last executing test programs: 2.916592226s ago: executing program 2 (id=63): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x77, 0x29, 0x4, 0x20, 0x424, 0x9901, 0xc257, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x43, 0x0, 0x2, 0x31, 0x7d, 0x55, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000400)={0x44, &(0x7f0000000200)=ANY=[@ANYBLOB="401504"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000400)={0x44, &(0x7f0000000200)=ANY=[@ANYBLOB="401504"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000140)={0x4d5001fcb46e0ea3, 0x0, 0x5, "5637b06fff"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000b00)={0x2c, &(0x7f0000000900)={0x0, 0xe, 0x4, "52b16000"}, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000b00)={0x2c, &(0x7f0000000900)={0x0, 0xe, 0x4, "52b16000"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000002c0)={0x1c, &(0x7f0000000480)=ANY=[@ANYBLOB="001b0000000000ef00cf0c2be0613ef26e5a4490df0a58f5b853f1a75b1ab550f9cb9214a6d30faf3f3f6386eb6c91dc069505c4417f6a749ace1cd8ca093995a91fd77de5e672993dbde3dad316fb6dccec12574c8339f05c25e0aa6aaccb3e7e83907c0859070413c5ff253d9d286471d5924f953afef28d19cd0d3afe6d89b3929140932c36626e41b88026647eced0ba69a92d6738fb34ec7c383320988acf5e98ffb384652cc1324fae729a401679b1f5edd01538b677"], 0x0, 0x0}) ioctl$ASHMEM_SET_SIZE(0xffffffffffffffff, 0x40087703, 0x10000003) (async) ioctl$ASHMEM_SET_SIZE(0xffffffffffffffff, 0x40087703, 0x10000003) bind$inet(0xffffffffffffffff, 0x0, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x2, 0x0) pipe(&(0x7f0000000040)) (async) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x5, 0xd) (async) splice(r1, 0x0, r3, 0x0, 0x5, 0xd) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r4, 0x0, 0x0) preadv(r3, 0x0, 0x3, 0x8934, 0x708) (async) preadv(r3, 0x0, 0x3, 0x8934, 0x708) ioctl$KVM_SET_FPU(r4, 0x41a0ae8d, 0x0) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x22281, 0x0) ioctl$IOC_PR_RELEASE(r5, 0x401070ca, &(0x7f00000000c0)={0x0, 0x4}) sendmsg$can_raw(r4, 0x0, 0x40) (async) sendmsg$can_raw(r4, 0x0, 0x40) write$bt_hci(r2, &(0x7f0000000000)={0x1, @le_del_from_resolv_list={{0x2028, 0x7}, {0x1}}}, 0xb) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) close(0x3) syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r7, 0xc02063a1, 0x0) (async) ioctl$KVM_CREATE_VM(r7, 0xc02063a1, 0x0) read$FUSE(r6, &(0x7f0000001180)={0x2020}, 0x2020) 1.356454789s ago: executing program 2 (id=74): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000001000010700000000e9ffffff"], 0x20}, 0x1, 0x0, 0x0, 0x4046014}, 0x400c0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x12040, 0x0) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x40040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) pipe2$watch_queue(0x0, 0x80) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r3, 0x4068aea3, &(0x7f0000000380)={0xbc, 0x0, 0x3}) ioctl$KVM_SET_GUEST_DEBUG(r4, 0x4048ae9b, &(0x7f0000000300)={0x4376ea830d4d549b, 0x0, [0xffffffffffffffff, 0x7, 0x1000000, 0x0, 0x5, 0x3, 0xfffffffffffffffc, 0x800000]}) fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f00000001c0)) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f00000ab000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000140)="36d0e866b8970000000f23c80f21f866350c00a0000f23f89d0f326635000400000f302e8dcc0f23742e3b5753baf80466b8f494f78e66efbafc0c66b83ac80000666fda6509", 0x46}], 0x1, 0x1a, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) ioctl$KVM_RUN(r4, 0xae80, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f00000004c0)='./bus\x00', 0x92) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@metacopy_on}]}) r5 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) mknodat$loop(r5, 0x0, 0x0, 0x0) chdir(&(0x7f0000000140)='./bus\x00') mkdirat$binderfs(0xffffffffffffff9c, &(0x7f00000019c0)='./binderfs2\x00', 0x1ff) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f000000d000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, &(0x7f0000001440)="660f51ba0c000ff34f00f3e18e66b9250b00000f3267f22f66b9800000c00f326635000800000f30650f011c66b80500000066b9060000000f01c1660f388252f1360f1866af", 0x46}], 0x1, 0x16, 0x0, 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='ext3\x00', 0x200000, 0x0) 1.355859819s ago: executing program 1 (id=75): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000480)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @const={0x0, {0x8}}}) socketpair$tipc(0x1e, 0x7, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000280)={0x4000, 0x2}, 0x10) sendmsg$netlink(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a0001002abd7000000000000a"], 0x78}], 0x1, 0x0, 0x0, 0x20400}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000880), r3) sendmsg$tipc(r2, &(0x7f0000000800)={&(0x7f0000000180)=@id={0x1e, 0x3, 0x1, {0x4e20, 0x4}}, 0x10, &(0x7f00000006c0)=[{&(0x7f00000001c0)="a8e9b98dcbed6e24406c3752b7ee9e154233ad472df0306bc4726f3273a4a9fd43acf7783eb0b79e8d92df1653f4c2709ccf6d3c47f8102b4ff91f12180f5514c4b52b04ef83d87de15999618ca3ffc19b20c099da4fceb24a135d0ed4822ad526d09cc736b4e4dd52c3f80db0afee1918ac4c2eea83502eb76489bbd85a4be4530eb1179f648c9fb2f65b716d459cd4ccc6d1540d7749d1e3e4786204244c74de77f2388a24e933143159c75ea7353dca7594349f8b33e5704bf66e1c60faabdc9ff2961978d1d698878fca", 0xcc}, {&(0x7f00000002c0)="d25ba167bc002d3eb84a42e80b82666b8e449e3f5344dfcf25218c133b461dc940b30cf0e630467cc63e5078deecba299ed8c541ed9223589bce6cfe8b88f134750619549438f38265c79771c1b54b28c706945f90667f651a00b95cb63d37ee326fbbb37d2695fdd89e1b5aeeaf0736142ae7863c15dfc29285e1942824fdb8af5132", 0x83}, {&(0x7f0000000380)="558bcd662faa7c4a578fad3ccf9dc0242ab5a9845e3624c0e93de7de367e8ab79969b9cfc5708340a4d795598344e6cd0e5713e72bfc59a5629cda15e607cb32ca13e2fc3bca6df1805c4527dcb54c162619d614e429bd2ef0e34be0925f4a9ad3cc792c2d1f2c205a456c72be00f23d789c69845579c332312a4318b483036e32df5c1711c301bcb1e5f87f53d370f9e89c82fd5cedb8c3714c5e9efb7a0a0bd8abed10cc0147bb5476b146aded", 0xae}, {&(0x7f00000004c0)="1c40d5110878acc7f3f6219e86afcac9b14b59f57647f57b0c7f6327e376865ee4de70660658ba851a6203c578cb22152b0dbcfbbd12cbbd72e2c8532035bef215a4eda4545055a7fe3add1fe61a887d1afb84a0a597eaebca61990abf83a11d7acc3a9e82626be96dd1e0e916cbb05596791bf391aac86ae68094d5afbc3a6e38f64baedbc37802147465c7bf8bdfde3aa60c073d1568fb77618f40ebf64e0b47f53b959d5710f142f765e7768f9ce5d963ea71f3fe4059c5091c7d5995ff7eb01f3d253acfdb0f745d19beeceb758ea653ce0d11521d7e167d52cacc2367fad19253738231465886b2bf51a8e0e843ba806775bef2dc0fe52ad590", 0xfc}, {&(0x7f0000000440)="f50cbf1e6a935feff1914126dbe18d1638e18d8bcb8025d8a672cf961334a0289ca049d2e8c09747784e6820cae4", 0x2e}, {&(0x7f00000005c0)="162e21587289be25145f014218bdabf23a4d9ad037043094fd26efb939517c3bb954f56582410b7f45d6001f0c783de018e968832c2d881e60d07aed9ff87624834263ab5f37ad93b07365407a7d4a1670973378aacfe1b79c553c4752d6523746d711a59d8acbae163f5beb03d46ba270c088a030621321abc89348f49a4cdad9ae25e612e8afa09e7fc603a79bba518e5dc22096b4e77d41a3409a07102f68377fe4ada87b73b3a4cde05da5baf9cca18d7fcb67b7b4ba582b645a95ffed7bdccdcd1e", 0xc4}], 0x6, &(0x7f0000000740)="9ead8f759ebe07011acf649033ece2c05bc6bd35daced8fb6f39ed3e96b4b9355d04ff26cd1f05b3a265e2058fb25702ea8b841916a2d207f8b75a96e97c492d71cebcf33adecc3f46148b0e1035fa0a84b25a7c4c249556df4b199b18f358a64544d3dc443e4d987b8e65fddd2f08fe76667487cfd741ee2c72dedeca21a9959ec3f85e6325565b03f3a86a041abcc7f6b438de0b9d9275242d93f08b758c539965", 0xa2, 0x84}, 0x811) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) poll(&(0x7f0000000840)=[{r4, 0x10}, {r3, 0x8200}], 0x2, 0x0) ioctl$EVIOCSMASK(r4, 0x40104593, &(0x7f0000000000)={0x1, 0x0, 0x0}) write$char_usb(r4, &(0x7f0000000040)="e2", 0x1068) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x1fd, 0x1, 0xcccc0000, 0x1000, &(0x7f0000fff000/0x1000)=nil}) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000009, 0x12, r5, 0x99b33000) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x3, 0x10000000000, 0x1000, &(0x7f0000fff000/0x1000)=nil}) 1.27631403s ago: executing program 0 (id=76): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs/binder0\x00', 0x0, 0x0) (async, rerun: 32) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) (rerun: 32) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) (async) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0x7, 0x1000000, 0x0}) (async, rerun: 64) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x24, 0x0, &(0x7f00000002c0)=[@decrefs={0x400c6314}, @clear_death={0x400c630f, 0x3}, @free_buffer], 0x0, 0x0, 0x0}) (async, rerun: 64) setsockopt$inet6_tcp_int(r2, 0x6, 0x1e, &(0x7f0000000000)=0x10, 0x4) 1.234842491s ago: executing program 1 (id=77): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x60303, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) dup(r4) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x6, 0x8, 0x9, 0x9, 0x2, 0x0, 0x8, 0x8, 0xb, 0x6, 0x7f, 0x100000000, 0xa95, 0xfffffffffffff001, 0x7, 0x5], 0x4000, 0x745603289bc19506}) r5 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f00000002c0)=@pppol2tpin6={0x18, 0x1, {0x0, r5, 0x4, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x32) close_range(r0, 0xffffffffffffffff, 0x0) 978.731825ms ago: executing program 1 (id=78): mkdir(&(0x7f0000000540)='./file0\x00', 0x108) (async) mount$cgroup(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100)={[{@subsystem='cpuset'}, {@subsystem='memory'}, {@subsystem='cpuacct'}]}) (async) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) (async) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@xino_auto}]}) (async) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip6_mr_cache\x00') madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000a39000/0x1000)=nil, 0x1000}, 0x2}) (async, rerun: 64) bind$inet6(0xffffffffffffffff, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) (async, rerun: 64) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) (async) r4 = eventfd2(0x0, 0x0) (async, rerun: 32) io_setup(0x6, &(0x7f0000000140)=0x0) (rerun: 32) io_submit(r5, 0x1, &(0x7f00000000c0)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0xfffd, r3, 0x0, 0x0, 0x0, 0x0, 0x3, r4}]) readv(r4, &(0x7f0000000d00)=[{&(0x7f00000002c0)=""/95, 0x5f}], 0x1) shutdown(r3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) r7 = dup2(r6, r2) close_range(r7, 0xffffffffffffffff, 0x0) read$FUSE(r0, &(0x7f0000000f00)={0x2020}, 0x2020) 722.542848ms ago: executing program 2 (id=80): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) (async) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4480) write$P9_RVERSION(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) (async, rerun: 32) r2 = dup(r1) (rerun: 32) write$FUSE_BMAP(r2, &(0x7f0000000000)={0x18}, 0x18) (async) syslog(0x2, 0x0, 0x0) (async) r3 = openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$selinux_access(r3, 0x0, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r5 = socket$unix(0x1, 0x5, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) r7 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) ioctl$USBDEVFS_SUBMITURB(r7, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {}, 0x20000009, 0x81, &(0x7f0000000240)={0x2, 0x0, 0xfffc, 0x360}, 0x8, 0x5, 0xa6, 0x0, 0x4001, 0x9, 0x0}) (async) sendmsg$nl_xfrm(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="48000000120001000000000000000000ac141400000000000000000000000000000000000000000014000d0020", @ANYRES8=r4, @ANYRES16=r5], 0x48}}, 0x4014) (async) write$FUSE_DIRENTPLUS(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) (async, rerun: 64) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (rerun: 64) connect$inet6(r8, &(0x7f0000000000)={0xa, 0x4e24, 0x3, @mcast2, 0x5}, 0x1c) (async) setsockopt$inet6_int(r8, 0x29, 0x11, &(0x7f0000000040)=0x5, 0x4) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB="2c6317784d0699ff40"]) (async) getresuid(&(0x7f0000000280), &(0x7f0000000400), &(0x7f0000000440)) (async) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r9, &(0x7f0000000980)={0x2020}, 