last executing test programs: 4m9.440954577s ago: executing program 32 (id=1279): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r1, &(0x7f0000000080)='\x00'/10, 0xa, 0x0, &(0x7f00000000c0)={0x2, 0x4e20, @empty=0x97ff}, 0x10) recvfrom(r0, &(0x7f0000000100)=""/10, 0xa, 0x0, 0x0, 0x0) 3m52.431497631s ago: executing program 3 (id=1522): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000500)='./file1/file0\x00', 0x0, 0x201008, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000000), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000001180)='./bus\x00') r0 = syz_open_dev$loop(&(0x7f0000000100), 0x80000006, 0x48002) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac0000000000000000000000001400", "90be8b1c551265406c7f306003d8a0f4bd00"}}) 3m52.378368143s ago: executing program 3 (id=1523): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={0x14, r1, 0x1, 0x70bd24}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) syz_clone(0x80881400, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0) 3m52.378150352s ago: executing program 3 (id=1524): r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000900)=[{{0x1, 0x1}, {0x4, 0x0, 0x0, 0x1}}, {{0x4, 0x1}, {0x2, 0x0, 0x1, 0x1}}], 0x10) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000002140)) r1 = add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000100)={'fscrypt:', @desc2}, &(0x7f0000000140)={0x0, "7af9c2add30c3b0d788d9a94b0731ab8d4a8502c36822594c41a3a588f9ea10f4ea91dff6ece7b715bd30d75c5da8c5c4dada466bf73ee60295d1d133135d5c7", 0x14}, 0x48, 0xfffffffffffffffe) add_key$fscrypt_provisioning(&(0x7f0000000000), 0x0, 0x0, 0x0, r1) r2 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, r1) keyctl$unlink(0x9, r2, 0xfffffffffffffffd) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) ioctl$KVM_CAP_DISABLE_QUIRKS(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000240)={0x74, 0x0, 0x12}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000200)) ioctl$KVM_SET_MSRS(r7, 0xc008ae88, &(0x7f0000000040)=ANY=[@ANYBLOB="cf00a4559b000000000000"]) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000023c0)=ANY=[@ANYRES16=r1, @ANYRES16=r4, @ANYBLOB="010027bd70000800000002fc0200040005340aa47637e712cb7d90b7a828abe8101aa34d40de6fa762637fcbd5ac0e50b464dbd48d2018ee367db37f8fb6ba8f4b8563c53a1c68b3889d2182a94cae404fffd41b246b44eb8929168765a5f5b61c79b339b5d5611a9e55c443861019c1dfa5b1e91df8bbd9b8826bca60c70107d3ca4b83bfec97d68f08ede31239ff144b344321723cbe2f58ad2dc2eb0e5a4cbd17e250444e829e38ffe8751ea074ae8eca93dde7b81594b9a7034993d417d68e7398d7067392a6"], 0x18}}, 0x44800) r8 = socket$packet(0x11, 0x3, 0x300) sendmmsg$sock(r8, 0x0, 0x0, 0x814) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000380)) ioctl$sock_inet_SIOCSIFNETMASK(r8, 0x891c, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f0000000100)={0x30, 0x0, &(0x7f00000002c0)=[@acquire, @request_death, @increfs_done={0x40106308, 0x1}, @register_looper], 0x1d, 0x0, &(0x7f0000000300)="840800ce9e343e943a0510c639507b49b9faa29116bdaa4829e5646ea4"}) r10 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_clone(0x84800000, 0x0, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000fff000/0x1000)=nil) syz_clone(0x7080, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0) read$FUSE(r10, &(0x7f0000000380)={0x2020}, 0x2020) 3m52.198089905s ago: executing program 3 (id=1533): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000500)='./file1/file0\x00', 0x0, 0x201008, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000000), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000001180)='./bus\x00') r0 = syz_open_dev$loop(&(0x7f0000000100), 0x80000006, 0x48002) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac0000000000000000000000002000", "90be8b1c551265406c7f306003d8a0f4bd00"}}) 3m52.197034765s ago: executing program 3 (id=1535): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000038c0), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000001440)={'\x00', 0x2}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x324) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000040)="9114", 0x2) 3m52.069178747s ago: executing program 3 (id=1537): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000058c0)=ANY=[@ANYBLOB="fc01000013000100000000000000000000000000000000000000000000000001fc0200000000000000000000003300014e24000d040000090a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000010000000000000000000000000000000000000000ffffffffffffffff00000000000000000300000000000000090000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000feffffff00000000000000000000000044010500e0000002000000000000000000000000000004d632"], 0x1fc}, 0x1, 0x0, 0x0, 0x11}, 0x0) 3m51.949964299s ago: executing program 33 (id=1537): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000058c0)=ANY=[@ANYBLOB="fc01000013000100000000000000000000000000000000000000000000000001fc0200000000000000000000003300014e24000d040000090a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000010000000000000000000000000000000000000000ffffffffffffffff00000000000000000300000000000000090000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000feffffff00000000000000000000000044010500e0000002000000000000000000000000000004d632"], 0x1fc}, 0x1, 0x0, 0x0, 0x11}, 0x0) 2m51.940953157s ago: executing program 0 (id=2329): r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x100) ioctl$KVM_TRANSLATE(r0, 0xc018ae85, &(0x7f0000000040)={0x1, 0x1000, 0x65, 0x10, 0x8}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r2 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000380)={'team_slave_0\x00', &(0x7f00000000c0)=@ethtool_rxnfc={0x29, 0x3, 0x0, {0x7, @ether_spec={@local, @remote, 0x1ff}, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 0x0, 0x8000, [0x2, 0x2]}, @udp_ip6_spec={@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @mcast1, 0x4e23, 0x4e22, 0x9c}, {0x0, @broadcast, 0x3, 0x0, [0x3, 0x5]}, 0xfffffffffffffffe, 0x1}}}) ioctl$TIOCMBIC(r0, 0x5417, &(0x7f0000000240)) listen(r2, 0x5b) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) sendfile(r4, r5, 0x0, 0x5) ioctl$FIONCLEX(0xffffffffffffffff, 0x5450) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e21, 0x5, @rand_addr=' \x01\x00', 0x3}, 0x1c) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r0, 0x6628) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_CONTINUE(r3, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f00000001c0)={@flat, @fd={0x66642a85, 0x0, r1}, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, &(0x7f00000002c0)}) 2m51.769446719s ago: executing program 0 (id=2332): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000058c0)=ANY=[@ANYBLOB="fc01000013000100000000000000000000000000000000000000000000000001fc0200000000000000000000000000014e24000d040000090a003c0000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000010000000000000000000000000000000000000000ffffffffffffffff00000000000000000300000000000000090000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000feffffff00000000000000000000000044010500e0000002000000000000000000000000000004d6320000000a000000ac1414aa000000000000000000000000053500000303030009000000b4000000070000007f000001000000000000000000000000000004d36c00000000000000fc0100000000000006000000000000000000000000000900010000000080000008000000ac1414aa000000000000000000000000000004d2330000000a000000ac1414bb0000000000000000ddffffff023500000002fa00070000000a00000002000000fe80000000000000000000000000000f000004d43c"], 0x1fc}, 0x1, 0x0, 0x0, 0x11}, 0x0) 2m51.622327611s ago: executing program 0 (id=2335): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) ioctl$VHOST_SET_LOG_BASE(r1, 0x4008af04, &(0x7f0000000300)=&(0x7f0000000240)) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0xea100, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x47f) connect$inet(r2, &(0x7f00000000c0), 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x24, &(0x7f0000000040)=0xffffffffffffffff, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0x8001, 0xfffe, 0x1}, 0x14) shutdown(r2, 0x2) io_setup(0x7, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0xffff1000, 0x1000, &(0x7f00008eb000/0x1000)=nil}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000080)=ANY=[]) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/slabinfo\x00', 0x0, 0x0) ppoll(&(0x7f0000000180)=[{r3, 0x4048}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x400c04, 0x0) close_range(r4, r0, 0x2) mmap(&(0x7f0000532000/0x4000)=nil, 0x4000, 0x100000a, 0x12, r4, 0x45809000) r5 = openat$ashmem(0xffffffffffffff9c, 0x0, 0x20200, 0x0) ioctl$ASHMEM_SET_NAME(r5, 0x41007701, 0x0) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r5, 0x0) read(r4, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_KVMCLOCK_CTRL(0xffffffffffffffff, 0xaead) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0, 0xeeee0000}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)) 2m51.494313773s ago: executing program 0 (id=2338): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000500)='./file1/file0\x00', 0x0, 0x201008, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000000), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000001180)='./bus\x00') r0 = syz_open_dev$loop(&(0x7f0000000100), 0x80000006, 0x48002) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00"}}) 2m51.258345828s ago: executing program 0 (id=2341): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f0000000300)={0x0, 0x0, @pic={0x4, 0x8, 0x1e, 0x7f, 0x4, 0x2f, 0x9e, 0xf3, 0x1, 0xd4, 0x9, 0x3, 0xd, 0x6, 0x14}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x0, 0x2004cb, 0x0, 0xa1d, 0x68ff, 0x5, 0x3, 0x3, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 2m51.022067021s ago: executing program 0 (id=2345): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, 0x0) mmap(&(0x7f0000196000/0x1000)=nil, 0x1000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0x0) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r1, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x12, r1, 0xd1383000) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000007, 0x13, r0, 0x0) mmap(&(0x7f0000fee000/0xf000)=nil, 0xf000, 0x0, 0x11, r0, 0x0) ioctl$USBDEVFS_RESETEP(r1, 0x80045503, &(0x7f0000000040)={0x4}) 2m50.962548802s ago: executing program 34 (id=2345): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, 0x0) mmap(&(0x7f0000196000/0x1000)=nil, 0x1000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0x0) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r1, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x12, r1, 0xd1383000) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000007, 0x13, r0, 0x0) mmap(&(0x7f0000fee000/0xf000)=nil, 0xf000, 0x0, 0x11, r0, 0x0) ioctl$USBDEVFS_RESETEP(r1, 0x80045503, &(0x7f0000000040)={0x4}) 2m28.671124979s ago: executing program 1 (id=2613): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040), 0x280, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x8000) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, 0x0) (async) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3, 0x12, r0, 0x4d75d000) (async) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000080)={[{0x2b, 'freezer'}, {0x2b, 'blkio'}, {0x0, 'net'}, {0x2b, 'perf_event'}, {0x2b, 'io'}, {0x2d, 'devices'}, {0x2b, 'net'}, {0x2d, 'blkio'}, {0x2b, 'freezer'}, {0x2b, 'rdma'}]}, 0x49) 2m28.486236562s ago: executing program 1 (id=2614): r0 = socket$netlink(0x10, 0x3, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000200), 0x4) syz_genetlink_get_family_id$nl80211(0x0, r0) syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0) 2m28.398465853s ago: executing program 1 (id=2615): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000058c0)=ANY=[@ANYBLOB="fc01000013000100000000000000000000000000000000000000000000000001fc020000000000000000000000000001", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000010000000000000000000000000000000000000000ffffffffffffffff00000000000000000300000000000000090000000000000000000000000000000000000000000000010000000000000000000700000000000000000000000000feffffff00000000000000000000000044010500e0000002000000000000000000000000000004d632"], 0x1fc}, 0x1, 0x0, 0x0, 0x11}, 0x0) 2m28.264993726s ago: executing program 1 (id=2618): fsopen(&(0x7f0000000000)='selinuxfs\x00', 0x0) readlink(0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@xino_on}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r0 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', &(0x7f00000001c0)={0x101081, 0x41, 0x4}, 0x18) chdir(&(0x7f00000003c0)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) mkdirat(r0, &(0x7f0000000200)='./file0\x00', 0x104) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(r2, &(0x7f00000021c0)={0x2020}, 0x2020) ptrace$getsig(0x4202, r1, 0x2000000000006b, &(0x7f00000000c0)) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', &(0x7f0000000140), 0x4800, &(0x7f0000000040)=ANY=[@ANYBLOB="6673636f6e746578743d756e636ff43707003a60b43ff8cf2890ec2b77ee3d1c2cc466aedafcafa3d81074017bebc69c047e621edf3f10cff4249487e250772d1fd2ad04ec3b3c1b92711d6d9143e2ea8ab44d0fc78d23ee553bade864e89e18ae6016465395f1d2824146f611d154034d6fc5acb6a38c51829d52f71c7ba6794c6bd28c9cc72bd0450b43bf455e538b80e687e5b169b955365002356d6634f0a2582708d4d8a0c09e0a9dc7151cbc227fe445a92a66e2ced72342074083"]) 2m27.357583169s ago: executing program 1 (id=2628): openat$binderfs(0xffffffffffffff9c, 0x0, 0x1002, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x22102, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = eventfd(0xfffffffe) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000100)={0x2, 0x0, [{0x4, 0x2, 0x0, 0x0, @msi={0x902, 0x6, 0x7, 0x9}}, {0x9, 0x2, 0x0, 0x0, @msi={0x7, 0x3fffc00, 0x1, 0x5}}]}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x1}) 2m23.715043316s ago: executing program 1 (id=2668): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_usb_connect$cdc_ncm(0x0, 0x94, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020000102505a1a44000010203010902820002010000000904000001020d0000052406000105240000000d240f01feffffff000000000006241a0000000c241b070005008e0118000f0524"], 0x0) (async) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f00000003c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010226bd7000fcdbdf250c0000001000038008000200080000000400040018000076657468315f766c616e000000000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20000094}, 0x404c004) socket$nl_xfrm(0x10, 0x3, 0x6) (async) mremap(&(0x7f0000ff6000/0x4000)=nil, 0x4000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) (async) r2 = socket$nl_audit(0x10, 0x3, 0x9) (async) r3 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCGARP(r3, 0x8954, &(0x7f0000000000)={{0x2, 0x4e21, @remote}, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x6a, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 'virt_wifi0\x00'}) (async) r4 = socket$unix(0x1, 0x1, 0x0) r5 = dup2(r4, r2) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000f40)={'ip6gre0\x00', &(0x7f0000000ec0)={'ip6gre0\x00', 0x0, 0x29, 0x1, 0x1, 0x97, 0x2, @loopback, @remote, 0x20, 0x7800, 0x1, 0xfff}}) (async) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='defcontext', @ANYRES16]) (async) ioctl$KVM_DIRTY_TLB(r5, 0x4010aeaa, &(0x7f0000000080)={0x100000000, 0x2}) (async) mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r5, 0xf) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x400000, 0x0) 2m23.611302357s ago: executing program 35 (id=2668): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_usb_connect$cdc_ncm(0x0, 0x94, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020000102505a1a44000010203010902820002010000000904000001020d0000052406000105240000000d240f01feffffff000000000006241a0000000c241b070005008e0118000f0524"], 0x0) (async) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f00000003c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010226bd7000fcdbdf250c0000001000038008000200080000000400040018000076657468315f766c616e000000000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20000094}, 0x404c004) socket$nl_xfrm(0x10, 0x3, 0x6) (async) mremap(&(0x7f0000ff6000/0x4000)=nil, 0x4000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) (async) r2 = socket$nl_audit(0x10, 0x3, 0x9) (async) r3 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCGARP(r3, 0x8954, &(0x7f0000000000)={{0x2, 0x4e21, @remote}, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x6a, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 'virt_wifi0\x00'}) (async) r4 = socket$unix(0x1, 0x1, 0x0) r5 = dup2(r4, r2) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000f40)={'ip6gre0\x00', &(0x7f0000000ec0)={'ip6gre0\x00', 0x0, 0x29, 0x1, 0x1, 0x97, 0x2, @loopback, @remote, 0x20, 0x7800, 0x1, 0xfff}}) (async) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='defcontext', @ANYRES16]) (async) ioctl$KVM_DIRTY_TLB(r5, 0x4010aeaa, &(0x7f0000000080)={0x100000000, 0x2}) (async) mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r5, 0xf) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x400000, 0x0) 2m6.334295617s ago: executing program 4 (id=2867): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000058c0)=ANY=[@ANYBLOB="fc01000013000100000000000000000000000000000000000000000000000001fc0200000000000000000000000000014e24000d040000090a00000032000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000010000000000000000000000000000000000000000ffffffffffffffff00000000000000000300000000000000090000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000feffffff00000000000000000000000044010500e0000002000000000000000000000000000004d632"], 0x1fc}, 0x1, 0x0, 0x0, 0x11}, 0x0) 2m6.334132757s ago: executing program 4 (id=2868): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) (async) r1 = getpgrp(0x0) r2 = gettid() kcmp(r1, r2, 0x7ffffffe, 0xffffffffffffffff, 0xffffffffffffffff) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0xa, 0x2}) (async, rerun: 32) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/pm_test', 0x1a1081, 0x18) (rerun: 32) write$khugepaged_scan(r3, &(0x7f0000000000), 0x8) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) (async, rerun: 64) r4 = openat$kvm(0x0, &(0x7f00000002c0), 0x1c4042, 0x0) (rerun: 64) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r5, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, 0x1}) ioctl$KVM_SET_GSI_ROUTING(r5, 0x4008ae6a, &(0x7f0000000180)=ANY=[@ANYBLOB="bc"]) (async) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1842, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7902}) r7 = socket(0xa, 0x1, 0x0) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e24, @private=0xa010100}, 0x10) (async) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000000)={'macsec0\x00', @random="010000204500"}) (async) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) 2m6.244538468s ago: executing program 4 (id=2869): mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='./file0\x00', 0x0, 0x0) syz_fuse_handle_req(r0, &(0x7f00000021c0), 0x2000, &(0x7f00000041c0)={&(0x7f0000004280)={0x50}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r0, &(0x7f0000004300)="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200", 0x2000, &(0x7f0000006300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000063c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2m6.11244722s ago: executing program 4 (id=2872): openat$binderfs(0xffffffffffffff9c, 0x0, 0x1002, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x22102, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x4e24, 0x0, 0x2, 0x0, 0x20}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xc}, {}, 0x4, 0x0, 0x1, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x2, @in6=@loopback, 0x0, 0x2, 0x1, 0x4}}, 0xe8) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) r3 = syz_open_procfs(0x0, &(0x7f0000000300)='net/anycast6\x00') read$FUSE(r3, &(0x7f0000000640)={0x2020}, 0x2020) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000180)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r4) syz_clone(0xa0083200, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$TUNGETDEVNETNS(r4, 0xff05, 0x0) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x560d, &(0x7f0000000000)={0x2, {0x2, 0x101, 0x300, 0x0, 0x101, 0x300}}) ioctl$NS_GET_PARENT(r5, 0xb702, 0x0) r6 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$selinux_attr(r6, &(0x7f00000000c0)='system_u:object_r:printer_device_t:s0\x00', 0x9) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r8 = eventfd(0xfffffffe) r9 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x40c01) ioctl$USBDEVFS_GET_SPEED(r9, 0x551f) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000000400001eaf6cb7000000000000000000020900000600000007000000091200"/56]) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r8, 0x1}) 2m5.921540563s ago: executing program 4 (id=2873): openat$binderfs(0xffffffffffffff9c, 0x0, 0x1002, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x22102, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = eventfd(0xfffffffe) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000100)={0x1, 0x0, [{0x4, 0x2, 0x0, 0x0, @msi={0x902, 0x6, 0x7, 0x9}}]}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x1, 0x4000000}) 2m5.697901157s ago: executing program 4 (id=2874): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="2c0000000203050000000000000000000300000608000b40f43778adb80a2c4b61b2789e3278e55200005575080004400000003b0800054000000008"], 0x2c}}, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) getsockname(r2, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x0) write(r2, &(0x7f0000000340)="41000000010001", 0x7) getpeername$packet(r3, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000300)=0x14) r4 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x4e24, 0x0, 0x2, 0x0, 0x20}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xc}, {}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x2, 0x1, 0x4}}, 0xe8) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x4020aeb2, &(0x7f0000000080)={0x0, 0x0, @ioapic={0x100010000, 0x1, 0x0, 0x0, 0x0, [{0x6, 0x7, 0x8, '\x00', 0xab}, {0x2, 0x0, 0x2, '\x00', 0x5b}, {0x60, 0x4, 0x8, '\x00', 0x3}, {0x5, 0x6, 0x3, '\x00', 0xf1}, {0xc, 0xc, 0x9, '\x00', 0x43}, {0x4, 0x79, 0xc5, '\x00', 0x6}, {0x94, 0x5, 0x9, '\x00', 0xfe}, {0x1, 0x0, 0x6, '\x00', 0xfc}, {0x1, 0x4, 0x9, '\x00', 0x33}, {0x1, 0xf, 0x57, '\x00', 0x9}, {0x5, 0x4, 0x1, '\x00', 0x6}, {0x81, 0x6, 0x6, '\x00', 0x48}, {0x7, 0x3, 0x8, '\x00', 0xff}, {0x6, 0x3, 0xa3, '\x00', 0x2}, {0x7, 0x0, 0x3, '\x00', 0x50}, {0xd, 0x2, 0xd, '\x00', 0x6}, {0x8, 0x80, 0x80, '\x00', 0xb}, {0x3, 0x89, 0x1, '\x00', 0xe}, {0x78, 0x7, 0x2, '\x00', 0x7}, {0x3, 0x3, 0xc1, '\x00', 0x7}, {0x5, 0x26, 0x5, '\x00', 0x9}, {0x7, 0x9, 0xe2, '\x00', 0x6}, {0xf9, 0xd, 0x81, '\x00', 0x81}, {0xfd, 0x3, 0x80, '\x00', 0x6}]}}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x60303, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000200)={0x0, 0x6, 0xf000, 0x2000, &(0x7f0000f9a000/0x2000)=nil}) ioctl$KVM_SET_VCPU_EVENTS(r7, 0x4400ae8f, &(0x7f0000000000)=@x86={0x0, 0x40, 0x81, 0x0, 0xf43f, 0xb, 0x49, 0x7, 0x2, 0xfb, 0x3, 0xa4, 0x0, 0x4, 0x6bd, 0x2, 0x8, 