last executing test programs:

3m8.685170469s ago: executing program 0 (id=1132):
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000280), 0x204381, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = dup(r1)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000140), 0xa8041, 0x0)
ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000580))
r5 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f0009"], 0x0)
rt_tgsigqueueinfo(0x0, 0x0, 0x2f, &(0x7f00000003c0)={0x24, 0x8, 0x80})
syz_usb_control_io$hid(r5, 0x0, 0x0)
syz_init_net_socket$802154_raw(0x24, 0x4, 0x0)
syz_usb_control_io$hid(r5, &(0x7f0000000080)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0)
r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r6, 0x0)
mount$bind(&(0x7f00000002c0)='.\x00', 0x0, 0x0, 0x101091, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x1000, 0x1})
r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/custom1\x00', 0x4, 0x0)
ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000300)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x100000000000000, &(0x7f0000000180)="86"})
ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000480)={0x20, 0x0, &(0x7f0000000000)=[@request_death, @clear_death], 0x0, 0x0, 0x0})
ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000640)={0x0, 0xd000})
ioctl$KVM_NMI(r3, 0xae9a)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$ASHMEM_GET_NAME(r6, 0x81007702, &(0x7f00000006c0)=""/4096)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc(&(0x7f0000000100), r4)

3m8.17475556s ago: executing program 0 (id=1141):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000340)={0x1, 0x0, [{0x40000023, 0x0, 0x1}]})
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3})
syz_io_uring_setup(0x2d37, &(0x7f0000000400)={0x0, 0x3fb0, 0x10, 0x0, 0x14f}, 0xfffffffffffffffc, 0x0)
syz_open_dev$hiddev(&(0x7f0000000040), 0x746a, 0x8080)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="fc010000190001000000000010000000fe8000000000000000000000000000bbffffffff0000000000000000000000000000000bffff00000a00800000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000800000000000000001000000000000000000000000000000000000010000000044010500ac1414aa000000000000000000000000000000003c00000000000000ffffffff000000000000000000000300ff34000002020000000000000000000000000000ac1414aa000000000000000000000000000000003c00000000000000fe8000000000000000000000000000000000000000000000000800000008000000000000ff020000000000000100000000000001000000003200000000000000e00000010000000000000000000000000335000003000100000000000000000000000000ff0100000000000000000000000000010000000032"], 0x1fc}}, 0x0)
mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r3, 0x0)
accept$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000300)={@fd={0x66642a85, 0x0, r3}, @fda={0x66646185, 0x6, 0x1, 0x3e}, @fda={0x66646185, 0x1, 0x1, 0x33}}, &(0x7f0000000380)={0x0, 0x18, 0x38}}}], 0x0, 0x0, 0x0})

3m8.113216785s ago: executing program 0 (id=1142):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0)
mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x380, 0x2})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
socket$inet6(0xa, 0x1, 0x4)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1)
ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000240)=ANY=[@ANYBLOB="010000000000edfc030100c0"])
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2})
ioctl$TUNATTACHFILTER(r4, 0x401054d5, &(0x7f0000000040)={0x5, &(0x7f0000000000)=[{0x25, 0x0, 0x3, 0x1800000}, {}, {0x28}, {0xb1, 0x0, 0x0, 0x1ff}, {0x6}]})
r5 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x100000000, 0x244301)
fcntl$dupfd(r0, 0x0, r5)
r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x3, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x32, 0xffffffffffffffff, 0x2ec37000)
r7 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
ioctl$UI_END_FF_ERASE(r6, 0x400c55cb, &(0x7f0000000080)={0x4006, 0x0, 0x9})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfaf, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0})

3m8.112858485s ago: executing program 0 (id=1143):
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0)
userfaultfd(0x80801) (async)
r1 = userfaultfd(0x80801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) (async)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000480)={{&(0x7f0000ff9000/0x1000)=nil, 0x1000}})
syz_io_uring_setup(0x6fd0, &(0x7f0000000380)={0x0, 0xf7b1, 0x80, 0x1, 0xd7}, &(0x7f0000000200), &(0x7f0000000440)) (async)
r2 = syz_io_uring_setup(0x6fd0, &(0x7f0000000380)={0x0, 0xf7b1, 0x80, 0x1, 0xd7}, &(0x7f0000000200), &(0x7f0000000440))
mmap$IORING_OFF_CQ_RING(&(0x7f0000ff8000/0x4000)=nil, 0x4000, 0x4, 0x13, r2, 0x8000000)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r0, 0x20, &(0x7f0000000180)="5e73663bf4082f7c6cbecbf09d6dd7be5a06dfd64563f329c16f799d1836bfc45a7badc8faed24bb77c848723a43602d1fe0d236c062e105ec77ffd00fb243c3111dda42112650cc", 0x0, 0xfe2a)
r3 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_generic(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001c40)=ANY=[@ANYBLOB="781100001100010000000000020000001d0000006411e3800800228004002b80080035"], 0x1178}, 0x1, 0x0, 0x0, 0x1}, 0x0)
ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000ff9000/0x4000)=nil, 0x4000})
openat$rnullb(0xffffffffffffff9c, 0x0, 0x141342, 0x0)
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, 0x0)
setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="0200000001000000000000000400000000000000100000000000000020"], 0x24, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0)
listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000000)=""/25, 0x19)
r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) (async)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3})
mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0)
ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000640)={"84b81cbe13c38423305de0c2a06eafa6146875200ac71ece9145a722d55af5db1a40dca2716a18663eed74c451d37f32ca4d859de70266b3410d5dcba62e1e4efb1212082b4711b99427e60ce75e08e842d27e98c04a11263a176ac0e5ae866e3cb1720fab12d639c5f7e4c456064c5bd75bab3d84defc97827e1cb50f0ecd9e2c7a608b8212e6c499ecc5b9b07708951a3085db98d60fccb15a59bb273481ad8ed36bc288c06697bd59a11c3a3b5d2efbd1ccb5be73880de140fd1bcee9bbea373467227771e410cf665e0b723ae4b72bde0fa7ed093001af051c2b7f2b2b857537ef0d2c82ec7bfa3764ca9e0d63b066c1f9057f8bd348b2a1569409f723e41992b5be613dbf317c23298bf17a34f608556e11db1465194b999801b7c096908524121e1d7fab56e9ef6c989d363d533aa6147a3fc4005907c48ad780598eb631328d899e23dda4db9094ac33ae29e569b75cd4b04ef50fbf40dc90abbcb92883dba8b572bf228156247313d116b606a978751b8d9bd5b7613f295f2280327e756ebf86c0fa8bfeecf194bc31117b7a8d75224d4123e758c573e4eb6723eb48df4e7948600e6060f1c2a49e10a4f1e242627ceedbc0e8ba71e7a1cd2647bf6934f0ded25af4199c10d891e315fb4a7483f8781dfb350a854398ed560efc29ffaaf81b322c71bd6880c39dfec2fc78602c3e4925275b9da3d717c65ce2adbed1df82d36a18ec0fc2820eb03dae1d0adef9ccb3c233764db30268e129b709fca88ee34ce5a9908a7ff7d95534e020483b52f4f1a3ff24287e7de64bd0bf7e443067db73069754a7ff54003505d3432d2302ad583e95652052824e0a6e43c383ae9e85766f973471256c9f027cfe5a63ce90f9fcb27d918db3c6fe47496ec7f1d047861ae686a60114a4d6037a32a1b2fcccfa0ba68827aecc0b49bd3beb5060778c9f7e4e9452dc7b80ab80cb496f0c2e1b5de73a9372359a775c838a4d96132d94b4712801b1f9aeb156abf8d373a296c5e02d63b1568b9c1b2c8ea0f1e29a77efe383fb2fe1f9a47108519ecd1792432f2fd4b3093c3e6fc3d97ec43344a907349800d2e68df35afd783401983fdcbaa2ac3791dda1faf1037f2a7e266a07421360ef2b3417871d19607353649cc028879d8b39efd99239841305d4600ca5be7241011e26ec9f22b5e1b0e9dd232faaf260e0f3926b9d59a1ab943efdf72846b6b86cba7c54969d75acdafbe878ba8b030c975184fc4dbdbf05a1b93d95eae9f2a2181a3229e877a23397e47fab1b2c765c0059aa86ff09d82fad83d4c057e42e5983a9ca66cb8a5ca0f6f1e91435c92ee9732e9c89619bbc5c3c2b8803978f09c31359f9b5f38cbfeb7054a0039dbca509cfffc3d7685beddbb5ce7805f218048466ed5d3c54788dafe9c0b26d5c28ec1230c51e173abf1855f3b9c2b96071"})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000100)={0x90, 0x0, &(0x7f0000000a40)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f00000004c0)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/226, 0xe2, 0x2, 0x4}, @fda={0x66646185, 0xffffffffffffffff, 0x0, 0xe}, @ptr={0x70742a85, 0x0, &(0x7f0000002740)=""/243, 0xf3, 0x0, 0x28}}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}, 0x1000}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@fda={0x66646185, 0xffffffff7fffffff, 0xfffffffffffffffe, 0x10}, @ptr={0x70742a85, 0x1, &(0x7f0000000580)=""/173, 0xad, 0x0, 0x14}, @flat=@binder={0x73622a85, 0x110a, 0x1}}, &(0x7f0000000000)={0x0, 0x20, 0x48}}}], 0x0, 0x0, 0x0}) (async)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000100)={0x90, 0x0, &(0x7f0000000a40)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f00000004c0)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/226, 0xe2, 0x2, 0x4}, @fda={0x66646185, 0xffffffffffffffff, 0x0, 0xe}, @ptr={0x70742a85, 0x0, &(0x7f0000002740)=""/243, 0xf3, 0x0, 0x28}}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}, 0x1000}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@fda={0x66646185, 0xffffffff7fffffff, 0xfffffffffffffffe, 0x10}, @ptr={0x70742a85, 0x1, &(0x7f0000000580)=""/173, 0xad, 0x0, 0x14}, @flat=@binder={0x73622a85, 0x110a, 0x1}}, &(0x7f0000000000)={0x0, 0x20, 0x48}}}], 0x0, 0x0, 0x0})

3m8.091183828s ago: executing program 0 (id=1144):
mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)
pipe2$9p(&(0x7f0000000240)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="1500000065ff0300000000b139cc72d0d48864f70f"], 0x15)
r2 = dup(r1)
write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18)
write$FUSE_INIT(r2, &(0x7f0000001740)={0x50, 0x0, 0x0, {0x7, 0x21, 0x0, 0x14210000, 0x7d, 0x1005, 0x0, 0x3}}, 0x50)
mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000004380), 0x1814800, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@afid={'afid', 0x3d, 0x8}}], [], 0x6b}})
r3 = syz_open_procfs(0x0, &(0x7f00000003c0)='mountinfo\x00')
fcntl$getflags(r1, 0xb)
r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000340)='/sys/power/wake_lock', 0x82002, 0x105)
write$cgroup_int(r4, &(0x7f0000000180)=0x4, 0x12)
write$cgroup_pid(r4, &(0x7f0000000280), 0xa)
r5 = socket(0x10, 0x3, 0x0)
sendmsg$nl_generic(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001000)=ANY=[@ANYBLOB="240000001e00050300000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB='\b\x00\t\x00', @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x4a841}, 0x0)
r6 = open(&(0x7f0000000200)='./bus\x00', 0x141a42, 0x0)
sendfile(r6, r3, 0x0, 0xffffffff)
syz_clone(0x1000000, &(0x7f0000000000)="95c338248745a64f7ae8cedf817a0bdf4182c8924de4232e68fcf00af6ef9b19ed75a6088b172cd5c4c2f948fb0bb52f73b32d5691315f27da01b07b", 0x3c, &(0x7f0000000140), &(0x7f00000001c0), &(0x7f0000000280)="a2f8555d37a4b6466ea6918f2159b0b26403110f87ed0ada7c8797c854aa6a04541bf0505dc7ec2baa23c6ad108745f556c9e27f37500a0b3e492b963bf98b75aacc87e92c628c23ec5a42be571c8be6ebd740c1e78fcf1b5e84d7a60a9d88ffc9cce4e9")

3m8.060106991s ago: executing program 0 (id=1145):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), 0xffffffffffffffff)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)) (async)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x40, 0x0)
pipe2$9p(&(0x7f00000001c0)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
write$P9_RVERSION(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15)
dup(r4) (async)
r5 = dup(r4)
write$FUSE_BMAP(r5, &(0x7f0000000100)={0x18}, 0x18)
write$FUSE_NOTIFY_RETRIEVE(r5, &(0x7f00000000c0)={0x14c}, 0x137)
mount$9p_fd(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=0x0, @ANYBLOB=',cache=mmap'])
chmod(&(0x7f0000000140)='./file0\x00', 0x0) (async)
chmod(&(0x7f0000000140)='./file0\x00', 0x0)
creat(&(0x7f0000000300)='./file0\x00', 0x0) (async)
r6 = creat(&(0x7f0000000300)='./file0\x00', 0x0)
write$tcp_congestion(r6, &(0x7f0000000540)='nv\x00', 0x3)
pwritev2(r6, &(0x7f0000000200)=[{&(0x7f0000000480)="84", 0x1}], 0x1, 0x0, 0x5, 0x2) (async)
pwritev2(r6, &(0x7f0000000200)=[{&(0x7f0000000480)="84", 0x1}], 0x1, 0x0, 0x5, 0x2)
r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0)
ioctl$SIOCSIFHWADDR(r7, 0x40305839, &(0x7f0000000540)={'veth0_virt_wifi\x00', @link_local={0x1, 0x80, 0xc2, 0x5}})
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
getsockopt$IP_SET_OP_GET_BYNAME(r8, 0x1, 0x53, &(0x7f0000000140)={0x6, 0x7, 'syz1\x00'}, &(0x7f0000000180)=0x28) (async)
getsockopt$IP_SET_OP_GET_BYNAME(r8, 0x1, 0x53, &(0x7f0000000140)={0x6, 0x7, 'syz1\x00'}, &(0x7f0000000180)=0x28)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', <r9=>0x0})
socket$packet(0x11, 0x2, 0x300) (async)
r10 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000140)={'ip6_vti0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000140)={'ip6_vti0\x00', <r11=>0x0})
sendto$packet(r10, 0x0, 0x0, 0x4000814, &(0x7f0000000540)={0xc9, 0x0, r11, 0x1, 0x0, 0x6, @local}, 0x14)
sendmsg$ETHTOOL_MSG_LINKINFO_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="b0000000", @ANYRES16=r1, @ANYBLOB="000000000000000000001a000000200001801400020076657468315f746f5f6873720000000008000100", @ANYRES32=r9, @ANYBLOB="7c000180080003000200000008000100", @ANYRES32=r11, @ANYBLOB="1400020070696d72656731000000000000000000140002007465616d30000000000000000000000008000100", @ANYRES32=r9, @ANYBLOB="140002006e657464657673696d3000000000000008000100", @ANYRES32=r11, @ANYBLOB="1400ffffffffffffff7f6c6176655f3000459f0008000100", @ANYRES32=r11, @ANYBLOB], 0xb0}, 0x1, 0x0, 0x0, 0x4008800}, 0x0)
symlink(&(0x7f0000000080)='.\x00', &(0x7f0000000200)='./file0\x00')
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd='])
pipe2$9p(&(0x7f00000001c0), 0x4800)
syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) (async)
r12 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1)
setsockopt$nfc_llcp_NFC_LLCP_RW(r12, 0x118, 0x1000000, 0x0, 0x0)
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='vfat\x00', 0x200000, 0x0)
removexattr(&(0x7f0000000080)='./cgroup\x00', &(0x7f0000000100)=@random={'os2.', 'vfat\x00'}) (async)
removexattr(&(0x7f0000000080)='./cgroup\x00', &(0x7f0000000100)=@random={'os2.', 'vfat\x00'})

2m52.0337379s ago: executing program 32 (id=1145):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), 0xffffffffffffffff)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)) (async)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x40, 0x0)
pipe2$9p(&(0x7f00000001c0)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
write$P9_RVERSION(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15)
dup(r4) (async)
r5 = dup(r4)
write$FUSE_BMAP(r5, &(0x7f0000000100)={0x18}, 0x18)
write$FUSE_NOTIFY_RETRIEVE(r5, &(0x7f00000000c0)={0x14c}, 0x137)
mount$9p_fd(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=0x0, @ANYBLOB=',cache=mmap'])
chmod(&(0x7f0000000140)='./file0\x00', 0x0) (async)
chmod(&(0x7f0000000140)='./file0\x00', 0x0)
creat(&(0x7f0000000300)='./file0\x00', 0x0) (async)
r6 = creat(&(0x7f0000000300)='./file0\x00', 0x0)
write$tcp_congestion(r6, &(0x7f0000000540)='nv\x00', 0x3)
pwritev2(r6, &(0x7f0000000200)=[{&(0x7f0000000480)="84", 0x1}], 0x1, 0x0, 0x5, 0x2) (async)
pwritev2(r6, &(0x7f0000000200)=[{&(0x7f0000000480)="84", 0x1}], 0x1, 0x0, 0x5, 0x2)
r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0)
ioctl$SIOCSIFHWADDR(r7, 0x40305839, &(0x7f0000000540)={'veth0_virt_wifi\x00', @link_local={0x1, 0x80, 0xc2, 0x5}})
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
getsockopt$IP_SET_OP_GET_BYNAME(r8, 0x1, 0x53, &(0x7f0000000140)={0x6, 0x7, 'syz1\x00'}, &(0x7f0000000180)=0x28) (async)
getsockopt$IP_SET_OP_GET_BYNAME(r8, 0x1, 0x53, &(0x7f0000000140)={0x6, 0x7, 'syz1\x00'}, &(0x7f0000000180)=0x28)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', <r9=>0x0})
socket$packet(0x11, 0x2, 0x300) (async)
r10 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000140)={'ip6_vti0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000140)={'ip6_vti0\x00', <r11=>0x0})
sendto$packet(r10, 0x0, 0x0, 0x4000814, &(0x7f0000000540)={0xc9, 0x0, r11, 0x1, 0x0, 0x6, @local}, 0x14)
sendmsg$ETHTOOL_MSG_LINKINFO_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="b0000000", @ANYRES16=r1, @ANYBLOB="000000000000000000001a000000200001801400020076657468315f746f5f6873720000000008000100", @ANYRES32=r9, @ANYBLOB="7c000180080003000200000008000100", @ANYRES32=r11, @ANYBLOB="1400020070696d72656731000000000000000000140002007465616d30000000000000000000000008000100", @ANYRES32=r9, @ANYBLOB="140002006e657464657673696d3000000000000008000100", @ANYRES32=r11, @ANYBLOB="1400ffffffffffffff7f6c6176655f3000459f0008000100", @ANYRES32=r11, @ANYBLOB], 0xb0}, 0x1, 0x0, 0x0, 0x4008800}, 0x0)
symlink(&(0x7f0000000080)='.\x00', &(0x7f0000000200)='./file0\x00')
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd='])
pipe2$9p(&(0x7f00000001c0), 0x4800)
syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) (async)
r12 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1)
setsockopt$nfc_llcp_NFC_LLCP_RW(r12, 0x118, 0x1000000, 0x0, 0x0)
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='vfat\x00', 0x200000, 0x0)
removexattr(&(0x7f0000000080)='./cgroup\x00', &(0x7f0000000100)=@random={'os2.', 'vfat\x00'}) (async)
removexattr(&(0x7f0000000080)='./cgroup\x00', &(0x7f0000000100)=@random={'os2.', 'vfat\x00'})

1.241213087s ago: executing program 3 (id=4339):
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmmsg$unix(r1, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f00000002c0)="ea", 0x1}], 0x1, &(0x7f0000000140)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r1], 0x18}}], 0x1, 0x4)
pipe(&(0x7f0000000080)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
splice(r0, 0x0, r2, 0x0, 0x39000, 0x0)
r3 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fe, 0x82)
r4 = dup(r3)
ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f0000000040)={0x23, 0x3, 0x12, 0x0, 0x0, 0x0, 0x0})
timer_create(0x0, &(0x7f0000000140)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000))
pause()
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0)
mount$binderfs(0x0, &(0x7f0000000040)='./binderfs\x00', &(0x7f00000000c0), 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB='max=00000000000000000000001,stats=globCl,stats=global,max=00000000000000000000003,max=0000000000000000000001:,silent,rootcontext='])
timer_create(0x0, &(0x7f0000000100)={0x0, 0x1b, 0x0, @thr={&(0x7f0000000080)="2d99cf24515d8a25242884aec954432743251a91f0758845da052928dfcc5ba29ce6f3bf3c6a2ec12d38354146b2ac7b", &(0x7f0000000180)="83a037b5f9286806175a88c254e84b85bc33fbdd51b827107e6ca4e08b4f48ec1153d432f5e511932e220bd2256b9338d49728b97c40f2d2499b2d6c25d1582df730cc323fd6d0fbe9f38012caeeec014546d1fe513c6a7368017cd2784d6144383dbe13b052fa332c32914aea474fbcb3e1800ded78c046"}}, &(0x7f0000000200))

1.239667267s ago: executing program 1 (id=4341):
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="3400000013000100000100dffddbdf25070000f61600000008000000", @ANYRES32], 0x34}], 0x1, 0x0, 0x0, 0x4000}, 0x20044084) (async, rerun: 32)
r1 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32)
sendmsg$nl_route_sched_retired(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000fc0)=@newtaction={0x44, 0x31, 0x69b6754e5abcd1c9, 0x70bd28, 0x25dfdbfb, {}, [{0x30, 0x1, [@m_ipt={0x2c, 0x1, 0x0, 0x0, {{0x8}, {0x3}, {0x4}, {0xc}, {0xc, 0x8, {0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x8080}, 0x9080) (async)
sendmsg(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000180)="49483ea3abd1565ea4", 0x9}], 0x1, 0x0, 0x0, 0x11000000}, 0x0) (async)
r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async)
r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
fcntl$F_SET_FILE_RW_HINT(r3, 0x40e, &(0x7f0000000100)=0x5)
ptrace(0x10, r2) (async)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000540)) (async, rerun: 32)
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='vfat\x00', 0x808081, 0x0) (rerun: 32)

1.234721878s ago: executing program 1 (id=4342):
r0 = socket(0x1e, 0x4, 0x0)
setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x10f, 0x15, 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$smc(&(0x7f00000002c0), 0xffffffffffffffff)
sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000380)={&(0x7f0000000280), 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c80fc04", @ANYRES16=r2, @ANYBLOB="01002bbd7000ffdbdf25010000000500040001000000"], 0x1c}, 0x1, 0x0, 0x0, 0x40440c5}, 0x8000)
getgroups(0x0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0)
setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f0000000040)={0x1, 0x4}, 0x8)
shutdown(0xffffffffffffffff, 0x1)
syz_usb_control_io(0xffffffffffffffff, &(0x7f00000003c0)={0x2c, &(0x7f0000000140)=ANY=[@ANYBLOB="200d5b0000005b116a87bb14ef24eb64d06dd8511449d202594892f4c95dcd1925a408ec40f63f85a05b6c2c566d670bc121c197fc99351bda77f3a29b24868712ae184940f91b8096f46b74dfa050721ca5dcbd69413c14c15fdd545bece679e2"], 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000880)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r4 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x200, 0x4)
r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r5)
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000001c0)={'veth0\x00', <r7=>0x0})
sendto$packet(r4, &(0x7f0000000180)="0d04100048fa7dcbe0ff02000000000088641100000000000000", 0x1a, 0x60095, &(0x7f0000000140)={0x11, 0x15, r7}, 0x14)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3})
mount(0x0, &(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)='exfat\x00', 0x200000, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r8 = socket$vsock_stream(0x28, 0x1, 0x0)
r9 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/cpuinfo\x00', 0x0, 0x0)
sendfile(r0, r4, &(0x7f0000000000)=0x2, 0x0)
sendfile(r8, r0, 0x0, 0x30000023896)
poll(&(0x7f0000000640)=[{0xffffffffffffffff, 0x4010}, {r9}], 0x2, 0x7)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8001, 0x3, 0x40f, 0x8, 0x80, 0x2, 0x200, 0x7f, 0x2000000a, 0x20000000, 0x6, 0x5f, 0x9, 0x5, 0xffff2d38, 0x1002, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x0, 0x7, 0x3c1b, 0x2, 0x24, 0xd, 0x1, 0x3, 0xffffffff, 0x8e661, 0x4, 0x7, 0x3, 0x1000008, 0x4c74, 0x80000000, 0x242, 0x6, 0xc, 0x0, 0x8071, 0x7, 0x6, 0xffffffff, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0xa8000002, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x5, 0x8000012d, 0x8004, 0x5, 0xfffffff3, 0x129432e2, 0xc8, 0xf9, 0xe, 0x2bf, 0x1, 0x9, 0xfffffffc, 0x4, 0xdfa, 0x0, 0x5, 0x2e, 0xe, 0x4, 0x78, 0xea4, 0xfff, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0x1000d, 0x4e0, 0x2, 0x4, 0xb, 0x3, 0x9, 0x4, 0xd, 0xe1, 0x47, 0x8000, 0x1, 0xfe000000, 0xfffe, 0x2, 0x4, 0x9, 0x103, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x3, 0xfffffff8, 0x3], [0x5, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0x8, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x2, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x6, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x3, 0x800003, 0x200, 0x83, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x2000005, 0x6, 0xac8, 0xbf, 0x4002, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x9, 0x1c, 0x120000, 0x3, 0x1, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0x9, 0x5, 0x938, 0x6, 0x6, 0xf, 0xb9, 0xce7, 0x1ff, 0x2, 0xfffffff8, 0x5, 0x3, 0x101, 0x10000, 0x9, 0x7ffb, 0xffff, 0xa620, 0x7, 0x78b, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0x1, 0xfffff000, 0x5, 0x8000003, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x101, 0xa1f, 0xf44, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0x1ff, 0xfffffffb]}, 0x45c)
syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff)
mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r3, 0x0)

