00', &(0x7f0000001440)='incremental-fs\x00', &(0x7f0000001480)='[,\x00', &(0x7f00000014c0)=':^\x00', &(0x7f0000001500)='\x85\\9\'))^!%(\x00', &(0x7f0000001540)='TIPCv2\x00', &(0x7f0000001580)='TIPCv2\x00', &(0x7f00000015c0)='/dev/rnullb0\x00', &(0x7f0000001600)='!\x00']}, 0x800)
writev(r6, &(0x7f00000000c0)=[{&(0x7f0000000000)="d0c4c6", 0x3}], 0x1)
writev(r6, &(0x7f0000000000)=[{&(0x7f0000000080)="b6bdd75cd4bf5ff3d96dd44206d2a87078eebdd306b146dc8a55d8c7366c8ec5d201a4065c54183755055b56b185f8387f9e33ea92acfb7c94560ec3a08098f4183e9e95ca25c329550b757dd4b65593a5f23b738dcbe97c1b757c395dc160eee21a772e2a25582e78dd97cf9a3ff00dbef78210c3dcaad269a9db743b8591500917bed45dd23d1d5e780bb1c049dcaaed62e08b0364cad067963e96dedc35c3b3bb8bb65dee673e5767dffbade430aac6c9eaac50caeb3363a7347a3caf3e374d7538ed9fed205cf90853d4fbcbed1f84c1574317b225dfebc5ae862d4f256d38e07fcbeba67231c312b60704c5998a3e781c9c4de874de1091b24e4623b24d1ed39e7aa2159bc038ce85228038a3d83927957e45e206ded57c0139ebfde2fb45d9c09e8c89b0bbb4bb058adf05227befd126bf16381fd48a0f3833c3519ee5c93681cc89a740ad52d159f2b9a6c57ee727c30523600d1e96c9cd6e31928a9291cb2c63148b01aa5af1681a0cb3c4fa5d99ec502e68e75e1f09a3fdc3532d4eee356781c9687cd11daeb6efb8aedc05ce9ef93202a44deba05d10999dadf9949b7230638df99a2fc6040baa9d1e1656c5b20acad5f472da5bfcb3d2dfa69dbce5673507ca95eae7c734ae03f38c917ac399fedcb0d737aa10d17dbd0ee9481c66e34f4d7c9570c563148b967a5c8acdc179c647a85d543ad8dcf7ceb25213a3fa82b585e8c7acbac947dfc2eaf887c0a65a66669bba2b65720a7edfe33202882eb86ba5f3a5fdae7a59faf9e518b24644136538136a5cbeea325fe5b62c4dfd2bb1d1e7f4762fe5eca8d2f7566cd93000b0bd17dfe13be74be65f73d496b37b3cbf8498c58354e68b6b0cd441d90302804e9f32145b678cff32b89f869a7897fb019f48a4479f3d647a5f5582bb8caced2220f92ec5e410282b71566f50a3f4436c33c358c5cda2f716dae450f2409f87d7e5be2e7676b6a5433d686bfd0cf8703ce035f02e22ebb8f3cc4d11cfb35cb46778f8e374685490a2a9ea8984dd9a91816e5bafeef495231c833e07ea94357e466f53b14665d85ca1ab6a72af203d884d2f2435109caca2b7d7a4b2e3fcda6ce42e064fd3fb0f62fdc11c722830d436de480554bb16246dc6de79aad051874a85fb82581885e87428e027490a85ea26c4de51df869b1fd0a13a63ab50b68b75484d1ed0685540779ef7181b09b9f7049e2b602d7aa273b5d109dfac776feda3d23dc97acc6229638da5f7d223d549dc40ed2bbcc5161c4805bd97a4a916686821c1b580c41c2a4c9dae23a621a055e26eeea9a16e7236e1811d2bfd34cf8a1c0772572465e4646cc5840b77da84d16bb43bf94a2f21d0a70d5d4a1c30f76a915c8d0f9dd78c42f45bf08fa13f1ea2921ce942605f46850247916198658aab398ab47000fcd995f233b520eb017f2fa8afa9fc4c4c762cdd684c48888805e5ef92180518a8eaf7a8558ab64b50a0e141a1ebf99c3abac2441100b5a904a3f46e34bbf8dc8c6627f6eb83ec63f3edb76b99d27817c9dee9fd00bf5a84d3d84763ed0c87ae34c174fbc86fedb5bef3b00e2acd35e57c231e875661e111a2c95f516a05c71a58e0157e33b1ed12afff9da50e78306f787adc825e878a1084691a5c417900961883014ea7ea74c4f2a642193a09b52cb0aa08d21e95058f7f51a106a086ce8bdc55be1d40f5f2c2b1b00b49a0a037db794c70cf789ac5e57add05200ae75055b2bb20035fade4e495c7f36c31a432573c14f0bc54b0734a2dec0bc4b316170744706fb1749e01b23b59ce186d4e0c35cd9fd1abcd1805122ba106068d6ed772c2021b6f1bd1b84695817622d0c708333b93a2eb75a39b85fead5549ba99ce6e048e4b64edfb8a3a869f3475dc906ae6d021894379298bd7f7296bfedaed84bf7da23b8aa96a3109a4106095931141974be0632cd36d21d0b1985f953c311d09e18c861b4973d3094277ff3e996f5a83317d4ddb5dad5bbd63374a22a190d049f460ee056286d095966e90df3b925987313854a2890b95c47a7e1c8a6659d91e81f021a7ca37b00e487756403201b3492e500b8f2720a169319f53de86691b033da3b0fd74706ce9bbc4b9460d36a3156cce0325c0f7528dfbfd30142de725f77366608e6a775794eb83cf7ab35db786797b52f0cea09b3682c676d58ac573721a310c962fd990e096fd0cba4287b8079392aa29cc65ede83eff13d3b0df64e0c07e88fedb0444dba4a13f7132fcf92eb58a9192f64f93efc432d8bf294c9067c06514bdf999158d5627d11ba8d639d035a97fa3d7f1f3ba0f8a00f3ae982ae9824289b8b68ab8727093da008036cd58c3a3d0971cff1cd7ac36e533f9924be6ea5973395f49104fab1ba2e3f519a89928dd5eeec4bd0aa36dded27eebc2418d48a6341d1176c154b82b8c46589c3f56429f787808ab4952d7a8c9c046f91c0b2943ce3e4114325168cf456256b7d9937e1a250e85ff81f153d520fabf0eccbc996d1dab1034bb45343d166a1ee213d5a17c397f236f06d6e68d896f0082e893dc389893e5c0624de68e0f1675c2a1edbf8a018431f5bf0bbd9b1d16a292dc6ac2b4960ad7b14a83af316b4578e237a1f4b13adcaf4f4f72c7af65f2874a033e9f243b0530f702cf49924a460e36825e079211e2d5ffac402e5d2e5e897f49fbd351189b758f38883c86acd0bbb7cc667d242dfe5b5210b71fc6dc959a4fa4d2e60f08be92a639a277e1acc2c464791c08749ced63ea210778171a7dd17ad8253b63680759f6c6afb4ce73658f2c5a8c6eabd2088a334672ed18c0c97875a520e2c8bbc1ecdcb58cc9d7e66330a07d4d88771e2beb9dd29688b2f2e6f22600cdf36d1f889455951760e4b45b8d1996fef5ee0fa6b6a5f936c350c77dc3f70095c5c32303b7d37e4f4e3ccdbb70b3cb16e4e7c8bfb4872a94ec3a6c968090c6df906f8876f59edf7acf76e12b4c45a74839c6da5601293e4580df45982c9dd9ab08553fa55406e33af69629194f3fd07db9f2140aa5cc2d8595c068d50b82a99c90132941bb66df433e3a1870e54287dd8e7d7ae501627876884f595db01f978ce405230903a02db4585e370f91947e5a5c77a2fe0e2696fed44fa1d60f54cb39821c3195877878782e4a32c2540a4a0ecebb0740f94db1d63ab5c122feb916dccff764899243a5b706c81841ff45cd69c3b35fd8c108b462c3af0be0f57b8767a6fcb17e75fcec7db22b96e7009abf29ab515be4459ff902f532629f1dcfa6dea42a0b211c77fab16250971f19024e43353e3c2caf012555f817fc13b58cbef55ab22609d4e6d89363319cc24d592345f9b67e0d75768f324fef71a139190240b55671ea8bbd6e7282974a647b40737b2741d562155bddc9c87f06299b38d3adb55285facb08191413a4d6dd98ac6f682691975a367a719cdf5b51ba02c2ac4991248851974be627a7f394d23fe7c18c3d1fe2d2585213f563be51bf5995d21d7e987dd3f511f5e0901f95af0c91b3d2cb93fe079433b9a6d55ca9bc429e061e5fe7567dcf31d6ed5de6857cd9ca209301fdf6c0dba2fbc57de25db390a417b478cb71f27ffaab2b446f71cf446e988fdc43e9146996036594cda96761d9c0fb8d1459b5da0c4eaed06998f1cb775b148a7732965563eae7c9231a0f95be22300bf1002809648def2ddf7a2db433da476d79de11a6a67d614655178fe84e2717b2183f12620a8ef016044afebacf17f72ec5fd279084f432c34a140d5c7cd6393f4b458d3593ab2b05953b77dd674fb7957e123982f59c054f803b566e5f8bffd8ae078df816f44013c1869e00a90ae5106c7b8a7bd5916607ed8cc16f1992c9e27cc437d93c8d098c8dd7a1fe2a138c1093a223a023968ba0f9f4a132b62e43e6f5d4ba6d7476f7e1eecc8efec97b959cdacd57df47a75e3db743369c705604982407f96009565424b5f1ee470efe742c1bca801815f8807be545802410a81aac0dd9718ce10f32b0c78ffd72ace78fb6955452038be38863928b96abe1542b0cef00c4dafb1bf0afe2641a546327e6e36bc9c131bec7519f38bf6fa83b9b81431ef7530d9223308ddc3d182aa877d3690efd85b25c0d832278a368cd61aebc2239e61a9f8a3657825a692d10aabf0b777b78f48f5be9a34302a9f1049c5daa6abb87e6205b890037eb4288b091a485b656bb7d03884844308462c0b702e9c03c81560647e94814fe51510702e395ba0bb8deda92b605558992b773dad1d7c8df958e6e2bb938aa3077d78d4ea11f55d47e4f0b35de11555333a9ce51aa130db9242c64a3c56f4e52d289831d5dfd93237bf75f4c74ffba1275754b831a2c7d0ca9eec0910ef6899f11955212d7e374adab146da44688e48e5983d29b79cb46770d122483d979416fe90e6460cb75552803afdc67d5c098d30c96f4be6c17a0b2555d48bbdcea0bc0100704de40cb77c52d3260ea11f8b8fd36449ff1eaa404e7c2c3d791010adeecbb6a6fe02976393354d03b7d8971007a9d69ffec33dacafc77a482591d4a1682bd2f5e24dee3ca2348cd2d8c9ebccf554f7b2bd7d7a9569ef5691e8891785f487a821d8fcffa18853aa9e78b3c1b0b5e125fad83d81cd4065045136d3ee20bebc50994da29886c46f1cf1064c8bf872a6bce45ecdaa1f703dc0b48212a1f2416d9d2a9785b90237935aea73a352c773cde93f99db027e00fe8b2d09cd97e8b48ea17737596a73c11afcc8ee3289a978294b3c708401ac969826582e21b3d6ad35be8829b170e67214465f16c2a38b6f8b31fabd5b6d00e7930fc10e6be29e44ec4fbdd03bde043bb7cd5765eb45c65f006912b15865b77849e9ebf41f943a87f8d34b74bd87a5a993c14c663758a6e7077511651345582283419aa36987a21e3deb7bd62131abe35c539d540206eea4e422dd89abf6027e91a9cdbc0b0ce49ac9267a6d44eab12659b7a1b7a96159bd8ece3507e3e8c1c526c544871c2939e66c840705742e3934f7e45d46f57e1250d95b60d3037d3f228ced8f06bedc8f6736df47ed7915f574ebf5a0fd06a6e4fa8799989ac621bcda4d03bf69183492ac88de695dc326b3298eec24587a12f071eff5ef1444d5f86d29f1df8481bd2ca0e592101692795ef47b88d9a60f370909d7c2a392caf24c88c4da908b7dc798a8882373d08d34af38971904984e5783c5ac3107ef8303aeceda93c6785543dfc778558a402f8fa0822990c4205c9ded201035fcf30171ff168ab6197a0dcb7f9577fdcb2e1c68a7e85d710807ff7314d2e79d375297ab3cc14930ef4b22a2b2efa56460b19653725541b7a87ecb868cb80f0325891785392d428730c1c85740256425bc47af577bf7122a8d2d2e3c30d3bcfc72ca3320de00bf4019ff1ba6e64e33df3daec1402f73bf5fb648e28bc1d46ee99cb5680e8fd4db7dee3a148c9b7ca2b962959a77aa1074eb7c732ac8fa73d283b6a6df9077183de0230846aac1bcc2894381bcdbaa678a2af81c008a2fd36dc9f0edb0a1f99cb5300afc48017876a6f25a395bdd29efd3bf4e43ee453b5691b7bd5ee30b359dc3c422c220271c027713686159f6d4c9bba38208f1febc0902a4d61e51dc2638a881bee5e4234b22eea85fbe73e7e4035cd9dcec2d892afad762ab268b2d404ae82e7f73fa9db80122957d7330abe6f49ea096ca90e901c358c815b9174ddbbc3f3dbbc813061e858b4a87d310bd3eccfe9efd682a6f3e47aa858acf9cf779ff38accdf6b4c05a6ecf28d", 0x1000}, {&(0x7f0000001080)="f143a645c941bf60a4bca610158e9a4d3beb11d8d0bc155c7268b0ad946d1a01934d98c7d25979b6e3a1a3ad7c1567e5c4cc0d5b96298ac64bf56f7d9992ad518c56f0c9b271876590bab08336c570efc0e27450921b6f88ff166b2a5a769f3b626d592662d11933cfc00004f9d205b18a776e39318567870f1c434fb1580759634b489e82c9cd520a8fc085627bd475253febb9b2813c62eafa1ab22bb6897a0c0a1c18227ce1ced3d12e5923b2aa0b060a8edfd655aa3c631b31e5b433", 0xbe}, {&(0x7f0000001140)="5e753ecb6bdcb7e5354322a74f076ef6ac1886518ec1e70a07a28e3084548b7c0055d036e185600363ebb884d99451fc3b98308190b239a04b64565a3a73834dfd76040b4cd69c9a3320bf68b6a5f38a05d6b43a7b6ceb8f9f13ed1b2ef4d17390078c5fbd757d28f259e30626e66d9468760bd4eedeeeb939e4fe72f60bdfa535eeb52d690d4dd387c437a93dc5ba31984bf168a42bf6c973f7a45e23d972e6fcd870b420", 0xa5}, {&(0x7f0000001200)="450404f6b1f78738b02537090419e3ea99ec972e53797f5292c526006432f72e4c457eba1f510ecbe6294acf06347a6dd7b854be7d498e1c9de29b3b7289df6020d6b9c007c1a814d85d1dc7e6fcf9563d4154fcb86f7da9044683c3143afef2cc37adbaa263380d829ab76aee6e4e780ca77aa9bdee74ba926651a6e1adaca79a32efef15a116ef078871be9423b912314d70b46b171392320835ff446845e84ec28e08c3ec", 0xa6}], 0x4)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
ptrace$PTRACE_GETSIGMASK(0x420a, r2, 0x8, &(0x7f00000016c0))

10.939970236s ago: executing program 2 (id=1154):
r0 = add_key$keyring(&(0x7f00000001c0), &(0x7f0000000200)={'syz', 0x0}, 0x0, 0x0, 0x0)
request_key(&(0x7f00000000c0)='encrypted\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000140)='/dev/ashmem\x00', r0)
r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0xa)
ioctl$ASHMEM_GET_SIZE(r1, 0x7704, 0x0)
ftruncate(r1, 0x5)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x31, 0xffffffffffffffff, 0x0)
signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x2000000002]}, 0x1, 0x40800)
mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x8010, r1, 0x0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CAP_EXIT_HYPERCALL(r3, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc})
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x3)
r5 = socket$inet(0x2, 0x802, 0x1)
connect$inet(r5, &(0x7f0000002780)={0x2, 0x4e24, @loopback}, 0x10)
write(r5, &(0x7f0000000440)="08008edf773c8000", 0x8)
read(r5, &(0x7f0000000100)=""/39, 0x27)
ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f0000000bc0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535ef976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fce30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac353b21fe733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52af50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc409541aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d7e083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e684fe16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472787621147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f149319f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600"})
ioctl$KVM_GET_LAPIC(r4, 0x8400ae8e, &(0x7f00000004c0))
read(r1, 0x0, 0x0)

10.938119407s ago: executing program 2 (id=1155):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0)
creat(&(0x7f0000000100)='./cgroup\x00', 0x2c)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil)
r2 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc))
madvise(&(0x7f000042f000/0x800000)=nil, 0x80fd00, 0x15)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0)
ioctl$KVM_CREATE_VCPU(r3, 0x770a, 0x2)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
r4 = dup3(r1, r0, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x6, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0})
socketpair(0x25, 0x6, 0x7, &(0x7f0000000000))

10.914069638s ago: executing program 37 (id=1155):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0)
creat(&(0x7f0000000100)='./cgroup\x00', 0x2c)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil)
r2 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc))
madvise(&(0x7f000042f000/0x800000)=nil, 0x80fd00, 0x15)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0)
ioctl$KVM_CREATE_VCPU(r3, 0x770a, 0x2)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
r4 = dup3(r1, r0, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x6, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0})
socketpair(0x25, 0x6, 0x7, &(0x7f0000000000))

2.557440643s ago: executing program 8 (id=1246):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x14)
r2 = socket(0x10, 0x803, 0x0)
sendto(r2, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r2, &(0x7f0000009080)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000001580)=""/4096, 0x1000}, {&(0x7f0000000040)=""/190, 0xb8}, {&(0x7f0000000580)=""/77, 0x4d}, {&(0x7f0000000600)=""/101, 0x31}, {&(0x7f0000002580)=""/4096, 0x1000}], 0x5}, 0x5e}, {{0x0, 0x0, 0x0}, 0x4}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0xffff22cb}], 0x4, 0x2, 0x0)
openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0)
mmap(&(0x7f0000060000/0x4000)=nil, 0x4000, 0x3000001, 0x50, r0, 0x147a5000)
r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00')
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0xc0686611, &(0x7f0000000000)={0x67, 0x0, 0x0, 0x2000, &(0x7f0000ffd000/0x2000)=nil})
ioctl$KVM_HAS_DEVICE_ATTR_vcpu(r3, 0x4018aee3, &(0x7f0000000000)=@attr_pmu_init)

2.47604863s ago: executing program 8 (id=1247):
mkdir(&(0x7f00000020c0)='./file0\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mkdir(&(0x7f0000000200)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0xf9fd, &(0x7f0000000500)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@uuid_on}]})

2.4754207s ago: executing program 8 (id=1248):
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80982, 0x0)
write$vga_arbiter(r0, 0x0, 0xff35)
socket$inet6(0xa, 0x2, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
readahead(r1, 0xe9, 0x0)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x2, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = getpid()
sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7)
r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='environ\x00')
read$FUSE(r5, &(0x7f00000048c0)={0x2020}, 0x2020)
sendmsg$nl_generic(r3, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000340)={0x160, 0x2e, 0x4, 0x70bd2d, 0x25dfdbfc, {0xa}, [@typed={0x14, 0xb, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x22}}}, @typed={0x8, 0x97, 0x0, 0x0, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}}, @nested={0x14, 0x11d, 0x0, 0x1, [@typed={0xc, 0x9a, 0x0, 0x0, @u64=0x5}, @nested={0x4, 0x2}]}, @nested={0x100, 0xdb, 0x0, 0x1, [@typed={0x8, 0xb4, 0x0, 0x0, @pid=r4}, @nested={0x4, 0xcc}, @typed={0x8, 0x49, 0x0, 0x0, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}}, @nested={0x4, 0x147}, @generic="c5ba224d489ddc471877d0a81f0b5527d32db7fa1dae23ea517e7b78103efbd84082e8a0a18a76acc104", @typed={0x14, 0x50, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @generic="a32614ac1604c4c5067ca23ac849a8c99098c2352022951201584f5440c7b45d4485ed2bec44d101a5d4f9eae9b151dfc0f8ecb5258bea8006e4acf25ccab7bd8a517e8182b66c1999c112f6626e33bd978ba47a0e75ac2ef492664488ba37b956e8d03d1aeffb6a6ade797e2f939760b8a0b92217a172c2c6fb9fec5e69c6e48fc4acc4e342", @typed={0x8, 0xa3, 0x0, 0x0, @fd=r5}, @nested={0x4, 0xf6}, @typed={0x14, 0x13a, 0x0, 0x0, @ipv6=@empty}]}, @generic="918d228bae58ee16b9e34988679a0ea8a2643c672390512d6048aebf"]}, 0x160}, 0x1, 0x0, 0x0, 0x80}, 0x8000080)
r6 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00')
r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0)
r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(r8, r9, &(0x7f0000fda000/0x18000)=nil, 0x0, 0x0, 0x10, 0x0, 0x0)
ioctl$KVM_SET_MSRS(r9, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x48a, 0x0, 0x1}]})
mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r2}})
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80982, 0x0) (async)
write$vga_arbiter(r0, 0x0, 0xff35) (async)
socket$inet6(0xa, 0x2, 0x0) (async)
socket$inet6_tcp(0xa, 0x1, 0x0) (async)
readahead(r1, 0xe9, 0x0) (async)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x2, 0x0) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
getpid() (async)
sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) (async)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='environ\x00') (async)
read$FUSE(r5, &(0x7f00000048c0)={0x2020}, 0x2020) (async)
sendmsg$nl_generic(r3, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000340)={0x160, 0x2e, 0x4, 0x70bd2d, 0x25dfdbfc, {0xa}, [@typed={0x14, 0xb, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x22}}}, @typed={0x8, 0x97, 0x0, 0x0, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}}, @nested={0x14, 0x11d, 0x0, 0x1, [@typed={0xc, 0x9a, 0x0, 0x0, @u64=0x5}, @nested={0x4, 0x2}]}, @nested={0x100, 0xdb, 0x0, 0x1, [@typed={0x8, 0xb4, 0x0, 0x0, @pid=r4}, @nested={0x4, 0xcc}, @typed={0x8, 0x49, 0x0, 0x0, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}}, @nested={0x4, 0x147}, @generic="c5ba224d489ddc471877d0a81f0b5527d32db7fa1dae23ea517e7b78103efbd84082e8a0a18a76acc104", @typed={0x14, 0x50, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @generic="a32614ac1604c4c5067ca23ac849a8c99098c2352022951201584f5440c7b45d4485ed2bec44d101a5d4f9eae9b151dfc0f8ecb5258bea8006e4acf25ccab7bd8a517e8182b66c1999c112f6626e33bd978ba47a0e75ac2ef492664488ba37b956e8d03d1aeffb6a6ade797e2f939760b8a0b92217a172c2c6fb9fec5e69c6e48fc4acc4e342", @typed={0x8, 0xa3, 0x0, 0x0, @fd=r5}, @nested={0x4, 0xf6}, @typed={0x14, 0x13a, 0x0, 0x0, @ipv6=@empty}]}, @generic="918d228bae58ee16b9e34988679a0ea8a2643c672390512d6048aebf"]}, 0x160}, 0x1, 0x0, 0x0, 0x80}, 0x8000080) (async)
syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async)
ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) (async)
ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2) (async)
syz_kvm_setup_cpu$x86(r8, r9, &(0x7f0000fda000/0x18000)=nil, 0x0, 0x0, 0x10, 0x0, 0x0) (async)
ioctl$KVM_SET_MSRS(r9, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x48a, 0x0, 0x1}]}) (async)
mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r2}}) (async)

