last executing test programs: 2.39325452s ago: executing program 0 (id=354): setfsuid(0xee01) (async) setfsuid(0xee01) setfsuid(0xee01) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, 0x0) syz_usb_connect$hid(0x1, 0x3f, &(0x7f0000000180)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x56a, 0x30, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x6, 0x40, 0x4, [{{0x9, 0x4, 0x0, 0x3, 0x1, 0x3, 0x1, 0x3, 0x2, {0x9, 0x21, 0x1, 0x8, 0x1, {0x22, 0x9e2}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x1, 0x5, 0x80}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0x9, 0x2, 0x9}}]}}}]}}]}}, &(0x7f00000004c0)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0xf9, 0xa, 0x1, 0x40, 0x9}, 0x4b, &(0x7f0000000200)={0x5, 0xf, 0x4b, 0x6, [@ext_cap={0x7, 0x10, 0x2, 0xa, 0x4, 0x2, 0x8}, @ss_container_id={0x14, 0x10, 0x4, 0xd8, "6a1b3228e7351a3714fff31e2525f572"}, @wireless={0xfffffffffffffe75, 0x10, 0x1, 0xc, 0x22, 0x38, 0x4, 0x3, 0xf8}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x1, 0x9e, 0xff}, @wireless={0xb, 0x10, 0x1, 0x8, 0x0, 0x7, 0x6, 0x81, 0x10}, @wireless={0xb, 0x10, 0x1, 0x2, 0x2, 0x10, 0x1f, 0x3, 0x4}]}, 0x4, [{0x7a, &(0x7f0000000540)=ANY=[@ANYRES8=0x0]}, {0xd5, &(0x7f0000000300)=@string={0xd5, 0x3, "2270a3ef251d2a5725e86317075b2743568df1562461ce1c790131214a03ef77ab348e061feffce4c13e0bbba16ece4e061004f76526f9abbdd603e1b6f89f3267924f27d8386b4ec20e62e4a5aa566a510ff5cd9de1bcedc640ee3527d51cda8f50deabe1bf16af400d702334ea80ea814390821b3d261d9b97e023bbe5792c57ffe2e4bc249d6e0f8b18125efbb7c4f27572f351315726004b5b9903911ff976946b429b4d60ee2e4df38ac1550977ae6862d093faafc268a776c5f599c99316726562aeea5a621e7373dc8dfe4162184348"}}, {0x57, &(0x7f0000000400)=@string={0x57, 0x3, "6e53b73fb901d2d0a2115667b28fe314cda9514b1c887d49188841bdd53e60ac62db8c590ef7271720304a2bf36ce8b3023b90f9c3b5ed193c84a07954911bc74e39724b27c43ddf8949d5618e16c63b81d7a651b3"}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x200a}}]}) sendmsg$IPVS_CMD_GET_SERVICE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x0, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24040014}, 0x2000c841) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x3, 0x50, r0, 0xb4c52000) getgroups(0x1, &(0x7f0000000140)=[0xee00]) syz_usb_connect$printer(0x5, 0x36, &(0x7f0000000280)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x10, 0x5, [{{0x9, 0x4, 0x0, 0x2, 0x2, 0x7, 0x1, 0x1, 0x5, "", {{{0x9, 0x5, 0x1, 0x2, 0x40, 0xa, 0x2, 0x3}}, [{{0x9, 0x5, 0x82, 0x2, 0x8, 0x7f, 0xf5, 0xd2}}]}}}]}}]}}, &(0x7f0000000640)={0xa, &(0x7f00000002c0)={0xa, 0x6, 0x110, 0xa, 0x3, 0x10, 0x0, 0x9}, 0x18, &(0x7f0000000580)={0x5, 0xf, 0x18, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x6, 0x4, 0x9, 0x3}, @ssp_cap={0xc, 0x10, 0xa, 0xd, 0x0, 0x2, 0xf000, 0x719}]}, 0x2, [{0x19, &(0x7f00000005c0)=ANY=[@ANYBLOB="1903b7e31346ff8cfa52fc2eb6e63c922cb96981b443c135c2"]}, {0x4, &(0x7f0000000600)=@lang_id={0x4, 0x3, 0x88c}}]}) fchown(r0, 0xee00, r1) (async) fchown(r0, 0xee00, r1) 1.88264787s ago: executing program 0 (id=371): r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz0\x00', 0x200002, 0x0) mkdirat$cgroup(r0, &(0x7f00000000c0)='syz1\x00', 0x1ff) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x4708c1, 0x0) mknod$loop(0x0, 0x0, 0x0) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fdc000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x40, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x0) r2 = openat$incfs(r1, &(0x7f0000000000)='.pending_reads\x00', 0x0, 0x0) ioctl$TIOCL_GETKMSGREDIRECT(r2, 0x40106726, &(0x7f00000000c0)) mount$binderfs(0x0, &(0x7f0000000080)='./binderfs\x00', &(0x7f0000000140), 0x4a81, &(0x7f0000000180)=ANY=[@ANYBLOB="6d61783d30303030303030303030303030303030303030303030302c00c9b204fdd9616f4c6394be9e14c52a8cf25da8fddb5e4aa0828b77030fe8f513cc5e659c1e930dabeb9ec90dcf7ee4467f1d55cc9e163fdf1af289dac7fd51176802511e9ee984709576ce0b4efdf58eb43f4247e7b92f4b1eaeaa072ad3274ccc539498bbdccf910d12930ec04e55ecf087"]) 1.872092241s ago: executing program 0 (id=372): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x4, 0x10ffff, 0xfffffffd}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x2007, &(0x7f0000000980)=0x0) r3 = eventfd2(0x6, 0x800) clock_gettime(0x1, &(0x7f00000001c0)) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r6 = socket(0xa, 0x3, 0x3a) r7 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000003c0)={'bridge0\x00', 0x0}) setsockopt$MRT6_ADD_MIF(r6, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x0, 0x0, r8}, 0xc) setsockopt$MRT6_ADD_MIF(r6, 0x29, 0xca, &(0x7f0000000040)={0x1, 0x0, 0x5, r8, 0xffffff8f}, 0xc) setsockopt$MRT6_ADD_MFC_PROXY(r6, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0xd, @remote}, {0xa, 0x4e22, 0x0, @mcast1}, 0x0, {[0x7b3, 0x0, 0xd]}}, 0x5c) io_pgetevents(r2, 0x5, 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}], &(0x7f00000000c0)={r4, r5+10000000}, &(0x7f0000000200)={&(0x7f0000000140)={[0x798]}, 0x8}) io_getevents(r2, 0x1, 0x1, &(0x7f0000000180)=[{}], 0x0) io_pgetevents(r2, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0, 0x0) io_submit(r2, 0x1, &(0x7f0000000280)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x1, r3}]) r9 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(r9, 0x0, 0x50, &(0x7f0000000540)={{{@in6=@remote, @in6=@private0}}, {{@in=@initdev}, 0x0, @in=@loopback}}, &(0x7f00000002c0)=0xe8) ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0) 1.666236198s ago: executing program 2 (id=377): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x70630aae1967d135, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x11, r1, 0x45809000) (async) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x1cbd81, 0x0) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000207d1e64320000000000010943580001000040000904008c0103000300092100000001220700090581030000000000"], 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) (async) connect$inet6(r3, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f00000000c0)=0x1, 0x4) write$binfmt_script(r3, &(0x7f0000000100), 0xfffffecd) (async) setsockopt$sock_int(r3, 0x1, 0x12, &(0x7f0000000b40)=0x20000, 0x4) (async) pselect6(0x40, &(0x7f0000000000)={0x6, 0x0, 0x7ffffffe, 0x2, 0x4, 0xffffffffffffffff, 0x0, 0x4}, &(0x7f0000000140)={0x9, 0x20000, 0xb59, 0x5, 0x5, 0x40000000000000, 0x6}, 0x0, 0x0, 0x0) (async) ioctl$BLKRRPART(r2, 0x125f, 0x0) 1.322477455s ago: executing program 1 (id=379): r0 = add_key$fscrypt_v1(&(0x7f00000000c0), &(0x7f0000000100)={'fscrypt:', @desc4}, &(0x7f0000000140)={0x0, "2de0a0a6483bd986fed7ba72d8b6152b6513173f00ca3ac4217c2d0aacd58592f5b0122e0b0f4efd7af2000001e8cd2f890214055009c582eae2a48dc69c290c", 0x1c}, 0x48, 0xfffffffffffffff9) r1 = add_key$fscrypt_provisioning(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)={0x2, 0x0, @d}, 0x18, r0) r2 = add_key$keyring(&(0x7f00000001c0), &(0x7f0000000200)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$update(0x2, r2, &(0x7f0000000240)="5bc1a02004240c92ff55070ace582f36b005da9fd3ea334e6851811bc21bd915262b6e7cc9b0632d320573d559d9052f333ec0f1bcb286a2c5e6672437e0c63f63ada831dd1e9baa22f1386c37953555cc30e9a85c292655fe7f62de128cbcbb984b99632db63dad2cbb8559401d1fcd3da13113e0ea53e63aac1f1b2cf255ebb50899e34708695b43161e4d73d1ef7b876d2603d7d1e9b886c69e64d449d1fbb53968bb33bbacc7007e9c71d1fdb240ef8fa691", 0xb4) keyctl$revoke(0x3, r1) keyctl$KEYCTL_PKEY_QUERY(0x18, r2, 0x0, &(0x7f0000000300)='^/\xc8\x00', &(0x7f0000000340)) r3 = add_key$keyring(&(0x7f0000000400), &(0x7f0000000440)={'syz', 0x1}, 0x0, 0x0, r0) r4 = add_key(&(0x7f0000000380)='id_legacy\x00', &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, r3) keyctl$setperm(0x5, r4, 0x32e22) keyctl$get_security(0x11, r4, &(0x7f0000000480)=""/236, 0xec) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) r6 = syz_open_dev$char_usb(0xc, 0xb4, 0xd) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000580)=0x0) timer_create(0x5, &(0x7f00000005c0)={0x0, 0x40, 0x6, @tid=r7}, &(0x7f0000000600)) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000000640)={0x2, {0x2, 0x6, 0x401, 0x3, 0x8, 0x10}}) r8 = request_key(&(0x7f0000000680)='id_resolver\x00', &(0x7f00000006c0)={'syz', 0x2}, &(0x7f0000000700)='syz', 0xfffffffffffffff8) r9 = add_key$keyring(&(0x7f0000000740), &(0x7f0000000780)={'syz', 0x0}, 0x0, 0x0, r2) keyctl$KEYCTL_MOVE(0x1e, r0, r8, r9, 0x1) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000007c0)='./binderfs/custom0\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f00000009c0)={0x58, 0x0, &(0x7f00000008c0)=[@enter_looper, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000800)={@fd={0x66642a85, 0x0, r6}, @flat=@weak_handle={0x77682a85, 0x101, 0x2}, @flat=@weak_handle={0x77682a85, 0x800, 0x1}}, &(0x7f0000000880)={0x0, 0x18, 0x30}}, 0x1000}, @increfs], 0x4b, 0x0, &(0x7f0000000940)="e8c2c12c4188778d936def3a7d1a69cb82955aed163b3a3428060b041afd8fe45cba50d2091951bc9aa94d44dcccc4bf45c59dd34724ef44e2450d04c600fce1a885ff88b1daae849e2b86"}) keyctl$link(0x8, r1, r4) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r10, 0xc018620c, &(0x7f0000000a00)) add_key$user(&(0x7f0000000a40), &(0x7f0000000a80)={'syz', 0x1}, &(0x7f0000000ac0)="87c4872a4aed594f710cc3445681f9757d121a05", 0x14, r8) add_key(&(0x7f0000000b00)='id_legacy\x00', &(0x7f0000000b40)={'syz', 0x3}, &(0x7f0000000b80)="b34f94ace10d86bddd559f851eef8c06faadace0f9e33a2b44ded383f533405659b78550d44d904ddf4e28850df5e38325ac02210f5eafd6d722236f88df1f27879f225993b4b25ac180fbc8ef4d0663ea0aa46eed6b200be9f9999fe84e76de6717542817e9df61f8e11f7e66f6b6a54db6555ef8a923e5462c9e9eec7dbfbfc077087752f6a664824e2ad956004799fb92d0d9fba7163ec0712da6097f2f89638325ba0f631f567611e8bdba0798fdfd", 0xb1, 0xfffffffffffffffb) r11 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$TCSETS(r11, 0x5402, &(0x7f0000000c40)={0x3dd9, 0x100, 0xffff, 0x10000, 0x0, "e1f146d4791ab7c19df280c6a7ef41cedf65f8"}) keyctl$join(0x1, 0x0) r12 = openat(r5, &(0x7f0000000d00)='./file0\x00', 0x0, 0x20) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000d40)={{{@in6=@mcast2, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@multicast1}}, &(0x7f0000000e40)=0xe8) mount$9p_fd(0x0, &(0x7f0000000c80)='./file0\x00', &(0x7f0000000cc0), 0x100000, &(0x7f0000000e80)={'trans=fd,', {'rfdno', 0x3d, r12}, 0x2c, {'wfdno', 0x3d, r11}, 0x2c, {[{@version_u}, {@version_L}, {@access_any}], [{@pcr={'pcr', 0x3d, 0x31}}, {@dont_appraise}, {@fowner_eq={'fowner', 0x3d, r13}}]}}) 1.302742896s ago: executing program 1 (id=380): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x138b, 0x6}) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x60, 0x18, &(0x7f00000001c0)={@ptr={0x70742a85, 0x2, 0x0, 0x0, 0x0, 0x15}, @flat=@binder={0x73622a85, 0x100, 0xfffffffffffffffc}, @fda={0x66646185, 0x9, 0xffffffffffffffff, 0x1f}}, &(0x7f0000000180)={0x0, 0x28, 0x40}}, 0x400}], 0x0, 0x0, 0x0}) socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x1, 0x0) unshare(0x60000600) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f0000000340)={'ip6tnl0\x00', &(0x7f00000001c0)=@ethtool_stats={0x1d, 0x2, [0xa1b, 0x3]}}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="20000000110001000000000000000000100000e60b"], 0x20}], 0x1}, 0x0) openat$rnullb(0xffffffffffffff9c, &(0x7f00000002c0), 0x40140, 0x0) fgetxattr(r0, &(0x7f0000000100)=@random={'system.', '\x00'}, &(0x7f0000000240)=""/32, 0x20) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f00000005c0)="2078b98d43d07572a4ac17e070f6e4ffd39036ed0af8f56f83f08868dc94aaa397e205bed98262b9477344a911603869d9f3f877f7aad1829f47273251843760bd7de0381b6c857784bb0ddc8246ff1e"}) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000006ac0)='dctcp-reno\x00', 0xb) sendto$inet6(r3, &(0x7f0000000000)='q', 0x1, 0x40000, 0x0, 0x0) write$binfmt_elf64(r3, &(0x7f0000000000)=ANY=[], 0xfffffd88) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000080)={0x4, "29ec3d"}, 0x6) 1.079135044s ago: executing program 2 (id=381): r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0xf, 0x8041) ioctl$USBDEVFS_ALLOC_STREAMS(r0, 0x8008551c, &(0x7f0000000040)={0x184a}) r1 = socket$tipc(0x1e, 0x5, 0x0) recvmmsg(r1, &(0x7f0000000bc0)=[{{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000500)=""/199, 0xc7}], 0x1}, 0x9}], 0x1, 0x0, 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='exfat\x00', 0x200000, 0x0) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f00000000c0)) 1.076271845s ago: executing program 2 (id=382): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0xe6683000) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, 0x0, 0x0) (async) sendmsg$sock(0xffffffffffffffff, &(0x7f0000001380)={0x0, 0x0, 0x0}, 0x8000) (async, rerun: 64) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000000)={0x0, 0x3, 0x7, 0x10001}) (rerun: 64) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000100), 0x208e24b) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 1.075166074s ago: executing program 2 (id=383): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000001c0)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000050000005800018044000400200001000a000002000000000000000000000000000000000000000100000000200002000a00000000000000fe8000000000faffffff000000000038008000000d0001007564703a7379"], 0x6c}, 0x1, 0x40000000}, 0x0) 1.074722774s ago: executing program 2 (id=384): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x1802, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(0xffffffffffffffff, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=""/73, 0x0, &(0x7f0000000500)=""/4092, 0x3000}) r2 = socket$netlink(0x10, 0x3, 0x8) sendmsg$netlink(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="2cc616b0cca8280000001000010000000000fedbdf5b170c000c0000000000000094da00000c0028000600000000000000"], 0x2c}], 0x1}, 0x0) syz_usb_connect(0x0, 0x3d, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 933.517516ms ago: executing program 0 (id=385): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000001c0)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000030000005800018044000400200001000a00000200000000ffe0000000000000000000000000000100000000200002000a00000000000000fe8000000000faffffff000000000038008000000d0001007564703a7379"], 0x6c}}, 0x0) 905.831958ms ago: executing program 0 (id=386): mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$incfs(&(0x7f0000000580)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f00000005c0), 0x0, 0x0) chdir(&(0x7f00000001c0)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80e02, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f000087e000/0x18000)=nil, &(0x7f00000002c0)=[@text64={0x40, &(0x7f0000000300)="66baf80cb81c8b3f88ef66bafc0cedf6a5535a0000f4420f01d1c4a17dd7fa66440ffc9300880000b9800000c00f3235008000000f3047dd6000430f0766ba410066ed", 0x43}], 0x1, 0x4d, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x2, 0x0) r3 = gettid() prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) tkill(r3, 0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = syz_clone(0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ptrace(0x10, r4) ptrace$setregset(0x4205, r4, 0x1, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415603, 0x3}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000006c0)={0x4, 0x0, &(0x7f0000000540)=[@enter_looper], 0x50, 0x0, &(0x7f0000000600)="8dcdbd6d42ccdb4d556e7c2df713f0976fa3babb5f759be053e97109c9075d28dd5945ae6cb4e4d7866fe0493fb5c9157fdee7247f8cbf6c4e75526dc08c3ae8609b8760a00535639755c0fd5010ceba"}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000400), 0x28, 0x0, 0x0}) 502.8275ms ago: executing program 2 (id=390): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000040)={0x1}, 0x8) (async) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000040)={0x1}, 0x8) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (async) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket(0x11, 0x3, 0x8) (async) r2 = socket(0x11, 0x3, 0x8) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x802, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x802, 0x0) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000019004f5d010203010902240001000010000904d60202ffff0000090502020002020000090582021000"/54], 0x0) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$BTRFS_IOC_DEFRAG(r5, 0x50009402, 0x0) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000001c0)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r7, 0x0) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r6, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) ptrace(0x11, 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) (async) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io$printer(r3, 0x0, 0x0) (async) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io$sierra_net(r3, 0x0, 0x0) syz_usb_control_io$lan78xx(r3, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000400)=ANY=[@ANYBLOB="20089e0000003e1762f35470093490d0a5c106749b74d8717065f2d23031ac821ecb46b28049ad838f7dff745e06a128b1ed918e43c82eaffd5c3c0f7f6a96724520472d04986129dec18b8d7d620072b03fe69ee99a0ee08191b72f31c49dbd015d1dbec700d5c78c6cc25046c374c68d4ab869b00cfc4468478144bdefc8d50d1c425281587e7935a2625156cb3724e769ed1fe2cb6b937f29119c245600000000000021683fddafa6abad884987198839c1af2e80c1a8c66ab0590af4113321345fa7abbf42d9d2022b84fd19cdac1374ece77d71a620657f44df1532f1f90c5ef4cf6543cf5515"], 0x0, 0x0, &(0x7f0000000300)={0xc0, 0xa1, 0x4, 0x7}, &(0x7f0000000080)={0x40, 0xa0, 0x4, 0x5}, &(0x7f0000000380)={0xc0, 0xa2, 0x2f, "33b2a477d07b5e4b829e0288aeb68ff020c89cf1fd4faced4f0b66a3fff9674257a73ee7fc92141338c2f1dbe144f0"}}) syz_usb_control_io$uac1(r3, 0x0, &(0x7f0000000e00)={0x44, &(0x7f00000004c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r2, &(0x7f00000007c0)={&(0x7f0000000280)=@abs={0x0, 0x0, 0x6}, 0x6e, &(0x7f0000000600)=[{&(0x7f0000000400)="a016e817", 0x4}], 0x1, &(0x7f0000000780)=[@cred={{0x1c}}], 0x20, 0x80}, 0x0) (async) sendmsg$unix(r2, &(0x7f00000007c0)={&(0x7f0000000280)=@abs={0x0, 0x0, 0x6}, 0x6e, &(0x7f0000000600)=[{&(0x7f0000000400)="a016e817", 0x4}], 0x1, &(0x7f0000000780)=[@cred={{0x1c}}], 0x20, 0x80}, 0x0) close_range(r1, r1, 0x0) (async) close_range(r1, r1, 0x0) 380.981949ms ago: executing program 1 (id=392): r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x7fffffff, 0x101000) r1 = openat$cgroup_ro(r0, 0x0, 0x300, 0x0) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 64) write$binfmt_misc(r1, 0x0, 0x3b) (async, rerun: 64) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/binder1\x00', 0x1002, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, 0x0) (async) r3 = socket$can_raw(0x1d, 0x3, 0x1) (async, rerun: 32) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) (rerun: 32) setsockopt$bt_l2cap_L2CAP_OPTIONS(r4, 0x6, 0x1, &(0x7f0000000140)={0x9, 0x6fc, 0x220, 0x8, 0xc, 0x80, 0x29bd}, 0xc) (async) getsockopt$bt_l2cap_L2CAP_OPTIONS(r4, 0x6, 0x1, 0x0, &(0x7f0000000540)) (async) setsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x8, 0x0, 0x0) (async, rerun: 64) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x129c0, 0x0) (async, rerun: 64) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip6_tables_targets\x00') preadv(r6, &(0x7f0000000100)=[{&(0x7f0000000200)=""/235, 0x14f}], 0x1, 0xfff, 0xfffffffe) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r8 = dup(r7) getsockopt$inet_int(r8, 0x0, 0xe, 0x0, &(0x7f0000000400)=0xfffffe6f) (async) ioctl$TCXONC(r5, 0x540a, 0x0) (async) close_range(r2, 0xffffffffffffffff, 0x0) (async, rerun: 64) ioctl$KDGETLED(r5, 0x4b31, &(0x7f0000000040)) (async, rerun: 64) r9 = getpid() syz_pidfd_open(r9, 0x0) r10 = gettid() r11 = getpid() rt_tgsigqueueinfo(r11, r10, 0x5, &(0x7f0000000280)={0x0, 0xa4, 0x6}) r12 = fsopen(&(0x7f00000000c0)='vfat\x00', 0x0) kcmp(r9, r10, 0x1, r7, r12) 365.8132ms ago: executing program 1 (id=393): openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x981b00, 0x0) (async) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x981b00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f00000004c0)=[@text64={0x40, 0x0}], 0x1, 0xdf, 0x0, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xc) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 263.167069ms ago: executing program 1 (id=394): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000001c0)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000050000005800018044000400200001000a000002000000000000000000000000000000000000000100000000200002000a00000000000000fe8000000000faffffff000000000038008000000d0001007564703a7379"], 0x6c}, 0x1, 0x4000000000000000}, 0x0) 259.939069ms ago: executing program 3 (id=395): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000001c0)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000030000005800018044000400200001000a0000020000000000fc000000000000000000000000000100000000200002000a00000000000000fe8000000000faffffff000000000038008000000d0001007564703a7379"], 0x6c}}, 0x0) 259.224659ms ago: executing program 1 (id=396): r0 = socket(0x1000000000000010, 0x80802, 0x0) sendmsg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="5500000018007fd500fe01b2a4a280930a06000000a843209100fe800c00080008000c00080000002d000f009b2c136ef75afb83de448daa72540d8102d2c55327c43ab82286ef1fdd20642383656d4d2449155037", 0x55}], 0x1}, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x2a) r3 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000b, 0x12, r3, 0x0) getsockname$packet(r3, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000001200)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2405000005000000000000000c240000e9fffff5ffffffff092403f3", @ANYRES8=r2, @ANYRES64=r1], 0x0) io_submit(0x0, 0x1, &(0x7f00000000c0)=[&(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0xfffc, r0, &(0x7f0000000000)="dc8f0c3b527d8e058a3246d53b629712bc9c1874f65dd8cc5a439c814ca68a771e3af7d736760865dd5f4d8ed0ea31c51fb86944d9d9cdac4eadf10ab707da164d0e4f261c41b473699d461107bb0d43a4da3b67e4313c72822d43060f", 0x5d, 0x4, 0x0, 0x0, r2}]) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r0, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x14, 0x0, 0x400, 0x70bd2a, 0x25dfdbfd}, 0x14}}, 0x20000040) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0x0, 0xffffffff}) r4 = openat$rtc(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH(r4, 0x7005, 0x0) mount$binderfs(0x0, &(0x7f0000000380)='./binderfs2\x00', 0x0, 0x2000063, &(0x7f0000000340)={[], [{@smackfsroot={'smackfsroot', 0x3d, '^'}}]}) 256.032829ms ago: executing program 3 (id=397): r0 = socket$inet_udp(0x2, 0x2, 0x0) accept$inet(r0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) (async) ioctl$KVM_SET_XSAVE(0xffffffffffffffff, 0x5000aea5, &(0x7f0000000100)={[0x7, 0xa, 0x9, 0x40d6, 0xfe5b, 0x4, 0x6, 0x800, 0x10001, 0x6, 0x401, 0x9, 0x434f99e5, 0x0, 0xfffffffd, 0x2, 0x5, 0x86d7, 0xa, 0x3ff, 0x6, 0x1000, 0x7, 0x3, 0x1, 0x8, 0x7, 0x8, 0x2, 0x5, 0x7, 0x1, 0x6, 0x7, 0x6, 0x1, 0x7, 0xd27e, 0x80, 0xff, 0x6, 0x7ff, 0x1, 0x8, 0x0, 0x1, 0x400, 0x96, 0x8, 0x5f34, 0x10000, 0x80, 0x2, 0x7fffffff, 0x9, 0x3, 0x37, 0xfffffff9, 0x9, 0x8, 0x6, 0xfffffff9, 0xfffffffb, 0xaba1, 0xd, 0xfffffff3, 0x3, 0x85a0, 0x5, 0xa8, 0x1000, 0xfffffffb, 0x7, 0x800, 0x8000, 0x2, 0x4, 0x1, 0x9, 0x9, 0x3, 0x0, 0x0, 0x7, 0x8000, 0x7, 0x2, 0xc, 0x190c, 0x6, 0xa, 0x1, 0x4, 0x9, 0x9a, 0x3, 0x100, 0xfa, 0x7, 0xe5eb, 0x5, 0x8, 0x2, 0x4, 0x0, 0x9, 0xffff7fff, 0x7, 0x7, 0xffff5988, 0x4, 0xfffffff7, 0x98, 0x3782, 0x9, 0x4, 0x5, 0x5, 0x3, 0x2, 0x7ff, 0x1000, 0x2, 0x2, 0x8, 0xfffffffe, 0x6, 0x9, 0x40, 0x7, 0x7, 0x1, 0x8, 0x0, 0x8001, 0x1, 0x200, 0x3b4, 0x10, 0x6, 0xd2f3, 0x3, 0xe46, 0x6, 0x9, 0x101, 0x4606, 0x9968, 0x9, 0x6, 0x5, 0x400, 0x4, 0x3, 0x4, 0x2, 0x1, 0x4, 0x2, 0x8, 0x7, 0x7, 0x6, 0x2, 0x4, 0x0, 0x51f8c8fa, 0x8, 0x1ff, 0x1, 0x2, 0x81, 0x2f8, 0x0, 0xfffffe00, 0xd, 0x6, 0x7, 0x7, 0x2, 0x4, 0x4, 0x5, 0x9, 0xfffffc01, 0x7, 0x6, 0x8, 0x401, 0x1, 0x9, 0x1000, 0x3, 0x7, 0x3, 0x8001, 0x2, 0x8, 0x88, 0x8001, 0xffff, 0x7, 0x97d, 0x8, 0x461, 0x7, 0x80000000, 0x6, 0x5, 0x1, 0x0, 0x7, 0x3, 0x1, 0x2, 0x7, 0x2, 0x6, 0x7, 0x12000000, 0x400, 0x40, 0x1, 0x7, 0x7, 0xfffffffc, 0xa110, 0x4, 0x10001, 0x4, 0x8d, 0x9, 0x8000, 0x8, 0x3, 0xd2, 0x9, 0x5, 0x0, 0x4, 0x6, 0x7, 0x9, 0x818, 0x5, 0x7, 0x4, 0x4, 0x10001, 0x1, 0x1, 0x6, 0x4, 0x3, 0x79f7, 0x9, 0x28, 0x2, 0x8, 0x401, 0xe4, 0x6, 0x133, 0xc, 0x80000000, 0x9, 0x4, 0x7, 0x9, 0x4, 0x4, 0xd, 0x20000000, 0x0, 0xc1a, 0x2, 0x9, 0x7, 0xfff, 0x2, 0x5, 0x93, 0xc32, 0x80000000, 0x6, 0x9, 0xfffffffa, 0x8, 0x8, 0x8, 0x6, 0x9a, 0xb0c4, 0x40, 0x0, 0x8, 0x3, 0x3, 0x170, 0x80000000, 0x9, 0x7fffffff, 0x5, 0x1000, 0x8, 0xff, 0x6, 0x2, 0xfef2, 0x7, 0xdd, 0xe, 0xe000, 0x2, 0x8, 0x3, 0x0, 0x7fffffff, 0x6884, 0x1ff, 0x400, 0x6, 0x2, 0x8000, 0x6, 0x5, 0x6, 0x800, 0xfffffff9, 0x8, 0x3, 0x8001, 0x80000000, 0xfffffff8, 0x3, 0x8, 0xfffffffc, 0x5, 0x2, 0x4, 0x1, 0x180, 0x3, 0x6, 0x4, 0x1, 0x80000000, 0x58, 0x200, 0x3, 0x7, 0x4, 0x8, 0x3, 0x1, 0x5, 0x3, 0xf17, 0x6, 0x2, 0x223f049, 0x5, 0x10, 0xbd16, 0x7, 0x6, 0x200, 0x3, 0x5, 0x8, 0x7, 0x9, 0xd, 0x6, 0x4, 0x839, 0x2e1a, 0x101, 0x1f, 0x6, 0x8, 0x3, 0x8919, 0x7, 0x7, 0x8, 0x6, 0x101, 0x401, 0x400, 0x26, 0x2, 0x781, 0x2, 0x2, 0x7, 0x1, 0x51ca, 0xa25, 0x1, 0xc, 0x0, 0x636, 0xfffffff7, 0x2, 0x4000000, 0xc631, 0x85ef, 0x5, 0x9, 0x0, 0xd8d, 0x96ef, 0xf, 0x7ff, 0x3, 0x2, 0x4, 0x0, 0xffffffbe, 0x59, 0xffffffff, 0x6, 0x1, 0xe6b, 0x5, 0xa, 0x9, 0x0, 0xd36, 0x6, 0xffff, 0xff, 0x9, 0x485a, 0x80, 0x8, 0x5, 0x6, 0x10000, 0xc764, 0x401, 0xfffffff2, 0x4, 0x401, 0x3, 0x10000, 0x9, 0x8, 0x1, 0x6, 0x9, 0x3, 0x2, 0x101, 0x7, 0x3, 0x7, 0x7, 0x4, 0x8, 0x80, 0x5, 0x1, 0x3, 0x9, 0xffffffc0, 0x9, 0xffffffff, 0x0, 0x6, 0x6, 0x8, 0xee, 0xe52, 0xfffffff9, 0xc, 0x1, 0x1, 0x0, 0x6, 0x2, 0x10, 0x40, 0x7, 0xfffffffb, 0x9, 0x0, 0x2, 0x7, 0x1ff, 0xfffffeff, 0x7f, 0xc, 0xa, 0x3ff, 0xa, 0x2, 0x5, 0x4, 0x3, 0x5, 0x1, 0x7, 0x5, 0x8062, 0x1, 0x3, 0x10, 0xe, 0x8001, 0x5, 0x401, 0xa, 0xfffffff9, 0x8, 0x3, 0x0, 0x80000001, 0x7, 0xd4, 0xf, 0x2, 0xcb, 0x401, 0x10, 0x2, 0x259, 0x7fff, 0x3, 0x68, 0x8, 0x8000, 0x2, 0x9, 0x5dbd2e38, 0xdbb, 0x7, 0x204, 0xbe7, 0x1, 0x9, 0x401, 0x5, 0x4, 0x9, 0x200, 0x0, 0x1216, 0x5, 0x9b, 0xfffffffc, 0x7f, 0x1, 0xffffffff, 0x2, 0x0, 0x400, 0xf1c, 0xd2f, 0x2, 0x10000, 0xb, 0x4, 0x4, 0x7, 0x8, 0x1, 0xfff, 0xf, 0x9, 0x80000000, 0x5, 0x5f, 0x7, 0x8000, 0x800, 0x4, 0xfffffffb, 0xaa3d, 0x4, 0x99, 0x6, 0x1, 0x3, 0x59, 0x8, 0x4e, 0x1, 0x2, 0xffff, 0xfffffffb, 0x31, 0xd0, 0x2d, 0x8001, 0x1, 0x11a, 0x34, 0x4, 0xffffffff, 0x3, 0x0, 0x5ef, 0x7, 0x6, 0x5, 0x7fffffff, 0x5, 0x8, 0x8000, 0x100, 0x0, 0x3, 0x5, 0x800, 0xfffffff9, 0x7, 0x2, 0x334d, 0x38e640, 0x1, 0x100, 0x1, 0xfffffffe, 0x1000, 0x9, 0x102308ed, 0x8, 0x4, 0x9, 0x9, 0x2, 0x4, 0x1, 0x708, 0x1c0, 0xd, 0x2, 0x3, 0x80, 0x298b, 0x2, 0x9, 0x7, 0x8, 0xfffffe00, 0x1ff, 0x7, 0x0, 0xed, 0x9, 0x4, 0x5, 0xfffffffd, 0x3, 0xe, 0x80000001, 0x2, 0x1ff, 0x9, 0x2, 0x7, 0x8, 0x1, 0x8, 0x264, 0x10000, 0x8, 0x4, 0x7, 0x8, 0x6, 0x1000, 0x2, 0x4, 0x9, 0x80, 0x7, 0x6, 0x5, 0x81, 0x47, 0x7e, 0x7, 0x3, 0x2, 0x1, 0x5, 0x9, 0x0, 0x9, 0x1, 0x3, 0x1, 0xffffff00, 0x8, 0x2e, 0x3, 0x1, 0x80000001, 0xa45, 0x4, 0x8001, 0x0, 0x250, 0xfff, 0x2a7c, 0xffffffff, 0xc, 0x51b1070d, 0xfffffffd, 0xfff, 0x477b, 0x1ff, 0xffffbfdb, 0x9, 0x0, 0x5, 0xab68, 0x9, 0x8001, 0x40, 0x4, 0x1526, 0x10001, 0x2, 0x1, 0x4, 0x1000, 0x40, 0x1, 0x7fffffff, 0x3, 0x3, 0x1, 0x6, 0xc, 0xca, 0xb6, 0x80000000, 0x5, 0x9, 0xd, 0xc, 0x8bb, 0x8, 0x2, 0x10001, 0x3, 0x9, 0x3, 0x9, 0x4, 0x9, 0xccde, 0xfffffff9, 0x800, 0x4, 0x7, 0x3ff, 0x8000000, 0x3, 0x4, 0x6, 0x0, 0x80000001, 0xff, 0x7, 0x5, 0x2, 0x9, 0x5, 0x2, 0x20000, 0xe, 0x8001, 0xfffffffb, 0x4, 0x1d18, 0x8, 0x7, 0x5, 0x5, 0x5, 0xf, 0x0, 0x0, 0x9, 0x4, 0x5, 0xff, 0x7, 0x702, 0x1ef, 0x65, 0x3, 0x6, 0x9, 0x9, 0x200, 0x2, 0x5, 0x370, 0xfffffffd, 0x8, 0x100, 0x7, 0x5, 0x100, 0x7, 0x0, 0x4, 0x6, 0x0, 0x7, 0x7, 0x10001, 0x7, 0x8, 0x80000000, 0xb, 0x237a, 0x99, 0x3, 0x800, 0x7, 0x84b8, 0x5, 0x5, 0x85, 0x6, 0xfff, 0x2, 0xd0, 0xfffffffd, 0x5, 0x5, 0x9, 0x5, 0x1, 0x6, 0x10000, 0x7ff, 0x9, 0x9, 0x5, 0x4, 0x4, 0x5, 0x2, 0xfffffffd, 0x2, 0xea2, 