last executing test programs: 5.642729546s ago: executing program 2 (id=163): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x20340, 0x0) (async) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x100480, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000140), 0x4040, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000300)={0x4376ea830d4d549b, 0x0, [0x8000000000000001, 0x8, 0x0, 0x8, 0x10001, 0x80000000000006, 0x1000000006, 0x10007ffffe]}) (async) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000100000500010001"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000000104050000000000000073050a00000006000640deffffff0500010002"], 0x24}, 0x1, 0x0, 0x0, 0xc090}, 0x2000004) (async) r6 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, &(0x7f0000000040)={@private2={0xfc, 0x2, '\x00', 0x2}, 0x800, 0x0, 0x1, 0x8, 0x6109, 0x3}, 0x20) (async) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0) (async) ioctl$UI_BEGIN_FF_ERASE(r4, 0xc00c55ca, 0x0) (async) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f00000ab000/0x18000)=nil, &(0x7f00000001c0)=[@text64={0x40, &(0x7f0000000080)="470f23fc6541fc48b8e7320000000000000f23d80f21f80f23e1f8f30f1edd0f2221c74c24022063800000002c24f30f556797c483fd005b02ea6426470f01cf65666466430f3833af00580000", 0x4d}], 0x1, 0x3e, 0x0, 0x0) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0) 5.611745979s ago: executing program 2 (id=164): r0 = socket(0x10, 0x802, 0x0) write(r0, &(0x7f0000000140)="1c00000018000711ab092500090007000a0700000000000600003693", 0x1c) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000200)=[@enter_looper], 0x50, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) close(r0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x68, 0x0, &(0x7f0000000380)=[@dead_binder_done, @exit_looper, @enter_looper, @clear_death={0x400c630f, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000500)={@ptr={0x70742a85, 0x1, &(0x7f0000000040)=""/97, 0x61, 0x0, 0x3c}, @flat=@handle={0x73682a85, 0xa, 0x3}, @fda={0x66646185, 0x1, 0x2, 0x1f}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}], 0xf7, 0x0, &(0x7f0000000400)="8b0b4c404981a6ef39f577efb9c2c64f47b576cec3dab5adbd25d802c31aa20f47283d909cfc1520a8ebb223d441539406505ea001848d180490b7a70bc561639b136ecae6c156d04957009916c1b24ba79c86ea06832ee972c31e6a0359b8b206c9498c06983956a604106001a616cb4d1c1bb6acb016cfecfc7ec3b0b2b9ad9ab9ad605bc7f30634cd84a3fa558165a23ef2774c87ec29f64cbf0b7d687933d9e1b3d23238f45fa89ff9f03aeed168cc4492998e962f5fc8d328b4204e969666ffdeb879c288373569757aa945c11bfc5a6d01cefde1031b79382c34c2da32f2058e7357c3d1fa5931bb923f0ebd396a976c32940686"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) 4.716264263s ago: executing program 2 (id=168): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000140), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x132) fstat(r1, &(0x7f0000000440)) syz_io_uring_setup(0x36e2, &(0x7f0000000080)={0x0, 0x5946, 0x400, 0x4, 0x3d9, 0x0, r1}, &(0x7f00000004c0), 0x0) clock_gettime(0x0, &(0x7f0000000000)) (async) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) timerfd_settime(r1, 0x0, &(0x7f0000000100)={{r2, r3+10000000}, {0x0, 0x3938700}}, &(0x7f0000000180)) (async) timerfd_settime(r1, 0x0, &(0x7f0000000100)={{r2, r3+10000000}, {0x0, 0x3938700}}, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000380)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) 4.63008651s ago: executing program 2 (id=172): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000780)='devpts\x00', 0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) fstat(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x0) fcntl$setlease(r2, 0x400, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) r4 = syz_open_procfs(0x0, &(0x7f0000000280)='fdinfo/4\x00') preadv(r4, &(0x7f0000001600)=[{&(0x7f0000000040)=""/35, 0x2b}], 0x1, 0x0, 0x0) r5 = getegid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) fstat(r6, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, 0x0, r7) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000240)={{{@in6=@local, @in=@loopback}}, {{@in=@private}, 0x0, @in6=@dev}}, &(0x7f0000000500)=0x145) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x40000, &(0x7f0000002600)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r5}, 0x2c, {[{@default_permissions}, {@allow_other}, {@default_permissions}, {@default_permissions}, {@blksize={'blksize', 0x3d, 0xa00}}, {@allow_other}], [{@context={'context', 0x3d, 'root'}}, {@smackfsroot={'smackfsroot', 0x3d, '\\\x98\'}}'}}, {@uid_lt={'uid<', r7}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@audit}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@appraise_type}]}}) mount$tmpfs(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x820061, &(0x7f0000000040)=ANY=[@ANYBLOB='uid=', @ANYRESDEC=0x0]) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, 0x0) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') read$FUSE(r8, &(0x7f00000005c0)={0x2020}, 0x2020) 4.551406556s ago: executing program 2 (id=174): ftruncate(0xffffffffffffffff, 0x398a0bdb) add_key$user(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) r0 = add_key$keyring(0x0, &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$read(0xb, r0, 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) syz_clone(0x102311, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100005938d74010973077339613a2dd8713ca1600000001090212000100001e000904"], 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 4.368141102s ago: executing program 2 (id=176): sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5}, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='auxv\x00') pread64(r2, 0x0, 0x0, 0xffffffff) sendfile(r1, r0, 0x0, 0x7ffff000) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000000080)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0xfeffffffffffffff, 0x8, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "67523720fd4002002cfc03d81a8ca55b39c01802c4dae4162e43ac61b7ad3300", [0x2, 0x7]}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x4000, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000000c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010028bd7000ffdbdf2501000000000000000b00002c00140014"], 0x30}}, 0xc840) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000000000)=[@sack_perm, @timestamp, @sack_perm, @window={0x3, 0xff, 0x4}, @sack_perm, @window={0x3, 0x4, 0x1}], 0x6) 4.367942991s ago: executing program 32 (id=176): sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5}, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='auxv\x00') pread64(r2, 0x0, 0x0, 0xffffffff) sendfile(r1, r0, 0x0, 0x7ffff000) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000000080)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0xfeffffffffffffff, 0x8, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "67523720fd4002002cfc03d81a8ca55b39c01802c4dae4162e43ac61b7ad3300", [0x2, 0x7]}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x4000, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000000c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010028bd7000ffdbdf2501000000000000000b00002c00140014"], 0x30}}, 0xc840) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000000000)=[@sack_perm, @timestamp, @sack_perm, @window={0x3, 0xff, 0x4}, @sack_perm, @window={0x3, 0x4, 0x1}], 0x6) 4.178599017s ago: executing program 3 (id=178): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000006c0)=ANY=[@ANYBLOB="380000000203010200000000000000000000000009000200000000010000000008000340000000070800010001"], 0x38}, 0x1, 0x0, 0x0, 0x40050}, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000000303010300000000000000000a0000000c0002"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x200000c4) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x23e, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000280), 0x8019, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000020000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r2, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000dc0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xfc5, 0xb080, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x3}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_control_io(r6, &(0x7f0000000740)={0x2c, &(0x7f0000000000)={0x40, 0x2, 0x3, {0x3, 0x0, '4'}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000000180)="440f20c035ef000000440f22c0f26df20f38f17a64b805000000b9e10d00000f01d9d8dd0f01728eb8010000000f01d94c0fc71d000000003ef245dbed410fc7f7", 0x41}], 0x1, 0x32, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) statx(0xffffffffffffff9c, 0x0, 0x100, 0x801, 0x0) sendfile(r2, r0, 0x0, 0x7ffff000) 2.55865005s ago: executing program 0 (id=180): mkdir(&(0x7f00000020c0)='./file0\x00', 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000100)='./bus\x00', 0x3eb) ioctl$KVM_GET_SUPPORTED_HV_CPUID_sys(0xffffffffffffffff, 0xc008aec1, 0x0) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5ed000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RGETLOCK(r1, &(0x7f00000002c0)=ANY=[], 0x200002e6) fcntl$setpipe(r0, 0x407, 0x7000001) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) socket(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000140)='./bus\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) mount$overlay(0x0, &(0x7f00000002c0)='./file1\x00', &(0x7f0000000080), 0x0, &(0x7f0000001640)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@redirect_dir_off}], [{@smackfshat={'smackfshat', 0x3d, 'overlay\x00'}}, {@euid_eq={'euid', 0x3d, 0xee00}}, {@dont_appraise}, {@fowner_lt={'fowner<', r2}}, {@defcontext={'defcontext', 0x3d, 'root'}}, {@fsmagic={'fsmagic', 0x3d, 0x4}}, {@smackfsroot={'smackfsroot', 0x3d, '-'}}]}) setxattr$trusted_overlay_opaque(&(0x7f0000000180)='./bus\x00', &(0x7f00000001c0), 0x0, 0x0, 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000580)={0x1ff, 0x0, 0x0, 0x1000, &(0x7f0000456000/0x1000)=nil}) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f00000005c0)={{0x3000, 0x4, 0x9, 0x7, 0xe, 0x40, 0x9, 0x80, 0x0, 0x4, 0xa8, 0x9}, {0x8080000, 0x4, 0x4, 0xeb, 0xed, 0x1, 0x1, 0x8, 0x2c, 0x5, 0x4, 0x8}, {0x1, 0x2, 0x4, 0xb, 0x7, 0x40, 0x1, 0x0, 0x9, 0x4, 0xc, 0xc1}, {0x100000, 0x2000, 0x1, 0x9, 0xb5, 0x8, 0x4, 0x6, 0xa6, 0x8, 0x8, 0xb}, {0x10000, 0xffff1000, 0xb, 0xc, 0xd0, 0xc, 0x2, 0xc, 0x84, 0x6, 0x10, 0x2b}, {0x0, 0x8000000, 0xd, 0x81, 0x6, 0xfb, 0x7, 0x5, 0x2, 0x67}, {0x8000000, 0x1000, 0x3, 0x8, 0x5, 0x43, 0x23, 0x0, 0xd, 0x8, 0x38}, {0xeeee8000, 0xeeee8000, 0x4, 0xc, 0x4, 0xb2, 0xbc, 0x80, 0x4, 0x9, 0x6, 0xb}, {0x102001, 0xa1b}, {0x6000, 0x7}, 0x0, 0x0, 0x2, 0x80, 0xc, 0x4000, 0x6000, [0x9, 0x81, 0x8, 0x8]}) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000000080000024d564b000000eccd"]) ioctl$KVM_RUN(r5, 0xae80, 0x0) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) listxattr(&(0x7f0000001cc0)='./bus\x00', &(0x7f0000000540)=""/4096, 0x1000) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x138a, 0x3}) r7 = mmap$binder(&(0x7f00000a0000)=nil, 0x0, 0x1, 0x11, r1, 0x4) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000100)={0x58, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x18, &(0x7f0000000440)={@flat=@weak_binder={0x77622a85, 0x0, 0x3}, @fda={0x66646185, 0x1, 0x0, 0xe}, @fd={0x66642a85, 0x0, r6}}, &(0x7f00000001c0)={0x0, 0x18, 0x38}}, 0x1000}, @free_buffer={0x40086303, r7}], 0x0, 0x0, 0x0}) 2.545633481s ago: executing program 3 (id=181): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1002, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x0) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000080)=')\x00', 0x2}], 0x1) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x33, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x2}]}, 0x10) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r0, 0x0) open(&(0x7f0000000000)='./cgroup.cpu/cpuset.cpus\x00', 0x1a1342, 0x162) mlock(&(0x7f0000fff000/0x1000)=nil, 0x1000) 2.496196505s ago: executing program 3 (id=182): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) (async) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 64) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async, rerun: 64) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) close_range(r0, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r2, 0x10e, 0x3, &(0x7f0000000040)=0x5, 0x4) 2.234010266s ago: executing program 3 (id=183): r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) dup(r0) bind$802154_raw(r0, &(0x7f0000000040)={0x24, @long={0x3, 0x3}}, 0x14) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1002, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0xa) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000040)={0x70, 0x1b, 0x9, 0x2, 0x21dfdbff, {0x1}, [@typed={0x59, 0x1, 0x0, 0x0, @str='/dev/rnlb0\x00\xe1\xb6y\xe7\xa3\xd3o\x8a\x84\xb7@~Z\xb4t\x87\x19\x87\xa6u\x80\xe4\x81\xad\xe7\xb4 \xc9\xcd\xd5o\xb6V\xc3\xebs\x8f\xba\xd5\xc4wm6\xb5\x85\xa2\x89<\fY\xc6K\xef[\xd0\x9a($R[C\x1d\x13/\x93\xea\x9f\xd1\xf8r\xca:\x88\x8d'}]}, 0x70}, 0x1, 0x0, 0x0, 0x24000810}, 0x4810) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$netlink(r4, &(0x7f0000000340)={&(0x7f0000000040)=@proc={0x10, 0x0, 0x25dfdbfb}, 0xc, &(0x7f0000000300)=[{&(0x7f0000000180)={0x154, 0x2f, 0x310, 0x70bd2b, 0x25dfdbff, "", [@generic="3cc331cb89d4a384ca265b4039831b94d5bb083f0ef4d57df7a9f9a6d9473fef879e2a792bd85681c67517d8f4ac01a6150b2b6deb2fb96619b8f835487cad641cc2fc54105fcb362a02926fb334cb9f17a54f4ea540f5799222768eca25132c80d0e4539d5cf05691a3f7c6062aed93398eedb63a146da81eeb64f189e5e9b647b2f8ec37", @generic="3d93b4f02be61e2a99e27913dfcdcd1912a7844fe3f7111ba732cc857cdf94a605940e0759c6de403e3efabcdfe4142a99de", @generic="7da45b4236ecd15bc3140febcfe7904611e9be3e744078d1e4654015d1553398bcf929db1bb8abbd3e267c12b413a7844c359f0a890e7ce85afef23157374ef7caa5c3ccd01ae75cf3e3f09c40a1c74233704be207be9f51277362eaa952fbe24bb5b20584ed85d3691a28113522e285129df9741a1949160746df3ec790fa7677e3fe13a8febbc12f01028482"]}, 0x154}], 0x1, 0x0, 0x0, 0x24000804}, 0x6b0a3620b1010dec) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000800), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) syz_usb_connect(0x0, 0x2d, &(0x7f0000000240)=ANY=[@ANYBLOB="12010d0000000708b5192100c7980000000109021b00022000ac00090400000107000009090585"], 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x84, &(0x7f00000020c0)=""/4055, &(0x7f0000001080)=0xfd7) r5 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r5, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000002040)='net/tcp\x00') read$FUSE(r6, &(0x7f0000000000)={0x2020}, 0x96) close(r5) read$FUSE(r6, &(0x7f0000004440)={0x2020}, 0x2020) openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x515002, 0xc6) close_range(r1, 0xffffffffffffffff, 0x0) 2.233433717s ago: executing program 0 (id=185): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={0x0, 0x302000, 0x1000, 0xe9, 0x7}, 0x20) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='uid_map\x00') r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r2, 0xc004ae02, &(0x7f00000007c0)) write$P9_RVERSION(r1, 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r6, 0x0, r8, 0x0, 0xf3a, 0x0) memfd_create(&(0x7f0000000440)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x11', 0x2) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB='P\x00\x00\x00\'\x00'], 0x50}, 0x1, 0x0, 0x0, 0x10}, 0x0) write(r4, &(0x7f0000000240)="94", 0x1) close(r7) tee(r3, r8, 0x8f5, 0x0) write$binfmt_script(r8, 0x0, 0xd9) clock_settime(0x300, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) writev(r10, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r10, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) sendmsg$NFQNL_MSG_VERDICT(r10, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYRES32], 0x40}}, 0x4040011) write(r5, 0x0, 0x0) ioctl$RTC_PIE_ON(r1, 0x7005) r11 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$read(0xb, r11, &(0x7f0000001040)=""/222, 0xde) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) ioctl$BINDER_GET_NODE_INFO_FOR_REF(0xffffffffffffffff, 0xc018620c, &(0x7f0000000000)={0x1}) 1.835485019s ago: executing program 0 (id=186): rt_sigaction(0x40000022, &(0x7f0000000080)={0x0, 0x80000000, 0x0, {[0x400fff]}}, 0x0, 0x8, &(0x7f0000000180)) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xf, 0x0, 0x0) r1 = syz_io_uring_complete(0x0) sigaltstack(&(0x7f0000000500)={0x0, 0x3}, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000300)=0x10001, 0x4) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, 0x0, 0x100, 0x70bd25, 0x25dfdbfe, {{}, {}, {0x18, 0x17, {0x1f, 0x2939, @l2={'ib', 0x3a, 'erspan0\x00'}}}}, ["", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0xc004}, 0x4044051) socket$unix(0x1, 0x2, 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='exfat\x00', 0x200000, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x41, &(0x7f00000001c0)={'raw\x00', 0x3, [{}, {}, {}]}, 0x58) accept(r1, &(0x7f0000000240)=@nl, &(0x7f00000002c0)=0x80) 1.674028263s ago: executing program 0 (id=187): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$inet(r0, &(0x7f0000001340)={&(0x7f0000000100)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10, &(0x7f0000001300)=[{&(0x7f00000002c0)="b65ed5f5356c9abbea60652bfb99e8b74fec917aaf3a084b6427960b", 0x1c}, {&(0x7f0000000300)="5d1399f077edf5cfa749ca331cd2695d72a81593527d241b4e46b3e58f230f7a8eb3a65b40091a19bdb74c5dc2c625e153f15d9d6220186f4cc507b12bf8adfd02150719766d262c09b45a9d5059049b4a17595e6bd1406cf0d35667fc09f1cac4d1eaa93f4b95deb32e7a2215b2ba364be548685949b2550e4e4371560cd990362d19b9a99b20a39ad6457b43f4da14198f864430bd8f60bee4cb5bcc3e5df742538cee62223ab35df3f032b0ae90946822c83f1712948b88b6e0c5ebe27321b6b60fcd807c5c7ca77cb0b638bda9b2393f668051b48822d043d03cb29db0e6868159a544954b3b73968d39e38aca68cc14782c56ecdde2216aa281a48e6c0e831e190e5e291f8497f745e6337dc823c63e73d374ad00ca567b8d8fc68837b217a9c932d0d2a5777ca62f518a563ea269bce52cccfe1d8bf060947046feeba370fd1779a4190090db1bd12ae8bf4b246390d8c44d667a999f77e696871acd680208a03db76cab2c4dcd8487e6f8dd546e1eb49bfa20bc39fdafae9a68cd2f8b33d3076be1935ad14566c92c524f3be2a82fded65a113afac5ae8e6aedbdfa46c0947ce64b6c1aa555a4b27f2ec80c26698227f763cbd4720c37891f760a1bca730ec64dc0646c72b7d0773d74e268b78c7637eeac9acdea143df56e9d533484634f8dc1ef6d22d9722d585378a169b6a36c843a06e081ba8143e8d9e3aed7062c766379be7f5ba1d7d125473cf61bc13fd8c671918a2f1a4c335265da65aaf3111e9bd58263bed65b44cb6fe4a06d057d8304d07600cb658963cb0fca36a95a58c892db613999d97650c5c06cdfe6a2f35c8f9229df214bf403b2dc3e4008a837fc814fb2433621e269ab0269f0774010179bf3bbdc88fa7200b314aaf5726b07157af5a5153979f0490d70618eaf827d91716a8cf903a6974c18f425004d3ef8af495544813d44ae1f4cdec3f259445e19f2e8b88cd80b79ab0bae882093d1f7542b6642f9a988a1865a9fd1304167afbc77209773b97bc1fa42ce494d729fe4a62fe089cd3e68c05ab8386277674e14ea94bd7e7fcee1bd3d892491d598ac09305ae65c4194dead7175998773433f29f5b57b8b520ae358b7971029af18d1784ea647edee06d796fcea8b228417e432789eec8a0a858e1a2c807e0d9587f387d7284965c23b3ffb169caf99959e766ed1f5e8c83f1bbb4318d2694fd8ee69c10c6bedbb4863b84339e9e55a0763cee7abcff6fdb30d8c9d70f9718ba0a38fe9da4a6cc5615305a0a2523e6ae897dc28ed4147f4c3a029d985ba546e4d311f7f940b15838c89dec2697700b47024b0ced07496bcbe1adcbb95b6d3f8915b5b4dfe57aa5564b926d8fe32f2a7657401f0acef2686ff32a6384f20c36d00bc753bb72858b4f144ffe28a27951e84301bcec37c8af1c4c803174fc4a6f65dbe27e291d1df2a9825238570bcb8ec9dfb022e3028beb231b4a0163790eca3a33eb64ef04275dff8c5c2b3d0f50cf29266a448b03d53e2bbd81b148b6b87df57087b34c03a8e5aace4f7bc727ff81f764b2b5f0c112f2ae67cbd83e4ef805d719ccbecd24ab36823e0f38d69600f606a9a2e41887efc77eb62afec969ec34b04fb75ec82815159bb8969d068dfde11f8a62012eeabc06c91c6dd686bb11c741443f0a4bac8a3818e9c177a9e45273454ef247b0e2634f4a5d87ee17545b641bc195cad502026d9f3e0fd4666971fc470d16c73e9f11287de5e2c268c12dde719d07b176aa1953bc07823f045c081511c823906ac21b451b798dc4bfa7f4c956bc229ca1719c00b2f087723632d88994fa21c40d579896c03a49fce911f45d87f6ff35659976ab85bb9552770d6611ce50bed73c510d9e8987386bdf69e3e5965314b4b7791c62021249975cdc4ceff46a51c65c87db80e288da235459611cdb722555bbaf26e70bfc52a2ef97d77f3a1b0c5c0a24dd605730638ab247989bf793c127ce8d06cea7ec2f9acd622c14763e92dee8b6f0b5cdf49a39551e6ed7399eb2ef83a381183a8d0c2f3051a4bb2138ab2c19aa390e39d49df2f4d0895ff22beb131e7fce27c585e1bb7cb5aa0bea58a00077c461dd9e77f7d6e40d823c067ffbb46bd55b774dae3fece78ca7dc67ff6f86959b29558dcea52a8ab9a2ece833b02ce11c1a541db965a45c2fb33bcba1c91fa3faed57f260cc40cd9362619f4aaef1b9880ceee25297d9d0083c6aa4d815f9f45801e69ea02f1a447344362d95a46a49b1dc4ca2d975510e48bbdc38a80ff0ec702838ae9253be83a74ba2bbd6e88ad37a8a851334c1312f2fe82afc9ba51868379a4a0245fdb61bfe5211b3158ffb602172ccfcb35ba08a0306c1c261d84c3b93bb227c29ad784185d011950de1ded2819c9b840d7061514490563bfc44b3a0a6963f8ff6554a7e38578bc4ede77840c4d0bb4c390d6498f5c69ff9951003ab0e374cede074ab2568fa6a4b91a778288ce9fd9635050e64e1eea1c668811a9f27ec2493ab74c697f953e91096f9bb331fd3424f4f365f1eed2ce83bea7b711f546b64a195977d08a793cefd516c9e11a6687c85f24532ba4f8fb96eb601dd80dab07ac4c514f09b0dd6be07ac999ca41dabbdfe20df33764c9855fe41260f2c6506f7b6209e3509030202986b34b1727880eb29361489e15c20d09ced9af5e27c114abf5d21aa53137d6021ebd10aa1dee3100597a874c38210206261fcbc4c6db00c54351f3b1a7de8ad24d7169fc54805bd34b5c0fa449e65c48bf6d44e56be127f246e20d4cac2617bd861420062c78da22bd29944d255b79196d149f19d2e2537ebafc3cfbc3191ce23caccde80a1ccdf390d8b420d418d6098de60902f1942b7f2307e5a2cc3b92830795804ce203016a1afdab5184ca47521bbb303556c2e0d16dd422b2f983d1f14170d99e0dd7c20ea83511422a2b37e17ad51e452837406f48dd929303c7b86296a6a7da2ec41fe18f4a1fc8d32da4ead67332f27dd73398c934b69ed19398089be7e172b46b914a12bd4ea64bc3eddb4518ad8ac5fd0834bf586d22d53cdb01b4bdf547def5af39d573701b28f8e223847d5d562b3c581c034b1ece807c83db606dc466e28ba62e5d9962d73c64a215524d8030fed70b45f887444918031219b6481b7c8d13325b3e59f5004a2fd5e077d89aa47fd118ff82998b54324677ab716ccaa131ffb21eb47505dc2c2f354200c1708723bc44908d685ccd7ed53227e8abd4321bbb4c6c56291dfaebd29f514753cf8ab645fb01d06ea48fd7fc87963193403d826276a462