last executing test programs: 56.605020913s ago: executing program 1 (id=41): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = syz_clone(0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0) fcntl$lock(r2, 0x25, &(0x7f0000002380)) preadv(r2, &(0x7f0000001e80)=[{&(0x7f0000000080)=""/4094, 0xffe}], 0x1, 0x33, 0x0) ptrace(0x10, r0) ptrace$setregset(0x4205, r0, 0x1, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415603, 0x3}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000006c0)={0x4, 0x0, &(0x7f0000000540)=[@enter_looper], 0x50, 0x0, &(0x7f0000000600)="8dcdbd6d42ccdb4d556e7c2df713f0976fa3babb5f759be053e97109c9075d28dd5945ae6cb4e4d7866fe0493fb5c9157fdee7247f8cbf6c4e75526dc08c3ae8609b8760a00535639755c0fd5010ceba"}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000001180)={'ip_vti0\x00', &(0x7f00000010c0)={'sit0\x00', 0x0, 0x1, 0x10, 0x101, 0x40, {{0x1d, 0x4, 0x0, 0x38, 0x74, 0x68, 0x0, 0x20, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x24}, {[@ra={0x94, 0x4}, @end, @timestamp_addr={0x44, 0x14, 0x98, 0x1, 0x9, [{@empty, 0x3}, {@private=0xa010102, 0x2}]}, @lsrr={0x83, 0x23, 0x7f, [@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010101, @private=0xa010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x43}, @dev={0xac, 0x14, 0x14, 0xd}]}, @timestamp={0x44, 0x20, 0x9d, 0x0, 0x2, [0x1, 0x7fff, 0x7, 0x1, 0xdaa, 0x7, 0x46]}, @ra={0x94, 0x4}]}}}}}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8500, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r7, &(0x7f00000002c0)=ANY=[@ANYBLOB="080086dd0001110004000000a60c6eec00be00442ffffe8000000000000000000000000000aaff02000000000000000000000000000104206558"], 0xfdef) r8 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r8, 0x4008ae89, &(0x7f0000000140)=ANY=[@ANYBLOB="010000000000000090000040"]) ioctl$sock_inet6_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f00000011c0)={@mcast1, 0x15, r4}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$INCFS_IOC_PERMIT_FILL(r1, 0x40046721, &(0x7f0000000000)={r1}) 56.484578513s ago: executing program 1 (id=42): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(0xffffffffffffffff, 0x40089413, &(0x7f0000000040)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0xe6683000) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)={0x5, 0x0, 0x0, {0x0, 0x2710}, {0x77359400}, {}, 0x2, @can={{}, 0x0, 0x2, 0x0, 0x0, "3fd31340e92c4bb8"}}, 0x48}, 0x300, 0x0, 0x0, 0x40040}, 0x24004801) futex(0x0, 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_usb_connect(0x2, 0x0, 0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0}) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x26) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000001f40)) 55.862811284s ago: executing program 1 (id=46): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000080)=0x4) 55.78523857s ago: executing program 1 (id=49): openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$FUSE_GETXATTR(r0, &(0x7f00000000c0)={0x18, 0xffffffffffffffda, 0x0, {0x8a}}, 0x18) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cpuinfo\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f00000020c0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) ioprio_get$pid(0x2, r2) getpid() gettid() r3 = getpid() mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) pipe2$9p(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) write$P9_RVERSION(r5, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) r6 = dup(r5) write$FUSE_BMAP(r6, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r6, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) write$FUSE_BMAP(r6, &(0x7f0000000180)={0x18, 0x0, 0x0, {0x9}}, 0x18) write$FUSE_GETXATTR(r6, &(0x7f0000000480)={0x18}, 0x9) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r4, @ANYBLOB=',wfdno=', @ANYRESHEX=r6]) r7 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x12, r7, 0x75e7f000) r8 = syz_pidfd_open(r3, 0x0) setns(r8, 0x24020000) r9 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r9, 0x10e, 0xc, &(0x7f0000000280)={0x4000, 0x2}, 0x10) sendmsg$netlink(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000002c0)=ANY=[@ANYRES32=r5], 0x78}], 0x1, 0x0, 0x0, 0x20404}, 0x0) mount_setattr(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x9800, &(0x7f0000001dc0)={0xf, 0x0, 0x100000}, 0x20) syz_clone(0x1000000, 0x0, 0xfffffd11, 0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') pread64(0xffffffffffffffff, 0x0, 0x0, 0x4) 55.709097085s ago: executing program 1 (id=53): openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) futex(0xfffffffffffffffc, 0x3, 0x0, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000240)={0x60003, 0x0, [0x6, 0x4, 0x401, 0x404, 0x100, 0x6, 0x0, 0x81]}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r3, 0x0, 0x3, &(0x7f0000000000)=0x4, 0x4) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000001c0)=[@text64={0x40, &(0x7f0000000100)="660fc7b5f3ffffff0fc73f47c44111f5c10c0cb8ab000f00d00f01cb66470fc7b60400000048b88bc00000000000000f23d80f21f835800000c00f23f848b8af890000000000000f23d00f21f835100000020f23218d8db86d2c6d2cfe6f1e", 0x5f}], 0x1, 0x21, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0x9, &(0x7f00000002c0)=0x8004004c, 0x4) ioctl$KVM_CAP_HYPERV_SYNIC(r2, 0x4068aea3, &(0x7f0000000300)) ioctl$F2FS_IOC_DECOMPRESS_FILE(r0, 0xf517, 0x0) mount(0x0, 0x0, 0x0, 0x200000, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89101) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000000)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r5, @ANYBLOB="05"], 0x0) mprotect(&(0x7f0000ff1000/0x2000)=nil, 0x2000, 0x3000000) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') read$eventfd(r6, &(0x7f0000000080), 0x8) stat(&(0x7f0000000280)='./file0/../file0\x00', &(0x7f00000000c0)) 55.561176316s ago: executing program 1 (id=58): clock_gettime(0xfffffffffffffff1, 0x0) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f0000000540)='\x00\x00\x03\x06\x00\x00\x00\x1f\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\x87\xa3\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe9\xb3\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Hd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9\xff\x03\x00\x00<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xea\x98\x97\xbe\xe2!\f?s\xff\xfb\x89\xb5\xd9\xe9\x93\xbb\x05:\xcf\xb1(x;\'%\xf0\xe4\xf6\x9e\xde8\xcf\v\x12aR\xf1\x1f\xfb\xa1\xeb\x06\xf3\x17\x15[\xbbd\xab\xe5\x01\xf6^@n\xe4\x87\xbc\xf5\xd6\xfd4s\x1fG\xba$\x15x\x95\xc5\x8c\xe6\x1f\xec\xea\x0e\xaf\xc0\x7fg\x11tkC\xd0\xa2\x8b\xb3\x1e\xf5q|h\x12\xc8\x1bQ\xfd\xc79\xa8\x83\xda8\x16\xa8\x8e\x98\xdb\xadN\xc2\x15w\xf5ij\x1dx\xcf\xdd\x1c\x18\xbfs\x88\xc7\x9a\xcbv?\xd0l\xa5\x1b\xd3\xf7\xa0\xf0\xb6\xe44W2A') 55.548588438s ago: executing program 32 (id=58): clock_gettime(0xfffffffffffffff1, 0x0) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f0000000540)='\x00\x00\x03\x06\x00\x00\x00\x1f\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\x87\xa3\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe9\xb3\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Hd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9\xff\x03\x00\x00<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xea\x98\x97\xbe\xe2!\f?s\xff\xfb\x89\xb5\xd9\xe9\x93\xbb\x05:\xcf\xb1(x;\'%\xf0\xe4\xf6\x9e\xde8\xcf\v\x12aR\xf1\x1f\xfb\xa1\xeb\x06\xf3\x17\x15[\xbbd\xab\xe5\x01\xf6^@n\xe4\x87\xbc\xf5\xd6\xfd4s\x1fG\xba$\x15x\x95\xc5\x8c\xe6\x1f\xec\xea\x0e\xaf\xc0\x7fg\x11tkC\xd0\xa2\x8b\xb3\x1e\xf5q|h\x12\xc8\x1bQ\xfd\xc79\xa8\x83\xda8\x16\xa8\x8e\x98\xdb\xadN\xc2\x15w\xf5ij\x1dx\xcf\xdd\x1c\x18\xbfs\x88\xc7\x9a\xcbv?\xd0l\xa5\x1b\xd3\xf7\xa0\xf0\xb6\xe44W2A') 2.74087308s ago: executing program 3 (id=880): openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x300, 0x0) sendmsg$netlink(0xffffffffffffffff, 0x0, 0xc0080) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, 0x0) socket$can_raw(0x1d, 0x3, 0x1) (async) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_RECV_OWN_MSGS(r1, 0x65, 0x8, 0x0, 0x0) (async) setsockopt$CAN_RAW_RECV_OWN_MSGS(r1, 0x65, 0x8, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) (async) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r3, 0x11, 0x8, 0x0, &(0x7f0000000680)) r4 = syz_open_dev$loop(&(0x7f0000000300), 0x3f877817, 0x2f82) syz_open_dev$loop(&(0x7f0000000000), 0x1, 0x8000) (async) r5 = syz_open_dev$loop(&(0x7f0000000000), 0x1, 0x8000) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f00000001c0)={r4, 0x0, {0x2a00, 0x80010000, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x14, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea80000000000000000000000deff0000000000000000000000000000000800", "2809e8dbe108038948224ad54afac11d875397bdb22d0000b420a1a93c7540f4767f9e01177d3dd40600000061ac00", "90be8b1c55f96400", [0x800]}}) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r6 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x1) r7 = openat$rnullb(0xffffffffffffff9c, 0x0, 0x20002, 0x0) ioctl$TIOCGRS485(r2, 0x542e, &(0x7f0000000100)) (async) ioctl$TIOCGRS485(r2, 0x542e, &(0x7f0000000100)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x11, r7, 0x45809000) r8 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_control_io$hid(r8, 0x0, 0x0) (async) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_control_io$hid(r8, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYRES32=r4], 0x0}, 0x0) r9 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r9, 0x10f, 0x87, &(0x7f0000000100)={0x41, 0x0, 0x2}, 0x1be) bind$tipc(r9, 0x0, 0x0) sendmsg$tipc(r9, &(0x7f0000000180)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10, 0x0}, 0x0) (async) sendmsg$tipc(r9, &(0x7f0000000180)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10, 0x0}, 0x0) syz_usb_control_io$hid(r8, 0x0, &(0x7f0000000640)={0x2c, &(0x7f0000000340)=ANY=[@ANYBLOB="2015760000005607c9347e738348dcbe58ef85b97cd985b575e0deecb52b8ed7775ef1dbe3bcda5e73f24a73d05914e7064ecccc21f767ea26837094c84039086c8a555bf0688ed2460c2dc3f16bb87ef43cfa6b5ea2cda30eb500ce849efe30ca7a83f46ce492ab4c14df0bd4ec3d5941cc6cbd779c069ec433a78ec044451cecf3cb1a9c3bbe0a342dba1f462b83c6bb0aadd7607d30f97fca45258937038198a834289aad4b87ca960718cb82f42bbf68f50f097c878f931f1f97c886eb99558b808ea0eeb1ce6bd0c3e00a17f6e9d752300952f15aff59c069b9112d158e3a00000000e502df8930731f081e4ba947a280c38e54a6160f75b2470d00fcffffffffffffb8f2eddc1effc474801e416319d6042f02e44a78b49c467d945cd1fc3b1d090d7e9298bca054d99b2280d1630ca50f2c756fe1cedb58ed8baa6e417720f1725b7bdc3d423d01626822284145356860d1c4fdf7b73a7a35b17c9d9b29402fc634ef8938107b189e58d7d4775772295be096e4b26e5283cc59ae748c38c4c8c49545e1c030ec257b58a02ad307299c3ec205f68cfe25c79d0b110bf29e87025977c6791ac60fb18c28916299a2ccd4a67f5abe386792f65f272a97b4987f291e9ab3e57459daa4eef21b96209d98c1a544777eff0ae3f289e4a1107f4896ea3eedc5"], &(0x7f0000000580)={0x0, 0xa, 0x1, 0x9}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x4}, 0x0, &(0x7f0000000140)={0x20, 0x3, 0x1, 0x28}}) (async) syz_usb_control_io$hid(r8, 0x0, &(0x7f0000000640)={0x2c, &(0x7f0000000340)=ANY=[@ANYBLOB="2015760000005607c9347e738348dcbe58ef85b97cd985b575e0deecb52b8ed7775ef1dbe3bcda5e73f24a73d05914e7064ecccc21f767ea26837094c84039086c8a555bf0688ed2460c2dc3f16bb87ef43cfa6b5ea2cda30eb500ce849efe30ca7a83f46ce492ab4c14df0bd4ec3d5941cc6cbd779c069ec433a78ec044451cecf3cb1a9c3bbe0a342dba1f462b83c6bb0aadd7607d30f97fca45258937038198a834289aad4b87ca960718cb82f42bbf68f50f097c878f931f1f97c886eb99558b808ea0eeb1ce6bd0c3e00a17f6e9d752300952f15aff59c069b9112d158e3a00000000e502df8930731f081e4ba947a280c38e54a6160f75b2470d00fcffffffffffffb8f2eddc1effc474801e416319d6042f02e44a78b49c467d945cd1fc3b1d090d7e9298bca054d99b2280d1630ca50f2c756fe1cedb58ed8baa6e417720f1725b7bdc3d423d01626822284145356860d1c4fdf7b73a7a35b17c9d9b29402fc634ef8938107b189e58d7d4775772295be096e4b26e5283cc59ae748c38c4c8c49545e1c030ec257b58a02ad307299c3ec205f68cfe25c79d0b110bf29e87025977c6791ac60fb18c28916299a2ccd4a67f5abe386792f65f272a97b4987f291e9ab3e57459daa4eef21b96209d98c1a544777eff0ae3f289e4a1107f4896ea3eedc5"], &(0x7f0000000580)={0x0, 0xa, 0x1, 0x9}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x4}, 0x0, &(0x7f0000000140)={0x20, 0x3, 0x1, 0x28}}) ioctl$TCXONC(r2, 0x540a, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 2.223901941s ago: executing program 3 (id=893): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x54, 0x1, 0x400, 0x0, {0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x4c504}, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'ip_vti0\x00', 0x0}) (async) r3 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, &(0x7f0000000040)=0x48c2, 0x4) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000080)=0x2, 0x4) (async, rerun: 32) sendmsg$can_raw(r3, &(0x7f0000000300)={&(0x7f0000000800)={0x1d, r2}, 0x10, &(0x7f0000000880)={&(0x7f0000000840)=@can={{}, 0x0, 0x0, 0x0, 0x0, "ded27feeba7ca62a"}, 0x10}}, 0x0) (async, rerun: 32) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r4, 0x4008af60, &(0x7f0000000040)={@my=0x1}) (async) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32) sendmsg$IPCTNL_MSG_EXP_GET(r5, &(0x7f0000006680)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x50, 0x1, 0x2, 0x11e79709bd51445, 0x0, 0x0, {0xa, 0x0, 0x2}, [@CTA_EXPECT_MASTER={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, {0x14, 0x4, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}]}, 0x50}}, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) (async) r7 = socket$netlink(0x10, 0x3, 0x0) writev(r7, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff0600000001000000450000002500000019000d000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r6, 0x0) (async) r8 = socket(0x28, 0x5, 0x0) pidfd_getfd(r6, r8, 0x0) (async) r9 = socket$inet6(0xa, 0x2, 0x0) (async) r10 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r10, 0x8946, &(0x7f0000000380)={'team_slave_0\x00', &(0x7f0000000080)=@ethtool_rxnfc={0x32, 0x11, 0x1, {0xa, @udp_ip4_spec={@multicast1, @multicast1, 0x4e21, 0x4e22, 0x5d}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x5, 0xfb44, [0x5, 0x9]}, @esp_ip4_spec={@local, @private=0xa010100, 0x9}, {0x0, @broadcast, 0x46, 0x3ff, [0x2]}, 0x4, 0x2}}}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r9, 0x29, 0x20, &(0x7f0000000780)={@private0={0xfc, 0x0, '\x00', 0x1}, 0x1800, 0x0, 0x2, 0x1}, 0x20) connect$vsock_stream(r8, &(0x7f0000000100)={0x28, 0x0, 0x0, @my=0x1}, 0x57) syz_usb_connect(0x0, 0x3d, 0x0, 0x0) mount$binderfs(0x0, &(0x7f0000000280)='./binderfs\x00', 0x0, 0x888, &(0x7f0000000040)={[{@stats}]}) 1.660479986s ago: executing program 3 (id=920): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) socket$netlink(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1000, 0x0) r1 = gettid() rt_tgsigqueueinfo(0x0, r1, 0x7, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000180), 0x204, 0x2581) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x5b0) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0xf9, 0x14, 0x0, 0x0, 0x7995}, 0x8, 0x0, 0x0, 0x48000000, 0x0, 0x40000000, 0x0}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000009, 0x32, 0xffffffffffffffff, 0x3000) ioctl$USBDEVFS_REAPURBNDELAY(r2, 0x4004550c, 0x0) r4 = inotify_init() ioctl$INOTIFY_IOC_SETNEXTWD(r4, 0x40044900, 0x2) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000200)={0x10201, 0x6, 0xffff1000, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x50, 0x0, &(0x7f0000000580)="c6547e22bade76f1a03b79e954ee20b943f7fe47218a02ff8ba942478a7b6946e9a6000055002cc15e854564e7d309f20d222f9220c8d9b1b0d196137252587ab1794808000000000000000e647c2e70"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@weak_binder={0x77622a85, 0x10a, 0x3}, @fda={0x66646185, 0x8, 0x2, 0x2d}, @fda={0x66646185, 0x2, 0x2, 0x3}}, &(0x7f0000000000)={0x0, 0x18, 0x38}}, 0x400}], 0x0, 0x0, 0x0}) 1.61724622s ago: executing program 3 (id=922): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r1, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file0\x00', 0x1c0) read$FUSE(r1, &(0x7f0000008180)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000180)={0x50, 0x0, r2, {0x7, 0x27}}, 0x50) syz_fuse_handle_req(r1, &(0x7f0000004140)="c98bb9a2a79e72fbca051478fe6e24cbeab04e730a86fef02db30a01d33d07efbac36f4e0e786aa540e01cc4ec64adbac57f750e7b0b749206bb7fc70de5cbcd7bf78bdb59c1095a03ef60a8d22a4e0dcea0aa96c523a2c7f666f1ac51acec733c589f2ab3ca2c8e129a652d7ec8ce120c530ca4fad46123b30cb061fb9998ff71ed9844b1f49f8b8e30e887ecd82a0f44450a325720e5b5065ae543bad2cef4486d5759515a29f048b21b3c78e9a95913a9df61bc854512fc21a6d0376742532ad21cf3b18c7f70b25345a81ede616baf89824f817fb808ea9ca55ac0ecdb91687f27177bbf1f1cdb2321efa1366e8287587ec7f39237537c625c813feae6cffdcb4c829e5ac0bda5c1b746edeb78bc7e1c198ae04f319f0fe41f24c7cbc7c0e3278a349bbf7c804dd729114792d4f81f19f49b2c018e49f43e72eaf5fd4c0ae32f73c0106c2b202152cdb28b21cf2132c6f9c7c583114d7790d397177165952670ccbfc0f4eff26391e8f4faca3536a070470e76d26625a6ec4df17b0fb0923fc31dfc1606f6a9cadaf4718d681d2351ddd138df20ff419c67f684d0d13792c78bfa348e5d76f00503124114034f41283e15ddbe79d5f4e200d5f28ada106334eca95a37fa843aa23236ef3d8aff07df194e8c4396561132379a60c449c5f1b400d2709d5c5f1ee1542790d5843e35f11be0ca4e7caa32c8329320069daea18ab51fad9ae4080d79671d73242278044391b9187eb0c05bbfef7d51bf64275f64ce780b25b509741c695f9e396234e3a67bc6988f05f6ad547371709e50b599179f7fc3def57115b58be578feb01612126bf5d1f08091743b76cd9cac032998adeb68a066387edb528b08d2063c3c504574e3d64ebee51da66e92bc3201baf0fa10bf5686e077a606c2b03a5529c97612b5d299078b99fc644aa101565836991bdcb92afae97b0330fc10c9af1edf05337221c05731246d57f7b063ee01778b99c768c8a8eb07e88f472d53bb59ec1db64191a32e981d384653943289d58970f4785d0081e321e5411bbe8738ee580a36be332a9082126579c797e162a37987a348743225786cf2e4e46f0c0ab0f7c14a6a16dc33e0f7042f203855db6776a3d760846ba5fd2173af04989b2f21cfd7e9e61df98adebef311c1c31f8b14f49c63ce924258af21d2d1766313a60dd23cf1966772551649ed78110d2462e47f14de5eed932bb03d3635f3bcbb8824bfa8b5c77649f097d78ec071b0d09dcdfc2078d0a97f96cb3e32f4cf80da4e07fad909eeabeb5715296ce578ada637a133ada68676e30632acba4f32fd2d23267a685f14a47fad0b36f2940494283a15b30576ff31e2b4472388fe3fecaa2e243818fce1d5de9a0e10aed4dc38a8636bec2ce0d43da7aa2541e8123bc4229ba6f9db4ec6b03c208125be4c389f8e587081209531f3c187077318698b08ace5b1e5a1c5b82633abfb6c4ef2bad7f9e61a142caef3c44dd6b81a9937650f75dfdb6f56bc26edc801fb0f53aa49655ce5f51283d8bb56ba56e9fc9f48395299a4ca4ae5b74398e1be02e2ea0565976ab155ae5df2114301565e23c25595853247dae9c2a598776c44ec0cfc26b3447c20b08424762dd29bfff90cf3f71f0fe933d1b1a29c3f6839858c7993a666401e2a03a1117988b28ae1c82adef8caf1ab564eb445199b57666397a7e7301ccfa9304dbf2854c8b50ab72ce6887e9cd69a647766f87a59d580a19964c9f691fb1eabe8143228bb375cbf12b5167085168ed22de2fee1b26d44324321a632b43d1b7bd13f15b807f1ab259b8456ba5d014fad3876b492b7f14af2ac75cb0f19eef7ad5c3d7f692d81ce1eb3e3fb96200d9253d338cb6d4097f3e6f4f061edcc98994b694b64ce1a266eac23e0506e68d09e4a3d0049420be6e73d684f7566e01bb43c1d51ed2e2c76be592bf4c6cf7471a21ba817f8c708ed76e14d6352e28deb6199bd7ec1232a041c6a655fbc01be4f749def876e0a94275c79bded1eb5bb3f9bfe286e14702e81c0e8a65f4b0a0a7ae62cfd4093a7e0fb07a02ab6a2f005ef538fd56392a3072f8317a1cedcdaecd857cef0f574efca11a6a28fbaa6fa2f6d74676197dec824d96b4ce0cc5999766b4926a6c21e21d4a78f71e87e9a8f1e2c4e3005da888457957377defd70d82fe26041f5399f295d869eb65c8e185a4f853c64603decb3c499a6921534730afbc41c1be57539603f0c1bdc2f61b8d7cfc971fe3fff189faae8411928dc039cb1ee33404544992a7f5646efd1e12d890ef7290ecc5e957a35cc6defb180b8006f8c016621bf17a6546022b9c579e781a66e57bc30d4c5ec8c56c42efce79bb8f203cb3c08133be710f2061879b90905671b346aaf735f2a614e7e46755d35570754e365490e2658090f40c2cb9164b0a1742b3bda5a32a4ebe25166c4ec0b387538362e7998092b1b737370239ef58f1f68f80753146ca2c166119fae83b2c60a19a1461903341d315d5ef8c57473bfd995964dc7b73ca7d35e88589cc7766480c9829ce44af423dcbef90b1ec62d8da8d812ad001e8e67df683dcb9de40db531e9eab3ca59b84689453b40f7df2b04051a6f052f179df5989bcb2e9245d23dee5d9b9ee03ee1ca0cef1b843acf0eb8dacd69047f5afda11b2a7ce274279c8b8a5da4618580f14d6c80bf1a647c90d2ef66395da4a0284427227ed59cc010088f39c12af4fb420683803db81f5ed467508b4e34886ce1550d7e9e29f9c92872d50566726af8b66b10498ce695ebc41573bc9100b6373c53cec7696bb79260d8214390d453d3223b9261c49fca17cf9923d7d1f3ac3abb332f37ddd9d0e09fb4df9305e88fc11f00ca1ddfce8dcc386e05a517c9b42d74629ff2460557107e7d39c0c1938e5b5f1da2dbffb30e3eb77c53d459580077eefb5260d59ad9fba11a66ffa703a3750d5979850acd8644de3c23a5514b4ba922dc20f5911b0d5078a1704f4016c84e39719c280db3ad2cd5f0693c8da07969c239608067fa82aba83d9a3a0f5f3e1f845a27bae1d8708d82eb10c7c205c07234b6e71312d54e878b960c821fd2dd01685143ffad375598dfd10038002a0d9aeceec499669523fb865683cb9379229761ac546e700a26523769ff1432d00073eb387e393d674eeb33a17422b3c0cedd91b3f0802ee59f1307467900c0a919bfaf92578fc18765cfc29cee13da07e821cc26354f5793d9e507cf13fdb55befeb814f4863552cc22440c3e80a61d7db867d72dfb41196bcc020f265fc9beec0004afff442c4a01a772db48a02d2f109a2096ec6d0f938cf8bc0835e07fa180f17cebf8a25b950380be955c4eb6a4f7fc6543a7eee578f800f5137069d08cd04f50cd02580aa7b249156baecd972eb6d8d9ff7598b85c0b0395016ade7107dcc8663c265857fbd7e42b3d4fb7a8c5f58b8befb22530ab47add8ca50611b23770d39a041c7291f30a92873d6c9f193f0bd8a7dc0949d435a3dbd554bf884bee76c3b28b2836e297a7b2dd940e6199b3c14ddf6bf7989eb9f721da9adbd2c754e91304b431c61deff5a7a24107a4f5bbeb1f422fcf10af1f5bcd204deb239c47e93d2f4ac55f4920bb4cbb0c358567ae115bfbcbdb2ff940f0d897fd54e9c198142e5445dc4a6ca4f794e26382394f6f11fc93acc4930cdb6fb39b04867eae0dad3cd2414ca0a1d9d8836a54894697bc3710e1ec9f58b28588a7108e6d8ea098c3e26646818345680dfd4812f89a2b632d2197e8d0d88fe932a1e52a1345d9e9d968e000ccf3658162ca9f50beb08b858a26ffe9cc320bc49cba66582647c5358234d9b38d3e605a2c1c4ddce61dd90070e26fc211d01fbec9fbfcc4cb0c1882014438284303cc80dee1760f631fc66a72d0eb6c6d01a7701a92c2a45613000ce87734f37ecce7774083b8e71dfba4a455516447b4dffe7288d578a37908ce0256d70d07c936a5d21ae223a3197f9cbede4ae983b9356a7073f2b6ba2068556721fd9379041897472c237a0c2007aa8f75a6e145c60a2f0cb7ffda5b6443e2682ec08eea3c851a72aa31508a186185962e79620791a3337abfdf527e513ea287a7b95f2a50f58575aac96af999ce667b1e415545fb931a02282eefad0e9489ec6478218b2a9478aa6060566f2ce636e28ce3d7a6d0c62c340c224efe58b8c99b9d59e6890e858244cf85102a44909645fcd66f57a1e4cde0697e53547aefeadef57db39543bc4b444f1fb5e99d3df8860fa13b91b3c9c47cba2ef823f7739d93f1d59251f2ecbe25b2cd67be1fe37359c5a673564688806154cd28bff8cf321578ef5580b945d208050f13e4429247dadbfeb417519d6b48aeef36e32c656d138191d612b99bcd11225187c41cba1b17b401698a12a3d28f6807be56dee75b93a27a5a120ce4fa25b45a41e2ff5affcd8771ef5efaeba4763fca7f3cadb4a96fd45dc42767dac4efc77aec8803b9edb4e2a3843a5a4936754d42c6bfe35a677aa972873190683712960a9172e75d039ae8f724e51f3770e85efb65dceedbf3e41f5e25244771a004b77777d745ef7401ab7f4586e2c10b0bece0137db9e5285a27621cf0dbe74ddbdeb2904beea55318ff8d65836dd2a57ee5354ac92e7727d2efefa10885184a2647597fb6d482f928baf0be5f83feb05be019268d05e419f58e9e590094a7e3ad7da2aa0fdcd2cfa2f7e7b26750d9049c0402d3def15b15491e1326f71a1d1e4a2a24ff9902f2d0e0e36cfd4314610be7a4e5f6ded81cc6048ee9f4e857f91a131220eedb51838cb1e406c20ef20a5783fb2cfdbaebce5d56a59579b994a0bebf58626e98bc4a7387b9bee07d5dd14a38e27d350cf159200fb2761d8953f1906298c74ee6c78deadd208bb84d3bc074ef127166f6b6c9c6315a76e2606a3aa91b19ae867e3e7372225d8266b6c87aec5fe40af5c816e7771cba0ba9957b6736b6d556daac4c1f60479c7ca81783f6e97509ce609ee07891b79020199018e67c05de3ba577af655ab3b5c79672cfb14c57499558d76f9e1e9681a07acde5064380e0f0446b1e9c2a15cbfdf5fae562884c2bd1f724fec6b0c520aa7df5239c1d54bcbaeb711be9e224eb5aa5dac0df99d8782248f70d9f86c1b576bef030d386beb50ca315c14b768baa013f3b70d85b6fe13bdfe7aa839804a139877c54c5135c920e11404d33a8385559acca5600e96cae8f459bfe295df4198fd19a192ae26c8a694151c70d70d5101b002f2c2580f969571d2cce22218d577b9ec43136e6284953546650b5974da34ad5dd4b0fb1e8e699eb3333e7e3477f21aacd908c69b4d9d092f881039c59c03f4503dfb1dc84f89c16be07b39a0aba23ad387fbb0980809b4147fce3127aaeb40638c889ceda0144189352a3497912daebdde46fb603cec06d9dc6e49fc916c7265c8ef0122f60f46dfd5047f75178e8eed1e2323e67ffbb1de6ca51dfb052862eebc8c81a038906831ae942bbd1148c632af20a06e032f7d91d7a07c740b174d641eee12e66d8db9aa9fadb4004290302d4e35485d9118b4abbb97a2690ec53a1d8555861185f66ec039c627dc74b7b51c7e7754a1391ae29488dce09416116d3e5fb2511865181471a6e8d11febe050358294738931a58326faf5ad405941a8a90cf88b9e155470e4034ad0c3de21c03697d09ce094b5532a77ea66f9c05609f079edac54b310fdd8452a2134ecfddc899f57014754b4783dd4cf190bb957271e9f9f4aa1bf1e792f711c2156cf09015707371a4e88987c25707c5c5a7fc7891b358d1ce9b0ec38983853d0059d5bf5da2c4c5a7e8863ba0b91cb18e94ce20ff72c7cba848355f5afd5e5c086fd16c1647d145cef93f2e7e337f43f67198abff32dc3e624f768ace48bb989e49e02b42bb4831610f561c47b84624f00c011ffee7376ca0b0aa09b048826a40463a6949c47473ac1d524bd808ec7e876822f15512a6814dc335daa536e7148fbfb8200603b882e4c693f5960965e419bb00fe41743084b619cefa3fddf2485e753f1b96de55e3e54cef66885c73dde661978fe65a6966767c9991f030d1dc9b882cd6fbb83181474fb57360a591c2782369d00df5be76697dcc697351006d7fe8363437a220df1cf36f464de3ada90fb8b6c56d607f245a8a8175bbf63fea0c45c8a6462140c285a86ca0bc0b872297c0981bc33c53a0499f849cf9a86db6bb48b87b597f2dd04b29e376a757e070d6b724d7a4ded0a01fd03e58c2d1d7c9bd084c8388e3a193423010e328952c5a62b4100788d1ac5b61c203c31997003d7669f4eff0e01a75d3a06cc7ef7b9a621a93cc6954118d8f7736245665c24ba84f9bf5851c481cac617fbb0ff71f3eaf5441348e61f5e4e7e8bca22d9e91e4a6e843bf02d324c8b55ec8a519b6f95818d84ac9e0f4ec36b7fb44b3db6924bef1a431dde856cecfb479072bc2d97efedb1dfd9fffbcf6dd430899d0fd8dcf33a2c137296d28373cf70984d6ffd823abd4721303c0c4072bd9c0723b7e868290b9e6f2d5b92feb6a4d2ea5dfb31c3a9cae8611a567ade5fc050eb7b74a240ead9a70679e61b4b8ac671695e70879459afd7151bb29655274d7ec3d10766eb919f5dcc648394717507588a95800b0c9969c70b981dd37e1b5702f50f49a67aed32db437746da94c965344e7fda47d36488fd24489f462b8abc2bd08ffc7c54dd7a2d1ebffe3b126565b89b764a289e505411ae846f5b8f9877ffcd70a8a57b3b7dcf8356d774aaa2746f63fd8e9e5e4b6d5b2ea62bdea0a90696608d156623863985f13b312a56960e3d5cd908ce456a2465ac72232fafd4f1c779b8e6707f3b34c5dc1356ae159bcf311d77e15dccb6c094ab12e999e1aea1026afd8c3dafa5f761a7e82bc139951e1cac736d0e3ed163837b3e8a120df674355c32a17efb6d126beda38ac57722f16e5e2ff5a5979b219e6a886f3cb853291cb5c835d591b6229ae938cb59ac73caaff0a1e13f6efb4a3e1385fc8fe77a33a189cf1b1a5eed06bee4d5237aafdede0f3c883f64ceaed04d88ac0e3738f89f7eba17fa71ea5bdad5af6c2a3c281c6762cc70f277361aec24a666ccfd95a8cc9af0dbb331f840e1990083cf648f7068808f903f281e6222d3ea6da539d047f6309d2d0c0d1fc9b7e2b2b7d082432f8d819f923f54e2ffff2e1504c3f7b17a9b19c32bed9ef376fe6d0d0647f9be85c617eacc82cf9ec9a9c901cc4088fa90e1abbb6f1340e34e4445313922286d5d1e655da8b42e799eb04a8f766d88ae24dcbe9f589104ee2c83335d6b3a498fd236fdd26c1b8e72258925de84861e3946a389bbce2d87e044d242ce9684afaf75ff20306db09dfead4481c844dbba005146a50dfbe3b4d939d3bb587a00daefb7db1f1cfe616c0528941d28cae06f057650475dad0fd3be6e85f5693b32636e8677634fb17ed60379b9a74a22f0abb12f74f2084c8bff00afd1e7ccc43a3b08ecabc1aa4a722e1f3b1c2510476e643df4b4a6f069e8029c975f471c89a3c0c49c63c6c0899950ea89f6d692a0f2e2e7a8e828f7e9cadda537119db284505380296a689a7bc168da713671c3d47af2ac32e53a05796ae11afc14d87f2daae13201275228d0d536d72cd43580726378be6b9a7b4e56670998adf46cbcb2a61d5daffc57acbc682d1e1716409527db61a11bf2d0b6b8ec8ac9a6fb553935329ba9f877b1019d1bea3ea0e98d65b830765e50786a2dc0600000061efc79e406155f2e6df3187b0a22864cbd5ee9d29c0ed153fd2751ce7d6cc9178481c0a3806791f6e4be674352a76eeffcf07dc867fac687933d2b7597008c2614a2e0157cad1f7bcf75a3e98bfafa4addf57db94421b54c8e3580c554c11b15e9f10a33c21e430bf3e13f3fcea6b17ce4d7f32ac0ecc9540b1deebb0b73bcb56f9632cced1b0f5f1ba4a9fa5100e8916bb7f47f71e5fc4cc46b344dadc9a9bc1a470583490a6304b374da44a179533dc00f3614678b292841b47f34dde4f08f0f86fd50f4a6984bed2a1d8dbb49f987dc196180aa6797f8b9cf739a5b6b940c841346ed2189f76733ddad49787b44737ffd2179ce2d3c9b94332014ee0f3882f62ab697d09dd37cb5d602e1fb24fef4309e72e76cb43a2bdcfd5ba97ff84f19801aba142c1be10851cf937d4cef92423d630646b1c9ae3580907c84db42ec4132cb9702781760c5a7d3aadc0395bdd0b7dce7bbdf8cfe6610dd7187ae6534cdf6267f8e9423e9805bab23e22169f9af3312cbea92d784a343419e4f038d1547625e13258e2f7330c75adf5d810efd666ca9b93368ae3a745113f125f961a0ca79287c3eba8ac2a81e7ea5b66bbd04b5e12a9e73f776ff17bbb3deb2473e10a284ec98e9e52c178cff024e1885b86ef7559227e033ec4f8074e513d85b50810b158e9dc1d42a810251443b44f325dcca8e47f7b1dfcdccdca14947083a9377694bef2acc5af03e63edcd03f54bb53c0cb8769d1a009f096de7f43c79eb83d2f360fd5118f4ca54367389b9b3c68e0f655a25328585cd27d3d908787ff816968da7769838e26bb215e6823d987f09f3d5cea873c788d667e92fd590463c579bcccd21b0edc12eab5c6939487baa24a1e22ceff90b9d6587d6b7bd69a15efa818e30f3b65c4234de7951ba94f0e6726d1237e0168b2044b7067de2c0766e1d3502094ccf35d0882a09e9f50d7d20e3ac8ecfe6e1c0606fc750dd9f340a7776d2eeb6eb5e50823a82f308eaf3ad5908baf58a780759d6ae8022aaddcd599c427dde8d986f14fb433b5b351edf64e943f1fcc31a0e1fb7c077557d9581d91e9ce1f71193db30cc42d280517b8de8818dc1477882039247841870285cf1e1da4c443b83b5c791b0a8eaf697f571e7c3d51baf0cd27dfb809cb31df5f714051f5a9a83773102641f7d345bb18641f0eb4c8a168ad8f056662ef7565906a71ba7a79ce9f0853054655c432dcf32b78b7b3b4bdc5b40092da20b5a8859b4d2b863f94e21fcd70425177e6dd9a64b2ab690e14ccee1374a7815f06a5f09de4f6043d2b39fddcef29e92910a6eea18ced41c1bedfcdee1089ec2deee3ad76b7cabd255b1a2a53f7575f459e0230c018165747126060172d5f13816edc644972a072a7e401d439dad958949ef477d8a2b5e5899a8ea8846cbc7b335b78c7f2644c8c69a1e6b254f58b8aa7a7885c4234bfd962352c311a007c2a7bb5a8e34202dd52692304624117be8ce6f110782767587aa4943a9ddbb960b7e00396fdbabcddd4854e0313daa94422601af0462314c173afc2528db6052e221dc59d594f89e7c9452b5c605b5955b469482d5135cfbf2d0d3b455508d9f40f37eca2b11fbac931f4e2ebcc9bc690de80641ce0213689946735ea8473f6c89e24f5246d22ebb22dd377ef43579702cd3d80650e14766ce7a37a8823841967b650a7a3a347a6f0b2ba7d8bb1e9fded9cd7e2b47742fd726d07447de92ae4b02db7c30a7e065b2d05ff5ff5709b7cf283606903f80e99810799780780d6a28cdda40505d3a4df0996b9d9bb237477cac4fdd3fa1717c9365ac7318de52070fc91861db4624f83dc374690209ae7ff09a0d2aae536937cd86ddd187bace3b7b42974e81cbe54fc011ca1817c1323cd0914ea96b6e7ebb10b7213a51a34b3bba4c129d571ca9f41a6aa41ce336bca6911f24f45cbb4122e1100a559a3e580957dcdf5f14bb32154ed64f250f480b282f5fe9ee65621093d370682afd2b8f37a7e9aaab1447c5162887f3d0f6c74959938c0716ab03dd242f967f574df9cd25cfd64bcb2e6f5788530e761711990778960bd7a828497cec05da36777433fb27bd80d517f6850c46d84b101ea644b596d352714945d6e31b2c43c1acb4e09e443fe51890559a0dd049dbe33d375e46f008bb5ee4af3a7609120cb5498a7aa33fd64f7b3e18170cfe1875cb6e25ce1dc78d04130894d757b66da2349a7f038c747138b0eaf0f2fa933ef7f51dfedb586bc0f49c76860f46009e28ab730290080e0483c70635da84b373e7413fa576e2a3e464c1d2432b3fe5e1a08e06e004d6c47948da8f8290db7ef807a23aabce4fc3e2164be066a721a7ace91f82ceecf3a1339d60134e410dee712bc5585c2ad61389ddeb49bf8679112d537418f9d2379c4bc56850fc400c6ba0b3f9252d43bf5271167adea041bc537b33d22a6c7226a6b9897aa1d34a35198f151865243de05435a58716e5f8a864e01ebe6ec6fd841210b5a1c39027f59e3df97b3090ea6a0e7113bd1ee146e174aec4139bbf6f9fdd7b6dc5d92ee3b4d5044db49e04a90a820993bda6858c36e414e8fa033cb86c58ca687043a0754d0a96cd9833f188cb5b9ca73f412a81dc92b3b88f8585fc357129ab44fcd3c04d46aa09b6373539e784aa546106b7a7472829206a5a1df78df26d0cc691d158136da9661990109e74d75e866388e2fbc8a905c5e939e56a09bb168954ddac4be6f1b9770137440129c4328246cb71bcfc2e95925616fba756806fac7b4256597a837bd170674fa678d8bb70c9c50c4d62ed7bab199363854d073f50758f89d2670b39ba58e16267aa45f69367e003e3ee1899f7400580b375984dd040ab6eab1ec0fcd3ffa536004727ae17dc4cd76d4c2534bd50b92a5e1039e4cceeeb7e48cf347314db3534c6e835d94315fe129bdfbaaf4ab528d20fc0c802eebba43b81d31f2f25079057e25f3fab4bb1b61a8380694e586a5d248fdd0b30a54794eb3852267ea6e5b6d3dcec4e3c889ff42759c96f535f5330b1d869bdc41592791dc4a56f9de48e90182bcf0af670155b79291e811fee0098a39d12f6001f71547bed9f07a10ad3d8054dc5cabfa30feadcf25c851a64fa03d75c0f2e57f9887c9606707005d6d1fb9dee4b4ae52637ae6d963f6c3409e8506c165ae21185f04c55e7bc5af51de5b561a3493f2d7b30ec26bb8a03e4493d27de6608ede356b6b62111c25f446f4fac3056c70f762919f021d7bc4c1470ece9776dac82ed0678c88cd3c8fcd92de28e0ce9a091405f9b8f2d3aac3a78553f47b75b6d91cf53e4e93857b55edfc7afe956b264067d9a0591acd3f6b32ddd93de8ddc046ff55d1f41de1021ce62c988fb378e9e4e1efdc428dbccacf0fa8232a52673aa67ac0251bed7ec2eddad07ed57d9cc6a735171cc180544a8ba5887f7cb588474897376c3b5d0b633a54ea821f2117ef8bf9d4f509bd6487042b0208069d44aceff75f49fe3ab2a39069ec0ac2f3dbee0b982b8f04013ed2e99907030eff31be0b847bbc818f68103e8c24d99f8fee0fdd968751ee3482e90c210ee47cb2f6b5e5fb87248ed281dad438af5808128f83a3b602a2238632d3067e19a764b4386e726bbe17b70499c5b381d94d83c9ff03667f3b6cb8505efc134a7e2c1460349f0efe1b5ef15519445d5f4c146a1af51a164353733f8dd16704f462fdd309cdc5aa1d6be35643cbb94e3872d82c9ded4f3a287d199e6bf2a35567bc382b34957b8730b0dd9400", 0x2000, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x90, 0x0, 0x2, {0x4, 0x0, 0x0, 0x3, 0xfffffffb, 0x0, {0x5, 0xffffffffffffffff, 0xfffffffffffffffc, 0x2, 0x2, 0x800, 0x8, 0x800000, 0x1, 0x1000}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0xc}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0xc}, @flat=@handle={0x73682a85, 0x101, 0x7}}, &(0x7f0000000080)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 1.557157425s ago: executing program 3 (id=925): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000080)=0xffffffffffffffff) r2 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040ac054382408b0b00000109022400010000002009040000fd0301000009210000000122010009058103"], 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) r4 = eventfd(0x0) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000240)=r4) r5 = syz_open_dev$usbfs(&(0x7f0000000000), 0x76, 0x183281) ioctl$USBDEVFS_DROP_PRIVILEGES(r5, 0x4004551e, &(0x7f0000002840)=0xabb2) ioctl$USBDEVFS_RESET(r5, 0x5514) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000000)) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f00000003c0)={0x24, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="002281"], 0x0}, 0x0) syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x2401) openat$binderfs(0xffffffffffffff9c, 0x0, 0x1002, 0x0) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) (async) socket$xdp(0x2c, 0x3, 0x0) (async) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000080)=0xffffffffffffffff) (async) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040ac054382408b0b00000109022400010000002009040000fd0301000009210000000122010009058103"], 0x0) (async) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) (async) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) (async) eventfd(0x0) (async) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000240)=r4) (async) syz_open_dev$usbfs(&(0x7f0000000000), 0x76, 0x183281) (async) ioctl$USBDEVFS_DROP_PRIVILEGES(r5, 0x4004551e, &(0x7f0000002840)=0xabb2) (async) ioctl$USBDEVFS_RESET(r5, 0x5514) (async) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000000)) (async) syz_usb_control_io$hid(r2, 0x0, 0x0) (async) syz_usb_control_io$hid(r2, &(0x7f00000003c0)={0x24, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="002281"], 0x0}, 0x0) (async) syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x2401) (async) openat$binderfs(0xffffffffffffff9c, 0x0, 0x1002, 0x0) (async) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) close_range(r0, 0xffffffffffffffff, 0x0) (async) 1.556119795s ago: executing program 3 (id=927): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x165342, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002880)='.\x00', &(0x7f00000028c0), 0x4001, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030303030303034303030302c757365725f69643dd1aa1c991b4ad79c5e656f4b7e557996501c2887f2e7ec88c8f2b1c1c966008afd63bef78c929d64344b71127e14c7f97d8130491df20341641143f36c", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000080)={0x28, 0x4, 0x0, {0x1, 0x7fff}}, 0x28) r2 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000080)=0x4, 0x4) sendmsg$netlink(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000240)=ANY=[@ANYBLOB="30000000120001000000000000000000100000000c00000000000000000000000d0003"], 0x30}], 0x1}, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) sendmsg$NL80211_CMD_DEL_KEY(0xffffffffffffffff, 0x0, 0x200000c0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='ns\x00') seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) fsopen(&(0x7f0000000080)='autofs\x00', 0x0) socket$netlink(0x10, 0x3, 0x0) r4 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESOCT], 0x0) syz_usb_disconnect(r4) r5 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x200) capset(0x0, 0x0) syz_usb_disconnect(r5) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCRMFF(r5, 0x4004550d, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r6, 0xffffffffffffffff, 0x0) openat$incfs(r3, &(0x7f0000000480)='.pending_reads\x00', 0x2, 0x145) mount_setattr(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000080), 0x20) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) fsetxattr$trusted_overlay_nlink(0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)={'L-', 0x7}, 0x16, 0x1) ioctl$PTP_EXTTS_REQUEST2(r7, 0x40603d10, &(0x7f0000000040)) write(r0, &(0x7f0000000400)="547bbee68789313efe846d6698abfeac0d12b144933fa6f684f1ba13b34680bf4b9ea70f71faa2a82a45ab47458c1f827355ad34033fbb8b9699eb0b279252dfcf29e377e14dcfbde42857cbf2aa88d3dad8ec2deea7afe4e747fa392fe01d425970fb2dd7a000ea3889f0d9021f347818106963e18c256e3df26b41c61d30284a8ad61c6269756119d62e3a7a24c1dcd09d3eb35dfee6ec945ac190c4797988e0d7f6f38bf9b124431dd8208a9208195a70c8e558c216e78d5f5b3f6df6f155e16bf7dd8f4e9eaf61d5142a82da7a87aeca19c25b631cd8a14ce9f2fc8dbcd05f51dc9260abc82d780c9358bd6411ebf48520694d413024432d0bfc3759a620289c9c8705009fd829da6eb5b72b454436b0af8e9dc4941ca2cff92561cad984e15849dcd73f04c7f70a30304da2fbc17f421767ad5ce47ed79d6698428eada9a39faa02f978699bc8c482224a2d5f85cc1135ea92ac1c610e32f1e7c82da6d91e0c8634da679760c32c3e891db352b76b61a65bbdd023e093a8e0d37fd8cd00679cb1bceaac84b05861740c221b2cb4afa1ce8b091c815fc4bd83995b5bf5dcdf2912572cf6180ec27445404917ff9e8e6604e2afc19a1bb3745914f0a101e03e44cb9664d40402f12a81310c97086fb01d04e82799c40f29348eb283ad58a40d608a47fbf9a25dbb308aa03b2425ffa896e1a70a37cf49e6dbdeda39ee88aadb26811eba78a0dfe5400a51428c31582edcc5f75b5dd963707a54b9b1e35f9966995d6474acbf7094124cecf38369aba3f6a5e3ad071f5e3df902843a3947623fe01571d97625c3e27721b08a6f85fd7b879acd400de5beabdd2603d566fdb4018bf8bd74c3ea1ae67c988992c7dab4ebcf501a73815e1b527d3ff1cf9e729d55127118565f794d253fef25609e5a415615d1b5fca5381b49446d9b9e75fb95dd9218b0d8d8d965871b897544e32fd0b4cb5600ffdcdb0056bcad75216759590f8a94db82b0acd2a5a34e5c34241a19f1a7a7cceb894341f55c6b474f3cc052f9863a67519dfadee6576f08d7448929424c13e845e2e636b87dc14e1ab4ad05d69f896ca1bc5c1267befb686c4207e21aa30bdae1d1602d3e4080784834e213c426ba5446f90d3b3885a5d6942c6b0e637f5bb9c7908460bd7d04497ab054c8fc7f89068f7535976ad051bfe94c243ce7604a63b2099b69f1ed73590a318fad9a170fa0cddfe60e981a92de2e1aab3465b11a968108e08deadfa1fa546c4cbc0c34ac28597848562583ae8d93cb60f2e06c7a1f743add51eb8cd732b40d48fde00117cb2d654100dfcc66b7c9fefac80e137caa5cf43ae897780251a3ebbc4ddd3b003168963c9e2c9446cb29731fc4bbb5e551aca6913f7b8576ce34012581b5a363917970399ca369688e637cf06ff3c8114383d2fcbf9c69f1ca63cd21695254a440df5ef0a8abfdbd0a651a533b6cdb82382e3bd70f87c1d3eb0a6e22452605026fafe6d35158c0728c1050a39330c80ee2ee0b09366fc6382883ecd0796feec657b36aee4091471e406e9faffd5ede27943e5fbf1b7249ab8bad71f60063697f04db52e980a9fb3eb5e53b89be8a5f0e6afea7435789ecd444c28eb411cdc2158e434178749f36cc957dbd17efb2b218592f78d6864f2708e8c6db2da0d3f6de53959afec0c90d3d62a13a0bc3857bce58d81223eddd05cf3c1ec6b3fc5307d0f16d470f2065300295197e9fa81d2e5574b2c7b18f1c6c85156a9b1174d62dcd3cb026f4b67e6babd66c8f427b9687585f37b18c82e0100507035e78ce010b78ea1b5d3884db25df36ae929dd535a854a31cba5e47655873df72be7463c600b704e9da0e7cb2d61d0710248814ecced2eef8f227c8aec308c2c9d0a39d1a6b306080e8eaef8edece0f6d0d1612c582d70c3999a1a6bd529538f51ba4869ce74bc8509a7126d96db118cdb55411a36f4361d53c8027c12a7486e9c84e4de445b454630be27bdc2ec268702d9c1890297bdd1fc7a235f1a47f4645d286146f3cb9a7ce650f4157a1e7f134eb1815001d59905d3103efad3c66479330e8a5da941c9c38bf21bc0770e3fd56cafa19ad653aacdcc956aeecfb1dd613caf918e1ca8ef2e1504c42768e77df43569d5fe4b48c237cad5285c578b26b4e47c8ce06fd2686e17eb6d5df5645d0fdde7782216be07a1135dabc3a59598bdbab249c5391832f18ac5163aa7a1a890128a4520835a53eb750604c5e328ecb3216516b3eba3f97652caeb4327da8865880a932dc8e7668666ac3b76a2a424ca37b5dfb52495710611e20790427a9f9e7ac59bb86f0fb7a17a5def347a98dd8e733b784d78d5c7f16f327a2606d4252411457465540a60b0757802f470d08337c0fe4eee5f5cfe4f296d0f7068e80828a022c95632beb7b7f802135e246b1adebebf24c821dee7205e9fe1a437b16aaa8dcb4a58b0bdbc8dbc2fce09271c27430cc9ca8141955ec5ff4228627c3816cfe1bb2c0f40f6a61e8bfa4e2dd744e41ed80b83e9aef77119f4b062b98e86690711e83e795bafa7a8db16f241cee76aa01ff749100c113fda966aa8c83ebe975f760c18e3864065a5de6e8028a9e3199f4acff11e14bb13bc50faf97fdeab46edc371e55cab78841a2de17ca116b0183ac38b658c57a64ab11bb0de071c971a7a5175ad0bac6ac1d1118230a5412a35bd005b369df0e04e749ea93d7e56f713b9ceff580547a2a76ea4753a78b4a5cd0311024c5536b536c8ede63bac8e8b4c5851248d9098a7c6bcc3d5f209178b45aef3c1afa4ab73d8feac3e1f771626d73d85f72dc15d16bd3b7b93e622626f6f3d96b4425d328236cf1579f1ca834a7b318b012e27b9a2dc528189cf1eb3705d90de50ce7ac0c256b7e41500113e164fb7d53c74c6f829552a5bce73eeab9a46d01551bdab18fd3a7e82b036872f1e876b12c5676f63a6ef0c6ff159788a0c2fc40f179a259c656e8aba9295e90027e74ef910ce3c56d6e2de917947410b05603b6a5052453f13e6ac058b3f621573bfe6224bad8c3a5f575e1eb774839cb554c53c9b3ad623df6c5c9627cce856f9ba5847557bc9f854cbb37a936f20a733ba352ee5b343b941290a399fb862434d1b551da420053cad3bad65195cde40b345740e30e9a22619add8aedb763473b729c0649f7a1ea45325534c9b629a1fe3a54a78fe44969715182c6df5c9ecf6878380831b2996579332ac37286e72ab16824c3fc9ef8d74a7f1f5cf80fa37f6bb990db3a7a70139887a4eba0763247c58f4fe770a0496a5ef49a3ba4d62bb900644d49b5fba7e58d58af6ae50c96da346618434ed46b8f4c27cde5e8863d5b090dc117f3b16db2c4273fa84f8b06d3df436bf4a8cfa6d33d7f0e78ef422d5d7640c821398c9adf4d6ccb1b2f7cd0e497023cfdd6b5bb9ad6a29edb8b78fb3322414cad1458eb12699853acb165076db7088f518386380850c911cbe74034ddbfe217db714325ebc4d6b46eba640cf125b87eed0832077ab775e475e431079756b3da6f9bb3c861ce7eabf6adf70b76eb9642a1bab3d7afef2d7b40c8a19b98123ad7449c1039c494e73bc91a86e8e92c39a9482cf60605b9e5c209262c4fcfde76ee370bd6a78253b64c5cbb19a11b34c5a9ccf634c52751277268cd97e795b43867af5a4db51bd631ac547906fd52aff43eb98edacecf08f94a060902b5cb82e87ec856305005bd1150e581d9717460e31ba724da5e7ad72fa580f8509fe838dbc1bfbbf53e29688f25ca602d2de702e4411d3d133e2ab2f454f71f98efc2cd0eb468544cacf608c6689ef122009cf61e813e26b7b2b1695143fcd510f509ec2bf7205e674ba6767eaa29605c51e434c298bde0969617292e960d22b085632d241aa2a8e0f6ac6f2d56d0ed2c6bd3eca306a3224915065894480e737c7d7a11901bb7f977525cfcab652476baab0fd3b68dc59fd14ccdd6248bd5c5a0ab1dbae28a848b2d4ad0d973bb149ff4115b0436b7d145a6f8081d314039131f60dc8ed0ccf2c4971f0a59a65b3b1ef638e6d009dff793a4b7266c58f88bb117d665cae8fc6f6c2840470333bdbc8df12c6633a6ac7b664e089a85dc6d49f52459dd2df1be552194eef6027c1b45f62b97647788c3325f05609c1e02cbc9a18be72e4b502df719e4f9cb82615e3a03b5732328e552023dbfdcf91ed5ab51242e7d09a9b73674f0946976d8a8fa9288dce4d54d5820a0f0053b892685f79a6c8dbac724fce4d24a7b75e383f54ac58af3951d666a22f158637acc4f0e09e248e85f8e1439501afc0d5b7e9eab40fa737ae93482a1e29f3e327fa31d0d764c65ab976af1eb91fe08c5bc10a48b93453ad192d1d538cf93b792a70246bde99f46a78b670edea552840e08c787c928ee311f954b73d07287a59b470e38d4e624ddba8e4b21a74d7c07cc684b0ea82212129901029e74312866722dfa2dc53de3e8ddc00adc21deb7510ed15c50d139296297408da3d6beb589e7bb3f1d74e4e8dddec14b9cdf371d7f142136cdca5644d09edd97228a0abcd2e7b402c5cc68683cb980f50ca7aea8338dc5990a6ebb2d2b95a3deecc45f5a4f4e0e40a57e29f3e227c41db00e17dc962e2ea3184b5057c89974bcab651a22e588a527d7d8ec695e7ab5622c1ad3763d045a8393b7acfa04488556ac957777d1aebfc5d0e2a8150a6984d5607ac2400789d8f622c837d6a9b78fcc2d8aa872949edde53e3a99b5f5bf35bff5f0db7874ad3f172f9d8dd6cbb17a770b1482c79b9a15605cd0d89c6bae9aa6db8e886cfff8f843b99df95dde88c96202ae6ced4d539a3f70997ee7b2bdb7bbe529f9bc55b143066de8d9dcd7fa38c54094f2235e4a17ef8e910b4d48c373ce5e6fc9824ca8f115e579b002df16c591557cd6cac1363b8d8fc656075ca703a87f1efa76e4122eb7358389f659681fb49cb82215f73b284a7678b8b1528472d0cfab1980ee3d4410bdc1c31f1f798c3ca5744077e2f6cb4ca6e415f1e3afc8c00dd95d3307de5428883513f01ed19dde487e1c103619fd78583f09d02982512e0ee20a670b3b24986dcb7431f1ef3fd12e801bb2454213ff7b1962a464647eb4c8125cf2ed098160da880024a98add9b2917e133dcee7a8e25387fd5bf2b3f8fb05b2f7ed5f719b30b9cca4b1754e31d48bd2ec79e7e9c155130ea5f0876f3bb4d94ac74b209633ecb03deb8b9448e8cf4b4bcb04ffdb38ac457881f84636246a4e5e7773166129fb8b7803c6dde0ee69fd1f76f1d93b729eacc9d8dbd6e61e638a3f8de972a824936b1d869a15daaa21db04760e9110c5b7c736671d31a72fc8f7a6f7424c898791cafa21a48921215a78d60a367aa7c6284a1aaa1fee0c5291bdc91bf8c032c9917fd28e68fc046ea4b17952f1abbe01af5f19e4fa99fc6a985f6264f9efbb208e6146d3465cc603ef36d3d59b5197bca1696bf5658b60cf0e0455cb1e174e52c4acb712a3ed9202a1ae334427b93305939c7f15e9e5eed09b5fc8d1e3836720d46d133841d4482ec2427d3002d95bce996b4b2d5b59b2a43970afe35517674bfdd8807931697422045f60641138fefa278d477ef04847dd02d305e8f15e228522e54d1ffda6d5b26ad831146c66e6f9153ebeb0785ea75283df66816d771c7e4297c1686d06494a59046313169f2e2b4988a2758198fcb166d9d112d187a4456503e6c0bdfb390c89dcebf3cb8260a27fdebddbc6071857010ad4c59c062db35a400"/4094, 