0x1, 0x7, '\x00', 0x2, 0x5}) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]}) setsockopt$MRT6_DONE(r4, 0x29, 0xc9, 0x0, 0x0) close_range(r8, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000180)=[@clear_death={0x400c630f, 0x2}], 0x0, 0x0, 0x0}) 2m5.663219077s ago: executing program 36 (id=2874): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="2c0000000203050000000000000000000300000608000b40f43778adb80a2c4b61b2789e3278e55200005575080004400000003b0800054000000008"], 0x2c}}, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) getsockname(r2, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x0) write(r2, &(0x7f0000000340)="41000000010001", 0x7) getpeername$packet(r3, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000300)=0x14) r4 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x4e24, 0x0, 0x2, 0x0, 0x20}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xc}, {}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x2, 0x1, 0x4}}, 0xe8) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x4020aeb2, &(0x7f0000000080)={0x0, 0x0, @ioapic={0x100010000, 0x1, 0x0, 0x0, 0x0, [{0x6, 0x7, 0x8, '\x00', 0xab}, {0x2, 0x0, 0x2, '\x00', 0x5b}, {0x60, 0x4, 0x8, '\x00', 0x3}, {0x5, 0x6, 0x3, '\x00', 0xf1}, {0xc, 0xc, 0x9, '\x00', 0x43}, {0x4, 0x79, 0xc5, '\x00', 0x6}, {0x94, 0x5, 0x9, '\x00', 0xfe}, {0x1, 0x0, 0x6, '\x00', 0xfc}, {0x1, 0x4, 0x9, '\x00', 0x33}, {0x1, 0xf, 0x57, '\x00', 0x9}, {0x5, 0x4, 0x1, '\x00', 0x6}, {0x81, 0x6, 0x6, '\x00', 0x48}, {0x7, 0x3, 0x8, '\x00', 0xff}, {0x6, 0x3, 0xa3, '\x00', 0x2}, {0x7, 0x0, 0x3, '\x00', 0x50}, {0xd, 0x2, 0xd, '\x00', 0x6}, {0x8, 0x80, 0x80, '\x00', 0xb}, {0x3, 0x89, 0x1, '\x00', 0xe}, {0x78, 0x7, 0x2, '\x00', 0x7}, {0x3, 0x3, 0xc1, '\x00', 0x7}, {0x5, 0x26, 0x5, '\x00', 0x9}, {0x7, 0x9, 0xe2, '\x00', 0x6}, {0xf9, 0xd, 0x81, '\x00', 0x81}, {0xfd, 0x3, 0x80, '\x00', 0x6}]}}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x60303, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000200)={0x0, 0x6, 0xf000, 0x2000, &(0x7f0000f9a000/0x2000)=nil}) ioctl$KVM_SET_VCPU_EVENTS(r7, 0x4400ae8f, &(0x7f0000000000)=@x86={0x0, 0x40, 0x81, 0x0, 0xf43f, 0xb, 0x49, 0x7, 0x2, 0xfb, 0x3, 0xa4, 0x0, 0x4, 0x6bd, 0x2, 0x8, 0x1, 0x7, '\x00', 0x2, 0x5}) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]}) setsockopt$MRT6_DONE(r4, 0x29, 0xc9, 0x0, 0x0) close_range(r8, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000180)=[@clear_death={0x400c630f, 0x2}], 0x0, 0x0, 0x0}) 47.679903466s ago: executing program 6 (id=3713): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903004000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') 47.366006561s ago: executing program 7 (id=3719): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom0\x00', 0x236c6a693cc55956, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r1, &(0x7f0000003fc0)=[{{&(0x7f0000000000)={0xa, 0x4e24, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6}, 0x1c, 0x0, 0x0, &(0x7f0000003440)=ANY=[], 0xf}}], 0x1, 0x20000091) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f00000021c0)=[@dead_binder_done, @dead_binder_done, @request_death={0x400c630e, 0x2}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002140)={@fd, @fda={0x66646185, 0x8, 0x1, 0x33}, @fd}, &(0x7f00000020c0)}}], 0xffffffffffffff95, 0x0, 0x0}) 47.327047391s ago: executing program 7 (id=3720): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000500)='./file1/file0\x00', 0x0, 0x201008, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000000), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000001180)='./bus\x00') r0 = syz_open_dev$loop(&(0x7f0000000100), 0x80000006, 0x48002) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd0000000000010e00"}}) 47.159300633s ago: executing program 7 (id=3724): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) fsopen(&(0x7f0000000140)='cpuset\x00', 0x1) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x32}, @fda={0x66646185, 0x3fffffffffffffff, 0x0, 0x16}, @ptr={0x70742a85, 0xfffffffc, 0x0, 0x0, 0x1}}, &(0x7f00000004c0)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0}) 47.014037736s ago: executing program 7 (id=3725): mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='./file0\x00', 0x0, 0x0) syz_fuse_handle_req(r0, &(0x7f00000021c0), 0x2000, &(0x7f00000041c0)={&(0x7f0000004280)={0x50}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r0, &(0x7f0000004300)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300", 0x2000, &(0x7f0000006300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000063c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 46.878342698s ago: executing program 7 (id=3728): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000058c0)=ANY=[@ANYBLOB="fc01000013000100000000000000000000000000000000000000000000000001fc0200000000000000000000000000014e24000d040000090a00000000003c00", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000010000000000000000000000000000000000000000ffffffffffffffff00000000000000000300000000000000090000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000feffffff00000000000000000000000044010500e0000002000000000000000000000000000004d6320000000a000000ac1414aa000000000000000000000000053500000303030009000000b4000000070000007f000001000000000000000000000000000004d36c00000000000000fc0100000000000006000000000000000000000000000900010000000080000008000000ac1414aa000000000000000000000000000004d2330000000a000000ac1414bb0000000000000000ddffffff023500000002fa00070000000a00000002000000fe80000000000000000000000000000f000004d43c"], 0x1fc}, 0x1, 0x0, 0x0, 0x11}, 0x0) 46.878029138s ago: executing program 7 (id=3729): r0 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=@getspdinfo={0x14, 0x25, 0x2, 0x70bd26, 0x25dfdbfc, 0x2}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x4040004) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) (async, rerun: 64) syz_clone(0x80001000, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x0) (rerun: 64) ioctl$TUNGETDEVNETNS(r2, 0xff06, 0x0) (async) read(r0, &(0x7f0000000180)=""/95, 0xffffff51) 45.210186714s ago: executing program 6 (id=3747): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000058c0)=ANY=[@ANYBLOB="fc01000013000100000000000000000000000000000000000000000000000001fc0200000000000000000000000000014e24000d040000090a00000000000003", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000010000000000000000000000000000000000000000ffffffffffffffff00000000000000000300000000000000090000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000feffffff00000000000000000000000044010500e0000002000000000000000000000000000004d6320000000a000000ac1414aa000000000000000000000000053500000303030009000000b4000000070000007f000001000000000000000000000000000004d36c00000000000000fc0100000000000006000000000000000000000000000900010000000080000008000000ac1414aa000000000000000000000000000004d2330000000a000000ac1414bb0000000000000000ddffffff023500000002fa00070000000a00000002000000fe80000000000000000000000000000f000004d43c"], 0x1fc}, 0x1, 0x0, 0x0, 0x11}, 0x0) 45.157972365s ago: executing program 6 (id=3749): openat$selinux_load(0xffffffffffffff9c, 0x0, 0x2, 0x0) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x380, 0x2}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000200)=[@request_death={0x400c630e, 0x2}], 0x50, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) (async) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000011c0)=ANY=[@ANYBLOB="12010001090003206d0414c340000000000109022400010000a0000904000001030101000921000800012203000905", @ANYRES64], 0x0) syz_usb_control_io$hid(r1, &(0x7f00000001c0)={0x24, &(0x7f0000001180)=ANY=[@ANYBLOB="00020c0000000c0002"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000001300)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) (async) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000680)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB='@0J'], 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r1, 0x0, &(0x7f0000000a80)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000f80)={0x20, 0x0, 0x4, {0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x20, 0x0, 0x4, {0x2, 0x2}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) prlimit64(0x0, 0xd, &(0x7f00000000c0)={0x200000000005, 0x8000000000200003}, 0x0) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) socket$netlink(0x10, 0x3, 0x7) (async) close(0x3) ioctl$RTC_SET_TIME(0xffffffffffffffff, 0x4024700a, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x145580, 0x0) r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x108202, 0x0) ioctl$BLKZEROOUT(r3, 0x127f, &(0x7f0000000280)={0x6000, 0x80600}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$UHID_INPUT(r4, &(0x7f0000000940)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125b2ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb03bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2033aae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b85b7b26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd6929bbc2850cd4901389e6ea6e86041e0efa1111c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c669bb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b2967cbfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bcddf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d6748c2ce5bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4658098549646bd63175adf77b5cdcf102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4baea02fa76fb4830aebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f8426a9049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21abfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e0068607000000fb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9fb4000000f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002afea6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b46e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae66444a8f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a00", 0xdd52d6c}}, 0x1006) (async) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x4010, r4, 0x0) (async) ioctl$PTP_PIN_SETFUNC(r2, 0x40603d07, &(0x7f0000000080)={'\x00', 0x31291e78, 0x3, 0x4}) (async) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x1}], 0x0, 0x0, 0x0}) (async) socket$inet_udp(0x2, 0x2, 0x0) 43.654482548s ago: executing program 6 (id=3758): prctl$PR_SET_KEEPCAPS(0x8, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x1000, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x400}) ioctl$TUNSETVNETHDRSZ(r1, 0x400454d8, &(0x7f0000000000)=0xd) r3 = getpgrp(0x0) ptrace(0x8, r3) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1081, 0x200000000000}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$RTC_SET_TIME(r4, 0x4024700a, &(0x7f0000000080)={0x25, 0x39, 0x8, 0x7, 0xa, 0x80, 0x4, 0xf, 0xffffffffffffffff}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2d, 0x20, 0x0, 0x0}, 0x10}], 0x0, 0x0, 0x0}) 43.430213362s ago: executing program 6 (id=3759): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000cc0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18, 0x4000080}, 0x10004040) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) setitimer(0x0, &(0x7f00000000c0)={{0xffffffff}, {0xffffffff}}, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_script(r1, &(0x7f0000020240), 0x10010) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000140)={0xa0, 0x0, 0x0, {{0x2, 0x1, 0x8, 0x8001, 0xfff, 0x2, {0x1, 0x339, 0xe, 0x0, 0xe1, 0x9, 0x6, 0x4, 0x2, 0x2000, 0x3, 0x0, 0x0, 0x1, 0x1}}, {0x0, 0x18}}}, 0xa0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x0, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e, 0x2}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x33}, @flat=@binder={0x73622a85, 0xa, 0x2}}, &(0x7f0000000280)={0x0, 0x18, 0x25}}, 0x10}], 0x0, 0x0, 0x0}) 43.406705772s ago: executing program 6 (id=3761): r0 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$FUSE(r1, &(0x7f0000000640)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="f000000010001307269b70000000000000000000000000000000ffffe0000002ac14141b0000000000000000000000004e230001000000030a0000a03a000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000ac1414330000000000000000000000000000000000000000000000000000000008000000000000000a000000000000000600000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000200000000000000fcffffffffffffff0c000000000000000200000028bd700000000000020004000000000000000000"], 0xf0}, 0x1, 0x0, 0x0, 0xc0}, 0x0) syz_clone3(&(0x7f0000002a80)={0x0, 0x0, 0x0, 0x0, {0x24}, 0x0, 0x0, 0x0, &(0x7f0000002a40)=[r2, r2], 0x2}, 0x58) socket(0x2, 0x4, 0x8) timer_create(0x2, 0x0, &(0x7f0000000480)) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timer_delete(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)={0x200a}) read(r0, &(0x7f0000000180)=""/95, 0xffffff51) syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) (async) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) read$FUSE(r1, &(0x7f0000000640)={0x2020}, 0x2020) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="f000000010001307269b70000000000000000000000000000000ffffe0000002ac14141b0000000000000000000000004e230001000000030a0000a03a000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000ac1414330000000000000000000000000000000000000000000000000000000008000000000000000a000000000000000600000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000200000000000000fcffffffffffffff0c000000000000000200000028bd700000000000020004000000000000000000"], 0xf0}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) syz_clone3(&(0x7f0000002a80)={0x0, 0x0, 0x0, 0x0, {0x24}, 0x0, 0x0, 0x0, &(0x7f0000002a40)=[r2, r2], 0x2}, 0x58) (async) socket(0x2, 0x4, 0x8) (async) timer_create(0x2, 0x0, &(0x7f0000000480)) (async) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) (async) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) (async) timer_delete(0x0) (async) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)={0x200a}) (async) read(r0, &(0x7f0000000180)=""/95, 0xffffff51) (async) 30.784115639s ago: executing program 37 (id=3729): r0 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=@getspdinfo={0x14, 0x25, 0x2, 0x70bd26, 0x25dfdbfc, 0x2}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x4040004) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) (async, rerun: 64) syz_clone(0x80001000, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x0) (rerun: 64) ioctl$TUNGETDEVNETNS(r2, 0xff06, 0x0) (async) read(r0, &(0x7f0000000180)=""/95, 0xffffff51) 27.295844343s ago: executing program 38 (id=3761): r0 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$FUSE(r1, &(0x7f0000000640)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="f000000010001307269b70000000000000000000000000000000ffffe0000002ac14141b0000000000000000000000004e230001000000030a0000a03a000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000ac1414330000000000000000000000000000000000000000000000000000000008000000000000000a000000000000000600000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000200000000000000fcffffffffffffff0c000000000000000200000028bd700000000000020004000000000000000000"], 0xf0}, 0x1, 0x0, 0x0, 0xc0}, 0x0) syz_clone3(&(0x7f0000002a80)={0x0, 0x0, 0x0, 0x0, {0x24}, 0x0, 0x0, 0x0, &(0x7f0000002a40)=[r2, r2], 0x2}, 0x58) socket(0x2, 0x4, 0x8) timer_create(0x2, 0x0, &(0x7f0000000480)) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timer_delete(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)={0x200a}) read(r0, &(0x7f0000000180)=""/95, 0xffffff51) syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) (async) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) read$FUSE(r1, &(0x7f0000000640)={0x2020}, 0x2020) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="f000000010001307269b70000000000000000000000000000000ffffe0000002ac14141b0000000000000000000000004e230001000000030a0000a03a000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000ac1414330000000000000000000000000000000000000000000000000000000008000000000000000a000000000000000600000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000200000000000000fcffffffffffffff0c000000000000000200000028bd700000000000020004000000000000000000"], 0xf0}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) syz_clone3(&(0x7f0000002a80)={0x0, 0x0, 0x0, 0x0, {0x24}, 0x0, 0x0, 0x0, &(0x7f0000002a40)=[r2, r2], 0x2}, 0x58) (async) socket(0x2, 0x4, 0x8) (async) timer_create(0x2, 0x0, &(0x7f0000000480)) (async) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) (async) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) (async) timer_delete(0x0) (async) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)={0x200a}) (async) read(r0, &(0x7f0000000180)=""/95, 0xffffff51) (async) 2.262382894s ago: executing program 8 (id=4139): openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) (async) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) read(r0, &(0x7f0000000040)=""/106, 0x6a) 2.258894355s ago: executing program 8 (id=4140): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000058c0)=ANY=[@ANYBLOB="fc01000013000100000000000000000000000000000000000000000000000001fc0200000000000000000000000000014e24000d040000090a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0280ff010000000000000000000000000000000000000000ffffffffffffffff00000000000000000300000000000000090000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000feffffff00000000000000000000000044010500e0000002000000000000000000000000000004d632"], 0x1fc}, 0x1, 0x0, 0x0, 0x11}, 0x0) 2.230246145s ago: executing program 8 (id=4141): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000), 0x0) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', 0x0, 0x120020, &(0x7f0000000000)=ANY=[@ANYBLOB='defcontext', @ANYRESOCT]) 2.192598706s ago: executing program 8 (id=4142): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x202, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000001200)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x48, 0x0, 0x0) setsockopt(r2, 0x0, 0x9, &(0x7f0000000000)="67021d7f3c6435b4622381695390e583c2882249d49cc6fdae221050b957a540cf972fd80b5e06c405953709b6776cde50c9afcee604575c72e0932ad12ddf41343a8f1450f7e9792e9137e31c1158bddcbae90cf03e264e974462ae78e27e0e5e886f6756fda7bc277676860d27ba729abeed61f14d22bf7963fffd70fd657b1e13b2455ccb5767e2da6e2e", 0x8c) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000640)=0x4) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r1, 0x40049366, 0x0) syz_usb_connect$uac1(0x0, 0x0, 0x0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0xf9, 0x3, 0xd5, '\x00', 0x8}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x2040, 0x0) ioctl$ASHMEM_SET_PROT_MASK(r3, 0x40087705, 0x0) 1.762331802s ago: executing program 2 (id=4146): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000058c0)=ANY=[@ANYBLOB="fc01000013000100000000000000000000000000000000000000000000000001fc020000000000000000000000000001", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000010000000000000000000000000000000000000000ffffffffffffffff00000000000000000300000000000000090000000000000000000000000000000000000000000000010000000000000000000000000000000000002000000000feffffff00000000000000000000000044010500e0000002000000000000000000000000000004d632"], 0x1fc}, 0x1, 0x0, 0x0, 0x11}, 0x0) 1.758474932s ago: executing program 2 (id=4147): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x1081, 0x200000000000}) (async) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3314) r1 = syz_clone(0x280, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) (async) ptrace$pokeuser(0x6, r1, 0xd8, 0x0) (async) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000140)) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f00000001c0)=[@enter_looper], 