1.181614373s ago: executing program 3 (id=4344):
openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0)
r0 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0xff, 0x2, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x0, 0x13}}}}}]}}]}}, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000011c0)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}})
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r1, 0x6, 0x13, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000006c0)={0x34, &(0x7f0000000400)={0x20, 0xc}, 0x0, &(0x7f0000000500)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000540)={0x20, 0x0, 0x37, {0x35, "4def5b7d023ffa876ae5d13f864a7aab22b7bfba5317cac238989b83277fb366b6a51c2c81634c4f1aa4de1d423b5282d07734a0ce"}}, &(0x7f0000000640)={0x20, 0x1, 0x1, 0x6}, 0x0})
r2 = socket$nl_audit(0x10, 0x3, 0x9)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, 0x0)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000240)=0x1, 0x4)
connect$inet(r3, &(0x7f0000000040)={0x2, 0x4e04, @dev={0xac, 0x14, 0x14, 0x59}}, 0x10)
shutdown(r3, 0x1)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f00000003c0)=0x2, 0x4)
r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r4)
ptrace$getenv(0x4201, r4, 0xc, &(0x7f00000003c0))
recvmmsg(r3, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x40000142, 0x0)
setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, 0x0, 0x0)
epoll_pwait(0xffffffffffffffff, 0x0, 0x0, 0x6, 0x0, 0x0)
syz_usb_disconnect(r0)
r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x800, 0x0)
close_range(r5, 0xffffffffffffffff, 0x0)

839.564877ms ago: executing program 2 (id=4356):
r0 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x100080, 0x1, 0xf}, 0x18)
mkdirat(r0, &(0x7f0000002040)='./file0\x00', 0x0) (async)
mmap(&(0x7f0000568000/0x2000)=nil, 0x1000000, 0x0, 0x11, 0xffffffffffffffff, 0x0) (async)
munmap(&(0x7f00003f9000/0xc00000)=nil, 0xc00000) (async)
socket$unix(0x1, 0x5, 0x0) (async)
ioprio_set$uid(0x3, 0x0, 0x0) (async)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4})
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) (async)
prctl$PR_SET_SECUREBITS(0x1c, 0x15) (async)
setuid(0xee01) (async)
mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x800000, 0x0) (async)
r2 = syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') (async)
r3 = fsopen(&(0x7f0000000140)='tracefs\x00', 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x300, 0x0, 0x0) (async)
read$FUSE(r2, &(0x7f0000000980)={0x2020}, 0x2074)

834.975037ms ago: executing program 2 (id=4358):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0)
mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3})
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000240))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfdf, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1f}, @fda={0x66646185, 0x4, 0x0, 0xffffffffffffffff}, @flat=@weak_binder={0x77622a85, 0x0, 0x3}}, &(0x7f0000000180)={0x0, 0x28, 0x48}}, 0x400}], 0x0, 0x0, 0x0})
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeef, 0x8031, 0xffffffffffffffff, 0x1000)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2c0000001400010000000000000000000a00020004000000140002"], 0x2c}}, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
writev(r2, &(0x7f0000000040)=[{0x0}], 0x1)
mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil)
r3 = userfaultfd(0x801)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x280})
r4 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0)
r5 = fsmount(r4, 0x0, 0x0)
fchdir(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0)
lseek(r6, 0x2, 0x3)
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000200)={{&(0x7f0000b3f000/0x2000)=nil, 0x2000}, 0x2})
ioctl$UFFDIO_WRITEPROTECT(r3, 0xc018aa06, &(0x7f00000000c0)={{&(0x7f000040a000/0x800000)=nil, 0x800000}, 0x1})
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000b1d000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00008fb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00006f2000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
syz_io_uring_setup(0xbb, &(0x7f0000000380)={0x0, 0x1993, 0x1, 0x1, 0x1a1}, 0x0, 0x0)
mount$fuseblk(0x0, 0x0, 0x0, 0x0, 0x0)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={<r7=>0xffffffffffffffff})
getpeername$tipc(r7, &(0x7f00000001c0)=@name, &(0x7f0000000080)=0x10)

716.011399ms ago: executing program 4 (id=4360):
ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f0000000000)={0x9, <r0=>0xffffffffffffffff, 'id0\x00'})
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x4c, r1, 0x20, 0x70bd26, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0x4}, @NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0x2}, @NL80211_ATTR_BSS_SHORT_PREAMBLE={0x5, 0x1d, 0x3}, @NL80211_ATTR_BSS_CTS_PROT={0x5, 0x1c, 0x4}, @NL80211_ATTR_BSS_SHORT_SLOT_TIME={0x5, 0x1e, 0x3}, @NL80211_ATTR_AP_ISOLATE={0x5, 0x60, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0xc040}, 0x8000)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r0)
sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x54, r3, 0x100, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_P2P_OPPPS={0x5, 0xa3, 0x1}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_INACTIVITY_TIMEOUT={0x6, 0x96, 0x8}, @acl_policy=[@NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}, @NL80211_ATTR_MAC_ADDRS={0x1c, 0xa6, 0x0, 0x1, [{0xa}, {0xa, 0x6, @broadcast}]}]]}, 0x54}, 0x1, 0x0, 0x0, 0x4008800}, 0x0)
ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f00000003c0))
r4 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000440), r0)
sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, r4, 0x400, 0x70bd2c, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x4840)
r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000580), r0)
sendmsg$TIPC_NL_MEDIA_SET(r0, &(0x7f00000006c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0xbc, r5, 0x4, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x44, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xffff3c7b}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xa}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x88f}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}]}, @TIPC_NLA_BEARER={0x64, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @l2={'ib', 0x3a, 'vlan0\x00'}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffbce}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x406}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x52}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0x4080}, 0x84)
getsockopt$IP_SET_OP_GET_FNAME(r0, 0x1, 0x53, &(0x7f0000000700)={0x8, 0x7, 0x0, 'syz0\x00'}, &(0x7f0000000740)=0x2c)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000007c0), r0)
sendmsg$TIPC_CMD_SET_LINK_PRI(r6, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x68, r7, 0xbbb690005e3e48d3, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x4c, 0x18, {0x7, @link='syz0\x00'}}}, ["", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x40040}, 0x0)
sendmsg$NL80211_CMD_TDLS_OPER(r6, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r3, 0x10, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_TDLS_OPERATION={0x5, 0x8a, 0x1}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_TDLS_OPERATION={0x5}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x44}, 0x1, 0x0, 0x0, 0x40d5}, 0x400c0)
sendmsg$SEG6_CMD_SET_TUNSRC(r6, &(0x7f0000000b40)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000b00)={&(0x7f0000000a80)={0x44, r4, 0x20, 0x70bd27, 0x25dfdbfb, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x3}, @SEG6_ATTR_DST={0x14, 0x1, @dev={0xfe, 0x80, '\x00', 0x30}}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}]}, 0x44}}, 0x4000054)
r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000bc0), r6)
sendmsg$NL80211_CMD_REGISTER_FRAME(r0, &(0x7f0000000fc0)={&(0x7f0000000b80)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000c00)={0x354, r8, 0x4, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x21}}}}, [@NL80211_ATTR_FRAME_MATCH={0x31, 0x5b, "05406511399ec5efef685101dfe87e7ab1e1179304fc62fb31fe1309a90fee96033078f369d4374cd0d6b8b9aa"}, @NL80211_ATTR_FRAME_MATCH={0x8b, 0x5b, "0f5f8f035003e756626a36e891ca05df52f8fad69e2e55995a78b02e1cdca9f1bab0171252f607b11fa28cfb0af4b7985c8c2508af8aedb92e2a58531ff6be8235849fa340d376e86239d62c7dc07f86801d1707748de15c9158da030317d56123f3606eace565e0513c565d81f6766e31eb97d48ebb15ebfb8bf242c4950ffb3e6d4bde06ed0f"}, @NL80211_ATTR_FRAME_MATCH={0xb4, 0x5b, "1eca8cf14f4985d951059ec42da1f0d40ac252a32851bf66c56ae792088fbdb8bda68750f3ebfcf30fee730e52fe7c477202a10efd25a82eaeea0abbb57be9896ee325c33f19f2baa40c0edca66f1af0372f0fdbf1acb8f6987e0a6e5d05f1e545f8d875fcda4fb718ef9023bc0132d316537300a0ee6e9bda4ebecfb82056be1ca8ea384d7f8bb9dba5d1f095da1ed2b1b297afe262418b7704f2fc807fdebd0898326498c9bf3b53cbe96b62593729"}, @NL80211_ATTR_FRAME_MATCH={0xa2, 0x5b, "df1bf6f17be17dad0ae7e3245587283b4cb20aef47e573cb55c6747cb912e6786d90b987bf07139cfef0867053d42958407a329cd4406b1b55eae0055c45ecb9f927155ab040f527fcaed0ee50694bda304beb8bdb59dc759a1ce0d42ee055f92c4c8568d6bbe47c2eb2a2858ca35295b35f32746be8bc2c319f63cf25d00cd70dd3372b2c5f2eb0853d979a372d4d07c3595b29ae2addb21994ba1ddb94"}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x6}, @NL80211_ATTR_FRAME_TYPE={0x6}, @NL80211_ATTR_FRAME_MATCH={0x102, 0x5b, "9918da974576240408631b67d04234798175618f794773185ce17f6fc6228d74b95d3d54216e548fd5694607fa2422193b6a08231317c3d04ea85230f3c806d2e4fffa909f1f2b3760fbc5f03a67d5937a50f03a59097aab5302eaaff2aeab267f1c63a1e16b33b5162b8c50996151b11b5c5d1fcb53ceb20dbc179be652e137b741b8da99782a03ec3baa3681e3bc77cc672549a17961e96af5688314cf89da994946f36c5323d509ef1b03c1d4ee142f09f35a9b66554bf75c6dba2ee1fa2e96e77f458804a87f03c14199c412c5a83e19ad2816d1001067e165c9e82327b75270751a4c93d8a4792b0eb169fc4670982663385e460e2adee12cc7ec67"}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x7}]}, 0x354}, 0x1, 0x0, 0x0, 0x40}, 0x20000000)
pipe2(&(0x7f0000001000)={<r9=>0xffffffffffffffff, <r10=>0xffffffffffffffff}, 0x4080)
ioctl$SIOCGETSGCNT(r10, 0x89e1, &(0x7f0000001040)={@broadcast, @remote})
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_SET_CHANNEL(r11, &(0x7f0000001140)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001100)={&(0x7f00000010c0)={0x30, r8, 0x800, 0x70bd2c, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0xfffffffb, 0x26}}}}, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3d6}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x20800)
ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000001180)={'wlan0\x00'})
r12 = socket$unix(0x1, 0x2, 0x0)
ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r12, 0x8983, &(0x7f00000011c0)={0x1, 'wg0\x00', {}, 0x8})
sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r11, &(0x7f00000012c0)={&(0x7f0000001200)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001280)={&(0x7f0000001240)={0x20, r3, 0x800, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x7fffffff, 0x29}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x85}, 0x4800)
prlimit64(0x0, 0x8, &(0x7f0000001300)={0x80000001, 0x8001}, &(0x7f0000001340))
sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r11, &(0x7f0000001440)={&(0x7f0000001380)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001400)={&(0x7f00000013c0)={0x1c, r7, 0x400, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x400c000)
sendmsg$nl_xfrm(r9, &(0x7f0000001540)={&(0x7f0000001480)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001500)={&(0x7f00000014c0)=@getspdinfo={0x14, 0x25, 0x400, 0x70bd2d, 0x25dfdbff, 0x3, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x4011)

715.833769ms ago: executing program 2 (id=4361):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x4, 0x0)
ioperm(0x0, 0x5353, 0xffffffffffffff7f)
iopl(0x3)
iopl(0x0)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x0, 0x0, 0x700})

604.069621ms ago: executing program 2 (id=4362):
setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000080)={@remote}, 0x14) (async)
madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) (async)
openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x165142, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async)
r0 = fsopen(&(0x7f0000000100)='configfs\x00', 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) (async)
r1 = fsmount(r0, 0x0, 0x0) (async)
socket$inet6(0xa, 0x5, 0xd3ce) (async)
r2 = socket(0x28, 0x3, 0x1)
fchdir(r2)
r3 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x100)
lseek(r3, 0xffffffffffffffff, 0x1)
r4 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000140)={&(0x7f0000000000)=""/74, 0x1b23000, 0x0, 0xffffffff}, 0xffffffc6)
setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) (async)
r5 = socket$inet6_udplite(0xa, 0x2, 0x88)
bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x3, @ipv4={'\x00', '\xff\xff', @empty}, 0x4}, 0x1c) (async)
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4a, &(0x7f0000000000)=0x5575, 0x4) (async)
connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e21, 0x659, @empty, 0xff}, 0x1c) (async)
sendto$inet6(r5, 0x0, 0x0, 0x80, 0x0, 0x0) (async)
r6 = fcntl$dupfd(r5, 0x0, r5)
recvmmsg$unix(r6, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x1, 0x60000103, 0x0) (async)
r7 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000b00)=ANY=[@ANYBLOB="8001751affff010027bd700000000000fc020000000000e4fffffffffffc0000fe8000000000000000000000000000aa000008000000000000000000b9000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1414aa0000000000000000000000000000000033000000ac1414400000000000000000000000000000000000000100000000000000000000000000000000003a0d0000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000007000000000000000000000000000000010000000000008000000000bc000000000000000000000000000000020001003a00000000000000480001007368613235362d61726d36342d6e656f6e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000480003006c7a7300"/312], 0x180}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
r8 = socket$inet6_udplite(0xa, 0x2, 0x88) (async)
setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4)
setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f00000004c0)=0x100, 0x4) (async)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r8, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', <r9=>0x0})
bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x0, r9}, 0x10)
mmap$xdp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6, 0x11, r4, 0x100000000)

603.408981ms ago: executing program 4 (id=4363):
r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x14b040, 0x0)
ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffff3)
r1 = dup(0xffffffffffffffff)
r2 = add_key$user(&(0x7f0000000340), &(0x7f0000000380)={'syz', 0x3}, &(0x7f00000003c0)="0d4c7b940561828f995caaa5171f09607b284435dcfcff3c0f56b58c5d8fc7f74793fba5b569cbc3104f45cd4931e1f61a58fdae4b3bbd6b8d8d8f55a399ab00f76b1e2dee97073205dabac82dc51f87cb954b4c803f279a320d50720463ac4b3ba358f2ee969af296aea2a1e7c04ef5716154e2deccbdd57eac685a105e7bce5e9a1f4ef6a83fd84ce2179b568a552c995dbdb264fea2fdc5ee4243087f7e44815c13ec60857a0a8a0a65e96db6546defec8085fb9188165150fe43e9f9", 0xbe, 0xfffffffffffffff8)
keyctl$get_security(0x11, r2, &(0x7f0000000540)=""/186, 0xba)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0)
ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f0000001180)='\x00\x00\x03\x01\x00\x00\x00\x1f\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x02\x00g\x00\x00\x00\x80\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-\xac\x99\xb8\xd2<Z l\xdfDh\xa1\x99Bj<\r\x87\xa3\xd1?$\x8b\x02\x00\x00\x00h\x1b\x01\x00\x00\x00\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc4\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0HdO\xb9\xa2\x1d\x13\x8fCha\xb3\x95wl},\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80Z\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9\x13f=\xbd\x03\xe8\xbex:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13\xba\x00|g]7\xdc\xe9=\"\xe4\xb3\x0f\xc6\x8f\x85fGGV&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146\'Z\x83H\xabF\x18<\x86h\x01=\x03\\\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&@\x00\x00\x00rT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\xd7c\t(\xf2\x93\x8d\\\x91\xef\xab(Jck\xdf\xa3 \x16\x9bH=\x01\x7f\x02\x1dF3\x7f\xd15\xa8\xd2\x94\xa7\xe9\xbd\xdc\x16\xe1Z\x9c\xe3\xeb9\x8f\xfdC\x0e\xd3]\xb5\xfdB\\\xd2\xfe\xf6H\x8ai}kDM\xbd\xfcJ{T{@i/\xb7x\xef\x1f\xf0t\xf5\xaf\xb21F\x01\xe0\x86\xde\x88\xb8\x8f \xfc\xcd\xba\xea\x16\xc1J\xb7\xe3\x04m\x0e\xaf\xd6X\xba\x8a\xdb\xeda\x83.H\xe3\x86\x03\t\xcb\xdc\x80\xee\x0ec\x12\x8a\x92\x11\xb6\xcc#\x10\xec\xfd\xbb\xd3\\\xc8\x88\x04,\'\x14\xbf\x84\x16\xb3\x8f,6\xc6D\xae\xa1\xf9\xe7@\xac\xaa\x104\x8b\x8eQ8\x11\xa7|\x87\xe2\xccrj%\xc4r&\r\a\xa7\xda\xf5\'V\x89\xe6\xa4\x05\xde\xf5\xaa@\xec\xe2\xf6\xb5x\xa1w\n\xda\xf2\xd67\xc6%\x0f[sF\xb6\xaeS>\xe9^\xd4\xf03\xe9.\xc4\xd5\xe0\r\xa1Q\xa8\xf2\xa2`zs\'k\xd4pV\xab&%\xf8\x8a\x80\x9d\"\xf3\xcc\xd2i\xc8\xd8\xc6\xbeD\xda\x86?\xf9\x13\xe5L`R\xe8Vq\xa3\nD\x9f\xe4M\xe6\xab\xdd!=%\x06z$\x99\';O\xfc\xf0u\x83\v<H\x8cmD\x8e\x9e\x18\xf7\xac\xa5\x17\x89\xc6\x88\x86\xe9\x15\x87WV\xfbF\xb1\x1fo\x85t\xf1\r\x8a\x9c\xe8\xac^\x19cp\xcceJ\xa6\x0e_\aE\bZ\x9f\xfa\xdf$\xad\xf0\xa5E\xeb\xd6\x80\xb7 \rd\xcc\x92\b\x01\x1bG\xb4su\x90\xcfs\x18LQ\x81^\x17\x80\xca\xdc\xe2\xb3\x01\x87G\xb8\x92\xdaJt\xa2g\xb7Azy+\x8f\xee\xb9\xa9\xa6\x04\xd1a\xca1~\x03\xbc\x87\xd1\xbaY\xf3\x8ai\xff[\xde\xde\xc6\xb1\xb9T{\xe2>\x83\a8\xfe<\x9e\xa8\xfe\xca`D\x91\x81!QT$\x05T\x85\xd6\xe9!\xb9wfL\x12\xa8\xb0\xb0\x86\xc2\xa1\xf7\x05i\xf5\xf0\r\xe7h\xdaD\xcb\xd4\x87\x84\xe5\xc7r;.\xf0\xed\x17\x83Nn\xb7\x0f!u}J)\xa1\xa1\x16\xc5`Z,\xa3\xcf\xfdy\aH\x06\x14l\x92x\xdbB=\xcc\xcdf\xe5\x04=HQ\xeaE-v\x02\x0eY\x8e\xbf\xec\x16\xc4G\xea\x8bS\x8e\xd5f\xdcj\xe1\x86\xf9s\x90\xe5\xf9\x89\xc0\xf3\xcd;r4j]\x9b\xdf\xf5\xe9\x82\xe1\xdb\x11\xb3\b\xa2Y\xdb\\\xc1H\xc3\xcf\xb1W\xe9(\xee\x18\xca\xda\xf5p,\x16\xbc\x17\xfe\xd8\n\xe1\xa1&=+)\xf9Vd\x11\xf6hX\xbe\x85O=\xe2\x9f~I\xa1\"\xa9\xd9\x19\xa2\\\xb8>f\xe2Jh+u\x90\x13\x94\x12\xc8X\xd7\xb4\xf1JS0FN\xa0\xda\xb6ez`\x9a\xea\xcf^\xa5\x17{\v\xe8n\xe9 \xc0/D\t\x7f\xd8\xad\xf2e\xff\x8b\x16p\x0f\xe4\x1a/\xe1\x96\xd2\xae\x94\x0e5\xb0b+\xac\x14\xaa\xb0\xb7\xa5.\x15\x8a\xca\xb5~=D-\x90\xc1\xbf\x05\xb9\xd5\x86\xeb\xd2#\xda\xc132\'\xfc!%\x94\x1f\xbfL)\xc2c\xa8\xef\x152\x8d\xef\xde\xbe\xab\xf5g\x80\x02G>\xf5\x04a-\xff\x06X+\xc1\xd3\xb1\xcdn\x15p\xdf\xd8.\x89\x95{\xb6+:`\x9c\xcf2\x01\x1d1\xf7\xe6\x7f\x1f\xf5\xb0\xb9\t2\x14\x81\x99\xb8@7y\xb4\xce\xf1]\a\x03y\xc5F\xfa\xae\xd1O\x7f7\xa7\xc1\xb2.~B\xe8@G\xd1\xd9R~\x1b\xf7\xa8\x86\xa7\xc1\b\x9ej\x01\xf4\xb7\xd2\x0e\xc2\x15S\x19\xd7\xd4\xe6\xaf!\xf8_\x8aEOp@>4\xd7\xcf\x11\xe0;\x99}QmE\xdd\xa69)Q\x9e\xb9\'\x97\x9b\xe7\xa4?Ed\x9c\x7fE\xba5\x90\xc07\x96S\x9d\xe1\x84\xfa\x1a\xd6\x9a\x15\xd1o \xc0\xd28\x01\xa7\x99\x85q\xbd\x80\x00\x00\x00\x00\x00\x00\x00H\x0f\xbbT\xd5\xb3\xf4\xcd<\x8a\x01\x19\xd0|B\f0\xf8i\xd3\x1bJke\t\x8b7Q\x1dQ&\x96H\x05\xec\x80\xf0\xab\x8f\x94{\x9d+\xefs\x1c\xfck\xf7q\x10\xf6\x16\xbc\xe7\x93\x0f\x7f\xcd\xa7b\xbe\x88\xcc\xb6^\x93\xa9P\xf3\xa3\xe4Az=\xe0+Q\x9e\xb5\x11\xb3\xc1\xa8P0+\xc9\xa1\xdbU~J$\xa4\x03\x11\x1aa~\x9du\x8f\x8d\xbcI\x85k\xa0\xae\xf6\xa0\x94r\xfb\xe3\xaa\xd4\xf0\x99\x06\xe1i\x1f\xfa\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\\\xb2/R\xedI2e5\x88(\xc0+^\xe7G\x17\x03^\xd7g\xb9n\x8c2\xb3\x12\x91\x86b\t\xd0R\x01\xda$Y\x85\x02&\x95FC\xc8\xd9\x00\x00\x00\xb6u\xbb\n{\x90\xfd>')
ioctl$ASHMEM_SET_NAME(r0, 0x40087707, &(0x7f0000000040)='\x00\x00\x03\x06\x00\x00\x00\x05\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xf0:\xfd$\xad\xbb\x9a|c\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b7\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Xd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84x\x00\x00X\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xd5\b^[D~~\x84\\\xe4\x00')
ioctl$ASHMEM_SET_NAME(r1, 0x40087708, &(0x7f0000000ec0)='\x00\x00\x00\x00\x00\x00\x00\x1f\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\x87\xa3\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Hd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xc9\x91\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\x06\x00\x00\x00\xf2\xd5\b^[D~\x00\x00\x00\x00\x00\x00\x00')

603.17848ms ago: executing program 2 (id=4364):
r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x2, &(0x7f0000000000)=[{0x28, 0x0, 0x0, 0x9}, {0x6, 0x0, 0x0, 0xffffffff}]})
ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x400001000001fe)
ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, 0x0)
fsetxattr(r0, &(0x7f0000000000)=@known='trusted.overlay.origin\x00', &(0x7f0000000040)='/dev/ashmem\x00', 0xc, 0x0)
mmap(&(0x7f000001a000/0x2000)=nil, 0x2000, 0x8, 0x13, r0, 0x66053000)