0x7ff, 0x6, 0x2, 0x0, 0x80000001, 0x2, 0x2, 0xaf, 0x9, 0x4, 0x8, 0x5af6, 0x22df4e, 0x8, 0x2, 0xe8, 0xe, 0x6, 0x8, 0x3ff, 0xd, 0x0, 0x3, 0x4, 0xf, 0x3, 0x9, 0x738101a9, 0x9, 0xa3, 0x6, 0x71d, 0x766a, 0xfffffffd, 0x7fffffff, 0x401, 0x5, 0x90, 0x5, 0x9, 0xffffffff, 0x2, 0x1, 0x7, 0x7, 0x1, 0x7, 0x9, 0x4, 0x5c, 0x3, 0x6, 0x166cba4, 0x200, 0x3b8a85c1, 0x10, 0x5, 0x3, 0x80000001, 0xfffffff9, 0x7, 0x98e, 0x9, 0x30, 0x759, 0x8, 0x45, 0x200, 0x1, 0x9, 0x8, 0x9, 0x200, 0x721ca50d, 0x3, 0x0, 0xc, 0x4, 0xffffffff, 0x2, 0xffffffff, 0x80, 0x5, 0xfffffe00, 0x4c3, 0x3, 0x6, 0xfffffff7, 0x4, 0xfffffffa, 0x200, 0x5, 0xd, 0xb7, 0x3800, 0x7, 0x5, 0x4, 0xbf, 0x3, 0x9, 0x10000, 0xb, 0x7a, 0x7, 0x2, 0x342b, 0x4, 0x400, 0x401, 0x5, 0x0, 0x4, 0x3, 0x1, 0x6, 0x20de988b, 0x7ff, 0x8, 0x5, 0x6, 0x7, 0x5, 0x7fffffff, 0xaf, 0x2, 0xfffffffc, 0x3, 0x6, 0xa, 0x6db, 0x10000, 0x4, 0x8, 0x3, 0x401, 0xffff8001, 0xfff, 0x6, 0xfffffffd, 0x300000, 0x8, 0x5, 0x6, 0x1000, 0x6, 0x5, 0x9, 0xfff, 0x1, 0x3, 0x80000000, 0x3, 0x9, 0x5, 0x10000, 0x0, 0x5, 0x10001, 0x9, 0x8000, 0xffff, 0x2, 0x2, 0x77a, 0x8, 0x4, 0xf, 0x2, 0x2]}) (async) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_opts(r3, 0x29, 0x40, &(0x7f00000001c0)=ANY=[], 0xd0060) (async) read(r2, &(0x7f00000007c0)=""/231, 0xe7) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_MPP(r2, &(0x7f00000014c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x28, r4, 0x10, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x0, 0x24}}}}}, 0x28}, 0x1, 0x0, 0x0, 0xc0}, 0x20000000) (async) r6 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r7 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x0, 0x0) getdents64(r7, &(0x7f0000000040)=""/40, 0x28) (async) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.numa_stat\x00', 0x275a, 0x0) write$tun(r8, &(0x7f0000000000)=ANY=[], 0x38) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x10012, r8, 0x0) lsm_list_modules(0x0, &(0x7f0000000040), 0x0) (async) copy_file_range(r6, 0x0, 0xffffffffffffffff, 0x0, 0x9, 0x0) (async) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1002, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r6, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="700000000102010100000000100000009b0000010800094000000000440003801400018008000100ac1414aa08000200ac1414bb0c000280050801001100000014000180080001000000000008000200ffffffff0c000280050001002f00000006004740000300000800084000000003"], 0x70}, 0x1, 0x0, 0x0, 0x20000000}, 0x4001) (async) close_range(r9, 0xffffffffffffffff, 0x0) (async) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f00000001c0)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000100)={@ptr={0x70742a85, 0x0, &(0x7f0000000440)=""/4096, 0x1000, 0x1, 0x34}, @fda={0x66646185, 0x6, 0x1, 0x24}, @fda={0x66646185, 0x5, 0x2, 0x3a}}, &(0x7f0000000180)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0}) 243.736411ms ago: executing program 3 (id=398): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000180)={'lo\x00', {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x2d}}}) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, &(0x7f0000001040)={'lo\x00', {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}) r4 = socket$can_raw(0x1d, 0x3, 0x1) mkdirat(0xffffffffffffff9c, 0x0, 0x0) setsockopt$CAN_RAW_FILTER(r4, 0x65, 0x1, &(0x7f0000000300)=[{{0x1, 0x1}, {0x4, 0x0, 0x0, 0x1}}, {{0x2}}], 0x10) bind$can_raw(r4, &(0x7f00000003c0), 0x10) bind$can_raw(r4, &(0x7f0000000400)={0x1d, r2}, 0x10) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000001c0)=[@text64={0x40, 0x0}], 0x1, 0x5b, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 225.300002ms ago: executing program 3 (id=399): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') write$cgroup_pid(r1, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)=0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) mlock(&(0x7f0000ffc000/0x4000)=nil, 0x4000) timer_create(0x7, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)=0x0) timerfd_settime(r1, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x3938700}}, &(0x7f0000000040)) timer_settime(r3, 0x0, &(0x7f0000000340)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) unshare(0x44040200) timer_gettime(r2, &(0x7f0000002180)) sendfile(r0, r0, 0x0, 0x7ffff000) 35.122697ms ago: executing program 3 (id=400): munmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000) mlock2(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1) mount$binderfs(0x0, &(0x7f0000000280)='./binderfs\x00', 0x0, 0x2000063, &(0x7f0000000400)={[], [{@flag='dirsync'}]}) r0 = socket$inet_udp(0x2, 0x2, 0x0) signalfd(r0, &(0x7f0000000080), 0x8) r1 = ioctl$UDMABUF_CREATE_LIST(0xffffffffffffffff, 0x40087543, &(0x7f00000000c0)) r2 = socket(0x11, 0x2, 0x0) setsockopt(r2, 0x107, 0x1, &(0x7f00000001c0)="110000000200060000071a806d8be255", 0x10) setsockopt(r2, 0x107, 0x2, &(0x7f00000001c0)="fcff00000100060000071a80010061cc", 0x10) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000040)) 34.263607ms ago: executing program 3 (id=401): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) (async) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_WPAN_PHY(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r4, 0x1, 0x70bd2c, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x40) (async) sendmsg$NL802154_CMD_GET_WPAN_PHY(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r4, 0x1, 0x70bd2c, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x40) r5 = memfd_secret(0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r5, 0x0) ftruncate(r5, 0x51a9497) (async) ftruncate(r5, 0x51a9497) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) vmsplice(r6, &(0x7f0000000140)=[{&(0x7f0000000100)="eb", 0x20000101}], 0x1, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async) r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) (async) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r7, r8, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000080)="67400f07c40249af4b8bb9800000c00f3235010200000f300f20a366450f769e00000100440f20c03588001d00445b66baf80cb88cf4b684ef66bafc0ced460f01c9c4827d24c366ba4cf0ff07ef87f345a57a43e16806a4", 0x58}], 0x1, 0x7c, 0x0, 0x0) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000100), r3) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r3, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x18003004}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x20, r9, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x50}, 0x404c801) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r8, 0x4138ae84, &(0x7f00000001c0)={{0x80a0000, 0xeeee0000, 0x8, 0x9, 0xfb, 0xd2, 0x40, 0xca, 0x0, 0x2e, 0x19}, {0x5000, 0xeeee8000, 0x3, 0x0, 0x40, 0x5, 0x7d, 0x6, 0x5, 0x3, 0x3, 0xb5}, {0xeeef0000, 0xdddd0000, 0xe, 0x5, 0x1, 0x7, 0x0, 0x9, 0x1, 0xa7, 0x5, 0x81}, {0x6000, 0x100000, 0xa, 0x6, 0x4, 0x42, 0xb, 0xf8, 0xb, 0x7, 0xe, 0xf1}, {0xeeee0000, 0xd000, 0x3, 0x3, 0x15, 0x6, 0xab, 0x7f, 0x3, 0x83, 0xf7, 0x83}, {0x1000, 0x80a0000, 0xc, 0xa0, 0xb1, 0x8, 0x1, 0xa0, 0x80, 0xf, 0x1, 0x7}, {0x3000, 0x8000000, 0x4, 0x5, 0x7, 0x5, 0x7, 0x3, 0x5, 0x81, 0x1, 0x70}, {0x100000, 0x1000, 0xe, 0x5, 0xf, 0x7, 0x1, 0x34, 0x2, 0xc, 0xb0, 0x9}, {0xeeef0000, 0x30}, {0x10000, 0x7}, 0x80000031, 0x0, 0x8000000, 0x2024, 0x3, 0x0, 0x3000, [0x6800000000000000, 0x4, 0x5e, 0xff]}) close_range(r0, 0xffffffffffffffff, 0x0) (async) close_range(r0, 0xffffffffffffffff, 0x0) 0s ago: executing program 0 (id=402): timer_create(0x0, 0x0, &(0x7f0000000140)=0x0) timer_gettime(r0, 0x0) (async) r1 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) (async) getgroups(0x2, &(0x7f0000001080)=[0xee01, 0xffffffffffffffff]) (async) r4 = socket$netlink(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r4, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) (async) sendmsg$netlink(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)={0x1c, 0x1e, 0x101, 0x0, 0x0, "", [@nested={0xc, 0x12, 0x0, 0x1, [@typed={0x8, 0xd2, 0x0, 0x0, @pid}]}]}, 0x1c}], 0x1}, 0x0) (async) keyctl$chown(0x4, r1, 0xee01, r3) keyctl$setperm(0x5, r1, 0x30925) keyctl$KEYCTL_MOVE(0x3, r1, 0x0, 0x0, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) stat(&(0x7f0000000180)='./cgroup\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) stat(&(0x7f0000000240)='./cgroup\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0xa, &(0x7f0000000280)=[0xffffffffffffffff, r3, r6, r2, r2, r2, r2, r2, r2, r7]) (async) getsockopt$packet_int(r5, 0x107, 0x18, 0x0, &(0x7f0000000040)) mount(&(0x7f0000000000)=@sg0, &(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0)='sysv\x00', 0x2308008, 0x0) r8 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x800000000004, @tid=r8}, &(0x7f0000bbdffc)=0x0) timer_settime(r9, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) (async) clock_getres(0x4, &(0x7f0000000300)) r10 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_RTHDR(r10, 0x29, 0x39, &(0x7f00000011c0)=ANY=[@ANYRESOCT=r8], 0x28) (async) eventfd2(0x4, 0x0) personality(0x5400004) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) (async) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) (async) timer_gettime(0x0, &(0x7f0000000080)) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000008380)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, 0x0) (async) signalfd(0xffffffffffffffff, 0x0, 0x0) socket(0x2, 0x2, 0x1) kernel console output (not intermixed with test programs): cess permissive=1 [ 17.002623][ T36] audit: type=1400 audit(1756446625.370:63): avc: denied { siginh } for pid=231 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.79' (ED25519) to the list of known hosts. [ 24.542768][ T36] audit: type=1400 audit(1756446632.930:64): avc: denied { mounton } for pid=281 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.543868][ T281] cgroup: Unknown subsys name 'net' [ 24.566977][ T36] audit: type=1400 audit(1756446632.930:65): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.596314][ T36] audit: type=1400 audit(1756446632.960:66): avc: denied { unmount } for pid=281 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.596562][ T281] cgroup: Unknown subsys name 'devices' [ 24.741154][ T281] cgroup: Unknown subsys name 'hugetlb' [ 24.747007][ T281] cgroup: Unknown subsys name 'rlimit' [ 24.900617][ T36] audit: type=1400 audit(1756446633.290:67): avc: denied { setattr } for pid=281 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.925071][ T36] audit: type=1400 audit(1756446633.290:68): avc: denied { mounton } for pid=281 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 24.933461][ T283] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 24.951700][ T36] audit: type=1400 audit(1756446633.290:69): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 24.984477][ T36] audit: type=1400 audit(1756446633.350:70): avc: denied { relabelto } for pid=283 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.012976][ T36] audit: type=1400 audit(1756446633.350:71): avc: denied { write } for pid=283 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.019911][ T281] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.039209][ T36] audit: type=1400 audit(1756446633.410:72): avc: denied { read } for pid=281 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.074008][ T36] audit: type=1400 audit(1756446633.410:73): avc: denied { open } for pid=281 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.411367][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.419127][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.426905][ T288] bridge_slave_0: entered allmulticast mode [ 26.433673][ T288] bridge_slave_0: entered promiscuous mode [ 26.461747][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.468934][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.476575][ T288] bridge_slave_1: entered allmulticast mode [ 26.483606][ T288] bridge_slave_1: entered promiscuous mode [ 26.534539][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.541970][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.549556][ T289] bridge_slave_0: entered allmulticast mode [ 26.556599][ T289] bridge_slave_0: entered promiscuous mode [ 26.563041][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.570215][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.577666][ T290] bridge_slave_0: entered allmulticast mode [ 26.584265][ T290] bridge_slave_0: entered promiscuous mode [ 26.590908][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.598642][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.605828][ T290] bridge_slave_1: entered allmulticast mode [ 26.612357][ T290] bridge_slave_1: entered promiscuous mode [ 26.624552][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.631988][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.639359][ T289] bridge_slave_1: entered allmulticast mode [ 26.645600][ T289] bridge_slave_1: entered promiscuous mode [ 26.717311][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.724758][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.732368][ T291] bridge_slave_0: entered allmulticast mode [ 26.738832][ T291] bridge_slave_0: entered promiscuous mode [ 26.745580][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.753101][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.760257][ T291] bridge_slave_1: entered allmulticast mode [ 26.766930][ T291] bridge_slave_1: entered promiscuous mode [ 