0x2020) 679.284929ms ago: executing program 2 (id=82): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0xfffffffd, 0x3}, 0x10) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) bind$tipc(r2, &(0x7f0000000080)=@id={0x1e, 0x3, 0x0, {0x4e23}}, 0x10) bind$tipc(r0, 0x0, 0x0) sendmsg$tipc(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4010}, 0x8820) 616.1502ms ago: executing program 2 (id=84): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) socket(0x80000000000000a, 0x2, 0x0) (async) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2a, &(0x7f0000000200)={0x8, {{0xa, 0x4e21, 0x6de, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) (async) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) read$FUSE(r2, &(0x7f0000001d40)={0x2020}, 0x2020) setsockopt$inet6_group_source_req(r1, 0x29, 0x2f, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x4, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e21, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x7fffd}}}, 0x108) close_range(r0, 0xffffffffffffffff, 0x0) 582.646661ms ago: executing program 2 (id=86): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r2 = syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x92, 0xec, 0xc6, 0x20, 0x5ac, 0x77c2, 0xeb3a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, [{{0x9, 0x4, 0xc4, 0x1, 0x2, 0xff, 0xfd, 0x1, 0x80, [], [{{0x9, 0x5, 0x2, 0x2, 0x210, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r2, &(0x7f0000000000)={0x14, 0x0, &(0x7f00000001c0)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000140)={0x20, 0x1, 0x6, "1693c6a87ad2"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write$ath9k_ep1(r2, 0x82, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, &(0x7f0000000800)={0x2c, 0x0, &(0x7f0000000640)={0x0, 0xa, 0x1, 0xdf}, 0x0, 0x0, &(0x7f00000007c0)={0x20, 0x3, 0x1, 0x71}}) syz_usb_control_io$printer(r2, &(0x7f0000000380)={0x14, &(0x7f0000000200)={0x40, 0x11, 0x88, {0x88, 0x22, "2bb910e39515060ed29ef640f7fcf2802c7a0141fefcc7764c41eb020491db851d33e168ee8294b8eb82e0c16598ef4eba3a9827d7ea3d7812ad18df36a17c37e6b809343b66823a43ab92b14f31bee3b4762141cce987db5db1c71f5e003b4deffdbe455373d9b3c294617abe3586bedf4b90e849bc8783f84a0e9a8acbb610a5a9960b509e"}}, &(0x7f0000000680)={0x0, 0x3, 0x86, @string={0x86, 0x3, "eee8f1f194121afc0bb269f38452350da733f2b50d201dcb4bfb5ce780ec22bb92e94ba992207748e0e1944ca6eb26fa915ca1dc668e623cf1c7737e7fa9b741c58ddc774539dbdf548b187f06f863ad479c0beef86b9b330a6a461da20ed253dd12efcfee1f36dd95f446a6a3fc645ad8e69fd7a87e0b3de713260eeb4e35425ecce95c"}}}, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)={0x40, 0x14, 0x1b, "74971857adb4d7a7b98f74b687f4ce262138329ac726e8442de6c9"}, &(0x7f0000000400)={0x0, 0xa, 0x1, 0x7f}, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000480)={0x20, 0x0, 0xa7, {0xa5, "78a7b9a65ae44b33f0cc60b9e8a721dd5bb5a005de70f103deb49cdbe26349c0aa107686a413132883146cae0c39960e99636cae1a96af418b7a75212ea53ef2b795187c8caf601364d5dfa1c373f6b3f0a5e965fbd369683b76f794e0e9a9e68d71a4f06d28a3c599f4702595eecf2040defeef5ee1bfeafe14192ef256498c8a6f36bda54da194b80e1ca90ed91b298afbe9715739a226bc8568095b3fd40df4dfc7a1e9"}}, &(0x7f0000000540)={0x20, 0x1, 0x1, 0x80}, &(0x7f0000000580)={0x20, 0x0, 0x1, 0x3}}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) fcntl$lock(r3, 0x7, &(0x7f00000000c0)={0x1, 0x2, 0x6, 0x80}) setsockopt$packet_int(r3, 0x107, 0x11, &(0x7f00000002c0)=0x101, 0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x7, &(0x7f0000000080)={@private1, 0x0}, &(0x7f00000000c0)=0x14) r5 = fsmount(r3, 0x0, 0x82) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000001140)='net\x00') prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) fchdir(r6) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) getdents64(r7, &(0x7f00000000c0)=""/55, 0x37) ioctl$RTC_PLL_SET(r5, 0x40207012, &(0x7f00000001c0)={0x3b4a, 0xeed, 0x10000, 0x9, 0x3, 0x5, 0xe97}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000000180)={'syztnl2\x00', &(0x7f0000000100)={'ip_vti0\x00', r4, 0x8, 0x1, 0x81, 0x3ff, {{0xa, 0x4, 0x1, 0x29, 0x28, 0x65, 0x0, 0x7, 0x4, 0x0, @empty, @broadcast, {[@generic={0x94, 0xe, "d87940e01c3129faf9a80433"}, @ra={0x94, 0x4, 0x1}, @end]}}}}}) connect$packet(r1, &(0x7f0000000000)={0x1f, 0xf8, 0x0, 0x1, 0x2, 0x6, @broadcast}, 0x14) 454.727163ms ago: executing program 0 (id=87): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0xffffffffffffffff, 0x100000000, 0x0, 0x9, 0x57a1, 0x0, 0x2004c8, 0x8000000, 0x0, 0x400000000800, 0x3, 0x40000000, 0x1, 0x0, 0x800000002, 0xffffffffffffffff], 0x0, 0x200}) timer_create(0x4, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000002c0)={[0x400000000000001, 0x5, 0xfffffffffffffffe, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x1c, 0x0, 0xfffffffffffffffc, 0x6], 0x0, 0x41901}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$F2FS_IOC_GARBAGE_COLLECT(r0, 0x4004f506, &(0x7f00000000c0)=0x1) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) write$P9_RLERRORu(r5, &(0x7f0000000180)=ANY=[@ANYBLOB="15000000070200080026402f5e7b7d2d2d09000000ce0d798d263bc164d4f9a9a7625b37adbbb417f4f75b47730a9fc547a0882b4998ff1e9c872324e6b35d748439f77020ffbd27df191ecb4a4faa3d23cdd3163cce7606c12f6344b7bdc3eba39743594607707044a0b2f5e629e80d967e4f7333c7a5d1b5b03e6ea56430464bba1480dd345833426fbda9beec7fb01911ab17b89412cc41e880743245aa3cc61cb1fc993f0b49c56c6ad6c27c56dc9582"], 0x15) process_madvise(0xffffffffffffffff, 0x0, 0x0, 0x11, 0xfdff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1, 0x22052, r4, 0xfffff000) lsm_get_self_attr(0x68, &(0x7f00000015c0)={0x0, 0x0, 0x1020, 0x1000, ""/4096}, &(0x7f0000000040)=0x1020, 0x1) 255.052626ms ago: executing program 0 (id=92): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003480)=[{{0x0, 0x0, &(0x7f0000000480)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {&(0x7f0000001940)=""/197, 0xc5}], 0x6}, 0xa}], 0x1, 0x40012100, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x181040, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f00000004c0)=ANY=[@ANYBLOB="010000004000000080000040"]) r5 = socket(0x8, 0x5, 0x0) r6 = syz_open_dev$usbfs(&(0x7f0000000080), 0xf, 0x8041) ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f00000001c0)={0x0, 0x2, "4cf90fba85c830e42a3ca4b10f01bbcb15f3806c4853e7c44a6974759d9f643905a56baa4195fb396d9bfa306999f1586e5d1ca49add100a36b751a7d9fe0b182ebf2c8a0e66f72c1c08260030752f07cd4089473e52885a3c85bacf3ccfac5bb9435fe036dcfccd7254bbd8bce90e2284d29e1f17d6652270fd0abcb8729f16ff602b438bd122a9e09984e2799d0dbfef7533d1a930ea4f4b57605ace45f5815450693650ae122d34aa0c5ca5e793516d156e5a5b34d6c17c40d753426a3d8e15e726d0f2622e873e0cbe63751bb62c68594d4cb0a21b92ad2e80f24a9b290a87ee6779022a0b7f5223e4e8c9f53f501ec8c439724078fdc076a51d50760566"}) ioctl$USBDEVFS_ALLOC_STREAMS(r6, 0x8008551c, &(0x7f0000000000)={0x184a, 0xb, [{0x1, 0x1}, {0x2}, {0xa}, {0x5, 0x1}, {0x4}, {0x6, 0x1}, {0x6, 0x1}, {0xb}, {0xc, 0x1}, {0x3, 0x1}, {0xe}]}) poll(&(0x7f0000000000)=[{r0, 0x8300}, {r0, 0x8441}, {r5, 0xb110}, {r0, 0xc8}, {r6, 0x1801}], 0x5, 0x0) ioctl$UI_ABS_SETUP(r1, 0x401c5504, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) (async) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) (async) recvmmsg(0xffffffffffffffff, &(0x7f0000003480)=[{{0x0, 0x0, &(0x7f0000000480)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {&(0x7f0000001940)=""/197, 0xc5}], 0x6}, 0xa}], 0x1, 0x40012100, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x181040, 0x0) (async) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) (async) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f00000004c0)=ANY=[@ANYBLOB="010000004000000080000040"]) (async) socket(0x8, 0x5, 0x0) (async) syz_open_dev$usbfs(&(0x7f0000000080), 0xf, 0x8041) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f00000001c0)={0x0, 0x2, "4cf90fba85c830e42a3ca4b10f01bbcb15f3806c4853e7c44a6974759d9f643905a56baa4195fb396d9bfa306999f1586e5d1ca49add100a36b751a7d9fe0b182ebf2c8a0e66f72c1c08260030752f07cd4089473e52885a3c85bacf3ccfac5bb9435fe036dcfccd7254bbd8bce90e2284d29e1f17d6652270fd0abcb8729f16ff602b438bd122a9e09984e2799d0dbfef7533d1a930ea4f4b57605ace45f5815450693650ae122d34aa0c5ca5e793516d156e5a5b34d6c17c40d753426a3d8e15e726d0f2622e873e0cbe63751bb62c68594d4cb0a21b92ad2e80f24a9b290a87ee6779022a0b7f5223e4e8c9f53f501ec8c439724078fdc076a51d50760566"}) (async) ioctl$USBDEVFS_ALLOC_STREAMS(r6, 0x8008551c, &(0x7f0000000000)={0x184a, 0xb, [{0x1, 0x1}, {0x2}, {0xa}, {0x5, 0x1}, {0x4}, {0x6, 0x1}, {0x6, 0x1}, {0xb}, {0xc, 0x1}, {0x3, 0x1}, {0xe}]}) (async) poll(&(0x7f0000000000)=[{r0, 0x8300}, {r0, 0x8441}, {r5, 0xb110}, {r0, 0xc8}, {r6, 0x1801}], 0x5, 0x0) (async) ioctl$UI_ABS_SETUP(r1, 0x401c5504, 0x0) (async) close_range(r0, 0xffffffffffffffff, 0x0) (async) 254.591486ms ago: executing program 3 (id=93): ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) (async) r1 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r2 = dup2(r1, r1) ioctl$VHOST_SET_LOG_BASE(r2, 0x4008af04, 0x0) (async) ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f0000000c40)={0x0, 0x0}) recvmmsg(r1, &(0x7f0000004ec0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001240)=""/99, 0x63}, 0x5}], 0x1, 0x40012140, &(0x7f0000004fc0)={0x77359400}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x54, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1001, 0x3}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000000)=""/13, 0xd, 0x0, 0x31}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}, @release={0x40046306, 0x3}], 0x5a, 0x0, &(0x7f00000002c0)="1920ff09471b1099c7961fdcc405843a41a786d3ed8ebe8e80e4b4144e1cf51c728b926c80eb2a8e4f6b2dab5b6ac95dd16066dc703442a9132a8dd210e45df98d795a638622681df1cb222612051f612948409bc69ce5464f37"}) 251.308306ms ago: executing program 3 (id=94): mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r0 = userfaultfd(0x801) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f00000000c0)={'#! ', './file0'}, 0xb) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) (async) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)) (async) ioctl$UFFDIO_WRITEPROTECT(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000800000/0x800000)=nil, 0x802000}, 0x2}) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x1, 0x1, 0x130587a6c4d48421, 0x0, 0x0, {0x2, 0x0, 0x6}, [@CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0xc00}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000080}, 0x24000880) (async) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a80)=ANY=[@ANYBLOB="14000000550001f3ff0000000000000007"], 0x14}, 0x1, 0x0, 0x0, 0x4c504}, 0x0) (async) r3 = fcntl$dupfd(r0, 0x0, r0) ioctl$UFFDIO_CONTINUE(r3, 0xc018aa06, &(0x7f0000000100)={{&(0x7f0000800000/0x800000)=nil, 0x800000}, 0x1}) (async) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r5, 0x0) (async, rerun: 32) remap_file_pages(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x8, 0x0) (async, rerun: 32) sendmsg$netlink(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000200)=ANY=[@ANYBLOB="2400000064001f03000000000000000008000000ffffffff"], 0x24}], 0x1}, 0x0) (async) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) (async) r6 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x511300, 0x0) ioctl$ASHMEM_SET_NAME(r6, 0x41007701, &(0x7f00000003c0)='\x06\xeb\xa51{\x00\x00\x00\xd3\x02\x00\x00\x00\x00=\xb7\xda)t\x99\xee\x86y\x1a\xfd{\x1c\x98\x00\x04\x00\x00\x00\x00\x00\x00\xd1\x88n\x9bA|\xa3\xd4\xb8\xc3WT\x8f\x06$\xfa\b\'\xd8\x92\xd8\x04\x1c\xcf]\xe7-\"b\x1cY\xef\x1e5\x86]\xe8\xa0C\x8fi\x19I\xdeA\xf3\xee\xe1\x172\x98\xc7\v\x005\x9c\xeb\x00\x00\x00\x00\x00\x00\x00\x01\xfax\xfaai\xdd2r\xd9\xebF\x8f\x95\xf7Clu\x9b\xbf;\x06\x97\x8f\x92\xbc\xf4\x0e\xf3\x89k\xaf\xa9\xd8(B]7EG>#E\xc6\xdb\xb6\xbaZ\xea4)\x9b\x8e#\xc5\x06RK\x86k|\xe6\xceV\xceQ\xd4\xd8\x0eE\xaa2\xd1\x8c,\xf5\xd3 \x82\xa1\x9e\xaa\xf3<\xea\x84]\xbeN=\x80\xaa!