602.63781ms ago: executing program 1 (id=4365):
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00') (async)
r1 = syz_open_dev$evdev(&(0x7f0000001a40), 0x2, 0xa040)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) (async)
syz_usb_connect(0x5, 0x2e5, &(0x7f0000001200)={{0x12, 0x1, 0x110, 0x8, 0x84, 0x87, 0x8, 0x5c6, 0x7102, 0xc982, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d3, 0x2, 0x4, 0x2, 0x80, 0x67, [{{0x9, 0x4, 0x2, 0x6, 0x7, 0xe5, 0x9a, 0x2b, 0x21, [@uac_control={{0xa, 0x24, 0x1, 0x7fff, 0x4}, [@input_terminal={0xc, 0x24, 0x2, 0x4, 0x101, 0x3, 0x0, 0x9, 0x1, 0x4}, @mixer_unit={0x8, 0x24, 0x4, 0x1, 0x3, "89b927"}, @feature_unit={0xb, 0x24, 0x6, 0x1, 0x6, 0x2, [0x2, 0xa], 0x6}, @extension_unit={0x7, 0x24, 0x8, 0x1, 0x200, 0x92}]}, @uac_control={{0xa, 0x24, 0x1, 0xfffc, 0x2}, [@selector_unit={0xa, 0x24, 0x5, 0x4, 0x7, "8afaaaf2ef"}, @feature_unit={0xd, 0x24, 0x6, 0x6, 0x1, 0x3, [0x5, 0x8, 0x3], 0x94}, @extension_unit={0xa, 0x24, 0x8, 0xff, 0x5, 0x4, "a40e7f"}, @processing_unit={0x9, 0x24, 0x7, 0x1, 0x4, 0x5, "81c7"}, @feature_unit={0x11, 0x24, 0x6, 0x3, 0x2, 0x5, [0xe, 0x1, 0xa, 0x7, 0x3], 0x1a}, @extension_unit={0x9, 0x24, 0x8, 0x6, 0x4, 0x0, "24b7"}]}], [{{0x9, 0x5, 0x9, 0x0, 0x8, 0x4, 0x7, 0x1}}, {{0x9, 0x5, 0x5, 0x0, 0x400, 0xed, 0xf7, 0x7}}, {{0x9, 0x5, 0xd, 0x0, 0x20, 0x10, 0x0, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x52, 0x7}]}}, {{0x9, 0x5, 0xf, 0x10, 0x8, 0xc2, 0x2, 0x2, [@generic={0x91, 0xe, "23108df24ee41888f17e946d602c0bd2fcc3b63e5b8176f27465e8a85291f0df3245d6101f8b64fc2527b154c6a1ac1c59d837deaefde81beed4b419416e0cada99350261386d8171bee81102177ebb56f5335fc3eaef49764393a06855d001114352986e47dd13fd559399ef0d8d9a75f338072c7632f130f229b4458947f360f05f563ccacf489aa25f6b1f91700"}]}}, {{0x9, 0x5, 0x5, 0xc, 0x10, 0x80, 0x0, 0x1, [@generic={0x5c, 0x22, "a080a5196547979959d00dccf3fa7bee4835a7f80e82baa9ca46ebb65c7b61c08a978a4635d8ff6fde59220573b75ed63ee01b1727f804a295e5ac35518036e64fa6a0dba5cbec7d6500ea14b090e380b17a4a81bf4114a87dd8"}]}}, {{0x9, 0x5, 0x6, 0x0, 0x1ff, 0x6, 0x4, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x4, 0x100}]}}, {{0x9, 0x5, 0xf, 0x0, 0x8, 0xf3, 0x8, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0xf7, 0x8719}, @generic={0x2b, 0x2, "c1669f412d903ea615a652c204921a3f5ec270c828c1d9f35a9dea8f7a1873dad10eaace225ed77c67"}]}}]}}, {{0x9, 0x4, 0x0, 0x4, 0x2, 0xc7, 0xd6, 0x15, 0x6, [], [{{0x9, 0x5, 0x1, 0x3, 0x200, 0x0, 0x71, 0x6, [@generic={0xb0, 0x3, "95198e8a301426c58ca5b538d93d9a6031ea8aeb784183ac12c004de2eaf44f63b758ff16d598395e1e3979e8d38ccfe8cdfef3f0eb46c66d3d477ff57a577ea3a1c95460b176a0ae0b8be9c989ec7331b7425e280e5144a5f012bdeec97cbeedf1e6906626ab17dd6cb65ecf0e642f30ca8321daf155166bdfbb908738a511906db046b103f4295538325de49a3782ddb3079f3aa5d1e214d5aa2e7624eb163a009e1a97fb457b3a4c4f9feb2bf"}]}}, {{0x9, 0x5, 0x6, 0x10, 0x20, 0x4, 0x1a, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x0, 0x7}, @uac_iso={0x7, 0x25, 0x1, 0x83, 0x9, 0x9}]}}]}}]}}]}}, &(0x7f0000001a80)={0xa, &(0x7f0000001500)={0xa, 0x6, 0x310, 0x7f, 0xd, 0x5, 0x10, 0xd3}, 0x1e, &(0x7f0000001540)={0x5, 0xf, 0x1e, 0x3, [@ext_cap={0x7, 0x10, 0x2, 0x0, 0x2, 0xa, 0x2800}, @ext_cap={0x7, 0x10, 0x2, 0x10, 0x9, 0xe, 0x200}, @wireless={0xb, 0x10, 0x1, 0x2, 0x1f, 0x9, 0xfb, 0xadc9, 0x1}]}, 0x9, [{0x3c, &(0x7f0000001580)=@string={0x3c, 0x3, "5d029cb3d797b121b709b8a893ce37b57fa38cb1916d9eebb51b2cad47a865b87435aeef2ff96ae308c3e4e882c062c50cd11c89ba816d7184bf"}}, {0x64, &(0x7f00000015c0)=@string={0x64, 0x3, "c2a08f1d9fe1216cee688bfbab6339893848d5d76b451f4e059228834eb839b5282f5c8ca50239730d17a225f8edf3fc076835ba30b2edf28a699e0b37b19e7d0cb59d85921a77175f8cc0f7a0dd64dea1c4b490393d303b628ca51fc9b08bbc2e9e"}}, {0xe7, &(0x7f0000001640)=@string={0xe7, 0x3, "caf539bc18115f32f25ccd63b0a72743c467cddac588043fae48d89b8b8a88e8cb09c4bb27e2e42f2031f3ec3c0d06099e9f3bba95dc0cf783d162513d3dd4790ad6291ed6768778aa50dbaf8b1fb07619bf2c1955a9af22176f4ba30889abe6657b627fbe37984c26ac8a3f8382c721f7b34d95f6507482ad561f8605f6620e446950a20b13f03ab40dea92e4c44195b7659d10366e399bc63ec977e15bcc4fd4f19763086b1f74bced3c93397bbd036fc69050ed4a5cc7d9931af2548cc2f9c412ff90db421ccc828aa6e6aeb993c0a72393badedb4365d31765264d5c7fe83cbb3f8898"}}, {0x4, &(0x7f0000001740)=@lang_id={0x4, 0x3, 0x411}}, {0x37, &(0x7f0000001780)=@string={0x37, 0x3, "4c07ad33ddeaf96ce1e2c1c161f998fcddf39419f7b83dab2ada132e15de3220c452dbd4e79b453fd94f23a478b30a3894ee99337d"}}, {0x83, &(0x7f00000017c0)=@string={0x83, 0x3, "5103f8030bd36d61e5e5b26ef1e469efbcfd7dcdb4d24d4bba10a691804b6aad8f27eba3a5daca948407a81a0cd0d8f6ba6279e008f5dc5c72fd3bb2c2de6c29cac1052bc80ef5e7c906c98d27e0b6277056c2e00da659d41a795ef798d0550d2603d7e81f55a0c3b28e5d85326027258956d5f40a2c4bd164a1496e4c8c52233b"}}, {0x4, &(0x7f0000001880)=@lang_id={0x4, 0x3, 0x420}}, {0xd2, &(0x7f00000018c0)=@string={0xd2, 0x3, "7658d919efd84611126f2427d049f98119937c5936a7a3e6fa61e4792d2c3d23eb8185f6bf54d6deb3fda3afe677a3619ba62ae0e881b007dded59c07a072fdf25c794fd10763a3aa03806b592a9de402482a52ab7992da618e6026f1c1767aff1f3d45936a0d31718a62ddcf500cdd58e42464284ddd52ba1fcc2fd8da56b2e58b5fb4c11d796137a2332fa21dc8690d2d0862ea34c37bafdf034d9f0d9da561d3c79086786a903e370cf03519d19084cff2ca65a6a09a124cd5da937388540f1712644c4564b8e149417b9a3f0e9ad"}}, {0x4, &(0x7f00000019c0)=@lang_id={0x4, 0x3, 0x447}}]}) (async)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, 0x0) (async)
pread64(r0, &(0x7f0000000200)=""/4087, 0xff7, 0xd37) (async)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) (async)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001a00), r0)
sendmsg$NL80211_CMD_SET_KEY(r0, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000140)={0xa8, r2, 0x4, 0x70bd26, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "69e9132167763459b000afea60"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "b5fe87dc2496f92a93e9fc7a08"}, @NL80211_ATTR_KEY={0x4c, 0x50, 0x0, 0x1, [@NL80211_KEY_TYPE={0x8}, @NL80211_KEY_DEFAULT_TYPES={0x2c, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_KEY_TYPE={0x8, 0x7, 0x1}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_MODE={0x5, 0x9, 0x2}]}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "b61d9e5380bee1a1074b820862"}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xb59779582fe79629}]}, 0xa8}, 0x1, 0x0, 0x0, 0xc0810}, 0x8044)

602.00917ms ago: executing program 2 (id=4366):
openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0)
r0 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0xff, 0x2, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x0, 0x13}}}}}]}}]}}, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000011c0)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}})
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r1, 0x6, 0x13, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000006c0)={0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="22e8a44aecd6d1c4bf63dc4317083bb432346815e16aaab4b440513da4709d01c7d349c85e97c79ff4fae0db9a1a19a4fcbc2f9eeffe9e20c96cb9d20d082e87d7fc45"], 0x0, &(0x7f0000000500)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000540)={0x20, 0x0, 0x37, {0x35, "4def5b7d023ffa876ae5d13f864a7aab22b7bfba5317cac238989b83277fb366b6a51c2c81634c4f1aa4de1d423b5282d07734a0ce"}}, &(0x7f0000000640)={0x20, 0x1, 0x1, 0x6}, 0x0})
r2 = socket$nl_audit(0x10, 0x3, 0x9)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, 0x0)
setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, 0x0, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000300)=@getsa={0x3c, 0x12, 0x1, 0x70bd28, 0x25dfdbfa, {@in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x4d6, 0x2, 0x2b}, [@srcaddr={0x14, 0xd, @in=@multicast1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000004}, 0x40040d0)
epoll_pwait(0xffffffffffffffff, 0x0, 0x0, 0x6, 0x0, 0x0)
syz_usb_disconnect(r0)
r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x800, 0x0)
close_range(r4, 0xffffffffffffffff, 0x0)

601.43594ms ago: executing program 4 (id=4367):
accept4$tipc(0xffffffffffffffff, &(0x7f0000000000)=@id, &(0x7f0000000040)=0x10, 0xc00) (async)
r0 = accept4$tipc(0xffffffffffffffff, &(0x7f0000000000)=@id, &(0x7f0000000040)=0x10, 0xc00)
mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x4000010, r0, 0xfffb4000) (async)
mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x4000010, r0, 0xfffb4000)
ioctl$FAT_IOCTL_GET_VOLUME_ID(r0, 0x80047213, &(0x7f0000000080)) (async)
ioctl$FAT_IOCTL_GET_VOLUME_ID(r0, 0x80047213, &(0x7f0000000080))
fadvise64(r0, 0x80000000, 0xffffffffffffffff, 0x1) (async)
fadvise64(r0, 0x80000000, 0xffffffffffffffff, 0x1)
ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) (async)
ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c)
quotactl_fd$Q_SYNC(r0, 0xffffffff80000100, 0x0, 0x0)
r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x4002)
ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r1, 0x40045402, &(0x7f0000000100)=0x1)
ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(0xffffffffffffffff, 0x40045402, &(0x7f0000000140)=0x1)
r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cgroup.controllers\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) (async)
r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) (async)
ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3)
fcntl$getown(r0, 0x9)
r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x3)
write$char_usb(r4, &(0x7f00000001c0)="2714c760a972a9a8c38316e58f3dc592f3e7793154dcdc92faa55afce442637c47e600dc17a0dbe0c32d9679b9bc9302ac9857bee89accd3482e0a6df5489a9192bedb7356295cad2fd878abbe49e2a7960739ac822d2f490854c4968e36069b618c631cbd27e6c79e1ba2df935f6e42330aa29d3c091f007683a01e2614ab547bae0f3956d2b96a2654490ffaf9751f5c56971f02ce2bf20b17013b8202d99abc2dd67013d73acc8c9f84c02dba099bb14a0b4eda3e4ea223e05e51b51fbd1b55f4131b4e6a2fb55eb0f0dc99b14f9b8d89c1265bd2ffe277b91c5bb3910a62f4d4", 0xe2)
ioctl$F2FS_IOC_GET_COMPRESS_OPTION(r4, 0x8002f515, &(0x7f00000002c0)) (async)
ioctl$F2FS_IOC_GET_COMPRESS_OPTION(r4, 0x8002f515, &(0x7f00000002c0))
ioctl$FS_IOC_GETFSMAP(r2, 0xc0c0583b, &(0x7f0000000300)={0x0, 0x0, 0x3, 0x0, '\x00', [{0x0, 0x20400000, 0x480000000, 0x3, 0x5, 0x6}, {0x4, 0xffffffff, 0x8, 0x8001, 0x7f, 0x1}], ['\x00', '\x00', '\x00']})
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000480)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x4000, 0x2})
ioctl$HIDIOCGRDESC(r2, 0x90044802, &(0x7f00000004c0)={0x3dc, "aa677aba4d45e43a477cc9c121536f181eecad30ee785b2351aa8de042304bd119e07f787c20c00352d972ced66eca6b775cf905a7efe9f2bc5886d946abaeacbb1401f1c7f8ef659782f5a23b89a2cf04ae462f9518f59bef647ef53590396fbee7560fc5d4652df24af29b3c996b5bf2c3b02e089b861600db6efec67f12cdbde68d86837b6b5789828cb2540ded6beb554a03f7905d4bc35a4b513d6bdda643de607285d96345927266f6aefd83d79cba5d1088a4fdac79ee3d09908d176e3c518b8ce1b44c6012e026a6f2645d245f0f031b1952fd5fdbe8ba6e8466eec8d5d419204e643a8b0029bed3f0e0fe5398b6b19c9cf192fc4d0d32ceed9bde6d9e306b04cbde9b080f8510928b0f8f979786f97560a742c87dabf811a7212f86b8f9cc705d85f214dfe4ac3a799aee336be5b3c8a7878db64cec6a058cb2e12194d30a29de1f9aa83b9f001ce0805730daea5e0a458c8e7e9c9d1e562f9fa55ff6ea76e44a38f788fb5da6b200d72e7579dee8cc9365f38c429d9f6d4a4bd3c12eac2ed78351aa800f75faca545d9e149ce9d8989e85b7ed59621d49e02a7d01422522d6a27c508b05ccf6fc9c48bab7e492808352e42b1964508dbcebc118d142cb70bcc07881965ec98acb9251b372403b330246fe0ffff21c421b7bc6e1c3d0b52b3471cfc30b8dbdf85ab2ef7a491770f2e03e395b6afa0c00b79f0b9266730ce67ee818794d8ee145380263630d963792213dd66f9ec3d977f00e724a9f38c77a9e0f2bf7cbbf8cbcc7cbd37de6c8b484846fcdd9875e01066a894ab6c135ae64d7790b041206f3c63f8351de68e4d61bd2df57f15a25da43967a243b019855a5ab502ac6d6fb665f40aa9eb7c44ca31a655da55b4832893ee9e24ba84855f95764ed53684565b46c75dc14b74a1e27b2d5c66c4367d9964f4175020a59299eda9f908eea4e704f0558d282f982af8855b7ef971740ef84c22c8dd5b8789e3ba24558b8111d6457ecc955561d0b95f2fa7857468f8271ccc7504aa41f7158cec1b77eb25598817fcf97286931cd181ab822c5cf1a8766d80f36c68f96be2777e377baa17eeedd6003afb423e32f21d01d6f23e6c5f33cccead6c519d19f5e22c374d58937827eea8069556b97a9ae3ce294f10d8bd3b479fb412eba9b53bae1d5d3e9aa59d9b11cd4f74b889d4e78e64b00c90b08522039c2b4db62be7d994fdae6b17b6001e0366dcfa50abcd28892ca055392f24481f4770761da256fbe181478ea4fba3b2ddfc3b783d17f142e08c1feeb7a09b432d0baf927bd364b1d285191f561147f06dab32fc2cd33e54488a9202b1f0c87ec8fa534f877e2f06d266c9ff0e620139d9636c203bc4a3257860835aa4b4553bb03c536"})
fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f00000008c0)=0x5) (async)
fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f00000008c0)=0x5)
ioctl$F2FS_IOC_GET_COMPRESS_OPTION(r4, 0x8002f515, &(0x7f0000000900))
socket$igmp(0x2, 0x3, 0x2) (async)
r5 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$MRT_ADD_MFC_PROXY(r5, 0x0, 0xd2, &(0x7f0000000940)={@remote, @broadcast, 0x0, "535dd5ab7f80477b51a8fb355be5bbe23f6b1cee70cdf525fa918cdde7a47c23", 0x12, 0x0, 0x2, 0x3}, 0x3c)
clock_gettime(0x0, &(0x7f0000000980)={<r6=>0x0, <r7=>0x0})
clock_gettime(0x0, &(0x7f00000009c0)={<r8=>0x0, <r9=>0x0})
setitimer(0x2, &(0x7f0000000a00)={{r6, r7/1000+60000}, {r8, r9/1000+10000}}, 0x0)
ioctl$FS_IOC_READ_VERITY_METADATA(r0, 0xc0286687, &(0x7f0000000ac0)={0x3, 0x12a6e367, 0x43, &(0x7f0000000a40)=""/67})
quotactl_fd$Q_SYNC(r4, 0xffffffff00000202, 0x0, 0x0)
read(r1, &(0x7f0000000b00)=""/48, 0x30)
ioctl$F2FS_IOC_START_VOLATILE_WRITE(r1, 0xf503, 0x0)

600.982991ms ago: executing program 4 (id=4368):
prctl$PR_GET_CHILD_SUBREAPER(0x25)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x2, 0x0)

591.263192ms ago: executing program 4 (id=4369):
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
r0 = socket$packet(0x11, 0x2, 0x300)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x2000011, r0, 0xffffd000)
socket(0x25, 0x1, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r2 = openat$cgroup_int(r1, &(0x7f0000000800)='cpuset.mems\x00', 0x2, 0x0)
write$cgroup_int(r2, &(0x7f0000000040)=0x2c, 0x1)
ioctl$BTRFS_IOC_DEV_INFO(r2, 0xd000941e, &(0x7f0000001400)={<r3=>0x0, "70c44db840e78b9f6e8adca50e0b1459"})
ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000002400)={r3, 0xe, 0x1, [0x8, 0x6, 0x8, 0x4, 0x9], [0x6, 0x100000001, 0xfd, 0x74f, 0x2, 0x3, 0x8001, 0x2, 0xffffffff80000001, 0x800, 0x1, 0xf5, 0x1, 0x5, 0x7, 0x100000001, 0x2, 0x80000000, 0x1, 0x6f, 0xaf97, 0x3, 0x1, 0x0, 0x4e5c, 0xffffffff, 0x3, 0x10000, 0xff, 0x4, 0x8453, 0x6, 0x1, 0x7, 0x0, 0x5, 0xf1b, 0x3, 0x3, 0x9, 0x39, 0x2, 0x0, 0x8000000000000000, 0xec2, 0x60d, 0x9, 0x1, 0x1000, 0xffffffffffffffff, 0x7, 0x7fffffffffffffff, 0x5, 0x7, 0x2, 0xff, 0x817a, 0x9f94, 0x2, 0x4, 0x8, 0x993, 0x2c6, 0x400, 0xb, 0x4, 0xb873, 0x200000000000, 0xa, 0x2000000, 0x6a9, 0x8, 0x100, 0x1, 0x1c77, 0x6, 0x1, 0x80000000, 0x2, 0x0, 0x80000000, 0x5, 0x0, 0x0, 0x2, 0x5, 0x627e, 0x0, 0x0, 0x7, 0x6, 0xffffffff, 0x1, 0x25e, 0x8, 0x2, 0x1, 0x8, 0x9, 0xffffffffffffff55, 0x0, 0x0, 0x1ff, 0x2, 0x80000001, 0x7fffffff, 0x800, 0x3, 0x6, 0xd, 0x0, 0xfff, 0x3, 0x8, 0x0, 0x10000, 0x100000001, 0x70, 0x9, 0x9, 0x7365bf3f]})
r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x165342, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
r5 = getpgrp(0x0)
syz_pidfd_open(r5, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.numa_stat\x00', 0x275a, 0x0)
write(r4, &(0x7f0000000400)="547bbee68789313efe846d6698abfeac0d12b144933fa6f684f1ba13b34680bf4b9ea70f71faa2a82a45ab47458c1f827355ad34033fbb8b9699eb0b279252dfcf29e377e14dcfbde42857cbf2aa88d3dad8ec2deea7afe4e747fa392fe01d425970fb2dd7a000ea3889f0d9021f347818106963e18c256e3df26b41c61d30284a8ad61c6269756119d62e3a7a24c1dcd09d3eb35dfee6ec945ac190c4797988e0d7f6f38bf9b124431dd8208a9208195a70c8e558c216e78d5f5b3f6df6f155e16bf7dd8f4e9eaf61d5142a82da7a87aeca19c25b631cd8a14ce9f2fc8dbcd05f51dc9260abc82d780c9358bd6411ebf48520694d413024432d0bfc3759a620289c9c8705009fd829da6eb5b72b454436b0af8e9dc4941ca2cff92561cad984e15849dcd73f04c7f70a30304da2fbc17f421767ad5ce47ed79d6698428eada9a39faa02f978699bc8c482224a2d5f85cc1135ea92ac1c610e32f1e7c82da6d91e0c8634da679760c32c3e891db352b76b61a65bbdd023e093a8e0d37fd8cd00679cb1bceaac84b05861740c221b2cb4afa1ce8b091c815fc4bd83995b5bf5dcdf2912572cf6180ec27445404917ff9e8e6604e2afc19a1bb3745914f0a101e03e44ea5f64d40402f12a81310c97086fb01d04e82799c40f29348eb283ad58a40d608a47fbf9a25dbb308aa03b2425ffa896e1a70a37cf49e6dbdeda39ee88aadb26811eba78a0dfe5400a51428c31582edcc5f75b5dd963707a54b9b1e35f9966995d6474acbf7094124cecf38369aba3f6a5e3ad071f5e3df902843a3947623fe01571d97625c3e27721b08a6f85fd7b879acd400de5beabdd2603d566fdb4018bf8bd74c3ea1ae67c988992c7dab4ebcf501a73815e1b527d3ff1cf9e729d55127118565f794d253fef25609e5a415615d1b5fca5381b49446d9b9e75fbfcdd9218b0d8d8d965871b897544e32fd0b4cb5600ffdcdb0056bcad75216759590f8a94db82b0acd2a5a34e5c34241a19f1a7a7cceb894341f55c6b474f3cc052f9863a67519dfadee6576f08d7448929424c13e845e2e636b87dc14e1ab4ad05d69f896ca1bc5c1267befb686c4207e21aa30bdae1d1602d3e4080784834e213c426ba5446f90d3b3885a5d6942c6b0e637f5bb9c7908460bd7d04497ab054c8fc7f89068f7535976ad051bfe94c243ce7604a63b2099b69f1ed73590a318fad9a170fa0cddfe60e981a92de2e1aab3465b11a968108e08deadfa1fa546c4cbc0c34ac28597848562583ae8d93cb60f2e06c7a1f743add51eb8cd732b40d48fde00117cb2d654100dfcc66b7c9fefac80e137caa5cf43ae897780251a3ebbc4ddd3b003168963c9e2c9446cb29731fc4bbb5e551aca6913f7b8576ce34012581b5a363917970399ca369688e637cf06ff3c8114383d2fcbf9c69f1ca63cd21695254a440df5ef0a8abfdbd0a651a533b6cdb82382e3bd70f87c1d3eb0a6e22452605026fafe6d35158c0728c1050a39330c80ee2ee0b09366fc6382883ecd0796feec657b36aee4091471e406e9faffd5ede27943e5fbf1b7249ab8bad71f60063697f04db52e980a9fb3eb5e53b89be8a5f0e6afea7435789ecd444c28eb411cdc2158e434178749f36cc957dbd17efb2b218592f78d6864f2708e8c6db2da0d3f6de53959afec0c90d3d62a13a0bc3857bce58d81223eddd05cf3c1ec6b3fc5307d0f16d470f2065300295197e9fa81d2e5574b2c7b18f1c6c85156a9b1174d62dcd3cb026f4b67e6babd66c8f427b9687585f37b18c82e0100507035e78ce010b78ea1b5d3884db25df36ae929dd535a854a31cba5e47655873df72be7463c600b704e9da0e7cb2d61d0710248814ecced2eef8f227c8aec308c2c9d0a39d1a6b306080e8eaef8edece0f6d0d1612c582d70c3999a1a6bd529538f51ba4869ce74bc8509a7126d96db118cdb55411a36f4361d53c8027c12a7486e9c84e4de445b454630be27bdc2ec268702d9c1890297bdd1fc7a235f1a47f4645d286146f3cb9a7ce650f4157a1e7f134eb1815001d59905d3103efad3c66479330e8a5da941c9c38bf21bc0770e3fd56cafa19ad6e9d51f94ed4f900062b5602653aacdcc956aeecfb1dd613caf918e1ca8ef2e1504c42768e77df43569d5fe4b48c237cad5285c578b26b4e47c8ce06fd2686e17eb6d5df5645d0fdde7782216be07a1135dabc3a59598bdbab249c5391832f18ac5163aa7a1a890128a4520835a53eb750604c5e328ecb3216516b3eba3f97652caeb4327da8865880a932dc8e7668666ac3b76a2a424ca37b5dfb52495710611e20790427a9f9e7ac59bb86f0fb7a17a5def347a98dd8e733b784d78d5c7f16f327a2606d4252411457465540a60b0757802f470d08337c0fe4eee5f5cfe4f296d0f7068e80828a022c95632beb7b7f802135e246b1adebebf24c821dee7205e9fe1a437b16aaa8dcb4a58b0bdbc8dbc2fce09271c27430cc9ca8141955ec5ff4228627c3816cfe1bb2c0f40f6a61e8bfa4e2dd744e41ed80b83e9aef77119f4b062b98e86690711e83e795bafa7a8db16f241cee76aa01ff749100c113fda966aa8c83ebe975f760c18e3864065a5de6e8028a9e3199f4acff11e14bb13bc50faf97fdeab46edc371e55cab78841a2de17ca116b0183ac38b658c57a64ab11bb0de071c971a7a5175ad0bac6ac1d1118230a5412a35bd005b369df0e04e749ea93d7e56f713b9ceff580547a2a76ea4753a78b4a5cd0311024c5536b536c8ede63bac8e8b4c5851248d9098a7c6bcc3d5f209178b45aef3c1afa4ab73d8feac3e1f771626d73d85f72dc15d16bd3b7b93e622626f6f3d96b4425d328236cf1579f1ca834a7b318b012e27b9a2dc528189cf1eb3705d90de50ce7ac0c256b7e41500113e164fb7d53c74c6f829552a5bce73eeab9a46d01551bdab18fd3a7e82b036872f1e876b12c5676f63a6ef0c6ff159788a0c2fc40f179a259c656e8aba9295e90027e74ef910ce3c56d6e2de917947410b05603b6a5052453f13e6ac058b3f621573bfe6224bad8c3a5f575e1eb774839cb554c53c9b3ad623df6c5c9627cce856f9ba5847557bc9f854cbb37a936f20a733ba352ee5b343b941290a399fb862434d1b551da420053cad3bad65195cde40b345740e30e9a22619add8aedb763473b729c0649f7a1ea45325534c9b629a1fe3a54a78fe44969715182c6df5c9ecf6878380831b2996579332ac37286e72ab16824c3fc9ef8d74a7f1f5cf80fa37f6bb990db3a7a70139887a4eba0763247c58f4fe770a0496a5ef49a3ba4d62bb900644d49b5fba7e58d58af6ae50c96da346618434ed46b8f4c27cde5e8863d5b090dc117f3b16db2c4273fa84f8b06d3df436bf4a8cfa6d33d7f0e78ef422d5d7640c821398c9adf4d6ccb1b2f7cd0e497023cfdd6b5bb9ad6a29edb8b78fb3322414cad1458eb12699853acb165076db7088f518386380850c111cbe74034ddbfe217db714325ebc4d6b46eba640cf125b87eed0832077ab775e475e431079756b3da6f9bb3c861ce7eabf6adf70b76eb9642a1bab3d7afef2d7b40c8a19b98123ad7449c1039c494e73bc91a86e8e92c39a9482cf60605b9e5c209262c4fcfde76ee370bd6a78253b64c5cbb19a11b34c5a9ccf634c52751277268cd97e795b43867af5a4db51bd631ac547906fd52aff43eb98edacecf08f94a060902b5cb82e87ec856305005bd1150e581d9717460e31ba724da5e7ad72fa580f8509fe838dbc1bfbbf53e29688f25ca602d2de702e4411d3d133e2ab2f454f71f98efc2cd0eb468544cacf608c6689ef122009cf61e813e26b7b2b1695143fcd510f509ec2bf7205e674ba6767eaa29605c51e434c298bde0969617292e960d22b085632d241aa2a8e0f6ac6f2d56d0ed2c6bd3eca306a3224915065894480e737c7d7a11901bb7f977525cfcab652476baab0fd3b68dc59fd14ccdd6248bd5c5a0ab1dbae28a848b2d4ad0d973bb149ff4115b0436b7d145a6f8081d314039131f60dc8ed0ccf2c4971f0a59a65b3b1ef638e6d009dff793a4b7266c58f88bb117d665cae8fc6f6c2840470333bdbc8df12c6633a6ac7b664e089a85dc6d49f52459dd2df1be552194eef6027c1b45f62b97647788c3325f05609c1e02cbc9a18be72e4b502df719e4f9cb82615e3a03b5732328e552023dbfdcf91ed5ab51242e7d09a9b73674f0946976d8a8fa9288dce4d54d5820a0f0053b892685f79a6c8dbac724fce4d24a7b75e383f54ac58af3951d666a22f158637acc4f0e09e248e85f8e1439501afc0d5b7e9eab40fa737ae93482a1e29f3e327fa31d0d764c65ab976af1eb91fe08c5bc10a48b93453ad192d1d538cf93b792a70246bde99f46a78b670edea552840e08c787c928ee311f954b73d07287a59b470e38d4e624ddba8e4b21a74d7c07cc684b0ea82212129901029e74312866722dfa2dc53de3e8ddc00adc21deb7510ed15c50d139296297408da3d6beb589e7bb3f1d74e4e8dddec14b9cdf371d7f142136cdca5644d09edd97228a0abcd2e7b402c5cc68683cb980f50ca7aea8338dc5990a6ebb2d2b95a3deecc45f5a4f4e0e40a57e29f3e227c41db00e17dc962e2ea3184b5057c89974bcab651a22e588a527d7d8ec695e7ab5622c1ad3763d045a8393b7acfa04488556ac957777d1aebfc5d0e2a8150a6984d5607ac2400789d8f622c837d6a9b78fcc2d8aa872949edde53e3a99b5f5bf35bff5f0db7874ad3f172f9d8dd6cbb17a770b1482c79b9a15605cd0d89c6bae9aa6db8e886cfff8f843b99df95dde88c96202ae6ced4d539a3f70997ee7b2bdb7bbe529f9bc55b143066de8d9dcd7fa38c54094f2235e4a17ef8e910b4d48c373ce5e6fc9824ca8f115e579b002df16c591557cd6cac1363b8d8fc656075ca703a87f1efa76e4122eb7358389f659681fb49cb82215f73b284a7678b8b1528472d0cfab1980ee3d4410bdc1c31f1f798c3ca5744077e2f6cb4ca6e415f1e3afc8c00dd95d3307de5428883513f01ed19dde487e1c103619fd78583f09d02982512e0ee20a670b3b24986dcb7431f1ef3fd12e801bb2454213ff7b1962a464647eb4c8125cf2ed098160da880024a98add9b2917e133dcee7a8e25387fd5bf2b3f8fb05b2f7ed5f719b30b9cca4b1754e31d48bd2ec79e7e9c155130ea5f0876f3bb4d94ac74b209633ecb03deb8b9448e8cf4b4bcb04ffdb38ac457881f84636246a4e5e7773166129fb8b7803c6dde0ee69fd1f76f1d93b729eacc9d8dbd6e61e638a3f8de972a824936b1d869a15daaa21db04760e9110c5b7c736671d31a72fcd57a6f7424c898791cafa21a48921215a78d60a367aa7c6284a1aaa1fee0c5291bdc91bf8c032c9917fd28e68fc046ea4b17952f1abbe01af5f19e4fa99fc6a985f6264f9efbb208e6146d3465cc603ef36d3d59b5197bca1696bf5658b60cf0e0455cb1e174e52c4acb712a3ed9202a1ae334427b93305939c7f15e9e5eed09b5fc8d1e3836720d46d133841d4482ec2427d3002d95bce996b4b2d5b59b2a43970afe35517674bfdd8807931697422045f60641138fefa27865b9d477ef04847dd02d305e8f15e228522e54d1ffda6d5b26ad831146c66e6f9153ebeb0785ea75283df66816d771c7e4297c1686d06494a59046313169f2e2b4988a2758198fcb166d9d112d187a4456503e6c0bdfb390c89dcebf3cb8260a27fdebddbc6071857010ad4c59c062db35a4", 0x1f000)