2.392042016s ago: executing program 8 (id=1249):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) (async)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x8, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x3}], 0x50, 0x0, &(0x7f0000000380)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) (async)
mmap$binder(&(0x7f0000ff8000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x6)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'ip6gre0\x00'}) (async, rerun: 32)
ioctl$FS_IOC_GETFSUUID(0xffffffffffffffff, 0x80111500, 0x0) (async, rerun: 32)
mkdir(0x0, 0x0) (async)
mkdir(0x0, 0x0) (async)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
getsockopt(r1, 0xff, 0x1, 0x0, &(0x7f0000000040))
open(&(0x7f0000000080)='./file0\x00', 0x48141, 0x67) (async, rerun: 32)
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000f478ef8ed"]) (async, rerun: 32)
r2 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async)
ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0xffffffffffffffff, 0x9, 0xfffffffffffffffd, 0x0, 0x10000, 0x10, 0x4002004c4, 0x1000, 0x0, 0x0, 0x0, 0x5, 0x0, 0x9, 0x0, 0x7], 0xeeee8000, 0x160091})
ioctl$KVM_RUN(r4, 0xae80, 0x0) (async)
ioctl$KVM_RUN(r4, 0xae80, 0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) (async, rerun: 64)
r6 = fsmount(r5, 0x0, 0x80) (rerun: 64)
r7 = openat$cgroup_int(r6, &(0x7f00000001c0)='cgroup.max.descendants\x00', 0x2, 0x0) (async)
mprotect(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x100000b)
write$cgroup_int(r7, &(0x7f0000000140)=0x9, 0x12) (async)
r8 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x442302, 0x0)
mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000002, 0x11, r8, 0x45809000) (async)
socket$inet_udp(0x2, 0x2, 0x0)
syz_open_dev$rtc(&(0x7f0000000040), 0x6, 0x8100)

2.376098828s ago: executing program 8 (id=1250):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0)
r2 = socket$packet(0x11, 0x3, 0x300)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3})
ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x89a0, &(0x7f0000000040)={'syzkaller0\x00'})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'syzkaller0\x00', <r4=>0x0})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000100)={r4, 0x2, 0x6}, 0x10)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000080)={r4, 0x1, 0x6, @random="0b65c01cd7d3"}, 0x10)
r5 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r5, 0x89a1, &(0x7f0000000040)={'syzkaller0\x00'})
mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3})
mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0)
r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
ioctl$sock_SIOCGPGRP(r6, 0x8904, &(0x7f00000001c0))
getsockopt$bt_l2cap_L2CAP_OPTIONS(r6, 0x6, 0x1, 0x0, &(0x7f0000000040))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfee, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x40000000000000, 0x18}, @ptr={0x70742a85, 0x0, &(0x7f00000029c0)=""/201, 0xc9, 0x1, 0x14}, @flat=@binder={0x73622a85, 0x1001, 0x3}}, &(0x7f0000000180)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0})
openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) (async)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) (async)
socket$packet(0x11, 0x3, 0x300) (async)
openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) (async)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) (async)
ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) (async)
ioctl$sock_SIOCGIFINDEX(r2, 0x89a0, &(0x7f0000000040)={'syzkaller0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'syzkaller0\x00'}) (async)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000100)={r4, 0x2, 0x6}, 0x10) (async)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000080)={r4, 0x1, 0x6, @random="0b65c01cd7d3"}, 0x10) (async)
socket$packet(0x11, 0x3, 0x300) (async)
ioctl$sock_SIOCGIFINDEX(r5, 0x89a1, &(0x7f0000000040)={'syzkaller0\x00'}) (async)
mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r1, 0x0) (async)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) (async)
mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) (async)
ioctl$sock_SIOCGPGRP(r6, 0x8904, &(0x7f00000001c0)) (async)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r6, 0x6, 0x1, 0x0, &(0x7f0000000040)) (async)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfee, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x40000000000000, 0x18}, @ptr={0x70742a85, 0x0, &(0x7f00000029c0)=""/201, 0xc9, 0x1, 0x14}, @flat=@binder={0x73622a85, 0x1001, 0x3}}, &(0x7f0000000180)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0}) (async)

2.191999583s ago: executing program 8 (id=1251):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0)
r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12dfffffff0000406a0500000000000000000902240001000040b109040000020300010009610101000132050009058103ff030c0000"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
r2 = syz_open_dev$loop(&(0x7f0000000440), 0x81, 0x2a82)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0)
ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f00000005c0)={r3, 0x800, {0x2a00, 0x80010000, 0x0, 0x7, 0x100000, 0x0, 0x3, 0x14, 0x0, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd6447a4b4e00d9683dda1af1ea09de2b7fb0a0100000000000000000300", "2809e8dbe108598927875397bab22d0000b420a9c81f40f05f819e01177d3d458dac00000000000000000000003b00000000000000000200", "90be8b1c5512406c7f00", [0x4, 0x40000000000000]}})
ioctl$KVM_CAP_HYPERV_SYNIC2(r3, 0x4068aea3, &(0x7f0000000100))
mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', 0x0, 0x4800, 0x0)
syz_usb_control_io(r1, &(0x7f0000000340)={0x2c, &(0x7f0000000040)={0x0, 0x7, 0x7, {0x7, 0x0, "00f4000000"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2)
syz_usb_disconnect(r1)
close_range(r0, 0xffffffffffffffff, 0x0)

1.515961547s ago: executing program 7 (id=1264):
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000005e80)={0x28, 0x13, 0x1, 0x2, 0x25dfdbf6, "", [@typed={0x7, 0x0, 0x0, 0x0, @str='\x13\x00\x00'}, @nested={0x10, 0x2, 0x0, 0x1, [@nested={0xc, 0x139, 0x0, 0x1, [@nested={0x4, 0x2a}, @generic="85ca4e10"]}]}]}, 0x28}], 0x1}, 0x0)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x802, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2})
ioctl$TUNSETGROUP(r2, 0x400454ce, 0x0)
close_range(r1, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000), 0xbd, 0x0, &(0x7f0000000140)="4643b7aa61e8b9667149c667d869ddf2015c60921a21251e5d4709b75899a862ed399029d78329f0dd1d0ad833f3c41deb673b155a1dfa107834574f669fb366e8c0286e13c76e7d10480e663cf6f2df66094c9e202d14cf1f82aaaf4d64080509417dc10f4fd7bf460b28eed01dd74c64ad40896e0843d63945f1300695d4d6ecccd7147b984719fade2375e465175d71f181aa23dcf2e9e2609efc8905d7beec7f8b45154b306bd2ab8724899d76a58a7ec066e15488f66334741000"})

1.515728017s ago: executing program 7 (id=1265):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$inet6_int(r0, 0x29, 0x16, 0x0, &(0x7f0000000180))
r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4, 0x20011, r1, 0xd6baf000)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, 0x0, &(0x7f0000000980))

1.508539287s ago: executing program 7 (id=1266):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167342, 0x0)
openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0)
r1 = socket$vsock_stream(0x28, 0x1, 0x0)
r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000002800), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_GUEST_CID(r2, 0x4008af60, &(0x7f0000000040)={@my=0x1})
r3 = socket$vsock_stream(0x28, 0x1, 0x0)
connect$vsock_stream(r3, &(0x7f0000001500)={0x28, 0x0, 0x0, @my=0x1}, 0x10)
bind$vsock_stream(r1, &(0x7f0000000440)={0x28, 0x0, 0x0, @host}, 0x10)
connect$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2710, @hyper}, 0x10)
connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0xffffffff}, 0x10)
readv(r0, &(0x7f0000000140)=[{0x0}, {&(0x7f0000001400)=""/4096, 0x1000}], 0x2)

1.22932606s ago: executing program 9 (id=1269):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) (async)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000200)=[@enter_looper], 0x50, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) (async, rerun: 64)
mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async, rerun: 64)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x66, 0x0, &(0x7f0000000000)="8b0b4c404964a6ef39f577efb9c2c64f47b576cec3dab5adbd25d802c31aa20f47283d909cfc1520a8ebb223d441539406505ea001848d180490b7a70bc561639b136ecae6c156d04957029916c1b24ba79c86ea868361e54db024065b65abec8a897eb9f873"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f00000004c0)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0})

1.038937876s ago: executing program 4 (id=1270):
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x2, 0x0)
setregid(0x0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f00000000c0), 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}})

665.492386ms ago: executing program 7 (id=1271):
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_mreq(r0, 0x29, 0x1d, 0x0, 0x0)
r1 = socket$inet6_udplite(0xa, 0x2, 0x88)
connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e21, 0x659, @empty, 0xff}, 0x1c)
r2 = fcntl$dupfd(r1, 0x406, r1)
write$cgroup_pid(r2, &(0x7f0000000240), 0xfdef)
read$FUSE(r2, &(0x7f0000000700)={0x2020}, 0x2020)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r4 = socket(0x2, 0x3, 0x100000001)
setsockopt(r4, 0xff, 0x1, 0x0, 0x9)
r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0xfc}}, 0x0)
r6 = socket$inet6(0xa, 0x400000000001, 0x0)
sendto$inet6(r6, 0x0, 0x0, 0x20004048, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @mcast1, 0x4}, 0x1c)
getsockopt$inet_int(r6, 0x0, 0xe, 0x0, &(0x7f0000000500))
r7 = dup(r5)
ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil})
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4000050, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c)
r8 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0)
ioctl$sock_inet6_SIOCDELRT(r7, 0x890c, &(0x7f0000000280)={@mcast2, @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8, 0x6, 0x51b0, 0x500, 0x1, 0x80200002})
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0)
syz_kvm_setup_cpu$x86(r7, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f0000000180)="8359092266b9260b000066b80c00000066ba008000000f30baf80c66b8812d128666efbafc0cb0d7eec013250f4c0c360f7965000f01cfdd71dc12df0f01c9", 0x3f}], 0x1, 0x4, 0x0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19)
r9 = socket(0x1e, 0x4, 0x0)
mremap(&(0x7f000000d000/0x2000)=nil, 0xfffffffffffffe74, 0x1000, 0x3, &(0x7f0000007000/0x1000)=nil)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
madvise(&(0x7f00007a2000/0x2000)=nil, 0x2000, 0x16)
setsockopt$packet_tx_ring(r9, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x9, 0x9, 0x7ff, 0x5, 0x5, 0x8, 0x10001}, 0x1c)
setregid(0x0, 0x0)

487.94776ms ago: executing program 7 (id=1272):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1002, 0x0)
ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = socket$inet(0x2, 0x2, 0x0)
ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000140)={'wg0\x00', <r3=>0x0})
sendto$packet(r1, &(0x7f0000000100)='0', 0x1, 0x4044000, &(0x7f00000001c0)={0x11, 0x88fb, r3, 0x1, 0x5, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x32}}, 0x14)
socket$nl_generic(0x10, 0x3, 0x10)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f0000000100)={0x4})
close_range(r0, 0xffffffffffffffff, 0x0)

459.738313ms ago: executing program 7 (id=1273):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0)
r1 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x56a, 0x19, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x90, 0xf1, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x101, 0x7, 0x1, {0x22, 0x4}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0xc, 0x6, 0xc}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0x8, 0xb, 0x2}}]}}}]}}]}}, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io(r1, &(0x7f0000000340)={0x2c, &(0x7f0000000040)={0x0, 0x7, 0x7, {0x7, 0x0, "00f4000000"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2)
syz_usb_disconnect(r1)
close_range(r0, 0xffffffffffffffff, 0x0)

