last executing test programs: 27.684863738s ago: executing program 2 (id=296): r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000002000", 0x39}], 0x1) 27.657646179s ago: executing program 2 (id=297): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000a40)=ANY=[@ANYBLOB="400100001000010000000000000000000000000000000000000000b3d043fc00fe8000000000000000000000000000bb0000fff720000001006999fb82000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="64010102000000000000000000000000000000006c000000ac1414bb00000000000000000000000000000000000000000000000000000000000000001a000000000000000000000003000000000000000000000000000000040000000000000000000000000000000000000000000000040000000000000000000040000000000000000000000000000000000000000000000000000000000000000002000001"], 0x140}}, 0x4810) 27.637596369s ago: executing program 2 (id=298): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) process_madvise(r1, 0x0, 0x0, 0x15, 0x0) 27.637191509s ago: executing program 2 (id=299): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000500)='./file1/file0\x00', 0x0, 0x201008, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000000), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000001180)='./bus\x00') r0 = syz_open_dev$loop(&(0x7f0000000100), 0x80000006, 0x48002) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100000000000000000000000000000000000000000000000000000000001200", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00"}}) 27.590949069s ago: executing program 2 (id=300): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000280)=0x10) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101740, 0x179) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4602, 0x0) poll(0x0, 0x0, 0xf) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) creat(&(0x7f0000000240)='./file0\x00', 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r4, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r5 = dup(r4) write$FUSE_BMAP(r5, &(0x7f0000000080)={0x18, 0x0, 0x0, {0x4}}, 0x18) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[], [], 0x6b}}) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r2, 0x4008af13, &(0x7f0000000040)) ioctl$BLKRRPART(r1, 0x125f, 0x0) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x6140c0, 0x0) 27.590327469s ago: executing program 2 (id=302): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000780)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000030000000000ac1e000100000000000000000000000000000000000000000a0040"], 0xb8}}, 0x7000000) 7.560007683s ago: executing program 32 (id=302): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000780)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000030000000000ac1e000100000000000000000000000000000000000000000a0040"], 0xb8}}, 0x7000000) 4.711528567s ago: executing program 3 (id=622): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000780)=ANY=[@ANYBLOB="84000000", @ANYRES16=r1, @ANYBLOB='ya\x00\x00\x00\x00\x00\x00\x00!~'], 0x84}}, 0x0) 4.691384237s ago: executing program 3 (id=623): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000002c80)={'mangle\x00', 0x2, [{}, {}]}, 0x48) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r1, 0x8004e500, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000280), 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000300)=0x14) sendmsg$BATADV_CMD_GET_VLAN(r2, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x2c, r3, 0x2, 0x70bd2d, 0x4, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xf}, @BATADV_ATTR_ISOLATION_MASK={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x20000010) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x161000, 0x0) read(r5, &(0x7f00000000c0)=""/107, 0x6b) syz_open_procfs(0x0, &(0x7f0000000e00)='maps\x00') r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), r6) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r6, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="14080000", @ANYRES16=r7, @ANYBLOB="08002dbd7000fedbdf2517000000"], 0x14}, 0x1, 0x0, 0x0, 0x4880}, 0x40001) 4.679157347s ago: executing program 3 (id=624): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r1, &(0x7f0000000080)="0000000000000000000f", 0xa, 0x0, &(0x7f00000000c0)={0x2, 0x4e20, @empty}, 0x10) recvfrom(r0, &(0x7f0000000100)=""/10, 0xa, 0x0, 0x0, 0x0) 3.783734791s ago: executing program 3 (id=627): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000500)='./file1/file0\x00', 0x0, 0x201008, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000000), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000001180)='./bus\x00') r0 = syz_open_dev$loop(&(0x7f0000000100), 0x80000006, 0x48002) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100000000000000000000000000000000000000000000000000000000001400", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00"}}) 3.783613191s ago: executing program 3 (id=628): mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f00000004c0)='./bus\x00', 0x92) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) removexattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@known='user.incfs.metadata\x00') (fail_nth: 2) 3.691518663s ago: executing program 3 (id=629): mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f00000004c0)='./bus\x00', 0x92) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@xino_on}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x800, 0x1) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000100)=@v2={0x2, @aes256, 0x4, '\x00', @c}) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) removexattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@known='user.incfs.metadata\x00') 3.658293104s ago: executing program 33 (id=629): mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f00000004c0)='./bus\x00', 0x92) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@xino_on}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x800, 0x1) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000100)=@v2={0x2, @aes256, 0x4, '\x00', @c}) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) removexattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@known='user.incfs.metadata\x00') 3.066986303s ago: executing program 5 (id=637): r0 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x49}]}) read(r0, &(0x7f0000000180)=""/95, 0xffffff51) 2.055809588s ago: executing program 4 (id=659): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000058c0)=ANY=[@ANYBLOB="fc01000013000100000000000000000000000000000000000000000000000001fc0200000000000000000000000000014e24000d040000090a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000010000000000000000000000000000000000000000ffffffffffffffff000000000000000003000000000000000900000000000000ffffffffffffff800000000000000000010000000000000000000000000000000000000000000000feffffff00000000000000000000000044010500"], 0x1fc}, 0x1, 0x0, 0x0, 0x11}, 0x0) 2.054241098s ago: executing program 4 (id=660): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000a40)=ANY=[@ANYBLOB="44010000100001000000000000000000ffffffff000000000000000000000000ac1414bb00000000000000000000000000003b00"/64, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="64010102000000000000000000000000000000006c000000ac1414bb000000000000000000000000000000000000000000000000000000000000000000000000ff800000000000000100000000000000fdffffffffffffff04000000000000000000000000000000020000000000000004000000000000000000004000000000000000000000000000000002000000000000000025bd7000000000000a000301000000000000000048000300"], 0x144}, 0x1, 0x0, 0x0, 0x44}, 0x4810) 2.023332869s ago: executing program 4 (id=662): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="84010000100013070000040000000000ac1e010000fe8000000000000000000000000000bb0000000000000000000000003c00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000004d332000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080ffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c001400636d616328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0"], 0x184}}, 0x0) 1.96385692s ago: executing program 4 (id=664): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="f80000002100010000000000fefffffffc020000000000000000000000000000fc02000000000000000000000000000000000000000000000a00000084000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="b66b6e000000000050001100ac14140c000000000000000000000000fc000000000000000000000000000001fc020000000000000000000000000000fe8000000000000001a80000000000aaff0000000200000002000a00240009000d00000000000000040000000000000008000000000000000500000000000000200017000100000027bd70002dbd70002dbd700028bd700003000000ff0100000c001c"], 0xf8}}, 0x0) 1.94406645s ago: executing program 4 (id=666): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000058c0)=ANY=[@ANYBLOB="fc0100001300010000000000000000000000000000000000000000002b000001fc0200000000000000000000000000014e24000d040000090a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000010000000000000000000000000000000000000000ffffffffffffffff00000000000000000300000000000000090000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000feffffff00000000000000000000000044010500e0000002000000000000000000000000000004d6320000000a000000ac1414aa000000000000000000000000053500000303030009000000b4000000070000007f000001000000000000000000000000000004d36c00000000000000fc0100000000000006000000000000000000000000000900010000000080000008000000ac1414aa000000000000000000000000000004d2330000000a000000ac1414bb0000000000000000ddffffff023500000002fa00070000000a00000002000000fe80000000000000000000000000000f000004d43c"], 0x1fc}, 0x1, 0x0, 0x0, 0x11}, 0x0) 1.92763676s ago: executing program 4 (id=667): statx(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x6000, 0x4, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) quotactl_fd$Q_GETFMT(0xffffffffffffffff, 0xffffffff80000400, r0, &(0x7f0000000140)) r2 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x480100, 0x0, 0x2}, 0x18) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) futimesat(r2, &(0x7f0000000200)='./file0\x00', &(0x7f0000000280)={{}, {r3, r4/1000+60000}}) r5 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f00000002c0)={0x28, 0x0, 0x2711}, 0x10, 0x0) ioctl$FS_IOC_RESVSP(r5, 0x40305828, &(0x7f0000000300)={0x0, 0x3, 0x6, 0x2}) r6 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000340), 0x400000, 0x0) r7 = syz_open_dev$mouse(&(0x7f0000000380), 0x4, 0x10000) clock_gettime(0x0, &(0x7f0000000480)={0x0, 0x0}) io_getevents(0x0, 0xc, 0x5, &(0x7f00000003c0)=[{}, {}, {}, {}, {}], &(0x7f00000004c0)={r8, r9+60000000}) r10 = socket$nl_generic(0x10, 0x3, 0x10) epoll_pwait2(r6, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}], 0x6, &(0x7f0000000580)={0x0, 0x989680}, &(0x7f00000005c0)={[0x8]}, 0x8) r11 = openat$cgroup_int(r6, &(0x7f0000000600)='io.latency\x00', 0x2, 0x0) fchown(r6, r0, r1) epoll_wait(r7, &(0x7f0000000640)=[{}, {}, {}], 0x3, 0xfffffff8) io_setup(0x9, &(0x7f0000000680)=0x0) r13 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000006c0), 0x400, 0x0) io_submit(r12, 0x3, &(0x7f00000009c0)=[&(0x7f0000000800)={0x0, 0x0, 0x0, 0x5, 0x6, r13, &(0x7f0000000700)="33203c752242432a7c632c0d47e934c0301941c9cb0e0f8a33f5773f24e07d32e8ffc79d2cfe49b89a1651e36cce4e03552f9f12328184eab040da47a279362aa73010d094e9842abdbba8958613fc670251a2b770daea9ab004d55b9e68b206657cd5c976459e42d06581fa8595fba752f645c2d3aab3fc8b3c4cbd156c5837d19af6b7e74eb86f78152d22f069f915413ab6316644338e818a2ba70cdb0f3ead6f94019a5be44849fded7a97837aaf9db6958cb6bf211609a1e5aebaab0346d31355f66f0082d6101f9e0ff060fa222e16", 0xd2, 0x3, 0x0, 0x1, r7}, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x3, 0x6, r6, &(0x7f0000000840)="851035e54994dcdf091477", 0xb, 0x10, 0x0, 0x2}, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x7, 0x9, r11, &(0x7f00000008c0)="3bb9b9d6945fcb468f16586d7055b75b5cf459f9d458295e247bb2d18bc04e45b5f8bb5afa68a34723c97198fa221cc08fb5f65a9c3ee81f0e989cb03b603c6e09341cb881b5bae97b187bd4cc2280f3cf63514a4c840ed42b0734bb23a84cdf51184255c2cb619c969a9ddb8a6b0f4eee64af886f5cbc0a8b764dc6a460758deb174ccf04b8242096def1723d46f347ab19489df16646a6cb0fed0f2a515e0e5242c6c796e16cfe288c15f0aa2e780a15e20c8aaa989c275bc220", 0xbb, 0x1, 0x0, 0x2, r6}]) syz_genetlink_get_family_id$ethtool(&(0x7f0000000a00), r10) read(r7, &(0x7f0000000a40)=""/57, 0x39) ioctl$RTC_WIE_OFF(r13, 0x7010) madvise(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2) ioctl$KVM_GET_XSAVE2(r7, 0x9000aecf, &(0x7f0000ff8000/0x4000)=nil) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80), r7) socket$nl_xfrm(0x10, 0x3, 0x6) r14 = syz_usb_connect$printer(0x5, 0x36, &(0x7f0000000ac0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0xff, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x75, 0x88, 0x7, [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x7, 0x1, 0x1, 0x9, "", {{{0x9, 0x5, 0x1, 0x2, 0x20, 0x9, 0x81, 0x4}}, [{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xa, 0x81, 0x5b}}]}}}]}}]}}, &(0x7f0000000f80)={0xa, &(0x7f0000000b00)={0xa, 0x6, 0x310, 0x7, 0x0, 0x6, 0x40, 0x5}, 0x185, &(0x7f0000000b40)={0x5, 0xf, 0x185, 0x6, [@wireless={0xb, 0x10, 0x1, 0x0, 0x4, 0xa7, 0xff, 0x7ff, 0x16}, @ssp_cap={0x14, 0x10, 0xa, 0x4, 0x2, 0x200, 0xff00, 0x85, [0x0, 0xff0000]}, @generic={0xa7, 0x10, 