26.895297][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.902572][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.911478][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.919209][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.944427][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.951748][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.959770][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.967326][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.982809][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.998997][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.006689][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.014265][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.026262][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.033946][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.041689][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.049435][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.100821][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.109126][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.117269][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.125033][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.132754][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.140591][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.148440][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.156080][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.170693][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.177857][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.185788][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.193573][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.217084][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.224370][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.233269][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.240805][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.249100][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.256423][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.290511][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.297878][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.306666][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.313893][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.322324][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.329867][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.350334][ T289] veth0_vlan: entered promiscuous mode [ 27.372566][ T291] veth0_vlan: entered promiscuous mode [ 27.401391][ T291] veth1_macvtap: entered promiscuous mode [ 27.410063][ T288] veth0_vlan: entered promiscuous mode [ 27.417644][ T289] veth1_macvtap: entered promiscuous mode [ 27.436228][ T290] veth0_vlan: entered promiscuous mode [ 27.460935][ T288] veth1_macvtap: entered promiscuous mode [ 27.472373][ T291] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 27.501108][ T290] veth1_macvtap: entered promiscuous mode [ 27.538060][ T331] tipc: Started in network mode [ 27.548757][ T331] tipc: Node identity 40000000000000000000000000000001, cluster identity 4711 [ 27.558489][ T331] tipc: Enabling of bearer rejected, failed to enable media [ 27.578640][ T336] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 27.642117][ T343] capability: warning: `syz.1.2' uses deprecated v2 capabilities in a way that may be insecure [ 27.687750][ T352] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8'. [ 27.744293][ T360] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=360 comm=syz.1.11 [ 27.754300][ T352] rust_binder: 4: no such ref 0 [ 27.764474][ T352] rust_binder: 4: no such ref 0 [ 27.786762][ T365] rust_binder: 357 RLIMIT_NICE not set [ 27.805332][ T63] rust_binder: 356: removing orphan mapping 0:24 [ 27.824825][ T369] tipc: Started in network mode [ 27.830257][ T369] tipc: Node identity e0000000000000000000000000000001, cluster identity 4711 [ 27.840710][ T369] tipc: Enabling of bearer rejected, failed to enable media [ 27.990348][ T370] rust_binder: Error in use_page_slow: ESRCH [ 27.990368][ T370] rust_binder: use_range failure ESRCH [ 28.010889][ T370] rust_binder: Failed to allocate buffer. len:24, is_oneway:false [ 28.016517][ T370] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 28.029185][ T394] fuse: Bad value for 'fd' [ 28.035850][ T370] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:11 [ 28.166877][ T403] loop7: detected capacity change from 0 to 7 [ 28.233453][ T50] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 28.244379][ T50] Buffer I/O error on dev loop7, logical block 0, async page read [ 28.255240][ T403] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 28.265606][ T403] Buffer I/O error on dev loop7, logical block 0, async page read [ 28.274412][ T403] loop7: unable to read partition table [ 28.280860][ T403] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 28.374921][ T408] tipc: Started in network mode [ 28.383665][ T408] tipc: Node identity fc000000000000000000000000000001, cluster identity 4711 [ 28.397923][ T408] tipc: Enabling of bearer rejected, failed to enable media [ 28.527156][ T421] netlink: 4 bytes leftover after parsing attributes in process `syz.1.26'. [ 28.578195][ T424] rust_binder: Failed to allocate buffer. len:4240, is_oneway:true [ 28.578228][ T424] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 28.586431][ T424] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:27 [ 28.618396][ T433] binder: Bad value for 'stats' [ 28.776329][ T438] pim6reg1: entered promiscuous mode [ 28.781866][ T438] pim6reg1: entered allmulticast mode [ 28.797077][ T439] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.807343][ T439] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.880288][ T445] tipc: Enabling of bearer rejected, failed to enable media [ 28.969118][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 29.119069][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 29.125613][ T9] usb 2-1: config 0 has an invalid interface number: 200 but max is 0 [ 29.134426][ T9] usb 2-1: config 0 has no interface number 0 [ 29.140633][ T9] usb 2-1: config 0 interface 200 has no altsetting 0 [ 29.149632][ T9] usb 2-1: New USB device found, idVendor=0b57, idProduct=8528, bcdDevice=6d.39 [ 29.158717][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.167071][ T9] usb 2-1: Product: syz [ 29.171319][ T9] usb 2-1: Manufacturer: syz [ 29.176186][ T9] usb 2-1: SerialNumber: syz [ 29.181839][ T9] usb 2-1: config 0 descriptor?? [ 29.443553][ T9] input: Hanwang Art Master III 0906 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.200/input/input4 [ 29.456265][ T455] mmap: syz.0.35 (455) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 29.457562][ T9] usb 2-1: USB disconnect, device number 2 [ 29.509800][ T46] Bluetooth: hci0: Frame reassembly failed (-84) [ 29.565414][ T36] kauditd_printk_skb: 114 callbacks suppressed [ 29.565427][ T36] audit: type=1400 audit(1756446637.950:188): avc: denied { unmount } for pid=291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 29.653466][ T471] Zero length message leads to an empty skb [ 29.959078][ T63] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 30.130234][ T63] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 30.141406][ T63] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.153003][ T63] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.163033][ T63] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 30.177077][ T63] usb 1-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 30.186277][ T63] usb 1-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 30.194439][ T63] usb 1-1: Manufacturer: syz [ 30.199855][ T63] usb 1-1: config 0 descriptor?? [ 30.217771][ T36] audit: type=1326 audit(1756446638.600:189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=478 comm="syz.3.42" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9434f8ebe9 code=0x50000 [ 30.241955][ T36] audit: type=1326 audit(1756446638.600:190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=478 comm="syz.3.42" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9434f8ebe9 code=0x50000 [ 30.249402][ T45] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 30.265590][ T36] audit: type=1326 audit(1756446638.600:191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=478 comm="syz.3.42" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9434f8ebe9 code=0x50000 [ 30.296482][ T36] audit: type=1326 audit(1756446638.600:192): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=478 comm="syz.3.42" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9434f8ebe9 code=0x50000 [ 30.320512][ T36] audit: type=1326 audit(1756446638.600:193): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=478 comm="syz.3.42" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9434f8ebe9 code=0x50000 [ 30.343817][ T36] audit: type=1326 audit(1756446638.600:194): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=478 comm="syz.3.42" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9434f8ebe9 code=0x50000 [ 30.367896][ T36] audit: type=1326 audit(1756446638.600:195): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=478 comm="syz.3.42" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9434f8ebe9 code=0x50000 [ 30.393346][ T36] audit: type=1326 audit(1756446638.600:196): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=478 comm="syz.3.42" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9434f8ebe9 code=0x50000 [ 30.417067][ T36] audit: type=1326 audit(1756446638.600:197): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=478 comm="syz.3.42" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9434f8ebe9 code=0x50000 [ 30.449029][ T45] usb 2-1: Using ep0 maxpacket: 32 [ 30.468419][ T45] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.482161][ T45] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.492582][ T45] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 30.502163][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.521407][ T45] usb 2-1: config 0 descriptor?? [ 30.642858][ T63] appleir 0003:05AC:8243.0001: unknown main item tag 0x0 [ 30.650456][ T63] appleir 0003:05AC:8243.0001: No inputs registered, leaving [ 30.659824][ T63] appleir 0003:05AC:8243.0001: hiddev96,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.0-1/input0 [ 30.910244][ T31] usb 1-1: USB disconnect, device number 2 [ 30.950328][ T496] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 4256, size: 18446744073709551438) [ 30.950359][ T496] rust_binder: Error while translating object. [ 30.970699][ T45] usbhid 2-1:0.0: can't add hid device: -71 [ 30.979022][ T496] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 30.983190][ T496] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:43 [ 30.996084][ T499] tipc: Enabling of bearer rejected, failed to enable media [ 30.996417][ T45] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 31.027326][ T45] usb 2-1: USB disconnect, device number 3 [ 31.062564][ T504] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 31.098938][ T511] SELinux: policydb version 372945694 does not match my version range 15-33 [ 31.112158][ T511] SELinux: failed to load policy [ 31.269171][ T523] /dev/rnullb0: Can't open blockdev [ 31.286900][ T526] tipc: Enabling of bearer rejected, failed to enable media [ 31.398148][ T556] rust_binder: Got transaction with invalid offset. [ 31.398244][ T556] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 31.405490][ T556] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:87 [ 31.509005][ T461] Bluetooth: hci0: command 0x1003 tx timeout [ 31.509191][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 31.615262][ T565] netlink: 'syz.1.61': attribute type 25 has an invalid length. [ 31.623568][ T566] netlink: 'syz.1.61': attribute type 25 has an invalid length. [ 31.963604][ T573] overlay: filesystem on ./bus is read-only [ 31.999040][ T45] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 32.015066][ T575] syz.3.65 uses obsolete (PF_INET,SOCK_PACKET) [ 32.022139][ T575] rust_binder: inc_ref_done called when no active inc_refs [ 32.150739][ T45] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 32.169100][ T45] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 129, using maximum allowed: 30 [ 32.180502][ T45] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x18, changing to 0x8 [ 32.192536][ T45] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 32.202637][ T45] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 129 [ 32.218806][ T45] usb 2-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 32.228802][ T45] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.237642][ T45] usb 2-1: Product: syz [ 32.242288][ T45] usb 2-1: Manufacturer: syz [ 32.247249][ T45] usb 2-1: SerialNumber: syz [ 32.259306][ T45] usb 2-1: config 0 descriptor?? [ 32.324007][ T592] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 32.619012][ T465] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 32.789471][ T465] usb 4-1: Using ep0 maxpacket: 8 [ 32.795201][ T465] usb 4-1: no configurations [ 32.800297][ T465] usb 4-1: can't read configurations, error -22 [ 32.939050][ T465] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 33.109118][ T465] usb 4-1: Using ep0 maxpacket: 8 [ 33.119315][ T600] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 33.119353][ T600] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:42 [ 33.129768][ T465] usb 4-1: no configurations [ 33.158420][ T465] usb 4-1: can't read configurations, error -22 [ 33.177389][ T465] usb usb4-port1: attempt power cycle [ 33.539032][ T465] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 33.559826][ T465] usb 4-1: Using ep0 maxpacket: 8 [ 33.565625][ T465] usb 4-1: no configurations [ 33.570893][ T465] usb 4-1: can't read configurations, error -22 [ 33.699505][ T465] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 33.739630][ T465] usb 4-1: Using ep0 maxpacket: 8 [ 33.745793][ T465] usb 4-1: no configurations [ 33.751402][ T465] usb 4-1: can't read configurations, error -22 [ 33.758034][ T465] usb usb4-port1: unable to enumerate USB device [ 34.698319][ T612] rust_binder: 54: no such ref 0 [ 34.774703][ T465] usb 2-1: USB disconnect, device number 4 [ 34.828517][ T36] kauditd_printk_skb: 89 callbacks suppressed [ 34.828538][ T36] audit: type=1400 audit(1756446643.210:287): avc: denied { create } for pid=619 comm="syz.2.81" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 