441db20f63836b4241aa898181a5a116f2e767d1d1cff0fcf158a714c810a3bf99c3e0b2ede31feba8509959f00e5999dbb49f5d12bead59712763efb1fb278b2e25a4709f1657b052f8d6b86bb6aba3898dd91f88b3c3f20ef9c8f14cc667591283111bd1d3c762d19602f2e5a1fb8a247c20f993d85dec1d489e31e61b3a29f683839806db68eec15f8ab65107083740e9f2085d8d28c89e64a8b90c8a9fa641265a0b250de0f365a6423da1bf272e59fe27382031f39d8783b892b1d2727909e6c375354d9ecb3c31917d31c4f56fa726adbbb60182b369bdc4087e9090ec9c0ca6b3da1ef1942d90401343ad924f6375c920028f2666685afc039067b92b65bbc9ea5116f4abd0ac131fd5e031a09e3fe0cb2b45bf181029b5a54f743679cb13bc80a8da5dd706f4493b404734aba53b901b4470ebb46bf4329d5a5b2857452d386aa564da698aa67d26cf8369fbaee11f28429057c889f105ad7b795ee0b4ccb80456692d98105322ff31bc0f45eba587d9d334696d09acc5c711c73146aaed504e9d7dafd11f10c576647ee56fe0945417310f774fcf3414f6489b19c686e735b6f638d340762929a5c14149f71464fc97e727c19ee9ad8537ecdb949a9e74271f1a44b671fadeaef5eacdd5be98d8673ff910ae0b8fa3131d235f228ed17f63115dcb54cf349abc9c13c4891730e624a9c6f4d439b0a91e54459eecec4463bff9f6e307fe010cd9ce1c90e952b6b9ee1062fc88617671dd12d2f494a6a67b6b10016e458188974c71e9df019ed6989192b2d0c209ac380f0487ac9d5dc8a02762ba96b83f84f6aa77985b2c96fbd40535f13b956daac729e09c74e6ad1961f182acadd39873127287531d9051c81c9e89d447651ff1b868ea10d57ba808cc5774bcf31f12bda305b6d56b610dfa494a620d4ad720f8820076718b0a14948405f42d89bfc947a6ed7facf33fa3546006bd69b92be13a3e1a766c299a5b7b257fcd6aaf899335eb9f6ad9e765b917bf6dbbf77731d4b9990f941024f7cb411c716d1b61ff6f6b1a5a65242c976378c487c09f8594f234dc53c926b36bcb3d8bf24ab7a7e83ae0f2e6bf136dcc45ea6b9be02aea818f81b99e8ba08f09f2387a2e235d00c7c59207ef0fd7c7633ccd533622118421af3e4da0cb0279cb9eab7c4c6cb0a465ef99ec4b52b219fc01d392c129f2e1fc209980f93bde52869151c5bf564ce6e7661abde7ffc0cd1485edfa2d1dc86cc5e3c228b8c1fb8a975b64849d4764321e6c133af3a831448020e499e79ce5a8a88a06f0416011fdc2a63a33b3f0c7e8b461c776a9d0f9da87b9f5b4ad4785855148ba4d5469f90ad3f36f0c655d2697523c355c3e4b327b6e860102ff5301d41c933ffab2b1320a2d10a6670d0a39a74850e47e0f7313f693d7609633a27c93b1cfa47f10a2013ef31e4aad7a7ef972c60b1c5d82150a6faa7f2f3a22d9717846d1e7652ad29ba8086bb9128bb525e15c7c6d2faf8958754da2caa0ba28340c0b5768a625136ff95635bb306593ee66545549fbe9b38f8b91fc84d026126184de1599b74191f19e054164938bb70df9dffe2d734e16cbc7a43d4a3fd62153d4475dd7f8cfb9f35574bb00580a2e8b0eed4e7b0e99a1a1fd296ef4f6164f17273bcaa4233f7b55cfa249c10bfba2339ee72c81b067d9bc3e93be7a4069a42c5d555e28f0564544e087a01ae73759f4581ec45b2dd4a887895c9b100e9639a48cb643f49d464f20ad2477525977bc4620e6da3745b0871c93172859f1c91b5510c741d3e4f580ff1e0a285b658a612b3b5cf97591ffbc9540e1477e506ae3372453004a36d3ee3fa5cb26a4ae078d89fb0b7bbd86d004ba00621f2a26ce832d56b515157cc4c0ae4f418fbf3c0dd689337b7671c30b4a3f075ccefa43f10518835988329dc40f66fa56cf88761addba4abfbe087f7754ffbee3f0ad0073b6a28e8860b8cbfeeea5d5baddb8796234211b99da64c708a7805792420e367b1bb2adbd2c9b1bd99c1b6c9cd5eb4062c7f47d17d5b7f076f19452d075dc8235ed8330bf80ac7aeb452c43cfe5843996b58a13c3701b0ff017135965749a470400c5ba3ce0ec13efd0321fe5c120ad56fa6cc3f8ca7ee8467894a1ce09103af55d64eeabecca78a5c284df39525c0de2910309718fb77cb5ef5b86d700dd09ac10e77d841746c9faf8c768345154e3ae917b8961895d8882056aae2bcc29a3010861a58e4b766f37020ee81108873831072a76a79a9425f0d7b64126a125f3de89693b0220f681650c883325a67c74c1eb77de8e75e5b4b3cf7f11798509aa508c56001ba624335212fd07299d0338b69998fe0af58f67545664f377857d72a197402c7202808ada77a0d78d4d7273c96a820603062785cf6928ac6920a51253c34bd292b08df882678f9a933408683942e7632eecf4fb91b60dd0801a245a5aea8ad2709b68eb", 0x1000}], 0x2}, 0x24000000) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x20002, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x11, r1, 0x45809000) clock_adjtime(0x4, &(0x7f00000001c0)={0x6, 0x7, 0x3, 0x6, 0x1, 0x0, 0x84fa, 0x401, 0x7ff, 0x7, 0x2, 0x1ff, 0x699, 0x2, 0xffffffffffffff03, 0x81, 0x3, 0x174, 0xffff, 0x2, 0x7, 0x8001, 0xd9, 0xa60, 0x80000000, 0x5}) r2 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0), 0x4000, 0x0) ioctl$BLKROSET(r1, 0x125d, &(0x7f0000000040)=0x40000000005) r3 = socket$inet_tcp(0x2, 0x1, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) setsockopt$inet_tcp_int(r3, 0x6, 0xa, &(0x7f0000000040)=0xffffffffffffffff, 0x4) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000000)={@local, 0x0, 0x0, 0xff, 0x1, 0x9}, 0x20) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x1cbd81, 0x0) ioctl$BLKRRPART(r5, 0x125f, 0x0) mmap(&(0x7f00005cc000/0x4000)=nil, 0x4000, 0xa, 0x4010, r5, 0x98256000) socket$netlink(0x10, 0x3, 0x0) fsync(r3) sendmsg$nl_netfilter(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYRES8=r4, @ANYRES32, @ANYBLOB="6abf80dfdf1a518d979678bee61a76dbb1154e5a6f1c6d50505d14823ceecb05bde602e0619beb6e45cf524baacb4d3cc4a94f0091296ec4f5afbaa5bb528c553054a8"], 0x28}}, 0x0) mount$binderfs(0x0, 0x0, 0x0, 0x4, &(0x7f0000000240)=ANY=[]) 1.490667358s ago: executing program 0 (id=188): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x800, 0x0) chown(&(0x7f0000000000)='./file0\x00', r0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x1501) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x103, 0x44, &(0x7f00000001c0)={0x20, 0x3, 0x17, 0x1}, 0x8, 0x20, 0x1, 0x0, 0x4bf, 0x404, 0x0}) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, &(0x7f0000000080)) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r2, &(0x7f00000029c0)={0x2020}, 0x2020) 1.490402907s ago: executing program 4 (id=184): mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000b20000/0x400000)=nil) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r1, 0x0, 0x2c, &(0x7f0000000480)={0x3, {{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2c}}}, {{0x2, 0x4e22, @multicast1}}}, 0x108) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) read$FUSE(0xffffffffffffffff, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x851) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) mlockall(0x1) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000280)={0x50, 0x0, r3, {0x7, 0x2b, 0x10001, 0x6b760e42d5793005, 0x3ff, 0x0, 0x9, 0x61, 0x0, 0x0, 0x100, 0x37f1}}, 0x50) mlockall(0x7) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, r6, &(0x7f0000fde000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000440)="0f20c035000000400f22c066b84f000f00d0b8400000000f23d80f21f835400000900f23f866bad00466b8684666ef650f01c5f20f066567640f78bf84de660fc730c4e3990e30030f20e035000020000f22e0", 0x53}], 0x1, 0x41, 0x0, 0x0) statfs(&(0x7f0000000000)='./file0\x00', &(0x7f00000001c0)=""/149) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) mlockall(0x3) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="280000002000010002000000000000000a00000000000001"], 0x28}], 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, r3, {0x7, 0x1f, 0x0, 0x10400}}, 0x50) r8 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) fcntl$setlease(r8, 0x400, 0x1) 1.359819269s ago: executing program 0 (id=189): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000cc0)=ANY=[@ANYBLOB="12010000773604202404019957c2010203010902240001000010000904430002317d5500090502020002020000090582020002"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000900)={0x34, &(0x7f0000000200)=ANY=[@ANYBLOB="001804"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f0000000580)={0x44, &(0x7f00000002c0)={0x20, 0x15, 0x4, "66e41940"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r4, 0x4138ae84, &(0x7f0000000440)={{0x7000, 0x0, 0x0, 0xa, 0x88, 0x8, 0x0, 0x2, 0x0, 0x7, 0x9, 0x10}, {0x8080000, 0x4, 0x10, 0x8, 0x0, 0x0, 0x0, 0x0, 0x6, 0x7, 0x0, 0xff}, {0x3000, 0x5000, 0x4, 0x0, 0x7, 0x4, 0x0, 0x1, 0x3, 0x0, 0x0, 0xa}, {0x10000, 0xd000, 0xd, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x2, 0x4}, {0x8590b1c2dac4ea16, 0x3002, 0x8, 0x0, 0xff, 0x4, 0x0, 0xe, 0x0, 0x3c}, {0x0, 0x6000, 0xb, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0xff, 0x80}, {0x6000, 0x5000, 0xa, 0x6, 0x5, 0x0, 0x68, 0x0, 0x1, 0xf9}, {0x0, 0xdddd0000, 0x0, 0x2, 0x0, 0x1, 0x0, 0xa, 0x26, 0x0, 0x10}, {0x80a0000}, {0xeeef0000, 0x3}, 0xfdfcffdb, 0x0, 0x0, 0x0, 0xb, 0xf801, 0x0, [0x80000000, 0x0, 0x401]}) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80940822}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r5, 0x100, 0x70bd26, 0x25dfdbfc}, 0x14}}, 0x10090) ioctl$KVM_TRANSLATE(r4, 0xc018ae85, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x4}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0xffffffffffffff2f, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffffffffffffa, 0x0, 0x0, 0x0}}, @register_looper], 0x25, 0x0, 0x0}) 1.358094929s ago: executing program 1 (id=150): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0xe6683000) fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r4 = dup(r3) write$FUSE_BMAP(r4, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r4, &(0x7f00000000c0)={0x14c}, 0x137) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x20008c0, &(0x7f0000000380)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r4, @ANYBLOB=',directio,dfltuid=', @ANYRESHEX=r5, @ANYBLOB="2c646972656374696f2c63616368653d6c6f6f73652c7065726d69745f646972656374696f2c736d61636b66737472616e736d7574653d282e275b9c7b2c657569643e", @ANYRESDEC=r5, @ANYBLOB="2c61707072616973655f747970653d696d61736967a04958498c2b0783b180b7da15ba0f24cc7892c63e5b2fa36383b3a1af0e691e3eb1000000000000000000000000c044fde34dbe9bbf29b22cc1f438e22e4432c2d7dc269c00bb5517a98e1505c9221a777b9dcdd27b6523ba24c7d9f867f67c24f8c25c0d2d54efe9e1534885aeb10aa38b9dddffb9f473c831cbce8969db36491d5980b3506a8f3c4d8c99aae4b502dd4fc3e36c88a8bd8e"]) read$FUSE(0xffffffffffffffff, &(0x7f00000005c0)={0x2020}, 0x2020) 1.238621198s ago: executing program 4 (id=184): mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000b20000/0x400000)=nil) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r1, 0x0, 0x2c, &(0x7f0000000480)={0x3, {{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2c}}}, {{0x2, 0x4e22, @multicast1}}}, 0x108) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) read$FUSE(0xffffffffffffffff, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x851) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) mlockall(0x1) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000280)={0x50, 0x0, r3, {0x7, 0x2b, 0x10001, 0x6b760e42d5793005, 0x3ff, 0x0, 0x9, 0x61, 0x0, 0x0, 0x100, 0x37f1}}, 0x50) mlockall(0x7) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, r6, &(0x7f0000fde000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000440)="0f20c035000000400f22c066b84f000f00d0b8400000000f23d80f21f835400000900f23f866bad00466b8684666ef650f01c5f20f066567640f78bf84de660fc730c4e3990e30030f20e035000020000f22e0", 0x53}], 0x1, 0x41, 0x0, 0x0) statfs(&(0x7f0000000000)='./file0\x00', &(0x7f00000001c0)=""/149) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) mlockall(0x3) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="280000002000010002000000000000000a00000000000001"], 0x28}], 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, r3, {0x7, 0x1f, 0x0, 0x10400}}, 0x50) r8 