=\xff\x05G \xcc\x87\fBX\xe4\x92v\xc7\xdd\x8f\xcc\x996\xad{\xd4\x12r\x11\xaa\x85\xf8r\x81\x9eE\xc2zs\xe4\x90\x1b\x06r\xfa\xc9v\x82') ioctl$ASHMEM_SET_NAME(r6, 0x41007701, &(0x7f0000000040)='\x06') 249.518746ms ago: executing program 3 (id=95): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder1\x00', 0x800, 0x0) r1 = open$dir(&(0x7f0000000000)='.\x00', 0x0, 0x0) lseek(r1, 0x7fffffffffffffff, 0x2) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1100}) rt_sigaction(0x19, &(0x7f0000000000)={&(0x7f0000000340)="dfd3bf2e36c07fff7066440f1ed20000d3a41039000000f344aa643e3ef08104dc19b4000041d8d041de7dd3c4e2f9db8179d90000f3410f5d4efe", 0x5c000006, 0x0}, 0x0, 0x8, &(0x7f0000000440)) r2 = memfd_create(&(0x7f00000006c0)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\xf2\xed\x04\x00\x00\x00\xd4N\x12\x9b\x1f\t\xd1Z+\x86T\x16\xf8\x01\x00\x00\x00\x9f+\x8d!\x0fG\xab\xc2\xdc\xa3\xb3\xae8\x9f9?\xefo\xa4k\x01\xb2>\xa1\x9c\x86xm\xe6\x9bZ4\x91\x1a\xdb\xdd\x89\xb9\xc0LF;\xd6\x84\x195\x06\x00\x00\x00~\xf3S\x12\"p^\xc1jP\x8a\xc6[\xbd\xe7q]\xdd\r\x1aZS\x01*\x1b\xfd\xbcMA\xdcq\xa1\x00\xb3\xf9\x91r\x7f\xdc\xf1\xc3G,\xdb\xccS\x15\x95b\x17\xab\xe4?\x81\x84\xb8\x92P\x99YO\xb8V\xd5p\x90X\xaaf', 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) socket$nl_route(0x10, 0x3, 0x0) fallocate(r2, 0x0, 0x400000000000000, 0x7) poll(&(0x7f0000000140)=[{r0, 0x240}], 0x1, 0x6) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x33}, @flat=@weak_binder={0x77622a85, 0x1, 0x1}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) 233.799056ms ago: executing program 0 (id=96): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder1\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x2200, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_XCRS(r3, 0x4188aea7, &(0x7f0000000040)=ANY=[@ANYRES32=r2]) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r4 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) r5 = syz_open_dev$usbfs(&(0x7f0000000000), 0x0, 0x1) ioctl$USBDEVFS_CLEAR_HALT(r5, 0xc0105502, &(0x7f0000000040)={0x1, 0x1}) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) ioctl$USBDEVFS_BULK(r4, 0xc0185502, &(0x7f0000000080)={{{0x1, 0x1}}, 0x119, 0x401, &(0x7f0000000380)="d83481089690d493c46207fa1e224af9e0bcacd4db226d1127ce512fd14895d554493921261cb454e006a8fd2370c4a6b41b8f4c9091e8f6d66245ca36b5dc125ff575db56b78380e944e36d36d0d3ebfe7993fc4df4611629d9edf1e3ebf52650d7d9221600672106befc441c81f64f03b55be0686ae9c039ca27b72a55b231f7b9ffa61260fcc747cc60499f4fcdf06e0388c1c683d504efe352294927b6526576e039567f2071ba0392add5147097d2329541ed78c29c26279e058d644dc1729bff8713ef205a6b9848ac609bd3f2f836a5af7def7f8136475bf0eac97648254723159bbdd4bb92c8bde9209bc4a5cc555775329e375b102c1541e58d64c36ff0f658bd213f9d7f34a3390c0a9fa51c0c83272729a8d234"}) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r6, &(0x7f000000c3c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r6, &(0x7f00000001c0)={0x50, 0x0, r7, {0x7, 0x1f, 0xffffffff, 0x22905a40, 0x0, 0x0, 0x1, 0x8000004, 0x0, 0x0, 0x10, 0xfffffffd}}, 0x50) syz_fuse_handle_req(r6, &(0x7f00000061c0)="c0f61a5fb77193bea0c6599de09cf570067192ff7d5bf191681878eb121895cd4c4052feb0a5196b61ab6e28d35aec54bb2aee6802a27f50c4e8f36a2b1bb12d93dbcd320ed338fd1a8ed43a2dcb2bf11c773ae982800321c7dcd67fa8930472eee2990090cc2a92f3373d898573a2cd1712c18ea624e82422c96f0d8895bfc4541911ff3662cd28fd55d795d1a5f31c92defbed88d48db688f899fe88997b057ce3e898eaf9eb2e76a59c1d2c10610768b3296595221c2b063ca2aa664fa0a5456c4e2bcddc7f856e2e29ce1b8852997a4d24f918408bfa9969074de495dd4cc9591e48287d78a2b3e0de09b48eb5b6bf78c6afd134b09770c164000d1f300c92877afe8be5d381c38da3b5fb9bd540c2f43c7dd2ec8dcff2af3517ba839c827866d10608964445bdead091df1264f5591e91d2f31b2015dff1b3b7ff0a5dc8b15748278849ddf4389ca7112ec1ca45957e2809b3d763e336f7051ac4e832ec61d1b95b9266565293806933dd8e3b65eaa1b4fe7946056703426674379ccec7abff1c459b91248f3a1d9e8103ae395aa86dd4235a5c16d9bd12dcb1ea9565a7c3d58d247a51db6d9077ecf47152d0733d79a5c449480c40b1cf8e115df4de3404b73ad06ac4c0d03f3b51d1b89b05ded082a5db1f5fbd8d351015b93862b2cc0995fb318609237e404e8d78d8982af761c27ad1fbc8f4693194c5e6b99edcb7a6e9dd261a386d8ed4420a7c12cbdcc86ab19f4e7a6c0c9b80fa3f0549ae57b38a93f669a87584b81e56211b34263db87c2d244e422878aa93e2c24260c71d06f75da33079b48b7072859669c128ba03d1487336a4a04167f2a3fa928d002c8b3cafdedf7a479604aa8f94e6b7ba58395df3d136b783f7be6b0b6b7b4b735c88a53da064a493b16713726b39ce23f08af19a671fe81be1e9772d87ca9cb5dccc35759fe3f7935a3167924d0a7d1586821ffebe0fa57e72a24967f7958875c4bf56d779369074db0077ee58138400c2f646c645e0f453e9e39aaf48da67775f59f8e282db3dec88bbe20ca6e65e2c7e44ab0583840513bfab76d94d1512549ea6db4a5a64cbe6f76b0ecdb2f1f71aa6446bcf4f7249366474cb77ed70ccb2702134b9dc6c2bfaf27ac9a9c85b8d9c48d100ae8c0eaa34701d2125a405b1117307119b754ccbbbcb2c8b71eb76d1157ddc7fbe0c75652a4cfc31d785a489f2344d8b4c47ff1b772104f49658f62d6241ef7f782db0cc071788b3dfa74e69533cd0a02ffadacdfbc8b5a83b9d4b8db068b5a7370f947fc4a99158c6296a442beba2e23ac1ef68c50f19851f3fb68b67fb714a5e7e53bb5a7690286cac12f2b002e854d8595075fbd00622b29bd423c3dbaf600ad6f37c96dcde43de6290b053c76df5620ce17118e2230039304c88a0d207c7cd05dd3854c545cdbebe907cc4d3411a382afed5e080502363cebe68e2c8dc1f800ea4add827a83a9cdf0fe6d54eabfca5a0ba370a06a4af1c49a60cd19141a4d994fbcce888278ade6300bd40685267fcdf1317cdb3b06cae9e7d9edb08d5c98b6d7115c025fcc05058a515adcc23c65ce526aed3b8203f3c54986f65ba9ffe2a9bc26b2813a1fe339ba2a58515cb8375e2d62550bf35dfd4fbdb75a70bb9fdc47d3d0346a65b986b7efd12aab760124b6888480b341b16ef2fea93fe2fbdeb55706690aa2c02bd80b1ccb7b8f23720283df89b515e2020bc5364cc4aea5fdc250f10d46db93c128e2de7477f4c80ec016f7a872efdef50ae1730b3a1deb8085d82f4fd53015a518803cd02646c087d67b0fd7092852dd81ac93ca60346f23fd847cf7c4883cab81af956342da21fb399b69e1988d89f9693b0630fa8cc95714285940d20eda153f8f7b0316b2b892327b5d1e754a36a3430c5c22c3b841357eb80e526d7792a8ab9c4b1d23d82e31f23ef38580c2b33ca72424fbfbbf237f315cf2e5d134783982cad204be087ef58da96c6bc5da2dc4bc78f293eed56157a10848c0a956de15b83daacede9ae1c54731149f9ce7231cd84e14f128f87361e1fc0cdb2940766f39c93b9ddc74bba0a32548cddb1ae20981576de2ef8a772b04ed90900b2da11ffc70bbdb7091b8b8ed600dc0c9d236277afd9bb97b035f3b8fc95ef3f30c056b67a195c5c9f44c0f2ca4debba0d6d8779903e8e34fdd6b766fbba6b57e722ad9a852dbbeca8eb9acb9929bdcb4d4fa57d54ef1c1a0fdc032a898d3334f5671c7df82361b7d616c1f87e23f7adf043edda83458051f073f2562904ed25ad9a7129f3c14286007c9e4c81ea56c6a7289d8e58782d949a19a2642dc89d107fb465d0a98128250e66eedd93cf063963b7f7a0e1d3b9f1dd212cc9edd662af45852dbbaec84c69a640be115a239b5abd46d990fa007988f6be78a8c1e426091ecb33822529f7fddfb34d9304466ea06bb546a34735021e98674ae4a5f5c0b4f153ad5434b81c6343c42ae79224fe5abfe8b9e6fba38164c3c318500c130323b2f9bbcdf6aceb664e10483e2084defa744cd745e565ac5a8b5c30166330dd95e70f2a072a5cf5462635f7e0a4f455bcb607426aede9fa06d708c7c0daaafe2b84896134ab3b379c6690c9049903156232e5b7ca9529d602968f1e1f7a73214aaf4a9575dd5147e5bef8f05907267580abdb728cf32f6845cdf3bc779451669e4972e0b787afac5a36bacc3c1bcce125e91e4bf9810d91d1f1a3d8316328dd2626040af09892f1241c6645537ebfbeb752afba5e8171f487edba97aa92404973d4e8d09254abd2b70bdadd9b98fa3c33355295a5c474e9b2f017a6636233a382e8ef4e73506880e2a588bf257b6bb11e57cd9e75e45ef609ba583f3a6b1f2f94c7a0443dc0a8906a13e0188b61550cd296e4c63faf45bf7aed852f68ffed377302da3f73d89e4274a64667636bf00e8e4408a8407e098aeeed98e545b9aef40896c8070a76aaa0042162979ec0b7b69b4ee701100d66d3e7d25a48c59989424522889b32e4f18676475782e86d652d2eb836c326b46b8544bb755eeb14727e5ca25875f7b9ae1c113068be55a1521cb4edefef34a7a4cabc3639e456c94f01d78c059c441ce2c468e7b39b56555ad5cd6a14df8e3518e4e1970fbd6f586ce46c51c4d9ad20c3f7f5048c071994e807f19b7176290a82406dd0ad3f0b64350bbce79b223f27ed99f819def43a33696c0739e09030460a5a5d04d251adfbde1af7a485894d3d30c79d49796a9a5e077aeddba1303f3e3a3187298c88da70885e2a9dc966eb69a6439e2d3b1934ae6e8ea328497d87a9dbbddbdbf12b0c582ca4ffe1f25cdcf89a6ccdb31880776ab808b4f050ae02adf70f64c73ab2a3b1c4da69950ab4f7bcf9cc22f81b99694a7783b792facd8197904c12d3776de5184afa143ee23eee82aab2ac79b25503e0692f3463e5c363e0b4b5f31af82898009f7da13d4f249a70de40314c003e7e59dfb233bc44d0316df3e45af806d216ca76a58417ff8abcdf7cfea2da8868c496cdec8f47c451ccdc8908c5e8c1039b6bfa8751637c29fdd9b7dc76279dea5ad7455af4db3394a34cb9be8b9bf1105862108f920c44d029c3372e77c44a25d06cba956da65ee40abe32b8b557e123fddaa87b4ed5ab3485eb11f13c61072720d4adbb937c336f2b60525933b6d49e7c6751f0769377bdcef02abe63639b17a6780a4afccc8067403aeea42726f253ec97994dcf55358e6faa3e622344dfc613f8be96714d5c49633d7b74b9a72883985782ea8691d26da620d905f3583adbd9d527d93f1ce623bcf70d98a0455ff80fb1d472c6fc6bf0390e81b8d755b196e94fb73bcc883f5f310043c5138c95c5d7079c24d5bc5876b422f46a2bb17aee407bf7a55dbbdb253e2865c1b91839737c37142a8fe8bdbc0a7bf89a392da717a5ed87af754052b1d0a1a37313b00cf3b4aad91ce7fa7777b1851121a63e374865b238ddf9a7ebd20641a719c68682b97e3c5126e732800c04cdb627bd415efbb7e5e19917bf4bd53f072b7ec2eaa0128b56e069a32e9f729718fa4a7212ab0fd1e5d3582a5723a704d84a88c235b44812849301ee8155cea471028beea1918cb1f4118728718674cca9dcc58bafcdb9379c57e9333ab348b30a801aa2f5c05c3107e52613cf0f591781ddb5e1e4844633057a26bb3179c31b5664db4bb8c6d762c7b9886317ab6e9e301de67f12085547ad2a20d1d63d361c2bcd66be2e25fe104f8b53b7cf89d90d456f063da31f60078b760ce340f9c9a8e8da113b6c6e3c53e666488d75ab209dbe31ecb531553f17446a29edc465ed22aee2d4c013ee8a4d935c0cd92bcba9e5a56a6c19ac114d12db58bcf5f931a7b282404af34fee464f4c28e16dab834de98dd57b107e45fa66b26c32fd94e848aef6e4a2a65fd4fbead1b1d445d6c343bf50d785e664220371e27566646e284c6a3b07c14c0c5b84b5cd1a01a84d655f8dd72ab8e3d0c48e67596f605cd4a50b5fde9b182792d7ee8ee457eb6666aadea80563b4d176933cc482f75cb98a8dde4a414041187cfb2abe3e5077f23c98bafd0afb8b023e0cb26efc1488dd98a51a19dc93412b5fd91c4e06439b6d2d20a174989f860de6b1be55923a11e5893d30fae74a625f777ef9362e64b529c964b5c0b5817a579a647ded28582c45f965e52e1f76084267c73f8fce8037b22c2496ee6674f56056d9c691eab831c831a27fccd90f961e949a51c90a80b677d11e70d01744f9632cc26b7e6476b8c92a688ec8e1280ea8b795eae7ee61e2735045b9ea516af752b35388a6c3ed98cfbc4e74c8d0717dc31eac87b6a9c06f0d4f412e8e1155ce48cec6d9c106f3013329596a2d43ffe7f942cb7b7449f38620a8a9e5138b5d5d03c8a563446e4dfb1905d841f7a350d6c67d85652297db21b3dd3291b795c90276ccc50eaf513f3ff9480b3d2c0096e92c93cbbea680833cfa630d72c4f5a21ef0f81910b8a5ef77d62175d3abf5b3417cce43e3c541b84ee1f5e354b2d79c2b46e3bdb2ffb15420e7a28c800c2591cd331d71c645a6b1bc43f06703164c05f61b4abc0fecbaee510def6340c2bbcc32248655e9161c3e6f01520bb0c53be04c3a3ef4a2dc401663f6719ac758aa297f65d1681652e4ad042d754b054df9cede3ffef7ad2f52184ea6d93d6867cc262b0a413da11c02d0c7c49a663319333d8b29d56cbf630e66b6683ff7f3b1ce5c481d37151626eae761adb77642f802bf0f663f3c322ee17cf01a09f058dbf82d04bdd7c48f34f54392d1dd489891ce28373ae980f74897fe3f90db2a9ccdbe56160fd2517adbc953e88c5fa8981456b87ab9f122321816e0df119f6f6c505f0dcab1c8e6a7f4109055dd80001dd90ea984b80f0b0766bd9772d96ed42d95f219b4a8420d7cf04f28475d7f5d8a8a07b0930c40d0dfc2592f8f54e90a80e0a98d3055f4660b1530565c7f2d91d7d96142da19d644aa7c512e24f83e8305970f9d3fc3b9382ad141f63f2d5b265b7cda258119ca4f553fab11f2fd925a7a24c4021045073d867bb089ca7bcb702bcedbc28781e408cf8bd43498f8661a320d28c95c1fc42635c9e4c4de8787afc70bf5c8bf75e0a2937a9ca2b08c15453f24211168c7fb2a24218fc3f04160c2daaa46ef7fb710606a53228e134f20511169034cec55e77037a108060b8fd10ab9ae228d9ee4d5ab1380cfcb8611e6c9d5dc143db2bc856d967b0b9d0187ba8483f7adbd1092562b2b16420baa5ab6c1f7c02ae56f013e752d9f41df4b4f0b008bc25ff58f816e50bdce308e219068bc898a21f1dd26d7fe7760459629f3615bcf7582c87d296f041fb005a72c7ef4013ccd8ca3bea85db90ae6349f101adb9235dd343be423816b37db2661dde2b9db33800da7599e8a9194fcf06755e2659670c62aba1d5a01172a416a0296bade0b32e69b0ee60dd6cd1eecca4335eb0416df6ded75049a14660276df47bb4f224e087235742e90ddf6f57827a0cf26d71b9338f2ff5166bea85a7639de6ac97ec829a7d071fac1f4b27c6c23e952adb5536b45a68e75c1c1a6d44508be6f4b87c5bb880a6baad5faecd1fd6730783d8729c2d89b23a3f2f9b79b78f7fcb70a7812607b25b17ae857e65f205ad