0xffe) 1.130335059s ago: executing program 4 (id=934): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') write$cgroup_pid(r1, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)=0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) timer_create(0x7, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)=0x0) timer_settime(r3, 0x0, &(0x7f0000000340)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) unshare(0x44040200) timer_gettime(r2, &(0x7f0000002180)) sendfile(r0, r0, 0x0, 0x7ffff000) r4 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') write$FUSE_NOTIFY_DELETE(r4, &(0x7f0000000000)=ANY=[@ANYBLOB="3500000005000000"], 0x35) ioctl$TUNSETVNETLE(r4, 0x400454dc, &(0x7f0000000000)=0x1) 989.28906ms ago: executing program 2 (id=942): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={0x0, 0x128000, 0x1800}, 0x20) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r1, &(0x7f0000000a40), 0x0, 0x8008800) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000d40), 0x1, 0x0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000d80)={0x1, &(0x7f0000000d40)=[{0x6, 0x6, 0x38, 0x7fffffff}]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f00000001c0)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c00f3266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 989.106551ms ago: executing program 2 (id=943): socket$nl_xfrm(0x10, 0x3, 0x6) (async) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000440)={0x900, 0x0, 0x0}, 0x40408c0) (async, rerun: 64) madvise(&(0x7f0000a0c000/0x3000)=nil, 0x3000, 0xf) (async, rerun: 64) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) (async) prctl$PR_SET_MM(0x23, 0xb, &(0x7f000014b000/0x2000)=nil) (async) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x68a00, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x7, 0x12, r1, 0x8ee47000) syz_open_dev$usbfs(&(0x7f0000000080), 0x0, 0x1a98c3) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 986.324581ms ago: executing program 4 (id=944): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@updpolicy={0x17c, 0x19, 0x1, 0x0, 0x0, {{@in6=@private2, @in6=@empty, 0x0, 0x3, 0x2, 0x0, 0x2, 0x0, 0x0, 0x89}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x3}}, [@tmpl={0xc4, 0x5, [{{@in6=@empty, 0x0, 0x32}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0xc}, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0xfffffffd}, {{@in6=@private2, 0x0, 0x32}, 0x0, @in6=@ipv4={'\x00', '\xff\xff', @remote}}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x80, 0x3c}, 0x3, @in6=@initdev={0xfe, 0x88, '\x00', 0xfd, 0x0}, 0x0, 0x4, 0x2}]}]}, 0x17c}}, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x100, 0x0) r2 = gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(0x0, 0x0, 0x0, &(0x7f00000000c0)={[0x8001a0ffffffff]}, 0x8) ioctl$int_in(r3, 0x5452, &(0x7f0000000180)=0xffffffffffffffff) fcntl$setsig(r3, 0xa, 0x12) ppoll(&(0x7f0000000100)=[{r4}], 0x1, 0x0, &(0x7f0000000080)={[0x8001a0efffffff]}, 0x8) dup2(r3, r4) fcntl$setown(r4, 0x8, r2) tkill(r2, 0x13) openat$procfs(0xffffff9c, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r1, 0xe5444000) r5 = creat(&(0x7f0000000080)='./bus\x00', 0x0) setuid(0xee00) fsetxattr$system_posix_acl(r5, &(0x7f0000000000)='system.posix_acl_access\x00', 0x0, 0x0, 0x0) creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r6, 0x8932, &(0x7f0000000000)={'dummy0\x00'}) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000131000/0x400000)=nil) madvise(&(0x7f0000363000/0x4000)=nil, 0x4000, 0x17) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/profiling', 0xa0042, 0x0) close(r7) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r8 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r9) setpriority(0x2, 0xff, 0x0) 986.172481ms ago: executing program 2 (id=945): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000080)=0x4) (async) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000080)=0x4) ioctl$BTRFS_IOC_QGROUP_CREATE(r0, 0x4010942a, &(0x7f0000000000)={0x1, 0xc}) close_range(r0, 0xffffffffffffffff, 0x0) (async) close_range(r0, 0xffffffffffffffff, 0x0) 933.113504ms ago: executing program 2 (id=946): ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x0, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000049ffe840e5130100534e0000000109021b0001000000000904"], 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x74, 0x0, &(0x7f0000000000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000280)={0x30, 0x30, 0x30}}}], 0x58, 0x0, &(0x7f0000000d80)="8b0b4c6e6e8ea72e404981a6ef39f577efb9c2c64f47b576cec3dab5adbd25d802c31aa20f47283d909cfc1520a8ebb223d441539406505ea0018c8d180490b7a70bc561639b136ecae6c156d04957009916c1b24ba79c86"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) 918.944856ms ago: executing program 0 (id=950): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x40000100000200) r1 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x2, 0x3, @empty}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000002100)="0800a9fc0da6b30a", 0x8}], 0x1, &(0x7f0000001d00)=ANY=[@ANYBLOB="30000000000000000000000007000000890704"], 0x30}, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0xf, &(0x7f0000000080)=0x4, 0x4) setsockopt$bt_BT_RCVMTU(r2, 0x112, 0xd, &(0x7f0000000040)=0x8, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000100)="9ea1d0081f", 0x5) recvmmsg(r4, &(0x7f00000008c0), 0x10, 0x0, 0x0) close(r3) mmap(&(0x7f0000018000/0x4000)=nil, 0x4000, 0xa8ca3411d1c26009, 0x13, r0, 0x22e7c000) 817.174114ms ago: executing program 0 (id=951): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x442580, 0x0) prctl$PR_SET_KEEPCAPS(0x8, 0x3) (async, rerun: 32) mmap(&(0x7f00002c9000/0xd000)=nil, 0xd000, 0x3000001, 0x12, r2, 0x407dc000) (async, rerun: 32) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_HAS_DEVICE_ATTR_vcpu(r3, 0x4018aee3, &(0x7f0000000000)=@attr_pmu_init) 816.251804ms ago: executing program 0 (id=952): r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) fchdir(r0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') mount(&(0x7f0000000080)=@filename='./cgroup\x00', &(0x7f0000000040)='./cgroup\x00', 0x0, 0x1401, 0x0) unshare(0x2c020400) fchdir(0xffffffffffffffff) syz_usb_connect(0x1, 0x0, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000480), 0x73, 0x141641) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') read$FUSE(r1, &(0x7f00000005c0)={0x2020}, 0x2020) 463.631093ms ago: executing program 2 (id=953): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xfffffffffffffff9}], 0xffffffffffffffbb, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xfffffffffffffff9}], 0xffffffffffffffbb, 0x0, 0x0}) 456.445033ms ago: executing program 2 (id=954): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000440)={0x7}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="200000001200010a000000000080000000b0"], 0x20}}, 0x0) sendto(r0, &(0x7f00000000c0)="3ef67de26395034c2dd498bb4390aef97fd34bac401cb2e13b8cda4074486fd66f44f01e15885722203857879b89a55362234eff3ce908a85c8f9eaf98277d0c1cff24171bd783bc007ff9bce513664d5c3744a7d66ff5bb33856a0ed81f6473a0dc", 0x62, 0x0, &(0x7f0000000140)=@tipc=@id={0x1e, 0x3, 0x3, {0x4e23, 0x3}}, 0x80) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r2 = userfaultfd(0x1) socketpair(0x10, 0x800, 0x1, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x544}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f0000000480)={0x1, {{0xa, 0x4e24, 0x98d5, @private2, 0x6}}, 0x1, 0x3, [{{0xa, 0x4e21, 0x1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x101}}, {{0xa, 0x4e20, 0x3, @private2, 0x3}}, {{0xa, 0x4e20, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0xcff}}]}, 0x210) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000362000/0x4000)=nil, &(0x7f0000099000/0x4000)=nil, 0x4000, 0x2}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r1, 0x45809000) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000003940)=ANY=[@ANYBLOB="18000000110005000000000002000000070000000400e380"], 0x18}}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 301.228666ms ago: executing program 0 (id=955): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) r1 = socket(0x11, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000005c0)={'gre0\x00', 0x0}) bind$packet(r1, &(0x7f0000000180)={0x11, 0x0, r3, 0x1, 0x1, 0x6, @multicast}, 0x14) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000000)=0xe9, 0x4) sendmsg$netlink(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000b00)=ANY=[@ANYBLOB="00050000270000012cbd7000fedbdf2509025159595638800800f400c1e3510bb77dc90981878e093c7ece11"], 0x500}], 0x1, 0x0, 0x0, 0x20000001}, 0x20040051) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r4, 0x0) remap_file_pages(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x8, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfee, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000280)={@fda={0x66646185, 0x1, 0x0, 0x34}, @flat, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0x1d}}, &(0x7f0000000180)={0x0, 0x20, 0x38}}, 0x400}], 0x0, 0x0, 0x0}) 297.892706ms ago: executing program 0 (id=956): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x8ee4a000) openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x40d00, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) r1 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) add_key$keyring(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, r1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = open(&(0x7f0000000000)='./file0\x00', 0x80140, 0x0) fcntl$setlease(r2, 0x400, 0x1) close_range(r2, 0xffffffffffffffff, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @rand_addr=0x64010102}, 0x10) 297.320756ms ago: executing program 0 (id=957): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x101400, 0x0) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0xfffffffa) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x3) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000040)={0xa, 0x4e20, 0x89a8, @remote, 0x2}, 0x4f, 0x0}, 0x20008814) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000080)="64f30f00d83ef30f6fb5799e0f01c42e2e2ef30f093667663667676726660f383046380f090f18d90fc75c09baf80c66b8544b8d8766f6efeffc0c66b8f2ffffff66efbaf80c66b8c0669d8966efbafc0c66ed", 0x53}], 0x1, 0xa9, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) futex(&(0x7f000000cffc)=0x1, 0x6, 0x0, 0x0, 0x0, 0x2) futex(&(0x7f000000cffc)=0x2, 0x5, 0x10000, 0x0, &(0x7f0000048000)=0xffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x1, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000040)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000100)={@flat=@weak_binder={0x77622a85, 0x110a, 0x3}, @flat=@binder={0x73622a85, 0x1, 0x3}, @flat=@handle={0x73682a85, 0xa, 0x2}}, 0x0}}], 0x0, 0x0, 0x0}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x14, 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000007d00)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="140000006a001511"], 0x14}], 0x1}, 0x4000080) ioctl$sock_netdev_private(r5, 0x89f4, &(0x7f0000000240)="9daa7d04231f7ca02158b16e36d82e68471fa11b444fb645c8c5823ec5f2fd853f53d7c7a79f38efc7102cf17afb1d2bb3d27b2426cd2c796db1aa59a940f7dff40efbfb17f5d442f79c5426ad184e003759ed01b4158a465b1694200fc3d7588286520449990023417f364302699ac76696761b4c09e78bb31cb826c798aded421b9d6eb47063f4b67c57f035b5ec98a8417b1179dca951") openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/attr/keycreate\x00', 0x2, 0x0) close_range(r0, 0xffffffffffffffff, 0x2) 142.691018ms ago: executing program 4 (id=958): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r1, &(0x7f0000000000)={0x24, @none={0x0, 0x1}}, 0x14) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x5) iopl(0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) ioprio_set$pid(0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='status\x00') preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000580)=""/85, 0x55}], 0x1, 0x0, 0xffffffff) mmap(&(0x7f0000018000/0x2000)=nil, 0x2000, 0xa8ca3411d3c26009, 0x13, r0, 0x22e7c000) 124.58026ms ago: executing program 4 (id=959): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_io_uring_setup(0x11c7, &(0x7f0000000400)={0x0, 0x5683, 0x80}, &(0x7f0000000080), &(0x7f00000005c0)) syz_io_uring_setup(0x3c5f, &(0x7f0000000240)={0x0, 0x0, 0x27, 0x2, 0x0, 0x0, r1}, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0xfffffffffffffffc) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000003940)={0x18, 0x11, 0x1, 0x0, 0x2, {0x7}, [@nested={0x4, 0xe3}]}, 0x18}}, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setresuid(0x0, 0xee01, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0xa, 0x2, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000000680)=0xfeab) fchown(r3, r5, 0xee01) setsockopt$inet6_IPV6_HOPOPTS(r2, 0x29, 0x36, &(0x7f0000000400)=ANY=[], 0x8) pipe2(0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000400)={0x6f, 0x0, 0x0, {0x7, 0x28, 0x80000001, 0x0, 0x0, 0x0, 0x2, 0x1}}, 0xfffffede) connect$inet6(r2, &(0x7f00000003c0)={0xa, 0xfffe, 0x3000000, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000240)='bridge0\x00', 0x10) write(r2, &(0x7f00000000c0)="8f2a0a65bd8c2c2b0304000e0580a7b6070d63e286a5cefe", 0x5ac) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x20, 0x5, 0x2, 0x70ff}, {0x6, 0xfe, 0x0, 0xa1a}]}, 0x10) sendmmsg(r6, &(0x7f0000002900)=[{{0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000b40)="97a797c5", 0xa797}], 0x1}}], 0x1, 0x0) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x10140, 0x0) madvise(&(0x7f0000578000/0x2000)=nil, 0x2000, 0x16) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 232.07µs ago: executing program 4 (id=960): lsm_set_self_attr(0x66, &(0x7f0000000440)={0x65, 0x5, 0x23, 0x3, "cfa7ae"}, 0x23, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x1000000, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) mount$incfs(&(0x7f00000007c0)='./bus\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0xffffc000) 0s ago: executing program 4 (id=961): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000a7b000/0x400000)=nil) syz_kvm_add_vcpu$x86(r3, &(0x7f0000000140)={0x0, 0x0, 0x18}) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0x0}, 0x68) (async) mlock(&(0x7f00007fe000/0x800000)=nil, 0x800000) (async) r4 = userfaultfd(0x1) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x10}) (async, rerun: 64) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) (async, rerun: 64) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x801, 0x0) ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x3) write$uinput_user_dev(r5, &(0x7f0000000240)={'syz0\x00', {0x9, 0x6, 0x5, 0x81}, 0x37, [0x2067c000, 0x2, 0x1, 0xd5d, 0xe, 0x7, 0x9, 0x3, 0x7, 0x0, 0x4, 0x8, 0x8, 0xec9, 0x8, 0x9e, 0x2, 0x7, 0x2, 0x8, 0xffffffff, 0x7, 0x0, 0x2, 0x1, 0x8b5, 0x3, 0x2, 0x4, 0x7, 0x4, 0x0, 0x4, 0x4, 0x8, 0x9, 0x1c, 0xffc, 0x2, 0x540, 0x1, 0x3, 0x7, 0x7c, 0xa77, 0xfffffffb, 0x7, 0x7, 0xefcd, 0x64d, 0x200, 0x7ff, 0x2, 0x95, 0x6, 0x3, 0x8, 0x1, 0x5, 0x8, 0x7ff, 0xc, 0xf, 0x401], [0x2, 0x5, 0x8, 0xa, 0x80, 0x7fff, 0x400000, 0x1000, 0x0, 0xa458, 0xfffffff9, 0x2, 0x7, 0x8, 0x2, 0xfffffffd, 0x400, 0x9, 0x6, 0x18, 0x3, 0x4, 0x3, 0x4c9d, 0x3, 0x8, 0x101, 0x0, 0xd, 0x8, 0x5, 0x4, 0x5, 0xfff, 0x8813, 0x0, 0x0, 0x2, 0x6, 0x5, 0x6f, 0x4, 0xd426, 0x6, 0x0, 0x400, 0x4, 0x5, 0x9, 0x3, 0x0, 0xa0, 0x1, 0x6, 0x5, 0x9, 0x1, 0x9, 0x7, 0x1, 0x1, 0x2, 0x0, 0x5], [0x43, 0x81, 0x3, 0x1, 0x8, 0x60, 0x2, 0x200, 0x3, 0x1, 0x9, 0x7, 0x6, 0x4, 0xc5d2, 0x7, 0xd, 0x10000, 0xfffffff9, 0x8000, 0x7f, 0x7fffffff, 0x4, 0x675, 0x1, 0x6, 0x8b7, 0xfffffffe, 0xfd, 0x0, 0x9, 0x4, 0xffffffff, 0x81, 0xd8b7, 0x1447, 0x5, 0x6, 0xd1c, 0x9, 0x400, 0x7, 0x29243924, 0x8, 0x3, 0x9, 0x6, 0xe, 0x0, 0xfffffff7, 0x9, 0x78029545, 0x5, 0x1000, 0x8801, 0x8, 0x0, 0x100, 0x80000000, 0xb, 0x80000001, 0x7, 0xd, 0x3], [0x4, 0x8, 0x7f, 0x7ff, 0x3, 0x3, 0x3, 0x10000, 0x4, 0x2, 0x10, 0x9, 0x9, 0x4, 0x4, 0x200, 0xbb7, 0x6, 0x10, 0x3, 0x6, 0x0, 0x3, 0x9, 0xfffffff0, 0x200, 0xd10c, 0x5, 0xbe6f, 0xf62e, 0x9, 0x3, 0x1, 0x401, 0x5, 0x8000, 0xe2ee, 0x3f, 0x0, 0x1, 0x5, 0x7fff, 0x5, 0xfd4, 0x0, 0x1, 0xffffffff, 0x31a, 0x4e, 0x5, 0x2549, 0x8, 0x1, 0x6, 0xc, 0x7fff, 0x5, 0x4a, 0x5, 0x8001, 0x3ff00000, 0xfff, 0x0, 0x81]}, 0x45c) ioctl$UFFDIO_WRITEPROTECT(r4, 0xc018aa06, &(0x7f00000000c0)={{&(0x7f0000b72000/0x400000)=nil, 0x400000}, 0x1}) (async) munlockall() madvise(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x19) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000d19000/0x1000)=nil, &(0x7f0000c34000/0x2000)=nil, &(0x7f0000a8f000/0x5000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f000062b000/0x1000)=nil, &(0x7f00008eb000/0x3000)=nil, &(0x7f000043e000/0x4000)=nil, &(0x7f0000e05000/0x3000)=nil, &(0x7f00006bc000/0x3000)=nil, &(0x7f0000ebf000/0x1000)=nil, &(0x7f0000614000/0x3000)=nil, &(0x7f0000000180)="a01e95b0500acafdbd2a54d206a0d529e46871bce2f5d5d8fb96e4efc6de81e8aaa194f37cc6410417ea783a45d7bb14f3596764634f2c82a90fa1bc0e9a595c2a0e4e5661da0df7138d11b849d94ddcd322736a25fa6264e59b7525145f4f0156f71b7dddaca326d97ae644f001e9547bc9b52f722216fe76f72616b2736cd9e4c6c464a02b2caa6c2c5d06cd65d2b9b5215d6df45b6da9d0da42652f4bb61269224ec776b10c9425eac049946b198f5d2fbf0afbfe59c57977ed95b69fffa9d778900b536f195ff86ed1fc80018a4a6e148720c31eb67ec59c72cd38", 0xdd, r0}, 0x68) (async) syz_kvm_add_vcpu$x86(r3, &(0x7f0000000140)={0x0, 0x0}) (async) close_range(r0, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): bridge0: port 2(bridge_slave_1) entered disabled state [ 24.156891][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.164955][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.172247][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.179711][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.186979][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.200104][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.207172][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.216657][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.223814][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.236633][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.243790][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.251940][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.258979][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.280834][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.287914][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.299964][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.307261][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.324921][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.332046][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.341302][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.348376][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.385897][ T290] veth0_vlan: entered promiscuous mode [ 24.401228][ T291] veth0_vlan: entered promiscuous mode [ 24.410508][ T289] veth0_vlan: entered promiscuous mode [ 24.423396][ T290] veth1_macvtap: entered promiscuous mode [ 24.444040][ T291] veth1_macvtap: entered promiscuous mode [ 24.457508][ T289] veth1_macvtap: entered promiscuous mode [ 24.507107][ T291] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 24.510474][ T288] veth0_vlan: entered promiscuous mode [ 24.559707][ T288] veth1_macvtap: entered promiscuous mode [ 24.586419][ T333] netlink: 'syz.0.1': attribute type 1 has an invalid length. [ 24.797828][ T45] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 24.887900][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 24.908071][ T65] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 24.947812][ T45] usb 3-1: Using ep0 maxpacket: 8 [ 24.954134][ T45] usb 3-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.00 [ 24.963440][ T45] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.972893][ T45] usb 3-1: config 0 descriptor?? [ 25.039131][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 25.049770][ T9] usb 2-1: config 0 has no interfaces? [ 25.056845][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 25.066209][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 25.068863][ T65] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 25.074713][ T9] usb 2-1: Product: syz [ 25.084935][ T65] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 25.089925][ T9] usb 2-1: Manufacturer: syz [ 25.100059][ T65] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 25.104442][ T9] usb 2-1: SerialNumber: syz [ 25.115824][ T65] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 25.119729][ T9] usb 2-1: config 0 descriptor?? [ 25.128830][ T65] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.141336][ T65] usb 1-1: Product: syz [ 25.145621][ T65] usb 1-1: Manufacturer: syz [ 25.150349][ T65] usb 1-1: SerialNumber: syz [ 25.187667][ T45] usbhid 3-1:0.0: can't add hid device: -71 [ 25.193714][ T45] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 25.202663][ T45] usb 3-1: USB disconnect, device number 2 [ 25.357355][ T348] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 25.357382][ T348] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:4 [ 25.367213][ T348] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 25.376402][ T348] rust_binder: Read failure Err(EFAULT) in pid:4 [ 25.393410][ T65] usb 1-1: USB disconnect, device number 2 [ 25.413862][ T335] udevd[335]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 25.476028][ T351] rust_binder: Error while translating object. [ 25.476066][ T351] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 25.482995][ T351] rust_binder: Failure BR_FAILED_REPLY { source: EINVAL } during reply - delivering BR_FAILED_REPLY to sender. [ 25.493332][ T351] rust_binder: Transaction failed: BR_TRANSACTION_COMPLETE my_pid:2 [ 25.555244][ T358] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.589446][ T65] usb 2-1: USB disconnect, device number 2 [ 25.603065][ T358] syzkaller0: entered promiscuous mode [ 25.608865][ T358] syzkaller0: entered allmulticast mode [ 25.871159][ T363] rust_binder: Read failure Err(EFAULT) in pid:6 [ 25.884745][ T367] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 25.933091][ T368] ======================================================= [ 25.933091][ T368] WARNING: The mand mount option has been deprecated and [ 25.933091][ T368] and is ignored by