0xda6, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70b7a440b4187098442946238cdd38a235b264899fa2f8b51f8a660653545ab78b6a47b6462efaa8192061344501fb8d96f8de3b132ee012626f94be7b4a9e572a43167614409ee4aa2a40d2feb04bb54137ca025e367e2eee1e8b4f78b741aac17c55ab77d0fd2b7318207e91fd536b9fb7c994a9ad0769020b45bc05965f6dffb15fd462bb2e49632c788cfeb74472be3d9eaf3284719df7187a354b3915df2661363052a24baf8cc101728d302f75878515b436d1fbdb3fc5fc88e8745c56b1bd79dc2cc7e7b5be814275a3edfc67e923d199c97fd6a8b2d11d2923b688471fe8c1e771545d17bad44fc5f7a91cf43ba91b4627c9554a333b6e8ee1c457b54c30bccbbabdfed6158fed6e548cd54ad7409e0a03fb2f685f8987e98ee687a09a730c2a757d3b1595a1146d57230e178284ef3fed5553bbd1e82bd418a13c03f944421d013d96182302122d01c432e24c43a9dff19658a3680167297367a1ee7f70e0968ce28ca2bc8b8525c41f8d4f9cdcaaa25b2d0fea854626eba2e86ecb31e9be7b8e704287fe45ad3f169d7f67e798b0de3bf70f485f81ba5e9aef1ec5782c4c609ffdc93a3bdfeeb7e7cd05ea7023895be4a3f78f188fdbd83ded6dcdf1d429c12b1b250284110295e3515bfb117119839f13057ea2366d3c4b75b28f60afe17b195d04ff58dd2f3382bb57152f2928f9a91bbcc42057777ba13becb4552419caa2ffc325219a6995f5d1e9a193a1aede859834ef765009d6c242ad918ecf3fe62c8dfe2ff309cbce740950cdd05c8e0b7f75aa21731be678552b2d0024a4b3815fb52f056ba37f3f466afab6b5728def0fdef93655524121927df3a39af0845df7612e9ccdae25f406ac0ad7a0e4f980398597ab2c2291d87a1ed618b9e392f1d055d5290be67b6cec9e7505c41025d2aa6e82a4f693042989b5f4a9abfe0ec51fd9dcb972a054b80ee6a460fd422eaa971e2cb759c72e676e2877c667c6ce002be1ce6ba8380e6dd691590c84ba68d26f3284280dcacd082b42bf5aac71467b3fcd5d68ab1bc26cf48fe770ccff5f14ff8afafb18d3127a6d989b7d77665a7a9bf4cb488621c904acd0b073396ad8509c9ddb02eb1d23510a52289a5f0d7edba66d4ef271b9c6acc3bfa996b55f6808650236b0001132ef85fc5070b69144ff5fdd8d64f6c3e0dd22711f69a940ebdb4ab5ff6240da3160049d2047e6713d47ad0db40ec543c095ad67c8cbe438fb875927c98e265498b3da8d4ca54bac0e6efe759a2d4d4190e9fc8835599da8237f472411a71236bb930d28a26f49062d270f4087a6a709c005eebc9740ed54dd005c787c44badac9c720b0d424d0ded9bb8c24c0e842deedf386fc7714a31268292d3bcc53b1cf24b156445c8bf64336f742b1ba836eba0ae4a5aaa9a6f35d4f81734e16bce965795d5b1255609d1860fe11c9c536db078af94772830ba000c13e1d9383e3d862fa07f2199da148632c036bc19f6014eeb206a3654d390c78911deeabebf128def61122754e0a4696db82666a018f8d2f44b5aadc12809ade8bed1b1ba2adbb6e3e82180e26748dc30a8eda0edb21fcaa702632ed3fb4e89550c3e0e1fd2b5ecf1983d85bf9569b231e28155756bd97f1220cbc2b5b1c02dab88ee4a8970d4833b9e51529895afe5029823576297d4a917602fe08df57e1d7f63d050877ddf8e82a5383e15f313171b2d5618a1549f3dfced0732b887508ca5e134124d0ed0bd4b767115d1530f73504387e0364d73a2d3b114fcb49219b1c15e066c455b01672e49499995454a502236f5a5007895d3d1d8843007352a3ccc3f71d3e801efd0a6ef922bf39ead16e01ec20ebff2b1ce7cfd0984b26225cb1359b36efe9ad2ae1f6de4862c0faaa52f4d0eb4c13960ceb4aeaa10ae61a09a5abdb0c61661962a0aab14d465a8ae6f45826e1e66428cf8572eb53c98160df6613a62bb611c63f1ffb7a795a889fc16670f6302fd36ee4247bdd4282f1afb6042c832a4b0857cecae0a7090d9b11ae46d9186c710c8dd12911db573493329bea2c743734d86a577cf27aa01e4fc6c91f1fa34bba173d20b97ed8bb4bad43692df90bfd2b193b9e8b93a95ec0d0d42217395d89db511d2e9bbeb3ef47b7b2d81ab54b5c8faa760ef5c0493af13a9327c9432521ed6bfcb9d778d25031da41a983027fe7d794c26326053d38172444307d88501cdd26c3fdeafdf5f599d3dcfd39972f28ec3fb1fb40982615f5d71d6693a8774df072576834c69b89f209b458fad4671f0108fdfc8548a6fcf76a843369a3bca4d2974221ed9af224d151fa8aa73276ba65ca3d8bc98d6504f16bcac30c697f68cb1625b4f2259ee0c694951752845fa11c20fc4dda369d53918c3746918692ee2cda958612808b841b8d36ef3933f5340e1fc8fb10ac2ae97da921f6a67806831356d515c7a32468dfd3385c1ae2008448e5750c3a3d5733b4a2486788550e6353e9b12cc09750d5b9dcd2aedba61d0520e99a51e880d3dd78a2b502029deac1860cf50885f8bf5119491c6b1e06492e98ca64e5e32afbb3b0630cb35b58640afc2188a232f77968c18d2d0e8f91c974edcb3198b4520f530acacb12017216338cc479de3651e8f15f1672397c730e3ca2a189ca4cc85f35dd46aeb67b6a2eb7268a653b190d8ba670490d50f761c1fa25f1954d8fe6bcb15dbc23698c945262b991e6245b9a25b12b13c87bf8a8a06f51784007abd06e01a0c03ee80b236fabb5b22ce797c4d8a739ac96dcf16c93f454463d3631c4cdd2dea6732a486015dc9937ee4e6efbfff46bdd8887094ca4bd94d995f411421c7ef07f949fcc10132f58b7c99a871780d92464594c930b80596baab77b0d68a05d71ca8a1888f3128f12aebac362c4d80870ab3d9f2e77d51f9af16472faff98dda1e0133c8bc2510345d5eb1d64bce64761f4cc39ac6655902338bf1335dc55393995af4447ed1aa4c50bfacd576842560abca3e6c74dcea6dd03d36f9e7f8bda2cf33e3b7da195fba79f5a60421e19910f1fef31b9fa52064ce9ee8c415746a3cab47a8ad8477e9f21e9ee804a85dc568439b95c01bbbc3fa16a8c26bd81b01b8849795b2370f591e2a8e175cd465a600a541839bc734271b4b3afb2303dc1cf12bee00080ad10658c97672ad023e89f23d9301b5dbf1a7ba6d6c2b8dbd300f05f36a095f188b56fd3ba8e871aaf22e2128696e7232cb22f4f5404a3d1256a11665caaead326faad340031cafb99edbceba7bac44c7d2720aedba9cb708dae55b192a1e31835fae8756f062c151f6778b1d93c2d1f8b479ae9bbe1255abcef9beaa95b558fbbc9a979d46580aa85b10f160b438bea64f23b8e605ce34d2b46bbf8bfbfa683b10f55b3d30c58675dd1a524495e5d42c7d02dc60b853e8b3ed2caf41cd24a8a1d044e27d48b2184bac00730f7c20a1ba2bb6b6a5381a3d359d8e721504bbbce18ee49031b48c278a5730f31fb83f6cf32ac98326b722d3e2d7b38a7b80b94a3eb2b69fb1aefc8c0bbe431191f0ed76141a8365621e4f7118dd4465b4642bdb0af21d30c8cfb1d5201852c0428b1983d91f706e814c1395888b1c2a3516ea20a93d868e27c3c9b68a9cda4befc389b57661a4ff37137628ec96bcb625fd10324625ac1589c2918c66f811a323a19ab30bcf28fc20b64176e319d58f74578093e32ba9f51b255693dda9514ff43f6ef6010143554305073e94be322daa024cb7efcf405ea4924bfa72633b766365fee1d59d1a94717450657ff3b72853785e91f94ca1502b129eafa718633bec1557fb1e0ae2887e6e8c0fdd9f3f99de03c0af7364781766520d90c15b0e2a4c43613089dbecc4dd68be74204809f0270370097642d54388ccbb54b58be8b5796eac48ef5f17752eaa7301f075faee593aae71ee0e0ca1f45a22e7cede3597f14a344796ceec33e98b3b89e031c0d757e83d5093322d9afc9898f80b2e9bb17bc8b2b164d048c1b912f6cd92979df629efcb94968cca6e65b9b078677698fa4937a2ec23edd00971a5505ecc65fe150d3d00a34e52cc64951937fc79014b0df8d2c9c35f06209f45556278fa7ecfc70a92eca165bbd493686fb4c0cd607cec994657149a61da2e09414944c557be54908197724174247194d435b25bf78ec4cc164a574662eb4d1e4d784a6ea0c71dd1a16e53a7b8a27fcec679346afe90a05e06b276fe972d5e1d3486e0452d0a9a1636ab9c517f371a0592ef34513a9a4e961cd79c86891f460becb57f41e22b2a72ae175e29344184cde0b2beae00f90a6a79dc689da4b4b1da0e9758854d404a9cbcf725c68b6f2de865b2b5e12124d09f8745208b5cc544522f7c8bcfceb907422502f1641b600a60a5aef28be5a92ff71755efaf29e23c8ca52ad945bbdc4d6e7502adee312ea8d9338a80671f36309026c0d9c2ceb14da0b8beb087853b8014d30372f0d58448530f1bed15c4caaf8a844853030aab1ba6de9891678a16a2d9b9889d4a367753f0aacda03ce6fae1f62b34a3317a704527e65b18dc3186f32c5caa2d82f058066274e145f3cfe0bb5d40a77f54fb0de584d5f50de29d1c3aa29acea2363ef5c1e0592ef94370936df0152871396c13a89e56086f381862edb6f4bec0d937e94a689a8c5c87a51e073fdaa935591bbccff359e0805ded9ac71e3b295fdd05bc2b03d7af58a393778c9dfdfd8101b3503c86a6d9e2fdeb215be40f90bb7360a04e111d743207a8742275ee7df2508b909ea4d3a7af7886d3f26aa58943edbbcbd686bf9cf9a78b43dd9792bca97cda6508340"}) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000980)=ANY=[@ANYBLOB="5800000a000004300002802c0001801400030000000000000000000000006bb7800601000000000000000000000001010c0019800800020022034000"/73], 0x58}, 0x1, 0x0, 0x0, 0x80}, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) r5 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) readv(r5, &(0x7f0000000300)=[{&(0x7f0000000040)=""/39, 0x27}], 0x1) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) (async) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x10}], 0x0, 0x0, 0x0}) (async) r6 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_buf(r6, 0x29, 0x39, &(0x7f0000000180)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) (async, rerun: 32) r7 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) (rerun: 32) setsockopt(r7, 0x107, 0x2001, &(0x7f0000000080)="010000000000060000", 0x9) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0x14, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}}, 0x14}}, 0x0) (async, rerun: 64) fsmount(0xffffffffffffffff, 0x1, 0x2) (rerun: 64) getsockopt$inet6_opts(r6, 0x29, 0x39, 0x0, &(0x7f0000000080)) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000340)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r4, 0x40046208, 0x0) (async, rerun: 32) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x200a82, 0x0) (rerun: 32) 1.729603233s ago: executing program 2 (id=4148): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000100), 0x6, 0x2d00) (async) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0x5, &(0x7f0000000000)=0x9, 0x4) r3 = socket$can_raw(0x1d, 0x3, 0x1) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r4, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x12) sendmsg$DEVLINK_CMD_PORT_GET(r1, &(0x7f0000002740)={&(0x7f0000002600)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000002700)={&(0x7f0000002640)={0xa8, 0x0, 0x0, 0x70bd27, 0x25dfdbfe, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}]}, 0xa8}}, 0x4004) (async) sendto$inet6(r4, &(0x7f0000000000)=':', 0x1, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty, 0x10}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000140)='vegas\x00', 0x6) shutdown(r4, 0x1) (async) close_range(r3, 0xffffffffffffffff, 0x0) (async) connect$bt_sco(r1, &(0x7f0000000580)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, 0x8) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xc, 0x0, &(0x7f0000000500)=[@reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)={@fda={0x66646185, 0x2, 0x1, 0x24}, @fda={0x66646185, 0x4, 0x2, 0x1c}, @ptr={0x70742a85, 0x1, &(0x7f0000000400)=""/217, 0x0, 0x2, 0x1a}}}}, @register_looper], 0xfffffec9, 0x0, &(0x7f0000000340)="a89aff67520a7335b849b4f88a6db06e45e3f5e648a65b8003975be8a982d5135e161a783d3d01fddcbd838bac306058a7e36a9e26b6bb537c85f5ad467697f0d78b"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f00000001c0)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, 0x0}) syz_clone3(&(0x7f00000029c0)={0x0, 0x0, 0x0, 0x0, {0x4}, 0x0, 0x0, 0x0, &(0x7f0000002980)=[0x0], 0x1}, 0x58) (async) read$FUSE(r1, &(0x7f00000005c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) fchown(r1, 0xee00, r5) (async) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0x5e) (async) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000040), 0x12) 1.650400314s ago: executing program 2 (id=4149): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000058c0)=ANY=[@ANYBLOB="fc01000013000100000000000000000000000000000000000000000000000001fc0200000000000000000000000000014e24000d040000090a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="02002b010000000000000000000000000000000000000000ffffffffffffffff00000000000000000300000000000000090000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000feffffff00000000000000000000000044010500e0000002000000000000000000000000000004d632"], 0x1fc}, 0x1, 0x0, 0x0, 0x11}, 0x0) 1.650066514s ago: executing program 2 (id=4150): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x367800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$inet(r4, &(0x7f0000000280), 0x0, 0x0) r5 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r5, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r6 = socket$netlink(0x10, 0x3, 0x0) writev(r6, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r6, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) r7 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) r8 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$RTC_SET_TIME(r8, 0x4024700a, &(0x7f0000000080)={0x25, 0x39, 0xa, 0x3, 0xa, 0x80, 0x4, 0xf, 0xffffffffffffffff}) setsockopt$inet_msfilter(r7, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027f"], 0x57) r9 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r9, 0x107, 0xd, &(0x7f00000004c0)=@req3={0x410000, 0x100000001, 0x210000, 0x1, 0x10000a}, 0x1c) setsockopt$inet_mreqsrc(r5, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) close_range(r3, 0xffffffffffffffff, 0x0) r10 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r11, 0xc008ae88, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000000000093020000000000000900000000000000f0a838fc36ba2f99a4655b16de71c5cd30ea72f14d7a171717f219fedff6ad2a80aed4a5d8a4c8154ab4a442db646ef6086c5dacfb3ee88ef8bbbf7b0a311d6718f8af3c79054a05da73939d4446ff926e46a5b1972f9053ae8944aedc7d3f6d8aef1192dba84ea85d435fff66b3e023e0f04f9b02ca26d97ee021e7cfc560a5b382389bf155e21b992626d2a264d2a4a56a1811589fd46b95ceedc42ba2e9ad1b60e3c0c62892ed7e"]) r12 = syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793f10d10501200002000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r12, 0x0, &(0x7f0000000380)={0x44, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r13 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r13, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r13, 0x0) ioctl$BINDER_WRITE_READ(r13, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f0000000bc0)=""/4096, 0x1000, 0x1, 0x13}, @fda={0x66646185, 0x7, 0x0, 0x24}, @fda={0x66646185, 0x6, 0x0, 0x2a}}, &(0x7f00000004c0)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) 1.505220516s ago: executing program 8 (id=4151): openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x20e02, 0x0) (async) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x20e02, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r0, 0x45809000) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) (async) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$KVM_INTERRUPT(0xffffffffffffffff, 0x4004ae86, 0x0) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) (async) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x0, 0x10000, 0x0, 0x4002004c4, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8d], 0xeeee8000, 0x2011c0}) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) (async) r5 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) mmap$binder(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x11, r5, 0x0) (async) mmap$binder(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x11, r5, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) r7 = add_key$fscrypt_v1(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffffd) r8 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb) ioctl$UI_DEV_CREATE(r5, 0x5501) keyctl$unlink(0x9, r7, r8) recvfrom$inet(r6, 0x0, 0x0, 0x40010122, 0x0, 0x0) (async) recvfrom$inet(r6, 0x0, 0x0, 0x40010122, 0x0, 0x0) ioctl$VHOST_SET_LOG_BASE(r1, 0x4008af04, &(0x7f0000000300)=&(0x7f0000000240)) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f0000000040)={0x1, 0x1, 0x0, &(0x7f0000000180)=""/87, 0x0, 0x8000000}) (async) ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f0000000040)={0x1, 0x1, 0x0, &(0x7f0000000180)=""/87, 0x0, 0x8000000}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x1) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x6746, 0xf, 0x8, 0x800, 0x861, 0xffffffffffffffff}) (async) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x6746, 0xf, 0x8, 0x800, 0x861, 0xffffffffffffffff}) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r5, 0x4008ae48, &(0x7f00000003c0)=0x1) ioctl$sock_FIOSETOWN(r5, 0x8901, &(0x7f00000002c0)=r9) 1.238182611s ago: executing program 5 (id=4153): mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='./file0\x00', 0x0, 0x0) syz_fuse_handle_req(r0, &(0x7f00000021c0), 0x2000, &(0x7f00000041c0)={&(0x7f0000004280)={0x50}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r0, &(0x7f0000004300)="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500", 0x2000, &(0x7f0000006300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000063c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.141632482s ago: executing program 5 (id=4154): ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) setxattr$security_capability(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), &(0x7f00000006c0)=@v2={0x2000000, [{0x1, 0x1}, {0x9, 0x3}]}, 0x14, 0x0) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[], 0x0, 0x0) sendfile(r3, r4, 0x0, 0x20000023896) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x4c, 0x0, &(0x7f0000000d00)=[@transaction_sg={0x400c6313, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000100), r1) sendmsg$IEEE802154_START_REQ(r2, &(0x7f0000000240)={&(0x7f0000000040), 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x24, r5, 0x4, 0x70bd26, 0x25dfdbfc, {}, [@IEEE802154_ATTR_BCN_ORD={0x5, 0x17, 0xf9}, @IEEE802154_ATTR_BCN_ORD={0x5, 0x17, 0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) (async) openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) (async) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) (async) setxattr$security_capability(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0) (async) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), &(0x7f00000006c0)=@v2={0x2000000, [{0x1, 0x1}, {0x9, 0x3}]}, 0x14, 0x0) (async) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[], 0x0, 0x0) (async) sendfile(r3, r4, 0x0, 0x20000023896) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x4c, 0x0, &(0x7f0000000d00)=[@transaction_sg={0x400c6313, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000100), r1) (async) sendmsg$IEEE802154_START_REQ(r2, &(0x7f0000000240)={&(0x7f0000000040), 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x24, r5, 0x4, 0x70bd26, 0x25dfdbfc, {}, [@IEEE802154_ATTR_BCN_ORD={0x5, 0x17, 0xf9}, @IEEE802154_ATTR_BCN_ORD={0x5, 0x17, 0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) (async) 914.581576ms ago: executing program 9 (id=4155): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x40000000000}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000000c0)={0x2, &(0x7f0000000040)=[{0x40, 0x5d, 0x2, 0x8}, {0x6, 0x0, 0x6, 0x1}]}, 0x10) bind$bt_hci(r2, &(0x7f0000000640)={0x1f, 0xffff, 0x2}, 0x6) write(r2, &(0x7f0000000140)="24000000010006", 0x7) r3 = fsopen(&(0x7f0000000040)='fuseblk\x00', 0x0) ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f00000005c0)) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="500100001a00130429bd7000000000000000000000000000000000000000000020010000000000000000000000000000000000004e2400000a0000203b000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0a0101020000000000000000000000000000000032000000e00000010000000000000000000009000000000000000000feffffffffffffff0000000000000000000000000000000008000000000000000000ee000000000081000000000000000000000000000000030000000000000005000000000000000400000000000000060000040000000000000000f9ffffff20000800000000000000000002000481680000000000000060001200726663343130362867636d286165732929000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e8d6a000000080"], 0x150}, 0x1, 0x0, 0x0, 0x612fc0b6c779297b}, 0x0) recvmsg(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000480)=""/24, 0x18}, {&(0x7f00000004c0)=""/36, 0x24}, {&(0x7f0000000500)=""/90, 0x5a}], 0x3, &(0x7f00000005c0)}, 0x40000040) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f00000001c0)='fuseblk\x00', &(0x7f0000000200)='fuseblk\x00', 0x0) read(r3, &(0x7f0000021000)=""/4096, 0x1000) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x2, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) close(0x5) r6 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r5, 0x2) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r7, 0xae03, 0xa7) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x60, 0x0, &(0x7f00000001c0)=[@free_buffer={0x40086303, r6}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000100)={@fda={0x66646185, 0x9, 0x2, 0x10}, @fd={0x66642a85, 0x0, r1}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/207, 0xcf, 0x1, 0x1b}}, &(0x7f0000000040)={0x0, 0x20, 0x38}}}, @request_death], 0x68, 0x0, &(0x7f0000000280)="9234dfc6b9faebc670b45739612c6b950e6dfef5af1db3860006a7be3288a1e6e2a9cb37281772a3f1082e9186b00a67b029f680f1e50367afe52dee3075fae14ca2c1e1156338925c1eb60e102a85004b76f0c8e14160fa3d1c5b11463ab9218f0ec51e28a4097a"}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0xc, 0x0, &(0x7f0000000340)=[@exit_looper, @increfs={0x40046304, 0x2}], 0x0, 0x0, 0x0}) 732.607159ms ago: executing program 9 (id=4156): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000500)='./file1/file0\x00', 0x0, 0x201008, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000000), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000001180)='./bus\x00') r0 = syz_open_dev$loop(&(0x7f0000000100), 0x80000006, 0x48002) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd0000000000000000002000"}}) 630.31685ms ago: executing program 5 (id=4157): ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) userfaultfd(0x80801) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1000, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x68f, 0x58) dup3(r1, r0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000200)=[@acquire, @transaction={0x400c6314, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 559.679241ms ago: executing program 9 (id=4158): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000058c0)=ANY=[@ANYBLOB="fc01000013000100000000000000000000000000000000000000000000000001fc0200000000000000000000000000014e24000d040000090a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020032010000000000000000000000000000000000000000ffffffffffffffff00000000000000000300000000000000090000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000feffffff00000000000000000000000044010500e0000002000000000000000000000000000004d632"], 0x1fc}, 0x1, 0x0, 0x0, 0x11}, 0x0) 433.521003ms ago: executing program 5 (id=4159): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='blkio.bfq.dequeue\x00', 0x0, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x4c, 0x0, &(0x7f0000000540)=[@dead_binder_done, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x26, 0x700000000000000, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) (async) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='blkio.bfq.dequeue\x00', 0x0, 0x0) (async) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x4c, 0x0, &(0x7f0000000540)=[@dead_binder_done, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x26, 0x700000000000000, 0x0}) (async) 378.156484ms ago: executing program 8 (id=4160): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f0000000240)='id_legacy\x00', &(0x7f0000000180)=@secondary) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f0000000100)='asymmetric\x00', &(0x7f0000000140)=@keyring={'key_or_keyring:', r2}) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_X86_SETUP_MCE(r4, 0x4018aee1, &(0x7f0000001200)={0x20, 0x2, 0xc}) recvfrom$inet(r0, 0x0, 0x0, 0x40010122, 0x0, 0x0) r5 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/igmp6\x00') r7 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0xc0042, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_TPR_ACCESS_REPORTING(0xffffffffffffffff, 0xc028ae92, &(0x7f0000000100)={0x10000, 0xfffffff7}) ioctl$KVM_SET_REGS(r9, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x100000000, 0x0, 0x81, 0x100000, 0x0, 0x2004c8, 0x8000000, 0xfffffffffffffffe, 0x1, 0xfffffffffffffffe, 0x0, 0x0, 0xfffffffffffffffd, 0x2], 0x80a0000, 0x42240}) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$KVM_ASSIGN_SET_MSIX_NR(r8, 0x4008ae73, &(0x7f0000000000)={0x800, 0x5}) ioctl$KVM_SET_REGS(r9, 0x4090ae82, &(0x7f0000000640)={[0xa, 0x7, 0x8000, 0x7, 0x2, 0x5, 0xefffffffffffffff, 0xb, 0x0, 0x7fffffffffffffff, 0x0, 0x9, 0x3, 0x1, 0x8000000000000000, 0xff], 0x0, 0x41847}) ioctl$KVM_RUN(r9, 0xae80, 0x0) io_setup(0x3, &(0x7f0000000200)) read(r6, &(0x7f0000000080)=""/190, 0xbe) ioctl$ASHMEM_SET_SIZE(r6, 0x40087703, 0x9250) mmap(&(0x7f0000fee000/0xf000)=nil, 0xf000, 0x0, 0x11, r5, 0x0) ioctl$FIOCLEX(r5, 0x5451) 377.837994ms ago: executing program 9 (id=4161): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) (async) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) openat(r2, &(0x7f00000000c0)='./file0\x00', 0x2041, 0x2) (async) openat(r2, &(0x7f00000000c0)='./file0\x00', 0x2041, 0x2) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @remote}, 0x3}}, 0x2e) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @multicast1}, 0x2}}, 0x2e) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='oom_score_adj\x00') writev(r5, &(0x7f0000000800)=[{&(0x7f0000000280)='2', 0x1}, {&(0x7f00000007c0)="fe", 0x1}], 0x2) (async) writev(r5, &(0x7f0000000800)=[{&(0x7f0000000280)='2', 0x1}, {&(0x7f00000007c0)="fe", 0x1}], 0x2) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) (async) r6 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) getresgid(0x0, 0x0, 0x0) ioctl$KVM_SET_CLOCK(r6, 0x4188aec6, &(0x7f0000000080)={0x0, 0x2, 0x8000, 0x960, 0x3}) (async) ioctl$KVM_SET_CLOCK(r6, 0x4188aec6, &(0x7f0000000080)={0x0, 0x2, 0x8000, 0x960, 0x3}) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r8 = socket$igmp6(0xa, 0x3, 0x2) close_range(r7, 0xffffffffffffffff, 0x0) r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r9, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r9, 0x0) shutdown(r9, 0x1) (async) shutdown(r9, 0x1) syz_open_dev$loop(&(0x7f0000000000), 0xfffffffffffff0ae, 0x10200) (async) r10 = syz_open_dev$loop(&(0x7f0000000000), 0xfffffffffffff0ae, 0x10200) r11 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r12 = syz_open_procfs$userns(0x0, &(0x7f0000000040)) close_range(r8, r12, 0x0) ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f0000000180)={0x8, 0x0, &(0x7f0000000000)=[@register_looper, @exit_looper], 0x0, 0x0, 0x0}) ioctl$LOOP_SET_BLOCK_SIZE(r10, 0x4c09, 0x296f959) 263.518675ms ago: executing program 9 (id=4162): mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='./file0\x00', 0x0, 0x0) syz_fuse_handle_req(r0, &(0x7f00000021c0), 0x2000, &(0x7f00000041c0)={&(0x7f0000004280)={0x50}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r0, &(0x7f0000004300)="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x2000, &(0x7f0000006300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000063c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 238.023666ms ago: executing program 5 (id=4163): openat$ashmem(0xffffffffffffff9c, &(0x7f00000000c0), 0x88601, 0x0) 98.232528ms ago: executing program 5 (id=4164): mount$binderfs(0x0, &(0x7f0000000040)='./binderfs\x00', &(0x7f0000000140), 0x4800, &(0x7f0000000000)=ANY=[@ANYBLOB="7365636c61629a550768"]) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x0, 0x2004cb, 0x0, 0xa1d, 0x68ff, 0x5, 0x0, 0x3, 0x2], 0x10000, 0x202}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x10001, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='rdma.current\x00', 0x275a, 0x0) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000280), 0x8800, 0x0) read(r5, 0x0, 0x0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0x32600) r6 = socket$pppl2tp(0x18, 0x1, 0x1) sendmsg(r6, &(0x7f00000029c0)={0x0, 0x0, 0x0}, 0x2) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x100000d, 0x12, r4, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r3, 0x660c) clock_adjtime(0x0, &(0x7f00000000c0)={0x800, 0xffff, 0x4, 0x100000001, 0x9, 0xfffffffffffffffd, 0xf, 0x4, 0x7, 0x1, 0x2, 0x5, 0x1000, 0x8000, 0x4, 0x9, 0x6, 0x5, 0x1000, 0x9, 0x3, 0x6, 0x7, 0x2, 0x10000, 0x4}) ioctl$TUNSETPERSIST(r3, 0x400454cb, 0x1) 16.34747ms ago: executing program 9 (id=4165): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x4c, 0x0, &(0x7f0000000600)=[@reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x51, 0x0, &(0x7f0000000700)="93ca2efc9445b68c079d41dcfff066e61c4d8f1021949c8c75c29113ed78c691e4a88534e71804ab594c9c0cea97e979adb05f81276775d60f54e903eb87a57f7cbe1f97039cb9d611ffa16ca4582a68cd"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x33}, @fda={0x66646185, 0x5, 0x0, 0xf}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) 0s ago: executing program 2 (id=4166): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xffffffffffffffff) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x4, 0x8002) ioctl$LOOP_SET_BLOCK_SIZE(r1, 0x4c09, 0x2) r2 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r3 = openat(r2, &(0x7f0000000040)='./cgroup\x00', 0x40000, 0x35) read$FUSE(r3, &(0x7f0000002a40)={0x2020}, 0x2020) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_udp_int(r4, 0x11, 0xa, &(0x7f00000001c0)=0x3, 0x4) sendmsg$inet6(r4, &(0x7f00000009c0)={&(0x7f0000000800)={0xa, 0x4e21, 0x6, @remote, 0x2}, 0x1c, &(0x7f00000008c0)=[{&(0x7f0000000840)="cbaa761ecc", 0x5}], 0x1}, 0x55) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) read(r0, &(0x7f0000000280)=""/112, 0x70) kernel console output (not intermixed with test programs): .8.3401'. [ 261.362057][ T9671] rust_binder: validate_parent_fixup: fixup_min_offset=29, parent_offset=27 [ 261.362078][ T9671] rust_binder: Error while translating object. [ 261.381636][ T9671] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 261.387897][ T9671] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:276 [ 261.578810][ T9678] netlink: 64 bytes leftover after parsing attributes in process `syz.8.3406'. [ 261.923153][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 261.924232][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 261.931233][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 261.939031][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 261.945664][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 261.953169][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 261.960355][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 261.966908][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 261.974197][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 261.981851][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 261.988427][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 261.995728][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.002795][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.009347][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.016786][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.023854][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.030420][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.037716][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.044803][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.051390][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.059236][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.066283][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.072852][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.080094][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.088309][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.094901][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.102195][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.109302][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.115856][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.122149][ T307] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 262.137507][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.137772][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.146129][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.153280][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.159808][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.167130][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.174175][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.180787][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.188412][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.195530][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.202061][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.209393][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.217130][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.223763][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.231091][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.238249][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.244774][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.252121][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.259194][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.265781][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.273105][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.280321][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.286855][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.295751][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.302523][ T307] usb 9-1: Using ep0 maxpacket: 16 [ 262.314237][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.314482][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.321009][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.330898][ T307] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 262.348084][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.348374][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.354962][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.361478][ T307] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 262.380525][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.380824][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.387350][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.393884][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.400177][ T307] usb 9-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 262.415734][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.416008][ T9687] rust_binder: Write failure EFAULT in pid:1332 [ 262.422328][ T307] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 262.444149][ T307] usb 9-1: config 0 descriptor?? [ 262.484879][ T9694] netlink: 324 bytes leftover after parsing attributes in process `syz.5.3411'. [ 262.572513][ T9] usb 8-1: USB disconnect, device number 17 [ 262.645359][ T9697] rust_binder: 9696 RLIMIT_NICE not set [ 262.895372][ T307] HID 045e:07da: Invalid code 65791 type 1 [ 262.929039][ T307] input: HID 045e:07da as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/0003:045E:07DA.0036/input/input84 [ 262.955743][ T307] microsoft 0003:045E:07DA.0036: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.8-1/input0 [ 263.059093][ T322] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 263.123225][ T9] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 263.232593][ T322] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 263.248264][ T322] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 263.258209][ T322] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 263.266843][ T322] usb 6-1: SerialNumber: syz [ 263.278145][ T322] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -22 [ 263.315272][ T9] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 2763, setting to 1024 [ 263.326689][ T9] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1024 [ 263.336696][ T9] usb 8-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 263.350132][ T9] usb 8-1: New USB device found, idVendor=a725, idProduct=e46a, bcdDevice= 0.47 [ 263.362073][ T9] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 263.381600][ T9705] raw-gadget.2 gadget.7: fail, usb_ep_enable returned -22 [ 263.495987][ T9707] SELinux: Context o}xd is not valid (left unmapped). [ 263.607427][ T9705] raw-gadget.2 gadget.7: fail, usb_ep_enable returned -22 [ 263.770624][ T322] usb 9-1: USB disconnect, device number 12 [ 263.832187][ T307] usb 6-1: USB disconnect, device number 64 [ 264.076488][ T9] usb 8-1: language id specifier not provided by device, defaulting to English [ 264.300340][ T36] kauditd_printk_skb: 619 callbacks suppressed [ 264.300365][ T36] audit: type=1400 audit(1750463933.087:30656): avc: denied { ioctl } for pid=9704 comm="syz.7.3415" path="/dev/binderfs/binder0" dev="binder" ino=12 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 264.334126][ T36] audit: type=1400 audit(1750463933.087:30657): avc: denied { set_context_mgr } for pid=9704 comm="syz.7.3415" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 264.373826][ T36] audit: type=1400 audit(1750463933.087:30658): avc: denied { map } for pid=9704 comm="syz.7.3415" path="/dev/binderfs/binder0" dev="binder" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 264.414713][ T36] audit: type=1400 audit(1750463933.087:30659): avc: denied { read } for pid=9704 comm="syz.7.3415" path="/dev/binderfs/binder0" dev="binder" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 264.446757][ T36] audit: type=1400 audit(1750463933.087:30660): avc: denied { ioctl } for pid=9704 comm="syz.7.3415" path="/dev/binderfs/binder0" dev="binder" ino=12 ioctlcmd=0x6201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 264.502374][ T9] cdc_ether 8-1:1.0: probe with driver cdc_ether failed with error -71 [ 264.511362][ T36] audit: type=1400 audit(1750463933.087:30661): avc: denied { call } for pid=9704 comm="syz.7.3415" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 264.526749][ T9] usb 8-1: USB disconnect, device number 18 [ 264.582139][ T36] audit: type=1400 audit(1750463933.125:30662): avc: denied { read write } for pid=8239 comm="syz-executor" name="loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 264.606904][ T36] audit: type=1400 audit(1750463933.125:30663): avc: denied { read write open } for pid=8239 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 264.651268][ T9717] netlink: 324 bytes leftover after parsing attributes in process `syz.8.3420'. [ 264.655746][ T36] audit: type=1400 audit(1750463933.125:30664): avc: denied { ioctl } for pid=8239 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 264.711963][ T9719] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:296 [ 264.735687][ T36] audit: type=1400 audit(1750463933.144:30665): avc: denied { read write } for pid=9709 comm="syz.8.3417" name="fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 264.790946][ T307] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 264.951296][ T307] usb 6-1: Using ep0 maxpacket: 16 [ 264.959117][ T307] usb 6-1: config 0 has an invalid interface number: 105 but max is 0 [ 264.967699][ T307] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 264.977894][ T307] usb 6-1: config 0 has no interface number 0 [ 264.987442][ T307] usb 6-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 264.997895][ T307] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 265.006734][ T307] usb 6-1: Product: syz [ 265.010951][ T307] usb 6-1: Manufacturer: syz [ 265.016278][ T307] usb 6-1: SerialNumber: syz [ 265.024434][ T307] usb 6-1: config 0 descriptor?? [ 265.032297][ T307] usb 6-1: Found UVC 0.00 device syz (046d:08f3) [ 265.039214][ T307] usb 6-1: No valid video chain found. [ 265.323856][ T9728] rust_binder: 9714 RLIMIT_NICE not set [ 265.324957][ T307] usb 6-1: USB disconnect, device number 65 [ 265.370623][ T9727] rust_binder: Failed to allocate buffer. len:8, is_oneway:true [ 265.370668][ T9727] rust_binder: Failure in copy_transaction_data: BR_DEAD_REPLY [ 265.378435][ T9727] rust_binder: Failure BR_DEAD_REPLY during reply - delivering BR_FAILED_REPLY to sender. [ 265.721028][ T49] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 265.924157][ T49] usb 8-1: Using ep0 maxpacket: 16 [ 265.947916][ T49] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 265.965101][ T49] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 265.979301][ T49] usb 8-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 265.988893][ T49] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 266.002141][ T49] usb 8-1: config 0 descriptor?? [ 266.172762][ T9745] netlink: 324 bytes leftover after parsing attributes in process `syz.8.3431'. [ 266.451571][ T49] HID 045e:07da: Invalid code 65791 type 1 [ 266.477304][ T49] input: HID 045e:07da as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/0003:045E:07DA.0037/input/input85 [ 266.515668][ T49] microsoft 0003:045E:07DA.0037: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.7-1/input0 [ 267.142922][ T1038] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 267.303270][ T1038] usb 6-1: Using ep0 maxpacket: 16 [ 267.313777][ T1038] usb 6-1: config 0 has no interfaces? [ 267.315767][ T49] usb 8-1: USB disconnect, device number 19 [ 267.320914][ T1038] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 267.356480][ T1038] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 267.382875][ T1038] usb 6-1: config 0 descriptor?? [ 267.718998][ T9769] binder: Unknown parameter 'fscononfined_u' [ 267.792785][ T9773] netlink: 324 bytes leftover after parsing attributes in process `syz.8.3441'. [ 267.955869][ T9778] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION freeze notification not active [ 267.998180][ T9778] rust_binder: Write failure EINVAL in pid:326 [ 268.297779][ T9785] kvm_intel: kvm [9783]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0x1d9) = 0x3 [ 268.589475][ T9792] rust_binder: Read failure Err(EAGAIN) in pid:404 [ 268.591941][ T9792] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:404 [ 268.811786][ T9799] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:329 [ 268.833159][ T9799] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 268.853466][ T9799] rust_binder: Read failure Err(EFAULT) in pid:329 [ 268.945072][ T9801] netlink: 324 bytes leftover after parsing attributes in process `syz.8.3452'. [ 269.029823][ T9805] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 3 [ 269.037248][ T9805] rust_binder: Write failure EINVAL in pid:333 [ 269.216861][ T10] usb 8-1: new high-speed USB device number 20 using dummy_hcd [ 269.398581][ T10] usb 8-1: Using ep0 maxpacket: 16 [ 269.407815][ T10] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 269.419461][ T10] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 269.432328][ T10] usb 8-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 269.441429][ T10] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 269.452347][ T10] usb 8-1: config 0 descriptor?? [ 269.677224][ T36] kauditd_printk_skb: 592 callbacks suppressed [ 269.677243][ T36] audit: type=1400 audit(1750463938.120:31258): avc: denied { ioctl } for pid=9802 comm="syz.7.3453" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 269.709880][ T36] audit: type=1400 audit(1750463938.120:31259): avc: denied { ioctl } for pid=9802 comm="syz.7.3453" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 269.923964][ T36] audit: type=1400 audit(1750463938.344:31260): avc: denied { ioctl } for pid=9802 comm="syz.7.3453" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 269.925607][ T10] HID 045e:07da: Invalid code 65791 type 1 [ 269.949072][ T36] audit: type=1400 audit(1750463938.344:31261): avc: denied { ioctl } for pid=9802 comm="syz.7.3453" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 269.986326][ T10] input: HID 045e:07da as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/0003:045E:07DA.0038/input/input86 [ 270.000415][ T36] audit: type=1400 audit(1750463938.419:31262): avc: denied { read } for pid=94 comm="acpid" name="event3" dev="devtmpfs" ino=1508 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 270.024067][ T36] audit: type=1400 audit(1750463938.419:31263): avc: denied { read open } for pid=94 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=1508 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 270.048346][ T10] microsoft 0003:045E:07DA.0038: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.7-1/input0 [ 270.068525][ T10] usb 6-1: USB disconnect, device number 66 [ 270.072127][ T36] audit: type=1400 audit(1750463938.475:31264): avc: denied { ioctl } for pid=94 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=1508 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 270.136225][ T36] audit: type=1400 audit(1750463938.475:31265): avc: denied { ioctl } for pid=94 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=1508 ioctlcmd=0x4521 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 270.243760][ T36] audit: type=1400 audit(1750463938.475:31266): avc: denied { ioctl } for pid=94 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=1508 ioctlcmd=0x4506 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 270.350099][ T36] audit: type=1400 audit(1750463938.494:31267): avc: denied { read write } for pid=4400 comm="syz-executor" name="loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 270.421311][ T9827] netlink: 324 bytes leftover after parsing attributes in process `syz.5.3462'. [ 270.855456][ T307] usb 8-1: USB disconnect, device number 20 [ 270.875806][ T9843] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:1376 [ 271.079104][ T9851] overlayfs: failed to resolve './file0': -2 [ 271.141452][ T9854] netlink: 324 bytes leftover after parsing attributes in process `syz.5.3473'. [ 271.357036][ T9859] rust_binder: Write failure EINVAL in pid:1387 [ 271.521587][ T9864] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:364 [ 271.684709][ T9870] kernel profiling enabled (shift: 63) [ 271.690104][ T9872] netlink: 324 bytes leftover after parsing attributes in process `syz.5.3482'. [ 271.707752][ T9870] profiling shift: 63 too large [ 271.745255][ T9874] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 271.745289][ T9874] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:416 [ 271.782788][ T9876] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:366 [ 272.231601][ T814] usb 6-1: new high-speed USB device number 67 using dummy_hcd [ 272.306439][ T307] usb 8-1: new low-speed USB device number 21 using dummy_hcd [ 272.442656][ T814] usb 6-1: Using ep0 maxpacket: 16 [ 272.455802][ T814] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 272.488163][ T307] usb 8-1: Invalid ep0 maxpacket: 16 [ 272.494435][ T814] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 272.527860][ T814] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 272.538065][ T814] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 272.544021][ T9901] netlink: 324 bytes leftover after parsing attributes in process `syz.8.3492'. [ 272.548313][ T814] usb 6-1: config 0 descriptor?? [ 272.606395][ T9903] binder: Unknown parameter '{' [ 272.653437][ T307] usb 8-1: new low-speed USB device number 22 using dummy_hcd [ 272.840959][ T307] usb 8-1: Invalid ep0 maxpacket: 16 [ 272.846868][ T307] usb usb8-port1: attempt power cycle [ 272.995454][ T814] HID 045e:07da: Invalid code 65791 type 1 [ 273.003136][ T814] input: HID 045e:07da as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:045E:07DA.0039/input/input87 [ 273.017087][ T814] microsoft 0003:045E:07DA.0039: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.5-1/input0 [ 273.172393][ T49] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 273.215167][ T307] usb 8-1: new low-speed USB device number 23 using dummy_hcd [ 273.237171][ T307] usb 8-1: Invalid ep0 maxpacket: 16 [ 273.311372][ T49] usb 7-1: device descriptor read/64, error -71 [ 273.375542][ T307] usb 8-1: new low-speed USB device number 24 using dummy_hcd [ 273.397526][ T307] usb 8-1: Invalid ep0 maxpacket: 16 [ 273.402956][ T307] usb usb8-port1: unable to enumerate USB device [ 273.567971][ T49] usb 7-1: device descriptor read/64, error -71 [ 273.824547][ T49] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 273.856703][ T307] usb 6-1: USB disconnect, device number 67 [ 273.963484][ T49] usb 7-1: device descriptor read/64, error -71 [ 274.220073][ T49] usb 7-1: device descriptor read/64, error -71 [ 274.338087][ T49] usb usb7-port1: attempt power cycle [ 274.663334][ T9928] netlink: 324 bytes leftover after parsing attributes in process `syz.5.3503'. [ 274.701127][ T49] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 274.728904][ T9932] SELinux: security_context_str_to_sid (syte) failed with errno=-22 [ 274.745842][ T49] usb 7-1: device descriptor read/8, error -71 [ 274.899004][ T49] usb 7-1: device descriptor read/8, error -71 [ 274.925676][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 274.925676][ T6130] Bluetooth: hci0: command 0x1003 tx timeout [ 275.059277][ T36] kauditd_printk_skb: 571 callbacks suppressed [ 275.059293][ T36] audit: type=1400 audit(1750463943.143:31839): avc: denied { read } for pid=9937 comm="syz.8.3508" name="binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 275.085995][ T10] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 275.088204][ T36] audit: type=1400 audit(1750463943.143:31840): avc: denied { read open } for pid=9937 comm="syz.8.3508" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 275.120044][ T36] audit: type=1400 audit(1750463943.143:31841): avc: denied { read } for pid=9937 comm="syz.8.3508" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 275.143252][ T36] audit: type=1400 audit(1750463943.143:31842): avc: denied { read open } for pid=9937 comm="syz.8.3508" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 275.166915][ T36] audit: type=1400 audit(1750463943.143:31843): avc: denied { ioctl } for pid=9937 comm="syz.8.3508" path="/dev/kvm" dev="devtmpfs" ino=13 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 275.191559][ T49] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 275.192744][ T36] audit: type=1400 audit(1750463943.152:31844): avc: denied { read write } for pid=9937 comm="syz.8.3508" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 275.218117][ T49] usb 7-1: device descriptor read/8, error -71 [ 275.222365][ T36] audit: type=1400 audit(1750463943.152:31845): avc: denied { read write open } for pid=9937 comm="syz.8.3508" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 275.252863][ T36] audit: type=1400 audit(1750463943.152:31846): avc: denied { ioctl } for pid=9937 comm="syz.8.3508" path="/dev/kvm" dev="devtmpfs" ino=13 ioctlcmd=0xae05 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 275.277762][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 275.278007][ T36] audit: type=1400 audit(1750463943.152:31847): avc: denied { ioctl } for pid=9937 comm="syz.8.3508" path="/dev/binderfs/binder0" dev="binder" ino=4 