5dd87a34e52c6e9611f588236bdc59d816f277aa8cd4a19750461d3e82c8621181b803900d1df439babcf4909168d4125a7c962ceac2f834d79460f17f92f415a85ad7e12da4b76105bceb4641fc87da7797fee092828f6e9e42631fd5c87046ebe5c4044663a31a1b39a6f6a53ee2b7fbc3eede57619535b1011c10d2d5a97c781c44bb6e493287528bc5281496f1aee3c746e09aeef0b2d38bdd33e37446c1f7516767ecbe298b78ef8e03336a08a1a9e62805140573b034459a445240aff04593539aa97056957f3dec9c43e50a1bce1b9c8e860940e03ae39e8f76fb80ae746f7fa4ed0b050c9e08a788e666e9f18bc8e83c64ee3ea04eb9f1c1dd92b3be73d18cc53bca76b00688b48c13982ae6d25fdd9b5b85612d5b706c9b9d7c6cca91141313356f0d7b859da0de669fb52a829014a0fdde51df658303ce085222a42ad624ee6c659ec94e0d0713b2d3c3becb53c6f76d30530e6129943e20361a7c9f7847f79cb871d866b5277eecc8c1626fe2719c9cf872c0fc78a98e6ca998555721e9abd5bf9e2d1848016e0bd3202c44575c688837136e71e85765d677e0f2b081707a4e7e22bef50b9280a1a5ea549022ef2a9fed989f156198975302608dffd03f8f1186a12585d4670ce868f0c96be37416b9132144f65c9abe8b00894d7a7e6d0a8554e09139ec2a0eb6d4f00c637684602c106257f5abe816e068e0f6f3e94a916ff41e23b6baa4876931209a6b0bce1f6fa8d1965665d3dc42e5c6b011bdb5144fa5fe4879779ac9dffe0843cf49806ecbb615b818e54c6dfe4d12ccae5b12b0ce87909c1e852e8d7587d1ee24c2575af61eb0b667c37b6d15b88121974598ac23cbc66503f95cf01a7a1e217f0712c4cc4e5fc22e83e3aa375eda531a73828eba91223d7de1194af730bbf2c1ed5ec47ecdf465b1794971010ff8c8771c488a1d3f98292b5d2ea9625e52589aaf7212fcdddcc0f1681b785911fcc64a6427358e4307a3d8bc583dd635ba5c41eeae96e0b6bc5236a1f539d291e568d5a0aee25ffbaa73d0cb84bf558cbf6d04b16ef7e97617b42d07100d82fda6f75dcade611e459bdb4773bf2b70e90a8add2bfe6ea6d3a4427940fef6c81931762dbea6678fc63e50c4430227b15cf184dbae4c3b2d8096292c17f701c560ac7cb33efe7d79d0c2a3c0c06e22d4e84e9e959697879f0d27df460046fc20394655cfa19793256cd9074f1c5f8ef530af537164e0e43184f921d56094fa7c7744af35821a5833c9b9d56fcf525a39fc795cf33f14705d0c7087c081bf11ad29e4d6c8fecbbb3a0d873262b89cfc54d4cec42c3e13a5ba604df942bf8b4eef7cdae1c0e2970edb7ea6437618e6f8312a745ca8bbf0c42df103f42c824ab4e77e8b118e2b9a84568ed3d4aa3800011d02be29c032192719635a1c6c28315b27368f6ffe852bbd661c351cbfbf97b1b36d52371a4ce57e5eb6e4b13cd01b022de1770a5b1cab0fe548092a16e04de76fb8d29d69a1c55f8aa11b34bd6f018d283a9a7c0338b8c1900e21c0054616ade6b56d0fe3379f1a8dec38b85fa8e74e9bb5df4287d037f77bad30de89ea87b03d40c3a1618db1073c07032f6d22f8a264cbf0c1113689308a2fcd7299603a64f884cb03f8c5f0e61e4981d2baac3d50975cb917b815efe2f7eda88f1cef1f34997f0819a92051c1d9eac3ef05de25a2b4d5f65619b4ea377180c541f2afbfa5c8fdae59f8e3a7635d2b30c4c759c32e570b8d9ec03b4aab65503e81e545dd41f593615cfedcf009424ae4854de3a9111115cb254608bc2666b18c85698ac193a9799f1a1f6098288b42dd2684db37e0d3b023ac9b417263b1566acd6d951df147e83db8e909b39bb6a1aa3fcc1c1a20795521b84e0884254b2524ebf0321e5709e7a79f2d62309247b7b24ec71553a9ab9daccacac1a8bd6019b7703c0ed468379640ac6e764ededb2fefaa2f88e15fc97ec6f16007f540cd7a57c7726f4aa9ff6640cc7f5d71a6c12048f98a9071ffd594f17e42e7336ab6d0fd429328df1238e5eb4ebe4f9d8ef01fbcfe8f53eb3f6defd4c7cb40b3772ea2f2130b655d2ad3643977cafa991bbc6aa2aaa2879a3c2d1dace3ec034beb3d06f0a09429b3fd1ac06870dde4ab97b7d5d7ff1394577a6bea7a3a53ca883a16c98d574ddad00de5dfe9f75369be7686a4badf44f4d9b110846b6ffca67f63973186433f6bc3691b580cdc689c159064c55a974fb849f56fd2f9cbe4738e0a1a8a764467dc1d3723278ee1ea573fad98a5318104218d359d89579614592fa6ae7cc4720e6ed71706fdc4c707b03ff77454daf4505700f249aea0abc909763416d44a069a6d605118ac0c20a325577fe1d8af053673fc72e489d24405281f01b4e2e05e4fa14e68a53294e4b5d201c146ff994cfb7a776ad80828732ee647092c20fe46d917142880318136557c47ff7e31d26f35f407c1e6d4254aae442b233b89dd4c0adcfc92b0f821a5a9dce95a24bed9bb5cd17a5b59d3e82086cdd7a3755064e4de22d8f0f973f4235aa58c6214dab89325638d94d3dc25f3ac4d912ff74be6ad8ef49aa2becede5453a409cc8ed8065dacf28a1a7498f6dd07a3478af093574fdd2d0a4f98d12fe898e47cd0550f1fc42810ed2e4cfe5cc4faa67d965f252aab1bd5c536bf2c936706bc71aae98b93494d364faac72a9a60188a23f15ddf1238896e4848da876789b57ca53cd5b1041612a49de9a64a545a39375aa2a516c4af4744daf65a9c28ffb635ba56b96731b763934afa0651fd6fb65e9f71eb0e6fd54bcfd2bf0118b486e97db512290bdb1dcfca76ed974722e13e5acd0569d5f944de70adf728379094981ffaec43848367ec8cdcc227b266649ced47a03b22016ce42be3a33135229670244cc7b3325ee448c95236d0de4bbf641e1cbb0516edb3f8829e60f91d43f0fe45595d8a99e699252930c7b05ba2ba679f8f46c38f789a7750ffa4eaed19c4c1a33aff60c8926ae42497662a130b83b3211e9399e2565d9f082ec30e26e5b02ea91cf43b0a046f9fe596e5bb2a9c800d761008dc7fced2a510af6b02d3f702fc3e1a98c6a87661f0d353b81bc4435c0d4376cfc74c057bf23febb101252c4eb168d4e347e697c8d0c48a687fb2224d58e5dc68c38de930164aba51e7cb19051fe64603c6b602c02c5cc22c6da1c47d906fa1cbf67312658b201b8f89a377d61695daaeee18eb2fb8caf38280fa8b95cca721afdf33d2c3092af57204bca72c46aeae9e9fc46f0ce76b96bbbb59a8517cb72d68f8b189280b6ce1e2686204913bac1d9aecd77623b7f05475352e57f245197894d767e5f17611bbf1bfe2015c9750e9b3f5ad4ad57be1ac4988c30d90829946b05fc5bd709dbd2590da2e3666294f83336e52758bc12c9d02af342a91fdcfc9144021a783643a9845a4898ee03417329ee0e2dd7bd53f3b23f3f9a10ea643b91b3c2df8438efb22fc894bbcdc408a13dbded7002d9cef6e38bf6dfa16f52f0f24087281a3ae95fb4995131938f9ca80c5f466c7367665e5717c823b318f43e7a3e2e8fe9c2e74959ca3d53b79fa45ac778d0a99351a1919b1c9ddfda10d61487fc5a2b8227493b14e2ea9fa41db870deb1700eb46665424fbc3f21c5d7ad61089ad0f99aadcca2a97d46fd091cf21d95674c3cf48f2724a89299b5342ebf8b18770e61c449455f77cacc5b2e0123005cc296acfc28e42e3d3b426469e39def114d6071a3f015f94dd8eab597dc4cf6109f2aeba0639ffe3f66f15ddaa74460a884a5c067e1e6f8d961ff32518e7571d53ae36badcaca50258a15743e67fb35e062e697d44ccd4e416010dbe62a1d13319d3ce88dc7826514d0f84cf7ffd5f1dbdbe3534af35bba26c5f951e18b012234a3e1cd22199358ba66421a326af09d36d45c3497c4725c0e8557395376fa9dcbe4c595aef7f822cb160e72138cd610563c382769b64f5da2ae6f62cbf09d24490565d7b88f6fefc30f050e74327b7efc168f040f18110a61cc6ecf73c43c0e9e73fafcfc6079ee68839a8ed710160fdcfd987394a790e01c42c916169e8c6a7af905c15d51f87e88877386b8f8743efe4fffc2dc8fd73b4e8905b428d4cd87d90e93513f19a981b5037370cd634f23859cb7bd6b5632bd25c6873b7195691e0f76fb07fce6e72d4b2b467e57a325febf4bb842820fe6896b23aa2a3eb37697753a3693ee936692e6cd91eae410bf89192df913f2689adc73b7b35eaf8bf80928c0023b105cbd2be51a08a371be88926636bd590466c218b203fe311d73dd1a8b440133f1ebb8249b4e1f6723b7b18b508dc34acd9da927ea60d2dc361c2d14cd43ad3b0137ac32e8988d11d11de19065d02e8012a2ee24891541989d11da87de4383036b757769222af022e86803b64ccd03e4bfe3a9d3b8a5d6522d7b6ade88aca72bc436382cfcba22a426ecb21366d42588e9a68c0d61722617a4706852ef6e5eb42842d127f88dabcb8cd635d621a9082efe0cbb52fffb017c8cbf80e48ad1d8ac4c927bda50be7bbb6a302081951dd7c05142465ef8188774807ba482c155f7b56b663d24c4ad88140ddba388e4d6abda83048db46ad18328c63006d02844189a769167d94265148e06f3eca08dcd81691df655968de44c5931e62f5dcc4aa16b24ceb6e7a2c8783d9918a9be7c72dcd57fbf39f985ac29069241cbe3298d7651124f03bef8e2adcadb0c0e08efb096f72e5df2d3f8e2ea6f9cd2401533469e5099a6faa98acc2f73028eae115b3a771bc7ddd186ee7a634398e206ce9b1262b1dbb80575eac718eade048bc01ac1d410e21393dada6c1ced94c411fc19ccacdd175996501d66819b491fef65697f736ecc3a4c32f3675d1f90c8e4d44a1ba6048e77fa24d6998ad88da3cf5de223446d53dd72981c19d5915af69b9a7b9bdf35114ac1cee66b9f3f6df4b9a2d2c017d44443a28badca61b1e8db627d967827ebf32c8642b7de41508c15538b6cdf0284f1a94e8d9fcaa086236f11fb1689d57d500423a0c1d362a4fd57e5efa8858c237a0b58210b4df2b6f10fb01ff8b305cb69e65120c716970e1752cae51022a068b9ac2b7775ac415c56d31536c9f1eca654ec89d7ed00855b2d2564a74bf1a0a3b75cbeadad89fd4ce7e0a83a565c6d69077f026dd40ee186fb496d575c5f5d2f4f84e0efd6bca34f070b185903c7fcd6478f467b73687dee0b765477cc474cbe7f067d1f655efe1fac24a6cda9ed82dee343a36f5ce3894587937f31a14dff66e8384bb3c9adebb753f782570a894e09a38c096f523fbdfb7e0c09026fa023c8dc9e5822410d8343afd647a91130744017166a9b195996ee871eb284279fa725f7af7f853eb85bce100cfade5d458c4e166c839e4c1a86", 0x2000, &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)={0x78, 0x0, 0x0, {0x400000000000007, 0xffeffffd, 0x0, {0x0, 0xfffffffffffffffb, 0xb849, 0x0, 0x0, 0x0, 0x20, 0x3, 0x400, 0xa000, 0x0, 0xffffffffffffffff}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) utimes(&(0x7f0000000100)='./file0\x00', 0x0) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r0, 0x400c620e, 0xfffffffffffffffe) 161.835757ms ago: executing program 3 (id=97): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x3, 0x0, 0x0, 0x0, {0xa, 0x4e24, 0x9, @empty, 0x3}}}, 0x3a) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000), 0xf, 0x0, &(0x7f0000000040)="44ac16596a7ca557e7bd43565c6e37"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f00000001c0)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/10, 0xa, 0x1}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, &(0x7f00000002c0)}) 88.793898ms ago: executing program 3 (id=98): r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_int(r0, 0x29, 0x33, 0x0, &(0x7f0000000c80)) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000040)={'wg2\x00'}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x60, 0x18, &(0x7f00000001c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x7}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x9, 0x0, 0x2d}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) 88.205518ms ago: executing program 1 (id=99): unshare(0x44040200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2100, 0x0) (async, rerun: 32) close(r1) (async, rerun: 32) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @random="e5db9638edbc"}) (async) unshare(0x60000) (async, rerun: 32) write$cgroup_devices(r0, &(0x7f0000000440)=ANY=[@ANYBLOB="1e030800dd5c9801288563"], 0xffdd) (rerun: 32) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x400002, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newsa={0x150, 0x10, 0x413, 0x0, 0x0, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@mcast2, 0x0, 0x7, 0x4e20, 0x4000, 0x2, 0x20, 0x20, 0x0, 0x0, 0xee00}, {@in6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3d}}, 0x0, 0x32}, @in=@empty, {0x0, 0x7, 0x0, 0x4, 0xffffffffffffffff, 0x0, 0x20000000008}, {0x6, 0x8, 0xcc}, {0xf6, 0x1, 0x1}, 0x0, 0x0, 0x2, 0x1, 0x1}, [@algo_aead={0x5f, 0x12, {{'rfc4309(ccm(aes))\x00'}, 0x98, 0x40, "7a7721427b16add9e6b50c9917d0e0684cb2e6"}}]}, 0x150}}, 0x804) (async, rerun: 32) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r2, 0x45809000) (async, rerun: 32) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r5, 0x0, 0x10, &(0x7f0000000280)="00000000020001000003be8c5e687a8a", 0x10) (async) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) (async) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r6, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB='(\x00\x00\x00^\x00\r'], 0x28}], 0x1}, 0x0) (async) r7 = syz_pidfd_open(r4, 0x0) pidfd_getfd(r7, 0xffffffffffffffff, 0x0) (async) r8 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') getdents64(r8, 0x0, 0x0) 87.762818ms ago: executing program 3 (id=100): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x2, 0x0) r1 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x46d, 0xc286, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x20, [{{0x9, 0x4, 0x0, 0x6, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x8}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0xfe, 0x9}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00\"\b\x00\x00\x00'], 0x0}, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x67) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) 73.673668ms ago: executing program 0 (id=101): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x99b33000) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x89f0, &(0x7f0000000040)={'ip6tnl0\x00', &(0x7f0000000080)=@ethtool_ringparam={0x10, 0x8000000, 0x0, 0x10, 0x800, 0x0, 0x0, 0x4}}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0x2) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000200)=0xf) ioctl$TIOCVHANGUP(r3, 0x5437, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f00002d6000/0xc000)=nil, 0xc000, 0x0, 0x0, 0x0, &(0x7f0000000300)=""/192, 0xc0, 