this kernel. Remove the mand [ 25.933091][ T368] option from the mount to silence this warning. [ 25.933091][ T368] ======================================================= [ 25.968614][ T368] syz.3.9: attempt to access beyond end of device [ 25.968614][ T368] loop3: rw=4096, sector=2, nr_sectors = 2 limit=0 [ 25.981646][ T368] EXT4-fs (loop3): unable to read superblock [ 26.049732][ T377] support for the xor transformation has been removed. [ 26.106945][ T65] rust_binder: 350: removing orphan mapping 0:24 [ 26.113583][ T383] capability: warning: `syz.2.15' uses deprecated v2 capabilities in a way that may be insecure [ 26.221511][ T397] rust_binder: Write failure EFAULT in pid:9 [ 26.307819][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 26.437733][ T65] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 26.457840][ T9] usb 1-1: device descriptor read/64, error -71 [ 26.588964][ T65] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 26.599263][ T65] usb 3-1: config 0 has no interfaces? [ 26.606462][ T65] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 26.616297][ T65] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 26.624571][ T65] usb 3-1: Product: syz [ 26.628904][ T65] usb 3-1: Manufacturer: syz [ 26.633528][ T65] usb 3-1: SerialNumber: syz [ 26.639018][ T65] usb 3-1: config 0 descriptor?? [ 26.707853][ T9] usb 1-1: device descriptor read/64, error -71 [ 26.922798][ T396] rust_binder: Error while translating object. [ 26.922827][ T396] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 26.927768][ T65] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 26.929627][ T396] rust_binder: Failure BR_FAILED_REPLY { source: EINVAL } during reply - delivering BR_FAILED_REPLY to sender. [ 26.946016][ T396] rust_binder: Transaction failed: BR_TRANSACTION_COMPLETE my_pid:23 [ 26.958031][ T9] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 27.013741][ T36] kauditd_printk_skb: 81 callbacks suppressed [ 27.013762][ T36] audit: type=1400 audit(1756447670.890:155): avc: denied { write } for pid=402 comm="syz.1.20" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 27.044693][ T45] usb 3-1: USB disconnect, device number 3 [ 27.088128][ T65] usb 4-1: Using ep0 maxpacket: 8 [ 27.094565][ T65] usb 4-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.00 [ 27.104147][ T65] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.114347][ T65] usb 4-1: config 0 descriptor?? [ 27.117735][ T9] usb 1-1: device descriptor read/64, error -71 [ 27.172068][ T36] audit: type=1400 audit(1756447671.050:156): avc: denied { create } for pid=405 comm="syz.1.21" anonclass=[userfaultfd] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 27.193801][ T36] audit: type=1400 audit(1756447671.050:157): avc: denied { ioctl } for pid=405 comm="syz.1.21" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=3832 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 27.220143][ T36] audit: type=1400 audit(1756447671.070:158): avc: denied { read } for pid=407 comm="syz.1.22" name="msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 27.243130][ T36] audit: type=1400 audit(1756447671.070:159): avc: denied { open } for pid=407 comm="syz.1.22" path="/dev/cpu/0/msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 27.271994][ T36] audit: type=1400 audit(1756447671.150:160): avc: denied { map } for pid=409 comm="syz.1.23" path="/dev/ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 27.327382][ T65] usbhid 4-1:0.0: can't add hid device: -71 [ 27.334084][ T65] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 27.342851][ T65] usb 4-1: USB disconnect, device number 2 [ 27.367828][ T9] usb 1-1: device descriptor read/64, error -71 [ 27.477917][ T9] usb usb1-port1: attempt power cycle [ 27.507822][ T329] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 27.572220][ T65] rust_binder: 395: removing orphan mapping 0:24 [ 27.583032][ T36] audit: type=1326 audit(1756447671.460:161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=414 comm="syz.2.24" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f81a3f8ebe9 code=0x0 [ 27.657746][ T329] usb 2-1: Using ep0 maxpacket: 32 [ 27.664004][ T329] usb 2-1: config 0 has an invalid descriptor of length 41, skipping remainder of the config [ 27.674385][ T329] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 27.685031][ T329] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 27.694139][ T329] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.702341][ T329] usb 2-1: Product: syz [ 27.706511][ T329] usb 2-1: Manufacturer: syz [ 27.711235][ T329] usb 2-1: SerialNumber: syz [ 27.716604][ T329] usb 2-1: config 0 descriptor?? [ 27.817766][ T9] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 27.838916][ T9] usb 1-1: device descriptor read/8, error -71 [ 27.918616][ T418] netlink: 8 bytes leftover after parsing attributes in process `syz.3.26'. [ 27.932714][ T36] audit: type=1400 audit(1756447671.810:162): avc: denied { read write } for pid=417 comm="syz.3.26" name="fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 27.956092][ T36] audit: type=1400 audit(1756447671.810:163): avc: denied { open } for pid=417 comm="syz.3.26" path="/dev/fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 27.983553][ T9] usb 1-1: device descriptor read/8, error -71 [ 28.227787][ T9] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 28.249116][ T9] usb 1-1: device descriptor read/8, error -71 [ 28.378993][ T9] usb 1-1: device descriptor read/8, error -71 [ 28.487872][ T9] usb usb1-port1: unable to enumerate USB device [ 28.507393][ T36] audit: type=1400 audit(1756447672.380:164): avc: denied { bind } for pid=429 comm="syz.2.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 28.686132][ T445] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.695256][ T445] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.087990][ T413] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 29.237797][ T413] usb 3-1: Using ep0 maxpacket: 32 [ 29.244011][ T413] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 29.252477][ T413] usb 3-1: config 0 has no interface number 0 [ 29.259901][ T413] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 29.269028][ T413] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.277023][ T413] usb 3-1: Product: syz [ 29.281201][ T413] usb 3-1: Manufacturer: syz [ 29.285868][ T413] usb 3-1: SerialNumber: syz [ 29.291431][ T413] usb 3-1: config 0 descriptor?? [ 29.297178][ T413] smsc95xx v2.0.0 [ 29.437749][ T9] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 29.589006][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 29.600163][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 29.609945][ T9] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 29.619033][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.627791][ T9] usb 1-1: config 0 descriptor?? [ 29.698217][ T413] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 29.709076][ T413] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 30.121602][ T462] rust_binder: Write failure EFAULT in pid:65 [ 30.123594][ T413] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000108: -71 [ 30.141162][ T413] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -71 [ 30.150791][ T413] usb 3-1: USB disconnect, device number 4 [ 30.236006][ T9] usb 1-1: language id specifier not provided by device, defaulting to English [ 30.280901][ T412] usb 2-1: USB disconnect, device number 3 [ 30.361419][ T474] rust_binder: 472 RLIMIT_NICE not set [ 30.441542][ T413] rust_binder: 471: removing orphan mapping 0:24 [ 30.695296][ T480] rust_binder: Error in use_page_slow: ESRCH [ 30.695324][ T480] rust_binder: use_range failure ESRCH [ 30.702100][ T480] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 30.707853][ T480] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 30.715893][ T480] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:67 [ 30.838789][ T469] rust_binder: Write failure EFAULT in pid:20 [ 30.851073][ T9] uclogic 0003:256C:006D.0001: v1 frame probing failed: -71 [ 30.866572][ T9] uclogic 0003:256C:006D.0001: failed probing parameters: -71 [ 30.874134][ T9] uclogic 0003:256C:006D.0001: probe with driver uclogic failed with error -71 [ 30.884357][ T9] usb 1-1: USB disconnect, device number 7 [ 31.174485][ T497] rust_binder: Read failure Err(EFAULT) in pid:79 [ 31.353804][ T518] binder: Unknown parameter 'rî("M#Hw' [ 31.467788][ T65] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 31.525830][ T292] bridge_slave_1: left allmulticast mode [ 31.531616][ T292] bridge_slave_1: left promiscuous mode [ 31.537304][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.545163][ T292] bridge_slave_0: left allmulticast mode [ 31.550995][ T292] bridge_slave_0: left promiscuous mode [ 31.557012][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.627767][ T65] usb 3-1: Using ep0 maxpacket: 32 [ 31.634222][ T65] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 31.634379][ T528] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.644569][ T65] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 31.660923][ T65] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 31.665945][ T528] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.688627][ T65] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 31.698786][ T528] bridge_slave_0: entered allmulticast mode [ 31.705458][ T528] bridge_slave_0: entered promiscuous mode [ 31.707904][ T65] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.720022][ T65] usb 3-1: Product: syz [ 31.724378][ T65] usb 3-1: Manufacturer: syz [ 31.724382][ T292] veth1_macvtap: left promiscuous mode [ 31.724459][ T292] veth0_vlan: left promiscuous mode [ 31.729457][ T65] usb 3-1: SerialNumber: syz [ 31.748087][ T65] cdc_ncm 3-1:1.0: skipping garbage [ 31.753432][ T65] cdc_ncm 3-1:1.0: skipping garbage [ 31.758984][ T65] cdc_ncm 3-1:1.0: CDC Union missing and no IAD found [ 31.765908][ T65] cdc_ncm 3-1:1.0: bind() failure [ 31.835851][ T528] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.844337][ T528] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.852972][ T528] bridge_slave_1: entered allmulticast mode [ 31.859589][ T528] bridge_slave_1: entered promiscuous mode [ 31.969484][ T528] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.976560][ T528] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.983898][ T528] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.990964][ T528] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.010873][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.018413][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.028495][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.035943][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.045630][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.052966][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.080361][ T528] veth0_vlan: entered promiscuous mode [ 32.095974][ T554] /dev/rnullb0: Can't open blockdev [ 32.105165][ T528] veth1_macvtap: entered promiscuous mode [ 32.114568][ T413] usb 3-1: USB disconnect, device number 5 [ 32.146165][ T558] netlink: 28 bytes leftover after parsing attributes in process `syz.3.66'. [ 32.176872][ T561] rust_binder: Write failure EINVAL in pid:2 [ 32.181571][ T36] kauditd_printk_skb: 29 callbacks suppressed [ 32.181592][ T36] audit: type=1400 audit(1756447676.050:194): avc: denied { name_bind } for pid=560 comm="syz.4.59" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 32.215175][ T36] audit: type=1400 audit(1756447676.050:195): avc: denied { block_suspend } for pid=560 comm="syz.4.59" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 32.237058][ T36] audit: type=1400 audit(1756447676.110:196): avc: denied { create } for pid=562 comm="syz.4.67" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 32.260973][ T36] audit: type=1400 audit(1756447676.140:197): avc: denied { create } for pid=562 comm="syz.4.67" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 32.281742][ T36] audit: type=1400 audit(1756447676.140:198): avc: denied { read write } for pid=562 comm="syz.4.67" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 32.304665][ T36] audit: type=1400 audit(1756447676.140:199): avc: denied { open } for pid=562 comm="syz.4.67" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 32.331116][ T36] audit: type=1400 audit(1756447676.170:200): avc: denied { read write } for pid=528 comm="syz-executor" name="loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 32.357329][ T36] audit: type=1400 audit(1756447676.170:201): avc: denied { open } for pid=528 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 32.382116][ T36] audit: type=1400 audit(1756447676.170:202): avc: denied { ioctl } for pid=528 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 32.407584][ T36] audit: type=1400 audit(1756447676.210:203): avc: denied { write } for pid=564 comm="syz.4.68" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 32.567859][ T65] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 32.729117][ T65] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 32.739011][ T65] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 32.748836][ T45] usb 4-1: new low-speed USB device number 3 using dummy_hcd [ 32.758435][ T65] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 32.767593][ T65] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.775661][ T65] usb 5-1: Product: syz [ 32.779896][ T65] usb 5-1: Manufacturer: syz [ 32.785016][ T65] usb 5-1: SerialNumber: syz [ 32.790758][ T65] usb 5-1: config 0 descriptor?? [ 32.796891][ T65] usb 5-1: 0:0 : invalid sync pipe. bmAttributes 00, bLength 9, bSynchAddress 00 [ 32.900031][ T45] usb 4-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 32.910229][ T45] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 32.919152][ T45] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 33.017240][ T65] usb 5-1: USB disconnect, device number 2 [ 33.032284][ T470] udevd[470]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 33.413039][ T600] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:91 [ 33.413195][ T600] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:91 [ 34.249580][ T627] rust_binder: 100: no such ref 1 [ 34.265759][ T627] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 3 [ 34.273177][ T627] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:100 [ 34.274150][ T627] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 4256, size: 18446744073709551610) [ 34.283376][ T627] rust_binder: Error while translating object. [ 34.297998][ T627] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 34.304280][ T627] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:100 [ 34.367740][ T413] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 34.402491][ T629] netlink: 4 bytes leftover after parsing attributes in process `syz.2.90'. [ 34.543168][ T413] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 34.557735][ T413] usb 1-1: can't read configurations, error -61 [ 34.647744][ T344] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 34.697774][ T413] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 34.808218][ T344] usb 3-1: Using ep0 maxpacket: 32 [ 34.816396][ T344] usb 3-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 34.826083][ T344] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.834184][ T344] usb 3-1: Product: syz [ 34.836792][ T632] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 34.838624][ T344] usb 3-1: Manufacturer: syz [ 34.838924][ T632] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:19 [ 34.848313][ T344] usb 3-1: SerialNumber: syz [ 34.869661][ T413] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 34.869707][ T344] usb 3-1: config 0 descriptor?? [ 34.877251][ T413] usb 1-1: can't read configurations, error -61 [ 34.878015][ T413] usb usb1-port1: attempt power cycle [ 35.227791][ T413] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 35.249561][ T413] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 35.257163][ T413] usb 1-1: can't read configurations, error -61 [ 35.289679][ T629] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 35.298326][ T629] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 35.340409][ T629] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 4256, size: 18446744073709551610) [ 35.340437][ T629] rust_binder: Error while translating object. [ 35.352670][ T629] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 35.358900][ T629] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:102 [ 35.387882][ T413] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 35.409286][ T412] usb 3-1: USB disconnect, device number 6 [ 35.420599][ T413] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 35.428298][ T413] usb 1-1: can't read configurations, error -61 [ 35.434705][ T413] usb usb1-port1: unable to enumerate USB device [ 35.503293][ T45] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 35.513032][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.521262][ T637] netlink: 16 bytes leftover after parsing attributes in process `syz.4.93'. [ 35.522647][ T45] usb 4-1: Product: ᆡ粫䊫á¶Ó½ïƒ‡á»¿â¾ë·è²™ê³‰ê¸­çœ‰ì²žâ´»ï¾™èŠ¿à —ﮦ몯₱巄㮻泱渊ꋊˬá´áŸ³ëŒ£æš¾ï©³í‡’è‹¡ [ 35.547732][ T45] usb 4-1: Manufacturer: à¡¡ [ 35.549716][ T637] netlink: 'syz.4.93': attribute type 1 has an invalid length. [ 35.561970][ T45] usb 4-1: can't set config #1, error -71 [ 35.567877][ T640] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 35.567903][ T640] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:68 [ 35.577939][ T45] usb 4-1: USB disconnect, device number 3 [ 35.582366][ T640] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 35.594595][ T640] rust_binder: Read failure Err(EFAULT) in pid:68 [ 35.603842][ T643] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 35.907818][ T344] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 36.008441][ T670] netlink: 4 bytes leftover after parsing attributes in process `syz.2.104'. [ 36.031683][ T670] tc_dump_action: action bad kind [ 36.089183][ T344] usb 5-1: unable to get BOS descriptor or descriptor too short [ 36.103687][ T344] usb 5-1: config 176 has an invalid interface number: 218 but max is 0 [ 36.119818][ T344] usb 5-1: config 176 has no interface number 0 [ 36.147281][ T344] usb 5-1: config 176 interface 218 has no altsetting 0 [ 36.155847][ T344] usb 5-1: New USB device found, idVendor=05ac, idProduct=b231, bcdDevice=85.00 [ 36.175338][ T344] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.188718][ T677] netlink: 104 bytes leftover after parsing attributes in process `syz.2.106'. [ 36.207876][ T344] usb 5-1: Product: syz [ 36.209490][ T678] netlink: 168 bytes leftover after parsing attributes in process `syz.3.103'. [ 36.212109][ T344] usb 5-1: Manufacturer: syz [ 36.240491][ T344] usb 5-1: SerialNumber: syz [ 36.266161][ T680] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 36.266202][ T680] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:113 [ 36.460766][ T344] ipheth 5-1:176.218: Unable to find alternate settings interface [ 36.489089][ T344] usb 5-1: USB disconnect, device number 3 [ 36.527144][ T413] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 36.711323][ T413] usb 4-1: unable to get BOS descriptor or descriptor too short [ 36.728657][ T413] usb 4-1: config 204 has an invalid interface number: 223 but max is 0 [ 36.737043][ T413] usb 4-1: config 204 has an invalid descriptor of length 10, skipping remainder of the config [ 36.747409][ T413] usb 4-1: config 204 has no interface number 0 [ 36.753732][ T413] usb 4-1: config 204 interface 223 has no altsetting 0 [ 36.768915][ T413] usb 4-1: New USB device found, idVendor=0b57, idProduct=5942, bcdDevice=38.7a [ 36.778043][ T413] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.794021][ T413] usb 4-1: Product: syz [ 36.798308][ T690] netlink: 56 bytes leftover after parsing attributes in process `syz.2.110'. [ 36.807220][ T413] usb 4-1: Manufacturer: syz [ 36.812299][ T413] usb 4-1: SerialNumber: syz [ 36.820356][ T690] fuse: Bad value for 'user_id' [ 36.825255][ T690] fuse: Bad value for 'user_id' [ 36.949727][ T694] fuse: Unknown parameter 'gQoup_id' [ 36.959336][ T694] pim6reg1: entered promiscuous mode [ 36.964758][ T694] pim6reg1: entered allmulticast mode [ 37.069369][ T413] usbhid 4-1:204.223: couldn't find an input interrupt endpoint [ 37.088653][ T413] usb 4-1: USB disconnect, device number 4 [ 37.168141][ T700] rust_binder: Error while translating object. [ 37.168176][ T700] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 37.175345][ T700] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:63 [ 37.200366][ T36] kauditd_printk_skb: 91 callbacks suppressed [ 37.200372][ T702] rust_binder: Error while translating object. [ 37.200388][ T36] audit: type=1400 audit(1756447681.080:295): avc: denied { transfer } for pid=701 comm="syz.0.116" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 37.209858][ T702] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 37.240912][ T702] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:65 [ 37.272349][ T36] audit: type=1400 audit(1756447681.150:296): avc: denied { create } for pid=706 comm="syz.2.118" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 37.301532][ T36] audit: type=1400 audit(1756447681.150:297): avc: denied { ioctl } for pid=706 comm="syz.2.118" path="socket:[7263]" dev="sockfs" ino=7263 ioctlcmd=0x8916 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 37.326547][ T36] audit: type=1400 audit(1756447681.150:298): avc: denied { mounton } for pid=706 comm="syz.2.118" path="/dev/binderfs" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 37.328745][ T705] Zero length message leads to an empty skb [ 37.350526][ T36] audit: type=1400 audit(1756447681.150:299): avc: denied { mount } for pid=706 comm="syz.2.118" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 37.358638][ T705] fuse: Unknown parameter '' [ 37.378856][ T36] audit: type=1400 audit(1756447681.160:300): avc: denied { mount } for pid=704 comm="syz.0.117" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 37.405448][ T36] audit: type=1400 audit(1756447681.160:301): avc: denied { mounton } for pid=704 comm="syz.0.117" path="/24/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 37.427665][ T36] audit: type=1400 audit(1756447681.160:302): avc: denied { unmount } for pid=704 comm="syz.0.117" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 