404.87117ms ago: executing program 3 (id=4370):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x800, 0x0)
r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x14b040, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080))
syz_io_uring_setup(0x83, &(0x7f0000000580)={0x0, 0xe7b6, 0x13500, 0x80000, 0x352}, 0x0, 0x0)
pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x0)
socket(0xa, 0x3, 0x3a)
socket$inet6(0xa, 0x80002, 0x0)
dup(r2)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r3, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x24, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0x6, 0x1, 0x0, 0x0, @str='\x14\x00'}, @typed={0x8, 0xa, 0x0, 0x0, @fd=r3}]}, 0x24}}, 0x0)
ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0xfffffff3)
mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0)
ioctl$ASHMEM_SET_NAME(r1, 0x40087708, &(0x7f0000001180)='\x00\x00\x03\x01\x00\x00\x00\x1f\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x02\x00g\x00\x00\x00\x80\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-\xac\x99\xb8\xd2<Z l\xdfDh\xa1\x99Bj<\r\x87\xa3\xd1?$\x8b\x02\x00\x00\x00h\x1b\x01\x00\x00\x00\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc4\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0HdO\xb9\xa2\x1d\x13\x8fCha\xb3\x95wl},\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80Z\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9\x13f=\xbd\x03\xe8\xbex:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13\xba\x00|g]7\xdc\xe9=\"\xe4\xb3\x0f\xc6\x8f\x85fGGV&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146\'Z\x83H\xabF\x18<\x86h\x01=\x03\\\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&@\x00\x00\x00rT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\xd7c\t(\xf2\x93\x8d\\\x91\xef\xab(Jck\xdf\xa3 \x16\x9bH=\x01\x7f\x02\x1dF3\x7f\xd15\xa8\xd2\x94\xa7\xe9\xbd\xdc\x16\xe1Z\x9c\xe3\xeb9\x8f\xfdC\x0e\xd3]\xb5\xfdB\\\xd2\xfe\xf6H\x8ai}kDM\xbd\xfcJ{T{@i/\xb7x\xef\x1f\xf0t\xf5\xaf\xb21F\x01\xe0\x86\xde\x88\xb8\x8f \xfc\xcd\xba\xea\x16\xc1J\xb7\xe3\x04m\x0e\xaf\xd6X\xba\x8a\xdb\xeda\x83.H\xe3\x86\x03\t\xcb\xdc\x80\xee\x0ec\x12\x8a\x92\x11\xb6\xcc#\x10\xec\xfd\xbb\xd3\\\xc8\x88\x04,\'\x14\xbf\x84\x16\xb3\x8f,6\xc6D\xae\xa1\xf9\xe7@\xac\xaa\x104\x8b\x8eQ8\x11\xa7|\x87\xe2\xccrj%\xc4r&\r\a\xa7\xda\xf5\'V\x89\xe6\xa4\x05\xde\xf5\xaa@\xec\xe2\xf6\xb5x\xa1w\n\xda\xf2\xd67\xc6%\x0f[sF\xb6\xaeS>\xe9^\xd4\xf03\xe9.\xc4\xd5\xe0\r\xa1Q\xa8\xf2\xa2`zs\'k\xd4pV\xab&%\xf8\x8a\x80\x9d\"\xf3\xcc\xd2i\xc8\xd8\xc6\xbeD\xda\x86?\xf9\x13\xe5L`R\xe8Vq\xa3\nD\x9f\xe4M\xe6\xab\xdd!=%\x06z$\x99\';O\xfc\xf0u\x83\v<H\x8cmD\x8e\x9e\x18\xf7\xac\xa5\x17\x89\xc6\x88\x86\xe9\x15\x87WV\xfbF\xb1\x1fo\x85t\xf1\r\x8a\x9c\xe8\xac^\x19cp\xcceJ\xa6\x0e_\aE\bZ\x9f\xfa\xdf$\xad\xf0\xa5E\xeb\xd6\x80\xb7 \rd\xcc\x92\b\x01\x1bG\xb4su\x90\xcfs\x18LQ\x81^\x17\x80\xca\xdc\xe2\xb3\x01\x87G\xb8\x92\xdaJt\xa2g\xb7Azy+\x8f\xee\xb9\xa9\xa6\x04\xd1a\xca1~\x03\xbc\x87\xd1\xbaY\xf3\x8ai\xff[\xde\xde\xc6\xb1\xb9T{\xe2>\x83\a8\xfe<\x9e\xa8\xfe\xca`D\x91\x81!QT$\x05T\x85\xd6\xe9!\xb9wfL\x12\xa8\xb0\xb0\x86\xc2\xa1\xf7\x05i\xf5\xf0\r\xe7h\xdaD\xcb\xd4\x87\x84\xe5\xc7r;.\xf0\xed\x17\x83Nn\xb7\x0f!u}J)\xa1\xa1\x16\xc5`Z,\xa3\xcf\xfdy\aH\x06\x14l\x92x\xdbB=\xcc\xcdf\xe5\x04=HQ\xeaE-v\x02\x0eY\x8e\xbf\xec\x16\xc4G\xea\x8bS\x8e\xd5f\xdcj\xe1\x86\xf9s\x90\xe5\xf9\x89\xc0\xf3\xcd;r4j]\x9b\xdf\xf5\xe9\x82\xe1\xdb\x11\xb3\b\xa2Y\xdb\\\xc1H\xc3\xcf\xb1W\xe9(\xee\x18\xca\xda\xf5p,\x16\xbc\x17\xfe\xd8\n\xe1\xa1&=+)\xf9Vd\x11\xf6hX\xbe\x85O=\xe2\x9f~I\xa1\"\xa9\xd9\x19\xa2\\\xb8>f\xe2Jh+u\x90\x13\x94\x12\xc8X\xd7\xb4\xf1JS0FN\xa0\xda\xb6ez`\x9a\xea\xcf^\xa5\x17{\v\xe8n\xe9 \xc0/D\t\x7f\xd8\xad\xf2e\xff\x8b\x16p\x0f\xe4\x1a/\xe1\x96\xd2\xae\x94\x0e5\xb0b+\xac\x14\xaa\xb0\xb7\xa5.\x15\x8a\xca\xb5~=D-\x90\xc1\xbf\x05\xb9\xd5\x86\xeb\xd2#\xda\xc132\'\xfc!%\x94\x1f\xbfL)\xc2c\xa8\xef\x152\x8d\xef\xde\xbe\xab\xf5g\x80\x02G>\xf5\x04a-\xff\x06X+\xc1\xd3\xb1\xcdn\x15p\xdf\xd8.\x89\x95{\xb6+:`\x9c\xcf2\x01\x1d1\xf7\xe6\x7f\x1f\xf5\xb0\xb9\t2\x14\x81\x99\xb8@7y\xb4\xce\xf1]\a\x03y\xc5F\xfa\xae\xd1O\x7f7\xa7\xc1\xb2.~B\xe8@G\xd1\xd9R~\x1b\xf7\xa8\x86\xa7\xc1\b\x9ej\x01\xf4\xb7\xd2\x0e\xc2\x15S\x19\xd7\xd4\xe6\xaf!\xf8_\x8aEOp@>4\xd7\xcf\x11\xe0;\x99}QmE\xdd\xa69)Q\x9e\xb9\'\x97\x9b\xe7\xa4?Ed\x9c\x7fE\xba5\x90\xc07\x96S\x9d\xe1\x84\xfa\x1a\xd6\x9a\x15\xd1o \xc0\xd28\x01\xa7\x99\x85q\xbd\x80\x00\x00\x00\x00\x00\x00\x00H\x0f\xbbT\xd5\xb3\xf4\xcd<\x8a\x01\x19\xd0|B\f0\xf8i\xd3\x1bJke\t\x8b7Q\x1dQ&\x96H\x05\xec\x80\xf0\xab\x8f\x94{\x9d+\xefs\x1c\xfck\xf7q\x10\xf6\x16\xbc\xe7\x93\x0f\x7f\xcd\xa7b\xbe\x88\xcc\xb6^\x93\xa9P\xf3\xa3\xe4Az=\xe0+Q\x9e\xb5\x11\xb3\xc1\xa8P0+\xc9\xa1\xdbU~J$\xa4\x03\x11\x1aa~\x9du\x8f\x8d\xbcI\x85k\xa0\xae\xf6\xa0\x94r\xfb\xe3\xaa\xd4\xf0\x99\x06\xe1i\x1f\xfa\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\\\xb2/R\xedI2e5\x88(\xc0+^\xe7G\x17\x03^\xd7g\xb9n\x8c2\xb3\x12\x91\x86b\t\xd0R\x01\xda$Y\x85\x02&\x95FC\xc8\xd9\x00\x00\x00\xb6u\xbb\n{\x90\xfd>')
ioctl$ASHMEM_SET_NAME(r1, 0x40087707, &(0x7f0000000540)='\x00\x00\x03\x06\x00\x00\x00\xaf\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xf0:\xfd$\xad\xbb\x9a|c\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]a\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b7\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\x99\xc9\xfd\xf7\xa9\x96\xf8/0Xd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd3\xc6\x1a\xf3\x8b\x0e\xba\xecOv$\xff\x01\x00\x00\x00\x00\x00\x00uT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x04\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\b\x00\x00\x00\vE\x18\"\x87\xa0\xa9:\xceY\xae\xd1 ?\x18\xc9\xf7\xde\xb0;\x85\x8c\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9\x02\xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xd7\x95\xeau\xb4\x84x\x00\x00X\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xd5\b^[\xa8\x17\xc6u\x1c\x18\xdeg\x1b\x10\xa8')
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x138a, 0x1000000003})
mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0)
r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1a)
ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000080)={[{0xe, 0x4, 0x10, 0x0, 0x45, 0x9, 0xd0, 0x10, 0x6, 0x6, 0x6f, 0x3, 0x4d01}, {0x3, 0xfff, 0x6, 0x19, 0x3, 0x3, 0xff, 0x5, 0x1, 0xfa, 0x81, 0x4, 0x2}, {0x8, 0xd47a, 0x36, 0x8, 0x44, 0x10, 0x4, 0xd, 0x8, 0x3, 0x11, 0x1, 0x1ff}], 0xfffffffb})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f0000000180)=""/249, 0xf9, 0x2, 0x4}, @fda={0x66646185, 0x7, 0x0, 0x12}, @fda={0x66646185, 0x4, 0x0, 0x23}}, &(0x7f0000000000)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0})

345.163286ms ago: executing program 3 (id=4371):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x800, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x138a, 0x1000000003})
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x132)
fstat(r1, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
setreuid(0x0, r2)
r3 = socket$inet6(0x10, 0x2, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000240)={0x2, &(0x7f0000000040)=[{0x48, 0x0, 0x0, 0xffeffffe}, {0x16}]}, 0x10)
sendto$inet6(r3, &(0x7f00000002c0)="1c0000001200050f0c1000000049b23e9b200a00080001c000000001", 0x1c, 0x0, 0x0, 0x0)
r4 = eventfd(0x2)
fchmod(r4, 0xa0ffff)
r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000940)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40086315, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x18, &(0x7f0000000040)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/238, 0xee, 0x2, 0x4}, @flat=@weak_binder={0x77622a85, 0x30a}, @flat=@binder={0x73622a85, 0x14, 0x3}}, &(0x7f0000000000)={0x0, 0x28, 0x40}}}], 0x0, 0x0, 0x0})

344.892506ms ago: executing program 3 (id=4372):
r0 = ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece)
read$snapshot(r0, &(0x7f0000000000)=""/43, 0x2b)
r1 = socket$inet6(0xa, 0x2, 0x3a)
sendmmsg$inet6(r1, &(0x7f0000000340)=[{{&(0x7f0000000380)={0xa, 0x0, 0x1000, @mcast2={0xff, 0x5, '\x00', 0x0}}, 0x14, &(0x7f0000000040)=[{&(0x7f0000000100)="a0002883781ecc0e", 0x8}], 0x1}}], 0x1, 0x0) (async)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs2/binder0\x00', 0x0, 0x0) (async)
fsopen(&(0x7f00000000c0)='msdos\x00', 0x1)
madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x17)
r3 = socket(0x10, 0x803, 0x0)
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f00000002c0)={'pim6reg1\x00', 0x0}) (async)
mincore(&(0x7f0000ffc000/0x3000)=nil, 0x3000, &(0x7f0000000000)=""/162)
ioctl$BINDER_GET_EXTENDED_ERROR(r2, 0xc00c6211, &(0x7f0000000080))
fstatfs(r1, &(0x7f0000000140)=""/180)

344.609546ms ago: executing program 3 (id=4373):
pipe2(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
syz_usb_connect$uac1(0x0, 0xa4, &(0x7f00000001c0)=ANY=[@ANYBLOB="2a01000020000040b708000000000000430109029200030172e5000904000000010100000a24010000000201020c0d240700000500006e626805000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r1, @ANYBLOB="05", @ANYRES16=r0], 0x0)
r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
getsockopt$WPAN_SECURITY_LEVEL(r2, 0x0, 0x2, &(0x7f00000000c0), &(0x7f0000000140)=0x4)
r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x8c83, 0x0)
ioctl$BLKRRPART(r3, 0x125f, 0x0)
r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ip_vs\x00')
ioctl$IOC_PR_RELEASE(r4, 0x401070ca, &(0x7f0000000040)={0x37, 0x8, 0x1})
exit(0xb)

110.106039ms ago: executing program 1 (id=4374):
setuid(0xee00)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000200)={'ip6gre0\x00', 0x0}) (async)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000200)={'ip6gre0\x00', 0x0})
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000000c0)={{{@in6=@remote, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in6=@ipv4}, 0x0, @in6=@ipv4={""/10, ""/2, @local}}}, &(0x7f00000003c0)=0xe8)
stat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)) (async)
stat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
lstat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)) (async)
lstat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
write$P9_RSTATu(r1, &(0x7f0000000340)={0x57, 0x7d, 0x2, {{0x0, 0x40, 0x6, 0x494f, {0x0, 0x3, 0x4}, 0xc8810000, 0x4, 0x3, 0x0, 0xc, '/dev/ashmem\x00', 0x0, '', 0x0, '', 0x1, '\x00'}, 0x2, '-&', r2, r3, r4}}, 0x57)
r5 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0)
ioctl$ASHMEM_SET_SIZE(r5, 0x40087703, 0x5)
mmap(&(0x7f0000018000/0x2000)=nil, 0x2000, 0xa8ca3411d3c26009, 0x13, r5, 0x22e7c000)

96.201501ms ago: executing program 1 (id=4375):
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/binder0\x00', 0x0, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_mreqn(r1, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc)
getsockopt$inet_buf(r1, 0x0, 0x29, &(0x7f0000000000)=""/145, &(0x7f0000695ffc)=0x24b)
r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x100000000000000, 0x2000, &(0x7f0000000000/0x2000)=nil})
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0xc6225a99193a0f0e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0})

3.77312ms ago: executing program 4 (id=4376):
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
vmsplice(r0, &(0x7f0000000140), 0x0, 0x0)
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CAP_X2APIC_API(0xffffffffffffffff, 0x4068aea3, 0x0)
r1 = openat$rnullb(0xffffffffffffff9c, 0x0, 0x301342, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendmsg$inet(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000140)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0xb}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x3}}], 0x30}, 0x20048080)
futex(&(0x7f0000000180)=0x2, 0x5, 0x2, 0x0, &(0x7f00000001c0)=0x2, 0x6)
recvmsg$unix(r2, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1, 0x0, 0x2}, 0x40000300)
setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x7, 0x0, 0x0)
ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0xffff8000)
capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x5})
r3 = getpid()
r4 = syz_pidfd_open(r3, 0x0)
setns(r4, 0x24020000)
r5 = syz_clone(0x16040000, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_pidfd_open(r5, 0x0)
syz_usb_disconnect(0xffffffffffffffff)
wait4(0x0, 0x0, 0x80000000, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x10008)
pipe2$9p(&(0x7f0000000580)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff}, 0x80000)
r8 = dup(r7)
write$FUSE_BMAP(r8, 0x0, 0x0)
mount$9p_fd(0x0, 0x0, 0x0, 0x4000, &(0x7f00000002c0)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r8}, 0x2c, {[], [{@func={'func', 0x3d, 'KEXEC_INITRAMFS_CHECK'}}, {@context={'context', 0x3d, 'staff_u'}}, {@permit_directio}, {@fscontext={'fscontext', 0x3d, 'user_u'}}, {@fowner_gt}, {@smackfstransmute={'smackfstransmute', 0x3d, 'KEXEC_INITRAMFS_CHECK'}}, {@subj_role={'subj_role', 0x3d, '%\'\''}}]}})
r9 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000000240)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x6000}})
write$FUSE_DIRENTPLUS(r9, &(0x7f00000001c0)=ANY=[@ANYBLOB="10000000", @ANYRES64=r9], 0x10)

0s ago: executing program 1 (id=4377):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) (async)
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x0)
r3 = openat$cgroup_subtree(r2, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r3, &(0x7f0000000180)={[{0x2b, 'io'}, {0x2d, 'cpuacct'}]}, 0xd)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x3) (async)
r4 = socket$inet6(0xa, 0x80002, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async)
mount$incfs(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x1010040, &(0x7f0000000180)=ANY=[@ANYBLOB="726c6f675f70616765733d323433322c000000000000000000000000000000000033c8b09cb1dc9dd37ce8ce65c5c36b2b988bcce79c19413f9884e0aeef4a727a82723b29eec818231e589a5ec3f0272bd7fac382504c1edc3128bc57ca961d586a0aa87545652647a0510e78a8f0a1fe650e7829ec2f1a875fa299382590e7c326053b8c4fb051bd6c919ea3db1875409a59c17a8f3c"]) (async)
setsockopt$inet6_mreq(r4, 0x29, 0x1b, &(0x7f0000000240)={@remote}, 0x14)
mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x4, 0x0)
pipe2$9p(&(0x7f00000001c0)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x0)
write$P9_RVERSION(r6, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15)
r7 = dup(r6)
write$FUSE_BMAP(r7, &(0x7f0000000000)={0x18}, 0x18)
write$FUSE_DIRENTPLUS(r7, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) (async)
mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000500)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r7}, 0x2c, {[{@access_uid}, {@dfltuid}, {@dfltgid}]}}) (async)
truncate(&(0x7f00000000c0)='./file0\x00', 0x7fffffffffffffff)
setsockopt$inet6_mreq(r4, 0x29, 0x1b, &(0x7f0000000000)={@dev}, 0x14) (async)
r8 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r8, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="20000000110001000000000000000000100000e60b"], 0x20}], 0x1}, 0x0) (async)
close_range(r0, 0xffffffffffffffff, 0x0)

kernel console output (not intermixed with test programs):