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) fcntl$setlease(r8, 0x400, 0x1) 1.125288408s ago: executing program 1 (id=150): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0xe6683000) fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r4 = dup(r3) write$FUSE_BMAP(r4, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r4, &(0x7f00000000c0)={0x14c}, 0x137) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x20008c0, &(0x7f0000000380)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r4, @ANYBLOB=',directio,dfltuid=', @ANYRESHEX=r5, @ANYBLOB="2c646972656374696f2c63616368653d6c6f6f73652c7065726d69745f646972656374696f2c736d61636b66737472616e736d7574653d282e275b9c7b2c657569643e", @ANYRESDEC=r5, @ANYBLOB="2c61707072616973655f747970653d696d61736967a04958498c2b0783b180b7da15ba0f24cc7892c63e5b2fa36383b3a1af0e691e3eb1000000000000000000000000c044fde34dbe9bbf29b22cc1f438e22e4432c2d7dc269c00bb5517a98e1505c9221a777b9dcdd27b6523ba24c7d9f867f67c24f8c25c0d2d54efe9e1534885aeb10aa38b9dddffb9f473c831cbce8969db36491d5980b3506a8f3c4d8c99aae4b502dd4fc3e36c88a8bd8e"]) read$FUSE(0xffffffffffffffff, &(0x7f00000005c0)={0x2020}, 0x2020) 1.003583208s ago: executing program 4 (id=184): mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000b20000/0x400000)=nil) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r1, 0x0, 0x2c, &(0x7f0000000480)={0x3, {{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2c}}}, {{0x2, 0x4e22, @multicast1}}}, 0x108) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) read$FUSE(0xffffffffffffffff, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x851) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) mlockall(0x1) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000280)={0x50, 0x0, r3, {0x7, 0x2b, 0x10001, 0x6b760e42d5793005, 0x3ff, 0x0, 0x9, 0x61, 0x0, 0x0, 0x100, 0x37f1}}, 0x50) mlockall(0x7) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, r6, &(0x7f0000fde000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000440)="0f20c035000000400f22c066b84f000f00d0b8400000000f23d80f21f835400000900f23f866bad00466b8684666ef650f01c5f20f066567640f78bf84de660fc730c4e3990e30030f20e035000020000f22e0", 0x53}], 0x1, 0x41, 0x0, 0x0) statfs(&(0x7f0000000000)='./file0\x00', &(0x7f00000001c0)=""/149) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) mlockall(0x3) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="280000002000010002000000000000000a00000000000001"], 0x28}], 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, r3, {0x7, 0x1f, 0x0, 0x10400}}, 0x50) r8 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) fcntl$setlease(r8, 0x400, 0x1) 845.134491ms ago: executing program 1 (id=150): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0xe6683000) fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r4 = dup(r3) write$FUSE_BMAP(r4, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r4, &(0x7f00000000c0)={0x14c}, 0x137) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x20008c0, &(0x7f0000000380)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r4, @ANYBLOB=',directio,dfltuid=', @ANYRESHEX=r5, @ANYBLOB="2c646972656374696f2c63616368653d6c6f6f73652c7065726d69745f646972656374696f2c736d61636b66737472616e736d7574653d282e275b9c7b2c657569643e", @ANYRESDEC=r5, @ANYBLOB="2c61707072616973655f747970653d696d61736967a04958498c2b0783b180b7da15ba0f24cc7892c63e5b2fa36383b3a1af0e691e3eb1000000000000000000000000c044fde34dbe9bbf29b22cc1f438e22e4432c2d7dc269c00bb5517a98e1505c9221a777b9dcdd27b6523ba24c7d9f867f67c24f8c25c0d2d54efe9e1534885aeb10aa38b9dddffb9f473c831cbce8969db36491d5980b3506a8f3c4d8c99aae4b502dd4fc3e36c88a8bd8e"]) read$FUSE(0xffffffffffffffff, &(0x7f00000005c0)={0x2020}, 0x2020) 709.644592ms ago: executing program 3 (id=190): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$poke(0x4, r0, &(0x7f0000000380), 0x10000) (async) ptrace$poke(0x4, r0, &(0x7f0000000380), 0x10000) socket$unix(0x1, 0x1, 0x0) (async) r1 = socket$unix(0x1, 0x1, 0x0) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x1d, &(0x7f0000002900)=0x659c, 0x4) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) getsockname$packet(r2, 0x0, 0x0) r3 = creat(&(0x7f0000000080)='./cgroup\x00', 0x100) recvfrom$packet(r3, &(0x7f0000000100)=""/190, 0xbe, 0x42, &(0x7f0000000240)={0x11, 0x1c, 0x0, 0x1, 0x5, 0x6, @broadcast}, 0x14) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0)='ext3\x00', 0x200000, 0x0) 709.406612ms ago: executing program 4 (id=184): mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000b20000/0x400000)=nil) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r1, 0x0, 0x2c, &(0x7f0000000480)={0x3, {{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2c}}}, {{0x2, 0x4e22, @multicast1}}}, 0x108) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) read$FUSE(0xffffffffffffffff, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x851) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) mlockall(0x1) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000280)={0x50, 0x0, r3, {0x7, 0x2b, 0x10001, 0x6b760e42d5793005, 0x3ff, 0x0, 0x9, 0x61, 0x0, 0x0, 0x100, 0x37f1}}, 0x50) mlockall(0x7) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, r6, &(0x7f0000fde000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000440)="0f20c035000000400f22c066b84f000f00d0b8400000000f23d80f21f835400000900f23f866bad00466b8684666ef650f01c5f20f066567640f78bf84de660fc730c4e3990e30030f20e035000020000f22e0", 0x53}], 0x1, 0x41, 0x0, 0x0) statfs(&(0x7f0000000000)='./file0\x00', &(0x7f00000001c0)=""/149) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) mlockall(0x3) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="280000002000010002000000000000000a00000000000001"], 0x28}], 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, r3, {0x7, 0x1f, 0x0, 0x10400}}, 0x50) r8 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) fcntl$setlease(r8, 0x400, 0x1) 569.957803ms ago: executing program 1 (id=150): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0xe6683000) fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r4 = dup(r3) write$FUSE_BMAP(r4, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r4, &(0x7f00000000c0)={0x14c}, 0x137) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x20008c0, &(0x7f0000000380)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r4, @ANYBLOB=',directio,dfltuid=', @ANYRESHEX=r5, @ANYBLOB="2c646972656374696f2c63616368653d6c6f6f73652c7065726d69745f646972656374696f2c736d61636b66737472616e736d7574653d282e275b9c7b2c657569643e", @ANYRESDEC=r5, @ANYBLOB="2c61707072616973655f747970653d696d61736967a04958498c2b0783b180b7da15ba0f24cc7892c63e5b2fa36383b3a1af0e691e3eb1000000000000000000000000c044fde34dbe9bbf29b22cc1f438e22e4432c2d7dc269c00bb5517a98e1505c9221a777b9dcdd27b6523ba24c7d9f867f67c24f8c25c0d2d54efe9e1534885aeb10aa38b9dddffb9f473c831cbce8969db36491d5980b3506a8f3c4d8c99aae4b502dd4fc3e36c88a8bd8e"]) read$FUSE(0xffffffffffffffff, &(0x7f00000005c0)={0x2020}, 0x2020) 441.034484ms ago: executing program 3 (id=191): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fda000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f00000001c0)="b805000000b9fa0000000f01d9660f78c4020a1bf7b805000000b90000c0fe0fae41d901000000b87f8b7f26ba000000000f30660fc775022e0fba600c980f320f3566b857000f00d0", 0x49}], 0x1, 0x10, 0x0, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000040)={0xbe, 0x0, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000740), 0x20001, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) recvmsg(r5, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x2) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e21, 0x659, @empty, 0xff}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x80, 0x0, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000008000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f0000000240)="0f0d51f40f01d10fc75800f30fc73600102e0f71e100b800008ec0640f017400aa66b9e408000066b81f6269e766ba000000000f309c0c0cb8d09bbc8966efbafc0cedba4300ba210066ed3626f00fc70d", 0x51}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r8, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r8, 0x0) r9 = syz_open_dev$mouse(&(0x7f0000000040), 0xdd, 0x101200) ioctl$GIO_CMAP(r9, 0x4b70, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x4}, @fda={0x66646185, 0x1, 0x0, 0xe}, @fda={0x66646185, 0x8, 0x0, 0x200000024}}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0}) 440.784224ms ago: executing program 4 (id=184): mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000b20000/0x400000)=nil) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r1, 0x0, 0x2c, &(0x7f0000000480)={0x3, {{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2c}}}, {{0x2, 0x4e22, @multicast1}}}, 0x108) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) read$FUSE(0xffffffffffffffff, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x851) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) mlockall(0x1) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000280)={0x50, 0x0, r3, {0x7, 0x2b, 0x10001, 0x6b760e42d5793005, 0x3ff, 0x0, 0x9, 0x61, 0x0, 0x0, 0x100, 0x37f1}}, 0x50) mlockall(0x7) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, r6, &(0x7f0000fde000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000440)="0f20c035000000400f22c066b84f000f00d0b8400000000f23d80f21f835400000900f23f866bad00466b8684666ef650f01c5f20f066567640f78bf84de660fc730c4e3990e30030f20e035000020000f22e0", 0x53}], 0x1, 0x41, 0x0, 0x0) statfs(&(0x7f0000000000)='./file0\x00', &(0x7f00000001c0)=""/149) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) mlockall(0x3) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="280000002000010002000000000000000a00000000000001"], 0x28}], 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, r3, {0x7, 0x1f, 0x0, 0x10400}}, 0x50) r8 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) fcntl$setlease(r8, 0x400, 0x1) 288.470206ms ago: executing program 1 (id=150): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0xe6683000) fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r4 = dup(r3) write$FUSE_BMAP(r4, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r4, &(0x7f00000000c0)={0x14c}, 0x137) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x20008c0, &(0x7f0000000380)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r4, @ANYBLOB=',directio,dfltuid=', @ANYRESHEX=r5, @ANYBLOB="2c646972656374696f2c63616368653d6c6f6f73652c7065726d69745f646972656374696f2c736d61636b66737472616e736d7574653d282e275b9c7b2c657569643e", @ANYRESDEC=r5, @ANYBLOB="2c61707072616973655f747970653d696d61736967a04958498c2b0783b180b7da15ba0f24cc7892c63e5b2fa36383b3a1af0e691e3eb1000000000000000000000000c044fde34dbe9bbf29b22cc1f438e22e4432c2d7dc269c00bb5517a98e1505c9221a777b9dcdd27b6523ba24c7d9f867f67c24f8c25c0d2d54efe9e1534885aeb10aa38b9dddffb9f473c831cbce8969db36491d5980b3506a8f3c4d8c99aae4b502dd4fc3e36c88a8bd8e"]) read$FUSE(0xffffffffffffffff, &(0x7f00000005c0)={0x2020}, 0x2020) 145.943818ms ago: executing program 4 (id=184): mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000b20000/0x400000)=nil) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r1, 0x0, 0x2c, &(0x7f0000000480)={0x3, {{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2c}}}, {{0x2, 0x4e22, @multicast1}}}, 0x108) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) read$FUSE(0xffffffffffffffff, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x851) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) mlockall(0x1) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000280)={0x50, 0x0, r3, {0x7, 0x2b, 0x10001, 0x6b760e42d5793005, 0x3ff, 0x0, 0x9, 0x61, 0x0, 0x0, 0x100, 0x37f1}}, 0x50) mlockall(0x7) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, r6, &(0x7f0000fde000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000440)="0f20c035000000400f22c066b84f000f00d0b8400000000f23d80f21f835400000900f23f866bad00466b8684666ef650f01c5f20f066567640f78bf84de660fc730c4e3990e30030f20e035000020000f22e0", 0x53}], 0x1, 0x41, 0x0, 0x0) statfs(&(0x7f0000000000)='./file0\x00', &(0x7f00000001c0)=""/149) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) mlockall(0x3) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="280000002000010002000000000000000a00000000000001"], 0x28}], 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, r3, {0x7, 0x1f, 0x0, 0x10400}}, 0x50) r8 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) fcntl$setlease(r8, 0x400, 0x1) 0s ago: executing program 1 (id=150): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0xe6683000) fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r4 = dup(r3) write$FUSE_BMAP(r4, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r4, &(0x7f00000000c0)={0x14c}, 0x137) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x20008c0, &(0x7f0000000380)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r4, @ANYBLOB=',directio,dfltuid=', @ANYRESHEX=r5, @ANYBLOB="2c646972656374696f2c63616368653d6c6f6f73652c7065726d69745f646972656374696f2c736d61636b66737472616e736d7574653d282e275b9c7b2c657569643e", @ANYRESDEC=r5, @ANYBLOB="2c61707072616973655f747970653d696d61736967a04958498c2b0783b180b7da15ba0f24cc7892c63e5b2fa36383b3a1af0e691e3eb1000000000000000000000000c044fde34dbe9bbf29b22cc1f438e22e4432c2d7dc269c00bb5517a98e1505c9221a777b9dcdd27b6523ba24c7d9f867f67c24f8c25c0d2d54efe9e1534885aeb10aa38b9dddffb9f473c831cbce8969db36491d5980b3506a8f3c4d8c99aae4b502dd4fc3e36c88a8bd8e"]) read$FUSE(0xffffffffffffffff, &(0x7f00000005c0)={0x2020}, 0x2020) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.201' (ED25519) to the list of known hosts. [ 22.988988][ T36] audit: type=1400 audit(1755771680.120:64): avc: denied { mounton } for pid=281 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.990450][ T281] cgroup: Unknown subsys name 'net' [ 23.011775][ T36] audit: type=1400 audit(1755771680.120:65): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.039079][ T36] audit: type=1400 audit(1755771680.150:66): avc: denied { unmount } for pid=281 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.039488][ T281] cgroup: Unknown subsys name 'devices' [ 23.243730][ T281] cgroup: Unknown subsys name 'hugetlb' [ 23.249391][ T281] cgroup: Unknown subsys name 'rlimit' [ 23.404670][ T36] audit: type=1400 audit(1755771680.540:67): avc: denied { setattr } for pid=281 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.428103][ T36] audit: type=1400 audit(1755771680.540:68): avc: denied { mounton } for pid=281 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.439036][ T283] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 23.453163][ T36] audit: type=1400 audit(1755771680.540:69): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 23.484791][ T36] audit: type=1400 audit(1755771680.600:70): avc: denied { relabelto } for pid=283 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.510565][ T36] audit: type=1400 audit(1755771680.600:71): avc: denied { write } for pid=283 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.548011][ T36] audit: type=1400 audit(1755771680.690:72): avc: denied { read } for pid=281 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.573619][ T36] audit: type=1400 audit(1755771680.690:73): avc: denied { open } for pid=281 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.573680][ T281] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.413725][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.420892][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.428167][ T288] bridge_slave_0: entered allmulticast mode [ 24.434639][ T288] bridge_slave_0: entered promiscuous mode [ 24.444684][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.451765][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.458865][ T288] bridge_slave_1: entered allmulticast mode [ 24.465363][ T288] bridge_slave_1: entered promiscuous mode [ 24.487070][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.494204][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.501507][ T291] bridge_slave_0: entered allmulticast mode [ 24.507876][ T291] bridge_slave_0: entered promiscuous mode [ 24.518699][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.525905][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.533059][ T291] bridge_slave_1: entered allmulticast mode [ 24.539318][ T291] bridge_slave_1: entered promiscuous mode [ 24.573958][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.581036][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.588155][ T290] bridge_slave_0: entered allmulticast mode [ 24.594491][ T290] bridge_slave_0: entered promiscuous mode [ 24.600909][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.608012][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.615103][ T290] bridge_slave_1: entered allmulticast mode [ 24.621508][ T290] bridge_slave_1: entered promiscuous mode [ 24.647733][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.654898][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.662029][ T289] bridge_slave_0: entered allmulticast mode [ 24.668276][ T289] bridge_slave_0: entered promiscuous mode [ 24.684744][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.691865][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.699308][ T289] bridge_slave_1: entered allmulticast mode [ 24.705715][ T289] bridge_slave_1: entered promiscuous mode [ 24.854625][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.861719][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.869019][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.876076][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.889015][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.896108][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.903433][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.910476][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.930966][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.938240][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.945579][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.952646][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.989792][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.996916][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.004257][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.011325][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.023445][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.030781][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.038507][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.045806][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.053387][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.060636][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.068041][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.075346][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.100727][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.107846][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.124791][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.131963][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.139625][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.146708][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.155939][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.163009][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.183635][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.190725][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.202477][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.209564][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.245821][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.253012][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.260722][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.267873][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.289171][ T290] veth0_vlan: entered promiscuous mode [ 25.313883][ T291] veth0_vlan: entered promiscuous mode [ 25.322835][ T290] veth1_macvtap: entered promiscuous mode [ 25.341815][ T288] veth0_vlan: entered promiscuous mode [ 25.352940][ T289] veth0_vlan: entered promiscuous mode [ 25.366156][ T291] veth1_macvtap: entered promiscuous mode [ 25.389378][ T289] veth1_macvtap: entered promiscuous mode [ 25.406317][ T290] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 25.427088][ T288] veth1_macvtap: entered promiscuous mode [ 25.505799][ T334] fuse: Bad value for 'user_id' [ 25.511544][ T334] fuse: Bad value for 'user_id' [ 25.517331][ T335] rust_binder: Read failure Err(EAGAIN) in pid:2 [ 25.522592][ T334] rust_binder: Error while translating object. [ 25.529116][ T334] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 25.536376][ T334] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:2 [ 25.579007][ T354] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.708298][ T362] rust_binder: Write failure EFAULT in pid:9 [ 25.730333][ T365] overlayfs: missing 'lowerdir' [ 25.761882][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 25.922353][ T10] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 25.933532][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.945323][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 25.955151][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 25.969036][ T10] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 25.978397][ T10] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 25.986547][ T10] usb 4-1: Manufacturer: syz [ 25.992531][ T10] usb 4-1: config 0 descriptor?? [ 26.402480][ T10] appleir 0003:05AC:8243.0001: unknown main item tag 0x0 [ 26.409900][ T10] appleir 0003:05AC:8243.0001: No inputs registered, leaving [ 26.426038][ T10] appleir 0003:05AC:8243.0001: hiddev96,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 26.557314][ T390] rust_binder: 24: no such ref 0 [ 26.562354][ T390] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:24 [ 26.675475][ T10] usb 4-1: USB disconnect, device number 2 [ 26.782072][ T66] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.787766][ T402] 9pnet_fd: Insufficient options for proto=fd [ 26.931305][ T66] usb 1-1: Using ep0 maxpacket: 16 [ 26.937570][ T66] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 26.946361][ T66] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 26.957123][ T66] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 26.967904][ T66] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 26.977124][ T66] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.985203][ T66] usb 1-1: Product: syz [ 26.989387][ T66] usb 1-1: Manufacturer: syz [ 26.994030][ T66] usb 1-1: SerialNumber: syz [ 27.041369][ T45] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 27.091169][ T377] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 27.191149][ T45] usb 3-1: Using ep0 maxpacket: 16 [ 27.197097][ T45] usb 3-1: unable to get BOS descriptor or descriptor too short [ 27.205778][ T45] usb 3-1: config 1 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 27.218876][ T45] usb 3-1: config 1 interface 0 has no altsetting 0 [ 27.229159][ T45] usb 3-1: New USB device found, idVendor=0c70, idProduct=f011, bcdDevice= 0.40 [ 27.238554][ T45] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.246707][ T409] netlink: 1 bytes leftover after parsing attributes in process `syz.3.27'. [ 27.246798][ T45] usb 3-1: Product: syz [ 27.256135][ T45] usb 3-1: Manufacturer: syz [ 27.264599][ T45] usb 3-1: SerialNumber: syz [ 27.269756][ T377] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 27.280995][ T377] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 27.294218][ T377] usb 2-1: New USB device found, idVendor=056a, idProduct=0020, bcdDevice= 0.00 [ 27.304046][ T377] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.314911][ T377] usb 2-1: config 0 descriptor?? [ 27.320320][ T406] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 27.401773][ T66] usb 1-1: 0:2 : does not exist [ 27.512897][ T392] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 27.512937][ T392] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:26 [ 27.526570][ T45] usbhid 3-1:1.0: can't add hid device: -71 [ 27.542352][ T45] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 27.552139][ T45] usb 3-1: USB disconnect, device number 2 [ 27.562476][ T406] rust_binder: validate_parent_fixup: new_min_offset=79, sg_entry.length=0 [ 27.562506][ T406] rust_binder: Error while translating object. [ 27.571278][ T406] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 27.577565][ T406] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:21 [ 27.633772][ T377] usbhid 2-1:0.0: can't add hid device: -71 [ 27.648999][ T377] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 27.658102][ T377] usb 2-1: USB disconnect, device number 2 [ 28.049018][ T36] kauditd_printk_skb: 102 callbacks suppressed [ 28.049039][ T36] audit: type=1400 audit(1755771685.180:176): avc: denied { read write } for pid=412 comm="syz.2.29" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 28.079566][ T36] audit: type=1400 audit(1755771685.180:177): avc: denied { getopt } for pid=411 comm="syz.3.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 28.100099][ T36] audit: type=1400 audit(1755771685.200:178): avc: denied { open } for pid=412 comm="syz.2.29" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 28.129552][ T36] audit: type=1400 audit(1755771685.200:179): avc: denied { ioctl } for pid=412 comm="syz.2.29" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 ioctlcmd=0xaf7a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 28.171860][ T36] audit: type=1400 audit(1755771685.300:180): avc: denied { read write } for pid=424 comm="syz.3.33" name="uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 28.191844][ T427] ======================================================= [ 28.191844][ T427] WARNING: The mand mount option has been deprecated and [ 28.191844][ T427] and is ignored by this kernel. Remove the mand [ 28.191844][ T427] option from the mount to silence this warning. [ 28.191844][ T427] ======================================================= [ 28.195758][ T36] audit: type=1400 audit(1755771685.300:181): avc: denied { open } for pid=424 comm="syz.3.33" path="/dev/uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 28.236573][ T427] overlayfs: overlapping lowerdir path [ 28.257358][ T36] audit: type=1400 audit(1755771685.310:182): avc: denied { connect } for pid=426 comm="syz.1.34" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 28.280407][ T36] audit: type=1400 audit(1755771685.310:183): avc: denied { write } for pid=426 comm="syz.1.34" laddr=fe80::a8aa:aaff:feaa:aaaa lport=58 faddr=ff03::1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 28.308089][ T36] audit: type=1400 audit(1755771685.310:184): avc: denied { create } for pid=426 comm="syz.1.34" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 28.329264][ T36] audit: type=1400 audit(1755771685.370:185): avc: denied { mount } for pid=426 comm="syz.1.34" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 28.355285][ T438] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 28.355319][ T438] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:24 [ 28.356680][ T439] binder: Unknown parameter 'dont_measure' [ 28.381183][ T10] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 28.435093][ T445] binder: Unknown parameter '7. M#' [ 28.467422][ T450] x_tables: duplicate underflow at hook 1 [ 28.532368][ T10] usb 3-1: too many configurations: 9, using maximum allowed: 8 [ 28.547119][ T10] usb 3-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=b9.bf [ 28.556289][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.564378][ T10] usb 3-1: Product: syz [ 28.568646][ T10] usb 3-1: Manufacturer: syz [ 28.573323][ T10] usb 3-1: SerialNumber: syz [ 28.578563][ T10] usb 3-1: config 0 descriptor?? [ 28.585660][ T10] usb 3-1: Waiting for MOTU Microbook II to boot up... [ 28.592742][ T10] usb 3-1: failed setting the sample rate for Motu MicroBook II: -22 [ 28.600866][ T10] snd-usb-audio 3-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 28.602838][ T460] FAT-fs (rnullb0): bogus number of reserved sectors [ 28.618123][ T460] FAT-fs (rnullb0): Can't find a valid FAT filesystem [ 28.688461][ T464] rust_binder: Failed to allocate buffer. len:24, is_oneway:false [ 28.862436][ T10] usb 3-1: USB disconnect, device number 3 [ 28.892315][ T66] usb 1-1: USB disconnect, device number 2 [ 28.900643][ T342] udevd[342]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 29.411905][ T471] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem [ 29.611213][ T45] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 29.721192][ T10] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 29.771147][ T45] usb 3-1: Using ep0 maxpacket: 32 [ 29.777504][ T45] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 29.786258][ T45] usb 3-1: config 0 has no interface number 0 [ 29.792640][ T45] usb 3-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 29.802849][ T45] usb 3-1: config 0 interface 196 has no altsetting 0 [ 29.812595][ T488] __vm_enough_memory: pid: 488, comm: syz.0.55, bytes: 18014402804453376 not enough memory for the allocation [ 29.824425][ T45] usb 3-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 29.825636][ T490] __vm_enough_memory: pid: 490, comm: syz.0.55, bytes: 18014402804453376 not enough memory for the allocation [ 29.834077][ T45] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.834105][ T45] usb 3-1: Product: syz [ 29.857977][ T45] usb 3-1: Manufacturer: syz [ 29.862647][ T45] usb 3-1: SerialNumber: syz [ 29.868086][ T45] usb 3-1: config 0 descriptor?? [ 29.873465][ T467] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 29.882927][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 29.889850][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 29.901045][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 29.911221][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 29.929780][ T10] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 29.940753][ T494] process 'syz.1.57' launched './file0' with NULL argv: empty string added [ 29.945309][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.963023][ T10] usb 4-1: config 0 descriptor?? [ 30.111170][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 30.191531][ T377] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 30.261769][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 30.269485][ T9] usb 1-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 30.278651][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.286742][ T9] usb 1-1: Product: syz [ 30.290935][ T9] usb 1-1: Manufacturer: syz [ 30.295588][ T9] usb 1-1: SerialNumber: syz [ 30.302872][ T9] r8152-cfgselector 1-1: Unknown version 0x0000 [ 30.309188][ T9] r8152-cfgselector 1-1: config 0 descriptor?? [ 30.316551][ T9] hub 1-1:0.0: bad descriptor, ignoring hub [ 30.322570][ T9] hub 1-1:0.0: probe with driver hub failed with error -5 [ 30.352424][ T377] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 30.363613][ T377] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.373598][ T377] usb 2-1: New USB device found, idVendor=056a, idProduct=0000, bcdDevice= 0.00 [ 30.377956][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 30.382736][ T377] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.397207][ T377] usb 2-1: config 0 descriptor?? [ 30.398287][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 30.410321][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 30.417702][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 30.425527][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 30.433162][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 30.440421][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 30.447741][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 30.455202][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 30.462533][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 30.482075][ T10] input: HID 045e:07da as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:07DA.0002/input/input4 [ 30.484761][ T45] ipheth 3-1:0.196: ipheth_enable_ncm: usb_control_msg: 0 [ 30.503812][ T10] microsoft 0003:045E:07DA.0002: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 30.511379][ T45] ipheth 3-1:0.196: Apple iPhone USB Ethernet device attached [ 30.523618][ T9] r8152-cfgselector 1-1: Unknown version 0x0000 [ 30.532679][ T9] r8152-cfgselector 1-1: bad CDC descriptors [ 30.604677][ T502] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 30.612460][ T377] wacom 0003:056A:0000.0003: Unknown device_type for 'HID 056a:0000'. Assuming pen. [ 30.638969][ T377] wacom 0003:056A:0000.0003: hidraw1: USB HID v0.01 Device [HID 056a:0000] on usb-dummy_hcd.1-1/input0 [ 30.672344][ T377] input: Wacom Penpartner Pen as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:056A:0000.0003/input/input5 [ 30.705875][ T45] usb 3-1: USB disconnect, device number 4 [ 30.723315][ T377] usb 2-1: USB disconnect, device