37.427814][ T412] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 37.447348][ T36] audit: type=1400 audit(1756447681.180:303): avc: denied { unmount } for pid=291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 37.447378][ T36] audit: type=1400 audit(1756447681.210:304): avc: denied { nlmsg_write } for pid=704 comm="syz.0.117" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 37.622962][ T721] rust_binder: Failed to allocate buffer. len:4256, is_oneway:false [ 37.622991][ T721] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 37.623005][ T720] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 4256, size: 18446744073709551610) [ 37.623021][ T720] rust_binder: Error while translating object. [ 37.631148][ T721] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:91 [ 37.640822][ T720] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 37.652748][ T412] usb 5-1: device descriptor read/64, error -71 [ 37.684034][ T720] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:91 [ 37.733705][ T729] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:100 [ 37.742854][ T344] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 37.764001][ T731] netlink: 3 bytes leftover after parsing attributes in process `syz.3.127'. [ 37.774402][ T731] netlink: 3 bytes leftover after parsing attributes in process `syz.3.127'. [ 37.783271][ T731] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 37.897765][ T412] usb 5-1: device descriptor read/64, error -71 [ 37.908181][ T344] usb 3-1: too many configurations: 184, using maximum allowed: 8 [ 37.917327][ T344] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 37.925076][ T344] usb 3-1: can't read configurations, error -61 [ 37.961696][ T751] overlayfs: failed to clone upperpath [ 38.057794][ T344] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 38.147758][ T412] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 38.208304][ T344] usb 3-1: too many configurations: 184, using maximum allowed: 8 [ 38.217265][ T344] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 38.224930][ T344] usb 3-1: can't read configurations, error -61 [ 38.231399][ T344] usb usb3-port1: attempt power cycle [ 38.277785][ T412] usb 5-1: device descriptor read/64, error -71 [ 38.486998][ T757] sit0: entered promiscuous mode [ 38.492940][ T757] netlink: 1 bytes leftover after parsing attributes in process `syz.0.136'. [ 38.517787][ T412] usb 5-1: device descriptor read/64, error -71 [ 38.567734][ T344] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 38.588498][ T344] usb 3-1: too many configurations: 184, using maximum allowed: 8 [ 38.597987][ T344] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 38.609267][ T344] usb 3-1: can't read configurations, error -61 [ 38.629353][ T412] usb usb5-port1: attempt power cycle [ 38.694661][ T779] rust_binder: inc_ref_done called when no active inc_refs [ 38.694686][ T779] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 38.713969][ T779] rust_binder: 109: no such ref 4 [ 38.719407][ T779] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:109 [ 38.748110][ T344] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 38.772688][ T782] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:109 [ 38.778539][ T344] usb 3-1: too many configurations: 184, using maximum allowed: 8 [ 38.796775][ T344] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 38.801085][ T786] overlayfs: failed to clone upperpath [ 38.804732][ T344] usb 3-1: can't read configurations, error -61 [ 38.816450][ T344] usb usb3-port1: unable to enumerate USB device [ 38.828175][ T788] /dev/loop0: Can't lookup blockdev [ 38.987796][ T412] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 39.008846][ T412] usb 5-1: device descriptor read/8, error -71 [ 39.138789][ T412] usb 5-1: device descriptor read/8, error -71 [ 39.377776][ T412] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 39.398778][ T412] usb 5-1: device descriptor read/8, error -71 [ 39.528871][ T412] usb 5-1: device descriptor read/8, error -71 [ 39.648062][ T412] usb usb5-port1: unable to enumerate USB device [ 39.777764][ T344] usb 4-1: new low-speed USB device number 5 using dummy_hcd [ 39.927730][ T344] usb 4-1: Invalid ep0 maxpacket: 32 [ 40.057787][ T344] usb 4-1: new low-speed USB device number 6 using dummy_hcd [ 40.207753][ T344] usb 4-1: Invalid ep0 maxpacket: 32 [ 40.216416][ T344] usb usb4-port1: attempt power cycle [ 40.299043][ T828] netlink: 5308 bytes leftover after parsing attributes in process `syz.0.158'. [ 40.309177][ T828] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=828 comm=syz.0.158 [ 40.353363][ T830] overlayfs: failed to clone upperpath [ 40.383915][ T834] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2049 sclass=netlink_route_socket pid=834 comm=syz.0.161 [ 40.515745][ T842] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:55 [ 40.521186][ T845] tmpfs: Bad value for 'nr_inodes' [ 40.557755][ T344] usb 4-1: new low-speed USB device number 7 using dummy_hcd [ 40.558939][ T852] fuse: Bad value for 'group_id' [ 40.570656][ T852] fuse: Bad value for 'group_id' [ 40.578126][ T344] usb 4-1: Invalid ep0 maxpacket: 32 [ 40.658176][ T863] tipc: Started in network mode [ 40.663196][ T863] tipc: Node identity ac141413, cluster identity 4711 [ 40.670184][ T863] tipc: New replicast peer: 10.1.1.2 [ 40.675852][ T863] tipc: Enabled bearer , priority 10 [ 40.707783][ T344] usb 4-1: new low-speed USB device number 8 using dummy_hcd [ 40.728123][ T344] usb 4-1: Invalid ep0 maxpacket: 32 [ 40.733622][ T344] usb usb4-port1: unable to enumerate USB device [ 40.857743][ T413] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 40.969868][ T881] netlink: 16 bytes leftover after parsing attributes in process `syz.0.175'. [ 41.007836][ T413] usb 3-1: Using ep0 maxpacket: 32 [ 41.014248][ T413] usb 3-1: config 0 has an invalid interface number: 148 but max is 0 [ 41.022524][ T413] usb 3-1: config 0 has no interface number 0 [ 41.028726][ T413] usb 3-1: config 0 interface 148 has no altsetting 0 [ 41.037053][ T413] usb 3-1: New USB device found, idVendor=067b, idProduct=0307, bcdDevice=dd.c8 [ 41.046146][ T413] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.054187][ T413] usb 3-1: Product: syz [ 41.058366][ T413] usb 3-1: Manufacturer: syz [ 41.062963][ T413] usb 3-1: SerialNumber: syz [ 41.068339][ T413] usb 3-1: config 0 descriptor?? [ 41.074147][ T413] pl2303 3-1:0.148: required interrupt-in endpoint missing [ 41.276051][ T413] usb 3-1: USB disconnect, device number 11 [ 41.332724][ T883] /dev/nbd4: Can't lookup blockdev [ 41.410668][ T887] pim6reg1: entered promiscuous mode [ 41.415998][ T887] pim6reg1: entered allmulticast mode [ 41.471159][ T889] 9pnet_fd: Insufficient options for proto=fd [ 41.481868][ T889] rust_binder: Write failure EINVAL in pid:79 [ 41.789889][ T413] tipc: Node number set to 2886997011 [ 41.962847][ T928] mmap: syz.2.192 (928) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 42.090066][ T944] x_tables: duplicate underflow at hook 2 [ 42.096894][ T944] overlay: Unknown parameter 'obj_type' [ 42.216938][ T36] kauditd_printk_skb: 41 callbacks suppressed [ 42.216960][ T36] audit: type=1400 audit(1756447686.091:346): avc: denied { read } for pid=962 comm="syz.0.206" name="/" dev="configfs" ino=2624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 42.256222][ T36] audit: type=1400 audit(1756447686.121:347): avc: denied { open } for pid=962 comm="syz.0.206" path="/" dev="configfs" ino=2624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 42.297740][ T413] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 42.427746][ T413] usb 3-1: device descriptor read/64, error -71 [ 42.603127][ T36] audit: type=1400 audit(1756447686.481:348): avc: denied { read } for pid=975 comm="syz.0.211" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 42.622939][ T977] 9pnet_fd: Insufficient options for proto=fd [ 42.638357][ T977] netlink: 4 bytes leftover after parsing attributes in process `syz.0.211'. [ 42.639358][ T36] audit: type=1400 audit(1756447686.521:349): avc: denied { bind } for pid=979 comm="syz.3.213" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 42.674102][ T413] usb 3-1: device descriptor read/64, error -71 [ 42.683198][ T36] audit: type=1400 audit(1756447686.561:350): avc: denied { setopt } for pid=979 comm="syz.3.213" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 42.728249][ T36] audit: type=1400 audit(1756447686.611:351): avc: denied { read } for pid=986 comm="syz.3.215" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 42.751899][ T36] audit: type=1400 audit(1756447686.611:352): avc: denied { open } for pid=986 comm="syz.3.215" path="/dev/ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 42.775222][ T412] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 42.785267][ T36] audit: type=1400 audit(1756447686.661:353): avc: denied { connect } for pid=989 comm="syz.3.216" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 42.893220][ T36] audit: type=1400 audit(1756447686.771:354): avc: denied { ioctl } for pid=993 comm="syz.3.218" path="/dev/ptp0" dev="devtmpfs" ino=196 ioctlcmd=0x54a0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 42.927808][ T412] usb 5-1: Using ep0 maxpacket: 8 [ 42.937755][ T413] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 42.946291][ T36] audit: type=1400 audit(1756447686.821:355): avc: denied { bind } for pid=993 comm="syz.3.218" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 42.958027][ T412] usb 5-1: unable to get BOS descriptor or descriptor too short [ 42.974829][ T412] usb 5-1: config 6 has an invalid interface number: 215 but max is 0 [ 42.983464][ T412] usb 5-1: config 6 has no interface number 0 [ 42.989675][ T412] usb 5-1: config 6 interface 215 altsetting 5 has an endpoint descriptor with address 0x1B, changing to 0xB [ 43.006723][ T412] usb 5-1: config 6 interface 215 altsetting 5 endpoint 0xB has invalid maxpacket 1999, setting to 1024 [ 43.018546][ T412] usb 5-1: config 6 interface 215 altsetting 5 bulk endpoint 0xB has invalid maxpacket 1024 [ 43.028839][ T412] usb 5-1: config 6 interface 215 altsetting 5 bulk endpoint 0x6 has invalid maxpacket 64 [ 43.038873][ T412] usb 5-1: config 6 interface 215 has no altsetting 0 [ 43.047103][ T412] usb 5-1: New USB device found, idVendor=0c52, idProduct=2442, bcdDevice=f8.3f [ 43.058765][ T412] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.067518][ T412] usb 5-1: Product: syz [ 43.072088][ T412] usb 5-1: Manufacturer: syz [ 43.076841][ T412] usb 5-1: SerialNumber: syz [ 43.081503][ T413] usb 3-1: device descriptor read/64, error -71 [ 43.090537][ T972] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 43.098113][ T972] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 43.202252][ T1008] cgroup: Invalid name [ 43.207147][ T1008] rust_binder: got new transaction with bad transaction stack [ 43.207168][ T1008] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:144 [ 43.276322][ T1013] rust_binder: Failed to allocate buffer. len:18446744073709551488, is_oneway:false [ 43.285555][ T1013] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 43.295336][ T1013] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:146 [ 43.305288][ T1013] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:146 [ 43.316725][ T972] rust_binder: validate_parent_fixup: new_min_offset=42, sg_entry.length=0 [ 43.327773][ T413] usb 3-1: device descriptor read/64, error -71 [ 43.344316][ T972] rust_binder: Error while translating object. [ 43.344376][ T972] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 43.346582][ T1019] rust_binder: Error while translating object. [ 43.350708][ T972] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:97 [ 43.360502][ T1019] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 43.375739][ T1019] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:151 [ 43.386373][ T412] ftdi_sio 5-1:6.215: FTDI USB Serial Device converter detected [ 43.406952][ T412] ftdi_sio ttyUSB0: unknown device type: 0xf83f [ 43.410362][ T1021] rust_binder: Write failure EFAULT in pid:153 [ 43.415731][ T412] usb 5-1: USB disconnect, device number 8 [ 43.430858][ T412] ftdi_sio 5-1:6.215: device disconnected [ 43.447880][ T413] usb usb3-port1: attempt power cycle [ 43.667775][ T344] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 43.787748][ T413] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 43.809057][ T413] usb 3-1: device descriptor read/8, error -71 [ 43.818741][ T344] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 43.828902][ T344] usb 4-1: config 0 has no interfaces? [ 43.834368][ T344] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 43.843443][ T344] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.851971][ T344] usb 4-1: config 0 descriptor?? [ 43.938841][ T413] usb 3-1: device descriptor read/8, error -71 [ 44.058029][ T9] usb 4-1: USB disconnect, device number 9 [ 44.137763][ T344] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 44.177782][ T413] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 44.202557][ T413] usb 3-1: device descriptor read/8, error -71 [ 44.260134][ T1023] overlay: filesystem on ./bus not supported as upperdir [ 44.287814][ T344] usb 5-1: Using ep0 maxpacket: 32 [ 44.294212][ T344] usb 5-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 44.305337][ T344] usb 5-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 44.315096][ T344] usb 5-1: config 0 interface 0 has no altsetting 0 [ 44.322053][ T344] usb 5-1: New USB device found, idVendor=056a, idProduct=00b9, bcdDevice= 0.00 [ 44.331151][ T344] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.339993][ T344] usb 5-1: config 0 descriptor?? [ 44.350115][ T413] usb 3-1: device descriptor read/8, error -71 [ 44.467967][ T413] usb usb3-port1: unable to enumerate USB device [ 44.697763][ T582] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 44.747920][ T344] wacom 0003:056A:00B9.0002: Unknown device_type for 'HID 056a:00b9'. Assuming pen. [ 44.758165][ T344] wacom 0003:056A:00B9.0002: hidraw0: USB HID v0.00 Device [HID 056a:00b9] on usb-dummy_hcd.4-1/input0 [ 44.770118][ T344] input: Wacom Intuos4 6x9 Pen as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:056A:00B9.0002/input/input4 [ 44.858850][ T582] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 44.869360][ T582] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 44.880313][ T582] usb 4-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 44.894662][ T582] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 44.903916][ T582] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.911966][ T582] usb 4-1: Product: syz [ 44.916166][ T582] usb 4-1: Manufacturer: syz [ 44.920806][ T582] usb 4-1: SerialNumber: syz [ 44.948342][ T344] usb 5-1: USB disconnect, device number 9 [ 45.036260][ T1048] SELinux: Context system_u:object_r:klogd_var_run_t:s0 is not valid (left unmapped). [ 45.427783][ T413] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 45.557747][ T413] usb 3-1: device descriptor read/64, error -71 [ 45.606554][ T1056] fuse: Unknown parameter '2}' [ 45.613394][ T1056] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 45.625824][ T1056] fuse: Bad value for 'user_id' [ 45.630711][ T1056] fuse: Bad value for 'user_id' [ 45.797776][ T413] usb 3-1: device descriptor read/64, error -71 [ 45.877756][ T9] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 45.958248][ T582] cdc_ncm 4-1:1.0: bind() failure [ 45.964156][ T582] cdc_ncm 4-1:1.1: probe with driver cdc_ncm failed with error -71 [ 45.972559][ T582] cdc_mbim 4-1:1.1: probe with driver cdc_mbim failed with error -71 [ 45.981970][ T582] usb 4-1: USB disconnect, device number 10 [ 46.037752][ T413] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 46.046675][ T9] usb 5-1: New USB device found, idVendor=0eef, idProduct=72c4, bcdDevice= 0.00 [ 46.056053][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 46.064984][ T9] usb 5-1: config 0 descriptor?? [ 46.177773][ T413] usb 3-1: device descriptor read/64, error -71 [ 46.273090][ T9] hid-multitouch 0003:0EEF:72C4.0003: unknown main item tag 0x0 [ 46.284311][ T9] hid-multitouch 0003:0EEF:72C4.0003: unknown main item tag 0x0 [ 46.292726][ T9] hid-multitouch 0003:0EEF:72C4.0003: unknown main item tag 0x0 [ 46.303616][ T9] hid-multitouch 0003:0EEF:72C4.0003: hidraw0: USB HID v1.01 Device [HID 0eef:72c4] on usb-dummy_hcd.4-1/input0 [ 46.318789][ T9] usb 5-1: USB disconnect, device number 10 [ 46.358597][ T1084] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 46.437793][ T413] usb 3-1: device descriptor read/64, error -71 [ 46.476130][ T1097] rust_binder: 166: no such ref 0 [ 46.529473][ T1104] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 112, limit: 136, size: 94) [ 46.529494][ T1104] rust_binder: Error while translating object. [ 46.540235][ T1104] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 46.546657][ T1104] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:173 [ 46.548289][ T413] usb usb3-port1: attempt power cycle [ 46.908372][ T413] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 46.940375][ T413] usb 3-1: device descriptor read/8, error -71 [ 46.965010][ T1136] netfs: Couldn't get user pages (rc=-14) [ 47.078763][ T413] usb 3-1: device descriptor read/8, error -71 [ 47.267793][ T9] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 47.277766][ T412] usb 4-1: new low-speed USB device number 11 using dummy_hcd [ 47.317791][ T413] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 47.338770][ T413] usb 3-1: device descriptor read/8, error -71 [ 47.418871][ T9] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 47.426967][ T9] usb 5-1: config 0 has no interface number 0 [ 47.433411][ T9] usb 5-1: too many endpoints for config 0 interface 1 altsetting 0: 64, using maximum allowed: 30 [ 47.444175][ T9] usb 5-1: config 0 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 64 [ 47.457304][ T9] usb 5-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 47.466711][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.476192][ T412] usb 4-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 47.485772][ T9] usb 5-1: config 0 descriptor?? [ 47.490811][ T412] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.500758][ T413] usb 3-1: device descriptor read/8, error -71 [ 47.508790][ T412] usb 4-1: config 0 descriptor?? [ 47.579449][ T1151] netlink: 'syz.0.273': attribute type 1 has an invalid length. [ 47.587357][ T1151] netlink: 9 bytes leftover after parsing attributes in process `syz.0.273'. [ 47.607879][ T413] usb usb3-port1: unable to enumerate USB device [ 47.628426][ T36] kauditd_printk_skb: 25 callbacks suppressed [ 47.628446][ T36] audit: type=1400 audit(1756447691.511:381): avc: denied { bind } for pid=1157 comm="syz.0.275" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 47.665904][ T36] audit: type=1400 audit(1756447691.541:382): avc: denied { ioctl } for pid=1159 comm="syz.0.276" path="socket:[8496]" dev="sockfs" ino=8496 ioctlcmd=0x9414 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 47.717321][ T412] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 47.729063][ T9] usb 5-1: string descriptor 0 read error: -71 [ 47.738798][ T9] snd-usb-audio 5-1:0.1: probe with driver snd-usb-audio failed with error -2 [ 47.742560][ T335] udevd[335]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.1/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 47.748171][ T412] asix 4-1:0.0: probe with driver asix failed with error -71 [ 47.773497][ T9] usb 5-1: USB disconnect, device number 11 [ 47.780169][ T36] audit: type=1400 audit(1756447691.661:383): avc: denied { block_suspend } for pid=1163 comm="syz.0.278" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 47.803752][ T412] usb 4-1: USB disconnect, device number 11 [ 48.066946][ T1168] netlink: 12 bytes leftover after parsing attributes in process `syz.2.279'. [ 48.304801][ T36] audit: type=1400 audit(1756447692.181:384): avc: denied { write } for pid=1183 comm="syz.4.284" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 48.337934][ T36] audit: type=1400 audit(1756447692.211:385): avc: denied { wake_alarm } for pid=1181 comm="syz.3.285" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 48.408300][ T1201] netlink: 8 bytes leftover after parsing attributes in process `syz.2.289'. [ 48.419506][ T36] audit: type=1400 audit(1756447692.301:386): avc: denied { setopt } for pid=1200 comm="syz.0.290" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 48.457167][ T36] audit: type=1400 audit(1756447692.301:387): avc: denied { ioctl } for pid=1200 comm="syz.0.290" path="socket:[8664]" dev="sockfs" ino=8664 ioctlcmd=0x8901 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 48.555430][ T36] audit: type=1400 audit(1756447692.431:388): avc: denied { bind } for pid=1215 comm="syz.2.293" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 48.676900][ T1227] SELinux: security_context_str_to_sid (--^$-) failed with errno=-22 [ 48.731457][ T1231] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 48.731484][ T1231] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:197 [ 48.751648][ T1233] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.763381][ T1233] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.770341][ T1233] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.778772][ T1233] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.785456][ T1233] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.792526][ T1233] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.799076][ T1233] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.805527][ T1233] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.812068][ T1233] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.818695][ T1233] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.825137][ T1233] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.831612][ T1233] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.838167][ T1233] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.844878][ T1233] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.937768][ T344] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 48.985561][ T36] audit: type=1400 audit(1756447692.861:389): avc: denied { map } for pid=1240 comm="syz.0.301" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=8781 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 