402.822797ms ago: executing program 9 (id=1274):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20c000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x31)
r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080)={<r3=>0x0, <r4=>0x0, <r5=>0x0}, &(0x7f00000000c0)=0xc)
fcntl$setownex(r0, 0xf, &(0x7f0000000100)={0x2, r3})
ioctl$KVM_CAP_DISABLE_QUIRKS(r1, 0x4068aea3, &(0x7f0000000140)={0x74, 0x0, 0x54})
close_range(r0, r1, 0x0)
ioctl$AUTOFS_IOC_EXPIRE_MULTI(r2, 0x40049366, &(0x7f00000001c0)=0x4)
ioctl$EXT4_IOC_CLEAR_ES_CACHE(r1, 0x6628)
r6 = syz_open_dev$evdev(&(0x7f0000000200), 0x9, 0x240)
ioctl$EVIOCGKEY(r6, 0x80404518, &(0x7f0000000240)=""/152)
r7 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$MRT_INIT(r7, 0x0, 0xc8, &(0x7f0000000300), 0x4)
ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000340)={0x7, 0x3ff})
r8 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0)
read$FUSE(r8, &(0x7f00000003c0)={0x2020, 0x0, 0x0, <r9=>0x0, <r10=>0x0, <r11=>0x0}, 0x2020)
timer_create(0x6, &(0x7f00000024c0)={0x0, 0x3d, 0x2, @thr={&(0x7f0000002400)="99061223aa5b06b369919d425c923fe9dfe991af4142494a86bca644234b2441d03e331ab6b54c039aea00044049", &(0x7f0000002440)="0c764a032374a9e0eedfca084f68c79f3f114272a204101745818b2797afea8ea8169648484bebf081cce9e26415094a6be34c1a917ba8c346f4696e29053f2aae3cb1512a624ad94603a23264bb1476ec2ea637ad57162341f5f95cefca7f0809bc9649be1cc6bf7083fe8401a374513b802f793023409d"}}, &(0x7f0000002500))
read$msr(r1, &(0x7f0000002540)=""/244, 0xf4)
timer_create(0x2, &(0x7f0000002700)={0x0, 0x20, 0x2, @thr={&(0x7f0000002640)="9d522bab9dc4", &(0x7f0000002680)="82abdf996bbfa9fee42f4fd695dbbb4325ded467e0e93fb8d0cb8dada884f5afc43b59024f8072de096ba2804b594f08e318109882ebccae8251a04c5e091cdd3f8823c055d25260b83aaa4204d394ff31fdacd187c945dd6d41c2b176a06abf9f74d5104705ddb0448c345a7780fed450709c273ad2202d"}}, &(0x7f0000002740))
ftruncate(r6, 0x180000000000000)
pipe(&(0x7f0000002780)={<r12=>0xffffffffffffffff, <r13=>0xffffffffffffffff})
write$vga_arbiter(r12, &(0x7f00000027c0)=@unlock_all, 0xb)
sendmsg$NFULNL_MSG_CONFIG(r13, &(0x7f0000002900)={&(0x7f0000002800)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000028c0)={&(0x7f0000002840)={0x44, 0x1, 0x4, 0x5, 0x0, 0x0, {0x5, 0x0, 0x6}, [@NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x7}, @NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x1}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x5}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0xf}, @NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x4}, @NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x933bb888cfd60eee}]}, 0x44}, 0x1, 0x0, 0x0, 0x680d4}, 0x40000)
fremovexattr(r12, &(0x7f0000002940)=@random={'user.', '^,,$,*&\x00'})
signalfd(r6, &(0x7f0000002980), 0x8)
stat(&(0x7f0000004f40)='./file0\x00', &(0x7f0000004f80)={0x0, 0x0, 0x0, 0x0, <r14=>0x0})
stat(&(0x7f0000005100)='./file0\x00', &(0x7f0000005140)={0x0, 0x0, 0x0, 0x0, 0x0, <r15=>0x0})
syz_fuse_handle_req(r13, &(0x7f00000029c0)="24dd5530c927f9c315f274341f38f04613322aaf98db6393468241858abf8b8ec478549ef9f73f1cf2fedd956337c0131a7cb9e3149f30d74700b745908655d61331900f0b2afd6cfd9c0fe42dac386bca30d6ea7ac9a2c385abea3b3570d0e0aa94aedb8a676e5d447af7b16ddab394dd69c0c0f1b64aa5354e37b918e8f97b90485dc8c48e6dbd578133507d2dd2907e5828e9dc617f834548050762ebb3fc6be5b07581925eddc5587725bfc5b4a12d78cbd1359345842e7fed7e669bf63d601df22749ec25bd6cf81db0cffa39617731f61c348f274c3862c9eaac8d6dab4b6b97656df1d4014f8414af5d9be5b08eccd186eb4dca241864500c060c94d6bd7ec96cf46cadb4d032ae095cba335dfda9d304f50481fb139664523e8bdb71926d813392b0ebfb16324ef008db60d8ecce9532de811bff72c5503e4d9ee10317ed11b815124b015e104595b2d148064db39c4faf80000eb4027ac029b9e192e24b2fab3bea65c9fe58cc182981d8b6f55fadbd89f7182af0905772cb3cd0e52980ad22bdae4795107644d30eebbbe11d8edb7b4ee788e65893cef2a91fefb3fea134b3795c74886a70663056b76eb1fb5ce270cd488e90898bd5d00c69c1ba4be41f17388eae02403fd48f8377bd1595e9b8d25855f27c8d729c047fbd462ecf4c976b6d129dc2fa29a173a8af9c639140e42007b46d6d5cae8469e000435cd8ebb02a4b400219ee562dad6523248f410c5d61e1e60dc12b8a962099843e73353e49514256fec797eb4601a70bc4b0abaf9fd0f138530709283dbe2a1ba63746fa36371d692fc0a67fe72d834dc6841141bb9f9162029471b09c343b62266de4a2e46577a843150028379af819fff4c50dfac7869e7eac4c3fde56d8b50f9c2f49fea7b5c8140b29ce26bbaa8c4feb61e264c2c1ed858e95c8bbd55964c1cf13ad9ee7a64b5485836877fb9ee18abae4d58cae7c1b20fa3454ab9ca126971945aa386cd83ca5d30a813d43aac0fe9e230ca410cd8333e35177f8ed777cf34e5ef3b17d60c6134afdc1c21a32514ec486f83573cced95e20bff30035e5cac084942b665b2669233c6d4d3432f95a171d4a4bde5bd91c53199dbd593485b6085ad3334a74d07a37aba483a651bd3e6b5a42c5b7ee06aa3372a61d6f28f15b6101c42140dc2c53aa28b1dd89b590fcb340318812284e88d4825f78bed3a17238302dbaeb00c3e17d2c620baf8ef6fbf2416b7a7d96af8a357ab657b7525d38b926246408d78719a95de9b30e732388dfb6bc57bdc29d0c886d07a0c74598b8f67d9739a79d40defe49eda5d6ea7a26a0e83b0fd4d67a6590988fd28a0b580746d061380c899e2e51e52016dd51d79dc8c79f368c164f167966362f3087f7ba5271fd02e61bf1518445a964b07d8325e10dc3a6f0065e8ac6cddccb36c3a22054d66baabafd04076ff52713086bacd0da8642bb283ae41f61bbe9ba4e0adf04fed55f4bbf6736c9406706e6a580b0671f66e65058cfd408331ec564dba236101b6023b97c9907d2d9d60cbd47fa22b79485001631cc1303397500f86b99b9d6ba420b342cd6287027b9e52a4f1105ea76490603d8f961a00425d5c40537d2de2f5625f09e93069c03a43f1662281ea843641021731c6cc78a3be1c595a02d86fd3f6a2fc994658906e06b7a88fc11f10a1a895132bdcd7a160943b0f98d0ce0f4fb0671674f5abbc5a32bf9820bab574397a01db0666188f315e3057458b2c160cd6779a1d8a78fc9064891d9e94cf6607098393f04f44a3ae0c166ca56b9a0272be7a21154bb96d2fd455c7524ec4dde922f26928caf03aaa54fe0dd1ac52e652539d988bbf5314019cfcde4fa0ac8f73f9fa058979a750e67e695ce1d4fe54d0e920e26552108b81f2af717f0b722688ae37af63b62660389d90cf33db4f34c28a066716825463f96b2453b64f3c0e4049de99005f28b89c5773e5ed4c71e45498c5088a973994ba8b98c25b2663e28721bddee954d3a0ea9c19e4f53737faa179550fd9f6006e04c197b7b369ce0d72ec77c48081d3a0b66691a4e3a7e5a3137c56451f6af3aa68804e33fe0890f226075840816d980368bfad34bef44547d780bb8e537701ad6ecc8e188a7d182881d15254c3ed52ffcc0b71fd762a2436407aa3fd68fd3e29428869841347d6a98522bbc789bca5c3f62dfcf57dd2c232e3fca2ba030bb00f8dabc1d42b4a89df5f46bb5ffc7c26ea776390045ecb45d3af44285cc49e92ebaa7dc9703514330e300a5820474eff7d694da61baba111bf8d435ae67fa42c25b3aacd168a00e8f899ee3d8a1557796f2295100401a79f29643404d40d6cf32e290ac1cbf0f3be6752b99d5205cb1a6b8111d952e5bd271ae5c3b9866e67817000b670988721b17f4ba2dc72d10a2997bf1347505251d4722e262e452707834f3e080a82b5424e493474b9e6db3a6a3607c5c0a2b12bea865586104170ea2ed3465a26d0b5a8787b88d998ec5420f0a56b8a26e81a63ecec1e23cdeb9a1b7ec10583b400bf963ac5ded58ecfd93f9f9ebe7d980255e257265aec3930bc3579fff5b5c51db03247fcade5d7a9211b9be16dbe03075f576095b5d7e1d9e97478b74f01802e992d324ddd32d718ab094240f7c0e96edccf16a5cdaa2c6e6b01bc2f51be15f969707ffae27fac83b16fdfd77ab1b89fc3dce63b4b3686c84a696b7a0c1e7360a4ad3612235e398e4db4bddaad9266a3a0ef478e50739c03a416569c5e3082585e57e4afc81c721d3d94c8ba0d9085a373d655740a5209f3f5256d2303e367fea08f6015bb0cc02ea44fc01fa6b2eef7cf2626a2e1f97c447d15ce25c19f871cc8150e71a71364fa95448b196f5f3e1b08eda319f5dee872e3558ef4660242da52e8715fd996e74e6c6ebc3427962897a8a43a4e41351aae39cde9071e0db1960ae6d57e2db22cba9e5539e1bfa3ea8312f5791e7c68732b2123c809aefcd68e847880e267082ca4c63c7344c3c0fef758bd6372c8812f4016e93284c86145fdb6b2789cc78872b62b11c4b25d4eb492cb2ca362f7843aaf8e617f6c823c85e3e94cbc4681079583457053e3de9c23d22bea81e5564cbafe2cdfa0675776039bb8d3fd7798a993e352a493bfe9044c2efa6f1771f22303f1c169ba7b65dba70fa35cceee6248dd1f4a6f9490b813e869a53fb9c449c0e0cd9b987ee92a677edfea8e8d795c7f4b820f988050369af26ddaf02ff334619ad26217b48bcfe0f8c53db96defbcd251b97c0ded4e08ae53952b275b9f8607db0e56f0bdfb3c3219ddd9f6ed6ec2fb1cf5e8a404f1cddfaf62c2f56c2a043ef39da5cc297f3be573a02c8a7102f81455c84b11c83394d4e5f0f171659e0534f3c7c044fe78c877c0bd8e9383424756500980b588f00161649bdf0dd8d28800b92eeba411ba67236c64c413285047cf2e5cca2942ec2a8643e53b4ae2711e62e07ef8bd28a3e45fcbbc005d385e182e6566076e1f982840e4e06bcf78ca22c518ffe50ed4e57efffdb69e796af9f19fa6b461a041342d1d7a6aec8a971a25e9112789b6e9a0ae2c738c16dc52dd23834e2e8258722b7c910b1fce321cdeecf883f0996534df81b9f350c5bea0f810a77ed7672ad1c21c55836c9c932d7741c6c546deea30f03270acf3248b3c16ac4636805e161064ad2b29e903ff99cf683f3f9a0bb7cac69154fb7877d167143d693989e130e599df7a017b8dd0a466e0e086391dda062e35d6af37d963d03e35ed8360357d78250ff00e6962c8e1c57861048ad76abda6feb2f76e81b48b0684b5bb57842485d15d51a77e5a3e32a5b9bbfa4f7f9333f1e90014c75dbb2d497a4a07a7bb6b02eb63e356237a63d000e0486e7b4f3af3e8fa6e3e9a92e46b4053947b4310aac031333291c9e341dc617e2c4f3516e00dc370b30164b7a8d11922ba6d5698dd99c73dd2fe9f7798c2a929de827b0d23c0caa2802dc3f2ccaab5877fdcd5952d251ee3cee7eec0dc30931b1398404121a5369dc46527c86b8290c01ee50fb5737ae9041ad95133dd5086d78d14d118dd003bcc2c0b14779178f54fb4c24f328b07006183c2d669a6c49c75d73c9ba196bcb479d8403f34fbbf6039319a03460b290edc886cda5e3403564511fcd951f378b55829cee75f4f37a4c09457ed2fdb5b8a85ad15ba64edde904478526023aea4c1b6d1f2d308cb402aba0e84466147c6c7c5cef10639c25a327e6d11c8ecb9e4cb6224a1e5b7fda617573052ee31d82bf4495e091da86bb6f4410cc367e7226428549f9756dc0b922430ac89195f59cd374ab4983dae9a1aef7b02396513c0807d27088efefdaff7dad78e4489ea2dbbe90a876098926b97cc7a9f7ec1e36912a31de18486682ad62232c2c8f9e18255d354182e51b26085a779d1466ec59f13291577a7f02e85bb740925bb96298b097cccd74bd946946f65eed3a45bb4676b89ba54d48795099ed543f4afa3c67258d809fd44dcd262730026fe7878ed77fb5c7f887c90669a4baf9d7b915af0615725e18113d2e7f81f9fe3002e62a4f9a2ecdf81268c8bcb021cfa7e0234900848833bb84c80a3ad32210a4047a2216775fc9e7405ca6909018f1f01ce474565dff4bc708d03ad98c21e795cbb2958ee7e29a741cd8bd234713ba9fc64488b6df3c279fb1ef1940eb14bdf2bfb08ac924ab6375e7bf6f8dbe4943a83a9f4d116ace3607e2b0962cdb0d723460a94c3dd15b5574822f37cfeacea61f6e38f6ca49a46d6aeab67c7448b544e81f7dedaee46c686557ce6fa8379a761e627de4b5f6750fb14171f88f02ee4528ca1c9b9ea55abfdf99b3ea6f049f6e4cba83a89da854f57a1439464c59cbae8db34f1c46ca9f69c6e250d4754f2331f0c0e2eeb6760ff7658daaf6eb720223db14daa38f09c2351ec968b6360ee6f53a54f61edacfa0370a1588f33506777f43619a3ca4cbdc15b7cf7817b630d6b53a4438ead4a7652850a4f64fe6c6046a11cdb1f3bbd1a371e8a58ec52e53c83b3d049ea05b47804d7bcfb3179b1c4b6b4fc5c88f6302eaa936ccf27bcd5396b5964715c50735a10842865b5b8530e62024b4b96adb6e10e070163e20609e5070775343b6cefd25e136166ca5f33f2edf7245dcab1d0cceee66d0588735969bb00d79b5637a726907a1e922b801573f5aa9b4b3b9eccdc8e588a1314ce7fcb067397158bf675d360325d922eaa3dbdc496638d8ca39b7ea230db27abbe3be7cf7db0d516731a3ffd0ecbc0d76dcdfc6b04657bd4cdff9076771e480835292b2a48f8477635416d69fb9dc6dc1fd3c5dd42f80104c85935b4584429ed99d225aa6ba4dae0162325c7bfa059cae3ee64346acb1d3105a8a7f5da019bb6fe491cfdc23277cc8092e3fcb8325d3fe572842083e232eee3a7a15886fe4986fc7bcdbf34b731ec903eb46a62dfec73d4eff643aca10693c4c66ff9858af3cebebae22e64d09390fb8daa9e7f9404117bc9285e63c39f8d29eb187a9fe1ed38fed16f9be95c6de937a49246ea045e9a9724a449e7fce048e9815e5eeff6148b0764a9ad7854901d524baf3d0c849376e27f56ee4c7d2bd9680c2a2ba954510f2c56281eba79f3f9303de25451dc43eff04a8f3650748eb005bae0c5538bb2ba5be6755d522c44c73335508c8a8e3ed0f8640e7eb6e9c201618aed6a6396db6dcd68caaaa8ea328ade4ea88c559bd88eb2368c0e86a0959f4cc01ac236e4ada11fd522834078fa089866a81e4db5b10a6d1f6c59ae0fdcafbc1db635e94fbdc1a0d4e1d8c5d244209adeab11f9de8e7cd763f3c2f64e5afc394e000fe65a6067d6e25b4ae8f02fb3dd3a18f404d4eef13b1f00834a40efce4e15c4c928d88157f6b84cdc2eadada441a2eff0379b1266e9c387239845e46319664f26b2b92b1b6fd090fead585830bb4391e28654abcdde15c7acf9c3ea3dd33459b73f6f679a7fc7865e6481b998c83b6a3e8d0f1fb0431e431f431744a4c9fc2cc8c25664b7485a06900eebcbc6572b4a5be4e6b632cfcedc1ff99e68e2930fc3a9169da30c50c46a8215cc75b87634ea1fc7f6c485aa8a2c600e3577d5265cf1d8687d4797c99a0509be5cb709b98cbe298ef6bc1a6e1b4127e9bb4cc70829dd1f3c96bde734994ab452f68611f12a87b1d2b02bdc9465b223d1c7d60d79d092035523cb274efc0e5f66d02f711f5f16c0af402544563a16c5150521355c852ff3f69f8bed3b581dc3b6c10c706131127dfb861767ca7bd8d0be619b914ce2fa76ee80220fe1b783bcdac93275a2cdd1b1059e2cff0a66143c9fb3eb1df72b3d166d7a226a87c1432b7c8c54e5cb7dd2d94c4381e363a726ea22030ee283e1b50a1f7a481d81b2ba2d7cb0007c495c4317cd20f0fbdbeda3ed8cee34b547b6893951f872bd97797b547389bbba2d424dd02da914858ca7b2b7ff41a6ddc4a15f93741805f0dbd2a8e7da012fa81308b142b5ab6c38e158d1567e4d0cbcc39a5112b440b11701e37993532d837ffd58b568ae7a67b64b4318019e14f8e79cde94ea48ad1df9455e105a0e0351b55b215de79f2eb17e5edb0a9400fc707c323a214ca45de1441978bd573d0f0eb99c04a37da8a7aaf90da7b1ccd39371c98e1766fbccb947b83cab539ea20281366ff7f4f4547cfdf972d579790b35c56cc3a3ddb80c660502e166b0fc2cce67c957101f41eb5b6b5e8988458e6c6c5aa3fb8f47fbb1cd9b779bb0845497cfa7508573d1eca631e031e108d65372601319e29882f5d1f83c60cb6bec5146e51feff8d999108dfdc650d25e2575185dc78eee87f98c409543934d12061638b8d96f192fdfeca393c8490f1ff2ebfe1ea5f9a440d173991962b592e8e9df424a1364e80ef535f86a7381e5dd037232bb10168fc001cb065287b77ab6c52dce13cd6e1c86fd5ce00c33c88372bf1e9086d978124cfac565e6c57b1963e5c9f1b7052908f064af4361784f5f5a9fa7138ad716e27924df13658ede92575b04c259a562f315c939acf895db1eeecf24667910fa0602fa4a1820a44cf68134e04a3ba7e5cbd9638df831aa5c3cf82bc6024d04c34e870315e17649a6b6a64cfc5078dcbcd40d0c4381c93565f2748042b63261f43380e9c06cc841c2e864c5b01ca5d5b6e7b34a8893fdf847c7dfa78b043102161a36f0068ab0684e12168aa2016d43920cc06045cfc178a63b73fd2819479b5c50ce3aff66ebb14afbca4c6e9cfe9aef55e8579f948a143ea336d575cd76ff5b1a7148472e6a270afb613276fbed753e58dc912f741ad8135f2c6dc56f74f1920f7b1a7274e6fd0f9a2c59991fbf2eed81c38faf71d11fa7d4eaba6317fd74c9c3590218f0f4787933d9eef2d49609d46f98e1d35a7a1cd921aa59f919ba414140870011e7c9f1db392e48de28b82e6b1b63e99978c99f0227011634dcbab7d920ec2608ead976c4d4fa4f69d61107a0c7f104acbc8b70564e68721f8fc1426ad33b09d9fcc8817110461322453769d1eb28753e3c6ac2b49762ded1e6e211995ac46b56ef9900daad77dcd45a6bfb59263a77db62f60ff1d657a5f60e5c103e2154bb12136b391457bfc894f8c19721d022bae131471c9253d11dbfcfaf187d88d8dd2898d0eae0aa8f871b5bed65f834b382d645f4bbfa6821d64bd4c37c63c55268d1c4b8ad25266543a67e48e30ac1ef68bd053d300c2e8d1857b8c5b8d32d523728c8d487b28fbdcafcad2a625cd7b98ffb8363765e57364b20aee5ac99957063e725e2329690e6d8270de6295dc83ee3e11d1a91744df94dd964013040b816294e803e44b8660ccb07ebe2e3bfca849c69696229d61f74a263f3ad27ea1aecd118124b6a02aea96c3579342335809c74b6d191a49f5fe06b799c55316fd3e6728d5fe0b6b935cb42280c8dc7dc73be5163889af63dd3d93dde215e2e4ae12a4f5852ab9cc5982353f56feb18e54c2e973cdb49d02c89d7027ec759b6cba2b9e327a9720a05f718823a64a466ff31d26171269017b1c0521b8c4d5d04802e24b90c86ad43cd11f3c3d8b817558924269838933d5fe999238d5ded19a534d8fceecfa8b6882bd77bfcb45653b40ebb85f1cbb2dd132ae965329873ad867cce2001bd65ab6d71c08aad470e24230575269fd801fef691c3feac489bfe7839d9e2b058c71b2a2ca0a6926d9892eeb10447c59a20a0e619a32070e20460aba719cc9d8c5ee2dc5daf0d6676f9fd829782fbbf2c932e258cad08a385f0ba7664bd80ae5c7fc26cddcea8be9331cac14dd3bd80ea57fee3ddbb4b001fe2c467e7c999c73c3dff5eca38234214ef29fff63ce5d60ce4c302ea2d0b42e3b6b156ec21560793055cbbe1739dfa48b6302ba2f317f81f916c26a168d5ea691c763dc1c49c29500b276bc5299c2675f849b72bbaa5001c02959f1a25b6ead235c95677dddf38aca3cc52b6a862b8851f853b765793dd1f17c549dbfdf43bcb646fd13ce698ae899c9dbebdba70818d85d9a5ba3050f646b220a5d69296d5820a8b88e957def86491af241df706a42a907f093a29429fb696f82759bab9fe4b3251651c043b708e6fa85376d66d1d1e0d66bc8361a8c721efd5403494fa2e155ca6971808e6e3e50ec5c4b573862fb16b1a183ea2a161cb771136bad71b822295620a7a64fc0c01289cb749ea8652ec01c683316c6503319e66d57d3eda8636c2171319e20dfee9574ec5b1949941bb18dae7d689960cd925a9fc1bc1de16969ee8a0ff8865a4570048265b6daafef7f7e453b17f1500b2ea01643f9e677b48d4279398550afe53c89f5b383d78ab59bd4dafa2a6741c14f573f9dc8eabe17fdfd550dd303abb879121cb41f47f2ea070cb6f020f480ad41ab34f7e10d5fcceeb8959d4dfea5d7df4f6eeb6c9566f8e9a5f14ac10ef168ba2f098bd418464914436b3e1371711486d1e23ffd4b66d559fe75f20a1f607226c82d23cdb080590cb93e38ba363662dcc5d4600bf41423d397fab0c3ea8bee5e3055787b31fcecbafe454f12153fa29e6a13ed7616a891ab484130ec229972da10fb55b6a5a69574cac6e9cfe09f261137bc4848ba551803444ae9515a23a91177dda73b9381f32768f3ea55637f28c9b9287cbc37f7248615f3573bc0950fb56e325e1a66dcae0bb5ecc1c4a46513eb148cc9c62e07b6a71d31dd07e2c16e216cb8a88447f5c610b1339d0f8ae082170b0546c7988f397b00b7744f5285a4df4b7c33317dee94b16ad8c339f389815fb8678781b364af518a2b41479df065f139310136cb428a457f0d7f18c489bb957f4a74120f90a84167fad0b751537280db7fa21f30f82d2c4702446b84f80a3c02a408dac5c968b69714e13db99aa194e7233d99794c34cc8c16902ea360c4f9407224e8e57495f4ab81f7d34c10991210efaf8915fb5bb6c19a1184a32b807d5f5858bc9877976bd0930cf45c62ae23654af587fbabbad26cb5cb77cf9874857dc324df9e9e98a4c8ecee046b803699dd24c5ee746a208aa6bda9a70c90a79970e2d1068f95acba63f9038814e77f0a486c60a77e9173d8285ed00de7c156e30dc7c1f22853b743bf3eac36704872ecb6dcb164a8f1f9180500a00aa99805b951a1330de15d6e02f695f0b49a0ea821760c516e0967f1f1cab3b0a1e7733ceff6ecc4d8c180de5f206927d66a95c912d50d035ed0279ea59675ddd46309cc94ad9f8eea122aff29d3472348ec3249a570fa95062a92b8114c3452dfd38179e0f3c28fd2f07235dacdc6d79f200c2af402dc563d3f3e88d96fe9a5695450976af450dcfaffeb555a3cc39420e51552489a8316094cf18440aa194d332acf4f73f7d556f99c1f7f42dd2d79b5f3bde6b4dae64e66cc8b4996fa180ef3340e1e90bdcaaaec87061568cbe7a9cc308f6ac884c69976bd150a67715dc8f4274b08b6b690b52b0c8694b82311a02a3180e2dec0a4f355741b8b104799840fa599023c052388f96bdd880f1b5c4c709fa95d73fbbfcba9ea8f5913efb85a9519bde9ccbe3fc27f75c01f1f23a7cba373559499989f710cde87919f92cd78b2b6ecacd4182bd49bde09a29f6d1ab5205a07e91800d0c10cc8a6ec6a02967126c27d81f21d088c586ad9e4324c9d7bf0c04982a321f5095b157ab7b4e83cefac28eba19a3e76fe65cde77ff0d430a106bcc6e172eaa6601df31d17ac5c813f2928ef4154fca35ddbd2a5a82b658b4706ddcc542697356ec035d0dc0b596d4c2d16c8a737270fdf33db527ff528e1eb4b13dd103f805d43b0d7e2bcd702dd7c5cf7c10cba10dd8331fe4480eb0a7e421566c56e6df1bc18a0d6b759016dee897fb2a6165091e58491f41cc0540d25adef9fdc32ef50db01fd538c583eccb4f349014732de56ccb64b3f9739cd1cf3407f8c98b832292ee73110e998476df3a5a364ca48a2516a91996085db50ce3ef3e90b39d963b0d9807d9dd721a7900d156ec86fc13ab943eeb25a36a9d2fff34b1b257a9f07fe6e6685b06ccbbef5fd3f63640d29798fe6ddcadbf3d9d81e10134a31e1fe76a741c5ce8d5c9d1666a2050410895b9f0269807248f236eae38fca1b6b6294b25f91a9787e9ac6f46fb86b2a9847bd47f927086f327bbba9d230fc7c3941bcba138d3d0e62643bdfeede5b3fabbb4814806d5843ac2d3cf99aa70e51624a09a74d26e6c02382953af457b17ce4a649564348a5b4b0460a362ee7a47d2da96af136d05c411d3da3ba6c0c18e1fdbe7ce0aa0bb798f368e52426768133d87c0fb7a4f043635049febb2ad5e767ba854f7ec2de49e3c7a591cb591e2dd72457a9095754c015a4eb9612fa424e99821d65ee8749d2ec5b25d63d03dc8db50825d3bcea74edd931b34a999b5a9864c90f375d37c0edec45df7bef56b190a2c90896c218f0e3ac527d837c9596c2ca36eec616a28beda3d82ffbfa212bd26f0bf9916c6fd3765919355c397164a69c88ed64a1badbea145262cd0391dba93b641aeadf4cf2822de9fa2093d6b1ed2557daebeb2101e2faf5e26500108fd518069d2e22baf08b4b50b3d9897ac9c02740a3af064a9b02b965dbadfac64b5e9f4938dcd08bb208eb859c5163937b04cb35d4d081f1160427a39d32dcac47572ccf0dee0d4dfdbc9f7bb04fe7f192c378f4d5262095282241a7e12509396cfb4e3d28f3313adb8f10ab20b70fb9e28de08d3aa83afedbf6b422753f93389821de65b50cb6c999373678a354a2f207258efc4af43a89a0b01d607b80578cdbda150d8131607c1f01fed5ee16d9e2fc55057d01baf83cba9a44223dde41ab898fddf4004286e023098b7af9d79bf7468a9acedd345aa05e85c08fc3085c2ccc7fdc1727f563002161aa711e11c300d14f1d389d947ab61acd6e21b3c24eb3e9fc1f175651833cf6d0705782f8dba21583e591522c309c3b62d44d87aebd1944e52b99d565fea7e41381443cd00db32165e6d6f680c5f794114b67413623949ff74e0cf28ee41f2e14769bdf7d11aaf786f2d807227e6a963168cca8b9ea8f0ff425b30e7c73577be855c43d1c295", 0x2000, &(0x7f0000005300)={&(0x7f00000049c0)={0x50, 0x0, 0xd6, {0x7, 0x2b, 0x8001, 0x43102804, 0x9, 0x3, 0x9, 0x4, 0x0, 0x0, 0x82, 0x8}}, &(0x7f0000004a40)={0x18, 0x0, 0x8, {0xfc04}}, &(0x7f0000004a80)={0x18, 0x0, 0x9, {0x100000001}}, &(0x7f0000004ac0)={0x18, 0xffffffffffffffda, 0x100000001, {0x10000}}, &(0x7f0000004b00)={0x18, 0x0, 0xffff, {0x4}}, &(0x7f0000004b40)={0x28, 0x0, 0x1, {{0x0, 0x80000001, 0x0, r11}}}, &(0x7f0000004b80)={0x60, 0x0, 0xd, {{0x5, 0x6ef5, 0x7fff, 0x3, 0x0, 0x6, 0x4, 0x101}}}, &(0x7f0000004c00)={0x18, 0x0, 0x1, {0x2}}, &(0x7f0000004c40)={0x12, 0x0, 0xa3, {'-\x00'}}, &(0x7f0000004c80)={0x20, 0x0, 0x3, {0x0, 0xc}}, &(0x7f0000004cc0)={0x78, 0x0, 0x8, {0x1, 0x1, 0x0, {0x2, 0x81, 0x824e, 0x3, 0x6, 0x6, 0x5, 0x4, 0xb4, 0xc000, 0x100, r9, r5, 0xfffffffc, 0xfffffffc}}}, &(0x7f0000004d40)={0x90, 0x0, 0x6c0, {0x1, 0x0, 0x10, 0xfffffffffffff87b, 0x24, 0x4, {0x0, 0x8, 0xd055, 0x8, 0x6c, 0x6, 0x1, 0xe2f, 0x1ff, 0xc000, 0x437c, r4, r10, 0xf296, 0xffff}}}, &(0x7f0000004e00)={0x58, 0x0, 0xe6d, [{0x1, 0xd12, 0x7, 0xfffffff7, '@)\\#[,^'}, {0x3, 0x9, 0xa, 0x9, '/dev/fuse\x00'}]}, &(0x7f0000004e80)={0xb0, 0x0, 0x2, [{{0x1, 0x2, 0x69bb, 0x10000, 0x400, 0x0, {0x4, 0x2, 0x3, 0x3, 0x4, 0x6, 0x7, 0x6, 0x6, 0x4000, 0x5, r4, r10, 0x7, 0x80000000}}, {0x2, 0x7, 0x3, 0x5, '!!]'}}]}, &(0x7f0000005000)={0xa0, 0x0, 0x3, {{0x3, 0x0, 0x2, 0x1, 0x6f, 0xfffffffc, {0x6, 0xa, 0x2b7, 0x8, 0x4, 0x2, 0x10000, 0x3, 0xe6a, 0x4000, 0xa4, r14, r10, 0x0, 0x9}}, {0x0, 0x8}}}, &(0x7f00000050c0)={0x20, 0x0, 0x0, {0x0, 0x4, 0x51f, 0x6}}, &(0x7f00000051c0)={0x130, 0x0, 0x7fff, {0x7b8, 0x9, 0x0, '\x00', {0x8000, 0x7, 0x7fffffffffffffff, 0x4ea8614f, r9, r15, 0x6000, '\x00', 0x5, 0xffffffffffffffeb, 0x7, 0xfffffffffffffffa, {0x6}, {0x3, 0x8}, {0xffffffffffffffff}, {0x10001, 0x1000}, 0x2, 0x9, 0x6, 0x9}}}})
socket$inet_tcp(0x2, 0x1, 0x0)
write$P9_RREADDIR(r13, &(0x7f00000053c0)={0x2a, 0x29, 0x1, {0x101, [{{0x2, 0x2, 0x7}, 0x4, 0x57, 0x7, './file0'}]}}, 0x2a)

328.100823ms ago: executing program 9 (id=1275):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0})

327.827093ms ago: executing program 9 (id=1276):
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
fcntl$setflags(r0, 0x2, 0x1)
r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0)
ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0x40000100000200) (async)
ioctl$ASHMEM_SET_PROT_MASK(r1, 0x40087705, 0x0) (async)
mmap(&(0x7f0000018000/0x4000)=nil, 0x4000, 0xa8ca3411d1c26008, 0x13, r1, 0xb085c000)

301.250895ms ago: executing program 9 (id=1277):
r0 = dup(0xffffffffffffffff)
ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) (async)
r1 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r1, 0x0) (async)
ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {}, 0x2000000b, 0x80, &(0x7f0000000240)={0x3, 0x0, 0xfffc, 0x4360}, 0x8, 0x6, 0x7d, 0x0, 0x1, 0x101, 0x0})
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r2, 0xc018620c, &(0x7f0000000180))

287.177587ms ago: executing program 9 (id=1278):
openat$uhid(0xffffffffffffff9c, &(0x7f0000000100), 0x802, 0x0)
openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x2, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='cgroup\x00')
eventfd(0x4)
mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}})
openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1800, 0x0)
sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x78, 0x0, 0x10, 0x70bd28, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0x64, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@rand_addr=' \x01\x00'}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x4}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2a02}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@remote}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8000}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
r2 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0)
socket$inet(0x2, 0x4000000000000001, 0x0)
tkill(r2, 0x12)
prlimit64(0x0, 0xe, 0x0, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
recvmmsg(r3, &(0x7f00000000c0), 0x4000000000001ce, 0x2000, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
syz_open_dev$MSR(0x0, 0xe000000000000000, 0x0)
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0)
setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x81, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x200})
ioctl$KVM_RUN(r7, 0xae80, 0x0)
ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f00000002c0)={[0x4, 0x5, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x1c, 0x0, 0xffffffffffffffff, 0x6], 0x0, 0x41901})
ioctl$KVM_RUN(r7, 0xae80, 0x0)

148.013477ms ago: executing program 4 (id=1279):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000005c0), r0)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000000)={0x14, r1, 0x615, 0x70bd26, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0xc040)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3})
mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r2, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/248, 0xf8, 0x2, 0x4}, @fda={0x66646185, 0x8, 0x0, 0xe}, @fda={0x66646185, 0x6, 0x0, 0x24}}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0})