0x1, "e7dc256573327f43853930b0cc904d524e08e532e90d6398cc32c293197f7bba6e2a22ca622fae3a5f279dd9ec64ee7b81055aef388345ac403951354d7e302a1b7c735bc9c94421f3421afb839f226f944dc3501e674986dd2a0e72aed4cf520bd77cc55243bac99ed7af38eb50688dd00ec2ac4b529027fe443f41ecb6845fb0d25cb00a14d652647adbde3b1195edb5ac5240485d126e993d01d6126ee219200fcf88"}, @generic={0xa7, 0x10, 0x1, "7c2cae22e986d6cedf8c1f771b684603a4f0ac238ef624a59956b3289813afa4049f743f12dda22ea2fcbc59aef521d5d01c0a900e9f0516fbc04acac1e4a880d241a67a3496d7324d9fed772ad88542fcd96816848f66bf885f155834d6cf14a33ff55feb4f30e6ebc49d6f143d88043311310d5cae1ef9993dc8fc2d9daa9b8653a076bf0209bb1031428a98fc5ec0b9bcaf54599c78b4e179110afd926d554b52ba7f"}, @ptm_cap={0x3}, @ssp_cap={0x10, 0x10, 0xa, 0x3, 0x1, 0x10, 0xf000, 0x400, [0xffc0cf]}]}, 0x8, [{0x67, &(0x7f0000000d00)=@string={0x67, 0x3, "91e56fbadd1fa886cd55dc16c51952c5919560c18956078f0aabf34986bdacd1e630a4dc1801581a4ae51634049d2a0819db9ef63dc5e1181651ee3c2d2e9f788b211f6b551ec0a3c226c632754b2247b7c732d1b1ebfb7af4187262512e01dbb2bc02c0ce"}}, {0x3f, &(0x7f0000000d80)=@string={0x3f, 0x3, "0f9c5cc94754c3e1d47a3e79f02f854ac3e5dc3eed53edf4f508b0ca48e0b5d18eabda7323dd5ab8b98dd79129e7683243ef0a27e8d0533c3cfeccc880"}}, {0xd, &(0x7f0000000dc0)=@string={0xd, 0x3, "66117ed0ace14862f7ff85"}}, {0x76, &(0x7f0000000e00)=@string={0x76, 0x3, "13887d206be5c5ff10eb33be4ebaf243f9d22621d9b421faa84d439f75d164799c9d08a25c4fcae44751c78241a9be914b3b6d30ae2ac43a94827221a5f58d9a96d7b9089eb9ed23c46c5dc08c4dea6440c50c137a384007152a1bfb1771ddd34b850631418cae8e5ad981b5cc700213a9ce63de"}}, {0x4, &(0x7f0000000e80)=@lang_id={0x4, 0x3, 0x187c}}, {0x4, &(0x7f0000000ec0)=@lang_id={0x4, 0x3, 0x439}}, {0x4, &(0x7f0000000f00)=@lang_id={0x4, 0x3, 0x458}}, {0x3f, &(0x7f0000000f40)=@string={0x3f, 0x3, "9a5e029079aa25e348a8d251cb9e84362bc6d9b505ad5f17fd81412310cf71590b55275edbf2b67dd916dd3d815d5a583fb03a01767208c6c5c322cd80"}}]}) syz_usb_control_io$printer(r14, &(0x7f0000001100)={0x14, &(0x7f0000001000)={0x20, 0x21, 0x89, {0x89, 0x23, "70a5d98c6dd2b72f1d058afff538f9587bbda2d1ce95c8f61f1dd5c3dc09adc2c169c2185283b902b2b74318129ffd635e97d3fdef1c62e9aab04073aa5abda6777644e608b991fdf3f18d36b5a9e5c0dcc0c9adf2a37c48c9decd235e785d7fa0be509014ee364e780aa874fe5407f7f5bdeb0ea421ef1a66aff2ed21812735188d84c6292606"}}, &(0x7f00000010c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44b}}}, &(0x7f0000001300)={0x34, &(0x7f0000001140)={0x0, 0xd, 0x19, "26081dcaa2ec5eb4c22727c6b82800639dafad7dbdfb18a58c"}, &(0x7f0000001180)={0x0, 0xa, 0x1, 0xf}, &(0x7f00000011c0)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000001200)={0x20, 0x0, 0x3b, {0x39, "2b586c8f6f3e350d3a67b18d28da3dbbd185a94f341dc3cf6772c8ece772b225a00c7410f654a7e130b8db779b1f3a58c68cf0b3a036653d4f"}}, &(0x7f0000001280)={0x20, 0x1, 0x1, 0x1}, &(0x7f00000012c0)={0x20, 0x0, 0x1, 0x8}}) r15 = syz_usb_connect$cdc_ncm(0x1, 0xc7, &(0x7f0000001340)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xb5, 0x2, 0x1, 0x10, 0x80, 0x7, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "60f8ef05a4"}, {0x5, 0x24, 0x0, 0xa}, {0xd, 0x24, 0xf, 0x1, 0x7, 0xb, 0x5, 0x2}, {0x6, 0x24, 0x1a, 0x336a}, [@mdlm_detail={0x40, 0x24, 0x13, 0xd, "1876c016865577e299373e92a39c6b57b95ed0a785ea88c545b0af2e07774711f31ad1ed956fc4c6aaeaf2fe63c62ea962806097e8d1dada23a38123"}, @mdlm_detail={0x14, 0x24, 0x13, 0x8, "9ca03dc39253425dbdfe80c1c7b951c0"}]}, {{0x9, 0x5, 0x81, 0x3, 0x10, 0x2, 0x7, 0xa1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x20, 0xa, 0x9, 0x40}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x7, 0x0, 0x8}}}}}}}]}}, &(0x7f0000001680)={0xa, &(0x7f0000001440)={0xa, 0x6, 0x201, 0x5, 0x2, 0x6, 0xff, 0x9}, 0x20, &(0x7f0000001480)={0x5, 0xf, 0x20, 0x3, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x6, 0xd7, 0x4, 0x7}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xc, 0x44, 0x3, 0xd8}, @ext_cap={0x7, 0x10, 0x2, 0x10, 0x1, 0x8, 0x1}]}, 0x4, [{0x4, &(0x7f00000014c0)=@lang_id={0x4, 0x3, 0x82c}}, {0x4, &(0x7f0000001500)=@lang_id={0x4, 0x3, 0x40e}}, {0x4, &(0x7f0000001540)=@lang_id={0x4, 0x3, 0x83e}}, {0xdc, &(0x7f0000001580)=@string={0xdc, 0x3, "3c3defd1fab7f4c3229aefb61641cd91b69aec5173c7f372649bf1f692d9fa1fdd82e2e4564bf44cf8cc6f2e4f157a11d03a7374341180d007bc9c81c094bf9167212b9f191a7ee3a457646c64aeeb222d0686762efc06c9b49d2ea7de8a58d9515cecaaa4b477e9deb46f1d44ba4a4a5cb13de446f22675c71ee8aae234c5849a6a2629e7d35a25840e06fdc6b458118553053acb7f22875c0fd546d3cc3a71dc05f8a1ffddfbc976174c8509f9b090d0dbbf29b7e137ef778cfb026c5ea58d3aa9cf8b2dc75c7684ecf0545625e7b9910d1476912d7eea8400"}}]}) syz_usb_control_io$cdc_ncm(r15, &(0x7f0000001840)={0x14, &(0x7f0000001700)={0x0, 0x22, 0xdd, {0xdd, 0x7, "5bca2a3a682dc977568e24b33585fd9649f825aabe3939423f6e79cd2cbbb479a3e59b1d67fbf27bada8e6dfb829cab77bd28e5930bccb7bee8bda5b087de850dcb915c17488f2b74c06579c16b43a9e405681eaa27cab5991c4228d89173059863c52132902e049274525b8fb553588c545d188aaec5997c3ed87d28f447ec81c6ba59e4a68a33538b0980530905e94c8d2c2412e75fc94331f5bbdfb423e82582b735b1aa1c5461bd650f2a29207e79b05d092d4b51f8c4f90fbd095fbc0c0e19b5f83e660c0ba4c9be4ae8912583dbc4164301c56fd4df7cc9f"}}, &(0x7f0000001800)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000001b40)={0x44, &(0x7f0000001880)={0x0, 0x31, 0xc5, "0d356f484bf31e3fd0fe03fa53ea49e46ccaf16361a2f9099c4e06bab0dddd5c1a3a2fe29918dfc6a307c32d552beb7c0a9d14424c25eea898b24333485126ffa3a37fc384cc3456a31b988e876ab1dc195c6b18aa1aba94d6a9e6b638e608f01b50077a14f727b1008a281466538be591d55a03ce7e5d3687859e6f2e89ece60c4a53f8b009d16a4695c32c230ee1f6a46bc235dbce3c22c73f603223fc71dfccfc5edf7d64683e9ea59e4e89f5955cf02d041fc755450b70650346377640f5cd9cefbbdc"}, &(0x7f0000001980)={0x0, 0xa, 0x1, 0xfe}, &(0x7f00000019c0)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000001a00)={0x20, 0x80, 0x1c, {0x5, 0x7, 0x4, 0x6, 0xfffc, 0x3, 0x9, 0x7, 0x5, 0xfff8, 0x9, 0x1}}, &(0x7f0000001a40)={0x20, 0x85, 0x4, 0x4}, &(0x7f0000001a80)={0x20, 0x83, 0x2}, &(0x7f0000001ac0)={0x20, 0x87, 0x2, 0x6}, &(0x7f0000001b00)={0x20, 0x89, 0x2, 0x1}}) 1.015768305s ago: executing program 0 (id=681): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) write$vga_arbiter(r0, &(0x7f0000000040)=ANY=[@ANYBLOB='lock i'], 0xc) ioctl$HIDIOCGCOLLECTIONINFO(0xffffffffffffffff, 0xc0104811, &(0x7f0000000000)={0x1, 0x1ff, 0xd0ca, 0x2}) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0xffffffc1) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$ASHMEM_SET_NAME(r1, 0x40087708, &(0x7f0000002600)='\x00\x00\x03\x06\x00\x00\x00\x05\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80`4/\xe9\x15\x9a\x9f\xf0:\xfd$\xad\xbb\x9a|c\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b7\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Xd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\x16\\n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x04;\xc5[\nja\xb9\'\xc9#\xfcx\x00\x00X\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xd5\b^[D~~\x84\\\xe4\x00B\x05\xd4\xea\xea\x7f=\xc6:\\N\xc3\xb7Vw\xc6\x9c\x96s\xaaHL\x96\xc72\n\x18Ynj\xceTS\xfbl\x0f\x9f8M\f\x89\xa1\xd2Hs`\x8bp\x8a\xc4%\xf8\x1d3\nV\x9a\xaf\x1f\xf96^\x93\xc1\xaf)\rg\x86\xd6\xea\xa9\x0f\x9a\xf1V\x1b\xbf\x8b\'-\xab\x8e\t7\xd3\xf7\xa9v\xfbY\xe6\x9b^d\x8c\xb1\xdd') ioctl$ASHMEM_SET_NAME(r1, 0x40087708, &(0x7f0000000300)='\x00\x00\x00\x06\x00\x00\x00\x01\x00x\x92\x12\xbc\x00\x00\xbb\x0642\x9c\x1a\xd1\xcbx\xb0\xd6\x1e\x10gQ\xca\x0e;\xf7\'\x8c\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn\x05\x00\x00\x00-<\r\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \xac\xc4K\x03\xfa\x13Vz\xbf\xe3c\x8d \x0f\xb1\xe9\xf2oci(\xcb\x82\x05\xfe[H\xaf\x01\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafd%\xf1\xdbjE\x01\xd1sD5hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\x851Y9OB\xdeB\xe1\x02-&\"1hS\x92\xe4$-\x02\x00\xe4\x8e\"\x85\xc9x\xef\x81E.r\x89\xe5\x00\x9e\x97\x96\xb8j\x81\xf0\xdca\xfb\xa6\xff\xff\xff\xff\x00\x00\x00\x00d\xf0\xf1j\x11\x12\xc0\xbb\xfdq~#\xf7\xa8\"$,\xf4\x84|\x89o\x00<\xa6-\xb0\xd3\x80\xbe\xcf\a\x00\xfc\xa6\xb1\x05\x94\x84l\xbfA\xeb\xd8\t\x00\x00\x00CvNhx461\x04N<\xedV\xcet\xaa~\xf3j\x94\xec\x92\x86uY\xf6\xb5\t?,~\xa67\\\xb9\xc9K\xf8\x9d\x96\xc0\xb5\xc7wF\x99\x12\x97T\x90.\x9c\xe3\x9a\xf1\xb9\x9c\x13\xbc\x19\xde/\xaahB\t\x97\a03\xcd\xb3\xc8\xd5l\x14!\xf9Xg2\x1d\xeeB\xccT\x0e\xd8\xef\xc8\xe9\xb4\xf3l\xc3\xf2\x998\xc8\xc2|2\xee\xb4W\x99f.\xeb\xe9\x05\xcbkz3+\xdd\xe1*8\x95@0t0\xad\xe3#\xd7\x19\xe7Q\xdfmI\xe5\x1e\xe4\x87\xc9\x8f\xa7\xe0\xd9v\xf6\x01\x9d\x8f`,\x1a8\x81I\x86l\x8f2\r:\xc1\x02\xd6Z%\xa7Ks\x8bUolS\x05\xbe\x97\x1fGe\x94\xa6\xa3\xab\xdb\r\x17\xff[\xb1\x00\xff\x7f\x00\x00\x00\x00') 1.011378665s ago: executing program 0 (id=683): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000d80), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) socket$inet_icmp(0x2, 0x2, 0x1) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000800)={0x4c, 0x0, &(0x7f0000000600)=[@reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x50, 0x0, &(0x7f0000000700)="93ca2efc9445b68c079d41dcfff066e61c4d8f1021949c8c75c29113ed78c691e4a88534e71804ab594c9c0cea97e979adb05f81276775d60f54e903eb87a57f7cbe1f97039cb9d611ffa16ca4582a68"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r3, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) pselect6(0x40, &(0x7f0000000180)={0xfffffffffffffffd, 0x3, 0x0, 0x4}, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x33}, @fda={0x66646185, 0x5, 0x0, 0xf}}, 0x0}, 0x10}], 0x0, 0x0, 0x0}) r6 = userfaultfd(0x801) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000240), 0x604043, 0x0) ioctl$PTP_ENABLE_PPS(r7, 0x40043d04, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x0, &(0x7f0000000180), 0xc06620, 0x4) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x4, 0x2, 0x36}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x31}, @flat=@binder={0x73622a85, 0x1100, 0x1}}, &(0x7f0000000280)={0x0, 0x20, 0x48}}, 0x10}], 0x0, 0x0, 0x0}) 711.580169ms ago: executing program 1 (id=691): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x4c, 0x0, &(0x7f0000000600)=[@reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x51, 0x0, &(0x7f0000000700)="93ca2efc9445b68c079d41dcfff066e61c4d8f1021949c8c75c29113ed78c691e4a88534e71804ab594c9c0cea97e979adb05f81276775d60f54e903eb87a57f7cbe1f97039cb9d611ffa16ca4582a68cd"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x33}, @fda={0x66646185, 0x5, 0x0, 0xf}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)={0x50, 0x2, 0x8, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2}, [@CTA_TIMEOUT_DATA={0x3c, 0x4, 0x0, 0x1, @udp=[@CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0xd}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0xfffffff8}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0xb6}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x8001}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x80000000}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0xc7}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x85}, 0x4000080) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x4c, 0x0, &(0x7f0000000600)=[@reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x51, 0x0, &(0x7f0000000700)="93ca2efc9445b68c079d41dcfff066e61c4d8f1021949c8c75c29113ed78c691e4a88534e71804ab594c9c0cea97e979adb05f81276775d60f54e903eb87a57f7cbe1f97039cb9d611ffa16ca4582a68cd"}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x33}, @fda={0x66646185, 0x5, 0x0, 0xf}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) (async) pipe2$watch_queue(&(0x7f0000000380), 0x80) (async) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)={0x50, 0x2, 0x8, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2}, [@CTA_TIMEOUT_DATA={0x3c, 0x4, 0x0, 0x1, @udp=[@CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0xd}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0xfffffff8}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0xb6}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x8001}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x80000000}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0xc7}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x85}, 0x4000080) (async) 676.12515ms ago: executing program 1 (id=692): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c0002800500010000000000080007400088ff"], 0x64}}, 0x0) 658.41421ms ago: executing program 1 (id=693): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000a40)=ANY=[@ANYBLOB="400100001000010000000000000000000000000000000000000000b3d043fc00fe8000000000000000000000000000bb0000fff720000001006999fb82000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="64010102000000000000000000000000000000006c000000ac1414bb0000000000000000000000000000000000000000000000000000000000000000001a0000000000000000000003000000000000000000000000000000040000000000000000000000000000000000000000000000040000000000000000000040000000000000000000000000000000000000000000000000000000000000000002000001"], 0x140}}, 0x4810) 575.839712ms ago: executing program 1 (id=694): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000a40)=ANY=[@ANYBLOB="44010000100001000000000000000000ffffffff000000000000000000000000ac1414bb00000000000000000000000000003b00"/64, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="64010102000000000000000000000000000000006c000000ac1414bb0000000000000000000000000000000000000000000000000000000000000000000000000000ffff000000000100000000000000fdffffffffffffff04000000000000000000000000000000020000000000000004000000000000000000004000000000000000000000000000000002000000000000000025bd7000000000000a000301000000000000000048000300"], 