34.863654][ T36] audit: type=1400 audit(1756446643.230:288): avc: denied { getopt } for pid=619 comm="syz.2.81" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 34.900728][ T622] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 34.908165][ T622] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:64 [ 34.908467][ T36] audit: type=1400 audit(1756446643.290:289): avc: denied { write } for pid=621 comm="syz.2.82" name="001" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 34.977775][ T36] audit: type=1400 audit(1756446643.360:290): avc: denied { create } for pid=623 comm="syz.2.83" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 35.001970][ T625] tipc: Enabled bearer , priority 0 [ 35.019017][ T36] audit: type=1400 audit(1756446643.400:291): avc: denied { mount } for pid=623 comm="syz.2.83" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 35.269019][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 35.396589][ T36] audit: type=1400 audit(1756446643.780:292): avc: denied { append } for pid=635 comm="syz.3.86" name="event2" dev="devtmpfs" ino=209 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 35.617276][ T36] audit: type=1400 audit(1756446644.000:293): avc: denied { sqpoll } for pid=653 comm="syz.3.91" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 35.617553][ T654] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 35.647474][ T36] audit: type=1400 audit(1756446644.000:294): avc: denied { remount } for pid=652 comm="syz.1.90" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 35.679982][ T36] audit: type=1400 audit(1756446644.040:295): avc: denied { map } for pid=653 comm="syz.3.91" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=6293 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 35.717174][ T662] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.717205][ T662] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.733301][ T36] audit: type=1400 audit(1756446644.040:296): avc: denied { read write } for pid=653 comm="syz.3.91" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=6293 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 35.812495][ T623] tipc: Resetting bearer [ 35.823777][ T671] futex_wake_op: syz.0.95 tries to shift op by -1; fix this program [ 35.841269][ T623] tipc: Disabling bearer [ 35.898723][ T678] rust_binder: Write failure EFAULT in pid:70 [ 36.089086][ T45] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 36.139041][ T488] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 36.179081][ T465] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 36.250396][ T45] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 36.260894][ T45] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 36.270294][ T488] usb 1-1: device descriptor read/64, error -71 [ 36.277743][ T45] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 36.289007][ T45] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 36.297470][ T45] usb 4-1: SerialNumber: syz [ 36.309064][ T465] usb 3-1: device descriptor read/64, error -71 [ 36.509038][ T488] usb 1-1: device descriptor read/64, error -71 [ 36.511963][ T667] rust_binder: Error while translating object. [ 36.515682][ T667] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 36.516083][ T700] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 36.522252][ T667] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:86 [ 36.532262][ T700] rust_binder: Read failure Err(EFAULT) in pid:147 [ 36.545884][ T45] usb 4-1: 0:2 : does not exist [ 36.549352][ T465] usb 3-1: device descriptor read/64, error -71 [ 36.558523][ T45] usb 4-1: unit 5: unexpected type 0x09 [ 36.575140][ T45] usb 4-1: USB disconnect, device number 7 [ 36.583105][ T463] udevd[463]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 36.749064][ T488] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 36.799080][ T465] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 36.879038][ T488] usb 1-1: device descriptor read/64, error -71 [ 36.929061][ T465] usb 3-1: device descriptor read/64, error -71 [ 37.098161][ T706] netlink: 'syz.3.106': attribute type 1 has an invalid length. [ 37.106930][ T706] binder: Unknown parameter 'stats' [ 37.119028][ T488] usb 1-1: device descriptor read/64, error -71 [ 37.169072][ T465] usb 3-1: device descriptor read/64, error -71 [ 37.229144][ T488] usb usb1-port1: attempt power cycle [ 37.279220][ T465] usb usb3-port1: attempt power cycle [ 37.288310][ T45] rust_binder: 699: removing orphan mapping 0:24 [ 37.298745][ T711] ======================================================= [ 37.298745][ T711] WARNING: The mand mount option has been deprecated and [ 37.298745][ T711] and is ignored by this kernel. Remove the mand [ 37.298745][ T711] option from the mount to silence this warning. [ 37.298745][ T711] ======================================================= [ 37.609051][ T488] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 37.629128][ T465] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 37.630168][ T488] usb 1-1: device descriptor read/8, error -71 [ 37.650325][ T465] usb 3-1: device descriptor read/8, error -71 [ 37.770216][ T488] usb 1-1: device descriptor read/8, error -71 [ 37.780319][ T465] usb 3-1: device descriptor read/8, error -71 [ 38.009103][ T488] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 38.019078][ T465] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 38.030220][ T488] usb 1-1: device descriptor read/8, error -71 [ 38.040211][ T465] usb 3-1: device descriptor read/8, error -71 [ 38.160370][ T488] usb 1-1: device descriptor read/8, error -71 [ 38.170070][ T465] usb 3-1: device descriptor read/8, error -71 [ 38.249605][ T722] binder: Unknown parameter 'smackfshat' [ 38.256479][ T724] binder: Unknown parameter 'smackfshat' [ 38.271578][ T488] usb usb1-port1: unable to enumerate USB device [ 38.279212][ T465] usb usb3-port1: unable to enumerate USB device [ 38.439657][ T733] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -4 [ 38.449042][ T733] platform regulatory.0: Direct firmware load for regulatory.db failed with error -4 [ 38.769054][ T465] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 38.789050][ T63] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 38.861934][ T747] tmpfs: Bad value for 'size' [ 38.867628][ T747] 9pnet_fd: Insufficient options for proto=fd [ 38.929042][ T465] usb 2-1: Using ep0 maxpacket: 16 [ 38.936880][ T465] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 38.948747][ T465] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 38.960884][ T63] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 38.973170][ T63] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 38.987944][ T465] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 38.997882][ T465] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.006466][ T63] usb 4-1: New USB device found, idVendor=056a, idProduct=0061, bcdDevice= 0.00 [ 39.015875][ T465] usb 2-1: Product: 姂秺䊗뉌ᕿ䥍勐喭쾫浃쩅郟昂︩鲻䑄ﴫ茲ᕧ渺꟫悗笥樾勵탡Ɍٰ咰댯䀖뉻暴⛛蘹좤ቔ폀퍩౟疥ٲ춰露ᯨ츎픍챐⺈ [ 39.033685][ T63] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.042123][ T465] usb 2-1: Manufacturer: ӿ [ 39.046949][ T63] usb 4-1: config 0 descriptor?? [ 39.052152][ T465] usb 2-1: SerialNumber: ⿤信愙詂ﲳ೏뀚맩㰅 [ 39.420919][ T443] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 39.468000][ T63] wacom 0003:056A:0061.0002: Unknown device_type for 'HID 056a:0061'. Assuming pen. [ 39.478646][ T465] usb 2-1: 0:2 : does not exist [ 39.484167][ T63] wacom 0003:056A:0061.0002: hidraw0: USB HID v1.01 Device [HID 056a:0061] on usb-dummy_hcd.3-1/input0 [ 39.496758][ T465] usb 2-1: USB disconnect, device number 5 [ 39.504795][ T63] input: Wacom PenStation2 Pen as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:056A:0061.0002/input/input7 [ 39.527067][ T329] udevd[329]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 39.587396][ T443] usb 1-1: unable to get BOS descriptor or descriptor too short [ 39.595644][ T443] usb 1-1: not running at top speed; connect to a high speed hub [ 39.604552][ T443] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 147, changing to 4 [ 39.617390][ T443] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 39.626720][ T443] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.634880][ T443] usb 1-1: Product: syz [ 39.639136][ T443] usb 1-1: Manufacturer: syz [ 39.643822][ T443] usb 1-1: SerialNumber: syz [ 39.656203][ T45] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 39.684146][ T745] fuse: Bad value for 'fd' [ 39.689946][ T465] usb 4-1: USB disconnect, device number 8 [ 39.816503][ T45] usb 3-1: Using ep0 maxpacket: 8 [ 39.822061][ T45] usb 3-1: too many configurations: 126, using maximum allowed: 8 [ 39.831521][ T45] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 39.839356][ T45] usb 3-1: can't read configurations, error -61 [ 39.976884][ T45] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 40.068696][ T772] binder: Bad value for 'max' [ 40.089144][ T36] kauditd_printk_skb: 31 callbacks suppressed [ 40.089163][ T36] audit: type=1326 audit(1756446648.435:328): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=773 comm="syz.1.128" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f999df8ebe9 code=0x0 [ 40.147963][ T45] usb 3-1: Using ep0 maxpacket: 8 [ 40.153670][ T45] usb 3-1: too many configurations: 126, using maximum allowed: 8 [ 40.163002][ T45] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 40.170771][ T45] usb 3-1: can't read configurations, error -61 [ 40.177437][ T45] usb usb3-port1: attempt power cycle [ 40.248368][ T777] netlink: 'syz.3.129': attribute type 12 has an invalid length. [ 40.285816][ T786] rust_binder: Write failure EINVAL in pid:103 [ 40.543691][ T45] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 40.557808][ T338] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 40.586832][ T45] usb 3-1: Using ep0 maxpacket: 8 [ 40.592529][ T45] usb 3-1: too many configurations: 126, using maximum allowed: 8 [ 40.601629][ T45] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 40.609433][ T45] usb 3-1: can't read configurations, error -61 [ 40.716106][ T31] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 40.727737][ T338] usb 4-1: unable to get BOS descriptor or descriptor too short [ 40.736564][ T338] usb 4-1: not running at top speed; connect to a high speed hub [ 40.746633][ T338] usb 4-1: config 1 has an invalid descriptor of length 157, skipping remainder of the config [ 40.757287][ T338] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 40.766450][ T45] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 40.774206][ T338] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 40.790733][ T338] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 40.800202][ T338] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.808748][ T45] usb 3-1: Using ep0 maxpacket: 8 [ 40.813938][ T338] usb 4-1: SerialNumber: syz [ 40.819582][ T45] usb 3-1: too many configurations: 126, using maximum allowed: 8 [ 40.829364][ T45] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 40.837110][ T45] usb 3-1: can't read configurations, error -61 [ 40.843900][ T45] usb usb3-port1: unable to enumerate USB device [ 40.864472][ T31] usb 2-1: device descriptor read/64, error -71 [ 41.045208][ T338] cdc_ncm 4-1:1.0: invalid descriptor buffer length [ 41.052599][ T338] cdc_ncm 4-1:1.0: CDC Union missing and no IAD found [ 41.060967][ T338] cdc_ncm 4-1:1.0: bind() failure [ 41.067326][ T338] usb 4-1: USB disconnect, device number 9 [ 41.121137][ T31] usb 2-1: device descriptor read/64, error -71 [ 41.377773][ T31] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 41.516790][ T31] usb 2-1: device descriptor read/64, error -71 [ 41.595098][ T796] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 41.603504][ T796] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 41.612265][ T796] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 41.620333][ T796] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 41.631712][ T36] audit: type=1400 audit(1756446649.875:329): avc: denied { ioctl } for pid=795 comm="syz.3.135" path="mnt:[4026532377]" dev="nsfs" ino=4026532377 ioctlcmd=0x940a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 41.773438][ T31] usb 2-1: device descriptor read/64, error -71 [ 41.891295][ T31] usb usb2-port1: attempt power cycle [ 42.255635][ T31] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 42.277400][ T31] usb 2-1: device descriptor read/8, error -71 [ 42.392857][ T443] usb 1-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 42.414249][ T443] usb 1-1: USB disconnect, device number 7 [ 42.416374][ T31] usb 2-1: device descriptor read/8, error -71 [ 42.427501][ T463] udevd[463]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 42.568641][ T36] audit: type=1400 audit(1756446650.754:330): avc: denied { connect } for pid=807 comm="syz.0.140" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 42.569572][ T810] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 42.607837][ T812] __vm_enough_memory: pid: 812, comm: syz.2.141, bytes: 18014402804453376 not enough memory for the allocation [ 42.627743][ T36] audit: type=1400 audit(1756446650.810:331): avc: denied { ioctl } for pid=811 comm="syz.2.141" path="socket:[6830]" dev="sockfs" ino=6830 ioctlcmd=0x8901 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 42.628739][ T812] __vm_enough_memory: pid: 812, comm: syz.2.141, bytes: 18014402804453376 not enough memory for the allocation [ 42.665673][ T63] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 42.696152][ T36] audit: type=1400 audit(1756446650.875:332): avc: denied { write } for pid=818 comm="syz.2.143" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 42.715959][ T31] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 42.725840][ T36] audit: type=1400 audit(1756446650.875:333): avc: denied { read } for pid=818 comm="syz.2.143" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 