145.497818ms ago: executing program 4 (id=1280):
openat$ppp(0xffffffffffffff9c, 0x0, 0x2300, 0x0)
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x60a00, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x57789000)
setsockopt$MRT_ASSERT(0xffffffffffffffff, 0x0, 0xcf, 0x0, 0x0)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)='setgroups\x00')
writev(r1, 0x0, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
socket$nl_audit(0x10, 0x3, 0x9)
sched_setattr(0x0, 0x0, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1e, 0x0, 0x0)
ioctl$FICLONERANGE(0xffffffffffffffff, 0x4020940d, 0x0)
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x16)
openat$ashmem(0xffffffffffffff9c, 0x0, 0x6000, 0x0)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
openat$ppp(0xffffffffffffff9c, 0x0, 0x2300, 0x0) (async)
openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x60a00, 0x0) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x57789000) (async)
setsockopt$MRT_ASSERT(0xffffffffffffffff, 0x0, 0xcf, 0x0, 0x0) (async)
syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)='setgroups\x00') (async)
writev(r1, 0x0, 0x0) (async)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) (async)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async)
socket$nl_audit(0x10, 0x3, 0x9) (async)
sched_setattr(0x0, 0x0, 0x0) (async)
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1e, 0x0, 0x0) (async)
ioctl$FICLONERANGE(0xffffffffffffffff, 0x4020940d, 0x0) (async)
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x16) (async)
openat$ashmem(0xffffffffffffff9c, 0x0, 0x6000, 0x0) (async)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async)

106.272671ms ago: executing program 4 (id=1281):
mkdir(&(0x7f0000000000)='./file2\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x1000000, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@volatile}]})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
socket$packet(0x11, 0x2, 0x300)
r0 = socket$packet(0x11, 0x3, 0x300)
socketpair(0x1, 0x5, 0x0, &(0x7f0000000000)={<r1=>0xffffffffffffffff})
getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14)
sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0xdd86, r2}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0)
prctl$PR_MCE_KILL(0x35, 0x0, 0x8)
r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00')
read$FUSE(r3, &(0x7f0000002140)={0x2020}, 0x2020)

67.950204ms ago: executing program 4 (id=1282):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3})
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)={0x70, 0x0, 0x1, 0x401, 0x11, 0x0, {0x2, 0x0, 0xfffd}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x7, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0xc, 0x6, 0x0, 0x1, [@CTA_NAT_V4_MINIP={0x8, 0x1, @rand_addr=0x64010101}]}]}, 0x70}}, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xfffffffffffffff9}], 0x0, 0x0, 0x0})

0s ago: executing program 4 (id=1283):
openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
ioctl$KVM_CAP_EXIT_ON_EMULATION_FAILURE(r1, 0x4068aea3, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000000000)="2ef36644f7e62e3e672e450f078f29d095abaa960000b890a4f084ef66bafc0c6d8f297812cf66ba410066ef48b800100000000000000f23d00f21f835100000080f23f866baf80cb88ef01480ef66bafc0c66b80c0066efc7442402d8650000c7442406000000000f011c2466ba4200ec2e64f30f5a8e6c000000", 0x7b}], 0x1, 0x52, &(0x7f0000000200)=[@vmwrite={0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x85200000c}], 0x1)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000240)={[0x3, 0xec, 0x401, 0x3, 0x7, 0x4, 0x8000000000000001, 0x80000001, 0x1, 0x200, 0x4, 0x6, 0x9, 0x10000000003a, 0x9, 0x9], 0x0, 0x2a80})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, 0x0}], 0x1, 0x7c, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0) (async)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x400c6313, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x400c6313, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

kernel console output (not intermixed with test programs):