0x144}, 0x1, 0x0, 0x0, 0x44}, 0x4810) 575.715262ms ago: executing program 1 (id=695): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000800)=ANY=[@ANYBLOB="08010000160001000000000000000000fe880000000000000000000000000101ffffffff00000000000000000000000000000000000000010000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac14140000000000000000000000000a0000000033"], 0x108}, 0x1, 0x0, 0x0, 0x1}, 0x0) 554.395742ms ago: executing program 1 (id=696): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f00000001c0), 0x2, 0x0) write$cgroup_type(r1, &(0x7f0000000280), 0x9) r2 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000c40), 0x12) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) syz_clone(0x40020000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000200)=0x1, 0x12) mount$binderfs(0x0, &(0x7f0000000040)='./binderfs\x00', &(0x7f00000000c0), 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB='max']) 164.453178ms ago: executing program 0 (id=697): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="84010000100013070000040000000000ac1e010000fe8000000000000000000000000000bb0000000000000000000000003c00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000004d332000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffff8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c001400636d616328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0"], 0x184}}, 0x0) 107.701909ms ago: executing program 0 (id=698): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000058c0)=ANY=[@ANYBLOB="fc01000013000100000000000000000000000000000000000000000000000001fc0200000000000000000000000000014e24000d040000090a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000010000000000000000000000000000000000000000ffffffffffffffff0000000000000000030000000000000009000000000000000080ff00000000000000000000000000010000000000000000000000000000000000000000000000feffffff00000000000000000000000044010500"], 0x1fc}, 0x1, 0x0, 0x0, 0x11}, 0x0) 107.406359ms ago: executing program 0 (id=699): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000000)=ANY=[]) (async) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0xeeef0000, 0xf000, 0xf, 0x0, 0x8, 0x8, 0x0, 0x2, 0x0, 0x6, 0x9, 0x13}, {0x1, 0x4, 0x0, 0x8, 0x0, 0x0, 0x0, 0x65, 0x7, 0x7, 0x0, 0xff}, {0x3000, 0x5000, 0xc, 0x0, 0x7, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfc}, {0x10000, 0xd000, 0xe, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x4}, {0xeeee8000, 0x0, 0x8, 0x8, 0xff, 0x4, 0x81, 0xe, 0x0, 0x3c, 0x7d}, {0x0, 0x80a0000, 0xd, 0x8, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x80}, {0x8080000, 0xdddd0000, 0xa, 0x6, 0x5, 0x0, 0x78, 0x0, 0x1, 0xff}, {0x0, 0xdddd0000, 0x8, 0x0, 0xfc, 0x1, 0x0, 0xa, 0x26, 0x0, 0x10, 0x45}, {0xf000}, {0xeeee8000}, 0xfdfcffdb, 0x0, 0xdddd0000, 0x101b8, 0x8000000000b, 0xf801, 0x10000, [0x0, 0x0, 0xffffffffffffffff, 0x7]}) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x149002, 0x0) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async) chdir(&(0x7f0000000540)='./cgroup\x00') (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched_retired(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newtclass={0x24, 0x28, 0x119, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xfff1, 0x1}, {0xffff, 0x7}, {0x4, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x1804}, 0x20020000) socket$packet(0x11, 0x3, 0x300) (async) socket$nl_route(0x10, 0x3, 0x0) quotactl_fd$Q_QUOTAOFF(0xffffffffffffffff, 0xffffffff80000301, 0xee01, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) (async) mkdir(&(0x7f0000000100)='./file1\x00', 0x13b) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) (async) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r4, 0x4010ae67, &(0x7f0000000380)={0x1, 0x0, 0x1}) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) (async) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) (async) ioctl$KVM_RUN(r6, 0xae80, 0x0) (async) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r8 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r8, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) (async) recvfrom(r8, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x4052, r7, 0xffffd000) 0s ago: executing program 0 (id=700): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$uhid(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) connect$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x3ff, @any, 0x7, 0x1}, 0xe) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000000)={0x5, 0x978d}, 0x0) pipe2$9p(0x0, 0x4000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x190e}, @flat=@binder={0x73622a85, 0x1}, @fda={0x66646185, 0x7, 0x0, 0xf}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, 0x0}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.178' (ED25519) to the list of known hosts. [ 34.482305][ T36] audit: type=1400 audit(1750463442.009:64): avc: denied { mounton } for pid=281 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 34.483508][ T281] cgroup: Unknown subsys name 'net' [ 34.505612][ T36] audit: type=1400 audit(1750463442.009:65): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 34.534485][ T281] cgroup: Unknown subsys name 'devices' [ 34.534706][ T36] audit: type=1400 audit(1750463442.039:66): avc: denied { unmount } for pid=281 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 34.743683][ T281] cgroup: Unknown subsys name 'hugetlb' [ 34.749343][ T281] cgroup: Unknown subsys name 'rlimit' [ 34.882554][ T36] audit: type=1400 audit(1750463442.409:67): avc: denied { setattr } for pid=281 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 34.906358][ T36] audit: type=1400 audit(1750463442.409:68): avc: denied { mounton } for pid=281 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 34.914702][ T283] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 34.931894][ T36] audit: type=1400 audit(1750463442.409:69): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 34.965356][ T36] audit: type=1400 audit(1750463442.459:70): avc: denied { relabelto } for pid=283 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 34.992250][ T36] audit: type=1400 audit(1750463442.459:71): avc: denied { write } for pid=283 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 35.023637][ T36] audit: type=1400 audit(1750463442.549:72): avc: denied { read } for pid=281 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 35.049843][ T36] audit: type=1400 audit(1750463442.549:73): avc: denied { open } for pid=281 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 35.049922][ T281] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 35.803294][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.811075][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.819018][ T288] bridge_slave_0: entered allmulticast mode [ 35.826023][ T288] bridge_slave_0: entered promiscuous mode [ 35.834982][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.842738][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.851030][ T288] bridge_slave_1: entered allmulticast mode [ 35.857991][ T288] bridge_slave_1: entered promiscuous mode [ 35.978879][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.986610][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.995502][ T290] bridge_slave_0: entered allmulticast mode [ 36.003329][ T290] bridge_slave_0: entered promiscuous mode [ 36.014343][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.021695][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.030588][ T290] bridge_slave_1: entered allmulticast mode [ 36.037662][ T290] bridge_slave_1: entered promiscuous mode [ 36.069468][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.077356][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.086127][ T289] bridge_slave_0: entered allmulticast mode [ 36.093432][ T289] bridge_slave_0: entered promiscuous mode [ 36.107338][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.114638][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.122315][ T289] bridge_slave_1: entered allmulticast mode [ 36.129665][ T289] bridge_slave_1: entered promiscuous mode [ 36.159818][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.168318][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.175651][ T294] bridge_slave_0: entered allmulticast mode [ 36.182163][ T294] bridge_slave_0: entered promiscuous mode [ 36.192441][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.199845][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.207288][ T294] bridge_slave_1: entered allmulticast mode [ 36.214219][ T294] bridge_slave_1: entered promiscuous mode [ 36.287266][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.294789][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.302180][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.309219][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.363485][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.370631][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.377915][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.384964][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.412909][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.420135][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.428152][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.435825][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.452312][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.459457][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.466944][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.474028][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.483426][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.490566][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.498128][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.505451][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.512989][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.520178][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.560014][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.567102][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.579836][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.586938][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.611109][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.618197][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.636301][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.643371][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.650950][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.658023][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.683183][ T288] veth0_vlan: entered promiscuous mode [ 36.691252][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.698472][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.716517][ T289] veth0_vlan: entered promiscuous mode [ 36.729019][ T290] veth0_vlan: entered promiscuous mode [ 36.738531][ T288] veth1_macvtap: entered promiscuous mode [ 36.748909][ T289] veth1_macvtap: entered promiscuous mode [ 36.781468][ T294] veth0_vlan: entered promiscuous mode [ 36.789316][ T290] veth1_macvtap: entered promiscuous mode [ 36.800578][ T288] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 36.829481][ T294] veth1_macvtap: entered promiscuous mode [ 36.846822][ T310] netlink: 'syz.1.2': attribute type 4 has an invalid length. [ 36.857144][ T312] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1'. [ 36.938294][ T322] rust_binder: Write failure EINVAL in pid:2 [ 36.940001][ T323] rust_binder: Write failure EINVAL in pid:2 [ 36.997586][ T336] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 37.012570][ T338] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12'. [ 37.037163][ T341] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 37.048836][ T344] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 37.056422][ T344] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:7 [ 37.133572][ T349] capability: warning: `syz.1.16' uses 32-bit capabilities (legacy support in use) [ 37.170918][ T356] ======================================================= [ 37.170918][ T356] WARNING: The mand mount option has been deprecated and [ 37.170918][ T356] and is ignored by this kernel. Remove the mand [ 37.170918][ T356] option from the mount to silence this warning. [ 37.170918][ T356] ======================================================= [ 37.218164][ T358] netlink: 324 bytes leftover after parsing attributes in process `syz.2.20'. [ 37.261043][ T365] netlink: 112 bytes leftover after parsing attributes in process `syz.2.23'. [ 37.352944][ T374] netlink: 12 bytes leftover after parsing attributes in process `syz.2.26'. [ 37.399010][ T382] netlink: 88 bytes leftover after parsing attributes in process `syz.0.31'. [ 37.401249][ T383] netlink: 80 bytes leftover after parsing attributes in process `syz.2.30'. [ 37.469011][ T396] netlink: 16 bytes leftover after parsing attributes in process `syz.2.34'. [ 37.541719][ T406] binder: Unknown parameter 'obj_type' [ 37.549206][ T406] rust_binder: Error while translating object. [ 37.549234][ T406] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 37.555048][ T398] rust_binder: Read failure Err(EAGAIN) in pid:33 [ 37.556183][ T406] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:28 [ 37.584232][ T411] netlink: 