11.471461][    T9] usb 4-1: config 0 descriptor??
[  211.904402][T10138] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  211.913316][T10138] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  211.924337][    T9] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0
[  211.931844][    T9] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0
[  211.939367][    T9] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0
[  211.946832][    T9] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0
[  211.954343][    T9] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0
[  211.961755][    T9] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0
[  211.969277][    T9] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0
[  211.976999][    T9] plantronics 0003:047F:FFFF.0008: No inputs registered, leaving
[  211.986136][    T9] plantronics 0003:047F:FFFF.0008: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0
[  212.196980][  T332] usb 4-1: USB disconnect, device number 27
[  212.572771][T10233] overlay: Unknown parameter 'fsuuid'
[  212.590260][T10232] bridge0: port 1(bridge_slave_0) entered blocking state
[  212.598119][T10232] bridge0: port 1(bridge_slave_0) entered disabled state
[  212.605298][T10232] bridge_slave_0: entered allmulticast mode
[  212.611668][T10232] bridge_slave_0: entered promiscuous mode
[  212.618196][T10232] bridge0: port 2(bridge_slave_1) entered blocking state
[  212.625323][T10232] bridge0: port 2(bridge_slave_1) entered disabled state
[  212.632455][T10232] bridge_slave_1: entered allmulticast mode
[  212.638901][T10232] bridge_slave_1: entered promiscuous mode
[  212.692409][T10232] bridge0: port 2(bridge_slave_1) entered blocking state
[  212.699577][T10232] bridge0: port 2(bridge_slave_1) entered forwarding state
[  212.706866][T10232] bridge0: port 1(bridge_slave_0) entered blocking state
[  212.714126][T10232] bridge0: port 1(bridge_slave_0) entered forwarding state
[  212.755550][   T36] audit: type=1400 audit(2000000373.844:39778): avc:  denied  { connect } for  pid=10243 comm="syz.3.3340" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1
[  212.768929][T10247] binder: Unknown parameter 'defcontext01777777777777777777777'
[  212.786012][T10246] netlink: 'syz.3.3341': attribute type 40 has an invalid length.
[  212.795715][T10232] veth0_vlan: entered promiscuous mode
[  212.808987][T10232] veth1_macvtap: entered promiscuous mode
[  212.847592][T10251] /dev/rnullb0: Can't open blockdev
[  212.913167][T10260] 9pnet_fd: Insufficient options for proto=fd
[  212.993839][T10266] usb usb8: usbfs: interface 0 claimed by hub while 'syz.4.3347' sets config #0
[  213.056775][T10276] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2584 sclass=netlink_route_socket pid=10276 comm=syz.3.3350
[  213.071868][T10276] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized
[  213.081564][T10276] binder: Unknown parameter 'maxul'
[  213.178307][T10280] rust_binder: Error in use_page_slow: ESRCH
[  213.178330][T10280] rust_binder: use_range failure ESRCH
[  213.184538][T10280] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false
[  213.190119][T10280] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH }
[  213.198280][T10280] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:20
[  213.336418][T10284] rust_binder: Error while translating object.
[  213.345682][T10284] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  213.351928][T10284] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:24
[  213.575786][T10295] 9pnet_fd: Insufficient options for proto=fd
[  213.621195][T10300] input: syz1 as /devices/virtual/input/input16
[  213.740971][T10310] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  213.741330][T10310] netlink: 64 bytes leftover after parsing attributes in process `syz.3.3362'.
[  213.757820][T10310] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  213.824809][T10318] overlay: Unknown parameter 'fsuuid'
[  213.827316][    T9] usb 3-1: new high-speed USB device number 27 using dummy_hcd
[  213.878248][T10322] netlink: 9 bytes leftover after parsing attributes in process `syz.1.3365'.
[  213.887635][T10322] gretap0: entered promiscuous mode
[  213.894338][T10324] netlink: 5 bytes leftover after parsing attributes in process `syz.1.3365'.
[  213.903407][T10324] 0ªî{X¹¦: renamed from gretap0
[  213.909105][T10324] 0ªî{X¹¦: left promiscuous mode
[  213.914255][T10324] 0ªî{X¹¦: entered allmulticast mode
[  213.920354][T10324] A link change request failed with some changes committed already. Interface 
30ªî{X¹¦ may have been left with an inconsistent configuration, please check.
[  213.942872][  T414] bridge_slave_1: left allmulticast mode
[  213.948848][  T414] bridge_slave_1: left promiscuous mode
[  213.953658][T10327] SELinux: security_context_str_to_sid (Eá…) failed with errno=-22
[  213.954592][  T414] bridge0: port 2(bridge_slave_1) entered disabled state
[  213.970464][  T414] bridge_slave_0: left allmulticast mode
[  213.976198][  T414] bridge_slave_0: left promiscuous mode
[  213.982005][    T9] usb 3-1: device descriptor read/64, error -71
[  213.984402][  T414] bridge0: port 1(bridge_slave_0) entered disabled state
[  214.122060][  T414] tipc: Disabling bearer <udp:syz0>
[  214.127443][  T414] tipc: Left network mode
[  214.132502][  T414] veth1_macvtap: left promiscuous mode
[  214.243080][    T9] usb 3-1: device descriptor read/64, error -71
[  214.498812][    T9] usb 3-1: new high-speed USB device number 28 using dummy_hcd
[  214.637369][    T9] usb 3-1: device descriptor read/64, error -71
[  214.893165][    T9] usb 3-1: device descriptor read/64, error -71
[  215.021165][    T9] usb usb3-port1: attempt power cycle
[  215.210245][T10353] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2461425684 (39382810944 ns) > initial count (8713180688 ns). Using initial count to start timer.
[  215.287565][   T36] audit: type=1400 audit(2000000376.217:39779): avc:  denied  { setattr } for  pid=10352 comm="syz.3.3375" path="/dev/rfkill" dev="devtmpfs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:wireless_device_t tclass=chr_file permissive=1
[  215.313348][T10359] rust_binder: Failed to allocate buffer. len:136, is_oneway:false
[  215.399048][   T36] audit: type=1400 audit(2000000376.330:39780): avc:  denied  { nosuid_transition } for  pid=10360 comm="syz.3.3377" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=process2 permissive=1
[  215.430536][    T9] usb 3-1: new high-speed USB device number 29 using dummy_hcd
[  215.457136][   T36] audit: type=1400 audit(2000000376.330:39781): avc:  denied  { transition } for  pid=10360 comm="syz.3.3377" path=2F6D656D66643A5B0BDB58AE5B1AA9FDFAADD16D64C8854858A9250C1A65E0202864656C6574656429 dev="tmpfs" ino=140 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=process permissive=1
[  215.487139][   T36] audit: type=1400 audit(2000000376.330:39782): avc:  denied  { entrypoint } for  pid=10360 comm="syz.3.3377" path=2F6D656D66643A5B0BDB58AE5B1AA9FDFAADD16D64C8854858A9250C1A65E0202864656C6574656429 dev="tmpfs" ino=140 scontext=system_u:object_r:hugetlbfs_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1
[  215.496460][    T9] usb 3-1: device descriptor read/8, error -71
[  215.517194][   T36] audit: type=1400 audit(2000000376.330:39783): avc:  denied  { share } for  pid=10360 comm="syz.3.3377" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=process permissive=1
[  215.543139][   T36] audit: type=1400 audit(2000000376.330:39784): avc:  denied  { noatsecure } for  pid=10360 comm="syz.3.3377" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=process permissive=1
[  215.737935][    T9] usb 3-1: device descriptor read/8, error -71
[  216.012371][    T9] usb 3-1: new high-speed USB device number 30 using dummy_hcd
[  216.034790][    T9] usb 3-1: device descriptor read/8, error -71
[  216.173285][    T9] usb 3-1: device descriptor read/8, error -71
[  216.289570][    T9] usb usb3-port1: unable to enumerate USB device
[  216.348204][T10379] SELinux: security_context_str_to_sid (sysadm_u) failed with errno=-22
[  216.427980][   T36] audit: type=1400 audit(2000000377.287:39785): avc:  denied  { setattr } for  pid=10388 comm="syz.3.3381" name="uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1
[  216.492091][T10394] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3389'.
[  216.551540][T10401] 9pnet_fd: Insufficient options for proto=fd
[  216.565461][T10397] syzkaller1: tun_chr_ioctl cmd 1074025678
[  216.571472][T10397] syzkaller1: group set to 0
[  216.576201][T10404] netlink: 124 bytes leftover after parsing attributes in process `syz.1.3392'.
[  216.576691][T10397] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  216.585338][T10397] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:50
[  216.811425][T10450] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3405'.
[  216.852886][T10455] overlay: Unknown parameter 'fsuuid'
[  216.944527][T10463] tun0: tun_chr_ioctl cmd 1074025675
[  216.949950][T10463] tun0: persist enabled
[  217.216781][    T9] usb 3-1: new high-speed USB device number 31 using dummy_hcd
[  217.376639][    T9] usb 3-1: Using ep0 maxpacket: 8
[  217.383051][    T9] usb 3-1: config 179 has an invalid interface number: 65 but max is 0
[  217.391565][    T9] usb 3-1: config 179 has no interface number 0
[  217.397992][    T9] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9
[  217.409318][    T9] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024
[  217.420817][    T9] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0
[  217.430956][    T9] usb 3-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23
[  217.444403][    T9] usb 3-1: config 179 interface 65 has no altsetting 0
[  217.451419][    T9] usb 3-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00
[  217.460475][    T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  217.646151][T10470] netlink: 1072 bytes leftover after parsing attributes in process `syz.4.3410'.
[  217.655628][T10470] netlink: 280 bytes leftover after parsing attributes in process `syz.4.3410'.
[  217.666668][T10470] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3410'.
[  217.683373][   T46] usb 3-1: USB disconnect, device number 31
[  217.701065][T10475] rust_binder: Failed to allocate buffer. len:1160, is_oneway:false
[  217.920220][    T9] usb 5-1: new full-speed USB device number 5 using dummy_hcd
[  218.092003][    T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64
[  218.103085][    T9] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4
[  218.116140][    T9] usb 5-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00
[  218.125376][    T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  218.134133][    T9] usb 5-1: config 0 descriptor??
[  218.139381][T10473] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22
[  218.147704][    T9] usbhid 5-1:0.0: can't add hid device: -22
[  218.153723][    T9] usbhid 5-1:0.0: probe with driver usbhid failed with error -22
[  218.361457][    T9] usb 5-1: USB disconnect, device number 5
[  218.428844][T10493] binder: Unknown parameter 'contextÌðÔð[7’'
[  218.580246][T10504] 9pnet_fd: Insufficient options for proto=fd
[  218.587433][T10505] 9pnet_fd: Insufficient options for proto=fd
[  218.642867][T10517] rust_binder: Failed to allocate buffer. len:1192, is_oneway:false
[  218.651864][T10520] overlay: Unknown parameter 'fsuuid'
[  218.716305][T10532] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  218.726494][T10532] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  218.774955][T10536] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3430'.
[  218.975445][   T46] usb 3-1: new high-speed USB device number 32 using dummy_hcd
[  219.124751][   T46] usb 3-1: device descriptor read/64, error -71
[  219.284583][  T332] usb 5-1: new high-speed USB device number 6 using dummy_hcd
[  219.380507][   T46] usb 3-1: device descriptor read/64, error -71
[  219.444027][T10556] rust_binder: Error while translating object.
[  219.444060][T10556] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM }
[  219.450348][  T332] usb 5-1: Using ep0 maxpacket: 8
[  219.450614][T10556] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:219
[  219.462239][  T332] usb 5-1: config 4 has an invalid interface number: 126 but max is 1
[  219.482714][  T332] usb 5-1: config 4 has an invalid interface number: 30 but max is 1
[  219.491093][  T332] usb 5-1: config 4 has no interface number 0
[  219.497211][  T332] usb 5-1: config 4 has no interface number 1
[  219.503312][T10560] rust_binder: Read failure Err(EAGAIN) in pid:223
[  219.503611][  T332] usb 5-1: config 4 interface 126 has no altsetting 0
[  219.519724][  T332] usb 5-1: string descriptor 0 read error: -22
[  219.526098][  T332] usb 5-1: New USB device found, idVendor=0499, idProduct=1040, bcdDevice=7e.7d
[  219.535886][  T332] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  219.546624][  T332] snd-usb-audio 5-1:4.126: probe with driver snd-usb-audio failed with error -2
[  219.561176][  T332] snd-usb-audio 5-1:4.30: probe with driver snd-usb-audio failed with error -2
[  219.562637][ T2293] udevd[2293]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:4.30/sound/card0/controlC0/../uevent} for writing: No such file or directory
[  219.657614][   T46] usb 3-1: new high-speed USB device number 33 using dummy_hcd
[  219.774876][  T372] usb 4-1: new full-speed USB device number 28 using dummy_hcd
[  219.796154][   T46] usb 3-1: device descriptor read/64, error -71
[  219.939889][  T372] usb 4-1: unable to get BOS descriptor or descriptor too short
[  219.948466][  T372] usb 4-1: not running at top speed; connect to a high speed hub
[  219.957602][  T372] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64
[  219.974990][  T372] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  219.986578][   T10] usb 5-1: USB disconnect, device number 6
[  219.994164][  T372] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  220.008774][  T372] usb 4-1: SerialNumber: syz
[  220.017655][T10563] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22
[  220.051982][   T46] usb 3-1: device descriptor read/64, error -71
[  220.098506][T10595] SELinux: security_context_str_to_sid (system_u) failed with errno=-22
[  220.162018][T10597] overlay: Unknown parameter 'fsuuid'
[  220.169493][   T46] usb usb3-port1: attempt power cycle
[  220.241745][T10563] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  220.250614][T10563] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  220.273469][T10598] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  220.273574][T10598] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:226
[  220.279798][T10563] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:226
[  220.335290][  T372] cdc_ncm 4-1:1.0: bind() failure
[  220.350733][  T372] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found
[  220.357588][  T372] cdc_ncm 4-1:1.1: bind() failure
[  220.365465][  T372] usb 4-1: USB disconnect, device number 28
[  220.542526][   T46] usb 3-1: new high-speed USB device number 34 using dummy_hcd
[  220.564627][   T46] usb 3-1: device descriptor read/8, error -71
[  220.703292][   T46] usb 3-1: device descriptor read/8, error -71
[  220.798076][   T10] usb 5-1: new full-speed USB device number 7 using dummy_hcd
[  220.958026][   T46] usb 3-1: new high-speed USB device number 35 using dummy_hcd
[  220.959145][   T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64
[  220.976898][   T10] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4
[  220.989803][   T10] usb 5-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00
[  220.991410][   T46] usb 3-1: device descriptor read/8, error -71
[  220.998921][   T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  221.014220][   T10] usb 5-1: config 0 descriptor??
[  221.018978][T10608] rust_binder: Error while translating object.
[  221.019312][T10608] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT }
[  221.025643][T10602] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22
[  221.036401][T10608] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:231
[  221.055814][   T10] usbhid 5-1:0.0: can't add hid device: -22
[  221.061829][   T10] usbhid 5-1:0.0: probe with driver usbhid failed with error -22
[  221.105059][T10617] tmpfs: Bad value for 'size'
[  221.114187][T10617] rust_binder: Write failure EINVAL in pid:240
[  221.114748][T10617] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  221.127694][T10618] tmpfs: Bad value for 'size'
[  221.140962][   T46] usb 3-1: device descriptor read/8, error -71
[  221.188971][T10622] rust_binder: Error while translating object.
[  221.189003][T10622] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM }
[  221.195321][T10622] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:245
[  221.206546][T10622] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3454'.
[  221.236774][T10624] netlink: 156 bytes leftover after parsing attributes in process `syz.3.3455'.
[  221.257035][   T46] usb usb3-port1: unable to enumerate USB device
[  221.260808][T10626] rust_binder: Write failure EFAULT in pid:249
[  221.270898][   T46] usb 5-1: USB disconnect, device number 7
[  221.942361][T10644] SELinux: security_context_str_to_sid (syste_uÝGй‰:ÿß) failed with errno=-22
[  222.068358][T10653] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM }
[  222.068399][T10653] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:88
[  222.161621][T10663] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 3
[  222.178001][T10663] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1
[  222.186594][T10663] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1
[  222.193771][T10663] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
[  222.200964][T10663] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:420
[  222.228579][T10665] rust_binder: Write failure EFAULT in pid:253
[  222.238330][T10665] rust_binder: Write failure EFAULT in pid:253
[  222.255712][T10669] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=61 sclass=netlink_route_socket pid=10669 comm=syz.3.3473
[  222.276445][T10669] tipc: Started in network mode
[  222.281380][T10669] tipc: Node identity 4, cluster identity 4711
[  222.287561][T10669] tipc: Node number set to 4
[  222.359760][T10672] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT }
[  222.359802][T10672] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:259
[  222.428656][T10684] binder: Bad value for 'max'
[  222.450188][  T331] usb 5-1: new full-speed USB device number 8 using dummy_hcd
[  222.455086][T10689] netlink: 'syz.3.3482': attribute type 4 has an invalid length.
[  222.467298][T10689] netlink: 'syz.3.3482': attribute type 4 has an invalid length.
[  222.478091][T10689] rust_binder: Error while translating object.
[  222.478120][T10689] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM }
[  222.484576][T10689] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:266
[  222.603801][T10710] overlayfs: failed to resolve '/
[  222.603801][T10710] MOì"Ù': -2
[  222.628931][  T331] usb 5-1: not running at top speed; connect to a high speed hub
[  222.637655][T10710] rust_binder: Write failure EFAULT in pid:273
[  222.645959][  T331] usb 5-1: config 4 has an invalid interface number: 211 but max is 2
[  222.660621][  T331] usb 5-1: config 4 has an invalid interface number: 10 but max is 2
[  222.668915][  T331] usb 5-1: config 4 has an invalid interface number: 100 but max is 2
[  222.689868][  T331] usb 5-1: config 4 has no interface number 0
[  222.696233][  T331] usb 5-1: config 4 has no interface number 1
[  222.702452][  T331] usb 5-1: config 4 has no interface number 2
[  222.710704][T10716] rust_binder: Write failure EFAULT in pid:276
[  222.713929][  T331] usb 5-1: config 4 interface 211 altsetting 4 has a duplicate endpoint with address 0x7, skipping
[  222.731359][  T331] usb 5-1: config 4 interface 211 altsetting 4 endpoint 0xB has invalid maxpacket 1023, setting to 64
[  222.742660][  T331] usb 5-1: config 4 interface 211 altsetting 4 endpoint 0x9 has invalid maxpacket 512, setting to 64
[  222.755693][  T331] usb 5-1: config 4 interface 211 altsetting 4 has an invalid descriptor for endpoint zero, skipping
[  222.771684][  T331] usb 5-1: config 4 interface 211 altsetting 4 has a duplicate endpoint with address 0x9, skipping
[  222.791308][T10726] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2
[  222.798543][T10726] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[  222.801894][  T331] usb 5-1: config 4 interface 211 altsetting 4 has a duplicate endpoint with address 0x5, skipping
[  222.833875][  T331] usb 5-1: config 4 interface 211 altsetting 4 has a duplicate endpoint with address 0xF, skipping
[  222.844804][  T331] usb 5-1: config 4 interface 211 altsetting 4 has an invalid descriptor for endpoint zero, skipping
[  222.855728][  T331] usb 5-1: config 4 interface 211 altsetting 4 endpoint 0x2 has invalid maxpacket 1024, setting to 64
[  222.866864][  T331] usb 5-1: config 4 interface 10 altsetting 64 has a duplicate endpoint with address 0x5, skipping
[  222.877603][  T331] usb 5-1: config 4 interface 10 altsetting 64 has an invalid descriptor for endpoint zero, skipping
[  222.888543][  T331] usb 5-1: config 4 interface 10 altsetting 64 endpoint 0x8 has invalid maxpacket 1024, setting to 64
[  222.888812][   T36] audit: type=1400 audit(2000000383.348:39786): avc:  denied  { map } for  pid=10723 comm="syz.1.3495" path="socket:[49018]" dev="sockfs" ino=49018 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1
[  222.899536][  T331] usb 5-1: config 4 interface 211 has no altsetting 0
[  222.899564][  T331] usb 5-1: config 4 interface 10 has no altsetting 0
[  222.937218][  T331] usb 5-1: config 4 interface 100 has no altsetting 0
[  222.948954][  T331] usb 5-1: New USB device found, idVendor=deee, idProduct=0303, bcdDevice=69.c2
[  222.958229][  T331] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  222.966500][  T331] usb 5-1: Product: 䒫딸▯�뺡䖗쎚箸鼿῾踊᧨勢䗭鯭�Ւ繬�劋ﰢ벊狧ꗣℚ弼
[  222.978151][  T331] usb 5-1: Manufacturer: Ñ—
[  222.982710][  T331] usb 5-1: SerialNumber: ꣟ퟫ럃뱯駦ៗ脿ᔃ䋅�ﺨ䜒�氅�鉬걉澇츩柟ꅭ텰퇖㖋㋘棆壴칥촧駾⼈鉣䲡ᰑ몎覧�ҩ좲鑕몥낫팙ュ耄�쓞ὃ┌옶儼Λ퓂뺛�뙜䩺᪆﫛싘
[  223.005808][T10657] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22
[  223.013088][T10657] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22
[  223.079040][   T46] usb 4-1: new high-speed USB device number 29 using dummy_hcd
[  223.086752][  T332] usb 3-1: new high-speed USB device number 36 using dummy_hcd
[  223.228347][   T46] usb 4-1: device descriptor read/64, error -71
[  223.246947][  T331] ftdi_sio 5-1:4.211: FTDI USB Serial Device converter detected
[  223.261292][  T332] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  223.269630][  T331] ftdi_sio ttyUSB0: unknown device type: 0x69c2
[  223.278717][  T332] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  223.290518][  T331] ftdi_sio 5-1:4.10: FTDI USB Serial Device converter detected
[  223.298471][  T332] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  223.308623][  T331] ftdi_sio ttyUSB1: unknown device type: 0x69c2
[  223.322826][  T332] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  223.324016][  T331] ftdi_sio 5-1:4.100: FTDI USB Serial Device converter detected
[  223.333877][  T332] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  223.349927][  T331] ftdi_sio ttyUSB2: unknown device type: 0x69c2
[  223.356428][  T332] usb 3-1: config 0 descriptor??
[  223.371134][  T331] usb 5-1: USB disconnect, device number 8
[  223.385535][  T331] ftdi_sio 5-1:4.211: device disconnected
[  223.398501][  T331] ftdi_sio 5-1:4.10: device disconnected
[  223.421209][  T331] ftdi_sio 5-1:4.100: device disconnected
[  223.441102][T10750] rust_binder: Write failure EFAULT in pid:105
[  223.516259][   T46] usb 4-1: device descriptor read/64, error -71
[  223.782550][   T46] usb 4-1: new high-speed USB device number 30 using dummy_hcd
[  223.791185][T10722] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0
[  223.798648][T10722] rust_binder: Write failure EINVAL in pid:422
[  223.800814][  T332] usbhid 3-1:0.0: can't add hid device: -71
[  223.813019][  T332] usbhid 3-1:0.0: probe with driver usbhid failed with error -71
[  223.821971][  T332] usb 3-1: USB disconnect, device number 36
[  223.932406][   T46] usb 4-1: device descriptor read/64, error -71
[  224.187572][   T46] usb 4-1: device descriptor read/64, error -71
[  224.307029][   T46] usb usb4-port1: attempt power cycle
[  224.355336][T10780] VFS: Mount too revealing
[  224.360701][T10780] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 224, size: 226)
[  224.360731][T10780] rust_binder: Error while translating object.
[  224.371463][T10780] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  224.377696][T10780] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:424
[  224.462890][T10789] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 1
[  224.667230][   T46] usb 4-1: new high-speed USB device number 31 using dummy_hcd
[  224.689923][   T46] usb 4-1: device descriptor read/8, error -71
[  224.828065][   T46] usb 4-1: device descriptor read/8, error -71
[  224.868839][T10798] /dev/loop0: Can't lookup blockdev
[  225.082916][   T46] usb 4-1: new high-speed USB device number 32 using dummy_hcd
[  225.105496][   T46] usb 4-1: device descriptor read/8, error -71
[  225.243817][   T46] usb 4-1: device descriptor read/8, error -71
[  225.360125][   T46] usb usb4-port1: unable to enumerate USB device
[  225.556211][T10829] netlink: 'syz.1.3533': attribute type 27 has an invalid length.
[  225.587775][T10831] netlink: 57 bytes leftover after parsing attributes in process `syz.1.3534'.
[  225.725192][T10847] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3540'.
[  225.734303][T10847] netlink: 35 bytes leftover after parsing attributes in process `syz.1.3540'.
[  225.743304][T10847] netlink: 'syz.1.3540': attribute type 6 has an invalid length.
[  225.751118][T10847] netlink: 'syz.1.3540': attribute type 5 has an invalid length.
[  225.759014][T10847] netlink: 35 bytes leftover after parsing attributes in process `syz.1.3540'.
[  226.013081][T10868] netlink: 388 bytes leftover after parsing attributes in process `syz.1.3549'.
[  226.043213][T10870] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 3
[  226.057316][T10871] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 3
[  226.113993][T10878] binder: Bad value for 'stats'
[  226.447221][   T10] usb 4-1: new high-speed USB device number 33 using dummy_hcd
[  226.607086][   T10] usb 4-1: Using ep0 maxpacket: 16
[  226.613340][   T10] usb 4-1: config 0 has an invalid interface number: 105 but max is 0
[  226.621799][   T10] usb 4-1: config 0 has no interface number 0
[  226.630609][   T10] usb 4-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28
[  226.639778][   T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  226.647778][   T10] usb 4-1: Product: syz
[  226.652003][   T10] usb 4-1: Manufacturer: syz
[  226.656613][   T10] usb 4-1: SerialNumber: syz
[  226.661937][   T10] usb 4-1: config 0 descriptor??
[  226.792395][T10898] 9pnet_fd: Insufficient options for proto=fd
[  226.824853][   T36] audit: type=1400 audit(2000000387.044:39787): avc:  denied  { map } for  pid=10899 comm="syz.1.3562" path="socket:[50015]" dev="sockfs" ino=50015 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[  226.881617][   T10] usb 4-1: Found UVC 0.00 device syz (046d:08f3)
[  226.894692][   T10] usb 4-1: No valid video chain found.
[  226.926587][T10921] SELinux: security_context_str_to_sid (syste_uÝGй‰:ÿß) failed with errno=-22
[  226.936288][T10922] SELinux: security_context_str_to_sid (syste_uÝGй‰:ÿß) failed with errno=-22
[  227.093582][T10939] netlink: 'syz.4.3574': attribute type 12 has an invalid length.
[  227.101256][T10881] rust_binder: Failed to allocate buffer. len:1184, is_oneway:true
[  227.107463][   T46] usb 4-1: USB disconnect, device number 33
[  227.341398][T10939] rust_binder: Failure when writing BR_NOOP at beginning of buffer.
[  227.341427][T10939] rust_binder: Read failure Err(EFAULT) in pid:137
[  227.490678][T10947] netlink: 96 bytes leftover after parsing attributes in process `syz.2.3577'.
[  227.563062][T10963] rust_binder: Failed to allocate buffer. len:1176, is_oneway:false
[  227.796939][T10985] rust_binder: Error while translating object.
[  227.805094][T10985] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  227.811342][T10985] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:287
[  227.822644][   T36] audit: type=1400 audit(2000000387.992:39788): avc:  denied  { audit_write } for  pid=10984 comm="syz.3.3587" capability=29  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1
[  228.156538][   T36] audit: type=1400 audit(2000000388.301:39789): avc:  denied  { write } for  pid=11001 comm="syz.2.3591" name="msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1
[  228.163324][   T46] usb 5-1: new high-speed USB device number 9 using dummy_hcd
[  228.234219][T11007] rust_binder: validate_parent_fixup: new_min_offset=18, sg_entry.length=0
[  228.234248][T11007] rust_binder: Error while translating object.
[  228.243026][T11007] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  228.249368][T11007] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:472
[  228.281439][T11009] rust_binder: Write failure EFAULT in pid:474
[  228.314676][T11011] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  228.348732][   T46] usb 5-1: Using ep0 maxpacket: 8
[  228.383136][   T46] usb 5-1: config 0 has an invalid interface number: 31 but max is 0
[  228.393982][   T46] usb 5-1: config 0 has no interface number 0
[  228.403280][   T46] usb 5-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16
[  228.414547][   T46] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  228.430247][   T46] usb 5-1: Product: syz
[  228.434541][   T46] usb 5-1: Manufacturer: syz
[  228.443812][   T46] usb 5-1: SerialNumber: syz
[  228.463282][   T46] usb 5-1: config 0 descriptor??
[  228.633238][T11025] rust_binder: 482: no such ref 0
[  228.689851][   T46] usb 5-1: USB disconnect, device number 9
[  228.998012][T11046] netlink: 'syz.1.3609': attribute type 25 has an invalid length.
[  229.027176][T11051] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3606'.
[  229.056339][T11061] rust_binder: Write failure EINVAL in pid:496
[  229.079877][  T332] usb 4-1: new full-speed USB device number 34 using dummy_hcd