49.010454][ T36] audit: type=1400 audit(1756447692.861:390): avc: denied { read write } for pid=1240 comm="syz.0.301" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=8781 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 49.055398][ T1249] overlayfs: failed to clone upperpath [ 49.118862][ T344] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 49.129112][ T344] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 49.139074][ T344] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 49.148332][ T344] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 49.156340][ T344] usb 3-1: SerialNumber: syz [ 49.219402][ T1266] rust_binder: 148: no such ref 1 [ 49.238656][ T1268] rust_binder: Write failure EFAULT in pid:150 [ 49.364345][ T344] usb 3-1: 0:2 : does not exist [ 49.377090][ T344] usb 3-1: USB disconnect, device number 20 [ 49.487971][ T582] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 49.638826][ T582] usb 5-1: config 187 has an invalid descriptor of length 122, skipping remainder of the config [ 49.649525][ T582] usb 5-1: config 187 has 0 interfaces, different from the descriptor's value: 1 [ 49.666338][ T582] usb 5-1: New USB device found, idVendor=2a39, idProduct=3f8c, bcdDevice=94.24 [ 49.675821][ T582] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.684098][ T582] usb 5-1: Product: syz [ 49.688592][ T582] usb 5-1: Manufacturer: syz [ 49.693261][ T582] usb 5-1: SerialNumber: syz [ 49.709546][ T1288] netlink: 80 bytes leftover after parsing attributes in process `syz.0.317'. [ 49.721670][ T1287] netlink: 'syz.0.317': attribute type 27 has an invalid length. [ 49.820274][ T1295] FAT-fs (rnullb0): bogus number of reserved sectors [ 49.831420][ T1295] FAT-fs (rnullb0): Can't find a valid FAT filesystem [ 49.943746][ T1305] 9pnet_fd: p9_fd_create_tcp (1305): problem connecting socket to 127.0.0.1 [ 49.961241][ T1305] fuse: Bad value for 'rootmode' [ 50.071554][ T1317] netlink: 32 bytes leftover after parsing attributes in process `syz.0.326'. [ 50.072554][ T1318] netlink: 32 bytes leftover after parsing attributes in process `syz.0.326'. [ 50.198652][ T1327] x_tables: duplicate underflow at hook 4 [ 50.296603][ T1340] netlink: 28 bytes leftover after parsing attributes in process `syz.0.334'. [ 50.310816][ T582] usb 5-1: USB disconnect, device number 12 [ 50.384731][ T1350] fuse: Unknown parameter '$Ïæñ1Þ3>ÐøÎÅJT¾£N½4zãÛ uòvÏiæŒWÉV4HÌ0ñ…L¯øCFÇÒpUæ[$Œºc²Óí±ðƒƒÅ Ð;¨4䇧' [ 50.427730][ T412] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 50.507735][ T413] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 50.588850][ T412] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 50.599816][ T412] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 50.609456][ T412] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 50.618461][ T412] usb 3-1: config 0 descriptor?? [ 50.658960][ T413] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 50.670019][ T413] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 50.679812][ T413] usb 4-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 50.688889][ T413] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 50.697503][ T413] usb 4-1: config 0 descriptor?? [ 50.826166][ T412] usbhid 3-1:0.0: can't add hid device: -71 [ 50.833492][ T412] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 50.842748][ T412] usb 3-1: USB disconnect, device number 21 [ 50.944646][ T1361] veth1: entered allmulticast mode [ 50.951592][ T1360] veth1: left allmulticast mode [ 50.967343][ T1364] overlayfs: failed to clone upperpath [ 51.106224][ T413] isku 0003:1E7D:319C.0004: hidraw0: USB HID v0.00 Device [HID 1e7d:319c] on usb-dummy_hcd.3-1/input0 [ 51.187729][ T9] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 51.277749][ T582] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 51.348872][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 51.360178][ T9] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 51.369404][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.380109][ T9] usb 5-1: config 0 descriptor?? [ 51.449028][ T582] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 51.460217][ T582] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 51.475944][ T582] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 51.485270][ T582] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.494157][ T582] usb 3-1: config 0 descriptor?? [ 51.508107][ T45] usb 4-1: USB disconnect, device number 12 [ 51.590990][ T9] usbhid 5-1:0.0: can't add hid device: -71 [ 51.597469][ T9] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 51.606316][ T9] usb 5-1: USB disconnect, device number 13 [ 51.911376][ T582] plantronics 0003:047F:FFFF.0005: No inputs registered, leaving [ 51.920419][ T582] plantronics 0003:047F:FFFF.0005: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 52.027747][ T9] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 52.116703][ T1390] rust_binder: Write failure EFAULT in pid:223 [ 52.178769][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 52.196058][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 52.209054][ T9] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 52.218173][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 52.227043][ T9] usb 5-1: config 0 descriptor?? [ 52.635586][ T9] plantronics 0003:047F:FFFF.0006: No inputs registered, leaving [ 52.643542][ T36] kauditd_printk_skb: 1251 callbacks suppressed [ 52.643559][ T36] audit: type=1326 audit(1756447696.521:1642): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1381 comm="syz.0.349" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7ff1675c14a5 code=0x7ffc0000 [ 52.645015][ T9] plantronics 0003:047F:FFFF.0006: hiddev97,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 52.654120][ T36] audit: type=1326 audit(1756447696.521:1643): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1381 comm="syz.0.349" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7ff1675c14a5 code=0x7ffc0000 [ 52.726236][ T36] audit: type=1326 audit(1756447696.551:1644): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1381 comm="syz.0.349" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7ff1675c14a5 code=0x7ffc0000 [ 52.756866][ T36] audit: type=1326 audit(1756447696.551:1645): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1381 comm="syz.0.349" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7ff1675c14a5 code=0x7ffc0000 [ 52.780508][ T36] audit: type=1326 audit(1756447696.551:1646): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1381 comm="syz.0.349" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7ff1675c14a5 code=0x7ffc0000 [ 52.804388][ T36] audit: type=1326 audit(1756447696.561:1647): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1381 comm="syz.0.349" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7ff1675c14a5 code=0x7ffc0000 [ 52.828349][ T1402] netlink: 8 bytes leftover after parsing attributes in process `syz.3.353'. [ 52.837248][ T36] audit: type=1326 audit(1756447696.561:1648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1381 comm="syz.0.349" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7ff1675c14a5 code=0x7ffc0000 [ 52.860959][ T36] audit: type=1326 audit(1756447696.561:1649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1381 comm="syz.0.349" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7ff1675c14a5 code=0x7ffc0000 [ 52.892644][ T36] audit: type=1326 audit(1756447696.561:1650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1381 comm="syz.0.349" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7ff1675c14a5 code=0x7ffc0000 [ 52.916136][ T36] audit: type=1326 audit(1756447696.561:1651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1381 comm="syz.0.349" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7ff1675c14a5 code=0x7ffc0000 [ 53.187188][ T582] usb 3-1: USB disconnect, device number 22 [ 53.654272][ T1412] binder: Bad value for 'stats' [ 53.673638][ T1414] rust_binder: Error while translating object. [ 53.673688][ T1414] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 53.680079][ T1414] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:241 [ 53.806061][ T1440] netlink: 12 bytes leftover after parsing attributes in process `syz.3.365'. [ 53.841082][ T1443] /dev/rnullb0: Can't open blockdev [ 53.859159][ T1445] rust_binder: 272: no such ref 0 [ 53.864694][ T1445] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 53.864713][ T1445] rust_binder: Read failure Err(EFAULT) in pid:272 [ 53.873325][ T1445] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.159627][ T1450] 9pnet_fd: Insufficient options for proto=fd [ 54.207806][ T9] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 54.325136][ T412] usb 5-1: USB disconnect, device number 14 [ 54.357736][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 54.366015][ T9] usb 4-1: config 1 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 54.380152][ T9] usb 4-1: config 1 interface 0 has no altsetting 0 [ 54.388682][ T9] usb 4-1: New USB device found, idVendor=0c70, idProduct=f011, bcdDevice= 0.40 [ 54.398218][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.406226][ T9] usb 4-1: Product: syz [ 54.410443][ T9] usb 4-1: Manufacturer: syz [ 54.415036][ T9] usb 4-1: SerialNumber: syz [ 54.624769][ T9] usbhid 4-1:1.0: can't add hid device: -71 [ 54.630808][ T9] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 54.639677][ T9] usb 4-1: USB disconnect, device number 13 [ 54.929018][ T1509] /dev/rnullb0: Can't lookup blockdev [ 55.137801][ T1515] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 55.137829][ T1515] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:274 [ 55.171509][ T1519] /dev/rnullb0: Can't open blockdev [ 55.213750][ T1526] bridge0: port 3(ip6gretap0) entered blocking state [ 55.223643][ T1526] bridge0: port 3(ip6gretap0) entered disabled state [ 55.230575][ T1526] ip6gretap0: entered allmulticast mode [ 55.236704][ T1526] ip6gretap0: entered promiscuous mode [ 55.242402][ T1526] bridge0: port 3(ip6gretap0) entered blocking state [ 55.249143][ T1526] bridge0: port 3(ip6gretap0) entered forwarding state [ 55.283589][ T1535] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 55.476215][ T1550] overlayfs: failed to clone upperpath [ 55.527751][ T582] usb 5-1: new full-speed USB device number 15 using dummy_hcd [ 55.678789][ T582] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1632, setting to 64 [ 55.689758][ T582] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 55.702583][ T582] usb 5-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 55.711646][ T582] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 55.720307][ T582] usb 5-1: config 0 descriptor?? [ 55.725698][ T1535] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 56.136097][ T582] usbhid 5-1:0.0: can't add hid device: -71 [ 56.142173][ T582] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 56.151049][ T582] usb 5-1: USB disconnect, device number 15 [ 56.222659][ T1561] netlink: 32 bytes leftover after parsing attributes in process `syz.3.403'. [ 56.276192][ T1565] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 56.276226][ T1566] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 56.341166][ T1566] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:309 [ 56.597768][ T412] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 56.651385][ T1571] netlink: 8 bytes leftover after parsing attributes in process `syz.4.406'. [ 56.752342][ T1591] 9pnet_fd: Insufficient options for proto=fd [ 56.758904][ T412] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 56.769680][ T412] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 56.779534][ T412] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 56.791514][ T412] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 56.800505][ T412] usb 3-1: SerialNumber: syz [ 56.805222][ T1596] tmpfs: Unknown parameter 'h^ge' [ 57.029653][ T412] usb 3-1: 0:2 : does not exist [ 57.034568][ T412] usb 3-1: unit 14 not found! [ 57.044470][ T412] usb 3-1: USB disconnect, device number 23 [ 57.387760][ T413] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 57.517732][ T413] usb 4-1: device descriptor read/64, error -71 [ 57.670396][ T1625] rust_binder: Write failure EINVAL in pid:216 [ 57.757797][ T413] usb 4-1: device descriptor read/64, error -71 [ 57.794560][ T1640] rust_binder: 222: no such ref 3 [ 57.811028][ T36] kauditd_printk_skb: 963 callbacks suppressed [ 57.811047][ T36] audit: type=1400 audit(1756447701.691:2615): avc: denied { execstack } for pid=1641 comm="syz.0.430" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 57.878494][ T36] audit: type=1400 audit(1756447701.761:2616): avc: denied { create } for pid=1650 comm="syz.2.434" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ipx_socket permissive=1 [ 57.898223][ T36] audit: type=1400 audit(1756447701.761:2617): avc: denied { ioctl } for pid=1650 comm="syz.2.434" path="socket:[10939]" dev="sockfs" ino=10939 ioctlcmd=0x9429 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 57.926865][ T1656] rust_binder: Failed copying into alloc: EFAULT [ 57.926890][ T1656] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 57.933467][ T1656] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 57.941989][ T1656] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:228 [ 57.976769][ T36] audit: type=1400 audit(1756447701.851:2618): avc: denied { bind } for pid=1665 comm="syz.0.441" lport=4 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 57.993159][ T1673] 9pnet_fd: Insufficient options for proto=fd [ 58.010742][ T36] audit: type=1400 audit(1756447701.851:2619): avc: denied { name_bind } for pid=1665 comm="syz.0.441" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 58.012204][ T413] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 58.035391][ T36] audit: type=1400 audit(1756447701.851:2620): avc: denied { node_bind } for pid=1665 comm="syz.0.441" saddr=224.0.0.1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 58.098859][ T1691] netlink: 24 bytes leftover after parsing attributes in process `syz.2.448'. [ 58.109795][ T1693] overlayfs: failed to clone upperpath [ 58.113275][ T36] audit: type=1400 audit(1756447701.991:2621): avc: denied { mount } for pid=1692 comm="syz.0.449" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 58.177739][ T413] usb 4-1: device descriptor read/64, error -71 [ 58.260464][ T1704] syz.0.454: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz0,mems_allowed=0 [ 58.278561][ T1704] CPU: 1 UID: 0 PID: 1704 Comm: syz.0.454 Not tainted syzkaller #0 a8cf528afde17777b8d0df17d514b1350887467d [ 58.278590][ T1704] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2025 [ 58.278602][ T1704] Call Trace: [ 58.278608][ T1704] [ 58.278614][ T1704] __dump_stack+0x21/0x30 [ 58.278642][ T1704] dump_stack_lvl+0x10c/0x190 [ 58.278665][ T1704] ? __cfi_dump_stack_lvl+0x10/0x10 [ 58.278686][ T1704] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 58.278711][ T1704] dump_stack+0x19/0x20 [ 58.278732][ T1704] warn_alloc+0x1bc/0x2a0 [ 58.278753][ T1704] ? stack_depot_save_flags+0x38/0x800 [ 58.278771][ T1704] ? __cfi_warn_alloc+0x10/0x10 [ 58.278791][ T1704] ? kasan_save_track+0x4f/0x80 [ 58.278809][ T1704] ? __kmalloc_cache_noprof+0x1a5/0x3c0 [ 58.278834][ T1704] ? xskq_create+0x68/0x2a0 [ 58.278858][ T1704] ? xsk_init_queue+0xb6/0x120 [ 58.278880][ T1704] ? xsk_setsockopt+0x43f/0x6f0 [ 58.278903][ T1704] ? do_sock_setsockopt+0x26a/0x400 [ 58.278927][ T1704] ? __x64_sys_setsockopt+0x1b8/0x250 [ 58.278950][ T1704] ? x64_sys_call+0x2adc/0x2ee0 [ 58.278974][ T1704] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 58.278993][ T1704] __vmalloc_node_range_noprof+0x135/0x1420 [ 58.279020][ T1704] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 58.279044][ T1704] ? avc_has_perm+0x144/0x220 [ 58.279067][ T1704] ? kasan_save_alloc_info+0x40/0x50 [ 58.279090][ T1704] ? __kasan_kmalloc+0x96/0xb0 [ 58.279109][ T1704] vmalloc_user_noprof+0x77/0x90 [ 58.279131][ T1704] ? xskq_create+0xdb/0x2a0 [ 58.279154][ T1704] xskq_create+0xdb/0x2a0 [ 58.279177][ T1704] xsk_init_queue+0xb6/0x120 [ 58.279199][ T1704] xsk_setsockopt+0x43f/0x6f0 [ 58.279223][ T1704] ? __cfi_xsk_setsockopt+0x10/0x10 [ 58.279255][ T1704] ? do_futex+0x309/0x500 [ 58.279274][ T1704] ? bpf_lsm_socket_setsockopt+0xd/0x20 [ 58.279295][ T1704] ? security_socket_setsockopt+0x33/0xd0 [ 58.279312][ T1704] ? __cfi_xsk_setsockopt+0x10/0x10 [ 58.279335][ T1704] do_sock_setsockopt+0x26a/0x400 [ 58.279359][ T1704] ? __cfi_do_sock_setsockopt+0x10/0x10 [ 58.279385][ T1704] __x64_sys_setsockopt+0x1b8/0x250 [ 58.279409][ T1704] x64_sys_call+0x2adc/0x2ee0 [ 58.279433][ T1704] do_syscall_64+0x58/0xf0 [ 58.279454][ T1704] ? clear_bhb_loop+0x50/0xa0 [ 58.279472][ T1704] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 58.279490][ T1704] RIP: 0033:0x7ff16758ebe9 [ 58.279506][ T1704] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 58.279521][ T1704] RSP: 002b:00007ff16844f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 58.279542][ T1704] RAX: ffffffffffffffda RBX: 00007ff1677b5fa0 RCX: 00007ff16758ebe9 [ 58.279556][ T1704] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000005 [ 58.279569][ T1704] RBP: 00007ff167611e19 R08: 0000000000000004 R09: 0000000000000000 [ 58.279581][ T1704] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 58.279593][ T1704] R13: 00007ff1677b6038 R14: 00007ff1677b5fa0 R15: 00007ffeec6a2b58 [ 58.279609][ T1704] [ 58.279616][ T1704] Mem-Info: [ 58.338784][ T1706] random: crng reseeded on system resumption [ 58.341748][ T36] audit: type=1400 audit(1756447702.221:2622): avc: denied { write } for pid=1705 comm="syz.2.455" name="snapshot" dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 58.398724][ T1708] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 58.405366][ T1704] active_anon:14602 inactive_anon:3 isolated_anon:0 [ 58.405366][ T1704] active_file:19198 inactive_file:2215 isolated_file:0 [ 58.405366][ T1704] unevictable:2048 dirty:70 writeback:0 [ 58.405366][ T1704] slab_reclaimable:5060 slab_unreclaimable:70954 [ 58.405366][ T1704] mapped:32469 shmem:8314 pagetables:951 [ 58.405366][ T1704] sec_pagetables:0 bounce:0 [ 58.405366][ T1704] kernel_misc_reclaimable:0 [ 58.405366][ T1704] free:1518587 free_pcp:3121 free_cma:0 [ 58.417755][ T1708] rust_binder: Read failure Err(EFAULT) in pid:240 [ 58.420000][ T1704] Node 0 active_anon:60208kB inactive_anon:12kB active_file:76792kB inactive_file:8860kB unevictable:8192kB isolated(anon):0kB isolated(file):0kB mapped:131476kB dirty:280kB writeback:0kB shmem:34956kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:5392kB pagetables:3804kB sec_pagetables:0kB all_unreclaimable? no [ 58.429438][ T413] usb 4-1: device descriptor read/64, error -71 [ 58.436360][ T1704] DMA32 free:2960212kB boost:0kB min:19088kB low:23860kB high:28632kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145324kB managed:2965964kB mlocked:0kB bounce:0kB free_pcp:5752kB local_pcp:0kB free_cma:0kB [ 58.541505][ T1712] netlink: 'syz.2.457': attribute type 8 has an invalid length. [ 58.545489][ T1704] lowmem_reserve[]: [ 58.553641][ T413] usb usb4-port1: attempt power cycle [ 58.561690][ T1704] 0 3921 3921 [ 58.762880][ T1704] Normal free:3082324kB boost:0kB min:25964kB low:32452kB high:38940kB reserved_highatomic:0KB free_highatomic:0KB active_anon:68408kB inactive_anon:12kB active_file:76892kB inactive_file:15460kB unevictable:13892kB writepending:280kB present:5242880kB managed:4016120kB mlocked:13992kB bounce:0kB free_pcp:15528kB local_pcp:1460kB free_cma:0kB [ 58.797360][ T1704] lowmem_reserve[]: 0 0 0 [ 58.801822][ T1704] DMA32: 5*4kB (M) 4*8kB (M) 4*16kB (M) 5*32kB (M) 3*64kB (M) 3*128kB (M) 4*256kB (M) 4*512kB (M) 5*1024kB (UM) 5*2048kB (M) 718*4096kB (M) = 2960212kB [ 58.817466][ T1704] Normal: 107*4kB (UME) 390*8kB (UME) 760*16kB (UME) 387*32kB (UME) 284*64kB (UME) 105*128kB (UE) 36*256kB (UME) 4*512kB (UE) 1*1024kB (M) 4*2048kB (UME) 737*4096kB (UM) = 3098940kB [ 58.839288][ T1704] 31301 total pagecache pages [ 58.844156][ T1704] 3 pages in swap cache [ 58.848428][ T1717] syz.2.459 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 58.859140][ T1704] Free swap = 124696kB [ 58.863387][ T1704] Total swap = 124996kB [ 58.873136][ T1704] 2097051 pages RAM [ 58.877045][ T1704] 0 pages HighMem/MovableOnly [ 58.883588][ T1704] 351530 pages reserved [ 58.888017][ T1704] 0 pages cma reserved [ 58.894541][ T1704] Memory allocations: [ 58.898600][ T1704] 0 B 0 init/main.c:1370 func:do_initcalls [ 58.907502][ T1704] 0 B 0 init/do_mounts.c:186 func:mount_root_generic [ 58.917766][ T413] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 58.937713][ T1704] 0 B 0 init/do_mounts.c:158 func:do_mount_root [ 58.945399][ T1704] 0 B 0 init/do_mounts.c:352 func:mount_nodev_root [ 58.948722][ T413] usb 4-1: device descriptor read/8, error -71 [ 58.953342][ T1704] 0 B 0 init/do_mounts_rd.c:241 func:rd_load_image [ 58.977704][ T1704] 0 B 0 init/do_mounts_rd.c:72 func:identify_ramdisk_image [ 58.986337][ T1704] 0 B 0 init/initramfs.c:507 func:unpack_to_rootfs [ 58.997713][ T1704] 0 B 0 init/initramfs.c:508 func:unpack_to_rootfs [ 59.005650][ T1704] 0 B 0 init/initramfs.c:509 func:unpack_to_rootfs [ 59.013686][ T1704] 0 B 0 init/initramfs.c:101 func:find_link [ 59.077083][ T1735] netlink: 'syz.0.465': attribute type 27 has an invalid length. [ 59.085517][ T1735] overlayfs: failed to clone upperpath [ 59.088975][ T413] usb 4-1: device descriptor read/8, error -71 [ 59.218147][ T36] audit: type=1400 audit(1756447703.101:2623): avc: denied { read } for pid=1736 comm="syz.0.466" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 59.337754][ T413] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 59.368774][ T413] usb 4-1: device descriptor read/8, error -71 [ 59.498702][ T413] usb 4-1: device descriptor read/8, error -71 [ 59.607803][ T413] usb usb4-port1: unable to enumerate USB device [ 59.824490][ T1741] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 59.824523][ T1741] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 59.831183][ T1741] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 59.850774][ T1741] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 59.850803][ T1741] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 59.862115][ T1741] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 59.868769][ T1741] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 