42.746880][ T31] usb 2-1: device descriptor read/8, error -71 [ 42.813507][ T36] audit: type=1400 audit(1756446650.978:334): avc: denied { getopt } for pid=826 comm="syz.2.145" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 42.835297][ T63] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 42.845895][ T63] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 42.855841][ T63] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 42.865468][ T63] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 42.873693][ T63] usb 4-1: SerialNumber: syz [ 42.886740][ T31] usb 2-1: device descriptor read/8, error -71 [ 42.987076][ T830] rust_binder: Error in use_page_slow: ESRCH [ 42.987097][ T830] rust_binder: use_range failure ESRCH [ 42.987622][ T831] rust_binder: Error in use_page_slow: ESRCH [ 42.993214][ T830] rust_binder: Failed to allocate buffer. len:24, is_oneway:false [ 42.999107][ T831] rust_binder: use_range failure ESRCH [ 43.005137][ T31] usb usb2-port1: unable to enumerate USB device [ 43.013271][ T831] rust_binder: Failed to allocate buffer. len:24, is_oneway:false [ 43.018690][ T830] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 43.025100][ T831] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 43.033819][ T830] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:106 [ 43.043197][ T831] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:106 [ 43.097067][ T36] audit: type=1400 audit(1756446651.240:335): avc: denied { create } for pid=803 comm="syz.3.139" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 43.126547][ T36] audit: type=1400 audit(1756446651.240:336): avc: denied { write } for pid=803 comm="syz.3.139" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 43.127773][ T63] usb 4-1: 0:2 : does not exist [ 43.155592][ T63] usb 4-1: USB disconnect, device number 10 [ 43.293044][ T36] audit: type=1326 audit(1756446651.427:337): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=807 comm="syz.0.140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8927d8ebe9 code=0x7fc00000 [ 43.554509][ T839] netlink: 1 bytes leftover after parsing attributes in process `syz.0.149'. [ 43.721274][ T847] incfs: mount failed -22 [ 43.871741][ T338] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 44.019116][ T338] usb 1-1: device descriptor read/64, error -71 [ 44.233062][ T31] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 44.275775][ T338] usb 1-1: device descriptor read/64, error -71 [ 44.318609][ T63] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 44.393455][ T31] usb 3-1: Using ep0 maxpacket: 32 [ 44.400866][ T31] usb 3-1: config 8 has an invalid interface number: 125 but max is 3 [ 44.409694][ T31] usb 3-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 44.420387][ T31] usb 3-1: config 8 has 1 interface, different from the descriptor's value: 4 [ 44.429405][ T31] usb 3-1: config 8 has no interface number 0 [ 44.435485][ T31] usb 3-1: config 8 interface 125 altsetting 15 has 0 endpoint descriptors, different from the interface descriptor's value: 8 [ 44.448646][ T31] usb 3-1: config 8 interface 125 has no altsetting 0 [ 44.457286][ T31] usb 3-1: New USB device found, idVendor=041e, idProduct=401e, bcdDevice=87.18 [ 44.466694][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.475028][ T31] usb 3-1: Product: 쒃㮯ꋡ矵賚ϛ嘱潁沕솧鸙騈㬉ٲ懝峓磳룤珀顶℅䇃ࡁ궠୺郞ﶊ㌾ⴗ᷈ꀇ东ཀྵ둝簷酓௤捺兺紦㟢顩枴쓻꧚ꩵ幍Ɇ蜤䈴孳ᵊ㴮醻켦酀䐦εｔ㸡긏㜠哓Ⱈ쳤 [ 44.501160][ T31] usb 3-1: Manufacturer: ᰎ [ 44.501522][ T63] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 44.505972][ T31] usb 3-1: SerialNumber: syz [ 44.521866][ T63] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 44.534260][ T63] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 44.543139][ T338] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 44.543620][ T63] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.559637][ T63] usb 4-1: Product: syz [ 44.563838][ T63] usb 4-1: Manufacturer: syz [ 44.568511][ T63] usb 4-1: SerialNumber: syz [ 44.575616][ T63] cdc_mbim 4-1:1.0: skipping garbage [ 44.627382][ T872] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 44.682186][ T338] usb 1-1: device descriptor read/64, error -71 [ 44.790146][ T870] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 44.896005][ T485] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 44.938792][ T338] usb 1-1: device descriptor read/64, error -71 [ 45.056474][ T485] usb 2-1: Using ep0 maxpacket: 32 [ 45.061910][ T338] usb usb1-port1: attempt power cycle [ 45.068212][ T485] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 45.080024][ T485] usb 2-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 45.089522][ T485] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.097562][ T485] usb 2-1: Product: syz [ 45.101810][ T485] usb 2-1: Manufacturer: syz [ 45.106649][ T485] usb 2-1: SerialNumber: syz [ 45.112216][ T485] usb 2-1: config 0 descriptor?? [ 45.118286][ T485] usb 2-1: bad CDC descriptors [ 45.123405][ T485] usb 2-1: unsupported MDLM descriptors [ 45.338848][ T485] usb 2-1: USB disconnect, device number 10 [ 45.430793][ T338] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 45.441022][ T870] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 45.448804][ T63] cdc_mbim 4-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 45.453304][ T338] usb 1-1: device descriptor read/8, error -71 [ 45.456860][ T63] cdc_mbim 4-1:1.0: setting rx_max = 2048 [ 45.603195][ T338] usb 1-1: device descriptor read/8, error -71 [ 45.664119][ T63] cdc_mbim 4-1:1.0: setting tx_max = 184 [ 45.670619][ T63] cdc_mbim 4-1:1.0: cdc-wdm0: USB WDM device [ 45.677877][ T63] wwan wwan0: port wwan0mbim0 attached [ 45.685193][ T63] cdc_mbim 4-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.3-1, CDC MBIM, be:79:e7:76:7e:84 [ 45.711091][ T36] kauditd_printk_skb: 4 callbacks suppressed [ 45.711110][ T36] audit: type=1400 audit(1756446653.690:342): avc: denied { read } for pid=148 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 45.739491][ T36] audit: type=1400 audit(1756446653.690:343): avc: denied { search } for pid=148 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 45.761208][ T36] audit: type=1400 audit(1756446653.690:344): avc: denied { read } for pid=148 comm="dhcpcd" name="n15" dev="tmpfs" ino=1267 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 45.783196][ T36] audit: type=1400 audit(1756446653.690:345): avc: denied { open } for pid=148 comm="dhcpcd" path="/run/udev/data/n15" dev="tmpfs" ino=1267 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 45.806303][ T36] audit: type=1400 audit(1756446653.690:346): avc: denied { getattr } for pid=148 comm="dhcpcd" path="/run/udev/data/n15" dev="tmpfs" ino=1267 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 45.830141][ T36] audit: type=1400 audit(1756446653.718:347): avc: denied { read } for pid=876 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 45.853602][ T36] audit: type=1400 audit(1756446653.718:348): avc: denied { open } for pid=876 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 45.878482][ T36] audit: type=1400 audit(1756446653.718:349): avc: denied { getattr } for pid=876 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 45.879850][ T338] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 45.923982][ T870] rust_binder: Error while translating object. [ 45.924025][ T870] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 45.931110][ T148] 8021q: adding VLAN 0 to HW filter on device wwan0 [ 45.932588][ T870] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:134 [ 45.947580][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 45.957066][ T36] audit: type=1400 audit(1756446653.802:350): avc: denied { write } for pid=875 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=425 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 45.966433][ T338] usb 1-1: device descriptor read/8, error -71 [ 45.987093][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 45.996108][ T36] audit: type=1400 audit(1756446653.802:351): avc: denied { add_name } for pid=875 comm="dhcpcd-run-hook" name="resolv.conf.wwan0.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 45.998769][ T761] usb 4-1: USB disconnect, device number 11 [ 46.003525][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.029879][ T761] cdc_mbim 4-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.3-1, CDC MBIM [ 46.032026][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.047579][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.047612][ T892] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 46.062001][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.070042][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.079104][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.085634][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.092090][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.098741][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.105527][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.112246][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.118835][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.125513][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.132543][ T761] wwan wwan0: port wwan0mbim0 disconnected [ 46.137519][ T338] usb 1-1: device descriptor read/8, error -71 [ 46.148545][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.151540][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.158096][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.164819][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.171649][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.178184][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.184781][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.191460][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.198399][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.205703][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.212332][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.219674][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.226688][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.233573][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.240169][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.246840][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.253377][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.260187][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.266738][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.273365][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.278629][ T338] usb usb1-port1: unable to enumerate USB device [ 46.282476][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.293100][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.299620][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.306251][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.312759][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.320275][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.329660][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.336231][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.343391][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.350043][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.356776][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.363916][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.370728][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.377405][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.384442][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.391267][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.397952][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.404962][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.411510][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.418436][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.425217][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.432050][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.438594][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.445478][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.452034][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.458603][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.465137][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.471776][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.478574][ T890] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.514963][ T922] input: syz0 as /devices/virtual/input/input11 [ 46.652255][ T929] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 46.652293][ T929] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:74 [ 46.712384][ T935] rust_binder: Write failure EFAULT in pid:140 [ 47.089486][ T31] hub 3-1:8.125: bad descriptor, ignoring hub [ 47.094384][ T957] rust_binder: Error while translating object. [ 47.102456][ T957] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 47.104823][ T31] hub 3-1:8.125: probe with driver hub failed with error -5 [ 47.109063][ T957] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:119 [ 47.130723][ T443] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 47.148074][ T957] rust_binder: Error while translating object. [ 47.148106][ T957] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 47.153225][ T31] usb 3-1: USB disconnect, device number 10 [ 47.154355][ T957] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:119 [ 47.170586][ T958] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 47.260016][ T965] rust_binder: 962 RLIMIT_NICE not set [ 47.346288][ T443] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 47.362411][ T443] usb 4-1: config 0 has no interfaces? [ 47.368672][ T31] rust_binder: 0: removing orphan mapping 0:24 [ 47.374897][ T443] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 47.384147][ T443] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 47.393741][ T443] usb 4-1: Product: syz [ 47.398238][ T443] usb 4-1: Manufacturer: syz [ 47.403196][ T443] usb 4-1: SerialNumber: syz [ 47.408674][ T443] usb 4-1: config 0 descriptor?? [ 47.636196][ T949] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 47.647070][ T949] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 47.687087][ T31] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 47.766518][ T794] usb 4-1: USB disconnect, device number 12 [ 47.851989][ T31] usb 3-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 47.861608][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.869887][ T31] usb 3-1: Product: syz [ 47.874377][ T31] usb 3-1: Manufacturer: syz [ 47.879077][ T31] usb 3-1: SerialNumber: syz [ 47.906134][ T984] rust_binder: Got transaction with invalid offset. [ 47.906193][ T984] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 47.913341][ T984] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:230 [ 48.189685][ T63] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 48.338873][ T31] rtl8150 3-1:1.0: couldn't reset the device [ 48.345226][ T31] rtl8150 3-1:1.0: probe with driver rtl8150 failed with error -5 [ 48.354769][ T31] usb 3-1: USB disconnect, device number 11 [ 48.384343][ T63] usb 2-1: New USB device found, idVendor=b801, idProduct=7730, bcdDevice=96.33 [ 48.394097][ T63] usb 2-1: New USB device strings: Mfr=0, Product=4, SerialNumber=0 [ 48.402353][ T63] usb 2-1: Product: syz [ 48.407549][ T63] usb 2-1: config 0 descriptor?? [ 48.627737][ T63] usb 2-1: USB disconnect, device number 11 [ 48.863421][ T31] usb 1-1: new low-speed USB device number 12 using dummy_hcd [ 49.035581][ T31] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 49.044089][ T31] usb 1-1: config 179 has no interface number 0 [ 49.055945][ T31] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 10 [ 49.072173][ T31] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 49.082277][ T31] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 49.093624][ T31] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 58368, setting to 8 [ 49.105004][ T31] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 49.118484][ T31] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 49.127942][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.140021][ T994] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 49.149244][ T31] xpad 1-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 49.171843][ T31] xpad 1-1:179.65: probe with driver xpad failed with error -5 [ 49.229434][ T1003] overlayfs: failed to resolve './file0': -2 [ 49.380840][ T63] usb 1-1: USB disconnect, device number 12 [ 49.590600][ T794] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 49.751016][ T794] usb 2-1: Using ep0 maxpacket: 8 [ 49.759079][ T794] usb 2-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 49.768566][ T794] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 49.776861][ T794] usb 2-1: Product: syz [ 49.781089][ T794] usb 2-1: Manufacturer: syz [ 49.786010][ T794] usb 2-1: SerialNumber: syz [ 49.791228][ T794] usb 2-1: config 0 descriptor?? [ 49.927820][ T1026] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 50.012059][ T1017] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.028605][ T1017] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.042082][ T1017] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.052009][ T1017] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.066168][ T1031] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.092672][ T1031] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.098341][ T1017] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.115943][ T1032] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.125453][ T1017] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.138927][ T1032] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.189736][ T794] usb 2-1: USB disconnect, device number 12 [ 50.217568][ T463] udevd[463]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 50.381902][ T31] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 50.405338][ T1051] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=54 sclass=netlink_tcpdiag_socket pid=1051 comm=syz.2.205 [ 50.463071][ T1060] overlayfs: failed to clone lowerpath [ 50.563712][ T31] usb 4-1: Using ep0 maxpacket: 32 [ 50.570214][ T31] usb 4-1: config 40 has an invalid interface number: 30 but max is 0 [ 50.578555][ T31] usb 4-1: config 40 has no interface number 0 [ 50.584743][ T31] usb 4-1: config 40 interface 30 has no altsetting 0 [ 50.593338][ T31] usb 4-1: New USB device found, idVendor=1bc7, idProduct=0036, bcdDevice=1c.31 [ 50.602636][ T31] usb 4-1: New USB device strings: Mfr=1, Product=3, SerialNumber=3 [ 50.610845][ T31] usb 4-1: Product: syz [ 50.615024][ T31] usb 4-1: Manufacturer: syz [ 50.619921][ T31] usb 4-1: SerialNumber: syz [ 50.842430][ T1035] batadv0: tun_chr_ioctl cmd 1074025678 [ 50.848227][ T1035] batadv0: group set to 801 [ 50.871277][ T1073] TCP: TCP_TX_DELAY enabled [ 50.889712][ T31] usb 4-1: USB disconnect, device number 13 [ 51.105677][ T1091] capability: warning: `syz.2.219' uses 32-bit capabilities (legacy support in use) [ 51.148748][ T36] kauditd_printk_skb: 25 callbacks suppressed [ 51.148767][ T36] audit: type=1400 audit(1756446658.768:377): avc: denied { setopt } for pid=1094 comm="syz.2.221" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 51.305275][ T36] audit: type=1400 audit(1756446658.917:378): avc: denied { append } for pid=1104 comm="syz.0.217" name="ppp" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 51.338303][ T1110] tipc: Enabling of bearer rejected, failed to enable media [ 51.338437][ T1108] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 51.356475][ T1108] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:100 [ 51.363352][ T1108] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 51.629758][ T1132] netlink: 12 bytes leftover after parsing attributes in process `syz.0.232'. [ 51.638895][ T1132] netlink: 20 bytes leftover after parsing attributes in process `syz.0.232'. [ 51.663790][ T36] audit: type=1400 audit(1756446659.254:379): avc: denied { mount } for pid=1133 comm="syz.0.233" name="/" dev="ramfs" ino=8408 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 51.668141][ T1134] process 'syz.0.233' launched './file0' with NULL argv: empty string added [ 51.686930][ T36] audit: type=1400 audit(1756446659.263:380): avc: denied { execute } for pid=1133 comm="syz.0.233" name="file0" dev="ramfs" ino=8409 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 51.717270][ T36] audit: type=1400 audit(1756446659.282:381): avc: denied { execute_no_trans } for pid=1133 comm="syz.0.233" path="/file0" dev="ramfs" ino=8409 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 51.717422][ T443] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 51.889918][ T1137] tipc: Enabling of bearer rejected, failed to enable media [ 51.900506][ T443] usb 4-1: Using ep0 maxpacket: 16 [ 51.907384][ T443] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 51.918911][ T443] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 51.928840][ T443] usb 4-1: New USB device found, idVendor=05ac, idProduct=024b, bcdDevice= 0.00 [ 51.938118][ T443] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.947061][ T443] usb 4-1: config 0 descriptor?? [ 51.953885][ T794] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 52.115452][ T794] usb 1-1: config 0 has an invalid interface number: 123 but max is 0 [ 52.124123][ T794] usb 1-1: config 0 has no interface number 0 [ 52.130648][ T794] usb 1-1: too many endpoints for config 0 interface 123 altsetting 38: 58, using maximum allowed: 30 [ 52.141934][ T794] usb 1-1: config 0 interface 123 altsetting 38 has 0 endpoint descriptors, different from the interface descriptor's value: 58 [ 52.155640][ T794] usb 1-1: config 0 interface 123 has no altsetting 0 [ 52.162666][ T794] usb 1-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 52.171784][ T794] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 52.180613][ T794] usb 1-1: config 0 descriptor?? [ 52.290837][ T36] audit: type=1400 audit(1756446659.843:382): avc: denied { mount } for pid=1141 comm="syz.2.236" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 52.382451][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.389976][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.397378][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.403228][ T794] usb 1-1: string descriptor 0 read error: -71 [ 52.404746][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.416039][ T794] usb 1-1: Cannot read MAC address [ 52.417993][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.423379][ T794] MOSCHIP usb-ethernet driver 1-1:0.123: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 52.430020][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.446506][ T794] usb 1-1: USB disconnect, device number 13 [ 52.448600][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.461921][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.468938][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.475869][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.483169][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.490188][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.497410][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.504584][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.511661][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.518695][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.525727][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.532950][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.540089][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.547198][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.554527][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.561441][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.568340][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.575363][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.582240][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.589132][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.596456][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.603497][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.610518][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.617534][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.624676][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.631745][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.638759][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.646500][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.653505][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.660412][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.667329][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.674514][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.681642][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.688608][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.695783][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.702693][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.709670][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.716589][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.723848][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.730837][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.737865][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.744763][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.751848][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.759032][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.765930][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.773045][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.780138][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.787262][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.794435][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.801375][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.808264][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.815556][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.822841][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.829855][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.846925][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.853912][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.860953][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.868245][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.875966][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.883143][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.890316][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.897453][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.907318][ T443] apple 0003:05AC:024B.0003: unknown main item tag 0x0 [ 52.932039][ T443] apple 0003:05AC:024B.0003: hidraw0: USB HID v0.00 Device [HID 05ac:024b] on usb-dummy_hcd.3-1/input0 [ 52.955938][ T443] usb 4-1: USB disconnect, device number 14 [ 53.237251][ T63] usb 1-1: new full-speed USB device number 14 using dummy_hcd [ 53.293065][ T332] bridge_slave_1: left allmulticast mode [ 53.299092][ T332] bridge_slave_1: left promiscuous mode [ 53.307433][ T332] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.322517][ T332] bridge_slave_0: left allmulticast mode [ 53.328346][ T332] bridge_slave_0: left promiscuous mode [ 53.334089][ T332] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.398854][ T36] audit: type=1400 audit(1756446660.881:383): avc: denied { mounton } for pid=1165 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 53.400556][ T63] usb 1-1: not running at top speed; connect to a high speed hub [ 53.430777][ T63] usb 1-1: config 1 interface 0 has no altsetting 0 [ 53.441506][ T63] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 53.450947][ T63] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.459616][ T63] usb 1-1: Product: syz [ 