0x1, &(0x7f0000001180)=""/4073, 0xfe9}, &(0x7f00000001c0)=0x40) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000280)={0x1f, 0xffff, 0x3}, 0x6) io_setup(0x8, &(0x7f00000002c0)=0x0) io_submit(r5, 0x1, &(0x7f0000000000)=[&(0x7f0000000100)={0x2000000000, 0x4, 0x0, 0x1, 0x0, r4, &(0x7f0000000040)="0300ffff0000", 0x6}]) bind$bt_hci(r1, &(0x7f0000000000)={0x27}, 0x62) 56.147859ms ago: executing program 0 (id=102): fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) (async) r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() getdents(0xffffffffffffffff, 0x0, 0x0) (async) getdents(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f00004f7000/0x1000)=nil, 0x1000, 0x9) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) (async) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000300)={0x4376ea830d4f549b, 0x0, [0xa355, 0x47, 0x5, 0x0, 0x5, 0x7, 0x4, 0x10000]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r0, 0x0, 0x0) fchdir(r4) (async) fchdir(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x101042, 0x4) renameat2(0xffffffffffffff9c, &(0x7f0000000580)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file5\x00', 0x0) syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x20, 0x54c, 0x3d5, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0x40, 0x0, [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x1, 0x1, {0x9, 0x21, 0xff, 0x0, 0x1, {0x22, 0xcec}}, {{{0x9, 0x5, 0x81, 0x3, 0xdb24e55deb5203d4, 0x9, 0x8, 0x2}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0x7, 0x5, 0x3}}]}}}]}}]}}, &(0x7f0000000640)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x0, 0x2, 0x8, 0x6, 0x10, 0x7}, 0x2c, &(0x7f0000000200)={0x5, 0xf, 0x2c, 0x4, [@wireless={0xb, 0x10, 0x1, 0x2, 0x90, 0x6, 0x9, 0x7, 0x81}, @ext_cap={0x7, 0x10, 0x2, 0x10, 0xc, 0xf, 0xf}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x4, 0x5, 0x40, 0x5}, @wireless={0xb, 0x10, 0x1, 0x8, 0x2a, 0xc, 0xc, 0x1, 0xb0}]}, 0x7, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x421}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x2409}}, {0xe5, &(0x7f00000003c0)=@string={0xe5, 0x3, "e191eb5bdcad456a19158fa8338206c839a97ab57783431b75d8eda54597455b823979ae49e996f064b15979d766e37c4ad600630ed28960ba8959af4a205cd20b311cd02f4b344e4d979c4c3f543b53722acf9c61c5a75ab1968be5849a929b64293e681c7a7f11ebb51c2be172bbd5b56bdfe36ef2a8de825edc1d59509623d4556d003a056a398bdcd12d7b2b8c0b3883bbbee573af5b77f160b68badbd52a2c4022785d86f6e4bce8694acff0ae49dc7f5731dd5aab2521379edda94baca66c990d5676fb12c9d5ab1141be6c28b037bfe762a5c4f7bfa9c1f5837f27e8315fa34"}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x4001}}, {0x4d, &(0x7f0000000300)=ANY=[@ANYBLOB="4d0346bf33d8d5ef11205ec8108e13ff051a7c05c25db4ab1cb83d91c3ec15da86a4760d644b51aacf35182d670985bb68a926ae260318de90f97ce7a3d76cccdda4f7acab948b8b66213c6834"]}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0xc04}}, {0x36, &(0x7f0000000500)=@string={0x36, 0x3, "95a619b42c77c1d22312d8c9a34af8e451b5a8aebdc47d59f470f844a01f817ba2e3566abdddf0d7db00ff254459bb195f3cc145"}}]}) r6 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040), 0x280, 0x0) ioctl$ASHMEM_SET_SIZE(r6, 0x40087703, 0x8000) ioctl$ASHMEM_SET_PROT_MASK(r6, 0x40087705, 0x0) write$P9_RVERSION(r5, &(0x7f00000000c0)=ANY=[@ANYBLOB="1500000065ffff0800000008070000003030302e4c"], 0x15) (async) write$P9_RVERSION(r5, &(0x7f00000000c0)=ANY=[@ANYBLOB="1500000065ffff0800000008070000003030302e4c"], 0x15) r7 = socket$inet6(0xa, 0x800000000000002, 0x2) listen(r7, 0x2) (async) listen(r7, 0x2) setsockopt$inet6_mtu(r7, 0x29, 0x17, &(0x7f0000000380)=0x4, 0x4) 640.07µs ago: executing program 1 (id=103): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000080)="660f3a09800f00b266b9c209000066b8e525000066ba000000000f30360f060f01dff2dd7a7d66b9800000c00f326635001000000f3065660f38824e01ea8dfc36010fc71cbaf80c66b830835c8666efbafc0c66b80900000066ef", 0x5b}], 0x1, 0x2, &(0x7f0000000140), 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x20600, 0x0) (async, rerun: 64) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f00000001c0)={0x8, [0x4, 0xad6f], 0xb234}, 0x10) (async, rerun: 64) ioctl$F2FS_IOC_DEFRAGMENT(r0, 0xc010f508, &(0x7f0000000200)={0xffffffff, 0x9}) (async) fchdir(r0) r4 = accept4$bt_l2cap(r1, 0x0, &(0x7f0000000240), 0x800) ioctl$sock_SIOCOUTQ(r4, 0x5411, &(0x7f0000000280)) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r5, &(0x7f00000002c0)={0x1f, 0x1a, @none, 0x6}, 0xe) (async, rerun: 32) bind$unix(r2, &(0x7f0000000300)=@abs={0x1, 0x0, 0x4e20}, 0x6e) (async, rerun: 32) ioctl$HIDIOCINITREPORT(r2, 0x4805, 0x0) (async) mmap(&(0x7f0000fee000/0x2000)=nil, 0x2000, 0x1000006, 0x10, r3, 0xb5d8a000) (async, rerun: 32) fcntl$F_SET_FILE_RW_HINT(r3, 0x40e, &(0x7f0000000380)=0x1) (async, rerun: 32) lsm_get_self_attr(0x69, &(0x7f00000003c0)={0x0, 0x0, 0x1020, 0x1000, ""/4096}, &(0x7f0000001400)=0x1020, 0x1) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000001440)='./cgroup.net/syz1\x00', 0x200002, 0x0) connect$bt_l2cap(r2, &(0x7f0000001480)={0x1f, 0x6, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x2}, 0xe) (async) ioctl$KVM_SET_USER_MEMORY_REGION2(0xffffffffffffffff, 0x40a0ae49, &(0x7f00000014c0)={0x10201, 0x4, 0x4, 0x1000, &(0x7f0000ffd000/0x1000)=nil, 0x1, r1}) (async, rerun: 32) fstat(r5, &(0x7f0000001580)) (rerun: 32) r6 = dup(r2) lsm_get_self_attr(0x0, &(0x7f0000001600)={0x0, 0x0, 0x21, 0x1, ""/1}, &(0x7f0000001640)=0x21, 0x1) (async, rerun: 32) r7 = ioctl$KVM_CREATE_GUEST_MEMFD(r6, 0xc040aed4, &(0x7f0000001680)={0x101, 0x8}) (rerun: 32) ioctl$LOOP_SET_FD(r1, 0x4c00, r7) (async) flock(r1, 0xd) (async) setns(r2, 0x4000000) (async, rerun: 32) mount$9p_fd(0x0, &(0x7f00000016c0)='./file0\x00', &(0x7f0000001700), 0x14000, &(0x7f0000001740)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0x1}}, {@version_9p2000}], [{@obj_type={'obj_type', 0x3d, '/selinux/status\x00'}}, {@seclabel}, {@mask={'mask', 0x3d, 'MAY_APPEND'}}, {@mask={'mask', 0x3d, '^MAY_READ'}}, {@fsuuid={'fsuuid', 0x3d, {[0x18, 0x35, 0x36, 0x32, 0x64, 0x62, 0x32, 0x61], 0x2d, [0x38, 0x62, 0x0, 0x33], 0x2d, [0x33, 0x65, 0x66, 0x63], 0x2d, [0x31, 0x63, 0x35, 0x61], 0x2d, [0x31, 0x66, 0x37, 0x39, 0x62, 0x62, 0x30, 0x38]}}}]}}) (async, rerun: 32) socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64) ioctl$GIO_UNISCRNMAP(r6, 0x4b69, &(0x7f0000001840)=""/123) (rerun: 64) 0s ago: executing program 1 (id=104): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x1081, 0x200000000000}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x53, 0x0, &(0x7f0000000400)="892a7863af87409b1b8fe4e183cc4e2c2eddca324f8c2a61fb078c81d7272d92b902bf051aacb6decd83ec368991a0d7599c3ce3f7bed9d8078ba649896475d964ddb0c6d4d498b0ef80a3f6170b75654851be"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f00000001c0)=[@enter_looper], 0x50, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f0000000340)=[@increfs], 0x0, 0x0, 0x0}) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x84000) mkdir(&(0x7f0000000080)='./file0\x00', 0x80) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) creat(0x0, 0x0) mount$9p_fd(0x0, 0x0, &(0x7f0000000040), 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') unshare(0x22020600) lseek(r2, 0x10001, 0x0) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f0000000300)='cpuset\x00', 0x200000, &(0x7f00000003c0)='./binderfs/binder0\x00') r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000002c0)={0x30, 0x5, 0x0, {0x0, 0x3, 0x0, 0x5}}, 0x30) mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r3}}) write$binfmt_register(r3, &(0x7f0000000100)={0x3a, 'syz2', 0x3a, 'E', 0x3a, 0x6, 0x3a, './binderfs/binder0\x00', 0x3a, '/\t..\\.', 0x3a, './file0', 0x3a, [0x43]}, 0x41) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.253' (ED25519) to the list of known hosts. [ 24.195608][ T36] audit: type=1400 audit(1751181433.350:64): avc: denied { mounton } for pid=280 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.197105][ T280] cgroup: Unknown subsys name 'net' [ 24.218383][ T36] audit: type=1400 audit(1751181433.350:65): avc: denied { mount } for pid=280 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.249282][ T36] audit: type=1400 audit(1751181433.380:66): avc: denied { unmount } for pid=280 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.249694][ T280] cgroup: Unknown subsys name 'devices' [ 24.431992][ T280] cgroup: Unknown subsys name 'hugetlb' [ 24.437637][ T280] cgroup: Unknown subsys name 'rlimit' [ 24.532425][ T36] audit: type=1400 audit(1751181433.690:67): avc: denied { setattr } for pid=280 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.555702][ T36] audit: type=1400 audit(1751181433.690:68): avc: denied { mounton } for pid=280 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 24.569424][ T282] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 24.580841][ T36] audit: type=1400 audit(1751181433.690:69): avc: denied { mount } for pid=280 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 24.610429][ T280] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.612314][ T36] audit: type=1400 audit(1751181433.740:70): avc: denied { relabelto } for pid=282 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.646253][ T36] audit: type=1400 audit(1751181433.740:71): avc: denied { write } for pid=282 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.671891][ T36] audit: type=1400 audit(1751181433.760:72): avc: denied { read } for pid=280 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.697407][ T36] audit: type=1400 audit(1751181433.760:73): avc: denied { open } for pid=280 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.924370][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.931472][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.938537][ T289] bridge_slave_0: entered allmulticast mode [ 25.945102][ T289] bridge_slave_0: entered promiscuous mode [ 25.953914][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.961012][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.968138][ T289] bridge_slave_1: entered allmulticast mode [ 25.974482][ T289] bridge_slave_1: entered promiscuous mode [ 26.016979][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.024182][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.031383][ T288] bridge_slave_0: entered allmulticast mode [ 26.037654][ T288] bridge_slave_0: entered promiscuous mode [ 26.054095][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.061269][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.068357][ T288] bridge_slave_1: entered allmulticast mode [ 26.074741][ T288] bridge_slave_1: entered promiscuous mode [ 26.113289][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.120705][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.127791][ T290] bridge_slave_0: entered allmulticast mode [ 26.134185][ T290] bridge_slave_0: entered promiscuous mode [ 26.149026][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.156146][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.163258][ T290] bridge_slave_1: entered allmulticast mode [ 26.169564][ T290] bridge_slave_1: entered promiscuous mode [ 26.196638][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.203787][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.211134][ T287] bridge_slave_0: entered allmulticast mode [ 26.217416][ T287] bridge_slave_0: entered promiscuous mode [ 26.224054][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.231196][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.238331][ T287] bridge_slave_1: entered allmulticast mode [ 26.244676][ T287] bridge_slave_1: entered promiscuous mode [ 