59.875304][ T1741] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 59.890010][ T1741] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 59.896661][ T1741] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 59.903217][ T1741] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 59.918705][ T1741] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 60.060395][ T1751] rust_binder: Error while translating object. [ 60.067045][ T1751] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 60.073658][ T1751] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:261 [ 60.102395][ T36] audit: type=1400 audit(1756447703.981:2624): avc: denied { create } for pid=1756 comm="syz.4.472" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 60.165192][ T1762] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 60.172193][ T1761] rust_binder: Error in use_page_slow: ESRCH [ 60.172216][ T1761] rust_binder: use_range failure ESRCH [ 60.178264][ T1761] rust_binder: Failed to allocate buffer. len:4256, is_oneway:false [ 60.183823][ T1761] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 60.192028][ T1761] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:204 [ 60.213258][ T1764] rust_binder: Write failure EFAULT in pid:207 [ 60.327748][ T412] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 60.333868][ T1770] rust_binder: Error while translating object. [ 60.342382][ T1770] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 60.348670][ T1770] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:319 [ 60.364938][ T1772] binder: Unknown parameter 'contextÀ' [ 60.488788][ T412] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 60.499050][ T412] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 60.508802][ T412] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 60.527744][ T412] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 60.535870][ T412] usb 3-1: SerialNumber: syz [ 60.770671][ T412] usb 3-1: 0:2 : does not exist [ 60.778884][ T412] usb 3-1: unit 5: unexpected type 0x0c [ 60.799310][ T412] usb 3-1: USB disconnect, device number 24 [ 60.810378][ T335] udevd[335]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 61.123053][ T1793] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found [ 61.131838][ T1793] rust_binder: Write failure EINVAL in pid:225 [ 61.176826][ T1800] SELinux: security_context_str_to_sid (syste_uÝGй ‰:ÿß) failed with errno=-22 [ 61.249182][ T1805] FAT-fs (rnullb0): bogus number of reserved sectors [ 61.255941][ T1805] FAT-fs (rnullb0): Can't find a valid FAT filesystem [ 61.360657][ T1820] rust_binder: Error while translating object. [ 61.360694][ T1820] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 61.367010][ T1820] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:235 [ 61.637733][ T344] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 61.777782][ T344] usb 5-1: device descriptor read/64, error -71 [ 62.017735][ T344] usb 5-1: device descriptor read/64, error -71 [ 62.267754][ T344] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 62.300532][ T1837] process 'syz.0.502' launched './file0' with NULL argv: empty string added [ 62.300532][ T1836] process 'syz.0.502' launched './file0' with NULL argv: empty string added [ 62.327723][ T329] usb 3-1: new low-speed USB device number 25 using dummy_hcd [ 62.397780][ T344] usb 5-1: device descriptor read/64, error -71 [ 62.479039][ T329] usb 3-1: config index 0 descriptor too short (expected 1307, got 27) [ 62.487506][ T329] usb 3-1: config 0 has an invalid interface number: 0 but max is -1 [ 62.495679][ T329] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 62.504613][ T329] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 62.515457][ T329] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 62.527031][ T329] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 62.538319][ T329] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 62.549309][ T329] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 62.564318][ T329] usb 3-1: string descriptor 0 read error: -22 [ 62.570611][ T329] usb 3-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 62.579671][ T329] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 62.588441][ T329] usb 3-1: config 0 descriptor?? [ 62.593668][ T1831] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 62.601334][ T329] hub 3-1:0.0: bad descriptor, ignoring hub [ 62.607246][ T329] hub 3-1:0.0: probe with driver hub failed with error -5 [ 62.615012][ T329] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input9 [ 62.647747][ T344] usb 5-1: device descriptor read/64, error -71 [ 62.757865][ T344] usb usb5-port1: attempt power cycle [ 62.801589][ T1831] mmap: syz.2.500 (1831): VmData 29077504 exceed data ulimit 68. Update limits or use boot option ignore_rlimit_data. [ 62.817954][ T329] usb 3-1: USB disconnect, device number 25 [ 62.834244][ T1844] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 62.847615][ T1844] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 62.857041][ T1843] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 62.865663][ T1843] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 62.891985][ T36] kauditd_printk_skb: 11 callbacks suppressed [ 62.892005][ T36] audit: type=1400 audit(1756447706.771:2636): avc: denied { ioctl } for pid=1852 comm="syz.2.508" path="user:[4026531837]" dev="nsfs" ino=4026531837 ioctlcmd=0x940c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 63.097767][ T344] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 63.118910][ T344] usb 5-1: device descriptor read/8, error -71 [ 63.247747][ T329] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 63.248976][ T344] usb 5-1: device descriptor read/8, error -71 [ 63.377781][ T329] usb 3-1: device descriptor read/64, error -71 [ 63.497784][ T344] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 63.518881][ T344] usb 5-1: device descriptor read/8, error -71 [ 63.617753][ T329] usb 3-1: device descriptor read/64, error -71 [ 63.648889][ T344] usb 5-1: device descriptor read/8, error -71 [ 63.757862][ T344] usb usb5-port1: unable to enumerate USB device [ 63.841075][ T36] audit: type=1400 audit(1756447707.721:2637): avc: denied { append } for pid=1860 comm="syz.3.511" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 63.864424][ T329] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 63.885887][ T1863] overlayfs: workdir and upperdir must be separate subtrees [ 63.894053][ T1863] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 63.903155][ T1863] overlayfs: missing 'lowerdir' [ 63.910703][ T36] audit: type=1326 audit(1756447707.791:2638): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1862 comm="syz.3.512" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f303238ebe9 code=0x0 [ 63.997733][ T329] usb 3-1: device descriptor read/64, error -71 [ 64.237716][ T329] usb 3-1: device descriptor read/64, error -71 [ 64.347828][ T329] usb usb3-port1: attempt power cycle [ 64.687798][ T329] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 64.708764][ T329] usb 3-1: device descriptor read/8, error -71 [ 64.787728][ T413] usb 5-1: new low-speed USB device number 20 using dummy_hcd [ 64.838739][ T329] usb 3-1: device descriptor read/8, error -71 [ 64.917763][ T413] usb 5-1: device descriptor read/64, error -71 [ 64.989959][ T36] audit: type=1400 audit(1756447708.871:2639): avc: denied { mount } for pid=1891 comm="syz.0.521" name="/" dev="selinuxfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 64.990387][ T1892] overlayfs: failed to clone lowerpath [ 65.077726][ T329] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 65.098878][ T329] usb 3-1: device descriptor read/8, error -71 [ 65.157729][ T413] usb 5-1: device descriptor read/64, error -71 [ 65.228761][ T329] usb 3-1: device descriptor read/8, error -71 [ 65.337883][ T329] usb usb3-port1: unable to enumerate USB device [ 65.397717][ T413] usb 5-1: new low-speed USB device number 21 using dummy_hcd [ 65.527732][ T413] usb 5-1: device descriptor read/64, error -71 [ 65.767720][ T413] usb 5-1: device descriptor read/64, error -71 [ 65.877800][ T413] usb usb5-port1: attempt power cycle [ 66.009005][ T1910] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:276 [ 66.217727][ T413] usb 5-1: new low-speed USB device number 22 using dummy_hcd [ 66.248950][ T413] usb 5-1: device descriptor read/8, error -71 [ 66.256293][ T36] audit: type=1400 audit(1756447710.131:2640): avc: denied { execute } for pid=1911 comm="syz.2.528" path="/dev/binderfs/binder1" dev="binder" ino=208 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 66.378702][ T413] usb 5-1: device descriptor read/8, error -71 [ 66.406889][ T1933] netlink: 'syz.2.535': attribute type 13 has an invalid length. [ 66.617732][ T413] usb 5-1: new low-speed USB device number 23 using dummy_hcd [ 66.638914][ T413] usb 5-1: device descriptor read/8, error -71 [ 66.768830][ T413] usb 5-1: device descriptor read/8, error -71 [ 66.877820][ T413] usb usb5-port1: unable to enumerate USB device [ 66.959222][ T36] audit: type=1400 audit(1756447710.841:2641): avc: denied { create } for pid=1942 comm="syz.2.538" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 67.112951][ T36] audit: type=1400 audit(1756447710.991:2642): avc: denied { write } for pid=1944 comm="syz.3.539" name="ppp" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 67.386785][ T1953] rust_binder: Error while translating object. [ 67.386825][ T1953] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 67.393164][ T1953] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:352 [ 67.418803][ T36] audit: type=1400 audit(1756447711.301:2643): avc: denied { read } for pid=1954 comm="syz.3.542" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 67.519495][ T36] audit: type=1400 audit(1756447711.401:2644): avc: denied { shutdown } for pid=1957 comm="syz.4.543" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 67.556628][ T36] audit: type=1400 audit(1756447711.431:2645): avc: denied { create } for pid=1957 comm="syz.4.543" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 67.595890][ T1966] netlink: 80 bytes leftover after parsing attributes in process `syz.4.546'. [ 67.637575][ T1972] Invalid ELF header type: 2 != 1 [ 68.467648][ T1989] overlayfs: failed to resolve './file1': -2 [ 68.638551][ T1999] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 68.645727][ T1999] rust_binder: Write failure EINVAL in pid:258 [ 68.680438][ T2001] netlink: 76 bytes leftover after parsing attributes in process `syz.4.556'. [ 68.760018][ T36] kauditd_printk_skb: 7 callbacks suppressed [ 68.760040][ T36] audit: type=1400 audit(1756447712.641:2653): avc: denied { audit_read } for pid=2003 comm="syz.4.557" capability=37 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 68.898878][ T2021] SELinux: Context system_u:object_r:checkpolicy_exec_t:s0 is not valid (left unmapped). [ 68.898879][ T36] audit: type=1400 audit(1756447712.781:2654): avc: denied { relabelfrom } for pid=2020 comm="syz.2.561" name="NETLINK" dev="sockfs" ino=13068 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 68.937954][ T36] audit: type=1400 audit(1756447712.821:2655): avc: denied { relabelto } for pid=2020 comm="syz.2.561" name="NETLINK" dev="sockfs" ino=13068 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=netlink_route_socket permissive=1 trawcon="system_u:object_r:checkpolicy_exec_t:s0" [ 69.039365][ T36] audit: type=1400 audit(1756447712.921:2656): avc: denied { map } for pid=2024 comm="syz.2.563" path="socket:[13545]" dev="sockfs" ino=13545 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 69.077718][ T329] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 69.089022][ T2027] netlink: 'syz.2.564': attribute type 1 has an invalid length. [ 69.096856][ T2027] netlink: 24 bytes leftover after parsing attributes in process `syz.2.564'. [ 69.106962][ T2027] fuse: Bad value for 'fd' [ 69.112410][ T2027] overlayfs: failed to clone upperpath [ 69.152862][ T2034] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=2034 comm=syz.2.566 [ 69.193020][ T2045] netlink: 72 bytes leftover after parsing attributes in process `syz.2.569'. [ 69.238872][ T329] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 69.249380][ T329] usb 5-1: config 0 has no interfaces? [ 69.260180][ T329] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 69.269365][ T329] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 69.277551][ T329] usb 5-1: Product: syz [ 69.281762][ T329] usb 5-1: Manufacturer: syz [ 69.286375][ T329] usb 5-1: SerialNumber: syz [ 69.291988][ T329] usb 5-1: config 0 descriptor?? [ 69.503457][ T344] usb 5-1: USB disconnect, device number 24 [ 69.527227][ T2067] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 69.534431][ T2066] rust_binder: Error in use_page_slow: ESRCH [ 69.534459][ T2066] rust_binder: use_range failure ESRCH [ 69.540858][ T2066] rust_binder: Failed to allocate buffer. len:1144, is_oneway:true [ 69.546467][ T2066] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 69.554823][ T2066] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:271 [ 69.564475][ T2066] rust_binder: Error in use_page_slow: ESRCH [ 69.573695][ T2066] rust_binder: use_range failure ESRCH [ 69.579947][ T2066] rust_binder: Failed to allocate buffer. len:1144, is_oneway:true [ 69.585666][ T2066] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 69.593977][ T2066] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:271 [ 69.632496][ T2070] rust_binder: Error in use_page_slow: ESRCH [ 69.632516][ T2070] rust_binder: use_range failure ESRCH [ 69.638566][ T2070] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 69.644076][ T2070] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 69.652130][ T2070] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:274 [ 69.998615][ T36] audit: type=1400 audit(1756447713.881:2657): avc: denied { module_load } for pid=2078 comm="syz.3.579" path="/sys/power/pm_trace_dev_match" dev="sysfs" ino=1461 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=system permissive=1 [ 70.070286][ T2081] SELinux: security_context_str_to_sid (--^$-) failed with errno=-22 [ 70.209516][ T2090] netlink: 24 bytes leftover after parsing attributes in process `syz.0.584'. [ 70.467318][ T2107] netlink: 'syz.4.591': attribute type 2 has an invalid length. [ 70.467509][ T2106] netlink: 'syz.4.591': attribute type 1 has an invalid length. [ 70.482847][ T2106] netlink: 72 bytes leftover after parsing attributes in process `syz.4.591'. [ 70.739051][ T36] audit: type=1400 audit(1756447714.621:2658): avc: denied { setattr } for pid=2130 comm="syz.0.599" name="XDP" dev="sockfs" ino=13859 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 70.807834][ T2133] overlayfs: failed to clone upperpath [ 70.825957][ T2135] netlink: 12 bytes leftover after parsing attributes in process `syz.3.601'. [ 70.843695][ T2137] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=55 sclass=netlink_route_socket pid=2137 comm=syz.3.602 [ 71.068999][ T2141] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 71.069031][ T2141] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 71.077077][ T2141] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:282 [ 71.099053][ T2144] overlayfs: missing 'workdir' [ 71.347741][ T412] usb 5-1: new full-speed USB device number 25 using dummy_hcd [ 71.496372][ T2175] capability: warning: `syz.2.613' uses 32-bit capabilities (legacy support in use) [ 71.507039][ T412] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 71.523831][ T412] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 71.535986][ T412] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 64 [ 71.540832][ T2183] netlink: 8 bytes leftover after parsing attributes in process `syz.2.616'. [ 71.547023][ T412] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 71.559390][ T2183] overlayfs: missing 'workdir' [ 71.568863][ T412] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 71.580862][ T412] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.589174][ T412] usb 5-1: Product: syz [ 71.593781][ T412] usb 5-1: Manufacturer: syz [ 71.598528][ T412] usb 5-1: SerialNumber: syz [ 71.604580][ T2144] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 71.612469][ T412] cdc_mbim 5-1:1.0: skipping garbage [ 71.812827][ T2144] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 71.820417][ T2144] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 72.217933][ T36] audit: type=1400 audit(1756447716.101:2659): avc: denied { ioctl } for pid=2206 comm="syz.0.624" path="socket:[13958]" dev="sockfs" ino=13958 ioctlcmd=0x5828 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 72.444523][ T2144] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 72.451810][ T2144] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 72.459487][ T412] cdc_mbim 5-1:1.0: dwNtbInMaxSize=7 is too small. Using 2048 [ 72.467110][ T412] cdc_mbim 5-1:1.0: setting rx_max = 2048 [ 72.662924][ T412] cdc_mbim 5-1:1.0: setting tx_max = 16384 [ 72.670481][ T412] cdc_mbim 5-1:1.0: cdc-wdm0: USB WDM device [ 72.677414][ T412] wwan wwan0: port wwan0mbim0 attached [ 72.684513][ T412] cdc_mbim 5-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.4-1, CDC MBIM, 96:01:c2:0e:03:d9 [ 72.697117][ T412] usb 5-1: USB disconnect, device number 25 [ 72.709983][ T412] cdc_mbim 5-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.4-1, CDC MBIM [ 72.719231][ T36] audit: type=1400 audit(1756447716.591:2660): avc: denied { read } for pid=148 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 72.740346][ T36] audit: type=1400 audit(1756447716.591:2661): avc: denied { search } for pid=148 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 72.764985][ T36] audit: type=1400 audit(1756447716.591:2662): avc: denied { read } for pid=148 comm="dhcpcd" name="n15" dev="tmpfs" ino=2247 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 72.813186][ T412] wwan wwan0: port wwan0mbim0 disconnected [ 72.822866][ T2237] incfs: Can't find or create .index dir in ./file0 [ 72.837569][ T2237] incfs: mount failed -13 [ 73.130830][ T2272] overlayfs: failed to clone upperpath [ 73.229908][ T2296] rust_binder: Failed to allocate buffer. len:136, is_oneway:true [ 73.230255][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.238233][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.244720][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.251274][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.257837][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.264279][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.270816][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.277259][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.283742][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.290249][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.296791][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.304451][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.311166][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.317919][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.324428][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.331162][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.339439][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.346010][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.352699][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.359335][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.365839][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.372490][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.379095][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.385614][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.392261][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.398880][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.405377][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.412406][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.419036][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.425553][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.432210][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.438894][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.445413][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.452159][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.460947][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.467595][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.474273][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.480907][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.487394][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.494107][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.500789][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.507387][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.515169][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.521793][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.528444][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.534969][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.541607][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.548260][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.555219][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.562058][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.568699][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.575252][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.581953][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.588911][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.601001][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.609507][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.615978][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.623271][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.629831][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.636360][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.642853][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.649358][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.655917][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.662426][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.669010][ T2296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.714740][ T2315] binder: Bad value for 'defcontext' [ 73.764103][ T2321] netlink: 'syz.3.654': attribute type 1 has an invalid