 pid=2536 comm="syz.2.631" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1
[  106.793829][ T2546] rust_binder: 473: no such ref 0
[  106.800382][ T2546] rust_binder: 473: no such ref 2
[  106.806894][ T2546] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:473
[  106.977862][  T654] usb 3-1: new high-speed USB device number 29 using dummy_hcd
[  107.087946][   T65] usb 5-1: new low-speed USB device number 14 using dummy_hcd
[  107.113836][ T2566] KVM: debugfs: duplicate directory 2566-7
[  107.159449][  T654] usb 3-1: unable to get BOS descriptor or descriptor too short
[  107.168046][  T654] usb 3-1: config 8 has an invalid interface number: 43 but max is 0
[  107.176416][  T654] usb 3-1: config 8 contains an unexpected descriptor of type 0x1, skipping
[  107.185419][  T654] usb 3-1: config 8 has no interface number 0
[  107.194423][  T654] usb 3-1: config 8 interface 43 altsetting 255 endpoint 0x4 has invalid wMaxPacketSize 0
[  107.204875][  T654] usb 3-1: config 8 interface 43 altsetting 255 bulk endpoint 0x4 has invalid maxpacket 0
[  107.215595][  T654] usb 3-1: config 8 interface 43 has no altsetting 0
[  107.223798][  T654] usb 3-1: New USB device found, idVendor=0582, idProduct=935b, bcdDevice=be.6c
[  107.237708][  T654] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=33
[  107.239118][   T65] usb 5-1: config index 0 descriptor too short (expected 1307, got 27)
[  107.245992][  T654] usb 3-1: Product: syz
[  107.264301][   T65] usb 5-1: config 0 has an invalid interface number: 0 but max is -1
[  107.267760][  T654] usb 3-1: Manufacturer: syz
[  107.274538][   T65] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 0
[  107.277696][  T654] usb 3-1: SerialNumber: syz
[  107.287329][   T65] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30
[  107.303893][   T65] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  107.315904][   T65] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10
[  107.331325][   T65] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8
[  107.342752][   T36] audit: type=1400 audit(107.306:408): avc:  denied  { write } for  pid=2581 comm="syz.3.645" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1
[  107.353485][ T2582] 9pnet_fd: Insufficient options for proto=fd
[  107.366363][   T65] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246
[  107.373147][   T36] audit: type=1400 audit(107.306:409): avc:  denied  { append } for  pid=2581 comm="syz.3.645" name="event2" dev="devtmpfs" ino=209 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1
[  107.388105][   T65] usb 5-1: string descriptor 0 read error: -22
[  107.429634][   T65] usb 5-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de
[  107.439935][   T65] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  107.447873][ T2587] __vm_enough_memory: pid: 2587, comm: syz.3.646, bytes: 18014402804453376 not enough memory for the allocation
[  107.449401][   T65] usb 5-1: config 0 descriptor??
[  107.465817][ T2555] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22
[  107.477737][   T65] hub 5-1:0.0: bad descriptor, ignoring hub
[  107.484515][   T65] hub 5-1:0.0: probe with driver hub failed with error -5
[  107.493588][   T65] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input29
[  107.505163][ T2542] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  107.505831][ T2542] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:408
[  107.508119][ T2592] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  107.536539][ T2592] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  107.549990][ T2592] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  107.554914][  T654] usb 3-1: USB disconnect, device number 29
[  107.561069][ T1306] udevd[1306]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:8.43/sound/card0/controlC0/../uevent} for writing: No such file or directory
[  107.570850][ T2592] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  107.679775][   T65] usb 5-1: USB disconnect, device number 14
[  108.127058][   T36] audit: type=1400 audit(108.086:410): avc:  denied  { setopt } for  pid=2605 comm="syz.2.652" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1
[  108.167467][   T36] audit: type=1400 audit(108.126:411): avc:  denied  { audit_write } for  pid=2607 comm="syz.2.653" capability=29  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1
[  108.368024][ T1254] raw-gadget.0 gadget.3: failed to queue disconnect event
[  108.487968][   T10] usb 5-1: new high-speed USB device number 15 using dummy_hcd
[  108.539282][ T2206] bridge_slave_1: left allmulticast mode
[  108.545075][ T2206] bridge_slave_1: left promiscuous mode
[  108.561629][  T654] usb 7-1: new high-speed USB device number 5 using dummy_hcd
[  108.573042][ T2206] bridge0: port 2(bridge_slave_1) entered disabled state
[  108.581953][ T2206] bridge_slave_0: left allmulticast mode
[  108.587647][ T2206] bridge_slave_0: left promiscuous mode
[  108.593444][ T2206] bridge0: port 1(bridge_slave_0) entered disabled state
[  108.631221][   T36] audit: type=1400 audit(108.596:412): avc:  denied  { accept } for  pid=2640 comm="syz.2.667" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1
[  108.657975][   T10] usb 5-1: Using ep0 maxpacket: 32
[  108.664438][   T10] usb 5-1: config 0 has an invalid interface number: 184 but max is 0
[  108.672905][   T10] usb 5-1: config 0 has no interface number 0
[  108.679136][   T10] usb 5-1: config 0 interface 184 has no altsetting 0
[  108.687592][   T10] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee
[  108.696860][   T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  108.705135][   T10] usb 5-1: Product: syz
[  108.709680][   T10] usb 5-1: Manufacturer: syz
[  108.717225][   T10] usb 5-1: SerialNumber: syz
[  108.729425][   T10] usb 5-1: config 0 descriptor??
[  108.735294][  T654] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  108.738367][   T10] smsc75xx v1.0.0
[  108.747700][  T654] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11
[  108.758469][ T2643] rust_binder: Failure when writing BR_NOOP at beginning of buffer.
[  108.762009][ T2643] rust_binder: Read failure Err(EFAULT) in pid:432
[  108.764415][  T654] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[  108.790290][  T654] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  108.803674][  T654] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  108.803969][ T2206] tipc: Left network mode
[  108.818480][  T654] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  108.827709][ T2206] veth1_macvtap: left promiscuous mode
[  108.833461][  T654] usb 7-1: config 0 descriptor??
[  108.839341][ T2628] raw-gadget.4 gadget.6: fail, usb_ep_enable returned -22
[  108.840971][ T2206] veth0_vlan: left promiscuous mode
[  108.915478][ T2637] bridge0: port 1(bridge_slave_0) entered blocking state
[  108.922713][ T2637] bridge0: port 1(bridge_slave_0) entered disabled state
[  108.929835][ T2637] bridge_slave_0: entered allmulticast mode
[  108.936187][ T2637] bridge_slave_0: entered promiscuous mode
[  108.943305][ T2637] bridge0: port 2(bridge_slave_1) entered blocking state
[  108.950849][ T2637] bridge0: port 2(bridge_slave_1) entered disabled state
[  108.965437][ T2637] bridge_slave_1: entered allmulticast mode
[  108.972080][ T2637] bridge_slave_1: entered promiscuous mode
[  109.065374][ T2637] bridge0: port 2(bridge_slave_1) entered blocking state
[  109.072511][ T2637] bridge0: port 2(bridge_slave_1) entered forwarding state
[  109.079909][ T2637] bridge0: port 1(bridge_slave_0) entered blocking state
[  109.087030][ T2637] bridge0: port 1(bridge_slave_0) entered forwarding state
[  109.113487][  T333] bridge0: port 1(bridge_slave_0) entered disabled state
[  109.121234][  T333] bridge0: port 2(bridge_slave_1) entered disabled state
[  109.131667][  T293] bridge0: port 1(bridge_slave_0) entered blocking state
[  109.139080][  T293] bridge0: port 1(bridge_slave_0) entered forwarding state
[  109.149306][  T293] bridge0: port 2(bridge_slave_1) entered blocking state
[  109.156402][  T293] bridge0: port 2(bridge_slave_1) entered forwarding state
[  109.165287][   T10] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61
[  109.176650][   T10] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61
[  109.186874][   T10] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind
[  109.198672][   T10] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -61
[  109.238886][ T2637] veth0_vlan: entered promiscuous mode
[  109.251679][  T654] plantronics 0003:047F:FFFF.0017: unknown main item tag 0x0
[  109.256963][ T2637] veth1_macvtap: entered promiscuous mode
[  109.265593][  T654] plantronics 0003:047F:FFFF.0017: unknown main item tag 0x0
[  109.273726][  T654] plantronics 0003:047F:FFFF.0017: unknown main item tag 0x0
[  109.282581][  T654] plantronics 0003:047F:FFFF.0017: unknown main item tag 0x0
[  109.290460][  T654] plantronics 0003:047F:FFFF.0017: unknown main item tag 0x0
[  109.298274][  T654] plantronics 0003:047F:FFFF.0017: unknown main item tag 0x0
[  109.306151][  T654] plantronics 0003:047F:FFFF.0017: unknown main item tag 0x0
[  109.315709][  T654] plantronics 0003:047F:FFFF.0017: unknown main item tag 0x0
[  109.324100][  T654] plantronics 0003:047F:FFFF.0017: unknown main item tag 0x0
[  109.331816][  T654] plantronics 0003:047F:FFFF.0017: unknown main item tag 0x0
[  109.339488][  T654] plantronics 0003:047F:FFFF.0017: unknown main item tag 0x0
[  109.347282][  T654] plantronics 0003:047F:FFFF.0017: No inputs registered, leaving
[  109.358245][  T654] plantronics 0003:047F:FFFF.0017: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0
[  109.477951][ T1968] usb 3-1: new high-speed USB device number 30 using dummy_hcd
[  109.558740][   T10] usb 7-1: USB disconnect, device number 5
[  109.629149][ T1968] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  109.640857][ T1968] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11
[  109.652314][ T1968] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[  109.663720][ T1968] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  109.677016][ T1968] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  109.686590][ T1968] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  109.695354][ T1968] usb 3-1: config 0 descriptor??
[  109.700996][ T2663] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[  110.111666][ T1968] plantronics 0003:047F:FFFF.0018: unknown main item tag 0x0
[  110.129420][ T1968] plantronics 0003:047F:FFFF.0018: unknown main item tag 0x0
[  110.136940][ T1968] plantronics 0003:047F:FFFF.0018: unknown main item tag 0x0
[  110.146992][ T1968] plantronics 0003:047F:FFFF.0018: unknown main item tag 0x0
[  110.154622][ T1968] plantronics 0003:047F:FFFF.0018: unknown main item tag 0x0
[  110.162527][ T1968] plantronics 0003:047F:FFFF.0018: unknown main item tag 0x0
[  110.170299][ T1968] plantronics 0003:047F:FFFF.0018: unknown main item tag 0x0
[  110.177779][ T1968] plantronics 0003:047F:FFFF.0018: unknown main item tag 0x0
[  110.187005][ T1968] plantronics 0003:047F:FFFF.0018: unknown main item tag 0x0
[  110.194771][ T1968] plantronics 0003:047F:FFFF.0018: unknown main item tag 0x0
[  110.202696][ T1968] plantronics 0003:047F:FFFF.0018: unknown main item tag 0x0
[  110.210539][ T1968] plantronics 0003:047F:FFFF.0018: No inputs registered, leaving
[  110.221902][ T1968] plantronics 0003:047F:FFFF.0018: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0
[  110.368263][   T36] audit: type=1400 audit(110.326:413): avc:  denied  { write } for  pid=2691 comm="syz.6.680" dev="9p" ino=7016996765293437283 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1
[  110.391446][   T36] audit: type=1400 audit(110.336:414): avc:  denied  { open } for  pid=2691 comm="syz.6.680" path="/24/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="9p" ino=7016996765293437283 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1
[  110.867893][   T10] usb 7-1: new high-speed USB device number 6 using dummy_hcd
[  111.017913][   T10] usb 7-1: Using ep0 maxpacket: 16
[  111.024372][   T10] usb 7-1: config 4 has an invalid interface number: 159 but max is 0
[  111.033037][   T10] usb 7-1: config 4 has no interface number 0
[  111.040724][   T10] usb 7-1: New USB device found, idVendor=0dba, idProduct=5000, bcdDevice=45.cb
[  111.050140][   T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  111.058586][   T10] usb 7-1: Product: syz
[  111.062904][   T10] usb 7-1: Manufacturer: syz
[  111.067646][   T10] usb 7-1: SerialNumber: syz
[  111.809636][  T496] usb 5-1: USB disconnect, device number 15
[  111.839086][ T2713] rust_binder: Read failure Err(EAGAIN) in pid:490
[  111.851920][ T2715] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem
[  111.878171][ T2715] rust_binder: Fixups oob 156 120 160 164
[  111.878198][ T2715] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EINVAL }
[  111.884327][ T2715] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  111.892944][ T2715] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:492
[  111.979873][ T2723] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2
[  112.039089][ T2722] 9pnet_fd: Insufficient options for proto=fd
[  112.391885][ T2733] binder: Unknown parameter '�'
[  112.398123][ T2735] binder: Unknown parameter '�'
[  112.457865][    T9] usb 3-1: reset high-speed USB device number 30 using dummy_hcd
[  112.466246][    T9] usb 3-1: device reset changed ep0 maxpacket size!
[  112.473596][ T1968] usb 3-1: USB disconnect, device number 30
[  112.607949][ T1968] usb 3-1: new high-speed USB device number 31 using dummy_hcd
[  112.757887][ T1968] usb 3-1: Using ep0 maxpacket: 16
[  112.764825][ T1968] usb 3-1: config 1 interface 0 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024
[  112.766693][    T9] rust_binder: 2721: removing orphan mapping 0:112
[  112.775304][ T1968] usb 3-1: config 1 interface 0 altsetting 1 has 3 endpoint descriptors, different from the interface descriptor's value: 2
[  112.785793][    T9] rust_binder: 0: removing orphan mapping 112:1048
[  112.801025][ T1968] usb 3-1: config 1 interface 0 has no altsetting 0
[  112.810772][ T1968] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  112.820253][ T1968] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  112.828484][ T1968] usb 3-1: Product: syz
[  112.832711][ T1968] usb 3-1: Manufacturer: syz
[  112.837324][ T1968] usb 3-1: SerialNumber: syz
[  112.843574][ T2727] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[  112.851045][ T2727] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[  113.260638][   T36] audit: type=1400 audit(113.226:415): avc:  denied  { create } for  pid=2726 comm="syz.2.690" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1
[  113.281800][ T1968] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22
[  113.292096][ T1968] usb 3-1: USB disconnect, device number 31
[  113.409596][ T2754] fuse: blksize only supported for fuseblk
[  113.462396][ T2761] rust_binder: 31: no such ref 0
[  113.468069][ T2761] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:31
[  113.468538][ T2761] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0
[  113.485834][ T2761] rust_binder: Write failure EINVAL in pid:31
[  113.645361][   T10] usb 7-1: MBOX3: Invalid descriptor size=18.
[  113.667120][   T10] usb 7-1: USB disconnect, device number 6
[  113.723133][   T36] audit: type=1400 audit(113.686:416): avc:  denied  { lock } for  pid=2778 comm="syz.4.709" path="/dev/fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1
[  114.117880][   T10] usb 7-1: new high-speed USB device number 7 using dummy_hcd
[  114.287860][   T10] usb 7-1: Using ep0 maxpacket: 32
[  114.294495][   T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  114.306043][   T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  114.316118][   T10] usb 7-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00
[  114.325601][   T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  114.334364][   T10] usb 7-1: config 0 descriptor??
[  114.420555][   T36] audit: type=1400 audit(114.386:417): avc:  denied  { nlmsg_tty_audit } for  pid=2809 comm="syz.7.718" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1
[  114.448360][ T2812] 9pnet: p9_errstr2errno: server reported unknown error ottle.io_service_bytes_recursive
[  114.750836][   T10] savu 0003:1E7D:2D5A.0019: hiddev96,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.6-1/input0
[  114.839425][ T2842] netlink: 3 bytes leftover after parsing attributes in process `syz.4.729'.
[  114.849754][ T2842] netlink: 3 bytes leftover after parsing attributes in process `syz.4.729'.
[  114.858977][ T2842] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check.
[  114.906224][ T2848] kvm: kvm [2847]: vcpu10, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010001) = 0x1
[  114.916479][ T2848] netlink: 8 bytes leftover after parsing attributes in process `syz.4.731'.
[  114.927891][  T496] usb 3-1: new high-speed USB device number 32 using dummy_hcd
[  114.971288][   T59] Bluetooth: hci0: Frame reassembly failed (-84)
[  114.977995][   T59] Bluetooth: hci0: Frame reassembly failed (-84)
[  115.049718][ T2854] rust_binder: Failed to allocate buffer. len:192, is_oneway:true
[  115.061195][ T1968] usb 7-1: USB disconnect, device number 7
[  115.078526][  T496] usb 3-1: Using ep0 maxpacket: 32
[  115.085420][  T496] usb 3-1: config 0 has an invalid interface number: 67 but max is 0
[  115.093641][  T496] usb 3-1: config 0 has no interface number 0
[  115.101373][  T496] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57
[  115.111149][  T496] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  115.119377][  T496] usb 3-1: Product: syz
[  115.123638][  T496] usb 3-1: Manufacturer: syz
[  115.128656][  T496] usb 3-1: SerialNumber: syz
[  115.133881][  T496] usb 3-1: config 0 descriptor??
[  115.139904][  T496] smsc95xx v2.0.0
[  115.943244][  T496] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71
[  115.954553][  T496] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD
[  115.964505][  T496] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71
[  115.975691][  T496] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -71
[  115.984724][  T496] usb 3-1: USB disconnect, device number 32
[  116.605778][ T2872] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  116.605905][ T2872] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  116.613078][ T2872] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:464
[  116.618488][ T2873] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  116.635597][ T2873] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:117
[  116.646107][ T2873] rust_binder: Failure when writing BR_NOOP at beginning of buffer.
[  116.655414][ T2873] rust_binder: Read failure Err(EFAULT) in pid:117
[  116.710215][ T2878] netlink: 140 bytes leftover after parsing attributes in process `syz.2.740'.
[  117.017923][ T2833] usb 7-1: new high-speed USB device number 8 using dummy_hcd
[  117.037917][   T52] Bluetooth: hci0: command 0x1003 tx timeout
[  117.037959][  T587] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  117.157855][ T2833] usb 7-1: device descriptor read/64, error -71
[  117.308808][ T2898] rust_binder: Error while translating object.
[  117.308844][ T2898] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  117.315308][ T2898] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:568
[  117.385274][ T2904] binder: Unknown parameter 'appraise'
[  117.400296][ T2833] usb 7-1: device descriptor read/64, error -71
[  117.622326][ T2913] overlayfs: failed to resolve './file1': -2
[  117.638040][ T2833] usb 7-1: new high-speed USB device number 9 using dummy_hcd
[  117.667859][  T654] usb 5-1: new high-speed USB device number 17 using dummy_hcd
[  117.699841][   T36] audit: type=1400 audit(117.666:418): avc:  denied  { setopt } for  pid=2919 comm="syz.2.757" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1
[  117.700962][ T2920] rust_binder: Error while translating object.
[  117.719313][ T2920] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT }
[  117.725956][ T2920] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:478
[  117.777966][ T2833] usb 7-1: device descriptor read/64, error -71
[  117.818996][  T654] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  117.830534][  T654] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  117.841207][  T654] usb 5-1: New USB device found, idVendor=1d34, idProduct=0004, bcdDevice= 0.00
[  117.850487][  T654] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  117.859060][  T654] usb 5-1: config 0 descriptor??
[  117.895962][ T2926] input: syz1 as /devices/virtual/input/input30
[  118.027863][ T2833] usb 7-1: device descriptor read/64, error -71
[  118.269110][ T2833] usb usb7-port1: attempt power cycle
[  118.470279][   T36] audit: type=1400 audit(118.436:419): avc:  denied  { setattr } for  pid=2905 comm="syz.4.752" path="/dev/binderfs/binder1" dev="binder" ino=121 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1
[  118.471216][  T654] hid-led 0003:1D34:0004.001A: hidraw0: USB HID v0.06 Device [HID 1d34:0004] on usb-dummy_hcd.4-1/input0
[  118.507428][  T654] hid-led 0003:1D34:0004.001A: Dream Cheeky Webmail Notifier initialized
[  118.557946][   T10] usb 3-1: new high-speed USB device number 33 using dummy_hcd
[  118.607932][ T2833] usb 7-1: new high-speed USB device number 10 using dummy_hcd
[  118.629186][ T2833] usb 7-1: device descriptor read/8, error -71
[  118.674284][  T654] usb 5-1: USB disconnect, device number 17
[  118.707928][   T10] usb 3-1: Using ep0 maxpacket: 32
[  118.714551][   T10] usb 3-1: config index 0 descriptor too short (expected 29220, got 36)
[  118.723318][   T10] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32
[  118.731948][   T10] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81
[  118.740941][   T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0
[  118.750593][   T10] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0
[  118.760498][   T10] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18
[  118.773606][   T10] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40
[  118.782959][   T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  118.791529][ T2833] usb 7-1: device descriptor read/8, error -71
[  118.798437][   T10] usb 3-1: config 0 descriptor??
[  119.006995][   T10] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 33 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17
[  119.020136][   T10] usb 3-1: USB disconnect, device number 33
[  119.027121][   T10] usblp0: removed
[  119.037908][ T2833] usb 7-1: new high-speed USB device number 11 using dummy_hcd
[  119.059087][ T2833] usb 7-1: device descriptor read/8, error -71
[  119.190377][ T2833] usb 7-1: device descriptor read/8, error -71
[  119.201549][ T2939] overlayfs: failed to resolve './file1': -2
[  119.298005][ T2833] usb usb7-port1: unable to enumerate USB device
[  119.447922][  T654] usb 3-1: new high-speed USB device number 34 using dummy_hcd
[  119.597877][  T654] usb 3-1: Using ep0 maxpacket: 32
[  119.604503][  T654] usb 3-1: config index 0 descriptor too short (expected 29220, got 36)
[  119.613226][  T654] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32
[  119.621896][  T654] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81
[  119.630889][  T654] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0
[  119.640553][  T654] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0
[  119.650386][  T654] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18
[  119.663660][  T654] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40
[  119.672989][  T654] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  119.681938][  T654] usb 3-1: config 0 descriptor??
[  119.888331][  T654] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 34 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17
[  120.089127][   T36] audit: type=1400 audit(120.056:420): avc:  denied  { read write } for  pid=2935 comm="syz.2.762" name="lp0" dev="devtmpfs" ino=698 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1
[  120.089940][   T10] usb 3-1: USB disconnect, device number 34
[  120.112189][   T36] audit: type=1400 audit(120.056:421): avc:  denied  { open } for  pid=2935 comm="syz.2.762" path="/dev/usb/lp0" dev="devtmpfs" ino=698 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1
[  120.123314][   T10] usblp0: removed
[  120.196035][ T2948] rust_binder: Error while translating object.
[  120.196060][ T2948] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  120.197907][   T45] usb 7-1: new full-speed USB device number 12 using dummy_hcd
[  120.202524][ T2948] rust_binder: Failure BR_FAILED_REPLY { source: EINVAL } during reply - delivering BR_FAILED_REPLY to sender.
[  120.219896][ T2948] rust_binder: Transaction failed: BR_TRANSACTION_COMPLETE my_pid:585
[  120.235952][ T2833] rust_binder: 2947: removing orphan mapping 0:24
[  120.359314][   T45] usb 7-1: config 0 has no interfaces?
[  120.366763][   T45] usb 7-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80
[  120.375980][   T45] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  120.383999][   T45] usb 7-1: Product: syz
[  120.388371][   T45] usb 7-1: Manufacturer: syz
[  120.392977][   T45] usb 7-1: SerialNumber: syz
[  120.398116][   T45] usb 7-1: config 0 descriptor??
[  120.487906][  T654] usb 5-1: new high-speed USB device number 18 using dummy_hcd
[  120.606248][ T2946] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT }
[  120.606271][ T2946] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:124
[  120.616389][   T10] usb 7-1: USB disconnect, device number 12
[  120.637861][  T654] usb 5-1: Using ep0 maxpacket: 32
[  120.648834][  T654] usb 5-1: config index 0 descriptor too short (expected 29220, got 36)
[  120.664298][  T654] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32
[  120.674902][  T654] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  120.685620][  T654] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81
[  120.694744][  T654] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18
[  120.703809][ T2953] overlayfs: missing 'workdir'
[  120.708130][  T654] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40
[  120.722067][  T654] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  120.731155][  T654] usb 5-1: config 0 descriptor??
[  120.752567][ T2959] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  120.752966][ T2959] rust_binder: Error while translating object.
[  120.759522][ T2959] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF }
[  120.765761][ T2959] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:498
[  120.939032][ T2951] validate_nla: 10 callbacks suppressed
[  120.939050][ T2951] netlink: 'syz.4.767': attribute type 19 has an invalid length.
[  120.961951][ T2951] netlink: 5 bytes leftover after parsing attributes in process `syz.4.767'.
[  120.972005][ T2951] rust_binder: 588: no such ref 0
[  120.977351][ T2951] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 3
[  120.985084][ T2951] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  120.993573][ T2951] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  121.002397][   T10] usb 5-1: USB disconnect, device number 18
[  121.027922][  T654] usb 3-1: new high-speed USB device number 35 using dummy_hcd
[  121.145571][ T2963] overlayfs: failed to resolve './file1': -2
[  121.177930][  T654] usb 3-1: Using ep0 maxpacket: 32
[  121.184081][  T654] usb 3-1: config 0 has an invalid interface number: 148 but max is 0
[  121.192397][  T654] usb 3-1: config 0 has no interface number 0
[  121.198555][  T654] usb 3-1: config 0 interface 148 has no altsetting 0
[  121.206780][  T654] usb 3-1: New USB device found, idVendor=067b, idProduct=0307, bcdDevice=dd.c8
[  121.215877][  T654] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  121.223913][  T654] usb 3-1: Product: syz
[  121.228230][  T654] usb 3-1: Manufacturer: syz
[  121.232844][  T654] usb 3-1: SerialNumber: syz
[  121.238020][  T654] usb 3-1: config 0 descriptor??
[  121.244104][  T654] pl2303 3-1:0.148: required interrupt-in endpoint missing
[  121.397911][   T45] usb 7-1: new low-speed USB device number 13 using dummy_hcd
[  121.445168][   T36] audit: type=1400 audit(121.406:422): avc:  denied  { map } for  pid=2960 comm="syz.2.771" path="socket:[22042]" dev="sockfs" ino=22042 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1
[  121.527929][   T45] usb 7-1: device descriptor read/64, error -71
[  121.767932][   T45] usb 7-1: device descriptor read/64, error -71
[  121.950819][   T65] usb 3-1: USB disconnect, device number 35
[  122.007883][   T45] usb 7-1: new low-speed USB device number 14 using dummy_hcd
[  122.137897][   T45] usb 7-1: device descriptor read/64, error -71
[  122.247892][   T65] usb 3-1: new high-speed USB device number 36 using dummy_hcd
[  122.387892][   T45] usb 7-1: device descriptor read/64, error -71
[  122.398475][   T65] usb 3-1: Using ep0 maxpacket: 32
[  122.404853][   T65] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  122.415965][   T65] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  122.425896][   T65] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5
[  122.439293][   T65] usb 3-1: New USB device found, idVendor=0458, idProduct=501a, bcdDevice= 0.00
[  122.448466][   T65] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  122.457724][   T65] usb 3-1: config 0 descriptor??
[  122.498000][   T45] usb usb7-port1: attempt power cycle
[  122.627860][   T10] usb 5-1: new high-speed USB device number 19 using dummy_hcd
[  122.788964][   T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  122.800256][   T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  122.810416][   T10] usb 5-1: New USB device found, idVendor=1d34, idProduct=0004, bcdDevice= 0.00
[  122.819570][   T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  122.828235][   T10] usb 5-1: config 0 descriptor??