26.387028][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.394130][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.401539][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.408593][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.422292][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.429379][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.436641][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.443784][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.452421][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.459508][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.466792][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.473834][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.493009][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.500124][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.507400][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.514471][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.565701][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.573293][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.580778][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.587988][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.596047][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.603362][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.611289][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.618606][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.630258][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.637328][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.661174][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.668238][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.675861][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.682924][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.690716][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.697762][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.705712][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.712809][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.722121][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.729207][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.746105][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.753181][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.761617][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.768707][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.813840][ T287] veth0_vlan: entered promiscuous mode [ 26.832886][ T288] veth0_vlan: entered promiscuous mode [ 26.847477][ T289] veth0_vlan: entered promiscuous mode [ 26.865853][ T287] veth1_macvtap: entered promiscuous mode [ 26.872892][ T290] veth0_vlan: entered promiscuous mode [ 26.878685][ T289] veth1_macvtap: entered promiscuous mode [ 26.905477][ T288] veth1_macvtap: entered promiscuous mode [ 26.917210][ T290] veth1_macvtap: entered promiscuous mode [ 26.941910][ T287] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 27.018985][ T312] rust_binder: Write failure EFAULT in pid:2 [ 27.085823][ T327] Zero length message leads to an empty skb [ 27.128292][ T329] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 27.209526][ T337] fuse: Bad value for 'group_id' [ 27.214593][ T337] fuse: Bad value for 'group_id' [ 27.308463][ T349] IPv6: NLM_F_CREATE should be specified when creating new route [ 27.316406][ T349] IPv6: NLM_F_REPLACE set, but no existing node found! [ 27.323548][ T10] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 27.358262][ T351] tmpfs: Bad value for 'uid' [ 27.359891][ T353] fuse: Bad value for 'fd' [ 27.363522][ T351] tmpfs: Bad value for 'uid' [ 27.379835][ T351] overlay: Unknown parameter 'euid>00000000004294967295' [ 27.479295][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 27.488824][ T10] usb 4-1: not running at top speed; connect to a high speed hub [ 27.497417][ T10] usb 4-1: config 95 has an invalid interface number: 1 but max is 0 [ 27.505602][ T10] usb 4-1: config 95 has no interface number 0 [ 27.512890][ T10] usb 4-1: config 95 interface 1 has no altsetting 0 [ 27.519748][ T344] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 27.528768][ T357] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=34842 sclass=netlink_xfrm_socket pid=357 comm=syz.1.14 [ 27.528874][ T10] usb 4-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice=ad.3f [ 27.550895][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.558900][ T10] usb 4-1: Product: syz [ 27.563098][ T10] usb 4-1: Manufacturer: syz [ 27.567723][ T10] usb 4-1: SerialNumber: syz [ 27.630978][ T9] usb 3-1: config 1 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.641979][ T9] usb 3-1: config 1 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 27.654996][ T9] usb 3-1: config 1 interface 0 has no altsetting 0 [ 27.663199][ T9] usb 3-1: New USB device found, idVendor=05ac, idProduct=021d, bcdDevice= 0.40 [ 27.673040][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.681150][ T9] usb 3-1: Product: ቦ䀞㴋撬왥踲Ꜧ藪纵霷騨㗃 [ 27.688530][ T9] usb 3-1: Manufacturer: ы [ 27.693174][ T9] usb 3-1: SerialNumber: ␉ [ 27.698586][ T344] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.710018][ T344] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.719872][ T344] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 27.733279][ T344] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 27.742389][ T344] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.751561][ T344] usb 1-1: config 0 descriptor?? [ 27.775559][ T316] capability: warning: `syz.3.4' uses deprecated v2 capabilities in a way that may be insecure [ 27.806681][ T10] usb 4-1: USB disconnect, device number 2 [ 27.828463][ T310] udevd[310]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:95.1/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 28.161167][ T344] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 28.170542][ T344] plantronics 0003:047F:FFFF.0001: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 28.189377][ T362] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.197954][ T362] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.218177][ T9] usbhid 3-1:1.0: can't add hid device: -71 [ 28.233652][ T9] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 28.247500][ T9] usb 3-1: USB disconnect, device number 2 [ 28.349808][ T374] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 28.358180][ T374] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 28.367055][ T374] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 28.375403][ T374] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 28.629235][ T9] usb 3-1: new low-speed USB device number 3 using dummy_hcd [ 28.781432][ T391] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.790056][ T344] usb 2-1: new low-speed USB device number 2 using dummy_hcd [ 28.799066][ T391] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.808752][ T391] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.817829][ T391] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.826458][ T9] usb 3-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 28.838695][ T9] usb 3-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 28.849866][ T9] usb 3-1: config 0 interface 0 has no altsetting 0 [ 28.856515][ T9] usb 3-1: New USB device found, idVendor=04d9, idProduct=a067, bcdDevice= 0.00 [ 28.865656][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.875667][ T9] usb 3-1: config 0 descriptor?? [ 28.881040][ T372] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 28.951075][ T344] usb 2-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 28.962212][ T344] usb 2-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid maxpacket 32, setting to 8 [ 28.972927][ T344] usb 2-1: config 0 interface 0 has no altsetting 0 [ 28.979726][ T344] usb 2-1: New USB device found, idVendor=046d, idProduct=c286, bcdDevice= 0.00 [ 28.988861][ T344] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.998125][ T344] usb 2-1: config 0 descriptor?? [ 29.005134][ T389] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 29.056352][ T393] rust_binder: Write failure EFAULT in pid:13 [ 29.090560][ T391] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.107039][ T391] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.144202][ T347] usb 1-1: USB disconnect, device number 2 [ 29.283346][ T36] kauditd_printk_skb: 101 callbacks suppressed [ 29.283365][ T36] audit: type=1400 audit(1751181438.440:175): avc: denied { execute } for pid=400 comm="syz.3.28" path="/7/cpuacct.usage_sys" dev="tmpfs" ino=56 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 29.314185][ T9] holtek_mouse 0003:04D9:A067.0002: unknown main item tag 0x3 [ 29.318162][ T36] audit: type=1400 audit(1751181438.470:176): avc: denied { create } for pid=400 comm="syz.3.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 29.323584][ T9] holtek_mouse 0003:04D9:A067.0002: hidraw0: USB HID v0.00 Device [HID 04d9:a067] on usb-dummy_hcd.2-1/input0 [ 29.361887][ T36] audit: type=1400 audit(1751181438.510:177): avc: denied { write } for pid=400 comm="syz.3.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 29.419275][ T389] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.427799][ T389] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.456271][ T36] audit: type=1400 audit(1751181438.610:178): avc: denied { read } for pid=404 comm="syz.3.29" dev="nsfs" ino=4026532546 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 29.477261][ T36] audit: type=1400 audit(1751181438.610:179): avc: denied { open } for pid=404 comm="syz.3.29" path="net:[4026532546]" dev="nsfs" ino=4026532546 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 29.508344][ T36] audit: type=1400 audit(1751181438.610:180): avc: denied { create } for pid=404 comm="syz.3.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 29.536552][ T344] usbhid 2-1:0.0: can't add hid device: -71 [ 29.543790][ T344] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 29.556271][ T9] usb 3-1: USB disconnect, device number 3 [ 29.558520][ T408] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:27 [ 29.562258][ T36] audit: type=1400 audit(1751181438.710:181): avc: denied { connect } for pid=407 comm="syz.3.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 29.593679][ T344] usb 2-1: USB disconnect, device number 2 [ 29.651811][ T36] audit: type=1400 audit(1751181438.810:182): avc: denied { read } for pid=411 comm="syz.3.32" name="usbmon0" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 29.696703][ T36] audit: type=1400 audit(1751181438.810:183): avc: denied { open } for pid=411 comm="syz.3.32" path="/dev/usbmon0" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 29.733014][ T36] audit: type=1400 audit(1751181438.830:184): avc: denied { write } for pid=411 comm="syz.3.32" name="001" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 29.790766][ T429] tipc: Started in network mode [ 29.795796][ T429] tipc: Node identity 52ca9d5cd885, cluster identity 4711 [ 29.803407][ T429] tipc: Enabled bearer , priority 0 [ 29.811742][ T429] tipc: Disabling bearer [ 29.847740][ T432] ./file0: Can't lookup blockdev [ 29.853299][ T431] netlink: 200 bytes leftover after parsing attributes in process `syz.0.37'. [ 29.862407][ T431] tc_dump_action: action bad kind [ 30.089266][ T347] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 30.239254][ T347] usb 4-1: Using ep0 maxpacket: 32 [ 30.246373][ T347] usb 4-1: config 1 interface 0 altsetting 3 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.257566][ T347] usb 4-1: config 1 interface 0 has no altsetting 0 [ 30.265664][ T347] usb 4-1: New USB device found, idVendor=1b96, idProduct=0012, bcdDevice= 0.40 [ 30.274848][ T347] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.282873][ T347] usb 4-1: Product: syz [ 30.287154][ T347] usb 4-1: Manufacturer: ˠ䨨੎㜢鯭ᨳⱧ粑ᱠ㒿윩죵♂㫅귾珐쾀曐ᘲ鐧⑷ଘ쩄陵梍즇몫᫼䧍ѡ弩皅햳욖⬥꤯벆绿͖迴꿹㡩瀖᣷⩯鏿Վ [ 30.304503][ T344] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 30.312393][ T347] usb 4-1: SerialNumber: syz [ 30.317911][ T347] usb 4-1: rejected 1 configuration due to insufficient