8 bytes leftover after parsing attributes in process `syz.0.39'. [ 37.641883][ T64] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 37.805061][ T64] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 37.815009][ T388] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 37.823231][ T64] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.842123][ T64] usb 2-1: Product: syz [ 37.844794][ T422] netlink: 12 bytes leftover after parsing attributes in process `syz.3.44'. [ 37.849674][ T64] usb 2-1: Manufacturer: syz [ 37.870735][ T64] usb 2-1: SerialNumber: syz [ 37.875983][ T305] Bluetooth: hci0: Frame reassembly failed (-84) [ 37.925929][ T437] rust_binder: Error while translating object. [ 37.925970][ T437] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 37.932355][ T437] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:17 [ 37.956375][ T439] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 37.979759][ T439] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 37.991933][ T388] usb 3-1: Using ep0 maxpacket: 32 [ 37.999901][ T388] usb 3-1: too many configurations: 200, using maximum allowed: 8 [ 38.009004][ T388] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 38.017040][ T388] usb 3-1: can't read configurations, error -61 [ 38.046562][ T445] overlayfs: failed to resolve './file1': -2 [ 38.151993][ T388] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 38.301965][ T388] usb 3-1: Using ep0 maxpacket: 32 [ 38.307699][ T388] usb 3-1: too many configurations: 200, using maximum allowed: 8 [ 38.319343][ T388] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 38.328024][ T388] usb 3-1: can't read configurations, error -61 [ 38.336034][ T388] usb usb3-port1: attempt power cycle [ 38.592382][ T478] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 38.592406][ T478] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:57 [ 38.614329][ T480] tipc: Started in network mode [ 38.630610][ T480] tipc: Node identity 68a, cluster identity 3 [ 38.636951][ T480] tipc: Node number set to 1674 [ 38.645957][ T480] binder: Unknown parameter 'fscontext?}' [ 38.681990][ T388] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 38.711470][ T484] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 38.712376][ T388] usb 3-1: Using ep0 maxpacket: 32 [ 38.719545][ T484] rust_binder: Write failure EINVAL in pid:63 [ 38.727250][ T388] usb 3-1: too many configurations: 200, using maximum allowed: 8 [ 38.743259][ T388] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 38.750920][ T388] usb 3-1: can't read configurations, error -61 [ 38.881946][ T388] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 38.912213][ T388] usb 3-1: Using ep0 maxpacket: 32 [ 38.917980][ T388] usb 3-1: too many configurations: 200, using maximum allowed: 8 [ 38.936440][ T388] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 38.945034][ T388] usb 3-1: can't read configurations, error -61 [ 38.952301][ T388] usb usb3-port1: unable to enumerate USB device [ 38.978916][ T507] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 38.978941][ T507] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:86 [ 39.575151][ T36] kauditd_printk_skb: 106 callbacks suppressed [ 39.575168][ T36] audit: type=1400 audit(1750463447.099:180): avc: denied { create } for pid=515 comm="syz.3.78" anonclass=[userfaultfd] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 39.612644][ T36] audit: type=1400 audit(1750463447.109:181): avc: denied { ioctl } for pid=515 comm="syz.3.78" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=5010 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 39.659913][ T36] audit: type=1400 audit(1750463447.179:182): avc: denied { mounton } for pid=524 comm="syz.3.82" path="/41/file0" dev="tmpfs" ino=281 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 39.682867][ T36] audit: type=1400 audit(1750463447.179:183): avc: denied { map } for pid=524 comm="syz.3.82" path="socket:[5239]" dev="sockfs" ino=5239 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 39.901937][ T52] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 39.902169][ T429] Bluetooth: hci0: command 0x1003 tx timeout [ 39.932615][ T543] capability: warning: `syz.3.90' uses deprecated v2 capabilities in a way that may be insecure [ 39.985915][ T554] SELinux: security_context_str_to_sid (sytem_uÝGй ‰:ÿß) failed with errno=-22 [ 40.019431][ T560] netlink: 'syz.0.97': attribute type 4 has an invalid length. [ 40.049678][ T564] netlink: 'syz.0.99': attribute type 4 has an invalid length. [ 40.057881][ T564] netlink: 'syz.0.99': attribute type 4 has an invalid length. [ 40.059834][ T36] audit: type=1400 audit(1750463447.579:184): avc: denied { write } for pid=555 comm="syz.3.95" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 40.125596][ T36] audit: type=1400 audit(1750463447.649:185): avc: denied { ioctl } for pid=572 comm="syz.0.102" path="socket:[6186]" dev="sockfs" ino=6186 ioctlcmd=0x8983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 40.275852][ T36] audit: type=1400 audit(1750463447.799:186): avc: denied { create } for pid=585 comm="syz.0.107" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 40.379673][ T64] usb 2-1: USB disconnect, device number 2 [ 40.451823][ T36] audit: type=1326 audit(1750463447.969:187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=601 comm="syz.1.114" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fdbe798e929 code=0x0 [ 40.550001][ T605] netlink: 'syz.2.115': attribute type 4 has an invalid length. [ 40.560078][ T36] audit: type=1400 audit(1750463448.079:188): avc: denied { mount } for pid=601 comm="syz.1.114" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 40.594759][ T606] loop2: detected capacity change from 0 to 7 [ 40.594928][ T36] audit: type=1400 audit(1750463448.079:189): avc: denied { search } for pid=601 comm="syz.1.114" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 40.601638][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 40.631767][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 40.639746][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 40.648998][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 40.656907][ T606] loop2: unable to read partition table [ 40.662768][ T606] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 40.672923][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 40.682214][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 40.690280][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 40.699566][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 40.707572][ T109] loop2: unable to read partition table [ 40.716450][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 40.725810][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 40.735272][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 40.744480][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 40.753710][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 40.762907][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 40.771003][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 40.782070][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 40.795310][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 40.804723][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 40.828102][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 40.837286][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 40.845837][ T109] loop2: unable to read partition table [ 40.853086][ T627] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 40.853116][ T627] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:137 [ 40.878333][ T628] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:75 [ 40.891444][ T109] loop2: unable to read partition table [ 40.913883][ T633] overlayfs: failed to resolve './file1': -2 [ 40.927081][ T109] loop2: unable to read partition table [ 40.941643][ T638] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 40.941673][ T638] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:62 [ 40.951423][ T638] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 40.960734][ T638] rust_binder: Read failure Err(EFAULT) in pid:62 [ 40.974564][ T109] loop2: unable to read partition table [ 41.231867][ T64] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 41.381884][ T64] usb 3-1: Using ep0 maxpacket: 16 [ 41.389035][ T64] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 41.400086][ T64] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 41.413356][ T64] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 41.423190][ T64] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 41.434901][ T64] usb 3-1: config 0 descriptor?? [ 41.472884][ T651] binder: Bad value for 'stats' [ 41.542695][ T663] rust_binder: validate_parent_fixup: fixup_min_offset=29, parent_offset=27 [ 41.542722][ T663] rust_binder: Error while translating object. [ 41.552000][ T663] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 41.558447][ T663] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:56 [ 41.654300][ T669] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 41.663813][ T669] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:62 [ 41.752827][ T306] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 41.791956][ T306] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 41.852362][ T687] overlayfs: failed to resolve './file0': -2 [ 41.873018][ T675] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 41.893348][ T675] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.951283][ T693] netlink: 'syz.3.151': attribute type 4 has an invalid length. [ 42.121856][ T306] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 42.272923][ T306] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 42.284311][ T306] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 42.295559][ T306] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 42.305749][ T306] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 42.319716][ T306] usb 1-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 42.329079][ T306] usb 1-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 42.337351][ T306] usb 1-1: Manufacturer: syz [ 42.342757][ T306] usb 1-1: config 0 descriptor?? [ 42.659171][ T703] __nla_validate_parse: 27 callbacks suppressed [ 42.659188][ T703] netlink: 324 bytes leftover after parsing attributes in process `syz.1.155'. [ 42.691313][ T705] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:72 [ 42.691984][ T705] rust_binder: Error while translating object. [ 42.701267][ T705] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 42.707757][ T705] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:72 [ 42.785823][ T707] netlink: 76 bytes leftover after parsing attributes in process `syz.1.157'. [ 42.818876][ T709] overlayfs: failed to resolve './file0': -2 [ 42.836741][ T711] netlink: 16 bytes leftover after parsing attributes in process `syz.3.159'. [ 42.894039][ T717] netlink: 112 bytes leftover after parsing attributes in process `syz.1.162'. [ 42.937920][ T722] netlink: 12 bytes leftover after parsing attributes in process `syz.3.164'. [ 42.938446][ T724] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 42.946895][ T724] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:84 [ 42.998490][ T732] overlayfs: failed to resolve './file0': -2 [ 43.060014][ T306] usbhid 1-1:0.0: can't add hid device: -71 [ 43.066180][ T306] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 43.075333][ T306] usb 1-1: USB disconnect, device number 2 [ 43.101135][ T739] netlink: 88 bytes leftover after parsing attributes in process `syz.0.172'. [ 43.122163][ T742] netlink: 76 bytes leftover after parsing attributes in process `syz.0.173'. [ 43.143317][ T744] netlink: 16 bytes leftover after parsing attributes in process `syz.0.174'. [ 43.174191][ T746] rust_binder: Failed to allocate buffer. len:4294966472, is_oneway:false [ 43.174229][ T746] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 43.182960][ T746] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:90 [ 43.221850][ T9] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 43.226772][ T752] overlayfs: failed to resolve './file0': -2 [ 43.272809][ T756] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:182 [ 43.323919][ T762] netlink: 12 bytes leftover after parsing attributes in process `syz.3.181'. [ 43.381860][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 43.389189][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 43.401102][ T768] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 43.401134][ T768] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:98 [ 43.410465][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 43.438346][ T9] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 43.448678][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.466191][ T9] usb 2-1: config 0 descriptor?? [ 43.478793][ T9] hub 2-1:0.0: USB hub found [ 43.565437][ T777] rust_binder: Error while translating object. [ 43.565496][ T777] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 43.572026][ T777] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:190 [ 43.594928][ T779] overlayfs: failed to resolve './file1': -2 [ 43.624222][ T781] 9pnet_fd: Insufficient options for proto=fd [ 43.676766][ T9] hub 2-1:0.0: 1 port detected [ 43.755028][ T785] Zero