[  229.113550][T11072] netlink: 188 bytes leftover after parsing attributes in process `syz.2.3618'.
[  229.150559][T11082] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3621'.
[  229.262513][  T332] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  229.266751][T11094] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  229.272844][  T332] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3
[  229.274265][T11094] rust_binder: Failed to allocate buffer. len:224, is_oneway:true
[  229.281074][  T332] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  229.311823][  T332] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  229.321616][T11099] rust_binder: Failed to allocate buffer. len:1160, is_oneway:true
[  229.326876][  T332] usb 4-1: Product: syz
[  229.343975][  T332] usb 4-1: Manufacturer: syz
[  229.348786][  T332] usb 4-1: SerialNumber: syz
[  229.456168][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.465786][   T36] audit: type=1400 audit(2000000389.521:39790): avc:  denied  { mounton } for  pid=11101 comm="syz.2.3629" path="/dev/binderfs/binder1" dev="binder" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1
[  229.472535][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.490616][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.510007][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.510064][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.524964][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.525011][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.539817][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.539865][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.554719][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.554763][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.569269][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.569350][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.584024][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.584092][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.601623][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.601676][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.616376][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.616457][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.631384][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.631435][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.646010][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.646062][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.660549][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.660598][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.675333][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.675386][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.690161][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.690214][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.704770][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.704823][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.719487][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.719540][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.734015][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.734074][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.748565][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.748620][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.763128][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.763180][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.777582][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.777633][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.792022][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.792086][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.804174][T11033] 9pnet_fd: Insufficient options for proto=fd
[  229.809853][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.812711][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.814596][  T332] usb 4-1: cannot find UAC_HEADER
[  229.819765][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.833113][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.848008][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.848403][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.863665][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.864338][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.865493][  T332] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22
[  229.871091][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.880765][  T332] usb 4-1: USB disconnect, device number 34
[  229.890512][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.900754][ T2293] udevd[2293]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory
[  229.908785][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.929386][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.931591][T11127] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:521
[  229.935832][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.947262][T11127] No source specified
[  229.953373][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.971871][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.972094][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  229.985417][T11130] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:523
[  229.986749][T11129] rust_binder: Error while translating object.
[  229.987025][T11110] rust_binder: Write failure EINVAL in pid:175
[  229.996238][T11129] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF }
[  230.002167][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  230.008985][T11129] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:523
[  230.017668][T11110] rust_binder: Write failure EINVAL in pid:175
[  230.035807][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  230.050793][T11110] rust_binder: Write failure EINVAL in pid:175
[  230.050840][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  230.065383][T11110] rust_binder: Write failure EINVAL in pid:175
[  230.065430][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  230.080354][T11110] rust_binder: Write failure EINVAL in pid:175
[  230.080405][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  230.095095][T11110] rust_binder: Write failure EINVAL in pid:175
[  230.095146][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  230.112247][T11139] rust_binder: Error while translating object.
[  230.112297][T11139] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF }
[  230.117385][T11110] rust_binder: Write failure EINVAL in pid:175
[  230.118555][T11139] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:533
[  230.129490][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  230.151855][T11110] rust_binder: Write failure EINVAL in pid:175
[  230.151905][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  230.166514][T11110] rust_binder: Write failure EINVAL in pid:175
[  230.166564][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  230.181108][T11110] rust_binder: Write failure EINVAL in pid:175
[  230.181160][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  230.195564][T11110] rust_binder: Write failure EINVAL in pid:175
[  230.195609][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  230.213007][T11110] rust_binder: Write failure EINVAL in pid:175
[  230.213058][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  230.247054][T11110] rust_binder: Write failure EINVAL in pid:175
[  230.247106][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  230.262451][T11110] rust_binder: Write failure EINVAL in pid:175
[  230.262502][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  230.277781][T11110] rust_binder: Write failure EINVAL in pid:175
[  230.277827][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  230.292705][T11110] rust_binder: Write failure EINVAL in pid:175
[  230.292751][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  230.310781][T11110] rust_binder: Write failure EINVAL in pid:175
[  230.310829][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  230.325499][T11110] rust_binder: Write failure EINVAL in pid:175
[  230.325546][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  230.341465][T11110] rust_binder: Write failure EINVAL in pid:175
[  230.341511][T11110] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  230.358605][T11110] rust_binder: Write failure EINVAL in pid:175
[  230.380409][T11156] binder: Bad value for 'max'
[  230.466984][   T36] audit: type=1400 audit(2000000390.459:39791): avc:  denied  { map } for  pid=11161 comm="syz.4.3648" path="/dev/usbmon0" dev="devtmpfs" ino=89 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1
[  230.715002][T11167] rust_binder: Error in use_page_slow: ESRCH
[  230.715034][T11167] rust_binder: use_range failure ESRCH
[  230.721524][T11167] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false
[  230.727094][T11167] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH }
[  230.735538][T11167] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:543
[  230.753297][    T9] usb 5-1: new high-speed USB device number 10 using dummy_hcd
[  230.814165][T11173] rust_binder: Error while translating object.
[  230.814209][T11173] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  230.820516][T11173] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:546
[  230.885896][   T36] audit: type=1400 audit(2000000390.863:39792): avc:  denied  { remount } for  pid=11179 comm="syz.2.3654" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[  230.925069][    T9] usb 5-1: device descriptor read/64, error -71
[  231.179701][    T9] usb 5-1: device descriptor read/64, error -71
[  231.417009][   T36] audit: type=1400 audit(2000000391.360:39793): avc:  denied  { mounton } for  pid=11189 comm="syz.3.3658" path="/bus" dev="ramfs" ino=51701 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1
[  231.417100][T11190] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore
[  231.447913][    T9] usb 5-1: new high-speed USB device number 11 using dummy_hcd
[  231.448560][T11190] overlayfs: missing 'lowerdir'
[  231.463386][T11190] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  231.463444][T11190] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:307
[  231.508042][   T36] audit: type=1107 audit(2000000391.435:39794): pid=11198 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='e§rÖ¿uÉ�ú!a‚3àžéÛÝfŠ°�@Ñóm–‡Ú¹#Í^–ãß@çãíòPPL•ÜªÌe
Ë಼ÒGå&E¼¼f0¬Ód
¿-$>ýXÍÂ-'
[  231.595359][    T9] usb 5-1: device descriptor read/64, error -71
[  231.851209][    T9] usb 5-1: device descriptor read/64, error -71
[  231.978661][    T9] usb usb5-port1: attempt power cycle
[  232.341508][    T9] usb 5-1: new high-speed USB device number 12 using dummy_hcd
[  232.363794][    T9] usb 5-1: device descriptor read/8, error -71
[  232.502449][    T9] usb 5-1: device descriptor read/8, error -71
[  232.757141][    T9] usb 5-1: new high-speed USB device number 13 using dummy_hcd
[  232.772565][T11232] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1
[  232.779785][T11232] rust_binder: 567: no such ref 1
[  232.780947][    T9] usb 5-1: device descriptor read/8, error -71
[  232.784954][T11232] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:567
[  232.925905][T11236] overlayfs: missing 'lowerdir'
[  232.939353][    T9] usb 5-1: device descriptor read/8, error -71
[  233.043884][T11251] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3679'.
[  233.056287][    T9] usb usb5-port1: unable to enumerate USB device
[  233.079511][T11254] rust_binder: Write failure EFAULT in pid:576
[  233.103903][   T36] audit: type=1400 audit(2000000392.936:39795): avc:  denied  { setattr } for  pid=11263 comm="syz.2.3683" name="loop7" dev="devtmpfs" ino=56 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  233.492594][  T332] usb 3-1: new high-speed USB device number 37 using dummy_hcd
[  233.652473][  T332] usb 3-1: Using ep0 maxpacket: 8
[  233.664353][  T332] usb 3-1: config 179 has an invalid interface number: 65 but max is 0
[  233.672895][  T332] usb 3-1: config 179 has no interface number 0
[  233.679320][  T332] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9
[  233.691329][  T332] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024
[  233.703117][  T332] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0
[  233.713398][  T332] usb 3-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23
[  233.727966][  T332] usb 3-1: config 179 interface 65 has no altsetting 0
[  233.734897][  T332] usb 3-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00
[  233.744018][  T332] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  233.772132][T11290] rust_binder: Failed to allocate buffer. len:4232, is_oneway:false
[  233.786354][T11293] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  233.794721][T11293] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM }
[  233.801181][T11293] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:188
[  233.838485][T11297] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  233.849143][T11297] overlayfs: failed to resolve './file0': -2
[  233.849192][T11298] rust_binder: Failed to allocate buffer. len:152, is_oneway:false
[  233.934312][T11302] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11302 comm=syz.4.3696
[  233.955138][T11302] rust_binder: 196: no such ref 1
[  233.975540][    T9] usb 3-1: USB disconnect, device number 37
[  234.043214][   T36] audit: type=1400 audit(2000000393.827:39796): avc:  granted  { setsecparam } for  pid=11312 comm="syz.4.3700" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security
[  234.149106][T11323] rust_binder: Write failure EFAULT in pid:207
[  234.409258][  T372] usb 5-1: new full-speed USB device number 14 using dummy_hcd
[  234.570301][  T414] Bluetooth: hci0: Frame reassembly failed (-84)
[  234.576808][  T414] Bluetooth: hci0: received HCILL_GO_TO_SLEEP_ACK in state 0
[  234.586908][  T372] usb 5-1: unable to get BOS descriptor or descriptor too short
[  234.596840][  T372] usb 5-1: not running at top speed; connect to a high speed hub
[  234.606171][  T372] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  234.616712][  T372] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3
[  234.627837][  T372] usb 5-1: string descriptor 0 read error: -22
[  234.634192][  T372] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  234.643337][  T372] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  234.654911][  T372] usb 5-1: 0:2 : does not exist
[  234.694119][T11339] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3709'.
[  234.868649][   T36] audit: type=1400 audit(2000000394.597:39797): avc:  denied  { setcurrent } for  pid=11327 comm="syz.4.3705" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[  235.362548][T11328] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3705'.
[  235.484499][T11372] overlayfs: failed to clone upperpath
[  235.800486][T11393] netlink: 'syz.1.3726': attribute type 4 has an invalid length.
[  235.808344][T11393] netlink: 3657 bytes leftover after parsing attributes in process `syz.1.3726'.
[  236.004614][   T36] audit: type=1400 audit(2000000395.657:39798): avc:  denied  { map } for  pid=11405 comm="syz.1.3731" path="socket:[52422]" dev="sockfs" ino=52422 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1
[  236.242871][T11328] /dev/rnullb0: Can't open blockdev
[  236.256847][  T372] usb 5-1: 5:0: failed to get current value for ch 0 (-22)
[  236.268404][  T372] usb 5-1: 5:0: cannot get min/max values for control 3 (id 5)
[  236.287997][  T372] usb 5-1: 5:0: failed to get current value for ch 1 (-22)
[  236.307072][  T372] usb 5-1: USB disconnect, device number 14
[  236.732953][   T54] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  236.839437][T11448] netlink: 'syz.2.3746': attribute type 46 has an invalid length.
[  236.851603][T11448] rust_binder: Write failure EFAULT in pid:601
[  236.879402][T11456] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  236.885846][T11456] rust_binder: inc_ref_done called when no active inc_refs
[  236.948312][T11463] rust_binder: Write failure EFAULT in pid:606
[  237.086724][T11465] rust_binder: Error while translating object.
[  237.092991][T11465] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  237.099647][T11465] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:608
[  237.180509][  T331] usb 5-1: new full-speed USB device number 15 using dummy_hcd
[  237.368169][T11493] overlayfs: missing 'lowerdir'
[  237.386867][  T331] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  237.403695][  T331] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3
[  237.417820][  T331] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  237.431408][  T331] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  237.439964][  T331] usb 5-1: Product: syz
[  237.444252][  T331] usb 5-1: Manufacturer: syz
[  237.449637][  T331] usb 5-1: SerialNumber: syz
[  237.573391][T11509] loop2: detected capacity change from 0 to 7
[  237.580183][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  237.589409][    C1] Buffer I/O error on dev loop2, logical block 0, async page read
[  237.598160][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  237.607361][    C1] Buffer I/O error on dev loop2, logical block 0, async page read
[  237.615241][T11509]  loop2: unable to read partition table
[  237.621114][T11509] loop_reread_partitions: partition scan of loop2 (úùƒå¡™‰ü�¾CêjÌ–ã¢P=ý?ã}X‹ºÐ	œëÜ%õ«`ÉæÖ€ù…ˆ{í©Ö�˜Èµ4FLQkÝŠ) failed (rc=-5)
[  237.628582][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  237.636619][T11509] overlayfs: conflicting options: verity=require,redirect_dir=follow
[  237.643789][    C1] Buffer I/O error on dev loop2, logical block 0, async page read
[  237.660162][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  237.669350][    C1] Buffer I/O error on dev loop2, logical block 0, async page read
[  237.677709][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  237.686905][    C1] Buffer I/O error on dev loop2, logical block 0, async page read
[  237.695367][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  237.704677][    C1] Buffer I/O error on dev loop2, logical block 0, async page read
[  237.712886][    C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  237.722117][    C0] Buffer I/O error on dev loop2, logical block 0, async page read
[  237.879920][T11515] fuse: Unknown parameter 'rootmo00000040000'
[  237.900986][T11517] overlayfs: failed to clone upperpath
[  238.160376][T11533] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11533 comm=syz.1.3776
[  238.174838][   T36] audit: type=1326 audit(2000000397.702:39799): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11532 comm="syz.1.3776" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe42018eec9 code=0x0
[  238.745741][T11550] rust_binder: Error while translating object.
[  238.745795][T11550] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  238.752282][T11550] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:641
[  238.806868][T11565] rust_binder: Write failure EFAULT in pid:646
[  238.831359][  T431] Bluetooth: hci0: Frame reassembly failed (-84)
[  238.844304][T11567] Bluetooth: hci0: received HCILL_GO_TO_SLEEP_ACK in state 2
[  238.852623][T11567] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM }
[  238.852655][T11567] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:648
[  239.060127][   T36] audit: type=1400 audit(2000000398.528:39800): avc:  denied  { read } for  pid=11568 comm="syz.1.3789" name="/" dev="configfs" ino=2500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  239.091815][   T36] audit: type=1400 audit(2000000398.528:39801): avc:  denied  { open } for  pid=11568 comm="syz.1.3789" path="/" dev="configfs" ino=2500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  239.148267][T11575] fuse: Bad value for 'fd'
[  239.178202][T11577] fuse: Bad value for 'fd'
[  240.137100][  T331] usb 5-1: cannot find UAC_HEADER
[  240.145451][T11601] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  240.158209][  T331] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22
[  240.162470][T11603] binder: Unknown parameter 'defcontext01777777777777777777777'
[  240.166198][  T331] usb 5-1: USB disconnect, device number 15
[  240.196926][ T2293] udevd[2293]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory
[  240.198160][T11605] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  240.214709][T11605] rust_binder: Failed to allocate buffer. len:1192, is_oneway:false
[  240.233886][T11607] rust_binder: 231: no such ref 0
[  240.431669][T11620] overlayfs: missing 'lowerdir'
[  240.446241][T11622] rust_binder: Write failure EFAULT in pid:236
[  240.467694][T11624] SELinux:  policydb version 678391352 does not match my version range 15-33
[  240.483044][T11624] SELinux: failed to load policy
[  240.739428][T11645] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3818'.
[  240.749671][T11655] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=60 sclass=netlink_route_socket pid=11655 comm=syz.1.3821
[  240.765245][T11655] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11655 comm=syz.1.3821
[  240.890501][T11665] binder: Unknown parameter '0¯cfz±�A§2+Ff©P&�ôh”``ªUžûFªé`~~¤šÓ×sNÅ(ÒkðªeÝüœ6†Jûiu?*§©ˆNˆ>ƒÆ¯£(�bª vWHãvvR"Jÿ*ËKß/�ÿ"C#cOŪ+刈s†ÁZx-Ò'
[  240.920109][T11667] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22
[  240.996320][   T54] Bluetooth: hci0: command 0x1003 tx timeout
[  240.996320][  T590] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  241.918082][T11690] veth1: entered allmulticast mode
[  241.926886][T11689] veth1: left allmulticast mode
[  241.943373][T11694] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3838'.
[  241.953082][T11694] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3838'.
[  241.963349][T11695] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3838'.
[  241.994580][T11692] overlayfs: missing 'lowerdir'
[  242.074006][T11702] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=123 sclass=netlink_route_socket pid=11702 comm=syz.3.3840
[  242.141710][T11716] overlayfs: failed to clone upperpath
[  242.148442][T11716] tmpfs: Unknown parameter 'ÿÿÿÿÿÿÿÿëHÀ§óŠÎF°¥½62´Z¿4qïë/ãôNè	BmX™YnŸ¨Ê#ú¼À—>Üß—QaÍ:òþÞd‡.ÐÌÑ©xžOV 9Ì:° äðµù…‘دxQMÖ©�mÊ>çÐÏQŸc-âÅÖJƒ�Ñ‚nîhµw£ÒÜ…XÖ	v'
[  242.170505][T11716] fuse: Bad value for 'fd'
[  242.184269][T11718] bridge0: port 3(veth1_to_team) entered blocking state
[  242.191383][T11718] bridge0: port 3(veth1_to_team) entered disabled state
[  242.202024][T11718] veth1_to_team: entered allmulticast mode
[  242.208760][T11718] veth1_to_team: entered promiscuous mode
[  242.471929][T11742] overlayfs: missing 'lowerdir'
[  242.980531][T11745] /dev/rnullb0: Can't open blockdev
[  243.165643][T11760] rust_binder: validate_parent_fixup: fixup_min_offset=57, parent_offset=37
[  243.165686][T11760] rust_binder: Error while translating object.
[  243.174659][T11760] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  243.180921][T11760] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:668
[  243.257256][   T36] audit: type=1400 audit(2000000402.468:39802): avc:  denied  { connect } for  pid=11773 comm="syz.3.3862" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[  243.297683][   T36] audit: type=1326 audit(2000000402.496:39803): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11775 comm="syz.3.3863" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fba3858eec9 code=0x0
[  243.385756][T11781] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[  243.458506][  T330] usb 3-1: new high-speed USB device number 38 using dummy_hcd
[  243.618385][  T330] usb 3-1: Using ep0 maxpacket: 16
[  243.624726][  T330] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87
[  243.636346][  T330] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7
[  243.648813][  T330] usb 3-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89
[  243.657934][  T330] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  243.665975][  T330] usb 3-1: Product: syz
[  243.670145][  T330] usb 3-1: Manufacturer: syz
[  243.674769][  T330] usb 3-1: SerialNumber: syz
[  243.680076][  T330] usb 3-1: config 0 descriptor??
[  243.899736][T11763] futex_wake_op: syz.2.3859 tries to shift op by 144; fix this program
[  243.913209][  T330] usb 3-1: USB disconnect, device number 38
[  244.240326][T11792] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:279
[  244.503900][T11808] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  244.521743][T11808] rust_binder: Write failure EINVAL in pid:672
[  244.559655][T11815] /dev/rnullb0: Can't open blockdev
[  244.584273][T11819] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  244.584509][T11820] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  244.692794][T11827] overlayfs: missing 'lowerdir'
[  244.719576][T11830] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:301
[  244.719654][T11831] rust_binder: 301: no such ref 2
[  244.734581][T11831] rust_binder: 301: no such ref 1
[  244.740348][T11830] rust_binder: Failure when writing BR_NOOP at beginning of buffer.
[  244.740370][T11830] rust_binder: Read failure Err(EFAULT) in pid:301
[  244.762030][T11835] netlink: 'syz.4.3884': attribute type 4 has an invalid length.
[  244.776824][T11835] /dev/rnullb0: Can't open blockdev
[  244.811096][T11837] kvm: MWAIT instruction emulated as NOP!
[  245.005859][    T9] usb 3-1: new high-speed USB device number 39 using dummy_hcd
[  245.159182][T11880] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3897'.
[  245.174800][    T9] usb 3-1: Using ep0 maxpacket: 16
[  245.181276][    T9] usb 3-1: config 1 has an invalid descriptor of length 102, skipping remainder of the config
[  245.191779][    T9] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3
[  245.203637][    T9] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  245.212857][    T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  245.221021][    T9] usb 3-1: Product: syz
[  245.225234][    T9] usb 3-1: Manufacturer: syz
[  245.229903][    T9] usb 3-1: SerialNumber: syz
[  245.313111][  T331] usb 5-1: new full-speed USB device number 16 using dummy_hcd
[  245.453225][    T9] usb 3-1: 0:2 : does not exist
[  245.460525][    T9] usb 3-1: 5:0: cannot get min/max values for control 4 (id 5)
[  245.470646][    T9] usb 3-1: 5:0: cannot get min/max values for control 5 (id 5)
[  245.479836][  T331] usb 5-1: not running at top speed; connect to a high speed hub
[  245.488797][  T331] usb 5-1: config 1 interface 0 altsetting 8 endpoint 0x2 has invalid maxpacket 512, setting to 64
[  245.499832][  T331] usb 5-1: config 1 interface 0 has no altsetting 0
[  245.506791][    T9] usb 3-1: 5:0: cannot get min/max values for control 5 (id 5)
[  245.521999][  T331] usb 5-1: New USB device found, idVendor=056a, idProduct=0015, bcdDevice= 0.40
[  245.531289][  T331] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  245.539673][    T9] usb 3-1: 5:0: failed to get current value for ch 1 (-22)
[  245.547024][  T331] usb 5-1: Product: syz
[  245.551504][  T331] usb 5-1: Manufacturer: syz
[  245.556310][  T331] usb 5-1: SerialNumber: syz
[  245.564694][    T9] usb 3-1: USB disconnect, device number 39
[  245.571009][T11863] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22
[  245.585022][ T2293] udevd[2293]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory
[  246.009595][  T331] usbhid 5-1:1.0: can't add hid device: -71
[  246.020127][  T331] usbhid 5-1:1.0: probe with driver usbhid failed with error -71
[  246.030013][  T331] usb 5-1: USB disconnect, device number 16
[  246.362708][T11942] netlink: 'syz.1.3919': attribute type 27 has an invalid length.
[  246.440918][T11960] 9pnet_fd: Insufficient options for proto=fd
[  246.723505][T11972] rust_binder: Write failure EFAULT in pid:317
[  247.039803][  T330] usb 5-1: new full-speed USB device number 17 using dummy_hcd
[  247.211444][  T330] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64
[  247.222731][  T330] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4
[  247.235657][  T330] usb 5-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00
[  247.244943][  T330] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  247.253804][  T330] usb 5-1: config 0 descriptor??
[  247.259036][T11988] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22
[  247.267189][  T330] usbhid 5-1:0.0: can't add hid device: -22
[  247.273204][  T330] usbhid 5-1:0.0: probe with driver usbhid failed with error -22
[  247.308401][T11990] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3934'.
[  247.924472][    T9] usb 3-1: new high-speed USB device number 40 using dummy_hcd
[  248.064993][    T9] usb 3-1: device descriptor read/64, error -71
[  248.329550][    T9] usb 3-1: device descriptor read/64, error -71
[  248.585318][    T9] usb 3-1: new high-speed USB device number 41 using dummy_hcd
[  248.723876][    T9] usb 3-1: device descriptor read/64, error -71
[  248.839905][T12037] overlayfs: missing 'lowerdir'
[  248.979694][    T9] usb 3-1: device descriptor read/64, error -71
[  249.036023][   T36] audit: type=1400 audit(2000000407.891:39804): avc:  denied  { create } for  pid=12052 comm="syz.3.3954" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1
[  249.097177][    T9] usb usb3-port1: attempt power cycle
[  249.104079][T12060] 9pnet: Could not find request transport: fe
[  249.111168][T12060] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3957'.
[  249.120225][T12060] netlink: 43 bytes leftover after parsing attributes in process `syz.3.3957'.
[  249.129292][T12060] netlink: 'syz.3.3957': attribute type 6 has an invalid length.
[  249.137151][T12060] netlink: 'syz.3.3957': attribute type 5 has an invalid length.
[  249.144981][T12060] netlink: 43 bytes leftover after parsing attributes in process `syz.3.3957'.
[  249.155330][T12060] 9pnet: Could not find request transport: fe
[  249.201179][T12072] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3960'.
[  249.459342][    T9] usb 3-1: new high-speed USB device number 42 using dummy_hcd
[  249.481677][    T9] usb 3-1: device descriptor read/8, error -71
[  249.494270][T12090] netlink: 'syz.1.3965': attribute type 12 has an invalid length.
[  249.503937][T12089] 9pnet: p9_errstr2errno: server reported unknown error 1844674407
[  249.575194][T12106] cgroup: Unknown subsys name 'measure'
[  249.620224][    T9] usb 3-1: device descriptor read/8, error -71