available bus power [ 30.326749][ T347] usb 4-1: no configuration chosen from 1 choice [ 30.369299][ T9] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 30.460484][ T344] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.471704][ T344] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.481539][ T344] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 30.494456][ T344] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 30.503610][ T344] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.512872][ T344] usb 2-1: config 0 descriptor?? [ 30.530346][ T9] usb 3-1: config index 0 descriptor too short (expected 45, got 36) [ 30.538625][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 30.548936][ T9] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 218, using maximum allowed: 30 [ 30.560050][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 218 [ 30.573213][ T9] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 30.582322][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.591211][ T9] usb 3-1: config 0 descriptor?? [ 30.921063][ T344] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.928524][ T344] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.936617][ T344] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.944146][ T344] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.951884][ T344] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.959372][ T344] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.966817][ T344] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.974583][ T344] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.982090][ T344] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.989560][ T344] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.996990][ T344] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 30.998815][ T440] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 31.004444][ T344] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 31.023685][ T344] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 31.031171][ T344] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 31.038698][ T344] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 31.046789][ T344] plantronics 0003:047F:FFFF.0003: No inputs registered, leaving [ 31.056133][ T344] plantronics 0003:047F:FFFF.0003: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 31.180057][ T438] usb 2-1: USB disconnect, device number 3 [ 31.913792][ T465] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 31.958152][ T467] kvm: pic: non byte write [ 32.046680][ T470] tipc: Started in network mode [ 32.051640][ T470] tipc: Node identity , cluster identity 4711 [ 32.776269][ T31] usb 4-1: USB disconnect, device number 3 [ 32.930417][ T438] hid-generic 0000:0003:0000.0004: unknown main item tag 0x0 [ 32.938031][ T438] hid-generic 0000:0003:0000.0004: unknown main item tag 0x0 [ 32.946494][ T438] hid-generic 0000:0003:0000.0004: hidraw0: HID v0.00 Device [syz0] on syz1 [ 32.970981][ T489] fido_id[489]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 33.067642][ T491] rust_binder: Write failure EINVAL in pid:49 [ 33.068040][ T492] rust_binder: Read failure Err(EAGAIN) in pid:49 [ 33.088633][ T494] tmpfs: Unknown parameter 'hug' [ 33.109266][ T443] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 33.117846][ T9] usb 3-1: string descriptor 0 read error: -71 [ 33.130332][ T9] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 33.143172][ T9] usb 3-1: USB disconnect, device number 4 [ 33.159261][ T344] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 33.177736][ T498] kernel profiling enabled (shift: 0) [ 33.319660][ T344] usb 1-1: Using ep0 maxpacket: 32 [ 33.330309][ T344] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 33.341364][ T344] usb 1-1: New USB device found, idVendor=056a, idProduct=003b, bcdDevice= 0.00 [ 33.351329][ T344] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.369732][ T344] usb 1-1: config 0 descriptor?? [ 33.409224][ T347] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 33.559227][ T347] usb 4-1: device descriptor read/64, error -71 [ 33.779974][ T486] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.788702][ T486] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.799224][ T347] usb 4-1: device descriptor read/64, error -71 [ 33.807027][ T344] usbhid 1-1:0.0: can't add hid device: -71 [ 33.813679][ T344] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 33.827666][ T344] usb 1-1: USB disconnect, device number 3 [ 33.844153][ T513] ======================================================= [ 33.844153][ T513] WARNING: The mand mount option has been deprecated and [ 33.844153][ T513] and is ignored by this kernel. Remove the mand [ 33.844153][ T513] option from the mount to silence this warning. [ 33.844153][ T513] ======================================================= [ 33.879842][ T513] SELinux: security_context_str_to_sid () failed with errno=-22 [ 34.049295][ T347] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 34.159293][ T305] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 34.179286][ T347] usb 4-1: device descriptor read/64, error -71 [ 34.309313][ T305] usb 3-1: Using ep0 maxpacket: 32 [ 34.321021][ T305] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 34.331420][ T305] usb 3-1: config 0 has no interface number 0 [ 34.340015][ T305] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 34.349305][ T305] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.357635][ T305] usb 3-1: Product: syz [ 34.362379][ T305] usb 3-1: Manufacturer: syz [ 34.367192][ T305] usb 3-1: SerialNumber: syz [ 34.373046][ T305] usb 3-1: config 0 descriptor?? [ 34.378829][ T305] smsc95xx v2.0.0 [ 34.419709][ T347] usb 4-1: device descriptor read/64, error -71 [ 34.473185][ T36] kauditd_printk_skb: 28 callbacks suppressed [ 34.473206][ T36] audit: type=1400 audit(1751181443.630:213): avc: denied { call } for pid=526 comm="syz.0.66" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 34.473338][ T529] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 34.498111][ T529] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:29 [ 34.529367][ T347] usb usb4-port1: attempt power cycle [ 34.580120][ T305] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 34.590936][ T305] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 34.800831][ T305] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 34.811703][ T305] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -32 [ 34.839675][ T36] audit: type=1400 audit(1751181444.000:214): avc: denied { bind } for pid=531 comm="syz.1.67" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 34.859110][ T532] 9pnet_fd: Insufficient options for proto=fd [ 34.884846][ T347] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 34.910322][ T347] usb 4-1: device descriptor read/8, error -71 [ 35.040448][ T347] usb 4-1: device descriptor read/8, error -71 [ 35.214098][ T36] audit: type=1400 audit(1751181444.370:215): avc: denied { shutdown } for pid=541 comm="syz.0.70" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 35.245680][ T36] audit: type=1400 audit(1751181444.400:216): avc: denied { nlmsg_write } for pid=543 comm="syz.0.71" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 35.266742][ T36] audit: type=1400 audit(1751181444.420:217): avc: denied { read write } for pid=543 comm="syz.0.71" name="uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 35.267895][ T544] input: syz0 as /devices/virtual/input/input4 [ 35.290381][ T347] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 35.304462][ T36] audit: type=1400 audit(1751181444.420:218): avc: denied { open } for pid=543 comm="syz.0.71" path="/dev/uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 35.327844][ T36] audit: type=1400 audit(1751181444.420:219): avc: denied { ioctl } for pid=543 comm="syz.0.71" path="/dev/uinput" dev="devtmpfs" ino=194 ioctlcmd=0x556c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 35.352669][ T36] audit: type=1400 audit(1751181444.450:220): avc: denied { read } for pid=93 comm="acpid" name="event3" dev="devtmpfs" ino=470 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 35.375004][ T36] audit: type=1400 audit(1751181444.450:221): avc: denied { open } for pid=93 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=470 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 35.400868][ T36] audit: type=1400 audit(1751181444.450:222): avc: denied { ioctl } for pid=93 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=470 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 35.425938][ T347] usb 4-1: device descriptor read/8, error -71 [ 35.491834][ T550] binder: Unknown parameter '' [ 35.507711][ T305] usb 3-1: USB disconnect, device number 5 [ 35.519268][ T550] 9pnet_fd: Insufficient options for proto=fd [ 35.560322][ T347] usb 4-1: device descriptor read/8, error -71 [ 35.568630][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 35.576549][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 35.585473][ T557] rust_binder: Write failure EINVAL in pid:42 [ 35.585571][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 35.600096][ T558] rust_binder: Write failure EINVAL in pid:42 [ 35.600206][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 35.613774][ T557] rust_binder: Write failure EINVAL in pid:42 [ 35.613874][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 35.634257][ T558] rust_binder: Write failure EINVAL in pid:42 [ 35.634329][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 35.639308][ T557] rust_binder: Write failure EINVAL in pid:42 [ 35.641146][ T558] rust_binder: Write failure EINVAL in pid:42 [ 35.657290][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 35.679820][ T347] usb usb4-port1: unable to enumerate USB device [ 35.699271][ T557] rust_binder: Write failure EINVAL in pid:42 [ 35.699323][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 35.719306][ T557] rust_binder: Write failure EINVAL in pid:42 [ 35.723958][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 35.737608][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 35.745941][ T558] rust_binder: Write failure EINVAL in pid:42 [ 35.746587][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 35.772910][ T557] rust_binder: Write failure EINVAL in pid:42 [ 35.772979][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 35.784664][ T558] rust_binder: Write failure EINVAL in pid:42 [ 35.786734][ T557] rust_binder: Write failure EINVAL in pid:42 [ 35.793003][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 35.806366][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 35.813824][ T558] rust_binder: Write failure EINVAL in pid:42 [ 35.813888][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 35.819288][ T557] rust_binder: Write failure EINVAL in pid:42 [ 35.827735][ T558] rust_binder: Write failure EINVAL in pid:42 [ 35.827765][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 35.847369][ T557] rust_binder: Write failure EINVAL in pid:42 [ 35.847422][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 35.861034][ T557] rust_binder: Write failure EINVAL in pid:42 [ 35.861094][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 35.874532][ T558] rust_binder: Write failure EINVAL in pid:42 [ 35.874581][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 35.889302][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 35.902388][ T557] rust_binder: Write failure EINVAL in pid:42 [ 35.902439][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 35.903372][ T569] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 35.908935][ T558] rust_binder: Write failure EINVAL in pid:42 [ 35.917151][ T557] rust_binder: Write failure EINVAL in pid:42 [ 35.925230][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 35.943041][ T558] rust_binder: Write failure EINVAL in pid:42 [ 35.943086][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 35.956369][ T558] rust_binder: Write failure EINVAL in pid:42 [ 35.956422][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 35.970048][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 35.970047][ T557] rust_binder: Write failure EINVAL in pid:42 [ 35.970075][ T558] rust_binder: Write failure EINVAL in pid:42 [ 35.977289][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 35.996795][ T557] rust_binder: Write failure EINVAL in pid:42 [ 35.996818][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 36.010512][ T558] rust_binder: Write failure EINVAL in pid:42 [ 36.010531][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 36.023975][ T557] rust_binder: Write failure EINVAL in pid:42 [ 36.023983][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 36.037700][ T558] rust_binder: Write failure EINVAL in pid:42 [ 36.037721][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 36.051700][ T557] rust_binder: Write failure EINVAL in pid:42 [ 36.051724][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 36.065074][ T558] rust_binder: Write failure EINVAL in pid:42 [ 36.065090][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 36.065115][ T557] rust_binder: Write failure EINVAL in pid:42 [ 36.071455][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 36.101074][ T558] rust_binder: Write failure EINVAL in pid:42 [ 36.101135][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 36.115436][ T558] rust_binder: Write failure EINVAL in pid:42 [ 36.117019][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 36.132405][ T557] rust_binder: Write failure EINVAL in pid:42 [ 36.132457][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 36.153734][ T576] netlink: 12 bytes leftover after parsing attributes in process `syz.2.80'. [ 36.177864][ T557] rust_binder: Write failure EINVAL in pid:42 [ 36.179903][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 36.194289][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 36.204369][ T557] rust_binder: Write failure EINVAL in pid:42 [ 36.204422][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 36.235609][ T558] rust_binder: Write failure EINVAL in pid:42 [ 36.235680][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 36.259812][ T557] rust_binder: Write failure EINVAL in pid:42 [ 36.259882][ T558] rust_binder: Write failure EINVAL in pid:42 [ 36.266056][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 36.287901][ T595] SELinux: security_context_str_to_sid () failed with errno=-22 [ 36.302849][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 36.307056][ T557] rust_binder: Write failure EINVAL in pid:42 [ 36.310187][ T558] rust_binder: Write failure EINVAL in pid:42 [ 36.316927][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 36.330598][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 36.337895][ T558] rust_binder: Write failure EINVAL in pid:42 [ 36.337942][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 36.351383][ T557] rust_binder: Write failure EINVAL in pid:42 [ 36.351472][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 36.359242][ T558] rust_binder: Write failure EINVAL in pid:42 [ 36.364949][ T557] rust_binder: Write failure EINVAL in pid:42 [ 36.365168][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 36.384398][ T558] rust_binder: Write failure EINVAL in pid:42 [ 36.384432][ T557] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 36.399689][ T557] rust_binder: Write failure EINVAL in pid:42 [ 36.399765][ T558] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 36.413717][ T558] rust_binder: Write failure EINVAL in pid:42 [ 36.539221][ T305] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 36.572142][ T611] rust_binder: Write failure EINVAL in pid:78 [ 36.572240][ T611] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:78 [ 36.654723][ T628] usb usb8: usbfs: process 628 (syz.0.96) did not claim interface 0 before use [ 36.679874][ T305] usb 3-1: device descriptor read/64, error -71 [ 36.886549][ T653] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:129 [ 36.919369][ T305] usb 3-1: device descriptor read/64, error -71 [ 36.937703][ T655] rust_binder: Write failure EINVAL in pid:129 [ 36.939820][ T655] cgroup: Unknown parameter './binderfs/binder0' [ 36.953180][ T655] rust_kernel: panicked at rust/kernel/sync/poll.rs:54:18: [ 36.953180][ T655] null pointer dereference occurred [ 36.965861][ T655] ------------[ cut here ]------------ [ 36.971440][ T655] kernel BUG at rust/helpers/bug.c:7! [ 36.977447][ T655] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI [ 36.984451][ T655] CPU: 0 UID: 0 PID: 655 Comm: syz.1.104 Not tainted 6.12.30-syzkaller-g68f4f0b0690a #0 d2d57a621586a6800997b547ec5ef233d70fc6ad [ 36.997764][ T655] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 37.007834][ T655] RIP: 0010:rust_helper_BUG+0x8/0x10 [ 37.013164][ T655] Code: 8e e1 e7 02 cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b8 cb 25 70 fe 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 48 89 e5 <0f> 0b 66 0f 1f 44 00 00 b8 81 e1 39 72 90 90 90 90 90 90 90 90 90 [ 37.032801][ T655] RSP: 0018:ffffc900218071b0 EFLAGS: 00010246 [ 37.038898][ T655] RAX: 000000000000005a RBX: 1ffff92004300e38 RCX: 540c143e1d40ea00 [ 37.046878][ T655] RDX: ffffc90002284000 RSI: 0000000000003004 RDI: 0000000000003005 [ 37.054868][ T655] RBP: ffffc900218071b0 R08: 0000000000000003 R09: 0000000000000004 [ 37.062881][ T655] R10: dffffc0000000000 R11: fffffbfff0e5eebc R12: 0000000000000000 [ 37.070888][ T655] R13: dffffc0000000000 R14: ffffc900218071e0 R15: ffffc90021807210 [ 37.079224][ T655] FS: 00007ffb665fa6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 37.088162][ T655] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.094756][ T655] CR2: 0000200000001000 CR3: 000000011a70a000 CR4: 00000000003526b0 [ 37.102742][ T655] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 37.110718][ T655] DR3: 3917e8af5c460fd8 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 37.118699][ T655] Call Trace: [ 37.121987][ T655] [ 37.124956][ T655] _RNvCscSpY9Juk0HT_7___rustc17rust_begin_unwind+0x15b/0x160 [ 37.132444][ T655] ? __cfi__RNvCscSpY9Juk0HT_7___rustc17rust_begin_unwind+0x10/0x10 [ 37.140442][ T655] ? __cfi__RNvXs1b_NtCs9jEwPDbx20M_4core3fmtRNtNtNtB8_5panic10panic_info9PanicInfoNtB6_7Display3fmtCs43vyB533jt3_6kernel+0x10/0x10 [ 37.154035][ T655] ? p9pdu_vwritef+0x2720/0x2720 [ 37.159003][ T655] ? radix_tree_node_alloc+0x1af/0x400 [ 37.164475][ T655] ? _RNvNtCs9jEwPDbx20M_4core9panicking18panic_nounwind_fmt+0xa2/0xf0 [ 37.172730][ T655] ? __asan_memcpy+0x5a/0x80 [ 37.177358][ T655] _RNvNtCs9jEwPDbx20M_4core9panicking18panic_nounwind_fmt+0xec/0xf0 [ 37.185447][ T655] ? __cfi__RNvNtCs9jEwPDbx20M_4core9panicking18panic_nounwind_fmt+0x10/0x10 [ 37.194231][ T655] ? p9pdu_writef+0xdb/0x130 [ 37.198865][ T655] ? p9pdu_vwritef+0x2720/0x2720 [ 37.203822][ T655] _RNvNtCs9jEwPDbx20M_4core9panicking30panic_null_pointer_dereference+0x49/0x4c [ 37.212963][ T655] _RNvMNtNtCs43vyB533jt3_6kernel4sync4pollNtB2_9PollTable8from_ptr+0x40/0x40 [ 37.221827][ T655] ? _RNvCshgDM7dBCdno_11rust_binder16rust_binder_poll+0xce/0x570 [ 37.229743][ T655] _RNvCshgDM7dBCdno_11rust_binder16rust_binder_poll+0xe2/0x570 [ 37.237571][ T655] ? p9_client_prepare_req+0x732/0xa10 [ 37.243050][ T655] ? __cfi__RNvCshgDM7dBCdno_11rust_binder16rust_binder_poll+0x10/0x10 [ 37.251316][ T655] ? __kasan_check_write+0x18/0x20 [ 37.256443][ T655] ? _raw_spin_lock+0x8c/0x120 [ 37.261226][ T655] ? __cfi__raw_spin_lock+0x10/0x10 [ 37.266464][ T655] ? __kasan_check_write+0x18/0x20 [ 37.271583][ T655] ? pipe_poll+0x319/0x500 [ 37.276026][ T655] ? __cfi__RNvCshgDM7dBCdno_11rust_binder16rust_binder_poll+0x10/0x10 [ 37.284314][ T655] p9_fd_request+0x440/0x500 [ 37.288932][ T655] p9_client_rpc+0x2f9/0xb40 [ 37.293545][ T655] ? __cfi__RNvCshgDM7dBCdno_11rust_binder16rust_binder_poll+0x10/0x10 [ 37.301804][ T655] ? p9_fid_create+0x3d0/0x3d0 [ 37.306581][ T655] ? __cfi__RNvCshgDM7dBCdno_11rust_binder16rust_binder_poll+0x10/0x10 [ 37.314839][ T655] ? p9_conn_create+0x4c9/0x570 [ 37.319702][ T655] ? p9_fd_create+0x2f3/0x4c0 [ 37.324405][ T655] p9_client_create+0x96a/0x1190 [ 37.329381][ T655] ? __cfi_p9_client_create+0x10/0x10 [ 37.334790][ T655] ? kasan_save_alloc_info+0x40/0x50 [ 37.340119][ T655] ? __kasan_kmalloc+0x96/0xb0 [ 37.344931][ T655] ? kstrdup+0x7b/0x140 [ 37.349102][ T655] ? __kasan_check_write+0x18/0x20 [ 37.354233][ T655] v9fs_session_init+0x1e1/0x1820 [ 37.359286][ T655] ? __cfi_v9fs_session_init+0x10/0x10 [ 37.364759][ T655] ? kasan_save_alloc_info+0x40/0x50 [ 37.370066][ T655] ? __kasan_kmalloc+0x96/0xb0 [ 37.374884][ T655] ? v9fs_mount+0xbd/0xa00 [ 37.379326][ T655] v9fs_mount+0xd7/0xa00 [ 37.383614][ T655] ? __cfi_v9fs_mount+0x10/0x10 [ 37.388501][ T655] ? selinux_capable+0x38/0x50 [ 37.393289][ T655] legacy_get_tree+0x106/0x1b0 [ 37.398070][ T655] ? __cfi_v9fs_mount+0x10/0x10 [ 37.403026][ T655] vfs_get_tree+0x9e/0x290 [ 37.407459][ T655] do_new_mount+0x251/0xb40 [ 37.411986][ T655] ? security_capable+0xcf/0xf0 [ 37.416939][ T655] path_mount+0x688/0x1050 [ 37.421461][ T655] ? putname+0x113/0x150 [ 37.425718][ T655] __se_sys_mount+0x2bd/0x480 [ 37.430406][ T655] ? __x64_sys_mount+0xf0/0xf0 [ 37.435181][ T655] ? __kasan_check_write+0x18/0x20 [ 37.440301][ T655] ? fpregs_restore_userregs+0x11d/0x260 [ 37.445943][ T655] __x64_sys_mount+0xc3/0xf0 [ 37.450555][ T655] x64_sys_call+0x2021/0x2ee0 [ 37.455247][ T655] do_syscall_64+0x58/0xf0 [ 37.459679][ T655] ? clear_bhb_loop+0x50/0xa0 [ 37.464368][ T655] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 37.470274][ T655] RIP: 0033:0x7ffb6578e929 [ 37.474709][ T655] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 37.494322][ T655] RSP: 002b:00007ffb665fa038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 37.502765][ T655] RAX: ffffffffffffffda RBX: 00007ffb659b6080 RCX: 00007ffb6578e929 [ 37.510742][ T655] RDX: 0000200000000080 RSI: 0000200000000040 RDI: 0000000000000000 [ 37.518728][ T655] RBP: 00007ffb65810b39 R08: 0000200000000180 R09: 0000000000000000 [ 37.526896][ T655] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 37.534893][ T655] R13: 0000000000000000 R14: 00007ffb659b6080 R15: 00007ffc2fca9118 [ 37.542889][ T655] [ 37.545916][ T655] Modules linked in: [ 37.550249][ T655] ---[ end trace 0000000000000000 ]--- [ 37.550309][ T45] usb 4-1: new low-speed USB device number 8 using dummy_hcd [ 37.566843][ T655] RIP: 0010:rust_helper_BUG+0x8/0x10 [ 37.572225][ T655] Code: 8e e1 e7 02 cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b8 cb 25 70 fe 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 48 89 e5 <0f> 0b 66 0f 1f 44 00 00 b8 81 e1 39 72 90 90 90 90 90 90 90 90 90 [ 37.592208][ T655] RSP: 0018:ffffc900218071b0 EFLAGS: 00010246 [ 37.598401][ T655] RAX: 000000000000005a RBX: 1ffff92004300e38 RCX: 540c143e1d40ea00 [ 37.606436][ T655] RDX: ffffc90002284000 RSI: 0000000000003004 RDI: 0000000000003005 [ 37.614456][ T655] RBP: ffffc900218071b0 R08: 0000000000000003 R09: 0000000000000004 [ 37.622961][ T655] R10: dffffc0000000000 R11: fffffbfff0e5eebc R12: 0000000000000000 [ 37.631097][ T655] R13: dffffc0000000000 R14: ffffc900218071e0 R15: ffffc90021807210 [ 37.639100][ T655] FS: 00007ffb665fa6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 37.648084][ T655] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.654734][ T655] CR2: 00007ffb665d8f98 CR3: 000000011a70a000 CR4: 00000000003526b0 [ 37.662774][ T655] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 37.670785][ T655] DR3: 3917e8af5c460fd8 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 37.678771][ T655] Kernel panic - not syncing: Fatal exception [ 37.685101][ T655] Kernel Offset: disabled [ 37.689451][ T655] Rebooting in 86400 seconds..