length message leads to an empty skb [ 44.001406][ T64] usb 3-1: string descriptor 0 read error: -71 [ 44.010666][ T790] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 44.010697][ T790] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 44.017471][ T790] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 44.024090][ T64] usbhid 3-1:0.0: can't add hid device: -71 [ 44.038923][ T64] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 44.047541][ T790] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 44.047567][ T790] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 44.056821][ T64] usb 3-1: USB disconnect, device number 6 [ 44.141534][ T797] netlink: 80 bytes leftover after parsing attributes in process `syz.2.195'. [ 44.161636][ T799] binder: Bad value for 'stats' [ 44.175822][ T801] overlayfs: failed to resolve './file1': -2 [ 44.194870][ T803] rust_binder: Failed to allocate buffer. len:40, is_oneway:false [ 44.194904][ T803] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 44.202967][ T803] rust_binder: Read failure Err(EFAULT) in pid:85 [ 44.211313][ T803] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 44.279865][ T306] hub 2-1:0.0: activate --> -90 [ 44.523345][ T822] overlayfs: failed to resolve './file1': -2 [ 44.795910][ T36] kauditd_printk_skb: 30 callbacks suppressed [ 44.795925][ T36] audit: type=1400 audit(1750463452.319:220): avc: denied { listen } for pid=847 comm="syz.3.218" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 44.861906][ T9] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 44.882992][ T306] hub 2-1:0.0: hub_ext_port_status failed (err = -71) [ 44.890557][ T603] usb 2-1: USB disconnect, device number 3 [ 44.897554][ T306] usb 2-1-port1: cannot reset (err = -71) [ 44.903544][ T306] usb 2-1-port1: attempt power cycle [ 45.012958][ T9] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 45.026799][ T9] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 45.035997][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 45.044030][ T9] usb 3-1: SerialNumber: syz [ 45.501873][ T52] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 45.501920][ T429] Bluetooth: hci0: command 0x1003 tx timeout [ 45.560336][ T887] rust_binder: Write failure EINVAL in pid:113 [ 45.652780][ T9] cdc_ether 3-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.2-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 45.686475][ T903] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 45.700527][ T903] overlayfs: missing 'lowerdir' [ 45.706772][ T36] audit: type=1400 audit(1750463453.229:221): avc: denied { read } for pid=148 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 45.736136][ T36] audit: type=1400 audit(1750463453.249:222): avc: denied { read } for pid=148 comm="dhcpcd" name="n15" dev="tmpfs" ino=1582 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 45.760090][ T36] audit: type=1400 audit(1750463453.249:223): avc: denied { open } for pid=148 comm="dhcpcd" path="/run/udev/data/n15" dev="tmpfs" ino=1582 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 45.789656][ T36] audit: type=1400 audit(1750463453.249:224): avc: denied { getattr } for pid=148 comm="dhcpcd" path="/run/udev/data/n15" dev="tmpfs" ino=1582 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 45.816957][ T36] audit: type=1400 audit(1750463453.279:225): avc: denied { search } for pid=904 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 45.854729][ T36] audit: type=1400 audit(1750463453.339:226): avc: denied { read } for pid=909 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 45.882769][ T36] audit: type=1400 audit(1750463453.339:227): avc: denied { open } for pid=909 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 45.907835][ T917] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 144, size: 255) [ 45.907862][ T917] rust_binder: Error while translating object. [ 45.910046][ T36] audit: type=1400 audit(1750463453.339:228): avc: denied { getattr } for pid=909 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 45.928760][ T917] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 45.952883][ T917] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:133 [ 46.001825][ T36] audit: type=1400 audit(1750463453.519:229): avc: denied { write } for pid=908 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=425 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 46.005791][ T925] binder: Bad value for 'context' [ 46.158509][ T940] netlink: 'syz.0.251': attribute type 4 has an invalid length. [ 46.275832][ T945] binder: Unknown parameter 'defcontext01777777777777777777777' [ 46.321328][ T954] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 144, size: 255) [ 46.321352][ T954] rust_binder: Error while translating object. [ 46.339104][ T956] binder: Unknown parameter ' ûsCŸ¤10rsync' [ 46.351387][ T954] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 46.351423][ T954] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:153 [ 46.406525][ T831] rust_binder: Write failure EFAULT in pid:113 [ 46.433076][ T603] usb 3-1: USB disconnect, device number 7 [ 46.464582][ T603] cdc_ether 3-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.2-1, CDC Ethernet Device [ 46.501293][ T13] Bluetooth: hci0: Frame reassembly failed (-84) [ 46.584528][ T978] netlink: 'syz.0.264': attribute type 4 has an invalid length. [ 46.766734][ T1005] input: syz0 as /devices/virtual/input/input4 [ 46.785188][ T1005] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 46.844749][ T1017] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION already set [ 46.852025][ T1017] rust_binder: Write failure EINVAL in pid:259 [ 46.949937][ T1025] netlink: 'syz.2.275': attribute type 4 has an invalid length. [ 47.058637][ T1041] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 144, size: 255) [ 47.058660][ T1041] rust_binder: Error while translating object. [ 47.069328][ T1041] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 47.075533][ T1041] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:132 [ 47.111844][ T603] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 47.213413][ T1057] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 4200, limit: 4216, size: 89) [ 47.213436][ T1057] rust_binder: Error while translating object. [ 47.224131][ T1057] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 47.230301][ T1057] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:148 [ 47.274321][ T603] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 47.293704][ T603] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 47.307754][ T603] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 47.317922][ T603] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 47.331641][ T603] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 47.342369][ T603] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 47.356131][ T603] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 47.366272][ T603] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 47.379946][ T603] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 47.390107][ T603] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 47.405476][ T603] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 47.414644][ T603] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=80 [ 47.420253][ T1069] netlink: 'syz.2.296': attribute type 4 has an invalid length. [ 47.422940][ T603] usb 4-1: SerialNumber: syz [ 47.637299][ T388] usb 4-1: USB disconnect, device number 2 [ 47.652863][ T1098] binder: Unknown parameter 'processor : 0 [ 47.652863][ T1098] vendor_id : GenuineIntel [ 47.652863][ T1098] cpu family : 6 [ 47.652863][ T1098] model : 79 [ 47.652863][ T1098] model name : Intel(R) Xeon(R) CPU @ 2.20GHz [ 47.652863][ T1098] stepping : 0 [ 47.652863][ T1098] microcode : 0xffffffff [ 47.652863][ T1098] cpu MHz : 2200.212 [ 47.652863][ T1098] cache size : 56320 KB [ 47.652863][ T1098] physical id : 0 [ 47.652863][ T1098] siblings : 2 [ 47.652863][ T1098] core id : 0 [ 47.652863][ T1098] cpu cores : 1 [ 47.652863][ T1098] apicid : 0 [ 47.652863][ T1098] /dev/net/tun' [ 48.162915][ T1102] __nla_validate_parse: 25 callbacks suppressed [ 48.162934][ T1102] netlink: 8 bytes leftover after parsing attributes in process `syz.3.311'. [ 48.198168][ T1108] netlink: 324 bytes leftover after parsing attributes in process `syz.3.313'. [ 48.235280][ T1112] netlink: 76 bytes leftover after parsing attributes in process `syz.3.315'. [ 48.278863][ T1114] netlink: 'syz.3.316': attribute type 4 has an invalid length. [ 48.414063][ T1126] netlink: 112 bytes leftover after parsing attributes in process `syz.3.320'. [ 48.541885][ T429] Bluetooth: hci0: command 0x1003 tx timeout [ 48.547928][ T52] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 48.591843][ T1140] tmpfs: Bad value for 'size' [ 48.597785][ T1140] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:304 [ 48.698771][ T1144] netlink: 16 bytes leftover after parsing attributes in process `syz.0.327'. [ 48.725889][ T1148] netlink: 76 bytes leftover after parsing attributes in process `syz.1.329'. [ 48.762279][ T1150] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:198 [ 48.769033][ T1156] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 144, size: 255) [ 48.786527][ T1156] rust_binder: Error while translating object. [ 48.797799][ T1156] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 48.804422][ T1156] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:110 [ 48.866471][ T1166] netlink: 112 bytes leftover after parsing attributes in process `syz.3.337'. [ 48.887333][ T1168] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:112 [ 48.887333][ T1169] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:112 [ 49.121839][ T388] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 49.161837][ T603] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 49.291839][ T388] usb 2-1: Using ep0 maxpacket: 8 [ 49.298100][ T388] usb 2-1: config 0 has an invalid interface number: 151 but max is 1 [ 49.306423][ T388] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 49.316759][ T388] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 49.344237][ T388] usb 2-1: config 0 has no interface number 0 [ 49.357013][ T388] usb 2-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 49.373345][ T388] usb 2-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 49.385189][ T388] usb 2-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 49.395290][ T388] usb 2-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 0 [ 49.405730][ T388] usb 2-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 49.420602][ T388] usb 2-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 49.429887][ T388] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.438210][ T388] usb 2-1: Product: syz [ 49.442727][ T388] usb 2-1: Manufacturer: syz [ 49.447432][ T388] usb 2-1: SerialNumber: syz [ 49.455619][ T388] usb 2-1: config 0 descriptor?? [ 49.466632][ T388] snd-usb-audio 2-1:0.151: probe with driver snd-usb-audio failed with error -12 [ 49.483465][ T387] udevd[387]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.151/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 49.662277][ T31] usb 2-1: USB disconnect, device number 8 [ 49.742682][ T1175] rust_binder: Failed to allocate buffer. len:40, is_oneway:false [ 50.204903][ T36] kauditd_printk_skb: 26 callbacks suppressed [ 50.204924][ T36] audit: type=1400 audit(1750463457.729:256): avc: denied { execute } for pid=1176 comm="syz.1.340" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 50.264523][ T1180] netlink: 16 bytes leftover after parsing attributes in process `syz.1.341'. [ 50.307854][ T1184] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 50.307888][ T1184] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:123 [ 50.546690][ T1191] rust_binder: Failed to allocate buffer. len:65376, is_oneway:true [ 50.555911][ T1191] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 50.563975][ T1191] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:209 [ 50.588683][ T1193] rust_binder: Error while translating object. [ 50.597928][ T1193] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 50.604156][ T1193] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:211 [ 50.641928][ T9] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 50.792645][ T9] usb 2-1: device descriptor read/64, error -71 [ 50.881867][ T306] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 51.041874][ T306] usb 1-1: Using ep0 maxpacket: 32 [ 51.047135][ T9] usb 2-1: device descriptor read/64, error -71 [ 51.054625][ T306] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 51.063085][ T306] usb 1-1: config 0 has no interface number 0 [ 51.070818][ T306] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 51.090268][ T306] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 51.099560][ T306] usb 1-1: Product: syz [ 51.111847][ T306] usb 1-1: Manufacturer: syz [ 51.118703][ T306] usb 1-1: SerialNumber: syz [ 51.131930][ T306] usb 1-1: config 0 descriptor?? [ 51.140953][ T306] smsc95xx v2.0.0 [ 51.291857][ T9] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 51.422333][ T9] usb 2-1: device descriptor read/64, error -71 [ 51.550645][ T306] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 51.561628][ T306] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 