[  122.837904][   T45] usb 7-1: new low-speed USB device number 15 using dummy_hcd
[  122.859239][   T45] usb 7-1: device descriptor read/8, error -71
[  122.988839][   T45] usb 7-1: device descriptor read/8, error -71
[  123.067704][   T65] usbhid 3-1:0.0: can't add hid device: -71
[  123.073828][   T65] usbhid 3-1:0.0: probe with driver usbhid failed with error -71
[  123.082849][   T65] usb 3-1: USB disconnect, device number 36
[  123.227917][   T45] usb 7-1: new low-speed USB device number 16 using dummy_hcd
[  123.249011][   T45] usb 7-1: device descriptor read/8, error -71
[  123.378905][   T45] usb 7-1: device descriptor read/8, error -71
[  123.436776][   T10] hid-led 0003:1D34:0004.001B: hidraw0: USB HID v0.06 Device [HID 1d34:0004] on usb-dummy_hcd.4-1/input0
[  123.449694][   T10] hid-led 0003:1D34:0004.001B: Dream Cheeky Webmail Notifier initialized
[  123.487976][   T45] usb usb7-port1: unable to enumerate USB device
[  123.583446][ T2979] input: syz1 as /devices/virtual/input/input31
[  123.712115][   T36] audit: type=1400 audit(123.676:423): avc:  denied  { map } for  pid=2988 comm="syz.7.782" path="socket:[21146]" dev="sockfs" ino=21146 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1
[  123.744457][ T2833] usb 5-1: USB disconnect, device number 19
[  123.762899][ T2983] rust_binder: 508: no such ref 2
[  123.770214][ T2990] rust_binder: 508: no such ref 2
[  123.797901][   T10] usb 7-1: new low-speed USB device number 17 using dummy_hcd
[  123.927923][   T10] usb 7-1: device descriptor read/64, error -71
[  124.167909][   T10] usb 7-1: device descriptor read/64, error -71
[  124.187414][   T36] audit: type=1400 audit(124.146:424): avc:  denied  { execute } for  pid=2998 comm="syz.6.785" name="file1" dev="tmpfs" ino=265 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1
[  124.187436][ T2999] process 'syz.6.785' launched './file1' with NULL argv: empty string added
[  124.218407][   T36] audit: type=1400 audit(124.146:425): avc:  denied  { execute_no_trans } for  pid=2998 comm="syz.6.785" path="/40/file1" dev="tmpfs" ino=265 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1
[  124.219454][ T2999] netlink: 'syz.6.785': attribute type 4 has an invalid length.
[  124.241274][   T36] audit: type=1400 audit(124.186:426): avc:  denied  { create } for  pid=2998 comm="syz.6.785" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1
[  124.269559][ T2999] netlink: 'syz.6.785': attribute type 4 has an invalid length.
[  124.273659][   T65] rust_binder: 2975: removing orphan mapping 0:24
[  124.283755][   T65] rust_binder: 2975: removing orphan mapping 24:1024
[  124.284692][ T2999] rust_binder: validate_parent_fixup: fixup_min_offset=46, parent_offset=36
[  124.290819][ T2999] rust_binder: Error while translating object.
[  124.299926][ T2999] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  124.309591][ T2999] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:130
[  124.587865][   T65] usb 5-1: new high-speed USB device number 20 using dummy_hcd
[  124.689072][ T3024] mmap: syz.7.795 (3024) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst.
[  124.737864][   T65] usb 5-1: device descriptor read/64, error -71
[  124.756551][ T3036] 9pnet_fd: Insufficient options for proto=fd
[  124.963067][   T36] audit: type=1400 audit(124.926:427): avc:  denied  { view } for  pid=3040 comm="syz.7.800" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1
[  124.981791][   T65] usb 5-1: device descriptor read/64, error -71
[  125.227908][   T65] usb 5-1: new high-speed USB device number 21 using dummy_hcd
[  125.243477][ T3055] rust_binder: 512: no such ref 0
[  125.388279][   T65] usb 5-1: device descriptor read/64, error -71
[  125.487856][   T45] usb 7-1: new high-speed USB device number 19 using dummy_hcd
[  125.627852][   T65] usb 5-1: device descriptor read/64, error -71
[  125.647870][   T45] usb 7-1: Using ep0 maxpacket: 8
[  125.654254][   T45] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  125.665165][   T45] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  125.676495][   T45] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  125.692044][   T45] usb 7-1: New USB device found, idVendor=046d, idProduct=c537, bcdDevice= 0.00
[  125.702174][   T45] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  125.711250][   T45] usb 7-1: config 0 descriptor??
[  125.738025][   T65] usb usb5-port1: attempt power cycle
[  126.078061][   T65] usb 5-1: new high-speed USB device number 22 using dummy_hcd
[  126.099011][   T65] usb 5-1: device descriptor read/8, error -71
[  126.228957][   T65] usb 5-1: device descriptor read/8, error -71
[  126.320000][   T36] audit: type=1400 audit(126.286:428): avc:  denied  { bind } for  pid=3056 comm="syz.6.806" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1
[  126.325052][ T3057] can: request_module (can-proto-5) failed.
[  126.348906][   T10] usb 7-1: USB disconnect, device number 19
[  126.435973][   T36] audit: type=1400 audit(126.396:429): avc:  denied  { mounton } for  pid=3075 comm="syz.2.811" path="/181/file0" dev="tmpfs" ino=1167 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1
[  126.468054][   T65] usb 5-1: new high-speed USB device number 23 using dummy_hcd
[  126.488985][   T65] usb 5-1: device descriptor read/8, error -71
[  126.618834][   T65] usb 5-1: device descriptor read/8, error -71
[  126.728015][   T65] usb usb5-port1: unable to enumerate USB device
[  127.068497][ T3090] netlink: 'syz.6.814': attribute type 4 has an invalid length.
[  127.076237][ T3090] netlink: 17 bytes leftover after parsing attributes in process `syz.6.814'.
[  127.085459][ T3090] netlink: 'syz.6.814': attribute type 1 has an invalid length.
[  127.093147][ T3090] netlink: 'syz.6.814': attribute type 2 has an invalid length.
[  127.102314][ T3090] can0: slcan on ptm0.
[  127.128331][ T3090] can0 (unregistered): slcan off ptm0.
[  127.368116][ T3129] netlink: 3657 bytes leftover after parsing attributes in process `syz.4.818'.
[  127.757906][   T10] usb 5-1: new high-speed USB device number 24 using dummy_hcd
[  127.908891][   T10] usb 5-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config
[  127.919242][   T10] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3
[  127.929801][   T10] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  127.939096][   T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  127.947081][   T10] usb 5-1: Product: Љ
[  127.951176][   T10] usb 5-1: Manufacturer: Ь
[  127.955700][   T10] usb 5-1: SerialNumber: 卬橖갶ᕩ૜뤑寿ꡃ밿䈸ᬔ䏍┓ㅿ懃໦乘Œ뤸ꃳꍻ㙇ī㒷놩񎆁ߚ놃恺龀犄칧খ蝹æ欄⽬쵮뿳䶹絚貚輦∜裤ꗼ䭁눨醩钡쐌鰉ﬕ꟦뱍ᇑ倌齿喉禾Ⲻ潮竨왿턴龃樏頋ﰵ눂⇗齬䝙܀镘巻鈂坽ൂ눘ಬ
[  128.057438][   T36] audit: type=1400 audit(128.016:430): avc:  denied  { execute } for  pid=3141 comm="syz.6.823" path="/proc/174/task/175/net/icmp" dev="proc" ino=4026532991 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=file permissive=1
[  128.388134][   T10] usb 5-1: 0:2 : does not exist
[  128.396397][   T10] usb 5-1: USB disconnect, device number 24
[  128.900471][ T3148] overlayfs: failed to resolve './file0': -2
[  128.954240][ T3160] fuse: Bad value for 'rootmode'
[  128.966827][ T3162] netlink: 'syz.4.829': attribute type 12 has an invalid length.
[  129.106523][ T3172] rust_binder: Error while translating object.
[  129.106549][ T3172] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM }
[  129.112881][ T3172] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:190
[  129.143631][ T3176] overlayfs: failed to resolve './file0': -2
[  129.565446][ T3187] netlink: 8 bytes leftover after parsing attributes in process `syz.2.837'.
[  129.812933][   T36] audit: type=1400 audit(129.776:431): avc:  denied  { bind } for  pid=3192 comm="syz.4.840" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1
[  129.897895][   T45] usb 3-1: new high-speed USB device number 37 using dummy_hcd
[  129.913020][ T3195] binder: Unknown parameter 'context�'
[  129.939932][ T3198] netlink: 9 bytes leftover after parsing attributes in process `syz.6.842'.
[  129.949356][ T3198] gretap0: entered promiscuous mode
[  129.955956][ T3198] netlink: 5 bytes leftover after parsing attributes in process `syz.6.842'.
[  129.965080][ T3198] 0��{X��: renamed from gretap0
[  129.971471][ T3198] 0��{X��: left promiscuous mode
[  129.976770][ T3198] 0��{X��: entered allmulticast mode
[  129.982896][ T3198] A link change request failed with some changes committed already. Interface 
30��{X�� may have been left with an inconsistent configuration, please check.
[  130.001083][ T3198] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=257 sclass=netlink_route_socket pid=3198 comm=syz.6.842
[  130.049105][   T45] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  130.057856][ T2833] usb 5-1: new high-speed USB device number 25 using dummy_hcd
[  130.060733][   T45] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11
[  130.079873][   T45] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[  130.091198][   T45] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  130.091893][   T36] audit: type=1326 audit(130.056:432): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3199 comm="syz.6.843" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7feac918ebe9 code=0x0
[  130.104229][   T45] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  130.104261][   T45] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  130.144670][   T45] usb 3-1: config 0 descriptor??
[  130.149915][ T3191] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[  130.197905][ T2833] usb 5-1: device descriptor read/64, error -71
[  130.437903][ T2833] usb 5-1: device descriptor read/64, error -71
[  130.560226][   T45] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0
[  130.567772][   T45] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0
[  130.575205][   T45] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0
[  130.582626][   T45] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0
[  130.590061][   T45] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0
[  130.597453][   T45] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0
[  130.604869][   T45] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0
[  130.612288][   T45] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0
[  130.619874][   T45] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0
[  130.627254][   T45] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0
[  130.634743][   T45] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0
[  130.642323][   T45] plantronics 0003:047F:FFFF.001D: No inputs registered, leaving
[  130.651431][   T45] plantronics 0003:047F:FFFF.001D: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0
[  130.677892][ T2833] usb 5-1: new high-speed USB device number 26 using dummy_hcd
[  130.807891][ T2833] usb 5-1: device descriptor read/64, error -71
[  130.848533][   T45] usb 3-1: USB disconnect, device number 37
[  130.885119][   T36] audit: type=1400 audit(130.846:433): avc:  denied  { listen } for  pid=3206 comm="syz.6.845" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1
[  131.048268][ T2833] usb 5-1: device descriptor read/64, error -71
[  131.127910][   T10] usb 7-1: new high-speed USB device number 21 using dummy_hcd
[  131.157951][ T2833] usb usb5-port1: attempt power cycle
[  131.279084][   T10] usb 7-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33
[  131.291763][   T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  131.300460][   T10] usb 7-1: config 0 descriptor??
[  131.507882][ T2833] usb 5-1: new high-speed USB device number 27 using dummy_hcd
[  131.519141][   T10] usb 7-1: Cannot read MAC address
[  131.524351][   T10] MOSCHIP usb-ethernet driver 7-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71
[  131.547540][ T2833] usb 5-1: device descriptor read/8, error -71
[  131.563468][   T10] usb 7-1: USB disconnect, device number 21
[  131.688781][ T2833] usb 5-1: device descriptor read/8, error -71
[  131.937877][ T2833] usb 5-1: new high-speed USB device number 28 using dummy_hcd
[  131.978909][ T2833] usb 5-1: device descriptor read/8, error -71
[  132.067916][ T3228] sock: sock_set_timeout: `syz.7.850' (pid 3228) tries to set negative timeout
[  132.108945][ T2833] usb 5-1: device descriptor read/8, error -71
[  132.220888][ T2833] usb usb5-port1: unable to enumerate USB device
[  132.557861][  T654] usb 3-1: new high-speed USB device number 38 using dummy_hcd
[  132.718973][  T654] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  132.730709][  T654] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11
[  132.742446][  T654] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[  132.754080][  T654] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  132.767328][  T654] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  132.776534][  T654] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  132.789244][  T654] usb 3-1: config 0 descriptor??
[  132.794628][ T3248] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[  132.874131][ T3255] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 112, limit: 136, size: 73)
[  132.874160][ T3255] rust_binder: Error while translating object.
[  132.884812][ T3255] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  132.891140][ T3255] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:624
[  132.914578][ T3259] SELinux: security_context_str_to_sid (syste_u�Gй�:��) failed with errno=-22
[  132.980473][ T3267] netlink: 72 bytes leftover after parsing attributes in process `syz.4.863'.
[  132.989812][ T3268] netlink: 72 bytes leftover after parsing attributes in process `syz.4.863'.
[  133.008979][ T3268] /dev/rnullb0: Can't open blockdev
[  133.016692][ T3267] /dev/rnullb0: Can't open blockdev
[  133.207002][  T654] plantronics 0003:047F:FFFF.001E: unknown main item tag 0x0
[  133.214670][  T654] plantronics 0003:047F:FFFF.001E: unknown main item tag 0x0
[  133.222487][  T654] plantronics 0003:047F:FFFF.001E: unknown main item tag 0x0
[  133.230339][  T654] plantronics 0003:047F:FFFF.001E: unknown main item tag 0x0
[  133.238065][  T654] plantronics 0003:047F:FFFF.001E: unknown main item tag 0x0
[  133.245721][  T654] plantronics 0003:047F:FFFF.001E: unknown main item tag 0x0
[  133.253504][  T654] plantronics 0003:047F:FFFF.001E: unknown main item tag 0x0
[  133.262922][  T654] plantronics 0003:047F:FFFF.001E: unknown main item tag 0x0
[  133.270607][  T654] plantronics 0003:047F:FFFF.001E: unknown main item tag 0x0
[  133.277843][ T2833] usb 5-1: new full-speed USB device number 29 using dummy_hcd
[  133.278350][  T654] plantronics 0003:047F:FFFF.001E: unknown main item tag 0x0
[  133.293491][  T654] plantronics 0003:047F:FFFF.001E: unknown main item tag 0x0
[  133.301412][  T654] plantronics 0003:047F:FFFF.001E: No inputs registered, leaving
[  133.312677][  T654] plantronics 0003:047F:FFFF.001E: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0
[  133.428939][ T2833] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  133.439468][ T2833] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3
[  133.458847][ T2833] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  133.467946][ T2833] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  133.476136][ T2833] usb 5-1: Product: syz
[  133.480392][ T2833] usb 5-1: Manufacturer: syz
[  133.485016][ T2833] usb 5-1: SerialNumber: syz
[  133.581631][  T654] usb 3-1: USB disconnect, device number 38
[  133.693473][ T2833] usb 5-1: 0:2 : does not exist
[  133.710565][ T2833] usb 5-1: 5:0: failed to get current value for ch 0 (-22)
[  133.722210][ T2833] usb 5-1: USB disconnect, device number 29
[  133.736985][ T1306] udevd[1306]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory
[  133.976420][   T36] audit: type=1400 audit(133.936:434): avc:  denied  { setattr } for  pid=3290 comm="syz.7.871" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1
[  134.022625][ T3295] rust_binder: Write failure EFAULT in pid:243
[  134.054555][   T36] audit: type=1400 audit(134.016:435): avc:  denied  { setopt } for  pid=3298 comm="syz.7.875" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1
[  134.055281][ T3299] netlink: 80 bytes leftover after parsing attributes in process `syz.7.875'.
[  134.159984][   T36] audit: type=1400 audit(134.126:436): avc:  denied  { bind } for  pid=3309 comm="syz.7.880" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1
[  134.211924][   T36] audit: type=1326 audit(134.176:437): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3317 comm="syz.7.882" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd15538ebe9 code=0x0
[  134.967889][ T2833] usb 5-1: new high-speed USB device number 30 using dummy_hcd
[  134.991120][ T3335] overlayfs: conflicting lowerdir path
[  135.015554][ T3337] rust_binder: Error while translating object.
[  135.015585][ T3337] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT }
[  135.022476][ T3337] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:253
[  135.127837][ T2833] usb 5-1: Using ep0 maxpacket: 32
[  135.143758][ T2833] usb 5-1: config index 0 descriptor too short (expected 29220, got 36)
[  135.152362][ T2833] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32
[  135.162430][ T2833] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81
[  135.171920][ T2833] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0
[  135.181888][ T2833] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0
[  135.191870][ T2833] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18
[  135.205261][ T2833] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40
[  135.214469][ T2833] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  135.224578][ T2833] usb 5-1: config 0 descriptor??
[  135.257867][  T654] usb 3-1: new high-speed USB device number 39 using dummy_hcd
[  135.267931][   T45] usb 7-1: new high-speed USB device number 22 using dummy_hcd
[  135.397899][   T45] usb 7-1: device descriptor read/64, error -71
[  135.407900][  T654] usb 3-1: Using ep0 maxpacket: 32
[  135.414274][  T654] usb 3-1: config index 0 descriptor too short (expected 29220, got 36)
[  135.422737][  T654] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32
[  135.431881][  T654] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81
[  135.433833][ T2833] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 30 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17
[  135.445963][  T654] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0
[  135.462215][  T654] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0
[  135.462491][ T2833] usb 5-1: USB disconnect, device number 30
[  135.472194][  T654] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18
[  135.479890][ T2833] usblp0: removed
[  135.491324][  T654] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40
[  135.503824][  T654] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  135.512842][  T654] usb 3-1: config 0 descriptor??
[  135.657868][   T45] usb 7-1: device descriptor read/64, error -71
[  135.720163][  T654] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 39 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17
[  135.733024][  T654] usb 3-1: USB disconnect, device number 39
[  135.739721][  T654] usblp0: removed
[  135.917992][   T45] usb 7-1: new high-speed USB device number 23 using dummy_hcd
[  135.957901][ T2833] usb 5-1: new high-speed USB device number 31 using dummy_hcd
[  136.057882][   T45] usb 7-1: device descriptor read/64, error -71
[  136.107866][ T2833] usb 5-1: Using ep0 maxpacket: 32
[  136.114264][ T2833] usb 5-1: config index 0 descriptor too short (expected 29220, got 36)
[  136.122755][ T2833] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32
[  136.131462][ T2833] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81
[  136.140464][ T2833] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0
[  136.150219][ T2833] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0
[  136.160011][ T2833] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18
[  136.173109][ T2833] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40
[  136.182243][ T2833] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  136.190698][ T2833] usb 5-1: config 0 descriptor??
[  136.297891][   T45] usb 7-1: device descriptor read/64, error -71
[  136.397543][ T2833] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 31 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17
[  136.408014][   T45] usb usb7-port1: attempt power cycle
[  136.499653][   T36] audit: type=1400 audit(136.466:438): avc:  denied  { execmem } for  pid=3371 comm="syz.2.900" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[  136.509777][ T3372] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  136.597598][ T2833] usb 5-1: USB disconnect, device number 31
[  136.624772][ T2833] usblp0: removed
[  136.757884][   T45] usb 7-1: new high-speed USB device number 24 using dummy_hcd
[  136.778925][   T45] usb 7-1: device descriptor read/8, error -71
[  136.907905][   T65] usb 3-1: new high-speed USB device number 40 using dummy_hcd
[  136.916327][   T45] usb 7-1: device descriptor read/8, error -71
[  137.068651][   T65] usb 3-1: Using ep0 maxpacket: 32
[  137.074011][ T3388] binder: Bad value for 'max'
[  137.079885][   T65] usb 3-1: config index 0 descriptor too short (expected 29220, got 36)
[  137.088873][   T65] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32
[  137.097528][   T65] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81
[  137.106776][   T65] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0
[  137.116481][   T65] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0
[  137.126664][   T65] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18
[  137.139742][   T65] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40
[  137.148905][   T65] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  137.157394][   T65] usb 3-1: config 0 descriptor??
[  137.167844][   T45] usb 7-1: new high-speed USB device number 25 using dummy_hcd
[  137.181434][ T3391] netlink: 'syz.7.905': attribute type 2 has an invalid length.
[  137.190193][   T45] usb 7-1: device descriptor read/8, error -71
[  137.318921][   T45] usb 7-1: device descriptor read/8, error -71
[  137.364151][   T65] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 40 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17
[  137.376461][   T65] usb 3-1: USB disconnect, device number 40
[  137.383186][   T65] usblp0: removed
[  137.427923][   T45] usb usb7-port1: unable to enumerate USB device
[  137.758201][   T45] usb 5-1: new high-speed USB device number 32 using dummy_hcd
[  137.797901][   T31] usb 3-1: new high-speed USB device number 41 using dummy_hcd
[  137.907864][   T45] usb 5-1: Using ep0 maxpacket: 32
[  137.914006][   T45] usb 5-1: config index 0 descriptor too short (expected 29220, got 36)
[  137.922382][   T45] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32
[  137.931174][   T45] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81
[  137.940212][   T45] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0
[  137.949974][   T45] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0
[  137.959742][   T31] usb 3-1: Using ep0 maxpacket: 32
[  137.964892][   T45] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18
[  137.978032][   T45] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40
[  137.987199][   T45] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  137.996005][   T31] usb 3-1: config index 0 descriptor too short (expected 29220, got 36)
[  138.004588][   T45] usb 5-1: config 0 descriptor??
[  138.009627][   T31] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32
[  138.020354][   T31] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81
[  138.029482][   T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0
[  138.039314][   T31] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0
[  138.049672][   T31] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18
[  138.062990][   T31] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40
[  138.072317][   T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  138.081932][   T31] usb 3-1: config 0 descriptor??
[  138.220938][   T45] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 32 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17
[  138.234027][   T45] usb 5-1: USB disconnect, device number 32
[  138.240839][   T45] usblp0: removed
[  138.288576][   T31] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 41 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17
[  138.367889][  T654] usb 7-1: new high-speed USB device number 26 using dummy_hcd
[  138.422865][   T36] audit: type=1400 audit(138.386:439): avc:  denied  { bind } for  pid=3396 comm="syz.4.907" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1
[  138.489472][ T2833] usb 3-1: USB disconnect, device number 41
[  138.497011][ T2833] usblp0: removed
[  138.517850][  T654] usb 7-1: Using ep0 maxpacket: 8
[  138.523966][  T654] usb 7-1: config 0 has an invalid interface number: 31 but max is 0
[  138.532191][  T654] usb 7-1: config 0 has no interface number 0
[  138.539621][  T654] usb 7-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16
[  138.548710][  T654] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  138.556795][  T654] usb 7-1: Product: syz
[  138.560976][  T654] usb 7-1: Manufacturer: syz
[  138.565564][  T654] usb 7-1: SerialNumber: syz
[  138.570709][  T654] usb 7-1: config 0 descriptor??
[  138.776620][ T3404] rust_binder: Error while translating object.
[  138.776657][ T3404] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM }
[  138.782928][ T3404] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:259
[  138.793834][  T654] usb 7-1: Found UVC 0.04 device syz (046d:08c3)
[  138.809416][  T654] uvcvideo 7-1:0.31: Entity type for entity Output 6 was not initialized!
[  138.819260][  T654] usb 7-1: USB disconnect, device number 26
[  138.828273][   T10] usb 5-1: new high-speed USB device number 33 using dummy_hcd
[  138.977895][   T10] usb 5-1: Using ep0 maxpacket: 16
[  138.984223][   T10] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  138.994854][   T10] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3
[  139.005309][   T10] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  139.020132][   T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  139.028314][   T10] usb 5-1: Product: syz
[  139.032493][   T10] usb 5-1: Manufacturer: syz
[  139.039823][   T10] usb 5-1: SerialNumber: syz
[  139.046329][ T3413] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  139.056757][ T3413] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  139.128404][ T3417] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  139.179534][ T3418] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false
[  139.186015][ T3418] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC }
[  139.194036][ T3418] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:590
[  139.266486][   T10] usb 5-1: 0:2 : does not exist
[  139.282951][   T10] usb 5-1: 5:0: failed to get current value for ch 0 (-22)
[  139.293312][   T10] usb 5-1: USB disconnect, device number 33
[  139.302404][ T1306] udevd[1306]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory
[  139.333034][   T36] audit: type=1400 audit(139.296:440): avc:  denied  { execute } for  pid=3419 comm="syz.6.915" name="file0" dev="ramfs" ino=24806 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1
[  139.597910][   T31] usb 7-1: new high-speed USB device number 27 using dummy_hcd
[  139.747876][   T31] usb 7-1: Using ep0 maxpacket: 32
[  139.754437][   T31] usb 7-1: config index 0 descriptor too short (expected 29220, got 36)
[  139.762845][   T31] usb 7-1: config 0 has too many interfaces: 81, using maximum allowed: 32
[  139.771493][   T31] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 81
[  139.780613][   T31] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0
[  139.790334][   T31] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0
[  139.800026][   T31] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18
[  139.813008][   T31] usb 7-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40
[  139.822097][   T31] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  139.830607][   T31] usb 7-1: config 0 descriptor??
[  139.974476][ T3432] __vm_enough_memory: pid: 3432, comm: syz.2.918, bytes: 18014402804453376 not enough memory for the allocation
[  140.038342][   T31] usblp 7-1:0.0: usblp0: USB Bidirectional printer dev 27 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17
[  140.050699][   T31] usb 7-1: USB disconnect, device number 27
[  140.058198][   T31] usblp0: removed
[  140.183277][ T3457] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  140.360198][ T3477] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2
[  140.487877][   T10] usb 7-1: new high-speed USB device number 28 using dummy_hcd
[  140.568981][   T65] rust_binder: 3472: removing orphan mapping 0:1048
[  140.637850][   T10] usb 7-1: Using ep0 maxpacket: 32
[  140.644067][   T10] usb 7-1: config index 0 descriptor too short (expected 29220, got 36)
[  140.653220][   T10] usb 7-1: config 0 has too many interfaces: 81, using maximum allowed: 32
[  140.661999][   T10] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 81
[  140.671665][   T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0
[  140.681743][   T10] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0
[  140.692012][   T10] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18
[  140.705469][   T10] usb 7-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40
[  140.714861][   T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  140.727916][   T10] usb 7-1: config 0 descriptor??
[  140.806441][ T3491] fuse: Bad value for 'user_id'
[  140.811667][ T3491] fuse: Bad value for 'user_id'
[  140.817856][  T654] usb 3-1: new high-speed USB device number 42 using dummy_hcd
[  140.855073][   T36] audit: type=1400 audit(140.816:441): avc:  denied  { validate_trans } for  pid=3495 comm="syz.4.937" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1