[  249.875068][    T9] usb 3-1: new high-speed USB device number 43 using dummy_hcd
[  249.897394][    T9] usb 3-1: device descriptor read/8, error -71
[  249.987484][  T332] usb 5-1: USB disconnect, device number 17
[  250.046694][    T9] usb 3-1: device descriptor read/8, error -71
[  250.089539][T12072] 9pnet_fd: p9_fd_create_tcp (12072): problem connecting socket to 127.0.0.1
[  250.165573][    T9] usb usb3-port1: unable to enumerate USB device
[  250.344018][  T332] usb 5-1: new high-speed USB device number 18 using dummy_hcd
[  250.514526][  T332] usb 5-1: Using ep0 maxpacket: 16
[  250.520922][  T332] usb 5-1: config 1 interface 0 altsetting 255 endpoint 0x1 has invalid wMaxPacketSize 0
[  250.531921][  T332] usb 5-1: config 1 interface 0 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 0
[  250.543201][  T332] usb 5-1: config 1 interface 0 altsetting 255 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  250.561429][  T332] usb 5-1: config 1 interface 0 has no altsetting 0
[  250.569683][  T332] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40
[  250.578981][  T332] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  250.587016][  T332] usb 5-1: Product: syz
[  250.591270][  T332] usb 5-1: Manufacturer: syz
[  250.595890][  T332] usb 5-1: SerialNumber: syz
[  250.786494][   T36] audit: type=1400 audit(2000000409.533:39805): avc:  denied  { shutdown } for  pid=12174 comm="syz.3.3994" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1
[  250.791872][T12175] veth0_virt_wifi: mtu less than device minimum
[  250.816553][T12175] netlink: 'syz.3.3994': attribute type 19 has an invalid length.
[  250.825586][  T332] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 18 if 0 alt 255 proto 1 vid 0x0525 pid 0xA4A8
[  250.831099][T12175] netlink: 5 bytes leftover after parsing attributes in process `syz.3.3994'.
[  250.849611][   T36] audit: type=1326 audit(2000000409.589:39806): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12174 comm="syz.3.3994" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fba3858eec9 code=0x7ffc0000
[  250.873927][   T36] audit: type=1326 audit(2000000409.589:39807): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12174 comm="syz.3.3994" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7fba3858eec9 code=0x7ffc0000
[  250.899192][   T36] audit: type=1326 audit(2000000409.589:39808): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12174 comm="syz.3.3994" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fba3858eec9 code=0x7ffc0000
[  250.923121][   T36] audit: type=1326 audit(2000000409.589:39809): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12174 comm="syz.3.3994" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fba3858eec9 code=0x7ffc0000
[  250.929211][T12182] netlink: 'syz.1.3997': attribute type 27 has an invalid length.
[  250.946876][   T36] audit: type=1326 audit(2000000409.589:39810): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12174 comm="syz.3.3994" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fba385c1785 code=0x7ffc0000
[  250.956077][T12182] 0ªî{X¹¦: left allmulticast mode
[  250.978673][   T36] audit: type=1326 audit(2000000409.589:39811): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12174 comm="syz.3.3994" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fba3858eec9 code=0x7ffc0000
[  251.010047][   T36] audit: type=1326 audit(2000000409.721:39812): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12174 comm="syz.3.3994" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fba385c1785 code=0x7ffc0000
[  251.098276][   T36] audit: type=1326 audit(2000000409.814:39813): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12174 comm="syz.3.3994" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fba385c1785 code=0x7ffc0000
[  251.237512][T12199] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=12199 comm=syz.1.4003
[  251.324634][    T9] usb 3-1: new full-speed USB device number 44 using dummy_hcd
[  251.432265][T12204] overlayfs: missing 'lowerdir'
[  251.483207][T12212] netlink: 'syz.3.4007': attribute type 46 has an invalid length.
[  251.496037][T12201] bridge0: port 1(bridge_slave_0) entered blocking state
[  251.504446][    T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64
[  251.526279][T12201] bridge0: port 1(bridge_slave_0) entered disabled state
[  251.533743][    T9] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4
[  251.546777][T12201] bridge_slave_0: entered allmulticast mode
[  251.553275][T12201] bridge_slave_0: entered promiscuous mode
[  251.559534][    T9] usb 3-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00
[  251.568615][    T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  251.576956][T12201] bridge0: port 2(bridge_slave_1) entered blocking state
[  251.578568][    T9] usb 3-1: config 0 descriptor??
[  251.589252][T12201] bridge0: port 2(bridge_slave_1) entered disabled state
[  251.596498][T12180] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22
[  251.604748][    T9] usbhid 3-1:0.0: can't add hid device: -22
[  251.610866][    T9] usbhid 3-1:0.0: probe with driver usbhid failed with error -22
[  251.618759][T12201] bridge_slave_1: entered allmulticast mode
[  251.625302][T12201] bridge_slave_1: entered promiscuous mode
[  251.685753][T12201] bridge0: port 2(bridge_slave_1) entered blocking state
[  251.692859][T12201] bridge0: port 2(bridge_slave_1) entered forwarding state
[  251.700423][T12201] bridge0: port 1(bridge_slave_0) entered blocking state
[  251.707515][T12201] bridge0: port 1(bridge_slave_0) entered forwarding state
[  251.729464][  T431] bridge0: port 1(bridge_slave_0) entered disabled state
[  251.737231][  T431] bridge0: port 2(bridge_slave_1) entered disabled state
[  251.747599][  T431] bridge0: port 1(bridge_slave_0) entered blocking state
[  251.754706][  T431] bridge0: port 1(bridge_slave_0) entered forwarding state
[  251.764561][  T414] bridge0: port 2(bridge_slave_1) entered blocking state
[  251.771642][  T414] bridge0: port 2(bridge_slave_1) entered forwarding state
[  251.799028][T12201] veth0_vlan: entered promiscuous mode
[  251.810690][T12201] veth1_macvtap: entered promiscuous mode
[  251.831944][T12180] netlink: 9 bytes leftover after parsing attributes in process `syz.2.3996'.
[  251.841252][T12180] z00ªX¹¦: renamed from gretap0 (while UP)
[  251.848240][T12180] z00ªX¹¦: entered allmulticast mode
[  251.855872][T12180] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  251.866158][T12180] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  251.954702][    T9] usb 3-1: USB disconnect, device number 44
[  252.252007][  T332] usb 2-1: new full-speed USB device number 17 using dummy_hcd
[  252.413123][  T332] usb 2-1: config 0 has an invalid interface number: 46 but max is 0
[  252.421383][  T332] usb 2-1: config 0 has no interface number 0
[  252.428140][  T332] usb 2-1: config 0 interface 46 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64
[  252.440512][  T332] usb 2-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01
[  252.449634][  T332] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  252.458020][  T332] usb 2-1: Product: syz
[  252.462192][  T332] usb 2-1: Manufacturer: syz
[  252.466890][  T332] usb 2-1: SerialNumber: syz
[  252.472172][  T332] usb 2-1: config 0 descriptor??
[  252.477648][T12245] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22
[  252.485602][  T332] ums-karma 2-1:0.46: USB Mass Storage device detected
[  252.572748][  T332] ums-karma 2-1:0.46: probe with driver ums-karma failed with error -5
[  252.582187][T12257] rust_binder: Write failure EFAULT in pid:726
[  253.230258][T10737] usb 5-1: USB disconnect, device number 18
[  253.244319][T10737] usblp0: removed
[  253.258823][T12275] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  253.289815][T12275] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false
[  253.380897][T12279] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  253.404680][T12284] netlink: 'syz.4.4027': attribute type 2 has an invalid length.
[  253.433353][T12284] __vm_enough_memory: pid: 12284, comm: syz.4.4027, bytes: 18014402804453376 not enough memory for the allocation
[  253.473063][T12295] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4032'.
[  253.482655][T12295] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4032'.
[  253.507389][T12304] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 1
[  253.722814][  T372] usb 3-1: new high-speed USB device number 45 using dummy_hcd
[  253.901606][  T372] usb 3-1: config 0 has an invalid interface number: 213 but max is 0
[  253.909908][  T372] usb 3-1: config 0 has no interface number 0
[  253.917611][  T372] usb 3-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=92.db
[  253.926912][  T372] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  253.934997][  T372] usb 3-1: Product: syz
[  253.939221][  T372] usb 3-1: Manufacturer: syz
[  253.943842][  T372] usb 3-1: SerialNumber: syz
[  253.949244][  T372] usb 3-1: config 0 descriptor??
[  254.022075][T12320] /dev/md0: Can't lookup blockdev
[  254.165216][T12327] /dev/rnullb0: Can't open blockdev
[  254.170922][T12327] overlay: Unknown parameter 'pcr'
[  254.172269][T12296] binder: Unknown parameter '0'
[  254.183196][T12328] /dev/rnullb0: Can't open blockdev
[  254.191866][  T372] usb 3-1: USB disconnect, device number 45
[  254.209005][T12332] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  254.209405][T12332] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false
[  254.380511][   T36] kauditd_printk_skb: 13 callbacks suppressed
[  254.380544][   T36] audit: type=1326 audit(2000000412.901:39827): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12300 comm="syz.3.4034" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fba3858eec9 code=0x7fc00000
[  254.425101][   T36] audit: type=1326 audit(2000000412.901:39828): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12300 comm="syz.3.4034" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fba3858eec9 code=0x7fc00000
[  254.808205][T12353] 9pnet_fd: Insufficient options for proto=fd
[  255.231389][  T372] usb 2-1: USB disconnect, device number 17
[  255.276146][   T36] audit: type=1400 audit(2000000413.736:39829): avc:  denied  { map } for  pid=12366 comm="syz.1.4056" path="net:[4026532436]" dev="nsfs" ino=4026532436 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[  255.300932][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.300963][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.307671][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.314272][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.320873][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.327748][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.334284][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.340776][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.347384][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.353916][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.360359][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.366849][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.373306][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.379787][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.386358][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.392794][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.399350][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.405805][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.412349][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.418840][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.425282][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.431750][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.438208][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.444704][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.451178][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.457646][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.464125][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.470583][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.477089][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.483684][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.490128][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.496661][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.503353][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.509821][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.516311][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.522793][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.529306][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.536937][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.543392][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.550770][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.557283][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.563733][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.570210][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.576660][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.583211][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.589704][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.596135][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.602606][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.609059][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.615532][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.622008][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.628441][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.634903][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.641464][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.647920][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.659661][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.666367][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.672834][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.679614][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.686606][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.693187][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.699758][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.706569][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.713149][T12373] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  255.939858][   T62] usb 3-1: new high-speed USB device number 46 using dummy_hcd
[  256.025116][T10737] usb 2-1: new low-speed USB device number 18 using dummy_hcd
[  256.113299][   T62] usb 3-1: config 0 has an invalid interface number: 1 but max is 0
[  256.121411][   T62] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  256.131570][   T62] usb 3-1: config 0 has no interface number 0
[  256.137771][   T62] usb 3-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00
[  256.146867][   T62] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  256.155959][   T62] usb 3-1: config 0 descriptor??
[  256.186340][T10737] usb 2-1: No LPM exit latency info found, disabling LPM.
[  256.194299][T10737] usb 2-1: config 1 interface 0 altsetting 3 endpoint 0x81 has invalid maxpacket 1024, setting to 8
[  256.205616][T10737] usb 2-1: config 1 interface 0 altsetting 3 has 2 endpoint descriptors, different from the interface descriptor's value: 1
[  256.218934][T10737] usb 2-1: config 1 interface 0 has no altsetting 0
[  257.128288][T12385] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=12385 comm=syz.2.4059
[  257.430408][T12387] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  257.441601][T12387] rust_binder: Failed to allocate buffer. len:1168, is_oneway:true
[  257.783931][   T62] usb 5-1: new high-speed USB device number 19 using dummy_hcd
[  257.954329][   T62] usb 5-1: Using ep0 maxpacket: 32
[  257.960751][   T62] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  257.971736][   T62] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  257.981616][   T62] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40
[  257.990728][   T62] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  258.000729][   T62] usb 5-1: config 0 descriptor??
[  258.006853][   T62] hub 5-1:0.0: USB hub found
[  258.220078][   T62] hub 5-1:0.0: 1 port detected
[  258.653382][   T62] usb 5-1: USB disconnect, device number 19
[  258.896645][  T330] usb 3-1: USB disconnect, device number 46
[  258.910808][T12403] rust_binder: Failure when writing BR_NOOP at beginning of buffer.
[  258.910835][T12403] rust_binder: Read failure Err(EFAULT) in pid:743
[  258.945719][T12410] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  258.952344][T12410] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  258.959317][T12410] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  258.980616][T10737] usb 2-1: New USB device found, idVendor=172f, idProduct=0502, bcdDevice= 0.40
[  258.987130][T12415] binder: Bad value for 'defcontext'
[  259.001861][T10737] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  259.018905][T10737] usb 2-1: can't set config #1, error -71
[  259.025569][T10737] usb 2-1: USB disconnect, device number 18
[  259.032144][   T36] audit: type=1400 audit(2000000417.273:39830): avc:  denied  { associate } for  pid=12419 comm="syz.1.4074" name="bus" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1
[  259.232479][T12427] veth0_virt_wifi: entered allmulticast mode
[  259.239517][T12427] veth0_virt_wifi: left allmulticast mode
[  259.403944][T10737] usb 2-1: new full-speed USB device number 19 using dummy_hcd
[  259.564921][T10737] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64
[  259.576043][T10737] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4
[  259.589667][T10737] usb 2-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00
[  259.598958][T10737] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  259.609556][T10737] usb 2-1: config 0 descriptor??
[  259.615033][T12425] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  259.628044][T10737] usbhid 2-1:0.0: can't add hid device: -22
[  259.634067][T10737] usbhid 2-1:0.0: probe with driver usbhid failed with error -22
[  259.641889][  T330] usb 5-1: new high-speed USB device number 20 using dummy_hcd
[  259.769009][T12478] netlink: 'syz.2.4096': attribute type 4 has an invalid length.
[  259.776949][T12478] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4096'.
[  259.798564][T12480] netlink: 'syz.2.4097': attribute type 29 has an invalid length.
[  259.812757][  T330] usb 5-1: Using ep0 maxpacket: 32
[  259.819085][  T330] usb 5-1: config 2 has an invalid interface number: 194 but max is 0
[  259.827780][  T330] usb 5-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config
[  259.837353][    T9] usb 2-1: USB disconnect, device number 19
[  259.838411][  T330] usb 5-1: config 2 has no interface number 0
[  259.850211][  T330] usb 5-1: config 2 interface 194 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 833
[  259.860370][  T330] usb 5-1: config 2 interface 194 altsetting 0 endpoint 0xA has invalid maxpacket 1584, setting to 1024
[  259.871568][  T330] usb 5-1: config 2 interface 194 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4
[  259.884672][  T330] usb 5-1: New USB device found, idVendor=0499, idProduct=1025, bcdDevice=9c.f6
[  259.893758][  T330] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  259.902864][T12452] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22
[  259.910119][T12452] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22
[  260.064748][   T62] usb 3-1: new high-speed USB device number 47 using dummy_hcd
[  260.174030][  T330] usb 5-1: string descriptor 0 read error: -71
[  260.187060][  T330] usb 5-1: USB disconnect, device number 20
[  260.203339][   T62] usb 3-1: device descriptor read/64, error -71
[  260.411896][   T36] audit: type=1400 audit(2000000419.562:39831): avc:  denied  { view } for  pid=12492 comm="syz.1.4101" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1
[  260.440699][   T36] audit: type=1400 audit(2000000419.590:39832): avc:  denied  { mounton } for  pid=12494 comm="syz.1.4102" path="/file0" dev="ramfs" ino=56600 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1
[  260.440709][T12495] fuse: Bad value for 'fd'
[  260.459129][   T62] usb 3-1: device descriptor read/64, error -71
[  260.663400][T12517] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2049 sclass=netlink_route_socket pid=12517 comm=syz.1.4108
[  260.725597][   T62] usb 3-1: new high-speed USB device number 48 using dummy_hcd
[  260.754457][T12526] /dev/rnullb0: Can't open blockdev
[  260.809112][   T36] audit: type=1400 audit(2000000419.928:39833): avc:  denied  { setattr } for  pid=12541 comm="syz.1.4115" name="/" dev="configfs" ino=2500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  260.864516][   T62] usb 3-1: device descriptor read/64, error -71
[  261.002708][    T9] usb 5-1: new high-speed USB device number 21 using dummy_hcd
[  261.087993][  T330] usb 2-1: new high-speed USB device number 20 using dummy_hcd
[  261.119984][   T62] usb 3-1: device descriptor read/64, error -71
[  261.164318][    T9] usb 5-1: config 1 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  261.175314][    T9] usb 5-1: config 1 interface 0 altsetting 4 has 2 endpoint descriptors, different from the interface descriptor's value: 1
[  261.188290][    T9] usb 5-1: config 1 interface 0 has no altsetting 0
[  261.196426][    T9] usb 5-1: New USB device found, idVendor=056a, idProduct=00d1, bcdDevice= 0.40
[  261.205562][    T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  261.213578][    T9] usb 5-1: Product: �
[  261.217796][    T9] usb 5-1: Manufacturer: �丕麗�婯ᑓ�孛㳤垰藇쨂쿺≇刣�৵✬혒꘸ᇴ�Ⓒ⩭郳稖넥�⠮�劶괱첎�៨d矓绺䥼�઴庅�脈㇜歜䇫Ⓥਜꑭ鳎嘴ﮎ�婕氅䡬�蟷�һࢊ੉ꔸ饑틞볯鬒풔�ꇸ
[  261.242353][    T9] usb 5-1: SerialNumber: Є
[  261.247229][   T62] usb usb3-port1: attempt power cycle
[  261.270330][  T330] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  261.280686][  T330] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3
[  261.290539][  T330] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
[  261.299689][  T330] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
[  261.307750][  T330] usb 2-1: SerialNumber: syz
[  261.472293][    T9] usbhid 5-1:1.0: can't add hid device: -71
[  261.478376][    T9] usbhid 5-1:1.0: probe with driver usbhid failed with error -71
[  261.487436][    T9] usb 5-1: USB disconnect, device number 21
[  261.533708][  T330] usb 2-1: USB disconnect, device number 20
[  261.545718][ T2293] udevd[2293]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory
[  261.621086][   T62] usb 3-1: new high-speed USB device number 49 using dummy_hcd
[  261.643483][   T62] usb 3-1: device descriptor read/8, error -71
[  261.680696][T12544] netlink: 'syz.3.4116': attribute type 27 has an invalid length.
[  261.708278][  T431] bridge0: port 3(veth1_to_team) entered blocking state
[  261.715326][  T431] bridge0: port 3(veth1_to_team) entered forwarding state
[  261.781992][   T62] usb 3-1: device descriptor read/8, error -71
[  262.036693][   T62] usb 3-1: new high-speed USB device number 50 using dummy_hcd
[  262.059184][   T62] usb 3-1: device descriptor read/8, error -71
[  262.209462][   T62] usb 3-1: device descriptor read/8, error -71
[  262.324717][   T62] usb usb3-port1: unable to enumerate USB device
[  262.360240][T12584] rust_binder: Write failure EFAULT in pid:415
[  262.633549][   T62] usb 5-1: new high-speed USB device number 22 using dummy_hcd
[  262.805199][   T62] usb 5-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 0
[  262.817863][   T62] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  262.829707][   T62] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 4
[  262.844898][   T62] usb 5-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00
[  262.855602][   T62] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  262.864089][   T62] usb 5-1: Product: syz
[  262.868628][   T62] usb 5-1: Manufacturer: syz
[  262.873346][   T62] usb 5-1: SerialNumber: syz
[  262.890252][   T62] usb 5-1: config 0 descriptor??
[  262.898266][   T62] usb-storage 5-1:0.0: USB Mass Storage device detected
[  262.913292][   T62] usb-storage 5-1:0.0: Quirks match for vid 1908 pid 1315: 20000
[  263.043505][T12594] rust_binder: Failure when writing BR_NOOP at beginning of buffer.
[  263.043533][T12594] rust_binder: Read failure Err(EFAULT) in pid:763
[  263.113121][T12587] loop2: detected capacity change from 0 to 7
[  263.126279][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  263.135496][    C1] Buffer I/O error on dev loop2, logical block 0, async page read
[  263.144234][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  263.153463][    C1] Buffer I/O error on dev loop2, logical block 0, async page read
[  263.161567][T12587]  loop2: unable to read partition table
[  263.168740][T12587] loop_reread_partitions: partition scan of loop2 (úùƒå¡™‰ü�¾CêjÌ–ã¢P=ý?ã}X‹ºÐ	œëÜ%õ«`ÉæÖ€ù…ˆ{í©Ö�˜Èµ4FLQkÝŠ) failed (rc=-5)
[  263.182978][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  263.192366][    C1] Buffer I/O error on dev loop2, logical block 0, async page read
[  263.208568][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  263.218003][    C1] Buffer I/O error on dev loop2, logical block 0, async page read
[  263.232261][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  263.241486][    C1] Buffer I/O error on dev loop2, logical block 0, async page read
[  263.262827][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  263.272028][    C1] Buffer I/O error on dev loop2, logical block 0, async page read
[  263.280379][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  263.289608][    C1] Buffer I/O error on dev loop2, logical block 0, async page read
[  263.297742][    C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  263.306970][    C0] Buffer I/O error on dev loop2, logical block 0, async page read
[  263.328106][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  263.337485][    C1] Buffer I/O error on dev loop2, logical block 0, async page read
[  263.345637][ T7704]  loop2: unable to read partition table
[  263.352044][    C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  263.361250][    C1] Buffer I/O error on dev loop2, logical block 0, async page read
[  263.369591][T12587]  loop2: unable to read partition table
[  263.375448][T12587] loop_reread_partitions: partition scan of loop2 (7´Ó࢕ÀcＦpX]®Mâe‹c!¶¹ZûÌÌè83&²Ž;µ!ù,@~�+Ï�”ÍsÁPŠÉ¶lÔ�) failed (rc=-5)
[  263.391042][   T62] usb 5-1: USB disconnect, device number 22
[  263.417543][T12617] rust_binder: Error while translating object.
[  263.417599][T12617] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  263.421606][T12620] 9pnet: p9_errstr2errno: server reported unknown error ottle.io_service_bytes_recursive
[  263.424607][T12617] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:770
[  263.486985][T12622] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2049 sclass=netlink_route_socket pid=12622 comm=syz.2.4142
[  263.859270][  T330] usb 2-1: new high-speed USB device number 21 using dummy_hcd
[  263.939726][T12633] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  264.030159][  T330] usb 2-1: too many configurations: 244, using maximum allowed: 8
[  264.053535][  T330] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00
[  264.062870][  T330] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  264.070872][  T330] usb 2-1: Product: syz
[  264.075162][  T330] usb 2-1: Manufacturer: syz
[  264.079796][  T330] usb 2-1: SerialNumber: syz
[  264.189740][T10737] usb 5-1: new full-speed USB device number 23 using dummy_hcd
[  264.299819][T12631] rust_binder: Error while translating object.
[  264.299854][T12631] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  264.306073][T12631] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:133
[  264.336219][  T330] rtl8150 2-1:1.0: couldn't reset the device
[  264.351529][  T330] rtl8150 2-1:1.0: probe with driver rtl8150 failed with error -5
[  264.361304][T10737] usb 5-1: not running at top speed; connect to a high speed hub
[  264.369894][T10737] usb 5-1: config 1 interface 0 has no altsetting 0
[  264.377276][  T330] usb 2-1: USB disconnect, device number 21
[  264.388107][T10737] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40
[  264.400773][T10737] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  264.408882][T10737] usb 5-1: Product: syz
[  264.413082][T10737] usb 5-1: Manufacturer: syz
[  264.417729][T10737] usb 5-1: SerialNumber: syz
[  264.441269][T12635] rust_binder: Error while translating object.
[  264.441301][T12635] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM }
[  264.447623][T12635] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:777
[  264.855697][T10737] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 23 if 0 alt 1 proto 1 vid 0x0525 pid 0xA4A8
[  265.020100][   T36] audit: type=1400 audit(2000000423.877:39834): avc:  denied  { append } for  pid=12646 comm="syz.1.4153" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1
[  265.045185][   T36] audit: type=1400 audit(2000000423.877:39835): avc:  denied  { open } for  pid=12646 comm="syz.1.4153" path="/42/file0/.pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1
[  265.073463][T12633] rust_binder: Failed to allocate buffer. len:4240, is_oneway:false
[  265.074388][T10737] usb 5-1: USB disconnect, device number 23
[  265.090060][   T36] audit: type=1400 audit(2000000423.877:39836): avc:  denied  { ioctl } for  pid=12646 comm="syz.1.4153" path="/42/file0/.pending_reads" dev="incremental-fs" ino=2 ioctlcmd=0x6723 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1
[  265.120639][T10737] usblp0: removed
[  265.136881][T12651] rust_binder: 141: no such ref 3
[  265.142058][T12651] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1
[  265.149225][T12651] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1
[  265.156397][T12651] rust_binder: Write failure EFAULT in pid:141
[  265.479379][  T372] usb 2-1: new high-speed USB device number 22 using dummy_hcd
[  265.522732][T12659] netlink: 'syz.2.4158': attribute type 46 has an invalid length.
[  265.531120][T12659] No source specified
[  265.621118][T12661] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  265.630743][  T372] usb 2-1: device descriptor read/64, error -71
[  265.696833][T12672] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  265.737711][T12677] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0