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 275.306839][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 275.309472][ T36] audit: type=1400 audit(1750463943.152:31848): avc: denied { set_context_mgr } for pid=9937 comm="syz.8.3508" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 275.331866][ T10] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 275.358870][ T10] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 275.367977][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 275.377324][ T10] usb 6-1: config 0 descriptor?? [ 275.387890][ T49] usb 7-1: device descriptor read/8, error -71 [ 275.503023][ T49] usb usb7-port1: unable to enumerate USB device [ 275.549727][ T9947] SELinux: security_context_str_to_sid () failed with errno=-22 [ 275.826601][ T10] HID 045e:07da: Invalid code 65791 type 1 [ 275.838210][ T10] input: HID 045e:07da as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:045E:07DA.003A/input/input89 [ 275.856973][ T10] microsoft 0003:045E:07DA.003A: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.5-1/input0 [ 275.907547][ T9954] netlink: 324 bytes leftover after parsing attributes in process `syz.7.3513'. [ 276.049450][ T9957] binder: Bad value for 'max' [ 276.275537][ T9967] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 276.278724][ T9967] rust_binder: Error while translating object. [ 276.285447][ T9967] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 276.291668][ T9967] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:394 [ 276.492095][ T9974] netlink: 324 bytes leftover after parsing attributes in process `syz.6.3522'. [ 276.700330][ T307] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 276.705719][ T9] usb 6-1: USB disconnect, device number 68 [ 276.892705][ T307] usb 9-1: Using ep0 maxpacket: 16 [ 276.900934][ T307] usb 9-1: unable to get BOS descriptor or descriptor too short [ 276.926184][ T307] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 276.947095][ T307] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 276.979677][ T307] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 277.002063][ T307] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 277.016143][ T307] usb 9-1: Product: syz [ 277.018119][ T9992] netlink: 300 bytes leftover after parsing attributes in process `syz.6.3528'. [ 277.020369][ T307] usb 9-1: Manufacturer: syz [ 277.039707][ T307] usb 9-1: SerialNumber: syz [ 277.104330][ T9995] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 277.105029][ T9995] rust_binder: Failed to allocate buffer. len:128, is_oneway:false [ 277.240626][T10005] netlink: 324 bytes leftover after parsing attributes in process `syz.7.3531'. [ 277.266075][ T9972] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 277.274909][ T9972] rust_binder: Error while translating object. [ 277.302789][ T9972] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 277.309001][ T9972] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:396 [ 277.347593][T10009] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 277.431917][T10009] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 277.481022][ T307] usb 9-1: invalid UAC_HEADER (v1) [ 277.490079][ T307] snd-usb-audio 9-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 277.520755][ T307] usb 9-1: USB disconnect, device number 13 [ 277.537813][T10023] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 277.538195][T10023] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:401 [ 277.577408][T10023] rust_binder: Error while translating object. [ 277.586588][T10023] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 277.626967][T10023] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:401 [ 277.710222][ T309] udevd[309]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 277.819674][T10042] cgroup: Need name or subsystem set [ 277.827827][T10042] binder: Unknown parameter 'fscnconfined_u' [ 277.848708][T10044] netlink: 324 bytes leftover after parsing attributes in process `syz.8.3545'. [ 278.004802][ T10] usb 8-1: new high-speed USB device number 25 using dummy_hcd [ 278.192484][ T10] usb 8-1: Using ep0 maxpacket: 16 [ 278.209035][ T10] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 278.224029][ T10] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 278.241759][ T10] usb 8-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 278.267984][ T10] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 278.291308][ T10] usb 8-1: config 0 descriptor?? [ 278.413462][T10077] netlink: 324 bytes leftover after parsing attributes in process `syz.6.3555'. [ 278.549312][T10084] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=10084 comm=syz.8.3558 [ 278.692453][T10091] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=47 sclass=netlink_xfrm_socket pid=10091 comm=syz.8.3558 [ 278.706639][T10091] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=10091 comm=syz.8.3558 [ 278.765576][ T10] HID 045e:07da: Invalid code 65791 type 1 [ 278.784190][ T10] input: HID 045e:07da as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/0003:045E:07DA.003B/input/input90 [ 278.812105][ T10] microsoft 0003:045E:07DA.003B: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.7-1/input0 [ 278.999938][T10096] loop2: detected capacity change from 0 to 7 [ 279.006301][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 279.015466][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 279.026673][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 279.035864][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 279.043728][T10096] loop2: unable to read partition table [ 279.049418][T10096] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 279.108765][T10098] binder: Bad value for 'stats' [ 279.278205][T10102] netlink: 324 bytes leftover after parsing attributes in process `syz.5.3564'. [ 279.341226][T10105] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:923 [ 279.491509][T10113] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:926 [ 279.661848][ T49] usb 8-1: USB disconnect, device number 25 [ 279.849561][ T307] hid-generic 0000:0000:0000.003C: unknown main item tag 0x4 [ 279.859696][ T307] hid-generic 0000:0000:0000.003C: unknown main item tag 0x2 [ 279.873154][T10147] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 279.874536][ T307] hid-generic 0000:0000:0000.003C: unknown main item tag 0x3 [ 279.924156][T10147] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 279.924529][T10147] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 279.927496][ T307] hid-generic 0000:0000:0000.003C: hidraw0: HID v0.00 Device [syz0] on syz0 [ 279.939176][T10147] rust_binder: Write failure EINVAL in pid:430 [ 280.147582][T10149] fido_id[10149]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 280.199924][T10158] netlink: 324 bytes leftover after parsing attributes in process `syz.8.3575'. [ 280.314726][T10160] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:470 [ 280.316982][T10160] fuse: Unknown parameter 'group_i' [ 280.418818][ T36] kauditd_printk_skb: 1128 callbacks suppressed [ 280.418842][ T36] audit: type=1400 audit(1750463948.157:32977): avc: denied { unmount } for pid=6804 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 280.484908][ T36] audit: type=1400 audit(1750463948.166:32978): avc: denied { read write } for pid=8239 comm="syz-executor" name="loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 280.525364][T10170] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 280.535389][ T36] audit: type=1400 audit(1750463948.166:32979): avc: denied { read write open } for pid=8239 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 280.566349][T10174] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:941 [ 280.634444][ T9] usb 8-1: new high-speed USB device number 26 using dummy_hcd [ 280.640693][ T36] audit: type=1400 audit(1750463948.166:32980): avc: denied { ioctl } for pid=8239 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 280.685498][ T36] audit: type=1400 audit(1750463948.185:32981): avc: denied { unmount } for pid=6804 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 280.712509][ T36] audit: type=1400 audit(1750463948.203:32982): avc: denied { read write } for pid=6804 comm="syz-executor" name="loop6" dev="devtmpfs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 280.754245][ T36] audit: type=1400 audit(1750463948.203:32983): avc: denied { read write open } for pid=6804 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 280.785483][T10184] rust_binder: Error while translating object. [ 280.785516][T10184] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 280.791700][T10184] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1448 [ 280.813770][ T36] audit: type=1400 audit(1750463948.203:32984): avc: denied { ioctl } for pid=6804 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=55 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 280.839090][T10187] audit: audit_backlog=65 > audit_backlog_limit=64 [ 280.856518][ T9] usb 8-1: Using ep0 maxpacket: 32 [ 280.869850][T10160] audit: audit_backlog=65 > audit_backlog_limit=64 [ 280.881779][ T9] usb 8-1: config 0 has an invalid interface number: 85 but max is 0 [ 280.889960][ T9] usb 8-1: config 0 has no interface number 0 [ 280.899348][ T9] usb 8-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 280.912716][ T9] usb 8-1: config 0 interface 85 has no altsetting 0 [ 280.922683][ T9] usb 8-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 280.933747][ T49] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 280.939981][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 280.957229][T10189] netlink: 324 bytes leftover after parsing attributes in process `syz.5.3588'. [ 280.966378][ T9] usb 8-1: Product: syz [ 280.970547][ T9] usb 8-1: Manufacturer: syz [ 280.976091][ T9] usb 8-1: SerialNumber: syz [ 280.988337][ T9] usb 8-1: config 0 descriptor?? [ 281.073328][ T49] usb 7-1: device descriptor read/64, error -71 [ 281.136891][ T322] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 281.318625][ T322] usb 9-1: Using ep0 maxpacket: 16 [ 281.329118][ T322] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 281.340045][ T322] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 281.352855][ T322] usb 9-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 281.361927][ T49] usb 7-1: device descriptor read/64, error -71 [ 281.368903][ T322] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 281.379728][T10198] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3592'. [ 281.389111][ T322] usb 9-1: config 0 descriptor?? [ 281.628694][ T49] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 281.665318][ T9] usb 8-1: USB disconnect, device number 26 [ 281.768132][ T49] usb 7-1: device descriptor read/64, error -71 [ 281.832804][ T322] HID 045e:07da: Invalid code 65791 type 1 [ 281.840506][ T322] input: HID 045e:07da as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/0003:045E:07DA.003D/input/input91 [ 281.855082][ T322] microsoft 0003:045E:07DA.003D: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.8-1/input0 [ 282.024226][ T49] usb 7-1: device descriptor read/64, error -71 [ 282.142167][ T49] usb usb7-port1: attempt power cycle [ 282.274831][T10203] overlayfs: conflicting options: userxattr,redirect_dir=on [ 282.429819][T10211] netlink: 324 bytes leftover after parsing attributes in process `syz.5.3597'. [ 282.505291][ T49] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 282.541848][T10219] rust_binder: Write failure EFAULT in pid:1470 [ 282.543695][ T49] usb 7-1: device descriptor read/8, error -71 [ 282.693415][ T307] usb 9-1: USB disconnect, device number 14 [ 282.736874][ T49] usb 7-1: device descriptor read/8, error -71 [ 283.007738][ T49] usb 7-1: new high-speed USB device number 32 using dummy_hcd [ 283.051098][ T49] usb 7-1: device descriptor read/8, error -71 [ 283.199260][ T49] usb 7-1: device descriptor read/8, error -71 [ 283.213960][T10240] netlink: 324 bytes leftover after parsing attributes in process `syz.5.3608'. [ 283.287752][T10244] SELinux: security_context_str_to_sid () failed with errno=-22 [ 283.318128][ T49] usb usb7-port1: unable to enumerate USB device [ 283.704127][T10266] netlink: 324 bytes leftover after parsing attributes in process `syz.5.3618'. [ 283.840378][T10272] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 283.854579][T10272] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 283.868714][T10272] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 283.966243][T10278] 9pnet_fd: Insufficient options for proto=fd [ 284.058620][ T9] usb 8-1: new high-speed USB device number 27 using dummy_hcd [ 284.237143][ T9] usb 8-1: Using ep0 maxpacket: 16 [ 284.247682][ T9] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 284.260817][ T9] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 284.275418][ T9] usb 8-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 284.285726][ T9] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 284.302572][ T9] usb 8-1: config 0 descriptor?? [ 284.396142][T10303] netlink: 324 bytes leftover after parsing attributes in process `syz.6.3629'. [ 284.654687][T10269] overlayfs: statfs failed on './file0' [ 284.751853][ T9] HID 045e:07da: Invalid code 65791 type 1 [ 284.767237][T10317] binder: Unknown parameter '18446744073709551615' [ 284.779576][ T9] input: HID 045e:07da as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/0003:045E:07DA.003E/input/input92 [ 284.783322][T10319] binder: Unknown parameter '18446744073709551615' [ 284.806986][ T9] microsoft 0003:045E:07DA.003E: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.7-1/input0 [ 284.856970][T10322] netlink: 324 bytes leftover after parsing attributes in process `syz.6.3638'. [ 284.942737][ T1159] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 285.134551][ T1159] usb 9-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 285.144388][ T1159] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 285.188694][ T1159] usb 9-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 285.221525][ T1159] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 285.236984][ T1159] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 285.261341][T10333] rust_binder: Error while translating object. [ 285.261366][T10333] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 285.263905][T10335] rust_binder: Write failure EINVAL in pid:995 [ 285.284843][ T1159] usb 9-1: SerialNumber: syz [ 285.296411][T10333] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:1510 [ 285.500361][T10344] netlink: 324 bytes leftover after parsing attributes in process `syz.6.3647'. [ 285.596268][T10314] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 285.605959][ T49] usb 8-1: USB disconnect, device number 27 [ 285.606912][T10314] rust_binder: Error while translating object. [ 285.632541][T10314] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 285.648050][T10314] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:461 [ 285.777306][ T307] usb 9-1: USB disconnect, device number 15 [ 285.792455][ T36] kauditd_printk_skb: 994 callbacks suppressed [ 285.792472][ T36] audit: type=1400 audit(1750463953.180:33960): avc: denied { unmount } for pid=4400 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 285.870530][ T36] audit: type=1400 audit(1750463953.236:33961): avc: denied { read write } for pid=4400 comm="syz-executor" name="loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 285.935366][ T36] audit: type=1400 audit(1750463953.236:33962): avc: denied { read write open } for pid=4400 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 285.961355][ T36] audit: type=1400 audit(1750463953.236:33963): avc: denied { ioctl } for pid=4400 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 285.987077][ T36] audit: type=1400 audit(1750463953.320:33964): avc: denied { read } for pid=10355 comm="syz.5.3652" name="binder0" dev="binder" ino=30 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 286.009976][ T36] audit: type=1400 audit(1750463953.320:33965): avc: denied { read open } for pid=10355 comm="syz.5.3652" path="/dev/binderfs/binder0" dev="binder" ino=30 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 286.034704][ T36] audit: type=1400 audit(1750463953.320:33966): avc: denied { ioctl } for pid=10355 comm="syz.5.3652" path="/dev/binderfs/binder0" dev="binder" ino=30 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 286.060476][ T36] audit: type=1400 audit(1750463953.320:33967): avc: denied { set_context_mgr } for pid=10355 comm="syz.5.3652" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 286.080987][ T36] audit: type=1400 audit(1750463953.348:33968): avc: denied { map } for pid=10355 comm="syz.5.3652" path="/dev/binderfs/binder0" dev="binder" ino=30 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 286.105021][ T36] audit: type=1400 audit(1750463953.348:33969): avc: denied { read } for pid=10355 comm="syz.5.3652" path="/dev/binderfs/binder0" dev="binder" ino=30 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 286.386049][ T1159] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 286.456646][T10372] netlink: 324 bytes leftover after parsing attributes in process `syz.6.3657'. [ 286.558082][ T1159] usb 6-1: no configurations [ 286.562843][ T1159] usb 6-1: can't read configurations, error -22 [ 286.717415][ T1159] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 286.821287][T10389] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1020 [ 286.899417][ T322] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 286.900264][ T1159] usb 6-1: no configurations [ 286.920823][ T1159] usb 6-1: can't read configurations, error -22 [ 286.927467][ T1159] usb usb6-port1: attempt power cycle [ 287.070257][ T322] usb 9-1: Using ep0 maxpacket: 16 [ 287.077408][ T322] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 287.088344][ T322] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 287.101176][ T322] usb 9-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 287.110224][ T322] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 287.119397][ T322] usb 9-1: config 0 descriptor?? [ 287.294694][ T1159] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 287.325687][ T1159] usb 6-1: no configurations [ 287.332087][ T1159] usb 6-1: can't read configurations, error -22 [ 287.352533][ T5696] Bluetooth: hci0: Frame reassembly failed (-84) [ 287.361818][T10397] Bluetooth: received HCILL_WAKE_UP_IND in state 2 [ 287.413133][T10399] netlink: 324 bytes leftover after parsing attributes in process `syz.6.3668'. [ 287.487128][ T1159] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 287.525903][ T1159] usb 6-1: no configurations [ 287.531489][ T1159] usb 6-1: can't read configurations, error -22 [ 287.537924][ T1159] usb usb6-port1: unable to enumerate USB device [ 287.564640][ T322] HID 045e:07da: Invalid code 65791 type 1 [ 287.587961][ T322] input: HID 045e:07da as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/0003:045E:07DA.003F/input/input93 [ 287.617262][ T322] microsoft 0003:045E:07DA.003F: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.8-1/input0 [ 287.936102][ T322] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 288.096463][ T322] usb 7-1: Using ep0 maxpacket: 16 [ 288.103538][ T322] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 288.115161][ T322] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 288.124909][ T322] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 288.137721][ T322] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 288.146771][ T322] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 288.156197][ T322] usb 7-1: config 0 descriptor?? [ 288.430570][ T10] usb 9-1: USB disconnect, device number 16 [ 288.594044][ T322] microsoft 0003:045E:07DA.0040: unknown main item tag 0xd [ 288.601378][ T322] microsoft 0003:045E:07DA.0040: unknown global tag 0xc [ 288.608296][ T322] microsoft 0003:045E:07DA.0040: item 0 0 1 12 parsing failed [ 288.615957][ T322] microsoft 0003:045E:07DA.0040: parse failed [ 288.622184][ T322] microsoft 0003:045E:07DA.0040: probe with driver microsoft failed with error -22 [ 288.889696][ T10] usb 7-1: USB disconnect, device number 33 [ 289.155926][T10419] netlink: 324 bytes leftover after parsing attributes in process `syz.5.3677'. [ 289.166367][T10420] netlink: 220 bytes leftover after parsing attributes in process `syz.8.3676'. [ 289.539701][ T322] usb 9-1: new full-speed USB device number 17 using dummy_hcd [ 289.550454][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 289.551493][ T6130] Bluetooth: hci0: command 0x1003 tx timeout [ 289.636210][ T49] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 289.702475][ T322] usb 9-1: unable to get BOS descriptor or descriptor too short [ 289.710623][ T322] usb 9-1: not running at top speed; connect to a high speed hub [ 289.710751][ T10] usb 7-1: new high-speed USB device number 34 using dummy_hcd [ 289.721924][ T322] usb 9-1: config 129 has an invalid interface number: 28 but max is 0 [ 289.736591][ T322] usb 9-1: config 129 has no interface number 0 [ 289.742928][ T322] usb 9-1: config 129 interface 28 altsetting 250 has an endpoint descriptor with address 0xFD, changing to 0x8D [ 289.754861][ T322] usb 9-1: config 129 interface 28 altsetting 250 endpoint 0x8D has invalid maxpacket 18502, setting to 64 [ 289.768429][ T322] usb 9-1: config 129 interface 28 altsetting 250 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 289.785558][ T322] usb 9-1: config 129 interface 28 has no altsetting 0 [ 289.797821][ T322] usb 9-1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice=db.57 [ 289.799385][T10444] netlink: 324 bytes leftover after parsing attributes in process `syz.7.3687'. [ 289.806895][ T322] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 289.844150][ T49] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 289.855584][ T322] usb 9-1: Product: syz [ 289.860393][ T322] usb 9-1: Manufacturer: syz [ 289.864996][ T322] usb 9-1: SerialNumber: syz [ 289.869589][ T49] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 289.878591][ T49] usb 6-1: Product: syz [ 289.883047][ T49] usb 6-1: Manufacturer: syz [ 289.887667][ T49] usb 6-1: SerialNumber: syz [ 289.888838][T10430] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 289.899446][ T10] usb 7-1: Using ep0 maxpacket: 16 [ 289.909716][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 289.923073][ T10] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 289.936011][ T10] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 289.945053][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 289.954932][ T10] usb 7-1: config 0 descriptor?? [ 290.144872][T10430] binder: Unknown parameter 'context' [ 290.156682][ T322] usb 9-1: USB disconnect, device number 17 [ 290.394192][ T10] HID 045e:07da: Invalid code 65791 type 1 [ 290.401883][ T10] input: HID 045e:07da as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:045E:07DA.0041/input/input94 [ 290.415269][ T10] microsoft 0003:045E:07DA.0041: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.6-1/input0 [ 291.208137][ T36] kauditd_printk_skb: 609 callbacks suppressed [ 291.208154][ T36] audit: type=1400 audit(1750463958.259:34579): avc: denied { unmount } for pid=8239 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 291.252040][ T36] audit: type=1400 audit(1750463958.259:34580): avc: denied { ioctl } for pid=10453 comm="syz.7.3691" path="/dev/ashmem" dev="devtmpfs" ino=201 ioctlcmd=0x7703 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 291.268197][ T322] usb 7-1: USB disconnect, device number 34 [ 291.278371][ T36] audit: type=1400 audit(1750463958.287:34581): avc: denied { read write } for pid=8239 comm="syz-executor" name="loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 291.308050][T10468] netlink: 324 bytes leftover after parsing attributes in process `syz.8.3696'. [ 291.318780][ T36] audit: type=1400 audit(1750463958.287:34582): avc: denied { read write open } for pid=8239 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 291.352790][ T36] audit: type=1400 audit(1750463958.287:34583): avc: denied { ioctl } for pid=8239 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 291.386193][ T36] audit: type=1400 audit(1750463958.325:34584): avc: denied { create } for pid=10467 comm="syz.8.3696" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 291.407161][ T36] audit: type=1400 audit(1750463958.353:34585): avc: denied { write } for pid=10467 comm="syz.8.3696" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 291.428178][ T36] audit: type=1400 audit(1750463958.353:34586): avc: denied { nlmsg_write } for pid=10467 comm="syz.8.3696" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 291.449974][ T36] audit: type=1400 audit(1750463958.362:34587): avc: denied { read write } for pid=8239 comm="syz-executor" name="loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 291.474783][ T36] audit: type=1400 audit(1750463958.362:34588): avc: denied { read write open } for pid=8239 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 291.908159][T10490] netlink: 324 bytes leftover after parsing attributes in process `syz.7.3705'. [ 292.382285][T10516] binder: Unknown parameter '00000000000000000012' [ 292.429340][T10519] netlink: 324 bytes leftover after parsing attributes in process `syz.8.3716'. [ 292.511679][ T49] usb 7-1: new high-speed USB device number 35 using dummy_hcd [ 292.517950][T10523] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 292.543214][ T322] usb 6-1: USB disconnect, device number 73 [ 292.672631][ T49] usb 7-1: Using ep0 maxpacket: 16 [ 292.693600][ T49] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 292.705500][ T49] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 292.718461][ T49] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 292.733574][T10531] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 292.747437][ T49] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 292.768906][ T49] usb 7-1: config 0 descriptor?? [ 292.792787][T10534] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 292.792817][T10534] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:1534 [ 292.933631][T10544] netlink: 324 bytes leftover after parsing attributes in process `syz.5.3726'. [ 293.120534][T10553] cgroup: fork rejected by pids controller in /syz7 [ 293.213279][ T49] HID 045e:07da: Invalid code 65791 type 1 [ 293.235433][ T49] input: HID 045e:07da as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:045E:07DA.0042/input/input96 [ 293.267774][ T49] microsoft 0003:045E:07DA.0042: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.6-1/input0 [ 293.275460][T10587] fuse: Bad value for 'fd' [ 293.349927][T10587] rust_binder: Write failure EINVAL in pid:1546 [ 293.890322][T10621] netlink: 324 bytes leftover after parsing attributes in process `syz.8.3735'. [ 293.959789][T10624] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 293.963715][T10624] rust_binder: Error while translating object. [ 293.970990][T10624] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 293.977861][T10624] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:525 [ 294.088437][ T1159] usb 7-1: USB disconnect, device number 35 [ 294.463995][T10646] netlink: 324 bytes leftover after parsing attributes in process `syz.8.3744'. [ 294.578482][T10648] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 294.850912][T10653] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 294.857482][T10653] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:545 [ 295.077471][ T1159] usb 7-1: new high-speed USB device number 36 using dummy_hcd [ 295.248496][ T1159] usb 7-1: Using ep0 maxpacket: 32 [ 295.256185][ T1159] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 295.268835][ T1159] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 295.280080][ T1159] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 295.291291][ T1159] usb 7-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 295.300324][ T1159] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 295.310895][ T1159] usb 7-1: config 0 descriptor?? [ 295.317136][T10661] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 295.334789][ T1159] hub 7-1:0.0: USB hub found [ 295.542045][ T1159] hub 7-1:0.0: 2 ports detected [ 295.714621][T10666] binder: Unknown parameter 'contet' [ 295.830716][T10670] netlink: 324 bytes leftover after parsing attributes in process `syz.8.3753'. [ 296.157891][ T307] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 296.229905][ T1159] hub 7-1:0.0: hub_ext_port_status failed (err = -71) [ 296.233881][ T49] usb 7-1: USB disconnect, device number 36 [ 296.328223][ T307] usb 9-1: Using ep0 maxpacket: 16 [ 296.341246][ T307] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 296.368782][ T307] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 296.385505][ T307] usb 9-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 296.395443][ T307] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 296.405700][ T307] usb 9-1: config 0 descriptor?? [ 296.563558][ T36] kauditd_printk_skb: 720 callbacks suppressed [ 296.563573][ T36] audit: type=1400 audit(1750463964.268:35309): avc: denied { read } for pid=10693 comm="syz.6.3761" name="msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 296.612490][ T36] audit: type=1400 audit(1750463964.287:35310): avc: denied { read open } for pid=10693 comm="syz.6.3761" path="/dev/cpu/0/msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 296.702642][ T36] audit: type=1400 audit(1750463964.296:35311): avc: denied { create } for pid=10693 comm="syz.6.3761" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 296.704966][T10696] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1581 [ 296.758472][ T36] audit: type=1400 audit(1750463964.296:35312): avc: denied { write } for pid=10693 comm="syz.6.3761" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 296.760340][T10696] rust_binder: Write failure EFAULT in pid:1581 [ 296.767841][ T36] audit: type=1400 audit(1750463964.296:35313): avc: denied { nlmsg_write } for pid=10693 comm="syz.6.3761" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 296.852059][ T36] audit: type=1400 audit(1750463964.296:35314): avc: denied { ioctl } for pid=10691 comm="syz.5.3760" path="/dev/binderfs/binder0" dev="binder" ino=30 ioctlcmd=0x6201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 296.860067][ T307] HID 045e:07da: Invalid code 65791 type 1 [ 296.911456][ T307] input: HID 045e:07da as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/0003:045E:07DA.0043/input/input97 [ 296.937592][ T36] audit: type=1400 audit(1750463964.296:35315): avc: denied { call } for pid=10691 comm="syz.5.3760" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 296.939228][ T307] microsoft 0003:045E:07DA.0043: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.8-1/input0 [ 296.975532][ T36] audit: type=1400 audit(1750463964.296:35316): avc: denied { transfer } for pid=10691 comm="syz.5.3760" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 296.985667][T10703] netlink: 324 bytes leftover after parsing attributes in process `syz.5.3764'. [ 297.006230][ T36] audit: type=1400 audit(1750463964.306:35317): avc: denied { checkpoint_restore } for pid=10693 comm="syz.6.3761" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 297.029186][ T36] audit: type=1400 audit(1750463964.306:35318): avc: denied { checkpoint_restore } for pid=10693 comm="syz.6.3761" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 297.379037][T10705] rust_binder: Failed to allocate buffer. len:4294966472, is_oneway:false [ 297.379060][T10705] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 297.395053][T10705] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:1587 [ 297.729468][ T49] usb 9-1: USB disconnect, device number 18 [ 297.903191][ T5696] bridge_slave_1: left allmulticast mode [ 297.921153][ T5696] bridge_slave_1: left promiscuous mode [ 297.926838][ T5696] bridge0: port 2(bridge_slave_1) entered disabled state [ 297.953384][ T5696] bridge_slave_0: left allmulticast mode [ 297.959153][ T5696] bridge_slave_0: left promiscuous mode [ 297.970010][ T5696] bridge0: port 1(bridge_slave_0) entered disabled state [ 298.180574][ T5696] tipc: Left network mode [ 298.191459][ T5696] veth1_macvtap: left promiscuous mode [ 298.196972][ T5696] veth0_vlan: left promiscuous mode [ 298.422381][T10712] bridge0: port 1(bridge_slave_0) entered blocking state [ 298.435366][T10712] bridge0: port 1(bridge_slave_0) entered disabled state [ 298.446637][T10712] bridge_slave_0: entered allmulticast mode [ 298.453148][T10712] bridge_slave_0: entered promiscuous mode [ 298.467025][T10712] bridge0: port 2(bridge_slave_1) entered blocking state [ 298.474190][T10712] bridge0: port 2(bridge_slave_1) entered disabled state [ 298.482949][T10712] bridge_slave_1: entered allmulticast mode [ 298.497589][T10712] bridge_slave_1: entered promiscuous mode [ 298.767124][T10712] bridge0: port 2(bridge_slave_1) entered blocking state [ 298.774196][T10712] bridge0: port 2(bridge_slave_1) entered forwarding state [ 298.781500][T10712] bridge0: port 1(bridge_slave_0) entered blocking state [ 298.788542][T10712] bridge0: port 1(bridge_slave_0) entered forwarding state [ 298.934728][ T5696] bridge0: port 1(bridge_slave_0) entered disabled state [ 298.947593][ T5696] bridge0: port 2(bridge_slave_1) entered disabled state [ 298.989049][ T305] bridge0: port 1(bridge_slave_0) entered blocking state [ 298.996137][ T305] bridge0: port 1(bridge_slave_0) entered forwarding state [ 299.010752][ T5696] bridge0: port 2(bridge_slave_1) entered blocking state [ 299.017830][ T5696] bridge0: port 2(bridge_slave_1) entered forwarding state [ 299.211204][T10712] veth0_vlan: entered promiscuous mode [ 299.280595][T10712] veth1_macvtap: entered promiscuous mode [ 299.385773][ T307] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 299.557642][ T307] usb 9-1: Using ep0 maxpacket: 8 [ 299.566975][ T307] usb 9-1: config 179 has an invalid interface number: 65 but max is 0 [ 299.581226][ T307] usb 9-1: config 179 has no interface number 0 [ 299.603311][ T307] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 299.635070][ T307] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 299.669033][ T307] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 299.691989][ T307] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 299.704195][ T307] usb 9-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 299.755762][ T307] usb 9-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 299.791297][ T307] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 299.820715][T10723] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 300.071372][T10723] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 300.079908][T10723] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 300.136700][T10732] netlink: 324 bytes leftover after parsing attributes in process `syz.5.3773'. [ 300.322670][T10723] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:564 [ 300.324981][T10723] overlayfs: failed to resolve './file1/file0': -2 [ 300.529642][ T1159] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 300.711386][ T1159] usb 6-1: Using ep0 maxpacket: 16 [ 300.724978][ T1159] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 300.735922][ T1159] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 300.750968][ T1159] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 300.760365][ T1159] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 300.774724][ T1159] usb 6-1: config 0 descriptor?? [ 300.984901][T10737] binder: Bad value for 'stats' [ 301.016220][T10737] binder: Bad value for 'stats' [ 301.257123][ T1159] HID 045e:07da: Invalid code 65791 type 1 [ 301.282252][T10746] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 301.285072][T10746] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:576 [ 301.290092][ T1159] input: HID 045e:07da as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:045E:07DA.0044/input/input98 [ 301.356942][ T1159] microsoft 0003:045E:07DA.0044: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.5-1/input0 [ 301.579923][T10750] netlink: 'syz.8.3780': attribute type 4 has an invalid length. [ 301.957080][ T36] kauditd_printk_skb: 395 callbacks suppressed [ 301.957097][ T36] audit: type=1400 audit(1750463969.310:35714): avc: denied { read write } for pid=8239 comm="syz-executor" name="loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 302.012722][ T36] audit: type=1400 audit(1750463969.319:35715): avc: denied { read write open } for pid=8239 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 302.043420][ T36] audit: type=1400 audit(1750463969.319:35716): avc: denied { ioctl } for pid=8239 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 302.069420][ T36] audit: type=1400 audit(1750463969.385:35717): avc: denied { read } for pid=10753 comm="syz.8.3781" name="ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 302.072285][T10755] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 302.099309][ T36] audit: type=1400 audit(1750463969.385:35718): avc: denied { read open } for pid=10753 comm="syz.8.3781" path="/dev/ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 302.125092][ T1038] usb 6-1: USB disconnect, device number 75 [ 302.131678][ T36] audit: type=1400 audit(1750463969.385:35719): avc: denied { map } for pid=10753 comm="syz.8.3781" path="/dev/ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 302.155760][ T36] audit: type=1400 audit(1750463969.385:35720): avc: denied { read } for pid=10753 comm="syz.8.3781" path="/dev/ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 302.206538][ T36] audit: type=1400 audit(1750463969.385:35721): avc: denied { read } for pid=10753 comm="syz.8.3781" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 302.221998][T10755] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 302.261576][ T36] audit: type=1400 audit(1750463969.385:35722): avc: denied { read open } for pid=10753 comm="syz.8.3781" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 302.318129][ T36] audit: type=1400 audit(1750463969.385:35723): avc: denied { ioctl } for pid=10753 comm="syz.8.3781" path="/dev/kvm" dev="devtmpfs" ino=13 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 302.471013][T10759] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 302.496895][T10759] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 302.897589][T10761] rust_binder: Failed to allocate buffer. len:4096, is_oneway:false [ 303.042388][T10764] cgroup: fork rejected by pids controller in /syz5 [ 303.344517][ T5696] bridge_slave_1: left allmulticast mode [ 303.350224][ T5696] bridge_slave_1: left promiscuous mode [ 303.380643][ T5696] bridge0: port 2(bridge_slave_1) entered disabled state [ 303.418345][ T5696] bridge_slave_0: left allmulticast mode [ 303.424055][ T5696] bridge_slave_0: left promiscuous mode [ 303.448771][ T5696] bridge0: port 1(bridge_slave_0) entered disabled state [ 303.608599][ T5696] veth1_macvtap: left promiscuous mode [ 303.614171][ T5696] veth0_vlan: left promiscuous mode [ 304.006049][T10781] bridge0: port 1(bridge_slave_0) entered blocking state [ 304.013128][T10781] bridge0: port 1(bridge_slave_0) entered disabled state [ 304.020359][T10781] bridge_slave_0: entered allmulticast mode [ 304.029059][T10781] bridge_slave_0: entered promiscuous mode [ 304.037058][T10781] bridge0: port 2(bridge_slave_1) entered blocking state [ 304.044157][T10781] bridge0: port 2(bridge_slave_1) entered disabled state [ 304.051553][T10781] bridge_slave_1: entered allmulticast mode [ 304.059313][T10781] bridge_slave_1: entered promiscuous mode [ 304.225911][T10781] bridge0: port 2(bridge_slave_1) entered blocking state [ 304.233006][T10781] bridge0: port 2(bridge_slave_1) entered forwarding state [ 304.240297][T10781] bridge0: port 1(bridge_slave_0) entered blocking state [ 304.247329][T10781] bridge0: port 1(bridge_slave_0) entered forwarding state [ 304.321133][ T5696] bridge0: port 1(bridge_slave_0) entered disabled state [ 304.330835][ T5696] bridge0: port 2(bridge_slave_1) entered disabled state [ 304.351506][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 304.358665][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 304.371743][ T5696] bridge0: port 2(bridge_slave_1) entered blocking state [ 304.378800][ T5696] bridge0: port 2(bridge_slave_1) entered forwarding state [ 304.553429][T10781] veth0_vlan: entered promiscuous mode [ 304.635601][T10781] veth1_macvtap: entered promiscuous mode [ 304.915173][T10786] netlink: 324 bytes leftover after parsing attributes in process `syz.5.3788'. [ 305.026074][T10788] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 305.052571][T10790] netlink: 'syz.5.3790': attribute type 4 has an invalid length. [ 305.510323][T10788] rust_binder: Error in use_page_slow: ESRCH [ 305.510347][T10788] rust_binder: use_range failure ESRCH [ 305.516919][T10788] rust_binder: Failed to allocate buffer. len:4216, is_oneway:false [ 305.523601][T10788] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 305.531753][T10788] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:603 [ 305.661148][ T307] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 305.812660][T10796] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 305.864255][ T307] usb 6-1: Using ep0 maxpacket: 16 [ 305.880893][ T307] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 305.893344][ T307] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 305.906435][ T307] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 305.915937][ T307] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.928618][ T307] usb 6-1: config 0 descriptor?? [ 305.981528][T10798] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:606 [ 306.379965][ T307] HID 045e:07da: Invalid code 65791 type 1 [ 306.407845][ T307] input: HID 045e:07da as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:045E:07DA.0045/input/input99 [ 306.424943][ T307] microsoft 0003:045E:07DA.0045: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.5-1/input0 [ 306.944650][T10804] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 306.955849][T10804] rust_binder: Error while translating object. [ 306.962495][T10804] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 306.997505][T10804] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:613 [ 307.241694][ T307] usb 6-1: USB disconnect, device number 76 [ 307.328673][ T36] kauditd_printk_skb: 465 callbacks suppressed [ 307.328698][ T36] audit: type=1400 audit(1750463974.324:36189): avc: denied { read write } for pid=8239 comm="syz-executor" name="loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 307.412442][ T36] audit: type=1400 audit(1750463974.380:36190): avc: denied { read write open } for pid=8239 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 307.478541][ T36] audit: type=1400 audit(1750463974.380:36191): avc: denied { ioctl } for pid=8239 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 307.504287][ T36] audit: type=1400 audit(1750463974.445:36192): avc: denied { read write } for pid=10809 comm="syz.8.3797" name="fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 307.550255][ T36] audit: type=1400 audit(1750463974.445:36193): avc: denied { read write open } for pid=10809 comm="syz.8.3797" path="/dev/fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 307.597554][ T36] audit: type=1400 audit(1750463974.445:36194): avc: denied { mounton } for pid=10809 comm="syz.8.3797" path="/236/file0" dev="tmpfs" ino=1432 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 307.637085][ T36] audit: type=1400 audit(1750463974.445:36195): avc: denied { mount } for pid=10809 comm="syz.8.3797" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 307.664303][ T36] audit: type=1400 audit(1750463974.520:36196): avc: denied { unmount } for pid=8239 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 307.685611][ T36] audit: type=1400 audit(1750463974.530:36197): avc: denied { read write } for pid=8239 comm="syz-executor" name="loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 307.752955][ T36] audit: type=1400 audit(1750463974.530:36198): avc: denied { read write open } for pid=8239 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 307.854015][T10815] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 307.860513][T10815] rust_binder: Error in use_page_slow: ESRCH [ 307.895501][T10815] rust_binder: use_range failure ESRCH [ 307.901593][T10815] rust_binder: Failed to allocate buffer. len:4232, is_oneway:false [ 307.950226][T10815] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 307.958300][T10815] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:624 [ 307.982193][T10818] netlink: 168 bytes leftover after parsing attributes in process `syz.8.3800'. [ 308.301972][T10824] tmpfs: Unknown parameter 'siIq' [ 308.308628][T10824] tmpfs: Unknown parameter 'siIq' [ 308.325947][T10824] tmpfs: Unknown parameter 'siIq' [ 308.332725][T10824] tmpfs: Unknown parameter 'siIq' [ 308.340858][T10824] tmpfs: Unknown parameter 'siIq' [ 308.377497][T10824] tmpfs: Unknown parameter 'siIq' [ 308.419610][T10824] tmpfs: Unknown parameter 'siIq' [ 308.460844][T10824] tmpfs: Unknown parameter 'siIq' [ 308.474228][T10824] tmpfs: Unknown parameter 'siIq' [ 308.481845][T10828] binder: Bad value for 'stats' [ 308.492630][T10824] tmpfs: Unknown parameter 'siIq' [ 308.740331][T10835] binder: Bad value for 'stats' [ 308.832387][T10836] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 308.865319][T10830] binder: Unknown parameter 'rw-' [ 309.403260][T10849] netlink: 'syz.5.3812': attribute type 46 has an invalid length. [ 309.411094][T10849] netlink: 44 bytes leftover after parsing attributes in process `syz.5.3812'. [ 309.603685][T10856] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:31 [ 309.663186][T10859] rust_binder: Write failure EINVAL in pid:31 [ 309.816330][T10857] bridge0: port 1(bridge_slave_0) entered blocking state [ 309.829962][T10857] bridge0: port 1(bridge_slave_0) entered disabled state [ 309.837224][T10857] bridge_slave_0: entered allmulticast mode [ 309.845062][T10857] bridge_slave_0: entered promiscuous mode [ 