number 3 [ 30.752262][ T522] 9pnet_fd: Insufficient options for proto=fd [ 30.758639][ T45] ipheth 3-1:0.196: Apple iPhone USB Ethernet now disconnected [ 31.201143][ T377] usb 2-1: new low-speed USB device number 4 using dummy_hcd [ 31.331146][ T377] usb 2-1: device descriptor read/64, error -71 [ 31.333582][ T553] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 31.337467][ T553] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:52 [ 31.347065][ T10] r8152-cfgselector 1-1: USB disconnect, device number 3 [ 31.363322][ T553] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 31.363344][ T553] rust_binder: Read failure Err(EFAULT) in pid:52 [ 31.389374][ T555] binder: Bad value for 'max' [ 31.551139][ T9] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 31.571159][ T377] usb 2-1: device descriptor read/64, error -71 [ 31.723041][ T9] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 528 [ 31.733249][ T9] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1024 [ 31.741179][ T45] usb 4-1: reset high-speed USB device number 3 using dummy_hcd [ 31.745152][ T9] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 31.760124][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.768252][ T9] usb 3-1: Product: syz [ 31.772632][ T9] usb 3-1: Manufacturer: Ф [ 31.777235][ T9] usb 3-1: SerialNumber: syz [ 31.811154][ T377] usb 2-1: new low-speed USB device number 5 using dummy_hcd [ 31.941211][ T377] usb 2-1: device descriptor read/64, error -71 [ 31.948809][ T564] overlayfs: missing 'lowerdir' [ 31.989088][ T9] cdc_ncm 3-1:1.0: CDC Union missing and no IAD found [ 31.998735][ T9] cdc_ncm 3-1:1.0: bind() failure [ 32.011961][ T9] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 32.018798][ T9] cdc_ncm 3-1:1.1: bind() failure [ 32.197916][ T540] rust_binder: Error while translating object. [ 32.197970][ T540] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 32.201172][ T377] usb 2-1: device descriptor read/64, error -71 [ 32.204530][ T540] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:35 [ 32.222030][ T524] usb 3-1: USB disconnect, device number 5 [ 32.273593][ T574] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 32.321421][ T377] usb usb2-port1: attempt power cycle [ 32.349333][ T585] fuse: Bad value for 'user_id' [ 32.354441][ T585] fuse: Bad value for 'user_id' [ 32.595927][ T599] rust_binder: Write failure EFAULT in pid:51 [ 32.671182][ T377] usb 2-1: new low-speed USB device number 6 using dummy_hcd [ 32.702192][ T377] usb 2-1: device descriptor read/8, error -71 [ 32.788609][ T602] netlink: 'syz.2.82': attribute type 13 has an invalid length. [ 32.796428][ T602] netlink: 'syz.2.82': attribute type 13 has an invalid length. [ 32.804274][ T602] netlink: 'syz.2.82': attribute type 13 has an invalid length. [ 32.812022][ T602] netlink: 'syz.2.82': attribute type 13 has an invalid length. [ 32.819728][ T602] netlink: 'syz.2.82': attribute type 13 has an invalid length. [ 32.827567][ T602] netlink: 'syz.2.82': attribute type 13 has an invalid length. [ 32.835328][ T602] netlink: 'syz.2.82': attribute type 13 has an invalid length. [ 32.842285][ T377] usb 2-1: device descriptor read/8, error -71 [ 32.843235][ T602] netlink: 'syz.2.82': attribute type 13 has an invalid length. [ 32.856923][ T602] netlink: 'syz.2.82': attribute type 13 has an invalid length. [ 32.864781][ T602] netlink: 'syz.2.82': attribute type 13 has an invalid length. [ 32.892084][ T605] Zero length message leads to an empty skb [ 32.901156][ T45] usb 4-1: device descriptor read/64, error -71 [ 33.081161][ T377] usb 2-1: new low-speed USB device number 7 using dummy_hcd [ 33.102305][ T377] usb 2-1: device descriptor read/8, error -71 [ 33.141198][ T45] usb 4-1: device descriptor read/64, error -71 [ 33.232307][ T377] usb 2-1: device descriptor read/8, error -71 [ 33.341213][ T377] usb usb2-port1: unable to enumerate USB device [ 33.381150][ T45] usb 4-1: reset high-speed USB device number 3 using dummy_hcd [ 33.511143][ T45] usb 4-1: device descriptor read/64, error -71 [ 33.751168][ T45] usb 4-1: device descriptor read/64, error -71 [ 33.763855][ T610] rust_binder: Error while translating object. [ 33.763915][ T610] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 33.770200][ T610] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:46 [ 33.942984][ T617] netlink: 124 bytes leftover after parsing attributes in process `syz.2.87'. [ 33.962969][ T617] overlay: Unknown parameter '00000040000' [ 33.991148][ T45] usb 4-1: reset high-speed USB device number 3 using dummy_hcd [ 34.010809][ T619] /dev/rnullb0: Can't lookup blockdev [ 34.017816][ T36] kauditd_printk_skb: 71 callbacks suppressed [ 34.017835][ T36] audit: type=1400 audit(1755771691.157:257): avc: denied { watch watch_reads } for pid=618 comm="syz.2.88" path="/syzcgroup/unified/syz2" dev="cgroup2" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 34.050733][ T45] usb 4-1: device descriptor read/8, error -71 [ 34.054808][ T621] netlink: 32 bytes leftover after parsing attributes in process `syz.2.89'. [ 34.067401][ T36] audit: type=1400 audit(1755771691.207:258): avc: denied { listen } for pid=622 comm="syz.1.90" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 34.108747][ T628] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 34.109494][ T628] rust_binder: Failed to allocate buffer. len:4144, is_oneway:false [ 34.122977][ T628] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 34.131153][ T628] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:57 [ 34.155423][ T36] audit: type=1400 audit(1755771691.297:259): avc: denied { bind } for pid=632 comm="syz.1.94" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 34.202196][ T45] usb 4-1: device descriptor read/8, error -71 [ 34.322878][ T643] binder: Bad value for 'stats' [ 34.441144][ T45] usb 4-1: reset high-speed USB device number 3 using dummy_hcd [ 34.466830][ T45] usb 4-1: device descriptor read/8, error -71 [ 34.601806][ T658] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 34.602282][ T45] usb 4-1: device descriptor read/8, error -71 [ 34.633928][ T660] kvm: user requested TSC rate below hardware speed [ 34.650360][ T661] kvm: user requested TSC rate below hardware speed [ 34.660983][ T661] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 34.668236][ T661] rust_binder: Write failure EINVAL in pid:72 [ 34.687926][ T658] rust_binder: Failed to allocate buffer. len:4208, is_oneway:false [ 34.694129][ T658] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 34.702251][ T658] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:76 [ 34.732760][ T36] audit: type=1400 audit(1755771691.877:260): avc: denied { append } for pid=662 comm="syz.2.104" name="ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 34.768775][ T31] usb 4-1: USB disconnect, device number 3 [ 34.812722][ T674] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 34.813048][ T674] rust_binder: Failed copying remainder into alloc: EFAULT [ 34.819906][ T674] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 34.827457][ T674] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 34.835995][ T674] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:83 [ 34.846950][ T36] audit: type=1400 audit(1755771691.987:261): avc: denied { read } for pid=668 comm="syz.2.106" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 34.882565][ T36] audit: type=1400 audit(1755771691.997:262): avc: denied { open } for pid=668 comm="syz.2.106" path="/28/file0/.pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 34.906822][ T678] 9pnet_fd: Insufficient options for proto=fd [ 34.913027][ T36] audit: type=1400 audit(1755771692.037:263): avc: denied { read write } for pid=677 comm="syz.1.109" name="uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 34.936221][ T31] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 34.936855][ T36] audit: type=1400 audit(1755771692.037:264): avc: denied { open } for pid=677 comm="syz.1.109" path="/dev/uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 35.071154][ T31] usb 4-1: device descriptor read/64, error -71 [ 35.311148][ T31] usb 4-1: device descriptor read/64, error -71 [ 35.473006][ T36] audit: type=1400 audit(1755771692.617:265): avc: denied { getopt } for pid=680 comm="syz.0.110" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 35.493350][ T681] tmpfs: Invalid uid '0x00000000ffffffff' [ 35.551150][ T31] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 35.575695][ T36] audit: type=1400 audit(1755771692.717:266): avc: denied { ioctl } for pid=682 comm="syz.0.111" path="socket:[6741]" dev="sockfs" ino=6741 ioctlcmd=0x8983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 35.649263][ T695] tipc: Enabling of bearer rejected, media not registered [ 35.662271][ T695] netlink: 4 bytes leftover after parsing attributes in process `syz.0.114'. [ 35.681257][ T31] usb 4-1: device descriptor read/64, error -71 [ 35.726271][ T709] binder: Bad value for 'stats' [ 35.772104][ T712] SELinux: failed to load policy [ 35.924421][ T735] rust_binder: inc_ref_done called when no active inc_refs [ 35.924448][ T735] rust_binder: 121: no such ref 1 [ 35.937094][ T735] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:121 [ 35.938509][ T9] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 36.114170][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 36.128345][ T9] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 36.138674][ T9] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 36.148406][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 36.156807][ T9] usb 3-1: SerialNumber: syz [ 36.255665][ T783] rust_binder: Failed to allocate buffer. len:24, is_oneway:false [ 36.303604][ T785] fuse: Unknown parameter '00000000000000000000003' [ 36.372194][ T699] overlayfs: failed to resolve './file0': -2 [ 36.382871][ T9] usb 3-1: MIDIStreaming interface descriptor not found [ 36.397187][ T9] usb 3-1: USB disconnect, device number 6 [ 36.411758][ T378] udevd[378]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 36.442803][ T13] bridge_slave_1: left allmulticast mode [ 36.448503][ T13] bridge_slave_1: left promiscuous mode [ 36.454565][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.465573][ T13] bridge_slave_0: left allmulticast mode [ 36.471407][ T13] bridge_slave_0: left promiscuous mode [ 36.477369][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.583964][ T13] veth1_macvtap: left promiscuous mode [ 36.589616][ T13] veth0_vlan: left promiscuous mode [ 37.379647][ T830] hub 6-0:1.0: USB hub found [ 37.401752][ T830] hub 6-0:1.0: 1 port detected [ 37.455391][ T840] netlink: 12 bytes leftover after parsing attributes in process `syz.3.159'. [ 37.671180][ T9] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 37.701154][ T456] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 37.821126][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 37.827415][ T9] usb 3-1: unable to get BOS descriptor set [ 