[  265.742411][T12679] netlink: 'syz.3.4165': attribute type 6 has an invalid length.
[  265.744574][T12677] rust_binder: Write failure EINVAL in pid:436
[  265.775667][T12682] netlink: 'syz.3.4167': attribute type 12 has an invalid length.
[  265.791373][   T62] usb 3-1: new high-speed USB device number 51 using dummy_hcd
[  265.905744][  T372] usb 2-1: device descriptor read/64, error -71
[  265.937682][   T62] usb 3-1: device descriptor read/64, error -71
[  266.172176][  T372] usb 2-1: new high-speed USB device number 23 using dummy_hcd
[  266.193499][   T62] usb 3-1: device descriptor read/64, error -71
[  266.321402][  T372] usb 2-1: device descriptor read/64, error -71
[  266.412621][   T36] audit: type=1400 audit(2000000425.191:39837): avc:  denied  { validate_trans } for  pid=12691 comm="syz.4.4170" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1
[  266.449302][   T62] usb 3-1: new high-speed USB device number 52 using dummy_hcd
[  266.506213][T12702] /dev/rnullb0: Can't open blockdev
[  266.512641][T12702] sock: sock_timestamping_bind_phc: sock not bind to device
[  266.577258][  T372] usb 2-1: device descriptor read/64, error -71
[  266.588338][   T62] usb 3-1: device descriptor read/64, error -71
[  266.676491][   T36] audit: type=1400 audit(2000000425.435:39838): avc:  denied  { execute } for  pid=12721 comm="syz.4.4181" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1
[  266.715900][  T372] usb usb2-port1: attempt power cycle
[  266.854321][   T62] usb 3-1: device descriptor read/64, error -71
[  266.971702][   T62] usb usb3-port1: attempt power cycle
[  267.078211][  T372] usb 2-1: new high-speed USB device number 24 using dummy_hcd
[  267.100962][  T372] usb 2-1: device descriptor read/8, error -71
[  267.187704][   T36] audit: type=1326 audit(2000000425.923:39839): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12736 comm="syz.4.4185" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7a8cd8eec9 code=0x0
[  267.239254][  T372] usb 2-1: device descriptor read/8, error -71
[  267.333978][   T62] usb 3-1: new high-speed USB device number 53 using dummy_hcd
[  267.356409][   T62] usb 3-1: device descriptor read/8, error -71
[  267.493896][  T372] usb 2-1: new high-speed USB device number 25 using dummy_hcd
[  267.502842][   T62] usb 3-1: device descriptor read/8, error -71
[  267.516611][  T372] usb 2-1: device descriptor read/8, error -71
[  267.654797][  T372] usb 2-1: device descriptor read/8, error -71
[  267.760313][   T62] usb 3-1: new high-speed USB device number 54 using dummy_hcd
[  267.771460][  T372] usb usb2-port1: unable to enumerate USB device
[  267.782714][   T62] usb 3-1: device descriptor read/8, error -71
[  267.921347][   T62] usb 3-1: device descriptor read/8, error -71
[  268.037538][   T62] usb usb3-port1: unable to enumerate USB device
[  268.104694][T12749] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  268.108632][T12749] rust_binder: Failed to allocate buffer. len:4240, is_oneway:false
[  268.147724][T12751] rust_binder: 487: no such ref 3
[  268.160874][T12751] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1
[  268.167964][T12751] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1
[  268.175027][T12751] rust_binder: Write failure EFAULT in pid:487
[  268.455369][T12766] input: syz0 as /devices/virtual/input/input23
[  268.467983][T12766] input: failed to attach handler leds to device input23, error: -6
[  268.536962][T12770] No source specified
[  268.603894][T12778] netlink: 104 bytes leftover after parsing attributes in process `syz.3.4194'.
[  268.618679][T12781] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2
[  268.643870][T12785] rust_binder: Failed to allocate buffer. len:4096, is_oneway:true
[  268.643901][T12785] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC }
[  268.651923][T12785] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:166
[  269.115042][T12812] binder: Bad value for 'stats'
[  269.135721][T10737] usb 3-1: new high-speed USB device number 55 using dummy_hcd
[  269.209972][  T372] usb 2-1: new low-speed USB device number 26 using dummy_hcd
[  269.249900][T12823] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=35658 sclass=netlink_route_socket pid=12823 comm=syz.3.4215
[  269.286538][T12829] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pid=12829 comm=syz.3.4217
[  269.295195][T10737] usb 3-1: Using ep0 maxpacket: 16
[  269.305656][T10737] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  269.316912][T10737] usb 3-1: New USB device found, idVendor=046d, idProduct=c51b, bcdDevice= 0.00
[  269.326601][T10737] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  269.336523][T10737] usb 3-1: config 0 descriptor??
[  269.348511][  T372] usb 2-1: device descriptor read/64, error -71
[  269.423129][  T332] usb 5-1: new high-speed USB device number 24 using dummy_hcd
[  269.467390][T12834] 9pnet_fd: Insufficient options for proto=fd
[  269.582976][  T332] usb 5-1: Using ep0 maxpacket: 16
[  269.590585][  T332] usb 5-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06
[  269.599777][  T332] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  269.607873][  T332] usb 5-1: Product: syz
[  269.612086][  T332] usb 5-1: Manufacturer: syz
[  269.615045][  T372] usb 2-1: device descriptor read/64, error -71
[  269.616785][  T332] usb 5-1: SerialNumber: syz
[  269.631797][  T332] r8152-cfgselector 5-1: Unknown version 0x0000
[  269.638213][  T332] r8152-cfgselector 5-1: config 0 descriptor??
[  269.771879][T10737] logitech-djreceiver 0003:046D:C51B.0009: hidraw0: USB HID v0.09 Device [HID 046d:c51b] on usb-dummy_hcd.2-1/input0
[  269.858837][T12837] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  269.858880][T12819] rust_binder: Failed to allocate buffer. len:1176, is_oneway:true
[  269.865589][  T332] r8152-cfgselector 5-1: Needed 1 retries to read version
[  269.870765][  T372] usb 2-1: new low-speed USB device number 27 using dummy_hcd
[  270.019977][  T372] usb 2-1: device descriptor read/64, error -71
[  270.084056][  T331] r8152-cfgselector 5-1: USB disconnect, device number 24
[  270.197635][T12838] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  270.206279][T12838] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  270.220303][    T9] usb 3-1: USB disconnect, device number 55
[  270.275832][  T372] usb 2-1: device descriptor read/64, error -71
[  270.324572][T12849] rust_binder: 809: no such ref 0
[  270.329774][T12850] rust_binder: 809: no such ref 0
[  270.391623][T12852] rust_binder: Error while translating object.
[  270.391671][T12852] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF }
[  270.393418][  T372] usb usb2-port1: attempt power cycle
[  270.397951][T12852] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:812
[  270.766109][   T62] usb 3-1: new full-speed USB device number 56 using dummy_hcd
[  270.782961][  T372] usb 2-1: new low-speed USB device number 28 using dummy_hcd
[  270.809745][  T372] usb 2-1: device descriptor read/8, error -71
[  270.904709][T10737] usb 5-1: new high-speed USB device number 25 using dummy_hcd
[  270.948430][  T372] usb 2-1: device descriptor read/8, error -71
[  270.954737][   T62] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64
[  270.965725][   T62] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4
[  270.978649][   T62] usb 3-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00
[  270.987751][   T62] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  270.996380][   T62] usb 3-1: config 0 descriptor??
[  271.001714][T12864] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[  271.009787][   T62] usbhid 3-1:0.0: can't add hid device: -22
[  271.015984][   T62] usbhid 3-1:0.0: probe with driver usbhid failed with error -22
[  271.064560][T10737] usb 5-1: Using ep0 maxpacket: 16
[  271.071329][T10737] usb 5-1: config 1 has an invalid descriptor of length 181, skipping remainder of the config
[  271.082219][T10737] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3
[  271.092479][T10737] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 8.40
[  271.101885][T10737] usb 5-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3
[  271.110114][T10737] usb 5-1: Product: syz
[  271.114412][T10737] usb 5-1: SerialNumber: syz
[  271.158162][T12875] netlink: 172 bytes leftover after parsing attributes in process `syz.3.4231'.
[  271.213778][  T372] usb 2-1: new low-speed USB device number 29 using dummy_hcd
[  271.225646][T12864] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  271.234330][T12864] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  271.244458][   T62] usb 3-1: USB disconnect, device number 56
[  271.251502][  T372] usb 2-1: device descriptor read/8, error -71
[  271.339938][T10737] usb 5-1: 0:2 : does not exist
[  271.346955][T10737] usb 5-1: USB disconnect, device number 25
[  271.356123][ T2293] udevd[2293]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory
[  271.396122][  T372] usb 2-1: device descriptor read/8, error -71
[  271.512293][  T372] usb usb2-port1: unable to enumerate USB device
[  271.848700][T12887] binder: Unknown parameter 'permit_directio'
[  271.855552][T12888] binder: Unknown parameter 'permit_directio'
[  271.890624][   T36] audit: type=1400 audit(2000000430.332:39840): avc:  denied  { execheap } for  pid=12889 comm="syz.2.4235" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[  272.162385][  T372] usb 5-1: new high-speed USB device number 26 using dummy_hcd
[  272.255522][T12910] 9pnet_fd: Insufficient options for proto=fd
[  272.322233][  T372] usb 5-1: Using ep0 maxpacket: 16
[  272.350873][  T372] usb 5-1: config index 0 descriptor too short (expected 30756, got 36)
[  272.370129][  T372] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  272.395125][  T372] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 16
[  272.436073][T12933] netlink: 'syz.1.4247': attribute type 12 has an invalid length.
[  272.445467][  T372] usb 5-1: New USB device found, idVendor=1d34, idProduct=000a, bcdDevice= 0.00
[  272.456253][T12935] netlink: 'syz.2.4251': attribute type 27 has an invalid length.
[  272.464424][  T372] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  272.484945][  T372] usb 5-1: config 0 descriptor??
[  272.485221][T12935] rust_binder: Error while translating object.
[  272.490022][T12935] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  272.518035][T12935] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:846
[  272.667602][   T36] audit: type=1326 audit(2000000431.055:39841): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12943 comm="syz.2.4253" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3961b8eec9 code=0x0
[  272.767043][T12892] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  272.767156][T12892] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1
[  272.819384][T12892] rust_binder: 514: no such ref 0
[  272.840125][T12892] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:514
[  273.405201][T12960] rust_binder: Read failure Err(EAGAIN) in pid:194
[  273.410831][T12961] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  273.430841][T12962] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  273.431710][T12964] binder: Bad value for 'stats'
[  273.441837][T12962] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:518
[  273.490513][   T36] audit: type=1400 audit(2000000431.824:39842): avc:  denied  { ioctl } for  pid=12967 comm="syz.4.4259" path="socket:[59841]" dev="sockfs" ino=59841 ioctlcmd=0xf509 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1
[  273.583815][T12973] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT }
[  273.583854][T12973] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:858
[  273.678935][T12977] rust_binder: Write failure EFAULT in pid:860
[  273.953023][    T9] usb 3-1: new high-speed USB device number 57 using dummy_hcd
[  274.112919][    T9] usb 3-1: device descriptor read/64, error -71
[  274.379400][    T9] usb 3-1: device descriptor read/64, error -71
[  274.558092][T13003] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  274.566805][T13003] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  274.656561][    T9] usb 3-1: new high-speed USB device number 58 using dummy_hcd
[  274.795090][    T9] usb 3-1: device descriptor read/64, error -71
[  275.050909][    T9] usb 3-1: device descriptor read/64, error -71
[  275.131411][T13008] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  275.131536][T13008] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  275.139379][T13008] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  275.154697][T13008] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  275.175807][    T9] usb usb3-port1: attempt power cycle
[  275.200100][  T330] usb 2-1: new high-speed USB device number 30 using dummy_hcd
[  275.362618][  T330] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[  275.371770][  T330] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  275.379839][  T330] usb 2-1: Product: syz
[  275.384291][  T330] usb 2-1: Manufacturer: syz
[  275.388946][  T330] usb 2-1: SerialNumber: syz
[  275.551878][    T9] usb 3-1: new high-speed USB device number 59 using dummy_hcd
[  275.574299][    T9] usb 3-1: device descriptor read/8, error -71
[  275.713134][    T9] usb 3-1: device descriptor read/8, error -71
[  275.806820][T13020] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:547
[  275.929150][T13024] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4277'.
[  275.947428][T13024] bridge_slave_1: left allmulticast mode
[  275.953112][T13024] bridge_slave_1: left promiscuous mode
[  275.959123][T13024] bridge0: port 2(bridge_slave_1) entered disabled state
[  275.967022][T13024] bridge_slave_0: left allmulticast mode
[  275.973293][    T9] usb 3-1: new high-speed USB device number 60 using dummy_hcd
[  275.974750][T13024] bridge_slave_0: left promiscuous mode
[  275.987356][T13024] bridge0: port 1(bridge_slave_0) entered disabled state
[  275.990633][   T36] audit: type=1326 audit(2000000434.179:39843): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13022 comm="syz.4.4277" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a8cd8eec9 code=0x7fc00000
[  276.020020][    T9] usb 3-1: device descriptor read/8, error -71
[  276.109787][T13029] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:555
[  276.109787][T13028] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:555
[  276.134680][T13031] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  276.152623][T13031] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  276.173809][    T9] usb 3-1: device descriptor read/8, error -71
[  276.264067][T13042] rust_binder: Write failure EFAULT in pid:569
[  276.264209][T13042] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:569
[  276.270579][T13042] rust_binder: Failure when writing BR_NOOP at beginning of buffer.
[  276.279855][T13042] rust_binder: Read failure Err(EFAULT) in pid:569
[  276.298142][    T9] usb usb3-port1: unable to enumerate USB device
[  276.396949][T13051] 9pnet_fd: Insufficient options for proto=fd
[  276.419161][T13053] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4287'.
[  276.483437][T13054] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  276.492101][T13054] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  276.500368][T13054] rust_binder: Failed to allocate buffer. len:1048, is_oneway:true
[  276.926487][T13058] No source specified
[  276.951160][T13063] ext3: Bad value for 'dax'
[  276.951472][T13064] rust_binder: Write failure EFAULT in pid:871
[  276.955854][T13063] ext3: Bad value for 'dax'
[  276.955885][T13064] rust_binder: Write failure EFAULT in pid:871
[  276.962252][T13063] ext3: Bad value for 'dax'
[  276.967202][T13064] rust_binder: Write failure EFAULT in pid:871
[  276.973006][T13063] ext3: Bad value for 'dax'
[  276.977752][T13064] rust_binder: Write failure EFAULT in pid:871
[  276.983762][T13063] ext3: Bad value for 'dax'
[  276.988815][T13064] rust_binder: Write failure EFAULT in pid:871
[  276.994882][T13063] ext3: Bad value for 'dax'
[  276.999263][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.005485][T13063] ext3: Bad value for 'dax'
[  277.010085][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.016086][T13063] ext3: Bad value for 'dax'
[  277.020861][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.027097][T13063] ext3: Bad value for 'dax'
[  277.031430][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.037627][T13063] ext3: Bad value for 'dax'
[  277.042375][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.048466][T13063] ext3: Bad value for 'dax'
[  277.053023][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.058986][T13063] ext3: Bad value for 'dax'
[  277.063777][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.069781][T13063] ext3: Bad value for 'dax'
[  277.074570][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.080546][T13063] ext3: Bad value for 'dax'
[  277.085232][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.091408][T13063] ext3: Bad value for 'dax'
[  277.095976][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.102037][T13063] ext3: Bad value for 'dax'
[  277.106551][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.112774][T13063] ext3: Bad value for 'dax'
[  277.117603][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.123497][T13063] ext3: Bad value for 'dax'
[  277.128175][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.134195][T13063] ext3: Bad value for 'dax'
[  277.138884][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.144941][T13063] ext3: Bad value for 'dax'
[  277.149600][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.155795][T13063] ext3: Bad value for 'dax'
[  277.160518][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.166535][T13063] ext3: Bad value for 'dax'
[  277.171187][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.177274][T13063] ext3: Bad value for 'dax'
[  277.181925][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.188024][T13063] ext3: Bad value for 'dax'
[  277.192691][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.198726][T13063] ext3: Bad value for 'dax'
[  277.203400][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.209446][T13063] ext3: Bad value for 'dax'
[  277.214141][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.220223][T13063] ext3: Bad value for 'dax'
[  277.224902][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.230969][T13063] ext3: Bad value for 'dax'
[  277.235691][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.241727][T13063] ext3: Bad value for 'dax'
[  277.246402][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.252944][T13063] ext3: Bad value for 'dax'
[  277.257209][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.263232][T13063] ext3: Bad value for 'dax'
[  277.267593][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.273819][T13063] ext3: Bad value for 'dax'
[  277.278781][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.284630][T13063] ext3: Bad value for 'dax'
[  277.289088][T13064] rust_binder: Write failure EFAULT in pid:871
[  277.313644][T13067] rust_binder: 875: no such ref 0
[  277.934075][T13079] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4295'.
[  278.089312][  T372] usb 5-1: string descriptor 0 read error: -32
[  278.153441][T13091] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  278.153636][T13091] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  278.160282][T13091] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:899
[  278.167620][  T332] usb 2-1: USB disconnect, device number 30
[  278.194393][T13093] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  278.196704][T13093] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false
[  278.204721][T13093] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC }
[  278.216328][T13093] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:901
[  278.884325][T13120] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4309'.
[  278.902803][T13121] /dev/rnullb0: Can't open blockdev
[  278.934633][T13127] IPv6: NLM_F_CREATE should be specified when creating new route
[  279.048060][T13133] kvm: pic: non byte write
[  279.053293][T13133] kvm: pic: non byte write
[  279.065966][T13133] kvm: pic: non byte write
[  279.071517][T13133] SELinux: failed to load policy
[  279.114377][T13136] veth0_to_team: entered promiscuous mode
[  279.120171][T13136] veth0_to_team: entered allmulticast mode
[  279.637135][   T36] audit: type=1400 audit(2000000437.594:39844): avc:  denied  { create } for  pid=13172 comm="syz.4.4325" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=key permissive=1
[  279.658681][   T36] audit: type=1400 audit(2000000437.622:39845): avc:  denied  { unmount } for  pid=10232 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1
[  279.689022][  T332] usb 2-1: new high-speed USB device number 31 using dummy_hcd
[  279.703337][T13180] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:924
[  279.703520][T13180] rust_binder: Write failure EFAULT in pid:924
[  279.857933][  T332] usb 2-1: Using ep0 maxpacket: 8
[  279.870361][  T332] usb 2-1: config 179 has an invalid interface number: 65 but max is 0
[  279.878690][  T332] usb 2-1: config 179 has no interface number 0
[  279.885099][  T332] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9
[  279.896447][  T332] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024
[  279.907899][  T332] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0
[  279.918374][  T332] usb 2-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23
[  279.931723][  T332] usb 2-1: config 179 interface 65 has no altsetting 0
[  279.938652][  T332] usb 2-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00
[  279.947913][  T332] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  279.975245][  T330] usb 3-1: new high-speed USB device number 61 using dummy_hcd
[  280.133282][T13194] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  280.135087][  T330] usb 3-1: Using ep0 maxpacket: 8
[  280.142528][T13194] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  280.149190][  T330] usb 3-1: config 179 has an invalid interface number: 65 but max is 0
[  280.162044][T13194] netlink: 'syz.4.4333': attribute type 1 has an invalid length.
[  280.163276][  T330] usb 3-1: config 179 has no interface number 0
[  280.173813][  T372] usb 2-1: USB disconnect, device number 31
[  280.178619][  T330] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9
[  280.187661][T13194] netlink: 'syz.4.4333': attribute type 2 has an invalid length.
[  280.196723][  T330] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024
[  280.214760][  T330] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0
[  280.227476][  T330] usb 3-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23
[  280.241169][  T330] usb 3-1: config 179 interface 65 has no altsetting 0
[  280.250471][  T330] usb 3-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00
[  280.260479][  T330] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  280.282059][T13204] No source specified
[  280.490848][  T372] usb 3-1: USB disconnect, device number 61
[  280.825039][T13212] rust_binder: 233: no such ref 3
[  280.830185][T13212] rust_binder: 233: no such ref 1
[  280.835404][T13212] rust_binder: Write failure EFAULT in pid:233
[  280.872829][T13218] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4341'.
[  280.902744][T13223] No source specified
[  280.978527][T13230] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  280.978866][T13230] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false
[  281.005510][T13235] SELinux: security_context_str_to_sid (sytem_uÝGй) failed with errno=-22
[  281.046017][T13237] rust_binder: 928: no such ref 3
[  281.051116][T13237] rust_binder: 928: no such ref 1
[  281.056220][T13237] rust_binder: Write failure EFAULT in pid:928
[  281.121369][T13243] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  281.138628][T13246] /dev/rnullb0: Can't open blockdev
[  281.168607][T13243] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false
[  281.172547][T13248] /dev/rnullb0: Can't open blockdev
[  281.205882][T13253] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  281.212975][T13253] rust_binder: Error in use_page_slow: ESRCH
[  281.213015][T13253] rust_binder: use_range failure ESRCH
[  281.219090][T13253] rust_binder: Failed to allocate buffer. len:4256, is_oneway:false
[  281.224885][T13253] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH }
[  281.233246][T13253] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:938
[  281.236414][T13258] /dev/rnullb0: Can't open blockdev
[  281.295659][T13271] rust_binder: Error while translating object.
[  281.295705][T13271] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  281.302426][T13271] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:948
[  281.384198][T13274] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  281.451676][T13287] __vm_enough_memory: pid: 13287, comm: syz.2.4364, bytes: 18014402804453376 not enough memory for the allocation
[  281.733905][    T9] usb 3-1: new high-speed USB device number 62 using dummy_hcd
[  281.893757][    T9] usb 3-1: Using ep0 maxpacket: 16
[  281.900103][    T9] usb 3-1: config 1 interface 0 altsetting 255 endpoint 0x1 has invalid wMaxPacketSize 0
[  281.910037][    T9] usb 3-1: config 1 interface 0 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 0
[  281.919915][    T9] usb 3-1: config 1 interface 0 altsetting 255 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  281.933931][    T9] usb 3-1: config 1 interface 0 has no altsetting 0
[  281.942124][    T9] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40
[  281.951271][    T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  281.959585][    T9] usb 3-1: Product: syz
[  281.963796][    T9] usb 3-1: Manufacturer: syz
[  281.968463][    T9] usb 3-1: SerialNumber: syz
[  282.045517][T13313] rust_binder: Write failure EFAULT in pid:248
[  282.100402][T13318] ------------[ cut here ]------------
[  282.112205][T13318] WARNING: CPU: 1 PID: 13318 at mm/page_alloc.c:5228 __alloc_pages_noprof+0xe8/0x7b0
[  282.121758][T13318] Modules linked in:
[  282.125872][T13318] CPU: 1 UID: 0 PID: 13318 Comm: syz.1.4377 Not tainted syzkaller #0 9b63ddcf0ca82069290034062ca02b4369282e80
[  282.137609][T13318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
[  282.148110][T13318] RIP: 0010:__alloc_pages_noprof+0xe8/0x7b0
[  282.154196][T13318] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d a2 1f ee 05 00 0f 85 be 00 00 00 c6 05 95 1f ee 05 01 <0f> 0b 31 c0 e9 b0 00 00 00 83 fb 0a 0f 87 a5 00 00 00 44 8b 64 24
[  282.174024][T13318] RSP: 0018:ffffc90003caf860 EFLAGS: 00010246
[  282.180143][T13318] RAX: 0000000000000000 RBX: 000000000000000c RCX: 0000000000000000
[  282.188270][T13318] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003caf918
[  282.196355][T13318] RBP: ffffc90003caf988 R08: ffffc90003caf917 R09: 0000000000000000
[  282.197042][    T9] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 62 if 0 alt 255 proto 1 vid 0x0525 pid 0xA4A8
[  282.204407][T13318] R10: ffffc90003caf900 R11: fffff52000795f23 R12: ffffc90003caf8a0
[  282.204435][T13318] R13: dffffc0000000000 R14: 1ffff92000795f10 R15: 0000000000000000
[  282.231650][T13318] FS:  00007f30a2bd66c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
[  282.240857][T13318] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  282.247523][T13318] CR2: 0000200000001000 CR3: 0000000125b98000 CR4: 00000000003526b0
[  282.255623][T13318] Call Trace:
[  282.258960][T13318]  <TASK>
[  282.261926][T13318]  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  282.268120][T13318]  ? __cfi___alloc_pages_noprof+0x10/0x10
[  282.273911][T13318]  ? incfs_realloc_mount_info+0xa7/0x4d0
[  282.279719][T13318]  ___kmalloc_large_node+0x81/0x220
[  282.284959][T13318]  ? incfs_realloc_mount_info+0xa7/0x4d0
[  282.290655][T13318]  __kmalloc_large_node_noprof+0x1e/0xe0
[  282.296318][T13318]  ? incfs_realloc_mount_info+0xa7/0x4d0
[  282.302019][T13318]  __kmalloc_noprof+0x336/0x530
[  282.306905][T13318]  ? __cfi_lockref_get+0x10/0x10
[  282.311895][T13318]  incfs_realloc_mount_info+0xa7/0x4d0
[  282.317408][T13318]  ? incfs_add_sysfs_node+0x118/0x240
[  282.323125][T13318]  incfs_alloc_mount_info+0x479/0x600
[  282.328527][T13318]  incfs_mount_fs+0x3ca/0x960
[  282.333278][T13318]  ? __cfi_incfs_mount_fs+0x10/0x10
[  282.338515][T13318]  ? vfs_parse_fs_string+0x102/0x170
[  282.343866][T13318]  ? selinux_capable+0x38/0x50
[  282.348670][T13318]  legacy_get_tree+0x106/0x1b0
[  282.353488][T13318]  ? __cfi_incfs_mount_fs+0x10/0x10
[  282.358727][T13318]  vfs_get_tree+0x9e/0x290
[  282.363216][T13318]  do_new_mount+0x251/0xb40
[  282.367752][T13318]  ? security_capable+0xcf/0xf0
[  282.372628][T13318]  path_mount+0x688/0x1050
[  282.377124][T13318]  ? putname+0x113/0x150
[  282.381416][T13318]  __se_sys_mount+0x2bd/0x480
[  282.386183][T13318]  ? __x64_sys_mount+0xf0/0xf0
[  282.391076][T13318]  ? __kasan_check_write+0x18/0x20
[  282.396734][T13318]  ? fpregs_restore_userregs+0x11d/0x260
[  282.402587][T13318]  __x64_sys_mount+0xc3/0xf0
[  282.407281][T13318]  x64_sys_call+0x2021/0x2ee0
[  282.412003][T13318]  do_syscall_64+0x58/0xf0
[  282.416582][T13318]  ? clear_bhb_loop+0x50/0xa0
[  282.421306][T13318]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  282.427268][T13318] RIP: 0033:0x7f30a418eec9
[  282.431826][T13318] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  282.451535][T13318] RSP: 002b:00007f30a2bd6038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[  282.460130][T13318] RAX: ffffffffffffffda RBX: 00007f30a43e6090 RCX: 00007f30a418eec9
[  282.468124][T13318] RDX: 0000200000000140 RSI: 0000200000000100 RDI: 00002000000000c0
[  282.476151][T13318] RBP: 00007f30a4211f91 R08: 0000200000000180 R09: 0000000000000000
[  282.484351][T13318] R10: 0000000001010040 R11: 0000000000000246 R12: 0000000000000000
[  282.492472][T13318] R13: 00007f30a43e6128 R14: 00007f30a43e6090 R15: 00007ffd7d862428
[  282.500492][T13318]  </TASK>
[  282.503578][T13318] ---[ end trace 0000000000000000 ]---
[  282.509108][T13318] incfs: Error allocating mount info. -12
[  282.515116][T13318] incfs: mount failed -12
[  284.697003][  T331] usb 3-1: USB disconnect, device number 62
[  284.703650][  T331] usblp0: removed