51.661874][ T9] usb 2-1: device descriptor read/64, error -71 [ 51.782033][ T9] usb usb2-port1: attempt power cycle [ 52.106709][ T603] usb 4-1: unable to get BOS descriptor or descriptor too short [ 52.123224][ T9] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 52.133651][ T603] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 52.143215][ T603] usb 4-1: can't read configurations, error -71 [ 52.150543][ T1197] netlink: 76 bytes leftover after parsing attributes in process `syz.3.349'. [ 52.162834][ T9] usb 2-1: device descriptor read/8, error -71 [ 52.172800][ T1199] netlink: 12 bytes leftover after parsing attributes in process `syz.3.350'. [ 52.173260][ T306] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 52.202500][ T1201] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 4200, limit: 4216, size: 89) [ 52.202521][ T1201] rust_binder: Error while translating object. [ 52.213297][ T306] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -71 [ 52.221921][ T1201] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 52.227690][ T1201] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:324 [ 52.234441][ T306] usb 1-1: USB disconnect, device number 3 [ 52.339793][ T9] usb 2-1: device descriptor read/8, error -71 [ 52.585044][ T36] audit: type=1400 audit(1750463460.109:257): avc: denied { create } for pid=1224 comm="syz.3.362" name="file7" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 52.585457][ T1225] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 52.605665][ T1225] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:348 [ 52.615176][ T9] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 52.654045][ T9] usb 2-1: device descriptor read/8, error -71 [ 52.691111][ T1227] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=1227 comm=syz.0.363 [ 52.714202][ T1227] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=1227 comm=syz.0.363 [ 52.762170][ T36] audit: type=1400 audit(1750463460.289:258): avc: denied { write } for pid=1226 comm="syz.0.363" name="hwrng" dev="devtmpfs" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 52.789948][ T36] audit: type=1400 audit(1750463460.309:259): avc: denied { ioctl } for pid=1226 comm="syz.0.363" path="mnt:[4026532391]" dev="nsfs" ino=4026532391 ioctlcmd=0x660c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 52.792907][ T9] usb 2-1: device descriptor read/8, error -71 [ 52.824709][ T36] audit: type=1400 audit(1750463460.309:260): avc: denied { write } for pid=1226 comm="syz.0.363" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 52.931953][ T9] usb usb2-port1: unable to enumerate USB device [ 53.096772][ T36] audit: type=1400 audit(1750463460.619:261): avc: denied { append } for pid=1280 comm="syz.0.376" name="pfkey" dev="proc" ino=4026532549 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 53.152531][ T36] audit: type=1400 audit(1750463460.619:262): avc: denied { associate } for pid=1280 comm="syz.0.376" name="pfkey" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 53.175204][ T1293] rust_binder: Error while translating object. [ 53.175229][ T1293] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 53.181850][ T1293] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:254 [ 53.202022][ T36] audit: type=1400 audit(1750463460.699:263): avc: denied { create } for pid=1292 comm="syz.0.382" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 53.205178][ T1295] __nla_validate_parse: 10 callbacks suppressed [ 53.205195][ T1295] netlink: 324 bytes leftover after parsing attributes in process `syz.0.383'. [ 53.304199][ T1299] SELinux: security_context_str_to_sid (sytem_uÝGй) failed with errno=-22 [ 53.348044][ T1303] netlink: 16 bytes leftover after parsing attributes in process `syz.0.387'. [ 53.370690][ T1305] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 53.377906][ T1305] rust_binder: Write failure EINVAL in pid:266 [ 53.383994][ T388] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 53.521486][ T1319] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:275 [ 53.522322][ T1322] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 53.523077][ T1321] netlink: 76 bytes leftover after parsing attributes in process `syz.1.395'. [ 53.547827][ T1323] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:275 [ 53.561832][ T388] usb 4-1: Using ep0 maxpacket: 16 [ 53.577874][ T1327] random: crng reseeded on system resumption [ 53.584080][ T36] audit: type=1400 audit(1750463461.099:264): avc: denied { read write } for pid=1325 comm="syz.0.397" name="snapshot" dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 53.592885][ T388] usb 4-1: config 1 interface 0 altsetting 93 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 53.626883][ T1330] netlink: 8 bytes leftover after parsing attributes in process `syz.1.398'. [ 53.645946][ T36] audit: type=1400 audit(1750463461.099:265): avc: denied { ioctl open } for pid=1325 comm="syz.0.397" path="/dev/snapshot" dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 53.651857][ T388] usb 4-1: config 1 interface 0 altsetting 93 bulk endpoint 0x82 has invalid maxpacket 96 [ 53.694429][ T1334] netlink: 12 bytes leftover after parsing attributes in process `syz.1.399'. [ 53.700795][ T1336] binfmt_misc: register: failed to install interpreter file ./file0 [ 53.721825][ T388] usb 4-1: config 1 interface 0 altsetting 93 bulk endpoint 0x3 has invalid maxpacket 8 [ 53.731940][ T388] usb 4-1: config 1 interface 0 altsetting 93 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 53.761827][ T388] usb 4-1: config 1 interface 0 has no altsetting 0 [ 53.769506][ T1341] netlink: 324 bytes leftover after parsing attributes in process `syz.1.401'. [ 53.772736][ T388] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 53.795378][ T388] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 53.809278][ T388] usb 4-1: SerialNumber: syz [ 53.824619][ T1288] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 53.832293][ T1288] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 53.852751][ T1350] netlink: 16 bytes leftover after parsing attributes in process `syz.1.405'. [ 54.059769][ T1288] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 54.068612][ T1288] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 54.083543][ T1360] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:298 [ 54.083768][ T1359] rust_binder: Failed to vm_insert_page(35184372744192): vma_addr:35184372744192 i:0 err:EBUSY [ 54.100622][ T1359] rust_binder: Error in use_page_slow: EBUSY [ 54.121827][ T1359] rust_binder: use_range failure EBUSY [ 54.127868][ T1359] rust_binder: Failed to allocate buffer. len:8, is_oneway:true [ 54.136021][ T1359] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBUSY } [ 54.144420][ T1359] rust_binder: Failure BR_FAILED_REPLY { source: EBUSY } during reply - delivering BR_FAILED_REPLY to sender. [ 54.159280][ T1359] rust_binder: Transaction failed: BR_TRANSACTION_COMPLETE my_pid:298 [ 54.304456][ T1368] rust_binder: Write failure EINVAL in pid:154 [ 54.481107][ T388] cdc_ether 4-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.3-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 54.694064][ C1] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification 68! [ 54.702954][ C1] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification 01! [ 54.715573][ C1] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification 4e! [ 54.722973][ C1] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification 3a! [ 54.730342][ C1] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification a9! [ 54.737712][ C1] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification 30! [ 54.745080][ C1] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification 37! [ 54.752801][ C1] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification 96! [ 54.760168][ C1] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification 5d! [ 54.767537][ C1] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification a5! [ 54.774908][ C1] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification cf! [ 54.782285][ C1] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification 43! [ 54.789672][ C1] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification a7! [ 54.797049][ C1] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification 87! [ 54.804428][ C1] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification 92! [ 54.811977][ C1] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification 6d! [ 54.819361][ C1] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification 20! [ 54.826808][ C1] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification 59! [ 55.036130][ T1288] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.061985][ T1288] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.066232][ T1389] netlink: 76 bytes leftover after parsing attributes in process `syz.0.414'. [ 55.080588][ T1288] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.101594][ T1288] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.124253][ T1288] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.131195][ T1399] netlink: 8 bytes leftover after parsing attributes in process `syz.1.417'. [ 55.147295][ T1288] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.178107][ T1404] netlink: 12 bytes leftover after parsing attributes in process `syz.0.419'. [ 55.191551][ T1288] input: syz0 as /devices/virtual/input/input5 [ 55.208890][ T1288] binder: Unknown parameter '' [ 55.237905][ T1409] overlayfs: missing 'lowerdir' [ 55.417248][ T603] usb 4-1: USB disconnect, device number 5 [ 55.430796][ T603] cdc_ether 4-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.3-1, CDC Ethernet Device [ 55.456525][ T1419] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:317 [ 55.568983][ T1437] overlayfs: missing 'lowerdir' [ 55.575743][ T1439] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.588414][ T1439] rust_binder: Failed to allocate buffer. len:16, is_oneway:false [ 55.605686][ T1439] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.879948][ T1482] overlayfs: missing 'workdir' [ 56.015306][ T36] kauditd_printk_skb: 5 callbacks suppressed [ 56.015324][ T36] audit: type=1400 audit(1750463463.539:271): avc: denied { getopt } for pid=1494 comm="syz.1.445" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 56.091482][ T1521] overlayfs: missing 'workdir' [ 56.150755][ T1527] rust_binder: Write failure EINVAL in pid:362 [ 56.236141][ T1536] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 56.281809][ T1547] overlayfs: missing 'workdir' [ 56.293763][ T36] audit: type=1400 audit(1750463463.819:272): avc: denied { nlmsg_write } for pid=1542 comm="syz.1.461" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 56.388744][ T36] audit: type=1400 audit(1750463463.909:273): avc: denied { setopt } for pid=1556 comm="syz.1.467" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 56.630910][ T1563] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 56.632134][ T388] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 56.681077][ T603] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 56.682060][ T36] audit: type=1326 audit(1750463464.159:274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1561 comm="syz.3.469" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f88a098e929 code=0x0 [ 56.771860][ T388] usb 1-1: device descriptor read/64, error -71 [ 56.851892][ T603] usb 2-1: Using ep0 maxpacket: 16 [ 56.871810][ T603] usb 2-1: config 0 has an invalid interface number: 105 but max is 0 [ 56.890329][ T603] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 56.900626][ T603] usb 2-1: config 0 has no interface number 0 [ 56.908131][ T603] usb 2-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 56.919751][ T1571] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:383 [ 56.920929][ T36] audit: type=1400 audit(1750463464.439:275): avc: denied { map } for pid=1570 comm="syz.3.473" path="/dev/uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 56.921822][ T603] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 56.933007][ T36] audit: type=1400 audit(1750463464.439:276): avc: denied { execute } for pid=1570 comm="syz.3.473" path="/dev/uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 56.991977][ T603] usb 2-1: Product: syz [ 56.996218][ T603] usb 2-1: Manufacturer: syz [ 57.001080][ T603] usb 2-1: SerialNumber: syz [ 57.009324][ T603] usb 2-1: config 0 descriptor?? [ 57.021103][ T603] usb 2-1: Found UVC 0.00 device syz (046d:08f3) [ 57.027759][ T603] usb 2-1: No valid video chain found. [ 57.051835][ T388] usb 1-1: device descriptor read/64, error -71 [ 57.219838][ T1584] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 57.220612][ T36] audit: type=1400 audit(1750463464.739:277): avc: denied { mount } for pid=1583 comm="syz.3.479" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 57.232472][ T603] usb 2-1: USB disconnect, device number 13 [ 57.249632][ T1584] rust_binder: Error in use_page_slow: ESRCH [ 57.256031][ T1584] rust_binder: use_range failure ESRCH [ 57.262379][ T1584] rust_binder: Failed to allocate buffer. len:4232, is_oneway:false [ 57.268076][ T1584] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 57.278438][ T36] audit: type=1400 audit(1750463464.769:278): avc: denied { mounton } for pid=1583 comm="syz.3.479" path="/167/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 57.281993][ T1584] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:396 [ 57.311849][ T388] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 57.328772][ T36] audit: type=1400 audit(1750463464.839:279): avc: denied { unmount } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 57.408619][ T36] audit: type=1400 audit(1750463464.929:280): avc: denied { getopt } for pid=1596 comm="syz.3.484" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 57.428989][ T1597] rust_binder: Write failure EFAULT in pid:409 [ 57.485906][ T388] usb 1-1: device descriptor read/64, error -71 [ 57.731827][ T388] usb 1-1: device descriptor read/64, error -71 [ 57.732465][ T1617] Bluetooth: received HCILL_WAKE_UP_ACK in state 2 [ 57.765475][ T45] Bluetooth: hci0: Frame reassembly failed (-84) [ 57.771950][ T304] Bluetooth: hci0: Frame reassembly failed (-84) [ 57.842007][ T388] usb usb1-port1: attempt power cycle [ 58.191849][ T388] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 58.223453][ T388] usb 1-1: device descriptor read/8, error -71 [ 58.352924][ T388] usb 1-1: device descriptor read/8, error -71 [ 58.591851][ T388] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 58.623051][ T388] usb 1-1: device descriptor read/8, error -71 [ 58.753100][ T388] usb 1-1: device descriptor read/8, error -71 [ 58.862183][ T388] usb usb1-port1: unable to enumerate USB device [ 59.746003][ T52] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 62.926940][ T304] bridge_slave_1: left allmulticast mode [ 62.932695][ T304] bridge_slave_1: left promiscuous mode [ 62.938293][ T304] bridge0: port 2(bridge_slave_1) entered disabled state [ 62.946816][ T304] bridge_slave_0: left allmulticast mode [ 62.952595][ T304] bridge_slave_0: left promiscuous mode [ 62.958362][ T304] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.093615][ T304] veth1_macvtap: left promiscuous mode [ 63.099118][ T304] veth0_vlan: left promiscuous mode [ 67.533689][ T1632] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 67.569644][ T1640] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 67.570083][ T1640] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 144, size: 255) [ 67.586758][ T1640] rust_binder: Error while translating object. [ 67.611863][ T1640] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 67.628219][ T1640] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:364 [ 67.637710][ T36] kauditd_printk_skb: 1 callbacks suppressed [ 67.637725][ T36] audit: type=1400 audit(1750463475.149:282): avc: denied { mounton } for pid=1641 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 67.716525][ T1641] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.728691][ T1649] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 67.728807][ T1649] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 67.728830][ T1641] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.735637][ T1649] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:368 [ 67.755931][ T1641] bridge_slave_0: entered allmulticast mode [ 67.771942][ T1641] bridge_slave_0: entered promiscuous mode [ 67.780344][ T1641] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.787581][ T1641] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.794836][ T1641] bridge_slave_1: entered allmulticast mode [ 67.801440][ T1641] bridge_slave_1: entered promiscuous mode [ 67.807534][ T1651] netlink: 'syz.0.502': attribute type 4 has an invalid length. [ 67.833243][ T1654] __nla_validate_parse: 17 callbacks suppressed [ 67.833261][ T1654] netlink: 112 bytes leftover after parsing attributes in process `syz.0.503'. [ 67.877682][ T1647] rust_binder: Error in use_page_slow: ESRCH [ 67.877704][ T1647] rust_binder: use_range failure ESRCH [ 67.888115][ T1647] rust_binder: Failed to allocate buffer. len:136, is_oneway:false [ 67.894096][ T1647] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 67.902056][ T1647] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:225 [ 67.912124][ T1656] netlink: 393 bytes leftover after parsing attributes in process `syz.0.504'. [ 67.945528][ T1641] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.952618][ T1641] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.960089][ T1641] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.967157][ T1641] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.007332][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.015168][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.035808][ T305] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.043107][ T305] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.057020][ T1661] netlink: 80 bytes leftover after parsing attributes in process `syz.0.505'. [ 68.059648][ T305] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.072974][ T305] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.091062][ T1641] veth0_vlan: entered promiscuous mode [ 68.108474][ T1663] netlink: 8 bytes leftover after parsing attributes in process `syz.0.506'. [ 68.114117][ T1641] veth1_macvtap: entered promiscuous mode [ 68.157620][ T36] audit: type=1400 audit(1750463475.679:283): avc: denied { mounton } for pid=1641 comm="syz-executor" path="/root/syzkaller.j8dCrE/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 68.217564][ T36] audit: type=1400 audit(1750463475.739:284): avc: denied { read } for pid=1668 comm="syz.4.497" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 68.217983][ T1672] netlink: 16 bytes leftover after parsing attributes in process `syz.0.509'. [ 68.312493][ T1681] netlink: 'syz.0.514': attribute type 4 has an invalid length. [ 68.325401][ T1683] kvm: kvm [1682]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc2) = 0xffffffffffff6253 [ 68.359751][ T1688] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 68.411762][ T1692] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:393 [ 68.413952][ T1693] netlink: 12 bytes leftover after parsing attributes in process `syz.1.516'. [ 68.511561][ T1708] netlink: 80 bytes leftover after parsing attributes in process `syz.4.524'. [ 68.546105][ T1712] input: syz0 as /devices/virtual/input/input7 [ 68.592936][ T1721] netlink: 8 bytes leftover after parsing attributes in process `syz.3.528'. [ 68.624566][ T1725] netlink: 76 bytes leftover after parsing attributes in process `syz.3.532'. [ 68.720034][ T1735] netlink: 16 bytes leftover after parsing attributes in process `syz.4.535'. [ 68.722570][ T36] audit: type=1400 audit(1750463476.249:285): avc: denied { ioctl } for pid=1736 comm="syz.1.536" path="socket:[11925]" dev="sockfs" ino=11925 ioctlcmd=0x8953 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 68.774882][ T1741] netlink: 'syz.1.539': attribute type 4 has an invalid length. [ 68.853282][ T1753] support for the xor transformation has been removed. [ 68.868068][ T1761] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 69.031365][ T1775] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 69.059049][ T1775] rust_binder: Write failure EINVAL in pid:265 [ 69.076704][ T1780] random: crng reseeded on system resumption [ 69.167312][ T1786] syz.4.556 uses obsolete (PF_INET,SOCK_PACKET) [ 69.216335][ T1794] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 69.263387][ T36] audit: type=1326 audit(1750463476.789:286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1799 comm="syz.4.563" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd70518e929 code=0x0 [ 69.280141][ T1805] netlink: 'syz.0.565': attribute type 4 has an invalid length. [ 69.334733][ T1817] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 69.387440][ T1827] binder: Bad value for 'max' [ 69.558628][ T1850] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 69.558951][ T1850] rust_binder: Error in use_page_slow: ESRCH [ 69.565552][ T1850] rust_binder: use_range failure ESRCH [ 69.571706][ T1850] rust_binder: Failed to allocate buffer. len:4224, is_oneway:false [ 69.577460][ T1850] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 69.585526][ T1850] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:424 [ 69.619604][ T1855] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 69.675456][ T1870] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 69.720983][ T1875] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 69.728577][ T1875] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 144, size: 255) [ 69.735866][ T1875] rust_binder: Error while translating object. [ 69.750021][ T1875] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 69.757372][ T1875] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:439 [ 69.768391][ T1876] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:78 [ 69.778663][ T1876] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:78 [ 69.830269][ T36] audit: type=1400 audit(1750463477.349:287): avc: denied { setopt } for pid=1884 comm="syz.0.594" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 69.964990][ T1902] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 69.966424][ T1902] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION freeze notification not active [ 69.981592][ T1902] rust_binder: Write failure EINVAL in pid:457 [ 70.066131][ T1913] binder: Bad value for 'max' [ 70.089407][ T1915] netlink: 'syz.0.608': attribute type 4 has an invalid length. [ 70.188222][ T1926] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 70.188604][ T1926] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 144, size: 255) [ 70.196434][ T1926] rust_binder: Error while translating object. [ 70.207146][ T1926] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 70.218130][ T1926] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:478 [ 70.237587][ T1929] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 70.248508][ T1929] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 70.255662][ T1929] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:471 [ 70.345690][ T36] audit: type=1400 audit(1750463477.869:288): avc: denied { mount } for pid=1945 comm="syz.3.621" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 70.377037][ T36] audit: type=1400 audit(1750463477.879:289): avc: denied { unmount } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 70.542353][ T9] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 70.691876][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 70.698108][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 70.709422][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 70.722325][ T9] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 70.731649][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 70.740359][ T9] usb 1-1: config 0 descriptor?? [ 71.121886][ T388] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 71.342022][ T388] usb 5-1: unable to get BOS descriptor or descriptor too short [ 71.350790][ T388] usb 5-1: no configurations [ 71.355852][ T388] usb 5-1: can't read configurations, error -22 [ 71.393881][ T304] bridge_slave_1: left allmulticast mode [ 71.399757][ T304] bridge_slave_1: left promiscuous mode [ 71.405687][ T304] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.414719][ T304] bridge_slave_0: left allmulticast mode [ 71.420778][ T304] bridge_slave_0: left promiscuous mode [ 71.427580][ T304] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.554499][ T304] tipc: Left network mode [ 71.560817][ T304] veth1_macvtap: left promiscuous mode [ 71.566854][ T304] veth0_vlan: left promiscuous mode [ 71.626182][ T1962] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.634077][ T1962] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.641624][ T1962] bridge_slave_0: entered allmulticast mode [ 71.648845][ T1962] bridge_slave_0: entered promiscuous mode [ 71.656074][ T1962] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.668072][ T1962] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.676613][ T1962] bridge_slave_1: entered allmulticast mode [ 71.684893][ T1962] bridge_slave_1: entered promiscuous mode [ 71.740448][ T1962] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.749582][ T1962] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.758146][ T1962] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.766906][ T1962] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.801281][ T305] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.810458][ T305] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.826062][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.835805][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.849617][ T305] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.859642][ T305] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.904166][ T1962] veth0_vlan: entered promiscuous mode [ 71.916465][ T1969] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 71.918555][ T1969] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 144, size: 255) [ 71.918650][ T1962] veth1_macvtap: entered promiscuous mode [ 71.942591][ T1969] rust_binder: Error while translating object. [ 71.944397][ T1969] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 71.951076][ T1969] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:88 [ 71.979139][ T36] audit: type=1400 audit(1750463479.499:290): avc: denied { wake_alarm } for pid=1970 