37.834150][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 37.844301][ T9] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 37.854285][ T456] usb 4-1: config 0 interface 0 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 37.865525][ T456] usb 4-1: config 0 interface 0 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 37.875534][ T456] usb 4-1: config 0 interface 0 has no altsetting 0 [ 37.882264][ T9] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 37.891418][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.899413][ T9] usb 3-1: Product: ⫹縕읬뭸ꐘ毋✔ꎓ끬痙礥⣾⋋胦ꩠÄ铁䠢ꌢ윔嚀钚⩜㶨⭈嫯䈆姗䨖芸㷎煠 [ 37.912506][ T456] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 37.921600][ T456] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.929995][ T9] usb 3-1: Manufacturer: ъ [ 37.934867][ T456] usb 4-1: config 0 descriptor?? [ 37.939934][ T9] usb 3-1: SerialNumber: ࠒ [ 38.151886][ T9] usb 3-1: 0:2 : does not exist [ 38.171376][ T9] usb 3-1: USB disconnect, device number 7 [ 38.181423][ T342] udevd[342]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 38.547570][ T456] usb 4-1: string descriptor 0 read error: -22 [ 38.750404][ T456] input: HID 256c:006d as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:256C:006D.0004/input/input8 [ 38.763100][ T456] input: HID 256c:006d as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:256C:006D.0004/input/input9 [ 38.776125][ T456] input: HID 256c:006d Touch Strip as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:256C:006D.0004/input/input10 [ 38.801497][ T851] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 38.817065][ T456] input: HID 256c:006d Dial as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:256C:006D.0004/input/input11 [ 38.849269][ T456] uclogic 0003:256C:006D.0004: input,hidraw0: USB HID v0.00 Keypad [HID 256c:006d] on usb-dummy_hcd.3-1/input0 [ 38.912272][ T861] netlink: 104 bytes leftover after parsing attributes in process `syz.0.162'. [ 38.931434][ T866] netlink: 104 bytes leftover after parsing attributes in process `syz.0.162'. [ 38.940755][ T866] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 38.964567][ T869] IPv6: Can't replace route, no match found [ 38.972511][ T377] usb 4-1: USB disconnect, device number 6 [ 38.993930][ T873] netlink: 16 bytes leftover after parsing attributes in process `syz.0.165'. [ 39.038826][ T877] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 39.056217][ T877] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 120, limit: 144, size: 97) [ 39.056246][ T877] rust_binder: Error while translating object. [ 39.077717][ T877] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 39.088269][ T877] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:108 [ 39.121206][ T45] rust_binder: 868: removing orphan mapping 0:1048 [ 39.908234][ T36] kauditd_printk_skb: 20 callbacks suppressed [ 39.908254][ T36] audit: type=1400 audit(1755771697.047:287): avc: denied { accept } for pid=893 comm="syz.0.171" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 39.946568][ T897] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=897 comm=syz.3.170 [ 39.961901][ T36] audit: type=1400 audit(1755771697.107:288): avc: denied { mount } for pid=895 comm="syz.2.172" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 39.991687][ T36] audit: type=1400 audit(1755771697.117:289): avc: denied { mounton } for pid=895 comm="syz.2.172" path="/39/file0" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:devpts_t tclass=dir permissive=1 [ 40.014146][ T36] audit: type=1400 audit(1755771697.117:290): avc: denied { remount } for pid=895 comm="syz.2.172" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 40.034423][ T36] audit: type=1400 audit(1755771697.127:291): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 40.168597][ T892] rust_binder: Error while translating object. [ 40.168671][ T892] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 40.175344][ T892] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:87 [ 40.184976][ T892] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 40.194321][ T892] rust_binder: Read failure Err(EFAULT) in pid:87 [ 40.243803][ T13] bridge_slave_1: left allmulticast mode [ 40.276282][ T13] bridge_slave_1: left promiscuous mode [ 40.291141][ T456] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 40.291197][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.323879][ T914] 9pnet_fd: Insufficient options for proto=fd [ 40.326439][ T13] bridge_slave_0: left allmulticast mode [ 40.341179][ T13] bridge_slave_0: left promiscuous mode [ 40.353181][ T916] netlink: 8 bytes leftover after parsing attributes in process `syz.3.178'. [ 40.359690][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.369701][ T916] netlink: 8 bytes leftover after parsing attributes in process `syz.3.178'. [ 40.380896][ T36] audit: type=1400 audit(1755771697.517:292): avc: denied { read write } for pid=915 comm="syz.3.178" name="snapshot" dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 40.414190][ T36] audit: type=1400 audit(1755771697.517:293): avc: denied { open } for pid=915 comm="syz.3.178" path="/dev/snapshot" dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 40.451221][ T456] usb 1-1: Using ep0 maxpacket: 32 [ 40.457462][ T456] usb 1-1: config 0 has an invalid interface number: 196 but max is 0 [ 40.465702][ T456] usb 1-1: config 0 has no interface number 0 [ 40.471850][ T456] usb 1-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 40.483161][ T456] usb 1-1: config 0 interface 196 has no altsetting 0 [ 40.501941][ T456] usb 1-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 40.511041][ T456] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.519433][ T456] usb 1-1: Product: syz [ 40.524147][ T456] usb 1-1: Manufacturer: syz [ 40.528789][ T456] usb 1-1: SerialNumber: syz [ 40.534806][ T456] usb 1-1: config 0 descriptor?? [ 40.540103][ T907] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 40.547421][ T13] veth1_macvtap: left promiscuous mode [ 40.553348][ T13] veth0_vlan: left promiscuous mode [ 40.651142][ T9] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 40.812125][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 40.823110][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 40.833019][ T9] usb 4-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 40.842141][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.851272][ T9] usb 4-1: config 0 descriptor?? [ 41.150007][ T456] ipheth 1-1:0.196: ipheth_enable_ncm: usb_control_msg: 0 [ 41.158847][ T456] ipheth 1-1:0.196: Apple iPhone USB Ethernet device attached [ 41.262649][ T9] hid-led 0003:0FC5:B080.0005: item fetching failed at offset 0/3 [ 41.270854][ T9] hid-led 0003:0FC5:B080.0005: probe with driver hid-led failed with error -22 [ 41.351711][ T31] usb 1-1: USB disconnect, device number 4 [ 41.377247][ T31] ipheth 1-1:0.196: Apple iPhone USB Ethernet now disconnected [ 41.474282][ T377] usb 4-1: USB disconnect, device number 7 [ 41.934814][ T957] rust_binder: 183: no such ref 0 [ 42.339615][ T974] validate_nla: 57 callbacks suppressed [ 42.339636][ T974] netlink: 'syz.3.183': attribute type 1 has an invalid length. [ 42.340461][ T36] audit: type=1400 audit(1755771699.477:294): avc: denied { bind } for pid=973 comm="syz.3.183" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 42.425799][ T977] netlink: 60 bytes leftover after parsing attributes in process `syz.0.185'. [ 42.590825][ T982] netlink: 'syz.0.185': attribute type 4 has an invalid length. [ 42.598610][ T9] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 42.608683][ T982] netlink: 'syz.0.185': attribute type 4 has an invalid length. [ 42.735598][ T987] /dev/rnullb0: Can't lookup blockdev [ 42.771251][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 42.777625][ T9] usb 4-1: config 32 has 1 interface, different from the descriptor's value: 2 [ 42.787042][ T9] usb 4-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 10745, setting to 64 [ 42.798479][ T9] usb 4-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 42.807796][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.021120][ T36] audit: type=1400 audit(1755771700.157:295): avc: denied { write } for pid=973 comm="syz.3.183" name="tcp" dev="proc" ino=4026532490 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 43.065311][ T995] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 43.073878][ T36] audit: type=1400 audit(1755771700.207:296): avc: denied { mount } for pid=994 comm="syz.0.188" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 43.115363][ T9] usb 4-1: string descriptor 0 read error: -71 [ 43.125839][ T9] usb 4-1: USB disconnect, device number 8 [ 43.451184][ T31] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 43.601230][ T31] usb 1-1: Using ep0 maxpacket: 32 [ 43.607641][ T31] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 43.616882][ T31] usb 1-1: config 0 has no interface number 0 [ 43.625448][ T31] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 43.641948][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.650203][ T31] usb 1-1: Product: syz [ 43.662538][ T31] usb 1-1: Manufacturer: syz [ 43.667219][ T31] usb 1-1: SerialNumber: syz [ 43.681287][ T31] usb 1-1: config 0 descriptor?? [ 43.689976][ T31] smsc95xx v2.0.0 [ 44.262630][ T1021] rust_binder: validate_parent_fixup: new_min_offset=18, sg_entry.length=0 [ 44.262657][ T1021] rust_binder: Error while translating object. [ 44.271368][ T1021] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 44.277683][ T1021] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:112 [ 44.493863][ T31] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): EEPROM read operation timeout SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: repeatedly failed to execute the program proc=1 req=150 state=3 status=67 (errno 32: Broken pipe) [ 44.823173][ T31] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 44.834065][ T31] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -71 [ 44.847794][ T31] usb 1-1: USB disconnect, device number 5 [ 44.963063][ T12] bridge_slave_1: left allmulticast mode [ 44.968736][ T12] bridge_slave_1: left promiscuous mode [ 44.974486][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.982120][ T12] bridge_slave_0: left allmulticast mode [ 44.987765][ T12] bridge_slave_0: left promiscuous mode [ 44.993590][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.001390][ T12] bridge_slave_1: left allmulticast mode [ 45.007036][ T12] bridge_slave_1: left promiscuous mode [ 45.012692][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.020211][ T12] bridge_slave_0: left allmulticast mode [ 45.026205][ T12] bridge_slave_0: left promiscuous mode [ 45.031942][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.194629][ T12] veth1_macvtap: left promiscuous mode [ 45.200179][ T12] veth0_vlan: left promiscuous mode [ 45.205885][ T12] veth1_macvtap: left promiscuous mode [ 45.211464][ T12] veth0_vlan: left promiscuous mode