[  140.877170][   T36] audit: type=1326 audit(140.816:442): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3495 comm="syz.4.937" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8a68d8ebe9 code=0x0
[  140.928419][ T3500] /dev/rnullb0: Can't open blockdev
[  140.934533][   T10] usblp 7-1:0.0: usblp0: USB Bidirectional printer dev 28 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17
[  140.977874][  T654] usb 3-1: Using ep0 maxpacket: 8
[  140.985262][  T654] usb 3-1: config 0 interface 0 has no altsetting 0
[  140.992108][  T654] usb 3-1: New USB device found, idVendor=056e, idProduct=00ff, bcdDevice= 0.00
[  141.001247][  T654] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  141.012295][  T654] usb 3-1: config 0 descriptor??
[  141.024768][ T3515] 9pnet_fd: Insufficient options for proto=fd
[  141.136008][ T3425] tmpfs: Bad value for 'size'
[  141.141214][ T3425] veth1_macvtap: left promiscuous mode
[  141.148353][ T3425] veth1_macvtap: entered promiscuous mode
[  141.156107][ T2206] tipc: Subscription rejected, illegal request
[  141.165364][   T10] usb 7-1: USB disconnect, device number 28
[  141.174253][   T10] usblp0: removed
[  141.420500][  T654] elecom 0003:056E:00FF.001F: unknown main item tag 0x0
[  141.428069][  T654] elecom 0003:056E:00FF.001F: hidraw0: USB HID v0.00 Device [HID 056e:00ff] on usb-dummy_hcd.2-1/input0
[  141.621157][ T3482] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  141.621226][ T3482] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  141.627700][ T3482] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:631
[  141.640136][ T3482] rust_binder: Write failure EFAULT in pid:631
[  141.685030][   T36] audit: type=1400 audit(141.652:443): avc:  denied  { sqpoll } for  pid=3524 comm="syz.6.944" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1
[  141.712107][   T10] usb 3-1: USB disconnect, device number 42
[  141.724328][ T3529] syz.4.945: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz4,mems_allowed=0
[  141.739874][ T3529] CPU: 0 UID: 0 PID: 3529 Comm: syz.4.945 Not tainted 6.12.38-syzkaller-g125206b4d7d6 #0 b4183df40fdd555480841fc2136fdfcd4e3aa3fe
[  141.739913][ T3529] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  141.739926][ T3529] Call Trace:
[  141.739932][ T3529]  <TASK>
[  141.739941][ T3529]  __dump_stack+0x21/0x30
[  141.739973][ T3529]  dump_stack_lvl+0x10c/0x190
[  141.739997][ T3529]  ? __cfi_dump_stack_lvl+0x10/0x10
[  141.740022][ T3529]  ? _raw_spin_unlock_irqrestore+0x4a/0x70
[  141.740051][ T3529]  dump_stack+0x19/0x20
[  141.740078][ T3529]  warn_alloc+0x1bc/0x2a0
[  141.740106][ T3529]  ? stack_depot_save_flags+0x38/0x800
[  141.740142][ T3529]  ? __cfi_warn_alloc+0x10/0x10
[  141.740178][ T3529]  ? kasan_save_track+0x4f/0x80
[  141.740203][ T3529]  ? __kmalloc_cache_noprof+0x1a5/0x3c0
[  141.740234][ T3529]  ? xskq_create+0x68/0x2a0
[  141.740262][ T3529]  ? xsk_init_queue+0xb6/0x120
[  141.740289][ T3529]  ? xsk_setsockopt+0x43f/0x6f0
[  141.740315][ T3529]  ? do_sock_setsockopt+0x26d/0x400
[  141.740343][ T3529]  ? __x64_sys_setsockopt+0x1b8/0x250
[  141.740370][ T3529]  ? x64_sys_call+0x2adc/0x2ee0
[  141.740409][ T3529]  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  141.740442][ T3529]  __vmalloc_node_range_noprof+0x135/0x1420
[  141.740477][ T3529]  ? __cfi___vmalloc_node_range_noprof+0x10/0x10
[  141.740507][ T3529]  ? avc_has_perm+0x144/0x220
[  141.740538][ T3529]  ? kasan_save_alloc_info+0x40/0x50
[  141.740567][ T3529]  ? __kasan_kmalloc+0x96/0xb0
[  141.740589][ T3529]  vmalloc_user_noprof+0x77/0x90
[  141.740624][ T3529]  ? xskq_create+0xdb/0x2a0
[  141.740649][ T3529]  xskq_create+0xdb/0x2a0
[  141.740676][ T3529]  xsk_init_queue+0xb6/0x120
[  141.740701][ T3529]  xsk_setsockopt+0x43f/0x6f0
[  141.740725][ T3529]  ? __cfi_xsk_setsockopt+0x10/0x10
[  141.740750][ T3529]  ? do_futex+0x356/0x500
[  141.740771][ T3529]  ? bpf_lsm_socket_setsockopt+0xd/0x20
[  141.740796][ T3529]  ? security_socket_setsockopt+0x33/0xd0
[  141.740816][ T3529]  ? __cfi_xsk_setsockopt+0x10/0x10
[  141.740841][ T3529]  do_sock_setsockopt+0x26d/0x400
[  141.740869][ T3529]  ? __cfi_do_sock_setsockopt+0x10/0x10
[  141.740899][ T3529]  __x64_sys_setsockopt+0x1b8/0x250
[  141.740926][ T3529]  x64_sys_call+0x2adc/0x2ee0
[  141.740954][ T3529]  do_syscall_64+0x58/0xf0
[  141.740977][ T3529]  ? clear_bhb_loop+0x50/0xa0
[  141.740996][ T3529]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  141.741025][ T3529] RIP: 0033:0x7f8a68d8ebe9
[  141.741043][ T3529] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  141.741061][ T3529] RSP: 002b:00007f8a69c9b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  141.741085][ T3529] RAX: ffffffffffffffda RBX: 00007f8a68fb5fa0 RCX: 00007f8a68d8ebe9
[  141.741102][ T3529] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000005
[  141.741115][ T3529] RBP: 00007f8a68e11e19 R08: 0000000000000004 R09: 0000000000000000
[  141.741129][ T3529] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000
[  141.741142][ T3529] R13: 00007f8a68fb6038 R14: 00007f8a68fb5fa0 R15: 00007ffcc87f4798
[  141.741160][ T3529]  </TASK>
[  141.741201][ T3529] Mem-Info:
[  141.775926][ T3530] netlink: 12 bytes leftover after parsing attributes in process `syz.4.945'.
[  141.780271][ T3529] active_anon:7172 inactive_anon:2 isolated_anon:0
[  141.780271][ T3529]  active_file:20556 inactive_file:4129 isolated_file:0
[  141.780271][ T3529]  unevictable:0 dirty:34 writeback:0
[  141.780271][ T3529]  slab_reclaimable:6659 slab_unreclaimable:72508
[  141.780271][ T3529]  mapped:30851 shmem:165 pagetables:1161
[  141.780271][ T3529]  sec_pagetables:0 bounce:0
[  141.780271][ T3529]  kernel_misc_reclaimable:0
[  141.780271][ T3529]  free:1510076 free_pcp:2243 free_cma:0
[  141.927837][  T654] usb 7-1: new high-speed USB device number 29 using dummy_hcd
[  141.929367][ T3529] Node 0 active_anon:34836kB inactive_anon:8kB active_file:82224kB inactive_file:16516kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:129552kB dirty:136kB writeback:0kB shmem:6804kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:6168kB pagetables:4668kB sec_pagetables:0kB all_unreclaimable? no
[  142.067832][  T654] usb 7-1: device descriptor read/64, error -71
[  142.104237][ T3529] DMA32 free:2960212kB boost:0kB min:19088kB low:23860kB high:28632kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145324kB managed:2965968kB mlocked:0kB bounce:0kB free_pcp:5756kB local_pcp:5756kB free_cma:0kB
[  142.180092][ T3529] lowmem_reserve[]: 0 3921 3921
[  142.185073][ T3529] Normal free:3072056kB boost:0kB min:25964kB low:32452kB high:38940kB reserved_highatomic:0KB free_highatomic:0KB active_anon:34852kB inactive_anon:8kB active_file:82224kB inactive_file:16516kB unevictable:0kB writepending:136kB present:5242880kB managed:4016120kB mlocked:0kB bounce:0kB free_pcp:5068kB local_pcp:0kB free_cma:0kB
[  142.216525][ T3529] lowmem_reserve[]: 0 0 0
[  142.220974][ T3529] DMA32: 5*4kB (M) 4*8kB (M) 4*16kB (M) 5*32kB (M) 3*64kB (M) 3*128kB (M) 4*256kB (M) 4*512kB (M) 5*1024kB (UM) 5*2048kB (M) 718*4096kB (M) = 2960212kB
[  142.236743][ T3529] Normal: 290*4kB (UE) 1592*8kB (UE) 1135*16kB (UME) 1082*32kB (UME) 735*64kB (UME) 58*128kB (UME) 33*256kB (UME) 13*512kB (UME) 15*1024kB (UME) 6*2048kB (UME) 710*4096kB (UM) = 3072056kB
[  142.259249][ T3529] 26384 total pagecache pages
[  142.264227][ T3529] 2 pages in swap cache
[  142.268891][ T3529] Free swap  = 124784kB
[  142.273122][ T3529] Total swap = 124996kB
[  142.279262][ T3529] 2097051 pages RAM
[  142.283867][ T3529] 0 pages HighMem/MovableOnly
[  142.290183][ T3529] 351529 pages reserved
[  142.294458][ T3529] 0 pages cma reserved
[  142.300932][ T3529] Memory allocations:
[  142.304960][ T3529]          0 B        0 init/main.c:1370 func:do_initcalls
[  142.312427][ T3529]          0 B        0 init/do_mounts.c:186 func:mount_root_generic
[  142.320659][ T3529]          0 B        0 init/do_mounts.c:158 func:do_mount_root
[  142.328645][ T3529]          0 B        0 init/do_mounts.c:352 func:mount_nodev_root
[  142.328661][   T36] audit: type=1400 audit(142.292:444): avc:  denied  { setopt } for  pid=3531 comm="syz.2.946" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[  142.336784][ T3529]          0 B        0 init/do_mounts_rd.c:241 func:rd_load_image
[  142.364755][ T3532] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION freeze notification cookie mismatch
[  142.366698][  T654] usb 7-1: device descriptor read/64, error -71
[  142.374105][ T3532] rust_binder: Write failure EINVAL in pid:634
[  142.380228][ T3529]          0 B        0 init/do_mounts_rd.c:72 func:identify_ramdisk_image
[  142.403611][ T3529]          0 B        0 init/initramfs.c:507 func:unpack_to_rootfs
[  142.416449][ T3529]          0 B        0 init/initramfs.c:508 func:unpack_to_rootfs
[  142.424555][ T3529]          0 B        0 init/initramfs.c:509 func:unpack_to_rootfs
[  142.432873][ T3529]          0 B        0 init/initramfs.c:101 func:find_link
[  142.617943][  T654] usb 7-1: new high-speed USB device number 30 using dummy_hcd
[  142.663028][ T3544] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  142.835439][ T3546] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false
[  142.841979][ T3546] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC }
[  142.850154][ T3546] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:640
[  142.860399][  T654] usb 7-1: device descriptor read/64, error -71
[  143.107858][  T654] usb 7-1: device descriptor read/64, error -71
[  143.217936][  T654] usb usb7-port1: attempt power cycle
[  143.557948][  T654] usb 7-1: new high-speed USB device number 31 using dummy_hcd
[  143.593635][  T654] usb 7-1: device descriptor read/8, error -71
[  143.728832][  T654] usb 7-1: device descriptor read/8, error -71
[  143.847854][   T10] usb 5-1: new high-speed USB device number 34 using dummy_hcd
[  143.967863][  T654] usb 7-1: new high-speed USB device number 32 using dummy_hcd
[  143.988978][  T654] usb 7-1: device descriptor read/8, error -71
[  144.007889][   T10] usb 5-1: Using ep0 maxpacket: 8
[  144.015037][   T10] usb 5-1: config 86 has an invalid interface number: 214 but max is 1
[  144.023433][   T10] usb 5-1: config 86 has an invalid descriptor of length 0, skipping remainder of the config
[  144.033658][   T10] usb 5-1: config 86 has 1 interface, different from the descriptor's value: 2
[  144.042656][   T10] usb 5-1: config 86 has no interface number 0
[  144.048937][   T10] usb 5-1: config 86 interface 214 altsetting 4 has 0 endpoint descriptors, different from the interface descriptor's value: 16
[  144.062147][   T10] usb 5-1: config 86 interface 214 has no altsetting 0
[  144.070554][   T10] usb 5-1: New USB device found, idVendor=13d8, idProduct=0011, bcdDevice=d0.90
[  144.079728][   T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  144.087735][   T10] usb 5-1: Product: 㽖狊⤣㲈頪뚟Ҿ톥犷챯㭍駰ᕾ蘦ū䁅ᚆ̜꣰޿勿ᩄ뛪ၣ㟢뜾㗇ꉇ辀꺾Ϥ⤩켔車⾇໪잽닭⧿൞ꉴ춈靤夃㵒밄⫨鎧蔐⊌鑥╂든陿랣隯觺踮뤰൫裎睛샰沴᳛ᡅ墎甾
[  144.111038][   T10] usb 5-1: Manufacturer: ᐌ
[  144.115641][   T10] usb 5-1: SerialNumber: syz
[  144.130994][  T654] usb 7-1: device descriptor read/8, error -71
[  144.248574][  T654] usb usb7-port1: unable to enumerate USB device
[  144.326200][   T10] usb 5-1: USB disconnect, device number 34
[  144.629825][ T3586] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  144.713289][ T3590] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:674
[  144.740838][   T36] audit: type=1400 audit(144.712:445): avc:  denied  { ioctl } for  pid=3597 comm="syz.6.969" path="/90/file0/.pending_reads" dev="incremental-fs" ino=2 ioctlcmd=0x671e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1
[  144.788528][ T3600] netlink: 48 bytes leftover after parsing attributes in process `syz.6.970'.
[  144.837319][   T36] audit: type=1400 audit(144.802:446): avc:  denied  { read } for  pid=3603 comm="syz.4.972" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1
[  145.191202][ T3620] netlink: 24 bytes leftover after parsing attributes in process `syz.4.976'.
[  145.606473][ T3628] netlink: 1 bytes leftover after parsing attributes in process `syz.2.979'.
[  145.736132][   T36] audit: type=1400 audit(145.702:447): avc:  denied  { create } for  pid=3639 comm="syz.2.983" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1
[  145.755962][   T36] audit: type=1400 audit(145.702:448): avc:  denied  { write } for  pid=3639 comm="syz.2.983" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1
[  145.761181][ T3643] rust_binder: 3638 RLIMIT_NICE not set
[  146.075805][   T45] rust_binder: 3653: removing orphan mapping 0:24
[  146.090801][  T654] usb 7-1: new high-speed USB device number 33 using dummy_hcd
[  146.098673][   T45] rust_binder: 0: removing orphan mapping 24:1120
[  146.247863][  T654] usb 7-1: Using ep0 maxpacket: 16
[  146.254469][  T654] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  146.267686][  T654] usb 7-1: New USB device found, idVendor=0738, idProduct=1713, bcdDevice= 0.00
[  146.276946][  T654] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  146.285967][  T654] usb 7-1: config 0 descriptor??
[  146.696523][  T654] usb 7-1: string descriptor 0 read error: -71
[  146.704332][  T654] usbhid 7-1:0.0: can't add hid device: -71
[  146.710338][  T654] usbhid 7-1:0.0: probe with driver usbhid failed with error -71
[  146.719279][  T654] usb 7-1: USB disconnect, device number 33
[  147.220139][ T3693] netlink: 16 bytes leftover after parsing attributes in process `syz.7.999'.
[  147.231065][ T3694] netlink: 16 bytes leftover after parsing attributes in process `syz.7.999'.
[  147.477871][  T654] usb 5-1: new high-speed USB device number 35 using dummy_hcd
[  147.589726][ T3708] binder: Unknown parameter '"�"rΚ7��'
[  147.608049][ T3711] netlink: 'syz.2.1007': attribute type 2 has an invalid length.
[  147.642963][  T654] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  147.655284][ T3714] input: syz1 as /devices/virtual/input/input34
[  147.662622][  T654] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40
[  147.683846][  T654] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  147.714124][  T654] usb 5-1: config 0 descriptor??
[  147.724804][ T3716] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  147.725140][ T3716] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 216, size: 208)
[  147.732297][ T3716] rust_binder: Error while translating object.
[  147.746971][ T3716] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  147.753715][ T3716] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:723
[  147.786963][ T3718] /dev/rnullb0: Can't open blockdev
[  148.067848][   T10] usb 7-1: new high-speed USB device number 34 using dummy_hcd
[  148.218994][   T10] usb 7-1: config index 0 descriptor too short (expected 45, got 36)
[  148.227327][   T10] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  148.239007][   T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7
[  148.250130][   T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[  148.261380][   T10] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  148.274306][   T10] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  148.283814][   T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  148.294314][   T10] usb 7-1: config 0 descriptor??
[  148.299690][ T3704] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22
[  148.329617][ T3696] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:725
[  148.339271][  T654] usbhid 5-1:0.0: can't add hid device: -71
[  148.355352][  T654] usbhid 5-1:0.0: probe with driver usbhid failed with error -71
[  148.364961][  T654] usb 5-1: USB disconnect, device number 35
[  148.712323][   T10] plantronics 0003:047F:FFFF.0020: unknown main item tag 0xd
[  148.721762][   T10] plantronics 0003:047F:FFFF.0020: No inputs registered, leaving
[  148.731083][   T10] plantronics 0003:047F:FFFF.0020: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0
[  148.980022][   T10] usb 7-1: USB disconnect, device number 34
[  149.057911][  T654] usb 5-1: new high-speed USB device number 36 using dummy_hcd
[  149.218970][  T654] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  149.230755][  T654] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11
[  149.241939][  T654] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[  149.253090][  T654] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  149.266175][  T654] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  149.275329][  T654] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  149.284179][  T654] usb 5-1: config 0 descriptor??
[  149.289741][ T3746] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22
[  149.529065][ T3782] netlink: 'syz.6.1031': attribute type 28 has an invalid length.
[  149.704234][  T654] plantronics 0003:047F:FFFF.0021: unknown main item tag 0x0
[  149.712147][  T654] plantronics 0003:047F:FFFF.0021: unknown main item tag 0x0
[  149.719769][  T654] plantronics 0003:047F:FFFF.0021: unknown main item tag 0x0
[  149.727242][  T654] plantronics 0003:047F:FFFF.0021: unknown main item tag 0x0
[  149.734959][  T654] plantronics 0003:047F:FFFF.0021: unknown main item tag 0x0
[  149.742738][  T654] plantronics 0003:047F:FFFF.0021: unknown main item tag 0x0
[  149.750461][  T654] plantronics 0003:047F:FFFF.0021: unknown main item tag 0x0
[  149.758085][  T654] plantronics 0003:047F:FFFF.0021: unknown main item tag 0x0
[  149.765679][  T654] plantronics 0003:047F:FFFF.0021: unknown main item tag 0x0
[  149.773354][  T654] plantronics 0003:047F:FFFF.0021: unknown main item tag 0x0
[  149.780952][  T654] plantronics 0003:047F:FFFF.0021: unknown main item tag 0x0
[  149.789217][  T654] plantronics 0003:047F:FFFF.0021: No inputs registered, leaving
[  149.802321][  T654] plantronics 0003:047F:FFFF.0021: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0
[  149.962517][ T3746] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  149.972024][ T3746] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  150.036284][   T10] usb 5-1: USB disconnect, device number 36
[  150.078038][   T52] Bluetooth: hci0: command 0x1003 tx timeout
[  150.084110][  T587] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  150.126781][ T3787] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1034'.
[  150.135959][   T36] audit: type=1400 audit(150.092:449): avc:  denied  { nlmsg_write } for  pid=3786 comm="syz.2.1034" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1
[  150.173799][ T3790] SELinux: security_context_str_to_sid (���_;ޚ���O5��O��D) failed with errno=-22
[  150.352541][ T3796] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1
[  150.359928][ T3796] rust_binder: Write failure EINVAL in pid:740
[  150.670584][ T3802] binder: Bad value for 'max'
[  150.805045][ T3810] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1043'.
[  150.815087][ T3810] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1043'.
[  150.879566][ T3810] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT }
[  150.879610][ T3810] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:761
[  151.197930][ T1968] usb 5-1: new high-speed USB device number 37 using dummy_hcd
[  151.368948][ T1968] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  151.380671][ T1968] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11
[  151.392138][ T1968] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[  151.403920][ T1968] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  151.417040][ T1968] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  151.417867][    T9] usb 3-1: new high-speed USB device number 43 using dummy_hcd
[  151.426433][ T1968] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  151.442997][ T1968] usb 5-1: config 0 descriptor??
[  151.452390][ T3820] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22
[  151.607899][    T9] usb 3-1: Using ep0 maxpacket: 8
[  151.614456][    T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  151.624656][    T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  151.635568][    T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  151.645376][    T9] usb 3-1: New USB device found, idVendor=046d, idProduct=c537, bcdDevice= 0.00
[  151.654511][    T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  151.663332][    T9] usb 3-1: config 0 descriptor??
[  151.931029][ T1968] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0
[  151.938585][ T1968] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0
[  151.946009][ T1968] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0
[  151.953965][ T1968] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0
[  151.961681][ T1968] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0
[  151.969285][ T1968] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0
[  151.976730][ T1968] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0
[  151.984573][ T1968] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0
[  151.992229][ T1968] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0
[  151.999897][ T1968] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0
[  152.007326][ T1968] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0
[  152.015210][ T1968] plantronics 0003:047F:FFFF.0022: No inputs registered, leaving
[  152.028642][ T1968] plantronics 0003:047F:FFFF.0022: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0
[  152.071947][    T9] logitech-djreceiver 0003:046D:C537.0023: item fetching failed at offset 0/1
[  152.081346][    T9] logitech-djreceiver 0003:046D:C537.0023: logi_dj_probe: parse failed
[  152.090003][    T9] logitech-djreceiver 0003:046D:C537.0023: probe with driver logitech-djreceiver failed with error -22
[  152.352998][ T3824] rust_binder: Write failure EFAULT in pid:745
[  152.353889][    T9] usb 3-1: USB disconnect, device number 43
[  152.520729][ T3835] overlayfs: only single ':' or double '::' sequences of unescaped colons in lowerdir mount option allowed.
[  152.753275][ T3856] sock: sock_timestamping_bind_phc: sock not bind to device
[  152.780059][ T3861] 9pnet_fd: Insufficient options for proto=fd
[  152.895259][ T3865] binder: Unknown parameter 'fscontext?}'
[  152.999256][ T3877] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  153.367848][   T10] usb 5-1: reset high-speed USB device number 37 using dummy_hcd
[  153.377859][ T1968] usb 3-1: new high-speed USB device number 44 using dummy_hcd
[  153.537840][ T1968] usb 3-1: Using ep0 maxpacket: 16
[  153.545076][ T1968] usb 3-1: config 1 has an invalid descriptor of length 177, skipping remainder of the config
[  153.560044][ T1968] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3
[  153.579555][ T1968] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  153.592050][ T1968] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  153.609651][ T1968] usb 3-1: Product: syz
[  153.618342][ T1968] usb 3-1: Manufacturer: syz
[  153.623932][ T1968] usb 3-1: SerialNumber: syz
[  153.839809][ T3879] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  153.848655][ T3879] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  153.861349][ T3879] batadv0: tun_chr_ioctl cmd 2147767519
[  153.867217][ T3879] batadv0: tun_chr_ioctl cmd 1074025672
[  153.873222][ T3879] batadv0: ignored: set checksum enabled
[  153.995793][ T1968] usb 3-1: 0:2 : does not exist
[  154.009863][ T1968] usb 3-1: USB disconnect, device number 44
[  154.039689][ T1306] udevd[1306]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory
[  154.068998][ T3886] 9pnet_fd: Insufficient options for proto=fd
[  154.647840][   T10] usb 5-1: device descriptor read/64, error -71
[  154.757857][ T1968] usb 3-1: new high-speed USB device number 45 using dummy_hcd
[  154.913245][ T1968] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  154.933014][ T1968] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7
[  154.936767][   T10] usb 5-1: device firmware changed
[  154.949449][ T2833] usb 5-1: USB disconnect, device number 37
[  154.957827][ T1968] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0
[  154.977890][ T1968] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  155.007855][ T1968] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  155.020592][ T1968] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  155.038104][ T1968] usb 3-1: config 0 descriptor??
[  155.097862][ T2833] usb 5-1: new high-speed USB device number 38 using dummy_hcd
[  155.259458][ T2833] usb 5-1: unable to get BOS descriptor or descriptor too short
[  155.267932][ T2833] usb 5-1: config 114 has an invalid interface number: 227 but max is 0
[  155.276851][ T2833] usb 5-1: config 114 has no interface number 0
[  155.283388][ T2833] usb 5-1: config 114 interface 227 altsetting 4 endpoint 0x1 has an invalid bInterval 126, changing to 10
[  155.295040][ T2833] usb 5-1: config 114 interface 227 has no altsetting 0
[  155.308226][ T2833] usb 5-1: New USB device found, idVendor=0499, idProduct=1051, bcdDevice=69.2d
[  155.317300][ T2833] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  155.325727][ T2833] usb 5-1: Product: syz
[  155.330084][ T2833] usb 5-1: Manufacturer: syz
[  155.334701][ T2833] usb 5-1: SerialNumber: syz
[  155.448311][ T1968] plantronics 0003:047F:FFFF.0024: unknown main item tag 0x6
[  155.457974][ T1968] plantronics 0003:047F:FFFF.0024: unknown main item tag 0x6
[  155.465508][ T1968] plantronics 0003:047F:FFFF.0024: item fetching failed at offset 14/15
[  155.474402][ T1968] plantronics 0003:047F:FFFF.0024: parse failed
[  155.481095][ T1968] plantronics 0003:047F:FFFF.0024: probe with driver plantronics failed with error -22
[  155.541276][ T3889] rust_binder: Write failure EFAULT in pid:779
[  155.542688][ T3889] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  155.557894][ T3897] rust_binder: Write failure EFAULT in pid:779
[  155.558525][ T3889] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  155.577166][ T2833] usb 5-1: invalid MIDI in EP 0
[  155.585590][ T2833] snd-usb-audio 5-1:114.227: probe with driver snd-usb-audio failed with error -22
[  155.596796][ T2833] usb 5-1: USB disconnect, device number 38
[  155.609124][ T2593] udevd[2593]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:114.227/sound/card0/controlC0/../uevent} for writing: No such file or directory
[  155.667064][   T12] Bluetooth: hci0: Frame reassembly failed (-84)
[  155.674656][   T12] Bluetooth: hci0: Frame reassembly failed (-84)
[  156.343602][ T3913] 9pnet_fd: Insufficient options for proto=fd
[  156.521020][ T3928] veth0_vlan: left promiscuous mode
[  156.592694][ T3928] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1084'.
[  156.606580][   T12] Bluetooth: hci1: Frame reassembly failed (-84)
[  156.619314][   T12] Bluetooth: hci1: Frame reassembly failed (-84)
[  157.677922][  T592] Bluetooth: hci0: command 0x1003 tx timeout
[  157.677935][  T587] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  157.692987][  T654] usb 3-1: USB disconnect, device number 45
[  157.789902][   T36] audit: type=1400 audit(157.762:450): avc:  denied  { setopt } for  pid=3939 comm="syz.2.1089" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1
[  158.637833][  T587] Bluetooth: hci1: command 0x1003 tx timeout
[  158.637865][   T52] Bluetooth: hci1: Opcode 0x1003 failed: -110
[  159.087892][ T2833] usb 3-1: new high-speed USB device number 46 using dummy_hcd
[  159.179164][ T3953] 9pnet_fd: Insufficient options for proto=fd
[  159.260749][ T2833] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  159.271828][ T2833] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  159.284043][ T2833] usb 3-1: New USB device found, idVendor=1d34, idProduct=0004, bcdDevice= 0.00
[  159.305246][ T2833] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  159.333959][ T2833] usb 3-1: config 0 descriptor??
[  159.682425][ T3967] can0: slcan on ptm0.
[  159.814495][ T3967] can0 (unregistered): slcan off ptm0.
[  159.962308][ T2833] hid-led 0003:1D34:0004.0025: hidraw0: USB HID v0.06 Device [HID 1d34:0004] on usb-dummy_hcd.2-1/input0
[  159.985065][ T2833] hid-led 0003:1D34:0004.0025: Dream Cheeky Webmail Notifier initialized
[  160.273876][ T1968] usb 3-1: USB disconnect, device number 46
[  160.419630][ T4000] netlink: 72 bytes leftover after parsing attributes in process `syz.7.1099'.
[  160.431895][ T4000] cgroup: fork rejected by pids controller in /syz7
[  160.447771][ T4000] 9pnet_fd: Insufficient options for proto=fd
[  160.448273][   T36] audit: type=1400 audit(160.412:451): avc:  denied  { ioctl } for  pid=3999 comm="syz.7.1099" path="/dev/uhid" dev="devtmpfs" ino=199 ioctlcmd=0x941d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1
[  160.536918][ T4003] overlayfs: missing 'lowerdir'
[  160.692709][ T4010] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  160.711394][ T4010] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  160.719722][ T4010] netlink: 124 bytes leftover after parsing attributes in process `syz.4.1102'.
[  160.730156][   T36] audit: type=1400 audit(160.702:452): avc:  denied  { nlmsg_read } for  pid=4008 comm="syz.4.1102" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1
[  160.789643][   T45] rust_binder: 3950: removing orphan mapping 0:24
[  160.811531][   T45] rust_binder: 0: removing orphan mapping 24:1024
[  160.813168][ T4013] 9pnet_fd: Insufficient options for proto=fd
[  160.948045][ T1968] usb 5-1: new high-speed USB device number 39 using dummy_hcd
[  161.087845][ T1968] usb 5-1: device descriptor read/64, error -71
[  161.337828][ T1968] usb 5-1: device descriptor read/64, error -71
[  161.378309][   T12] bridge_slave_1: left allmulticast mode
[  161.384081][   T12] bridge_slave_1: left promiscuous mode
[  161.398174][   T12] bridge0: port 2(bridge_slave_1) entered disabled state
[  161.418559][   T12] bridge_slave_0: left allmulticast mode
[  161.424329][   T12] bridge_slave_0: left promiscuous mode
[  161.438438][   T12] bridge0: port 1(bridge_slave_0) entered disabled state