length. [ 73.782629][ T2323] netlink: 32 bytes leftover after parsing attributes in process `syz.3.655'. [ 73.940239][ T2328] netlink: 'syz.2.657': attribute type 10 has an invalid length. [ 73.948079][ T2328] netlink: 17 bytes leftover after parsing attributes in process `syz.2.657'. [ 74.207888][ T2376] SELinux: security_context_str_to_sid (--^$-) failed with errno=-22 [ 74.560733][ T36] kauditd_printk_skb: 18 callbacks suppressed [ 74.560755][ T36] audit: type=1400 audit(1756447718.441:2681): avc: denied { map } for pid=2386 comm="syz.4.680" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 74.590064][ T36] audit: type=1400 audit(1756447718.441:2682): avc: denied { execute } for pid=2386 comm="syz.4.680" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 74.957721][ T344] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 75.108903][ T344] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 75.119091][ T344] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 75.128726][ T344] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 75.137813][ T344] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 75.145807][ T344] usb 5-1: SerialNumber: syz [ 75.345744][ T36] audit: type=1400 audit(1756447719.221:2683): avc: denied { read } for pid=2403 comm="syz.3.687" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 75.370385][ T344] usb 5-1: 0:2 : does not exist [ 75.375519][ T344] usb 5-1: unit 255 not found! [ 75.385759][ T344] usb 5-1: USB disconnect, device number 26 [ 75.394167][ T335] udevd[335]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 75.424508][ T2414] overlayfs: failed to resolve './file1/file0': -20 [ 75.433153][ T2414] netlink: 25 bytes leftover after parsing attributes in process `syz.2.689'. [ 76.330128][ T36] audit: type=1400 audit(1756447720.211:2684): avc: denied { getopt } for pid=2432 comm="syz.2.695" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 76.461500][ T36] audit: type=1400 audit(1756447720.341:2685): avc: denied { create } for pid=2442 comm="syz.2.699" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 76.677909][ T2468] /dev/rnullb0: Can't lookup blockdev [ 76.690786][ T2470] /dev/rnullb0: Can't lookup blockdev [ 76.847115][ T2485] /dev/rnullb0: Can't lookup blockdev [ 76.880461][ T36] audit: type=1400 audit(1756447720.761:2686): avc: denied { accept } for pid=2489 comm="syz.0.713" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 76.975281][ T36] audit: type=1400 audit(1756447720.851:2687): avc: denied { bind } for pid=2501 comm="syz.0.717" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 77.006754][ T36] audit: type=1400 audit(1756447720.881:2688): avc: denied { listen } for pid=2501 comm="syz.0.717" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 77.026591][ T36] audit: type=1400 audit(1756447720.881:2689): avc: denied { write } for pid=2501 comm="syz.0.717" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 77.116326][ T2513] 9pnet_virtio: no channels available for device /dev/rnullb0 [ 77.231610][ T2522] netlink: 'syz.4.720': attribute type 12 has an invalid length. [ 77.300466][ T36] audit: type=1400 audit(1756447721.171:2690): avc: denied { listen } for pid=2536 comm="syz.2.728" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 77.510812][ T2567] 9pnet_fd: Insufficient options for proto=fd [ 77.597795][ T2571] netlink: 12 bytes leftover after parsing attributes in process `syz.0.740'. [ 78.227711][ T45] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 78.378885][ T45] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 78.389984][ T45] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 78.401129][ T45] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 78.410945][ T45] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 78.424804][ T45] usb 5-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 78.433934][ T45] usb 5-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 78.442220][ T45] usb 5-1: Manufacturer: syz [ 78.447374][ T45] usb 5-1: config 0 descriptor?? [ 78.579082][ T2603] overlayfs: failed to resolve './file1': -2 [ 78.857415][ T45] appleir 0003:05AC:8243.0007: unknown main item tag 0x0 [ 78.864862][ T45] appleir 0003:05AC:8243.0007: No inputs registered, leaving [ 78.865188][ T2620] overlayfs: failed to resolve './file1': -2 [ 78.879473][ T45] appleir 0003:05AC:8243.0007: hiddev96,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.4-1/input0 [ 78.898166][ T2623] 9pnet_fd: Insufficient options for proto=fd [ 79.108529][ T413] usb 5-1: USB disconnect, device number 27 [ 79.196647][ T2648] rust_binder: Write failure EFAULT in pid:336 [ 79.238571][ T2650] overlayfs: failed to resolve './file0': -2 [ 79.871867][ T36] kauditd_printk_skb: 5 callbacks suppressed [ 79.871895][ T36] audit: type=1400 audit(1756447723.751:2696): avc: denied { accept } for pid=2679 comm="syz.3.776" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 79.911869][ T36] audit: type=1400 audit(1756447723.791:2697): avc: denied { read } for pid=2692 comm="syz.3.779" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 80.006603][ T36] audit: type=1400 audit(1756447723.881:2698): avc: denied { getopt } for pid=2696 comm="syz.0.781" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 80.068091][ T2705] batadv_slave_0: mtu less than device minimum [ 80.111499][ T2711] /dev/sr0: Can't lookup blockdev [ 80.150405][ T2719] netlink: 25 bytes leftover after parsing attributes in process `syz.2.789'. [ 80.159395][ T2718] netlink: 25 bytes leftover after parsing attributes in process `syz.2.789'. [ 80.186065][ T2723] netlink: 12 bytes leftover after parsing attributes in process `syz.4.790'. [ 80.195420][ T2723] rust_binder: Read failure Err(EFAULT) in pid:344 [ 80.245524][ T2728] syz.4.792 uses obsolete (PF_INET,SOCK_PACKET) [ 80.259617][ T2728] netlink: 'syz.4.792': attribute type 4 has an invalid length. [ 80.269372][ T2728] netlink: 'syz.4.792': attribute type 4 has an invalid length. [ 80.278274][ T2728] veth1: entered allmulticast mode [ 80.283801][ T2728] veth1: left allmulticast mode [ 80.527769][ T413] usb 5-1: new full-speed USB device number 28 using dummy_hcd [ 80.679061][ T413] usb 5-1: config 1 has an invalid interface number: 138 but max is 2 [ 80.687377][ T413] usb 5-1: config 1 has an invalid interface number: 194 but max is 2 [ 80.695813][ T413] usb 5-1: config 1 has an invalid interface number: 32 but max is 2 [ 80.704058][ T413] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 80.712804][ T413] usb 5-1: config 1 has no interface number 0 [ 80.718969][ T413] usb 5-1: config 1 has no interface number 1 [ 80.725046][ T413] usb 5-1: config 1 has no interface number 2 [ 80.731206][ T413] usb 5-1: config 1 interface 138 altsetting 204 has an invalid descriptor for endpoint zero, skipping [ 80.742319][ T413] usb 5-1: config 1 interface 138 altsetting 204 has an endpoint descriptor with address 0xA9, changing to 0x89 [ 80.754187][ T413] usb 5-1: config 1 interface 138 altsetting 204 endpoint 0x89 has invalid maxpacket 41695, setting to 64 [ 80.765696][ T413] usb 5-1: config 1 interface 138 altsetting 204 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 80.779275][ T413] usb 5-1: config 1 interface 194 altsetting 7 has an invalid descriptor for endpoint zero, skipping [ 80.790176][ T413] usb 5-1: config 1 interface 194 altsetting 7 has an invalid descriptor for endpoint zero, skipping [ 80.801168][ T413] usb 5-1: config 1 interface 32 altsetting 252 has an invalid descriptor for endpoint zero, skipping [ 80.812134][ T413] usb 5-1: config 1 interface 32 altsetting 252 endpoint 0x2 has invalid maxpacket 1024, setting to 64 [ 80.823175][ T413] usb 5-1: config 1 interface 32 altsetting 252 has a duplicate endpoint with address 0x7, skipping [ 80.833966][ T413] usb 5-1: config 1 interface 32 altsetting 252 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 80.845009][ T413] usb 5-1: config 1 interface 32 altsetting 252 has a duplicate endpoint with address 0x3, skipping [ 80.856187][ T413] usb 5-1: config 1 interface 32 altsetting 252 endpoint 0xE has invalid maxpacket 512, setting to 64 [ 80.867509][ T413] usb 5-1: config 1 interface 32 altsetting 252 has an endpoint descriptor with address 0x99, changing to 0x89 [ 80.879376][ T413] usb 5-1: config 1 interface 32 altsetting 252 has a duplicate endpoint with address 0x89, skipping [ 80.890553][ T413] usb 5-1: config 1 interface 32 altsetting 252 has an invalid descriptor for endpoint zero, skipping [ 80.901662][ T413] usb 5-1: config 1 interface 32 altsetting 252 has a duplicate endpoint with address 0xE, skipping [ 80.912502][ T413] usb 5-1: config 1 interface 32 altsetting 252 endpoint 0xC has invalid maxpacket 64086, setting to 64 [ 80.914705][ T2742] netlink: 24 bytes leftover after parsing attributes in process `syz.0.796'. [ 80.923929][ T413] usb 5-1: config 1 interface 32 altsetting 252 has a duplicate endpoint with address 0xE, skipping [ 80.945362][ T413] usb 5-1: config 1 interface 32 altsetting 252 has an invalid descriptor for endpoint zero, skipping [ 80.956497][ T413] usb 5-1: config 1 interface 32 altsetting 252 has a duplicate endpoint with address 0xE, skipping [ 80.967331][ T413] usb 5-1: config 1 interface 32 altsetting 252 has 17 endpoint descriptors, different from the interface descriptor's value: 16 [ 80.980747][ T413] usb 5-1: config 1 interface 138 has no altsetting 0 [ 80.987522][ T413] usb 5-1: config 1 interface 194 has no altsetting 0 [ 80.994342][ T413] usb 5-1: config 1 interface 32 has no altsetting 0 [ 81.001727][ T413] usb 5-1: string descriptor 0 read error: -22 [ 81.008253][ T413] usb 5-1: New USB device found, idVendor=0586, idProduct=1000, bcdDevice=54.64 [ 81.017356][ T413] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.027452][ T2728] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 81.054933][ T2754] netlink: 'syz.2.800': attribute type 4 has an invalid length. [ 81.064758][ T2754] syz.2.800 (2754): attempted to duplicate a private mapping with mremap. This is not supported. [ 81.086545][ T2761] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=3350 sclass=netlink_route_socket pid=2761 comm=syz.3.802 [ 81.251413][ T413] usb 5-1: USB disconnect, device number 28 [ 81.286314][ T36] audit: type=1400 audit(1756447725.161:2699): avc: denied { write } for pid=2770 comm="syz.3.807" name="file0" dev="tmpfs" ino=1034 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 81.442435][ T2778] netlink: 'syz.3.810': attribute type 4 has an invalid length. [ 81.450299][ T2778] netlink: 'syz.3.810': attribute type 21 has an invalid length. [ 81.458394][ T2778] netlink: 3657 bytes leftover after parsing attributes in process `syz.3.810'. [ 81.487344][ T36] audit: type=1400 audit(1756447725.361:2700): avc: denied { read } for pid=2783 comm="syz.3.813" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 81.596519][ T2793] netlink: 'syz.2.817': attribute type 1 has an invalid length. [ 81.673533][ T2799] overlayfs: failed to clone upperpath [ 81.680460][ T2799] overlayfs: failed to clone upperpath [ 81.941039][ T36] audit: type=1400 audit(1756447725.821:2701): avc: denied { execute } for pid=2827 comm="syz.4.830" name="file0" dev="ramfs" ino=16142 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 81.963853][ T36] audit: type=1400 audit(1756447725.821:2702): avc: denied { execute_no_trans } for pid=2827 comm="syz.4.830" path="/file0" dev="ramfs" ino=16142 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 81.990246][ T2830] netlink: 'syz.4.832': attribute type 1 has an invalid length. [ 81.992879][ T2834] /dev/loop0: Can't lookup blockdev [ 82.021223][ T36] audit: type=1400 audit(1756447725.901:2703): avc: denied { setattr } for pid=2839 comm="syz.0.834" name="NETLINK" dev="sockfs" ino=16158 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 82.045864][ T2845] fuseblk: Bad value for 'user_id' [ 82.055585][ T2845] fuseblk: Bad value for 'user_id' [ 82.096452][ T2838] kernel profiling enabled (shift: 7) [ 82.215391][ T2860] random: crng reseeded on system resumption [ 82.667213][ T2885] netlink: 9 bytes leftover after parsing attributes in process `syz.0.848'. [ 82.676874][ T2885] gretap0: entered promiscuous mode [ 82.947446][ T2890] fuse: Bad value for 'fd' [ 83.097117][ T9] rust_binder: 2866: removing orphan mapping 0:24 [ 83.227758][ T36] audit: type=1400 audit(1756447727.101:2704): avc: denied { shutdown } for pid=2898 comm="syz.4.853" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 83.449269][ T36] audit: type=1400 audit(1756447727.331:2705): avc: denied { watch_reads } for pid=2909 comm="syz.0.857" path="/297/file0" dev="tmpfs" ino=1648 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 84.008094][ T2938] SELinux: security_context_str_to_sid (--^$-) failed with errno=-22 [ 84.077306][ T2941] overlayfs: failed to clone upperpath [ 84.154858][ T2958] netlink: 16 bytes leftover after parsing attributes in process `syz.0.874'. [ 84.165268][ T2958] fuse: Unknown parameter 'd' [ 84.592229][ T2985] binder: Unknown parameter 'defcontext01777777777777777777777' [ 84.729599][ T3011] netlink: 'syz.3.893': attribute type 13 has an invalid length. [ 84.783660][ T3022] netlink: 4 bytes leftover after parsing attributes in process `syz.0.897'. [ 84.971106][ T36] kauditd_printk_skb: 6 callbacks suppressed [ 84.971124][ T36] audit: type=1400 audit(1756447728.851:2712): avc: denied { setopt } for pid=3041 comm="syz.4.904" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 85.001127][ T36] audit: type=1400 audit(1756447728.881:2713): avc: denied { getopt } for pid=3041 comm="syz.4.904" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 85.092480][ T36] audit: type=1326 audit(1756447728.971:2714): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3057 comm="syz.2.909" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f81a3f8ebe9 code=0x0 [ 85.251595][ T3084] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 85.254884][ T3087] /dev/loop2: Can't lookup blockdev [ 85.278337][ T3084] rust_binder: Write failure EINVAL in pid:434 [ 85.382487][ T3118] fuse: Bad value for 'user_id' [ 85.399908][ T3118] fuse: Bad value for 'user_id' [ 85.411562][ T36] audit: type=1326 audit(1756447729.291:2715): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3117 comm="syz.3.927" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f303238ebe9 code=0x0 [ 85.906789][ T3154] cgroup: Bad value for 'name' [ 85.989400][ T3175] netlink: 44 bytes leftover after parsing attributes in process `syz.0.948'. [ 86.000055][ T3175] netlink: 12 bytes leftover after parsing attributes in process `syz.0.948'. [ 86.807840][ T3206] Unsupported ieee802154 address type: 0 [ 86.831055][ T36] audit: type=1400 audit(1756447730.701:2716): avc: denied { sqpoll } for pid=3207 comm="syz.4.959" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 86.888060][ T3210] SELinux: Context ϧ® is not valid (left unmapped). [ 86.897482][ T36] audit: type=1400 audit(1756447730.771:2717): avc: denied { create } for pid=3209 comm="syz.4.960" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon=CFA7AE [ 86.919579][ T36] audit: type=1400 audit(1756447730.771:2718): avc: denied { associate } for pid=3209 comm="syz.4.960" name="file0" scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon=CFA7AE [ 86.943295][ T36] audit: type=1400 audit(1756447730.771:2719): avc: denied { mounton } for pid=3209 comm="syz.4.960" path="/156/bus" dev="tmpfs" ino=874 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon=CFA7AE [ 86.943364][ T528] ------------[ cut here ]------------ [ 86.967415][ T36] audit: type=1400 audit(1756447730.781:2720): avc: denied { write } for pid=3209 comm="syz.4.960" name="bus" dev="tmpfs" ino=874 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon=CFA7AE [ 86.972670][ T528] WARNING: CPU: 1 PID: 528 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 86.995906][ T36] audit: type=1400 audit(1756447730.781:2721): avc: denied { add_name } for pid=3209 comm="syz.4.960" name="work" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon=CFA7AE [ 87.005143][ T528] Modules linked in: [ 87.005159][ T528] CPU: 1 UID: 0 PID: 528 Comm: syz-executor Not tainted syzkaller #0 a8cf528afde17777b8d0df17d514b1350887467d [ 87.042530][ T528] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2025 [ 87.052614][ T528] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 87.058293][ T528] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 de 57 99 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 46 2f 43 ff <0f> 0b e9 3e ff ff ff e8 3a 2f 43 ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 87.077942][ T528] RSP: 0018:ffffc900015cfb68 EFLAGS: 00010293 [ 87.084030][ T528] RAX: ffffffff8242b4fa RBX: 0000000000000000 RCX: ffff88811ac62600 [ 87.092050][ T528] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 87.100056][ T528] RBP: ffffc900015cfb90 R08: ffff88813c5ccf3f R09: 1ffff110278b99e7 [ 87.108086][ T528] R10: dffffc0000000000 R11: ffffed10278b99e8 R12: 0000000000000000 [ 87.116063][ T528] R13: dffffc0000000000 R14: ffff88813c5ccea0 R15: ffff88811841baa0 [ 87.124053][ T528] FS: 0000555562d8d500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 87.133028][ T528] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 87.139653][ T528] CR2: 0000555562da84a8 CR3: 0000000116938000 CR4: 00000000003526b0 [ 87.147641][ T528] Call Trace: [ 87.150960][ T528] [ 87.153884][ T528] ovl_do_remove+0x7b8/0xcf0 [ 87.158496][ T528] ? ovl_set_redirect+0x780/0x780 [ 87.163534][ T528] ? down_write+0xe9/0x2a0 [ 87.167986][ T528] ? __cfi_down_write+0x10/0x10 [ 87.172859][ T528] ovl_rmdir+0x1e/0x30 [ 87.176937][ T528] vfs_rmdir+0x3e0/0x560 [ 87.181199][ T528] incfs_kill_sb+0x109/0x230 [ 87.185819][ T528] deactivate_locked_super+0xd5/0x2a0 [ 87.191572][ T528] deactivate_super+0xb8/0xe0 [ 87.196266][ T528] cleanup_mnt+0x3f1/0x480 [ 87.200827][ T528] __cleanup_mnt+0x1d/0x40 [ 87.205254][ T528] task_work_run+0x1e3/0x250 [ 87.209867][ T528] ? __cfi_task_work_run+0x10/0x10 [ 87.215021][ T528] ? __x64_sys_umount+0x126/0x170 [ 87.220087][ T528] ? __cfi___x64_sys_umount+0x10/0x10 [ 87.225479][ T528] ? __kasan_check_read+0x15/0x20 [ 87.230554][ T528] resume_user_mode_work+0x36/0x50 [ 87.235688][ T528] syscall_exit_to_user_mode+0x64/0xb0 [ 87.241192][ T528] do_syscall_64+0x64/0xf0 [ 87.245634][ T528] ? clear_bhb_loop+0x50/0xa0 [ 87.250462][ T528] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 87.256368][ T528] RIP: 0033:0x7f127e98ff17 [ 87.260851][ T528] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 87.280760][ T528] RSP: 002b:00007fffdd7e4e78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 87.289227][ T528] RAX: 0000000000000000 RBX: 00007f127ea11c05 RCX: 00007f127e98ff17 [ 87.297220][ T528] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffdd7e4f30 [ 87.305231][ T528] RBP: 00007fffdd7e4f30 R08: 0000000000000000 R09: 0000000000000000 [ 87.313332][ T528] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fffdd7e5fc0 [ 87.321336][ T528] R13: 00007f127ea11c05 R14: 000000000001536b R15: 00007fffdd7e6000 [ 87.329390][ T528] [ 87.332428][ T528] ---[ end trace 0000000000000000 ]--- [ 87.338259][ T528] ------------[ cut here ]------------ [ 87.343767][ T528] WARNING: CPU: 0 PID: 528 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 87.353118][ T528] Modules linked in: [ 87.357020][ T528] CPU: 0 UID: 0 PID: 528 Comm: syz-executor Tainted: G W syzkaller #0 a8cf528afde17777b8d0df17d514b1350887467d [ 87.370149][ T528] Tainted: [W]=WARN [ 87.373959][ T528] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2025 [ 87.384031][ T528] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 87.389725][ T528] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 de 57 99 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 46 2f 43 ff <0f> 0b e9 3e ff ff ff e8 3a 2f 43 ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 87.409375][ T528] RSP: 0018:ffffc900015cfb68 EFLAGS: 00010293 [ 87.415458][ T528] RAX: ffffffff8242b4fa RBX: 0000000000000000 RCX: ffff88811ac62600 [ 87.423450][ T528] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 87.431453][ T528] RBP: ffffc900015cfb90 R08: ffff88813c5ccf3f R09: 1ffff110278b99e7 [ 87.439442][ T528] R10: dffffc0000000000 R11: ffffed10278b99e8 R12: 0000000000000000 [ 87.447423][ T528] R13: dffffc0000000000 R14: ffff88813c5ccea0 R15: ffff88811841baa0 [ 87.455525][ T528] FS: 0000555562d8d500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 87.464519][ T528] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 87.471203][ T528] CR2: 00007f81a4184198 CR3: 0000000116938000 CR4: 00000000003526b0 [ 87.479233][ T528] Call Trace: [ 87.482513][ T528] [ 87.485438][ T528] ovl_do_remove+0x7b8/0xcf0 [ 87.490113][ T528] ? ovl_set_redirect+0x780/0x780 [ 87.495160][ T528] ? down_write+0xe9/0x2a0 [ 87.499602][ T528] ? __cfi_down_write+0x10/0x10 [ 87.504491][ T528] ovl_rmdir+0x1e/0x30 [ 87.508682][ T528] vfs_rmdir+0x3e0/0x560 [ 87.512950][ T528] incfs_kill_sb+0x1a0/0x230 [ 87.517542][ T528] deactivate_locked_super+0xd5/0x2a0 [ 87.523033][ T528] deactivate_super+0xb8/0xe0 [ 87.527762][ T528] cleanup_mnt+0x3f1/0x480 [ 87.532184][ T528] __cleanup_mnt+0x1d/0x40 [ 87.536594][ T528] task_work_run+0x1e3/0x250 [ 87.541199][ T528] ? __cfi_task_work_run+0x10/0x10 [ 87.546325][ T528] ? __x64_sys_umount+0x126/0x170 [ 87.551389][ T528] ? __cfi___x64_sys_umount+0x10/0x10 [ 87.556784][ T528] ? __kasan_check_read+0x15/0x20 [ 87.561852][ T528] resume_user_mode_work+0x36/0x50 [ 87.566987][ T528] syscall_exit_to_user_mode+0x64/0xb0 [ 87.572485][ T528] do_syscall_64+0x64/0xf0 [ 87.576918][ T528] ? clear_bhb_loop+0x50/0xa0 [ 87.581620][ T528] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 87.587530][ T528] RIP: 0033:0x7f127e98ff17 [ 87.592004][ T528] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 87.611731][ T528] RSP: 002b:00007fffdd7e4e78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 87.620222][ T528] RAX: 0000000000000000 RBX: 00007f127ea11c05 RCX: 00007f127e98ff17 [ 87.628223][ T528] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffdd7e4f30 [ 87.636189][ T528] RBP: 00007fffdd7e4f30 R08: 0000000000000000 R09: 0000000000000000 [ 87.644185][ T528] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fffdd7e5fc0 [ 87.652197][ T528] R13: 00007f127ea11c05 R14: 000000000001536b R15: 00007fffdd7e6000 [ 87.660208][ T528] [ 87.663258][ T528] ---[ end trace 0000000000000000 ]---