309.853126][T10857] bridge0: port 2(bridge_slave_1) entered blocking state [ 309.860292][T10857] bridge0: port 2(bridge_slave_1) entered disabled state [ 309.867454][T10857] bridge_slave_1: entered allmulticast mode [ 309.874037][T10857] bridge_slave_1: entered promiscuous mode [ 309.939988][T10870] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 309.953027][T10870] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 310.118817][T10857] bridge0: port 2(bridge_slave_1) entered blocking state [ 310.125913][T10857] bridge0: port 2(bridge_slave_1) entered forwarding state [ 310.133229][T10857] bridge0: port 1(bridge_slave_0) entered blocking state [ 310.140266][T10857] bridge0: port 1(bridge_slave_0) entered forwarding state [ 310.331630][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 310.339881][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 310.369805][ T5696] bridge0: port 1(bridge_slave_0) entered blocking state [ 310.376905][ T5696] bridge0: port 1(bridge_slave_0) entered forwarding state [ 310.397471][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 310.404641][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 310.692401][T10857] veth0_vlan: entered promiscuous mode [ 310.848774][T10857] veth1_macvtap: entered promiscuous mode [ 310.869986][T10877] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 311.445620][T10893] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 311.496237][T10893] SELinux: failed to load policy [ 311.509369][T10896] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 311.573103][ T322] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 311.580967][T10896] SELinux: failed to load policy [ 311.759067][T10907] netlink: 324 bytes leftover after parsing attributes in process `syz.8.3829'. [ 311.779156][ T322] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 311.826481][ T322] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 311.851015][ T322] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 311.859074][ T322] usb 6-1: SerialNumber: syz [ 312.586953][ T322] cdc_ether 6-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.5-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 312.697237][ T36] kauditd_printk_skb: 588 callbacks suppressed [ 312.697255][ T36] audit: type=1400 audit(1750463979.356:36787): avc: denied { create } for pid=10931 comm="syz.8.3840" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 312.725621][T10932] netlink: 324 bytes leftover after parsing attributes in process `syz.8.3840'. [ 312.802468][ T36] audit: type=1400 audit(1750463979.384:36788): avc: denied { write } for pid=10931 comm="syz.8.3840" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 312.904008][ T36] audit: type=1400 audit(1750463979.384:36789): avc: denied { nlmsg_write } for pid=10931 comm="syz.8.3840" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 312.952743][T10934] fuseblk: Unknown parameter 'L\0dK46kcSQg)I7f鉶O{' [ 312.994932][ T36] audit: type=1400 audit(1750463979.459:36790): avc: denied { ioctl } for pid=10889 comm="syz.5.3825" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 313.123160][ T36] audit: type=1400 audit(1750463979.487:36791): avc: denied { read write } for pid=8239 comm="syz-executor" name="loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 313.218095][ T36] audit: type=1400 audit(1750463979.487:36792): avc: denied { read write open } for pid=8239 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 313.305046][T10943] audit: audit_backlog=65 > audit_backlog_limit=64 [ 313.311584][T10943] audit: audit_lost=77 audit_rate_limit=0 audit_backlog_limit=64 [ 313.344355][ T36] audit: type=1400 audit(1750463979.487:36793): avc: denied { ioctl } for pid=8239 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 313.346138][T10947] audit: audit_backlog=65 > audit_backlog_limit=64 [ 313.431596][T10935] bridge0: port 1(bridge_slave_0) entered blocking state [ 313.454561][T10935] bridge0: port 1(bridge_slave_0) entered disabled state [ 313.465984][T10947] overlayfs: failed to resolve './bus': -2 [ 313.474226][T10935] bridge_slave_0: entered allmulticast mode [ 313.484950][T10935] bridge_slave_0: entered promiscuous mode [ 313.493305][T10935] bridge0: port 2(bridge_slave_1) entered blocking state [ 313.500413][T10935] bridge0: port 2(bridge_slave_1) entered disabled state [ 313.507506][T10935] bridge_slave_1: entered allmulticast mode [ 313.522563][T10935] bridge_slave_1: entered promiscuous mode [ 313.699748][T10958] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 313.745505][T10958] SELinux: failed to load policy [ 313.786533][T10958] rust_binder: Write failure EFAULT in pid:31 [ 313.944455][T10935] bridge0: port 2(bridge_slave_1) entered blocking state [ 313.957625][T10935] bridge0: port 2(bridge_slave_1) entered forwarding state [ 313.964903][T10935] bridge0: port 1(bridge_slave_0) entered blocking state [ 313.971972][T10935] bridge0: port 1(bridge_slave_0) entered forwarding state [ 314.062580][ T305] bridge0: port 1(bridge_slave_0) entered disabled state [ 314.070599][ T305] bridge0: port 2(bridge_slave_1) entered disabled state [ 314.230252][ T305] bridge0: port 1(bridge_slave_0) entered blocking state [ 314.237340][ T305] bridge0: port 1(bridge_slave_0) entered forwarding state [ 314.258259][ T305] bridge0: port 2(bridge_slave_1) entered blocking state [ 314.265330][ T305] bridge0: port 2(bridge_slave_1) entered forwarding state [ 314.465390][T10977] rust_binder: Write failure EFAULT in pid:39 [ 314.504037][ T1159] usb 6-1: USB disconnect, device number 77 [ 314.505357][T10935] veth0_vlan: entered promiscuous mode [ 314.510531][ T1159] cdc_ether 6-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.5-1, CDC Ethernet Device [ 314.591911][T10935] veth1_macvtap: entered promiscuous mode [ 315.081254][T11001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 315.089791][T11001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 315.148254][T11001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 315.185179][T11001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 315.229438][T11005] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION freeze notification not active [ 315.233103][T11001] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 315.263532][T11001] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 315.275385][T11005] rust_binder: Write failure EINVAL in pid:47 [ 315.282782][T11001] overlayfs: conflicting options: userxattr,metacopy=on [ 315.760422][T11028] rust_binder: Read failure Err(EFAULT) in pid:55 [ 315.957628][T11046] binder: Bad value for 'stats' [ 316.151710][T11055] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 316.153992][T11055] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 316.160500][T11055] rust_binder: Read failure Err(EFAULT) in pid:695 [ 316.673386][T11081] netlink: 172 bytes leftover after parsing attributes in process `syz.2.3875'. [ 316.738659][T11083] rust_binder: Failed to allocate buffer. len:144, is_oneway:true [ 316.826426][T11087] binder: Unknown parameter 'fscontext?}' [ 316.959727][T11091] rust_binder: Failed to vm_insert_page(35184372744192): vma_addr:35184372744192 i:0 err:EBUSY [ 316.959763][T11091] rust_binder: Error in use_page_slow: EBUSY [ 317.009994][T11091] rust_binder: use_range failure EBUSY [ 317.030470][T11091] rust_binder: Failed to allocate buffer. len:8, is_oneway:true [ 317.031211][T11098] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 317.049637][T11091] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBUSY } [ 317.056180][T11091] rust_binder: Failure BR_FAILED_REPLY { source: EBUSY } during reply - delivering BR_FAILED_REPLY to sender. [ 317.066823][T11091] rust_binder: Transaction failed: BR_TRANSACTION_COMPLETE my_pid:35 [ 317.084759][T11098] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 317.132166][T11098] rust_binder: Write failure EINVAL in pid:699 [ 317.250989][T11108] binder: Bad value for 'max' [ 317.337208][ T5696] bridge_slave_1: left allmulticast mode [ 317.342880][ T5696] bridge_slave_1: left promiscuous mode [ 317.351199][ T5696] bridge0: port 2(bridge_slave_1) entered disabled state [ 317.388882][ T5696] bridge_slave_0: left allmulticast mode [ 317.394574][ T5696] bridge_slave_0: left promiscuous mode [ 317.416093][ T5696] bridge0: port 1(bridge_slave_0) entered disabled state [ 317.539220][T11117] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 317.540166][T11120] tipc: Started in network mode [ 317.540314][T11117] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 317.555522][T11117] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:702 [ 317.565736][T11120] tipc: Node identity 86f4fabc5f5d, cluster identity 4711 [ 317.589160][T11120] tipc: Enabled bearer , priority 0 [ 317.598714][ T5696] veth1_macvtap: left promiscuous mode [ 317.604362][ T5696] veth0_vlan: left promiscuous mode [ 317.679853][T11118] syzkaller0: MTU too low for tipc bearer [ 317.685732][T11118] tipc: Disabling bearer [ 317.695224][T11118] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 1 [ 317.702621][T11118] rust_binder: Write failure EINVAL in pid:41 [ 317.715885][T11123] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 317.730968][T11123] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 317.747269][T11123] random: crng reseeded on system resumption [ 317.850035][T11125] rust_binder: Error while translating object. [ 317.850067][T11125] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 317.856266][T11125] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:80 [ 318.083162][ T36] kauditd_printk_skb: 1495 callbacks suppressed [ 318.083205][ T36] audit: type=1400 audit(1750463984.389:38286): avc: denied { unmount } for pid=10935 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 318.119499][ T36] audit: type=1400 audit(1750463984.426:38287): avc: denied { ioctl } for pid=11131 comm="syz.5.3889" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 318.145746][ T36] audit: type=1400 audit(1750463984.436:38288): avc: denied { read write } for pid=10935 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 318.176900][ T36] audit: type=1400 audit(1750463984.436:38289): avc: denied { read write open } for pid=10935 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 318.179847][ T1159] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 318.203405][ T36] audit: type=1400 audit(1750463984.436:38290): avc: denied { ioctl } for pid=10935 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 318.236986][ T36] audit: type=1400 audit(1750463984.473:38291): avc: denied { read } for pid=11140 comm="syz.2.3893" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 318.259881][ T36] audit: type=1400 audit(1750463984.473:38292): avc: denied { read open } for pid=11140 comm="syz.2.3893" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 318.283675][ T36] audit: type=1400 audit(1750463984.520:38293): avc: denied { ioctl } for pid=11140 comm="syz.2.3893" path="/dev/kvm" dev="devtmpfs" ino=13 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 318.308733][ T36] audit: type=1400 audit(1750463984.538:38294): avc: denied { ioctl } for pid=11131 comm="syz.5.3889" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 318.334166][ T36] audit: type=1400 audit(1750463984.538:38295): avc: denied { ioctl } for pid=11131 comm="syz.5.3889" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 318.393656][ T1159] usb 6-1: Using ep0 maxpacket: 16 [ 318.401037][ T1159] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 318.411950][ T1159] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 318.437113][ T1159] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 318.450959][T11143] overlayfs: failed to resolve './file1/file0': -2 [ 318.453426][ T1159] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 318.475412][ T1159] usb 6-1: config 0 descriptor?? [ 318.612733][T11154] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 318.614393][T11154] rust_binder: Write failure EINVAL in pid:711 [ 318.739917][T11165] tmpfs: Unsupported parameter 'mpol' [ 318.929623][ T1159] HID 045e:07da: Invalid code 65791 type 1 [ 318.982003][ T1159] input: HID 045e:07da as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:045E:07DA.0046/input/input100 [ 319.015673][ T1159] microsoft 0003:045E:07DA.0046: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.5-1/input0 [ 319.068542][T11186] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 319.144702][T11188] rust_binder: Write failure EFAULT in pid:66 [ 319.217168][T11190] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 319.261286][T11190] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 319.325313][T11197] netlink: 324 bytes leftover after parsing attributes in process `syz.2.3912'. [ 319.454922][T11201] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:71 [ 319.519513][T11204] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 319.815717][T11211] can0: slcan on ptm0. [ 319.837978][ T1159] usb 6-1: USB disconnect, device number 78 [ 319.959265][T11210] can0 (unregistered): slcan off ptm0. [ 319.999647][T11217] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 320.032279][T11217] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 320.180634][T11226] netlink: 324 bytes leftover after parsing attributes in process `syz.9.3921'. [ 320.687642][T11259] netlink: 324 bytes leftover after parsing attributes in process `syz.2.3930'. [ 320.757754][T11263] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3932'. [ 320.950918][T11270] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 320.963591][T11270] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 321.084266][T11273] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000000 not found [ 321.092689][T11273] rust_binder: Write failure EINVAL in pid:96 [ 321.161621][T11276] rust_binder: Write failure EFAULT in pid:98 [ 321.377323][T11286] binder: Bad value for 'stats' [ 321.451951][T11288] netlink: 324 bytes leftover after parsing attributes in process `syz.2.3940'. [ 321.494885][T11290] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 321.588694][T11298] overlayfs: failed to resolve './file1': -2 [ 321.975009][T11308] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 322.009150][T11310] SELinux: failed to load policy [ 322.093746][T11312] input: syz0 as /devices/virtual/input/input101 [ 322.120110][T11315] rust_binder: Write failure EFAULT in pid:110 [ 322.235508][T11322] netlink: 324 bytes leftover after parsing attributes in process `syz.9.3951'. [ 322.391942][ T304] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 322.548240][ T304] usb 6-1: device descriptor read/64, error -71 [ 322.733611][T11344] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 322.744923][T11346] binder: Unknown parameter 'd"e9.fckd]N#a' [ 322.830287][ T304] usb 6-1: device descriptor read/64, error -71 [ 322.840956][ T1159] usb 10-1: new full-speed USB device number 2 using dummy_hcd [ 322.991074][T11347] rust_binder: Failed to allocate buffer. len:4232, is_oneway:true [ 322.991107][T11347] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 322.999029][T11347] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:751 [ 323.027356][ T1159] usb 10-1: not running at top speed; connect to a high speed hub [ 323.061463][ T1159] usb 10-1: config 1 interface 0 has no altsetting 0 [ 323.081628][ T1159] usb 10-1: New USB device found, idVendor=1e7d, idProduct=3232, bcdDevice= 0.40 [ 323.098335][ T1159] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 323.107312][ T1159] usb 10-1: Product: ᧲簂遃܇陥뎾ꅎႹ襠徔雿闑凤䣤໛쏳벽鷿헞˥剀㤉셕쌱쏳ᔡ菭ᮬꎗ攌㓆͛럌ٓ둱蓺톐쮱䧵✬涚琯።✽฼䉺䉆븥偄Ƀ윣ೱ萙ⱑ筿鬻ડ謽蹝鐤腥ᖦ嵳豚缧ꝶᄠ寝ᨖ鋄ᴾ䡌ꑜ䱑鋵嶛챉 [ 323.133940][ T1159] usb 10-1: Manufacturer: 짧孏圊ꁸ潪섳〃ﱉΉ侠贾㙝⋷纏䷄⠦硸᳒궽┳ﳍ꧑芇퐡䛛袥尰鋨୍鲪뀩饸룝ᔖ뺁쫍폧久쾞忄寠㜼㌥⹦├毩ଳ⎗㟥糔阨⪕ꥺ⁠됦噳権ὦ큌麋芠ጫ㧌ഐ뎲 [ 323.143592][ T304] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 323.157958][ T1159] usb 10-1: SerialNumber: 銇⍤灦蹱겟掓ᬚ챷䝩ӄ樂ᆿ⹣ྩ祕㥡믿ꦐ㋣屡伢嵲⨍㯻༵鍌ꣳ晕᥏ނᠵ錽붏餓⨚ྀẉ꣭ﵒ点䖖春⃤헒춵엔ﺷ株ꮘ⸐蓳瑤璚⩯㰻萩듖〦팦㏶㑆ꭕꈛ髒⛓ð뤎㻠ㅔォ襣㷗輅䲗鲙ᢹ㏕ꐑ웱⢌甊율 [ 323.197188][T11354] netlink: 324 bytes leftover after parsing attributes in process `syz.2.3963'. [ 323.300640][ T304] usb 6-1: device descriptor read/64, error -71 [ 323.429521][ T36] kauditd_printk_skb: 988 callbacks suppressed [ 323.429545][ T36] audit: type=1400 audit(1750463989.393:39284): avc: denied { read write } for pid=10935 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 323.461200][ T36] audit: type=1400 audit(1750463989.393:39285): avc: denied { read write open } for pid=10935 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 323.493737][ T36] audit: type=1400 audit(1750463989.393:39286): avc: denied { ioctl } for pid=10935 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 323.521356][ T36] audit: type=1400 audit(1750463989.449:39287): avc: denied { ioctl } for pid=11338 comm="syz.9.3958" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 323.552431][ T36] audit: type=1400 audit(1750463989.449:39288): avc: denied { ioctl } for pid=11338 comm="syz.9.3958" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 323.577627][ T304] usb 6-1: device descriptor read/64, error -71 [ 323.583537][ T36] audit: type=1400 audit(1750463989.459:39289): avc: denied { ioctl } for pid=11314 comm="syz.5.3950" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 323.610108][ T36] audit: type=1400 audit(1750463989.459:39290): avc: denied { read } for pid=11359 comm="syz.2.3966" dev="nsfs" ino=4026532909 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 323.632382][ T36] audit: type=1400 audit(1750463989.459:39291): avc: denied { read open } for pid=11359 comm="syz.2.3966" path="net:[4026532909]" dev="nsfs" ino=4026532909 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 323.656983][ T36] audit: type=1400 audit(1750463989.459:39292): avc: denied { create } for pid=11359 comm="syz.2.3966" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 323.677862][ T36] audit: type=1400 audit(1750463989.477:39293): avc: denied { read write } for pid=10935 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 323.706623][ T304] usb usb6-port1: attempt power cycle [ 323.719823][T11365] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 4200, limit: 4216, size: 89) [ 323.719861][T11365] rust_binder: Error while translating object. [ 323.730550][T11365] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 323.736738][T11365] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:136 [ 323.857377][T11369] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 323.888278][T11369] rust_binder: Error while translating object. [ 323.894788][T11369] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 323.901063][T11369] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:756 [ 323.920960][T11340] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 323.974807][T11340] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 323.987730][T11340] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 324.013085][T11340] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 324.031192][ T1159] usbhid 10-1:1.0: can't add hid device: -71 [ 324.037935][ T1159] usbhid 10-1:1.0: probe with driver usbhid failed with error -71 [ 324.059057][ T1159] usb 10-1: USB disconnect, device number 2 [ 324.081107][ T304] usb 6-1: new high-speed USB device number 81 using dummy_hcd [ 324.108290][ T304] usb 6-1: device descriptor read/8, error -71 [ 324.207078][T11379] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 324.265653][ T304] usb 6-1: device descriptor read/8, error -71 [ 324.411251][T11384] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 324.413061][T11384] rust_binder: Error while translating object. [ 324.419590][T11384] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 324.425851][T11384] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:768 [ 324.464600][T11386] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 324.513987][T11388] rust_binder: Failed to allocate buffer. len:4294966472, is_oneway:false [ 324.520508][ T304] usb 6-1: new high-speed USB device number 82 using dummy_hcd [ 324.520969][T11388] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 324.537420][T11388] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:772 [ 324.543726][ T304] usb 6-1: device descriptor read/8, error -71 [ 324.579711][T11390] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 324.587953][T11390] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 324.601469][T11390] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:774 [ 324.686194][T11396] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 324.725571][ T304] usb 6-1: device descriptor read/8, error -71 [ 324.861976][ T304] usb usb6-port1: unable to enumerate USB device [ 324.920202][T11410] rust_binder: Write failure EINVAL in pid:124 [ 324.921847][T11407] KVM: debugfs: duplicate directory 11407-12 [ 324.955081][T11411] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 324.973164][T11411] rust_binder: Write failure EINVAL in pid:124 [ 324.985596][T11413] binder: Unknown parameter 'lwNX}0laX@zϣgXY0o_쀢*5nbACU?