[  161.587884][ T1968] usb 5-1: new high-speed USB device number 40 using dummy_hcd
[  161.618618][   T12] veth1_macvtap: left promiscuous mode
[  161.630058][   T12] veth0_vlan: left promiscuous mode
[  161.737845][ T1968] usb 5-1: device descriptor read/64, error -71
[  161.847960][ T4029] bridge0: port 1(bridge_slave_0) entered blocking state
[  161.868120][ T4029] bridge0: port 1(bridge_slave_0) entered disabled state
[  161.877465][ T4029] bridge_slave_0: entered allmulticast mode
[  161.894583][ T4029] bridge_slave_0: entered promiscuous mode
[  161.908854][ T4029] bridge0: port 2(bridge_slave_1) entered blocking state
[  161.928041][ T4029] bridge0: port 2(bridge_slave_1) entered disabled state
[  161.938513][ T4029] bridge_slave_1: entered allmulticast mode
[  161.951611][ T4029] bridge_slave_1: entered promiscuous mode
[  161.998173][ T1968] usb 5-1: device descriptor read/64, error -71
[  162.117937][ T1968] usb usb5-port1: attempt power cycle
[  162.151913][ T2206] bridge0: port 1(bridge_slave_0) entered blocking state
[  162.159040][ T2206] bridge0: port 1(bridge_slave_0) entered forwarding state
[  162.167703][ T2206] bridge0: port 2(bridge_slave_1) entered blocking state
[  162.174809][ T2206] bridge0: port 2(bridge_slave_1) entered forwarding state
[  162.237186][ T4029] veth0_vlan: entered promiscuous mode
[  162.265004][ T4029] veth1_macvtap: entered promiscuous mode
[  162.404699][ T4044] x_tables: duplicate underflow at hook 1
[  162.479469][ T1968] usb 5-1: new high-speed USB device number 41 using dummy_hcd
[  162.509262][ T1968] usb 5-1: device descriptor read/8, error -71
[  162.648865][ T1968] usb 5-1: device descriptor read/8, error -71
[  162.710066][ T4058] random: crng reseeded on system resumption
[  162.749852][ T4058] binder: Bad value for 'max'
[  162.830417][   T36] audit: type=1400 audit(162.802:453): avc:  denied  { lock } for  pid=4061 comm="syz.2.1120" path="socket:[28418]" dev="sockfs" ino=28418 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1
[  162.907848][ T1968] usb 5-1: new high-speed USB device number 42 using dummy_hcd
[  162.928977][ T1968] usb 5-1: device descriptor read/8, error -71
[  163.058904][ T1968] usb 5-1: device descriptor read/8, error -71
[  163.168200][ T1968] usb usb5-port1: unable to enumerate USB device
[  163.577321][ T4064] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore
[  163.586289][ T4064] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it.
[  163.597749][ T4064] overlayfs: missing 'lowerdir'
[  163.903830][   T36] audit: type=1400 audit(163.872:454): avc:  denied  { setattr } for  pid=4080 comm="syz.4.1126" name="urandom" dev="devtmpfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1
[  163.928397][ T4081] rust_binder: Failure when writing BR_NOOP at beginning of buffer.
[  163.928420][ T4081] rust_binder: Read failure Err(EFAULT) in pid:831
[  164.502156][ T4087] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  164.509193][ T4087] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:826
[  164.797825][ T2833] usb 3-1: new full-speed USB device number 47 using dummy_hcd
[  164.953266][ T4098] bridge0: port 1(bridge_slave_0) entered blocking state
[  164.960513][ T4098] bridge0: port 1(bridge_slave_0) entered disabled state
[  164.967623][ T4098] bridge_slave_0: entered allmulticast mode
[  164.975161][ T4098] bridge_slave_0: entered promiscuous mode
[  164.982344][ T4098] bridge0: port 2(bridge_slave_1) entered blocking state
[  164.990116][ T4098] bridge0: port 2(bridge_slave_1) entered disabled state
[  164.997394][ T4098] bridge_slave_1: entered allmulticast mode
[  165.004111][ T4098] bridge_slave_1: entered promiscuous mode
[  165.010075][ T2833] usb 3-1: unable to get BOS descriptor or descriptor too short
[  165.018186][ T2833] usb 3-1: not running at top speed; connect to a high speed hub
[  165.026656][ T2833] usb 3-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config
[  165.036829][ T2833] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2
[  165.046058][ T2833] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1
[  165.046407][   T12] bridge_slave_1: left allmulticast mode
[  165.062117][ T2833] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  165.064632][   T12] bridge_slave_1: left promiscuous mode
[  165.073985][ T2833] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  165.079464][   T12] bridge0: port 2(bridge_slave_1) entered disabled state
[  165.087633][ T2833] usb 3-1: SerialNumber: syz
[  165.099042][   T65] usb 5-1: new high-speed USB device number 43 using dummy_hcd
[  165.099216][   T12] bridge_slave_0: left allmulticast mode
[  165.112336][   T12] bridge_slave_0: left promiscuous mode
[  165.118374][   T12] bridge0: port 1(bridge_slave_0) entered disabled state
[  165.240578][   T12] veth1_macvtap: left promiscuous mode
[  165.246109][   T12] veth0_vlan: left promiscuous mode
[  165.252485][   T65] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  165.273724][   T65] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11
[  165.284992][   T65] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[  165.296391][   T65] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  165.309712][   T65] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  165.319417][ T4093] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  165.319566][ T4098] bridge0: port 2(bridge_slave_1) entered blocking state
[  165.326011][ T4098] bridge0: port 2(bridge_slave_1) entered forwarding state
[  165.333398][ T4094] rust_binder: Failed to allocate buffer. len:5264, is_oneway:false
[  165.340386][ T4098] bridge0: port 1(bridge_slave_0) entered blocking state
[  165.340596][ T4094] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC }
[  165.348606][ T4098] bridge0: port 1(bridge_slave_0) entered forwarding state
[  165.348778][   T65] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  165.363043][ T4094] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:832
[  165.377167][   T65] usb 5-1: config 0 descriptor??
[  165.396869][ T2833] cdc_ncm 3-1:1.0: skipping garbage
[  165.402238][ T2206] bridge0: port 1(bridge_slave_0) entered disabled state
[  165.409547][ T2833] cdc_ncm 3-1:1.0: CDC Union missing and no IAD found
[  165.416397][ T2833] cdc_ncm 3-1:1.0: bind() failure
[  165.416827][ T2206] bridge0: port 2(bridge_slave_1) entered disabled state
[  165.422156][ T4097] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22
[  165.438240][ T2833] usb 3-1: USB disconnect, device number 47
[  165.439502][ T2206] bridge0: port 1(bridge_slave_0) entered blocking state
[  165.451293][ T2206] bridge0: port 1(bridge_slave_0) entered forwarding state
[  165.465278][   T13] bridge0: port 2(bridge_slave_1) entered blocking state
[  165.472471][   T13] bridge0: port 2(bridge_slave_1) entered forwarding state
[  165.500790][ T4109] usb usb9: usbfs: process 4109 (syz.7.1133) did not claim interface 0 before use
[  165.503353][ T4110] netlink: 44 bytes leftover after parsing attributes in process `syz.7.1133'.
[  165.522453][ T4111] tc_dump_action: action bad kind
[  165.534661][ T4098] veth0_vlan: entered promiscuous mode
[  165.549509][ T4098] veth1_macvtap: entered promiscuous mode
[  165.604642][ T4116] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:2
[  165.855393][   T65] plantronics 0003:047F:FFFF.0026: unknown main item tag 0x0
[  165.874775][   T65] plantronics 0003:047F:FFFF.0026: unknown main item tag 0x0
[  165.882280][   T65] plantronics 0003:047F:FFFF.0026: unknown main item tag 0x0
[  165.890955][   T65] plantronics 0003:047F:FFFF.0026: unknown main item tag 0x0
[  165.898505][   T65] plantronics 0003:047F:FFFF.0026: unknown main item tag 0x0
[  165.905559][   T36] audit: type=1400 audit(165.872:455): avc:  denied  { create } for  pid=4130 comm="syz.7.1140" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1
[  165.906419][   T65] plantronics 0003:047F:FFFF.0026: unknown main item tag 0x0
[  165.935934][   T65] plantronics 0003:047F:FFFF.0026: item fetching failed at offset 10/15
[  165.944765][   T65] plantronics 0003:047F:FFFF.0026: parse failed
[  165.953301][   T65] plantronics 0003:047F:FFFF.0026: probe with driver plantronics failed with error -22
[  166.155947][ T4144] rust_binder: Error while translating object.
[  166.155984][ T4144] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT }
[  166.162485][ T4144] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:8
[  166.189005][ T4149] overlayfs: conflicting lowerdir path
[  166.273066][ T4153] overlayfs: "xino" feature enabled using 2 upper inode bits.
[  167.072056][ T4161] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:840
[  167.116840][ T4170] can0: slcan on ptm2.
[  167.134830][ T4173] /dev/rnullb0: Can't open blockdev
[  167.280591][ T4169] can0 (unregistered): slcan off ptm2.
[  167.431062][   T36] audit: type=1400 audit(167.402:456): avc:  denied  { unlink } for  pid=291 comm="syz-executor" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1
[  167.562005][ T4205] bridge0: port 1(bridge_slave_0) entered blocking state
[  167.569376][ T4205] bridge0: port 1(bridge_slave_0) entered disabled state
[  167.576458][ T4205] bridge_slave_0: entered allmulticast mode
[  167.582853][ T4205] bridge_slave_0: entered promiscuous mode
[  167.589404][ T4205] bridge0: port 2(bridge_slave_1) entered blocking state
[  167.596460][ T4205] bridge0: port 2(bridge_slave_1) entered disabled state
[  167.604185][ T4205] bridge_slave_1: entered allmulticast mode
[  167.610501][ T4205] bridge_slave_1: entered promiscuous mode
[  167.649872][ T4205] bridge0: port 2(bridge_slave_1) entered blocking state
[  167.656952][ T4205] bridge0: port 2(bridge_slave_1) entered forwarding state
[  167.664284][ T4205] bridge0: port 1(bridge_slave_0) entered blocking state
[  167.671345][ T4205] bridge0: port 1(bridge_slave_0) entered forwarding state
[  167.736998][ T4205] veth0_vlan: entered promiscuous mode
[  167.748180][ T4205] veth1_macvtap: entered promiscuous mode
[  167.831716][   T36] audit: type=1400 audit(167.802:457): avc:  denied  { map } for  pid=4223 comm="syz.7.1159" path="socket:[31805]" dev="sockfs" ino=31805 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1
[  167.951224][ T2833] usb 5-1: USB disconnect, device number 43
[  168.070737][ T4244] SELinux: security_context_str_to_sid (sytem_u�Gй) failed with errno=-22
[  168.097901][   T65] usb 9-1: new high-speed USB device number 2 using dummy_hcd
[  168.247874][   T65] usb 9-1: Using ep0 maxpacket: 16
[  168.254172][   T65] usb 9-1: config 1 has an invalid descriptor of length 97, skipping remainder of the config
[  168.264536][   T65] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3
[  168.275174][   T65] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  168.284296][   T65] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  168.292337][   T65] usb 9-1: Product: syz
[  168.296563][   T65] usb 9-1: Manufacturer: syz
[  168.301364][ T2833] usb 5-1: new high-speed USB device number 44 using dummy_hcd
[  168.309006][   T65] usb 9-1: SerialNumber: syz
[  168.459083][ T2833] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  168.470166][ T2833] usb 5-1: config 0 interface 0 has no altsetting 0
[  168.476806][ T2833] usb 5-1: New USB device found, idVendor=054c, idProduct=03d5, bcdDevice= 0.00
[  168.485868][ T2833] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  168.494474][ T2833] usb 5-1: config 0 descriptor??
[  168.707587][ T2833] input: HID 054c:03d5 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:054C:03D5.0027/input/input39
[  168.717200][   T36] audit: type=1400 audit(168.682:458): avc:  denied  { getopt } for  pid=4256 comm="syz.4.1169" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1
[  168.744430][   T36] audit: type=1400 audit(168.712:459): avc:  denied  { write } for  pid=4226 comm="syz.8.1160" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1
[  168.765490][   T36] audit: type=1326 audit(168.712:460): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4256 comm="syz.4.1169" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f8a68d8ebe9 code=0x0
[  168.767674][ T2833] sony 0003:054C:03D5.0027: input,hidraw0: USB HID v0.00 Joystick [HID 054c:03d5] on usb-dummy_hcd.4-1/input0
[  168.803123][ T2833] usb 5-1: USB disconnect, device number 44
[  168.813899][ T4262] fido_id[4262]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory
[  168.943252][   T65] usb 9-1: unknown interface protocol 0x61, assuming v1
[  168.950334][   T65] usb 9-1: cannot find UAC_HEADER
[  168.956768][   T65] snd-usb-audio 9-1:1.0: probe with driver snd-usb-audio failed with error -22
[  168.968696][   T65] usb 9-1: USB disconnect, device number 2
[  168.977453][ T1306] udevd[1306]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory
[  169.087921][    T9] usb 10-1: new high-speed USB device number 2 using dummy_hcd
[  169.238974][    T9] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  169.250289][    T9] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  169.260273][    T9] usb 10-1: New USB device found, idVendor=054c, idProduct=0ba0, bcdDevice= 0.00
[  169.269557][    T9] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  169.279129][    T9] usb 10-1: config 0 descriptor??
[  169.473703][ T4268] rust_binder: Error while translating object.
[  169.473736][ T4268] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM }
[  169.480148][ T4268] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:31
[  169.650296][ T4272] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1173'.
[  169.693791][    T9] usbhid 10-1:0.0: can't add hid device: -71
[  169.700061][    T9] usbhid 10-1:0.0: probe with driver usbhid failed with error -71
[  169.709108][    T9] usb 10-1: USB disconnect, device number 2
[  169.757707][ T4276] netlink: 44 bytes leftover after parsing attributes in process `syz.9.1174'.
[  170.001988][ T4295] rust_binder: Error while translating object.
[  170.002031][ T4295] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  170.008380][ T4295] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:33
[  170.019224][ T4297] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  170.038273][ T4300] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only
[  170.054747][ T4300] rust_binder: 38: no such ref 3
[  170.059742][ T4300] rust_binder: 38: no such ref 4294967295
[  170.065522][ T4300] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:38
[  170.065652][ T4300] rust_binder: Write failure EINVAL in pid:38
[  170.075155][ T4301] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  170.348093][   T31] usb 9-1: new full-speed USB device number 3 using dummy_hcd
[  170.480135][ T4325] cannot load conntrack support for proto=3
[  170.486998][ T4325] netlink: 72 bytes leftover after parsing attributes in process `syz.9.1188'.
[  170.523049][   T31] usb 9-1: config 0 has an invalid interface number: 64 but max is 0
[  170.534260][   T31] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  170.547909][   T31] usb 9-1: config 0 has no interface number 0
[  170.555377][   T31] usb 9-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice= 0.07
[  170.564754][   T31] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  170.572904][   T31] usb 9-1: Product: syz
[  170.577102][   T31] usb 9-1: Manufacturer: syz
[  170.583151][   T31] usb 9-1: SerialNumber: syz
[  170.588581][   T31] usb 9-1: config 0 descriptor??
[  170.668253][ T4333] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  170.668284][ T4333] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:47
[  170.702107][ T4337] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it.
[  170.720898][ T4337] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent
[  170.758924][ T4347] rust_binder: Write failure EFAULT in pid:56
[  170.783646][ T4355] netlink: 'syz.9.1199': attribute type 6 has an invalid length.
[  170.802923][ T4355] netlink: 'syz.9.1199': attribute type 4 has an invalid length.
[  170.811127][ T4355] netlink: 'syz.9.1199': attribute type 6 has an invalid length.
[  170.819147][ T4355] netlink: 'syz.9.1199': attribute type 13 has an invalid length.
[  170.826982][ T4355] netlink: 'syz.9.1199': attribute type 15 has an invalid length.
[  170.839435][ T4355] netlink: 'syz.9.1199': attribute type 19 has an invalid length.
[  170.847255][ T4355] netlink: 3684 bytes leftover after parsing attributes in process `syz.9.1199'.
[  170.862564][ T4357] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4357 comm=syz.4.1200
[  170.890586][ T4357] netlink: 'syz.4.1200': attribute type 6 has an invalid length.
[  170.898441][ T4357] IPv6: NLM_F_CREATE should be specified when creating new route
[  171.631683][ T4385] rust_binder: 65: no such ref 0
[  171.631886][   T36] audit: type=1400 audit(171.602:461): avc:  denied  { ioctl } for  pid=4382 comm="syz.7.1206" path="socket:[32902]" dev="sockfs" ino=32902 ioctlcmd=0x8982 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1
[  171.665814][   T12] Bluetooth: hci0: Frame reassembly failed (-84)
[  171.670694][ T4384] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0
[  171.679696][ T4384] rust_binder: Write failure EINVAL in pid:65
[  171.679896][ T4383] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0
[  171.693170][ T4383] rust_binder: Write failure EINVAL in pid:65
[  172.058521][   T36] audit: type=1400 audit(172.032:462): avc:  denied  { read } for  pid=4397 comm="syz.9.1212" name="/" dev="configfs" ino=802 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  172.086581][   T36] audit: type=1400 audit(172.032:463): avc:  denied  { open } for  pid=4397 comm="syz.9.1212" path="/" dev="configfs" ino=802 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  172.437834][  T654] usb 10-1: new high-speed USB device number 3 using dummy_hcd
[  172.587844][  T654] usb 10-1: Using ep0 maxpacket: 16
[  172.594146][  T654] usb 10-1: config 0 has an invalid interface number: 28 but max is 0
[  172.602391][  T654] usb 10-1: config 0 has no interface number 0
[  172.608695][  T654] usb 10-1: config 0 interface 28 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  172.619762][  T654] usb 10-1: config 0 interface 28 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  172.629784][  T654] usb 10-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00
[  172.639219][  T654] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  172.648349][  T654] usb 10-1: config 0 descriptor??
[  173.057867][ T4406] syzkaller0: entered promiscuous mode
[  173.063502][ T4406] syzkaller0: entered allmulticast mode
[  173.070782][  T654] gt683r_led 0003:1770:FF00.0028: global environment stack underflow
[  173.079143][  T654] gt683r_led 0003:1770:FF00.0028: item 0 1 1 11 parsing failed
[  173.086942][  T654] gt683r_led 0003:1770:FF00.0028: hid parsing failed
[  173.093733][  T654] gt683r_led 0003:1770:FF00.0028: probe with driver gt683r_led failed with error -22
[  173.119069][    T9] usb 9-1: USB disconnect, device number 3
[  173.243769][   T36] audit: type=1326 audit(173.212:464): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4431 comm="syz.8.1223" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd5d138ebe9 code=0x0
[  173.677866][   T52] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  173.677866][  T587] Bluetooth: hci0: command 0x1003 tx timeout
[  174.129305][ T4466] input: syz0 as /devices/virtual/input/input40
[  174.202435][   T36] audit: type=1400 audit(174.172:465): avc:  denied  { execute } for  pid=4468 comm="syz.8.1235" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=33241 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1
[  174.356432][ T4485] can0: slcan on ptm1.
[  174.379384][ T4485] can0 (unregistered): slcan off ptm1.
[  174.577875][ T1968] usb 5-1: new high-speed USB device number 45 using dummy_hcd
[  174.727834][ T1968] usb 5-1: Using ep0 maxpacket: 16
[  174.734030][ T1968] usb 5-1: config 9 has an invalid descriptor of length 0, skipping remainder of the config
[  174.744483][ T1968] usb 5-1: config 9 has no interfaces?
[  174.749991][ T1968] usb 5-1: New USB device found, idVendor=045e, idProduct=9994, bcdDevice=fc.3c
[  174.759391][ T1968] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  175.015862][ T4482] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  175.025189][ T4482] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  175.054094][ T4482] /dev/rnullb0: Can't open blockdev
[  175.114202][ T4497] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:94
[  175.225435][ T1968] usb 5-1: string descriptor 0 read error: -71
[  175.242179][ T1968] usb 5-1: USB disconnect, device number 45
[  175.251513][   T65] usb 10-1: USB disconnect, device number 3
[  175.273787][ T4500] Dead loop on virtual device ip6_vti0, fix it urgently!
[  175.281533][ T4500] Dead loop on virtual device ip6_vti0, fix it urgently!
[  175.288823][ T4500] Dead loop on virtual device ip6_vti0, fix it urgently!
[  175.296242][ T4500] Dead loop on virtual device ip6_vti0, fix it urgently!
[  175.303921][ T4500] Dead loop on virtual device ip6_vti0, fix it urgently!
[  175.311515][ T4500] Dead loop on virtual device ip6_vti0, fix it urgently!
[  175.637834][   T65] usb 10-1: new high-speed USB device number 4 using dummy_hcd
[  175.788943][   T65] usb 10-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  175.800913][   T65] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11
[  175.812289][   T65] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[  175.823684][   T65] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  175.836675][   T65] usb 10-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  175.845858][   T65] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  175.858549][   T65] usb 10-1: config 0 descriptor??
[  175.865948][   T36] audit: type=1400 audit(175.832:466): avc:  denied  { map } for  pid=4509 comm="syz.8.1246" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1
[  175.896637][ T4502] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22
[  176.026268][ T4520] rust_binder: 107: no such ref 3
[  176.045272][ T4524] syzkaller0: entered allmulticast mode
[  176.051008][ T4524] syzkaller0: entered promiscuous mode
[  176.057636][ T4524] syzkaller0 (unregistering): left promiscuous mode
[  176.064351][ T4524] syzkaller0 (unregistering): left allmulticast mode
[  176.107361][ T4525] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  176.108229][ T4525] rust_binder: Failed to allocate buffer. len:1176, is_oneway:false
[  176.244836][ T4531] netlink: 'syz.4.1252': attribute type 27 has an invalid length.
[  176.293867][ T4538] netlink: 'syz.4.1254': attribute type 154 has an invalid length.
[  176.303135][ T4538] rust_binder: Write failure EFAULT in pid:940
[  176.305782][   T65] plantronics 0003:047F:FFFF.0029: unknown main item tag 0x7
[  176.325449][   T65] plantronics 0003:047F:FFFF.0029: unknown main item tag 0x0
[  176.334086][   T65] plantronics 0003:047F:FFFF.0029: item fetching failed at offset 6/15
[  176.343221][   T65] plantronics 0003:047F:FFFF.0029: parse failed
[  176.349770][   T65] plantronics 0003:047F:FFFF.0029: probe with driver plantronics failed with error -22
[  176.401745][ T4543] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:945
[  176.427865][ T1968] usb 9-1: new full-speed USB device number 5 using dummy_hcd
[  176.567867][ T1968] usb 9-1: device descriptor read/64, error -71
[  176.578800][   T31] usb 10-1: USB disconnect, device number 4
[  176.807872][ T1968] usb 9-1: device descriptor read/64, error -71
[  177.047889][ T1968] usb 9-1: new full-speed USB device number 6 using dummy_hcd
[  177.147473][   T36] audit: type=1400 audit(177.112:467): avc:  denied  { create } for  pid=4576 comm="syz.9.1268" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1
[  177.175734][ T4582] rust_binder: Error in use_page_slow: ESRCH
[  177.175755][ T4582] rust_binder: use_range failure ESRCH
[  177.181967][ T4582] rust_binder: Failed to allocate buffer. len:24, is_oneway:true
[  177.187524][ T4582] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH }
[  177.187823][ T1968] usb 9-1: device descriptor read/64, error -71
[  177.197813][ T4582] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:86
[  177.211150][ T4580] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:86
[  177.438160][ T1968] usb 9-1: device descriptor read/64, error -71
[  177.557893][ T1968] usb usb9-port1: attempt power cycle
[  177.897922][ T1968] usb 9-1: new full-speed USB device number 7 using dummy_hcd
[  177.919009][ T1968] usb 9-1: device descriptor read/8, error -71
[  178.016077][   T36] audit: type=1400 audit(177.982:468): avc:  denied  { read } for  pid=95 comm="acpid" name="event9" dev="devtmpfs" ino=839 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1
[  178.037184][   T36] audit: type=1400 audit(177.982:469): avc:  denied  { open } for  pid=95 comm="acpid" path="/dev/input/event9" dev="devtmpfs" ino=839 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1
[  178.059433][   T36] audit: type=1400 audit(177.982:470): avc:  denied  { ioctl } for  pid=95 comm="acpid" path="/dev/input/event9" dev="devtmpfs" ino=839 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1
[  178.088342][ T1968] usb 9-1: device descriptor read/8, error -71
[  178.094203][ T4598] __vm_enough_memory: pid: 4598, comm: syz.9.1276, bytes: 18014402804453376 not enough memory for the allocation
[  178.225718][ T4607] rust_binder: validate_parent_fixup: fixup_min_offset=46, parent_offset=36
[  178.225736][ T4607] rust_binder: Error while translating object.
[  178.234638][ T4607] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  178.240907][ T4607] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:966
[  178.313012][ T4616] overlayfs: failed to resolve './file0': -2
[  178.329078][ T1968] usb 9-1: new full-speed USB device number 8 using dummy_hcd
[  178.350466][ T4618] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  178.350505][ T4618] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:975
[  178.361195][ T1968] usb 9-1: device descriptor read/8, error -71
[  178.424367][ T4621] ------------[ cut here ]------------
[  178.429882][ T4621] WARNING: CPU: 0 PID: 4621 at arch/x86/kvm/x86.c:11569 kvm_arch_vcpu_ioctl_run+0x12af/0x1aa0
[  178.440247][ T4621] Modules linked in:
[  178.444241][ T4621] CPU: 0 UID: 0 PID: 4621 Comm: syz.4.1283 Not tainted 6.12.38-syzkaller-g125206b4d7d6 #0 b4183df40fdd555480841fc2136fdfcd4e3aa3fe
[  178.457729][ T4621] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  178.467893][ T4621] RIP: 0010:kvm_arch_vcpu_ioctl_run+0x12af/0x1aa0
[  178.474448][ T4621] Code: 7e 3b e8 34 06 6a 00 49 bd 00 00 00 00 00 fc ff df 4c 8b 7c 24 20 4c 8b 64 24 40 48 8b 5c 24 28 e9 26 fd ff ff e8 11 06 6a 00 <0f> 0b e9 e4 fc ff ff e8 05 06 6a 00 0f 0b e9 0e fd ff ff e8 f9 05
[  178.494124][ T4621] RSP: 0018:ffffc900023ef9c0 EFLAGS: 00010293
[  178.500311][ T4621] RAX: ffffffff811bd81f RBX: ffff8881313a4300 RCX: ffff88813b9b3900
[  178.508571][ T4621] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
[  178.516552][ T4621] RBP: ffffc900023efc70 R08: ffff88813b9b3907 R09: 1ffff11027736720
[  178.518860][ T1968] usb 9-1: device descriptor read/8, error -71
[  178.524581][ T4621] R10: dffffc0000000000 R11: ffffed1027736721 R12: ffff8881037b2000
[  178.524606][ T4621] R13: dffffc0000000000 R14: 0000000000000001 R15: ffff8881313a4378
[  178.547391][ T4621] FS:  00007f8a69c7a6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
[  178.556446][ T4621] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  178.563106][ T4621] CR2: 000000005200000c CR3: 000000013cab0000 CR4: 00000000003526b0
[  178.571300][ T4621] Call Trace:
[  178.574638][ T4621]  <TASK>
[  178.577571][ T4621]  ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10
[  178.583589][ T4621]  ? futex_unqueue+0x136/0x160
[  178.588484][ T4621]  ? __futex_wait+0x218/0x2a0
[  178.593168][ T4621]  ? __cfi_wait_rcu_exp_gp+0x10/0x10
[  178.598513][ T4621]  ? ioctl_has_perm+0x1aa/0x4d0
[  178.603409][ T4621]  ? __cfi_autoremove_wake_function+0x10/0x10
[  178.609504][ T4621]  ? ioctl_has_perm+0x3e0/0x4d0
[  178.614481][ T4621]  ? has_cap_mac_admin+0xd0/0xd0
[  178.619455][ T4621]  ? synchronize_rcu+0x77/0x2e0
[  178.624388][ T4621]  ? __cfi_synchronize_rcu+0x10/0x10
[  178.629691][ T4621]  ? futex_wait+0x29a/0x7a0
[  178.634216][ T4621]  ? __kasan_check_write+0x18/0x20
[  178.639348][ T4621]  kvm_vcpu_ioctl+0x96f/0xee0
[  178.644028][ T4621]  ? __cfi_kvm_vcpu_ioctl+0x10/0x10
[  178.648067][ T1968] usb usb9-port1: unable to enumerate USB device
[  178.649275][ T4621]  ? do_futex+0x309/0x500
[  178.659965][ T4621]  ? __cfi_do_futex+0x10/0x10
[  178.664669][ T4621]  ? __fget_files+0x2c5/0x340
[  178.669386][ T4621]  ? bpf_lsm_file_ioctl+0xd/0x20
[  178.674436][ T4621]  ? security_file_ioctl+0x34/0xd0
[  178.679668][ T4621]  ? __cfi_kvm_vcpu_ioctl+0x10/0x10
[  178.684886][ T4621]  __se_sys_ioctl+0x135/0x1b0
[  178.689600][ T4621]  __x64_sys_ioctl+0x7f/0xa0
[  178.694218][ T4621]  x64_sys_call+0x1878/0x2ee0
[  178.699009][ T4621]  do_syscall_64+0x58/0xf0
[  178.703445][ T4621]  ? clear_bhb_loop+0x50/0xa0
[  178.708684][ T4621]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  178.714633][ T4621] RIP: 0033:0x7f8a68d8ebe9
[  178.719538][ T4621] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  178.739622][ T4621] RSP: 002b:00007f8a69c7a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  178.748095][ T4621] RAX: ffffffffffffffda RBX: 00007f8a68fb6090 RCX: 00007f8a68d8ebe9
[  178.756102][ T4621] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006
[  178.764108][ T4621] RBP: 00007f8a68e11e19 R08: 0000000000000000 R09: 0000000000000000
[  178.772205][ T4621] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  178.780393][ T4621] R13: 00007f8a68fb6128 R14: 00007f8a68fb6090 R15: 00007ffcc87f4798
[  178.788583][ T4621]  </TASK>
[  178.791622][ T4621] ---[ end trace 0000000000000000 ]---