comm="syz.4.632" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 71.982156][ T1971] SELinux: security_context_str_to_sid (syte) failed with errno=-22 [ 72.065158][ T1978] usb usb8: usbfs: process 1978 (syz.4.634) did not claim interface 0 before use [ 72.306910][ T1988] netlink: 'syz.4.639': attribute type 4 has an invalid length. [ 72.815317][ T36] audit: type=1400 audit(1750463480.339:291): avc: denied { create } for pid=2020 comm="syz.4.653" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 72.817003][ T2022] rust_binder: Write failure EFAULT in pid:138 [ 72.877430][ T2028] netlink: 'syz.4.656': attribute type 4 has an invalid length. [ 73.038844][ T2038] __nla_validate_parse: 30 callbacks suppressed [ 73.038865][ T2038] netlink: 12 bytes leftover after parsing attributes in process `syz.4.660'. [ 73.052976][ T2040] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 73.058943][ T2040] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:278 [ 73.100409][ T2048] netlink: 8 bytes leftover after parsing attributes in process `syz.4.664'. [ 73.131292][ T2050] netlink: 324 bytes leftover after parsing attributes in process `syz.1.665'. [ 73.311900][ T9] usb 1-1: string descriptor 0 read error: -71 [ 73.337268][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 73.356900][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 73.374482][ T9] usb 1-1: USB disconnect, device number 8 [ 73.431842][ T60] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 73.563062][ T2067] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.563471][ T2067] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 144, size: 255) [ 73.570030][ T2067] rust_binder: Error while translating object. [ 73.581340][ T2067] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 73.587885][ T60] usb 5-1: device descriptor read/64, error -71 [ 73.604216][ T2067] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:498 [ 73.635440][ T2069] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.646213][ T2069] rust_binder: Error while translating object. [ 73.653442][ T2069] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 73.660001][ T2069] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:500 [ 73.753094][ T2071] netlink: 76 bytes leftover after parsing attributes in process `syz.0.674'. [ 73.823779][ T2075] input: syz1 as /devices/virtual/input/input8 [ 73.851994][ T60] usb 5-1: device descriptor read/64, error -71 [ 74.010722][ T2085] netlink: 80 bytes leftover after parsing attributes in process `syz.0.679'. [ 74.055912][ T2089] netlink: 12 bytes leftover after parsing attributes in process `syz.1.682'. [ 74.065238][ T36] audit: type=1400 audit(1750463481.589:292): avc: denied { read write } for pid=2090 comm="syz.0.681" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 74.090375][ T2094] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 74.091439][ T2094] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:520 [ 74.102338][ T36] audit: type=1400 audit(1750463481.589:293): avc: denied { open } for pid=2090 comm="syz.0.681" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 74.103212][ T60] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 74.182432][ T2099] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 74.182916][ T2099] rust_binder: Error while translating object. [ 74.189390][ T2099] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 74.195902][ T2099] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:520 [ 74.271841][ T60] usb 5-1: device descriptor read/64, error -71 [ 74.293179][ T2108] netlink: 324 bytes leftover after parsing attributes in process `syz.1.688'. [ 74.343098][ T2112] netlink: 76 bytes leftover after parsing attributes in process `syz.1.690'. [ 74.372273][ T2114] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:310 [ 74.372519][ T2114] rust_binder: Error while translating object. [ 74.383209][ T2114] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 74.389685][ T2114] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:310 [ 74.401888][ T2115] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 74.448920][ T2121] netlink: 80 bytes leftover after parsing attributes in process `syz.1.693'. [ 74.496330][ T2123] netlink: 12 bytes leftover after parsing attributes in process `syz.1.694'. [ 74.541872][ T60] usb 5-1: device descriptor read/64, error -71 [ 74.640756][ T2129] binder: Bad value for 'max' [ 74.662012][ T60] usb usb5-port1: attempt power cycle [ 75.011837][ T60] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 75.033076][ T60] usb 5-1: device descriptor read/8, error -71 [ 75.101409][ T36] audit: type=1400 audit(1750463482.619:294): avc: denied { connect } for pid=2139 comm="syz.0.700" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 75.101722][ T2140] rust_kernel: panicked at rust/kernel/sync/poll.rs:54:18: [ 75.101722][ T2140] null pointer dereference occurred [ 75.134761][ T2140] ------------[ cut here ]------------ [ 75.140374][ T2140] kernel BUG at rust/helpers/bug.c:7! [ 75.147470][ T36] audit: type=1400 audit(1750463482.669:295): avc: denied { read } for pid=91 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 75.170837][ T2141] rust_binder: Error while translating object. [ 75.170888][ T2141] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 75.177942][ T2140] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI [ 75.194271][ T2140] CPU: 1 UID: 0 PID: 2140 Comm: syz.0.700 Not tainted 6.12.23-syzkaller-g6c1c18fcb8b7 #0 ba78288b1e32eb9f88d3f8d8da6b79a037cd8362 [ 75.207649][ T2140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 75.217796][ T2140] RIP: 0010:rust_helper_BUG+0x8/0x10 [ 75.223222][ T2140] Code: cc cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b8 c4 c5 0a 36 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 48 89 e5 <0f> 0b 66 0f 1f 44 00 00 b8 8e 01 43 ba 90 90 90 90 90 90 90 90 90 [ 75.243219][ T2140] RSP: 0018:ffffc9000eae71d0 EFLAGS: 00010246 [ 75.250859][ T2140] RAX: 000000000000005a RBX: 1ffff92001d5ce3c RCX: c0b8e9c69d9a9f00 [ 75.259376][ T2140] RDX: ffffc90001631000 RSI: 000000000007ffff RDI: 0000000000080000 [ 75.267893][ T2140] RBP: ffffc9000eae71d0 R08: ffff8881f6f294d3 R09: 1ffff1103ede529a [ 75.276069][ T2140] R10: dffffc0000000000 R11: ffffed103ede529b R12: 0000000000000000 [ 75.284059][ T2140] R13: dffffc0000000000 R14: ffffc9000eae7200 R15: ffffc9000eae7230 [ 75.291900][ T36] audit: type=1400 audit(1750463482.669:296): avc: denied { search } for pid=91 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 75.292052][ T2140] FS: 00007f9125a466c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 75.313639][ T36] audit: type=1400 audit(1750463482.669:297): avc: denied { write } for pid=91 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 75.322474][ T2140] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 75.322490][ T2140] CR2: 00007f9125a25d58 CR3: 0000000130eec000 CR4: 00000000003526b0 [ 75.322506][ T2140] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 75.322516][ T2140] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 75.371819][ T36] audit: type=1400 audit(1750463482.669:298): avc: denied { add_name } for pid=91 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 75.374196][ T2140] Call Trace: [ 75.374204][ T2140] [ 75.400942][ T2140] _RNvCscSpY9Juk0HT_7___rustc17rust_begin_unwind+0x15b/0x160 [ 75.408434][ T2140] ? __cfi__RNvCscSpY9Juk0HT_7___rustc17rust_begin_unwind+0x10/0x10 [ 75.411820][ T36] audit: type=1400 audit(1750463482.669:299): avc: denied { create } for pid=91 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 75.416426][ T2140] ? __cfi__RNvXs1b_NtCs9jEwPDbx20M_4core3fmtRNtNtNtB8_5panic10panic_info9PanicInfoNtB6_7Display3fmtCs43vyB533jt3_6kernel+0x10/0x10 [ 75.450516][ T2140] ? p9pdu_vwritef+0x2720/0x2720 [ 75.453237][ T36] audit: type=1400 audit(1750463482.669:300): avc: denied { append open } for pid=91 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 75.455480][ T2140] ? radix_tree_node_alloc+0x1af/0x400 [ 75.483745][ T2140] ? __cfi_p9pdu_vwritef+0x10/0x10 [ 75.488878][ T2140] ? p9pdu_vwritef+0x1c5e/0x2720 [ 75.493828][ T2140] _RNvNtCs9jEwPDbx20M_4core9panicking18panic_nounwind_fmt+0xec/0xf0 [ 75.501909][ T2140] ? __cfi__RNvNtCs9jEwPDbx20M_4core9panicking18panic_nounwind_fmt+0x10/0x10 [ 75.510683][ T2140] ? p9pdu_writef+0xdb/0x130 [ 75.515292][ T2140] ? p9pdu_vwritef+0x2720/0x2720 [ 75.520243][ T2140] _RNvNtCs9jEwPDbx20M_4core9panicking30panic_null_pointer_dereference+0x49/0x4c [ 75.529366][ T2140] _RNvMNtNtCs43vyB533jt3_6kernel4sync4pollNtB2_9PollTable8from_ptr+0x40/0x40 [ 75.538225][ T2140] ? _RNvCshgDM7dBCdno_11rust_binder16rust_binder_poll+0xce/0x570 [ 75.546046][ T2140] _RNvCshgDM7dBCdno_11rust_binder16rust_binder_poll+0xe2/0x570 [ 75.553702][ T2140] ? p9_client_prepare_req+0x732/0xa10 [ 75.559299][ T2140] ? __cfi__RNvCshgDM7dBCdno_11rust_binder16rust_binder_poll+0x10/0x10 [ 75.567594][ T2140] ? __kasan_check_write+0x18/0x20 [ 75.572769][ T2140] ? _raw_spin_lock+0x8c/0x120 [ 75.577579][ T2140] ? __cfi__raw_spin_lock+0x10/0x10 [ 75.582818][ T2140] ? __kasan_check_write+0x18/0x20 [ 75.587966][ T2140] ? _raw_spin_lock+0x8c/0x120 [ 75.592763][ T2140] ? __cfi__RNvCshgDM7dBCdno_11rust_binder16rust_binder_poll+0x10/0x10 [ 75.601026][ T2140] p9_fd_request+0x391/0x520 [ 75.605666][ T2140] p9_client_rpc+0x2f9/0xb40 [ 75.610291][ T2140] ? bt_sock_poll+0x477/0x7b0 [ 75.614993][ T2140] ? p9_fid_create+0x3d0/0x3d0 [ 75.619769][ T2140] ? __cfi_sock_poll+0x10/0x10 [ 75.624548][ T2140] ? p9_conn_create+0x4c9/0x570 [ 75.629427][ T2140] ? p9_fd_create+0x2f3/0x4c0 [ 75.634117][ T2140] p9_client_create+0x96a/0x1190 [ 75.639067][ T2140] ? __cfi_p9_client_create+0x10/0x10 [ 75.644446][ T2140] ? kasan_save_alloc_info+0x40/0x50 [ 75.649738][ T2140] ? __kasan_kmalloc+0x96/0xb0 [ 75.654525][ T2140] ? kstrdup+0x7b/0x140 [ 75.658719][ T2140] ? __kasan_check_write+0x18/0x20 [ 75.663846][ T2140] v9fs_session_init+0x1e1/0x1820 [ 75.668886][ T2140] ? __cfi_v9fs_session_init+0x10/0x10 [ 75.674385][ T2140] ? kasan_save_alloc_info+0x40/0x50 [ 75.679683][ T2140] ? __kasan_kmalloc+0x96/0xb0 [ 75.684460][ T2140] ? v9fs_mount+0xbd/0xa00 [ 75.688887][ T2140] v9fs_mount+0xd7/0xa00 [ 75.693156][ T2140] ? selinux_sb_eat_lsm_opts+0xa69/0xb40 [ 75.698820][ T2140] ? __cfi_v9fs_mount+0x10/0x10 [ 75.703711][ T2140] ? selinux_capable+0x38/0x50 [ 75.708493][ T2140] legacy_get_tree+0x103/0x1b0 [ 75.713380][ T2140] ? __cfi_v9fs_mount+0x10/0x10 [ 75.718266][ T2140] vfs_get_tree+0x9e/0x290 [ 75.722694][ T2140] do_new_mount+0x251/0xb40 [ 75.727209][ T2140] path_mount+0x688/0x1050 [ 75.731634][ T2140] ? putname+0x113/0x150 [ 75.735988][ T2140] __se_sys_mount+0x2bd/0x480 [ 75.740707][ T2140] ? __x64_sys_mount+0xf0/0xf0 [ 75.745494][ T2140] ? __kasan_check_write+0x18/0x20 [ 75.750617][ T2140] ? fpregs_restore_userregs+0x11d/0x260 [ 75.751872][ T2141] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:532 [ 75.756256][ T2140] __x64_sys_mount+0xc3/0xf0 [ 75.769934][ T2140] x64_sys_call+0x2021/0x2ee0 [ 75.774629][ T2140] do_syscall_64+0x58/0xf0 [ 75.779058][ T2140] ? clear_bhb_loop+0x35/0x90 [ 75.783744][ T2140] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 75.789652][ T2140] RIP: 0033:0x7f9124b8e929 [ 75.794081][ T2140] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 75.813699][ T2140] RSP: 002b:00007f9125a46038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 75.822127][ T2140] RAX: ffffffffffffffda RBX: 00007f9124db5fa0 RCX: 00007f9124b8e929 [ 75.830115][ T2140] RDX: 0000200000000080 RSI: 0000200000000300 RDI: 0000000000000000 [ 75.838191][ T2140] RBP: 00007f9124c10b39 R08: 0000200000000340 R09: 0000000000000000 [ 75.846181][ T2140] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 75.854177][ T2140] R13: 0000000000000000 R14: 00007f9124db5fa0 R15: 00007ffeb69b09b8 [ 75.862180][ T2140] [ 75.865460][ T2140] Modules linked in: [ 75.870001][ T2140] ---[ end trace 0000000000000000 ]--- [ 75.876252][ T60] usb 5-1: device descriptor read/8, error -71 [ 75.897151][ T2140] RIP: 0010:rust_helper_BUG+0x8/0x10 [ 75.902644][ T2140] Code: cc cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b8 c4 c5 0a 36 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 48 89 e5 <0f> 0b 66 0f 1f 44 00 00 b8 8e 01 43 ba 90 90 90 90 90 90 90 90 90 [ 75.922527][ T2140] RSP: 0018:ffffc9000eae71d0 EFLAGS: 00010246 [ 75.928780][ T2140] RAX: 000000000000005a RBX: 1ffff92001d5ce3c RCX: c0b8e9c69d9a9f00 [ 75.937007][ T2140] RDX: ffffc90001631000 RSI: 000000000007ffff RDI: 0000000000080000 [ 75.945109][ T2140] RBP: ffffc9000eae71d0 R08: ffff8881f6f294d3 R09: 1ffff1103ede529a [ 75.953270][ T2140] R10: dffffc0000000000 R11: ffffed103ede529b R12: 0000000000000000 [ 75.961354][ T2140] R13: dffffc0000000000 R14: ffffc9000eae7200 R15: ffffc9000eae7230 [ 75.969527][ T2140] FS: 00007f9125a466c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 75.979229][ T2140] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 75.986061][ T2140] CR2: 000000110c32f24d CR3: 0000000130eec000 CR4: 00000000003526b0 [ 75.994418][ T2140] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 76.008503][ T2140] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 76.016654][ T2140] Kernel panic - not syncing: Fatal exception [ 76.022863][ T2140] Kernel Offset: disabled [ 76.027188][ T2140] Rebooting in 86400 seconds..