%' [ 325.589919][T11427] cgroup: fork rejected by pids controller in /syz9 [ 325.612079][T11474] binder: Binderfs stats mode cannot be changed during a remount [ 325.733337][T11481] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 325.825035][T11489] random: crng reseeded on system resumption [ 325.913874][T11501] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:118 [ 325.965750][T11509] binder: Unknown parameter '' [ 325.984629][T11509] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 325.997879][T11509] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 326.068846][T11524] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 1 [ 326.076480][T11524] rust_binder: Write failure EINVAL in pid:202 [ 326.438621][T11532] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 326.522058][T11537] netlink: 312 bytes leftover after parsing attributes in process `syz.9.4006'. [ 326.672640][T11544] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 326.700482][T11546] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 326.720735][T11544] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 326.753469][T11543] SELinux: failed to load policy [ 326.868489][T11554] netlink: 324 bytes leftover after parsing attributes in process `syz.9.4012'. [ 327.009900][T11559] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 327.103352][T11563] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION already set [ 327.117640][T11563] rust_binder: Write failure EINVAL in pid:229 [ 327.224095][ T9] usb 6-1: new high-speed USB device number 83 using dummy_hcd [ 327.366979][T11571] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 327.369619][T11572] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:796 [ 327.406628][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 327.452255][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 327.485302][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 34388, setting to 1024 [ 327.520516][ T9] usb 6-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 327.547986][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 327.588577][ T9] usb 6-1: config 0 descriptor?? [ 327.595150][T11556] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 327.647579][T11579] netlink: 324 bytes leftover after parsing attributes in process `syz.8.4022'. [ 327.845896][T11582] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 4200, limit: 4216, size: 89) [ 327.845921][T11582] rust_binder: Error while translating object. [ 327.861262][T11582] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 327.889193][T11582] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:803 [ 327.964523][T11586] overlayfs: overlapping lowerdir path [ 328.015171][T11591] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 328.038798][T11591] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 328.157408][T11599] overlayfs: failed to resolve './file0': -2 [ 328.593386][T11613] netlink: 324 bytes leftover after parsing attributes in process `syz.9.4032'. [ 328.627011][T11616] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 328.646450][T11616] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 328.855317][ T36] kauditd_printk_skb: 853 callbacks suppressed [ 328.855334][ T36] audit: type=1400 audit(1750463994.463:40147): avc: denied { read write } for pid=8239 comm="syz-executor" name="loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 328.901335][T11626] overlayfs: failed to resolve './file1': -2 [ 328.916473][ T36] audit: type=1400 audit(1750463994.482:40148): avc: denied { read write open } for pid=8239 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 328.965156][ T36] audit: type=1400 audit(1750463994.482:40149): avc: denied { ioctl } for pid=8239 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 329.001429][ T36] audit: type=1400 audit(1750463994.510:40150): avc: denied { mounton } for pid=11624 comm="syz.8.4037" path="/304/bus" dev="tmpfs" ino=1870 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 329.061057][ T36] audit: type=1400 audit(1750463994.529:40151): avc: denied { read write } for pid=11621 comm="syz.9.4035" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 329.095362][ T36] audit: type=1400 audit(1750463994.529:40152): avc: denied { read write open } for pid=11621 comm="syz.9.4035" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 329.121258][ T36] audit: type=1400 audit(1750463994.529:40153): avc: denied { write } for pid=11621 comm="syz.9.4035" name="pfkey" dev="proc" ino=4026532838 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 329.165406][ T36] audit: type=1400 audit(1750463994.529:40154): avc: denied { write } for pid=11621 comm="syz.9.4035" name="pfkey" dev="proc" ino=4026532838 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 329.202290][ T36] audit: type=1400 audit(1750463994.529:40155): avc: denied { read } for pid=11621 comm="syz.9.4035" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 329.227741][ T36] audit: type=1400 audit(1750463994.529:40156): avc: denied { read open } for pid=11621 comm="syz.9.4035" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 329.237007][T11636] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 329.265788][T11636] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 329.294839][T11636] binder: Unknown parameter '0x0000000000000008' [ 329.658400][T11646] netlink: 424 bytes leftover after parsing attributes in process `syz.2.4044'. [ 329.735946][T11647] input: syz1 as /devices/virtual/input/input103 [ 329.879111][T11659] overlayfs: failed to resolve './file1': -2 [ 330.036809][T11663] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 330.036842][T11663] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:255 [ 330.155341][ T322] usb 6-1: USB disconnect, device number 83 [ 330.295497][T11668] random: crng reseeded on system resumption [ 330.327993][T11670] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 330.491546][T11678] random: crng reseeded on system resumption [ 330.589189][T11682] overlayfs: failed to resolve './file1': -2 [ 330.987193][ T9] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 331.147564][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 331.156327][ T9] usb 3-1: config 1 interface 0 altsetting 6 bulk endpoint 0x1 has invalid maxpacket 32 [ 331.166108][ T9] usb 3-1: config 1 interface 0 altsetting 6 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 331.179064][ T9] usb 3-1: config 1 interface 0 has no altsetting 0 [ 331.193649][ T9] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 331.202905][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 331.211025][ T9] usb 3-1: Product: 擆씳暎̸౤荲࡭ⶅ嫁稧퀍캀⻰㬺梦뀳큝ꐦ煙퓪ẽ슴촆嘣딬䃥濫菝쑳⸴熬蕍뒌ꬌḤ啄똤萆甽ꔀ깜㖊 [ 331.226975][ T9] usb 3-1: Manufacturer:  [ 331.231701][ T9] usb 3-1: SerialNumber: ᠲ [ 331.242790][T11690] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 331.348716][T11698] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 331.362629][T11698] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 331.452828][T11700] rust_binder: Failed to allocate buffer. len:4294966472, is_oneway:false [ 331.459367][T11700] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 331.467910][T11700] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:822 [ 331.577386][T11706] netlink: 324 bytes leftover after parsing attributes in process `syz.9.4064'. [ 331.700924][ T304] usb 3-1: USB disconnect, device number 28 [ 331.768634][T11712] rust_binder: Write failure EINVAL in pid:277 [ 331.796308][T11720] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 331.813338][T11720] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 331.824533][T11720] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 331.842562][T11720] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 331.913858][T11722] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:279 [ 332.334284][T11734] netlink: 324 bytes leftover after parsing attributes in process `syz.5.4074'. [ 332.567308][T11745] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 332.575517][T11745] rust_binder: Error while translating object. [ 332.599921][T11745] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 332.619091][T11745] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:140 [ 332.849242][T11759] rust_binder: Write failure EINVAL in pid:299 [ 332.975639][ T9] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 333.146676][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 333.154900][ T9] usb 3-1: config 64 has an invalid descriptor of length 0, skipping remainder of the config [ 333.169880][ T9] usb 3-1: New USB device found, idVendor=9e88, idProduct=9e8f, bcdDevice=9b.e4 [ 333.179012][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 333.187050][ T9] usb 3-1: Product: syz [ 333.194343][ T9] usb 3-1: Manufacturer: syz [ 333.198992][ T9] usb 3-1: SerialNumber: syz [ 333.401356][T11764] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 333.404472][T11764] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 333.411001][T11764] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:144 [ 333.429668][ T9] ftdi_sio 3-1:64.0: Ignoring interface reserved for JTAG [ 333.454971][ T9] usb 3-1: USB disconnect, device number 29 [ 333.507790][T11768] netlink: 324 bytes leftover after parsing attributes in process `syz.5.4086'. [ 333.940565][T11784] rust_binder: Error in use_page_slow: ESRCH [ 333.940584][T11784] rust_binder: use_range failure ESRCH [ 333.946635][T11784] rust_binder: Failed to allocate buffer. len:136, is_oneway:false [ 333.954309][T11784] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 333.971322][T11784] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:307 [ 334.140953][ T9] usb 6-1: new high-speed USB device number 84 using dummy_hcd [ 334.176673][ T45] Bluetooth: hci0: Frame reassembly failed (-84) [ 334.225710][ T36] kauditd_printk_skb: 1096 callbacks suppressed [ 334.225728][ T36] audit: type=1400 audit(1750463999.486:41253): avc: denied { read write } for pid=10935 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 334.295518][ T36] audit: type=1400 audit(1750463999.486:41254): avc: denied { read write open } for pid=10935 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 334.325905][ T36] audit: type=1400 audit(1750463999.486:41255): avc: denied { ioctl } for pid=10935 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 334.365705][T11800] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:314 [ 334.367879][ T9] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 334.397488][ T36] audit: type=1400 audit(1750463999.505:41256): avc: denied { read write } for pid=11794 comm="syz.2.4096" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1 trawcon="system_u:object_r:modules_conf_t:s0" [ 334.435265][ T9] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 334.445082][ T9] usb 6-1: config 1 has no interface number 0 [ 334.451862][ T9] usb 6-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 334.463335][ T36] audit: type=1400 audit(1750463999.505:41257): avc: denied { read open } for pid=11794 comm="syz.2.4096" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1 trawcon="system_u:object_r:modules_conf_t:s0" [ 334.493692][ T9] usb 6-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 334.510405][ T9] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 334.524845][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.541640][ T36] audit: type=1400 audit(1750463999.505:41258): avc: denied { map } for pid=11794 comm="syz.2.4096" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1 trawcon="system_u:object_r:modules_conf_t:s0" [ 334.573724][ T9] usb 6-1: Product: syz [ 334.580918][ T9] usb 6-1: Manufacturer: syz [ 334.587626][ T9] usb 6-1: SerialNumber: syz [ 334.604375][T11782] audit: audit_backlog=65 > audit_backlog_limit=64 [ 334.611221][T11782] audit: audit_lost=79 audit_rate_limit=0 audit_backlog_limit=64 [ 334.619763][T11782] audit: backlog limit exceeded [ 334.625255][T11805] audit: audit_backlog=65 > audit_backlog_limit=64 [ 334.634108][T11805] rust_binder: Error while translating object. [ 334.634146][T11805] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 334.640450][T11805] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:317 [ 334.645596][T11802] binder: Unknown parameter 'ma%5p' [ 334.651792][ T45] Bluetooth: hci1: Frame reassembly failed (-84) [ 334.775979][T11808] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 112, limit: 128, size: 18) [ 334.776003][T11808] rust_binder: Error while translating object. [ 334.786607][T11808] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 334.792910][T11808] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:319 [ 335.225262][T11828] rust_binder: Write failure EFAULT in pid:332 [ 335.303732][ T9] cdc_ncm 6-1:1.1: failed GET_NTB_PARAMETERS [ 335.309843][ T9] cdc_ncm 6-1:1.1: bind() failure [ 335.321634][ T9] usb 6-1: USB disconnect, device number 84 [ 335.425582][T11839] binder: Unknown parameter 'secl&bel' [ 335.602954][T11845] binder: Unknown parameter 'coyBLV"i5ntext' [ 335.694484][T11854] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 335.707024][T11854] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 335.772729][T11861] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 335.780193][T11861] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 335.801988][T11861] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 335.813170][T11861] rust_binder: Failed to allocate buffer. len:136, is_oneway:false [ 335.925580][T11868] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 335.993748][T11872] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:162 [ 336.017306][T11872] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:162 [ 336.283010][T11888] netlink: 324 bytes leftover after parsing attributes in process `syz.9.4125'. [ 336.332480][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 336.338619][ T8659] Bluetooth: hci0: command 0x1003 tx timeout [ 336.447624][T11893] rust_binder: Write failure EFAULT in pid:374 [ 336.612679][T11900] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 336.638095][ T45] Bluetooth: hci0: Frame reassembly failed (-84) [ 336.690331][T11901] rust_binder: Failed to allocate buffer. len:40, is_oneway:false [ 336.691049][T11901] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:866 [ 336.845618][ T8659] Bluetooth: hci1: command 0x1003 tx timeout [ 336.845617][ T6130] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 337.110843][T11920] netlink: 324 bytes leftover after parsing attributes in process `syz.2.4135'. [ 337.569416][T11929] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 337.691927][T11936] binder: Unknown parameter 'defcontext01777777777777777777777' [ 337.846577][T11941] binder: Bad value for 'max' [ 337.973631][T11946] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 338.115312][T11948] netlink: 324 bytes leftover after parsing attributes in process `syz.2.4146'. [ 338.264243][T11963] netlink: 'syz.2.4150': attribute type 4 has an invalid length. [ 338.275885][T11963] netlink: 'syz.2.4150': attribute type 4 has an invalid length. [ 338.571347][ T9] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 338.604436][T11971] binder: Bad value for 'defcontext' [ 338.748561][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 338.760459][ T9] usb 3-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 338.769609][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 338.799361][ T9] usb 3-1: config 0 descriptor?? [ 338.806389][ T9] ftdi_sio 3-1:0.0: FTDI USB Serial Device converter detected [ 338.814038][ T6130] Bluetooth: hci0: command 0x1003 tx timeout [ 338.815080][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 338.899616][T11976] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 1 [ 338.907245][T11976] rust_binder: Write failure EINVAL in pid:184 [ 339.024191][ T9] usb 3-1: Detected FT232A [ 339.052648][ T9] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 339.143974][T11981] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:380 [ 339.252854][ T1159] usb 3-1: USB disconnect, device number 30 [ 339.295088][ T1159] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 339.310871][ T1159] ftdi_sio 3-1:0.0: device disconnected [ 339.352391][T11985] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 339.390737][T11985] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 339.422710][T11985] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 339.454173][T11985] rust_binder: Write failure EINVAL in pid:189 [ 339.554231][T11990] rust_binder: Write failure EFAULT in pid:191 [ 339.573270][ T36] kauditd_printk_skb: 926 callbacks suppressed [ 339.573288][ T36] audit: type=1400 audit(1750464004.500:42180): avc: denied { read } for pid=11989 comm="syz.8.4160" name="ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 339.650367][ T36] audit: type=1400 audit(1750464004.509:42181): avc: denied { connect } for pid=11991 comm="syz.9.4161" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 339.670304][ T36] audit: type=1400 audit(1750464004.509:42182): avc: denied { connect } for pid=11991 comm="syz.9.4161" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 339.690284][ T36] audit: type=1400 audit(1750464004.509:42183): avc: denied { read } for pid=11991 comm="syz.9.4161" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 339.713115][ T36] audit: type=1400 audit(1750464004.509:42184): avc: denied { read open } for pid=11991 comm="syz.9.4161" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 339.750508][ T36] audit: type=1400 audit(1750464004.509:42185): avc: denied { read } for pid=11991 comm="syz.9.4161" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 339.790757][ T36] audit: type=1400 audit(1750464004.509:42186): avc: denied { read open } for pid=11991 comm="syz.9.4161" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 339.829080][ T36] audit: type=1400 audit(1750464004.537:42187): avc: denied { read open } for pid=11989 comm="syz.8.4160" path="/dev/ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 339.840393][T12006] binder: Unknown parameter 'seclabUh' [ 339.881046][ T36] audit: type=1400 audit(1750464004.547:42188): avc: denied { read write } for pid=11989 comm="syz.8.4160" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 339.912569][ T36] audit: type=1400 audit(1750464004.547:42189): avc: denied { read write open } for pid=11989 comm="syz.8.4160" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 339.961244][T12011] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:394 [ 339.963126][T12009] rust_kernel: panicked at /syzkaller/managers/ci2-android-6-12-rust/kernel/rust/kernel/page_size_compat.rs:60:5: [ 339.963126][T12009] attempt to add with overflow [ 339.990204][T12011] rust_binder: Error while translating object. [ 339.990242][T12011] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 339.996422][T12011] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:394 [ 340.007479][T12009] ------------[ cut here ]------------ [ 340.022283][T12009] kernel BUG at rust/helpers/bug.c:7! [ 340.077738][T12009] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI [ 340.084723][T12009] CPU: 0 UID: 0 PID: 12009 Comm: syz.2.4166 Not tainted 6.12.23-syzkaller-g6c1c18fcb8b7 #0 ba78288b1e32eb9f88d3f8d8da6b79a037cd8362 [ 340.098279][T12009] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 340.108352][T12009] RIP: 0010:rust_helper_BUG+0x8/0x10 [ 340.113664][T12009] Code: cc cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b8 7c 49 14 f5 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 48 89 e5 <0f> 0b 66 0f 1f 44 00 00 b8 36 8d 5d 79 90 90 90 90 90 90 90 90 90 [ 340.133278][T12009] RSP: 0018:ffffc900010cf3f0 EFLAGS: 00010246 [ 340.139359][T12009] RAX: 000000000000008c RBX: 1ffff92000219e80 RCX: 0db54443b6866100 [ 340.147342][T12009] RDX: ffffc900188de000 RSI: 000000000000a50b RDI: 000000000000a50c [ 340.155336][T12009] RBP: ffffc900010cf3f0 R08: ffffc900010cf0e7 R09: 1ffff92000219e1c [ 340.163320][T12009] R10: dffffc0000000000 R11: fffff52000219e1d R12: 0000000000000000 [ 340.171304][T12009] R13: dffffc0000000000 R14: ffffc900010cf420 R15: ffffc900010cf450 [ 340.179292][T12009] FS: 00007fee131e96c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 340.188281][T12009] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 340.194878][T12009] CR2: 00007ffd27bbfec8 CR3: 000000011f2ec000 CR4: 00000000003526b0 [ 340.202864][T12009] DR0: 0000000000000008 DR1: 0000000000000008 DR2: 0000000000000006 [ 340.210848][T12009] DR3: 0000000000000004 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 340.218831][T12009] Call Trace: [ 340.222123][T12009] [ 340.225056][T12009] _RNvCscSpY9Juk0HT_7___rustc17rust_begin_unwind+0x15b/0x160 [ 340.232535][T12009] ? __cfi__RNvCscSpY9Juk0HT_7___rustc17rust_begin_unwind+0x10/0x10 [ 340.240536][T12009] ? kernel_text_address+0xa9/0xe0 [ 340.245664][T12009] ? __cfi__RNvXs1b_NtCs9jEwPDbx20M_4core3fmtRNtNtNtB8_5panic10panic_info9PanicInfoNtB6_7Display3fmtCs43vyB533jt3_6kernel+0x10/0x10 [ 340.259225][T12009] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 340.265394][T12009] ? arch_stack_walk+0x10b/0x170 [ 340.270424][T12009] _RNvNtCs9jEwPDbx20M_4core9panicking9panic_fmt+0x84/0x90 [ 340.277644][T12009] ? __cfi__RNvNtCs9jEwPDbx20M_4core9panicking9panic_fmt+0x10/0x10 [ 340.285544][T12009] _RNvNtNtCs9jEwPDbx20M_4core9panicking11panic_const24panic_const_add_overflow+0xb2/0xc0 [ 340.295430][T12009] ? __cfi__RNvNtNtCs9jEwPDbx20M_4core9panicking11panic_const24panic_const_add_overflow+0x10/0x10 [ 340.306016][T12009] _RNvXs1_CscPPBqWtAqum_11ashmem_rustNtB5_6AshmemNtNtCs43vyB533jt3_6kernel10miscdevice10MiscDevice4mmap+0xe44/0xfb0 [ 340.318254][T12009] ? mas_wr_store_type+0x8eb/0x1ad0 [ 340.323461][T12009] ? __cfi__RNvXs1_CscPPBqWtAqum_11ashmem_rustNtB5_6AshmemNtNtCs43vyB533jt3_6kernel10miscdevice10MiscDevice4mmap+0x10/0x10 [ 340.336221][T12009] ? mas_preallocate+0x56e/0xc60 [ 340.341169][T12009] ? __cfi_mas_preallocate+0x10/0x10 [ 340.346447][T12009] ? kasan_save_alloc_info+0x40/0x50 [ 340.351722][T12009] ? __asan_memset+0x39/0x50 [ 340.356309][T12009] mmap_region+0x1371/0x1bd0 [ 340.360897][T12009] ? __cfi_mmap_region+0x10/0x10 [ 340.365908][T12009] ? __kasan_check_read+0x15/0x20 [ 340.370930][T12009] ? arch_get_unmapped_area_topdown+0x232/0x8d0 [ 340.377182][T12009] ? file_mmap_ok+0x147/0x1a0 [ 340.381848][T12009] do_mmap+0xb6d/0x13c0 [ 340.386009][T12009] ? __cfi_do_mmap+0x10/0x10 [ 340.390588][T12009] ? down_write_killable+0xe9/0x2d0 [ 340.395783][T12009] ? __cfi_down_write_killable+0x10/0x10 [ 340.401414][T12009] vm_mmap_pgoff+0x38f/0x4e0 [ 340.406004][T12009] ? __cfi_vm_mmap_pgoff+0x10/0x10 [ 340.411111][T12009] ? __fget_files+0x2c5/0x340 [ 340.415790][T12009] ksys_mmap_pgoff+0x166/0x1e0 [ 340.420532][T12009] __x64_sys_mmap+0x121/0x140 [ 340.425197][T12009] x64_sys_call+0x13bf/0x2ee0 [ 340.429874][T12009] do_syscall_64+0x58/0xf0 [ 340.434275][T12009] ? clear_bhb_loop+0x35/0x90 [ 340.438946][T12009] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 340.444833][T12009] RIP: 0033:0x7fee1238e929 [ 340.449331][T12009] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 340.468922][T12009] RSP: 002b:00007fee131e9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 340.477321][T12009] RAX: ffffffffffffffda RBX: 00007fee125b5fa0 RCX: 00007fee1238e929 [ 340.485282][T12009] RDX: 0000000000000000 RSI: 0000000000001000 RDI: 0000200000701000 [ 340.493245][T12009] RBP: 00007fee12410b39 R08: 0000000000000003 R09: 0000000000000000 [ 340.501210][T12009] R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000000000 [ 340.509191][T12009] R13: 0000000000000000 R14: 00007fee125b5fa0 R15: 00007ffd02998fa8 [ 340.517167][T12009] [ 340.520190][T12009] Modules linked in: [ 340.524428][T12009] ---[ end trace 0000000000000000 ]--- [ 340.530399][T12009] RIP: 0010:rust_helper_BUG+0x8/0x10 [ 340.535777][T12009] Code: cc cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b8 7c 49 14 f5 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 48 89 e5 <0f> 0b 66 0f 1f 44 00 00 b8 36 8d 5d 79 90 90 90 90 90 90 90 90 90 [ 340.555525][T12009] RSP: 0018:ffffc900010cf3f0 EFLAGS: 00010246 [ 340.561632][T12009] RAX: 000000000000008c RBX: 1ffff92000219e80 RCX: 0db54443b6866100 [ 340.569671][T12009] RDX: ffffc900188de000 RSI: 000000000000a50b RDI: 000000000000a50c [ 340.577699][T12009] RBP: ffffc900010cf3f0 R08: ffffc900010cf0e7 R09: 1ffff92000219e1c [ 340.585699][T12009] R10: dffffc0000000000 R11: fffff52000219e1d R12: 0000000000000000 [ 340.593717][T12009] R13: dffffc0000000000 R14: ffffc900010cf420 R15: ffffc900010cf450 [ 340.601727][T12009] FS: 00007fee131e96c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 340.610699][T12009] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 340.617305][T12009] CR2: 00007f1945f81178 CR3: 000000011f2ec000 CR4: 00000000003526b0 [ 340.625330][T12009] DR0: 0000000000000cde DR1: 0000000000000000 DR2: 0000000000000000 [ 340.633348][T12009] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 340.641362][T12009] Kernel panic - not syncing: Fatal exception [ 340.647666][T12009] Kernel Offset: disabled [ 340.651976][T12009] Rebooting in 86400 seconds..