53.463900][ T63] usb 1-1: Manufacturer: syz [ 53.468607][ T63] usb 1-1: SerialNumber: syz [ 53.487503][ T332] tipc: Left network mode [ 53.487885][ T1165] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.499126][ T1165] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.506357][ T1165] bridge_slave_0: entered allmulticast mode [ 53.512894][ T1165] bridge_slave_0: entered promiscuous mode [ 53.520021][ T332] veth1_macvtap: left promiscuous mode [ 53.525626][ T332] veth0_vlan: left promiscuous mode [ 53.584537][ T1176] 9pnet_fd: p9_fd_create_tcp (1176): problem connecting socket to 127.0.0.1 [ 53.595382][ T1165] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.603107][ T1165] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.610533][ T1165] bridge_slave_1: entered allmulticast mode [ 53.617214][ T1165] bridge_slave_1: entered promiscuous mode [ 53.701549][ T1165] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.709108][ T1165] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.716516][ T1165] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.724130][ T1165] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.754114][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.763484][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.773971][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.781402][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.796156][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.803447][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.829838][ T1165] veth0_vlan: entered promiscuous mode [ 53.844832][ T1165] veth1_macvtap: entered promiscuous mode [ 53.867016][ T36] audit: type=1400 audit(1756446661.311:384): avc: denied { mounton } for pid=1165 comm="syz-executor" path="/root/syzkaller.TjfjXQ/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 53.906793][ T63] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 14 if 0 alt 1 proto 1 vid 0x0525 pid 0xA4A8 [ 53.908726][ T1193] tipc: Started in network mode [ 53.923229][ T1193] tipc: Node identity 00ffff00000000000000000000000001, cluster identity 4711 [ 53.932399][ T1193] tipc: Enabling of bearer rejected, failed to enable media [ 54.060586][ T31] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 54.128351][ T1154] mmap: syz.0.241 (1154): VmData 29077504 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 54.168487][ T63] usb 1-1: USB disconnect, device number 14 [ 54.175415][ T63] usblp0: removed [ 54.222166][ T31] usb 2-1: config index 0 descriptor too short (expected 45, got 36) [ 54.230821][ T31] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 54.243374][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 54.244610][ T1217] tipc: Enabling of bearer rejected, failed to enable media [ 54.255002][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 54.275531][ T31] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 54.290039][ T31] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 54.299506][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 54.309783][ T31] usb 2-1: config 0 descriptor?? [ 54.315086][ T1188] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 54.391594][ T36] audit: type=1400 audit(1756446661.798:385): avc: denied { create } for pid=1223 comm="syz.2.261" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 54.761651][ T31] plantronics 0003:047F:FFFF.0004: unknown main item tag 0xd [ 54.770347][ T31] plantronics 0003:047F:FFFF.0004: No inputs registered, leaving [ 54.780134][ T31] plantronics 0003:047F:FFFF.0004: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 54.801912][ T31] rust_binder: 0: removing orphan mapping 0:4120 [ 54.813685][ T36] audit: type=1400 audit(1756446662.200:386): avc: denied { create } for pid=1229 comm="syz.0.263" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 54.883339][ T1235] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.904140][ T1240] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.912093][ T1240] usb usb9: usbfs: process 1240 (syz.0.267) did not claim interface 0 before use [ 54.984128][ T1243] rust_binder: Error while translating object. [ 54.984166][ T1243] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 54.991276][ T1243] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:136 [ 55.034615][ T31] usb 2-1: USB disconnect, device number 13 [ 55.765251][ T1286] 8021q: VLANs not supported on wg1 [ 56.107278][ T1293] fuse: Unknown parameter '00000000000000000003' [ 56.370429][ T63] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 56.539041][ T1309] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 56.539423][ T1309] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:280 [ 56.565999][ T36] kauditd_printk_skb: 13 callbacks suppressed [ 56.566022][ T36] audit: type=1400 audit(1756446663.846:400): avc: denied { getopt } for pid=1310 comm="syz.1.293" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 56.605132][ T1311] rust_binder: Write failure EFAULT in pid:282 [ 56.690557][ T1317] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 56.694220][ T36] audit: type=1400 audit(1756446663.958:401): avc: denied { map } for pid=1314 comm="syz.2.296" path="socket:[9449]" dev="sockfs" ino=9449 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 56.796414][ T1324] rust_binder: Error while translating object. [ 56.796482][ T1324] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 56.803345][ T1324] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:290 [ 56.826683][ T1326] tipc: Enabling of bearer rejected, failed to enable media [ 56.975098][ T1337] rust_binder: 296: no such ref 2 [ 56.990709][ T1337] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 57.008707][ T1337] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:296 [ 57.033791][ T1345] rust_binder: Failed to allocate buffer. len:4256, is_oneway:false [ 57.045489][ T1345] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 57.061671][ T1345] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:298 [ 57.101999][ T1348] rust_binder: Write failure EFAULT in pid:301 [ 57.168366][ T1359] tipc: Started in network mode [ 57.179565][ T1359] tipc: Node identity 000000000000ff000000000000000001, cluster identity 4711 [ 57.188911][ T1359] tipc: Enabling of bearer rejected, failed to enable media [ 57.251442][ T1368] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 57.251481][ T1368] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:52 [ 57.261519][ T1368] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 57.270819][ T1368] rust_binder: Read failure Err(EFAULT) in pid:52 [ 57.301478][ T1373] netlink: 'syz.3.317': attribute type 2 has an invalid length. [ 57.326663][ T36] audit: type=1400 audit(1756446664.547:402): avc: denied { setopt } for pid=1372 comm="syz.3.317" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 57.417619][ T1379] netlink: 12 bytes leftover after parsing attributes in process `syz.0.318'. [ 57.447364][ T36] audit: type=1400 audit(1756446664.659:403): avc: denied { getopt } for pid=1380 comm="syz.3.319" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 57.520974][ T36] audit: type=1400 audit(1756446664.687:404): avc: denied { ioctl } for pid=1380 comm="syz.3.319" path="socket:[9800]" dev="sockfs" ino=9800 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 57.606438][ T36] audit: type=1400 audit(1756446664.809:405): avc: denied { map } for pid=1382 comm="syz.3.320" path="socket:[9817]" dev="sockfs" ino=9817 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 57.718241][ T1390] overlayfs: failed to clone upperpath [ 57.736767][ T1394] tipc: Enabling of bearer rejected, failed to enable media [ 57.782970][ T36] audit: type=1400 audit(1756446664.977:406): avc: denied { create } for pid=1402 comm="syz.2.328" name="file2" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 57.814127][ T36] audit: type=1400 audit(1756446664.977:407): avc: denied { ioctl } for pid=1407 comm="syz.3.329" path="/dev/fuse" dev="devtmpfs" ino=23 ioctlcmd=0x9420 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 57.856128][ T1418] /dev/nullb0: Can't lookup blockdev [ 57.873411][ T36] audit: type=1400 audit(1756446664.977:408): avc: denied { ioctl } for pid=1407 comm="syz.3.329" path="socket:[10298]" dev="sockfs" ino=10298 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 57.900066][ T36] audit: type=1400 audit(1756446664.996:409): avc: denied { read } for pid=1402 comm="syz.2.328" name="file2" dev="tmpfs" ino=602 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 57.924447][ T1410] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 57.947252][ T1424] tipc: Enabling of bearer rejected, failed to enable media [ 57.956384][ T1398] rust_binder: Error while translating object. [ 57.956420][ T1398] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 57.962717][ T1398] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:153 [ 57.991432][ T1428] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 58.002043][ T1428] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:83 [ 58.224695][ T1446] tipc: Enabling of bearer rejected, failed to enable media [ 58.255372][ T1448] netlink: 'syz.0.344': attribute type 1 has an invalid length. [ 58.263448][ T794] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 58.263910][ T1448] netlink: 156 bytes leftover after parsing attributes in process `syz.0.344'. [ 58.280355][ T1448] netlink: 'syz.0.344': attribute type 1 has an invalid length. [ 58.291412][ T1448] rust_binder: Write failure EINVAL in pid:171 [ 58.320363][ T1455] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 58.335860][ T1455] overlayfs: missing 'lowerdir' [ 58.404465][ T1458] exFAT-fs (rnullb0): invalid boot record signature [ 58.411287][ T1458] exFAT-fs (rnullb0): failed to read boot sector [ 58.418315][ T1458] exFAT-fs (rnullb0): failed to recognize exfat type [ 58.446554][ T794] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 58.457935][ T794] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 58.475938][ T794] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 58.485182][ T794] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 58.486834][ T1477] tipc: Enabling of bearer rejected, failed to enable media [ 58.496068][ T794] usb 2-1: config 0 descriptor?? [ 58.511634][ T794] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 58.661544][ T1501] tipc: Enabling of bearer rejected, failed to enable media [ 58.726878][ T1430] SELinux: policydb string length 1836477231 does not match expected length 8 [ 58.735949][ T1430] SELinux: failed to load policy [ 58.744913][ T1430] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 58.753574][ T1430] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 58.769434][ T1430] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 58.786996][ T1512] rust_binder: Error while translating object. [ 58.796022][ T1512] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 58.802418][ T1512] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:100 [ 58.833990][ T1518] rust_binder: Write failure EFAULT in pid:107 [ 58.843745][ T1518] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:107 [ 58.874172][ T63] usb 2-1: USB disconnect, device number 14 [ 59.108308][ T443] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 59.210593][ T1531] tipc: Enabling of bearer rejected, failed to enable media [ 59.269640][ T443] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 59.280248][ T443] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 59.290105][ T443] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 59.299248][ T443] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 59.307463][ T443] usb 4-1: SerialNumber: syz [ 59.529888][ T1520] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 59.540040][ T1520] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 59.552511][ T443] usb 4-1: 0:2 : does not exist [ 59.567921][ T443] usb 4-1: unit 5: unexpected type 0x09 [ 59.576867][ T443] usb 4-1: USB disconnect, device number 17 [ 59.598789][ T463] udevd[463]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 59.617985][ T1549] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 59.618400][ T1549] rust_binder: Error while translating object. [ 59.625105][ T1549] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 59.631608][ T1549] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:313 [ 59.984529][ T1560] tipc: Enabling of bearer rejected, failed to enable media [ 60.011842][ T1562] incfs: Unexpected inode type [ 60.631647][ T1594] netlink: 'syz.1.396': attribute type 15 has an invalid length. [ 60.639752][ T1595] tipc: Enabling of bearer rejected, failed to enable media [ 60.840987][ T1605] veth1: entered allmulticast mode [ 60.846648][ T1604] veth1: left allmulticast mode [ 60.904619][ T338] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 60.921509][ T1236] ------------[ cut here ]------------ [ 60.927399][ T1236] WARNING: CPU: 1 PID: 1236 at fs/inode.c:340 drop_nlink+0xce/0x110 [ 60.935625][ T1236] Modules linked in: [ 60.939667][ T1236] CPU: 1 UID: 0 PID: 1236 Comm: syz.0.265 Not tainted syzkaller #0 a8cf528afde17777b8d0df17d514b1350887467d [ 60.951708][ T1236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 60.962031][ T1236] RIP: 0010:drop_nlink+0xce/0x110 [ 60.967192][ T1236] Code: 04 00 00 be 08 00 00 00 e8 6f 48 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 d2 1c 98 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c [ 60.987354][ T1236] RSP: 0018:ffffc900101af860 EFLAGS: 00010293 [ 60.993599][ T1236] RAX: ffffffff81edc76e RBX: ffff888101fbf480 RCX: ffff888137f64c00 [ 61.001808][ T1236] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 61.009830][ T1236] RBP: ffffc900101af888 R08: 0000000000000003 R09: 0000000000000004 [ 61.017945][ T1236] R10: dffffc0000000000 R11: fffff52002035efc R12: dffffc0000000000 [ 61.026052][ T1236] R13: 1ffff110203f7e99 R14: ffff888101fbf4c8 R15: 0000000000000000 [ 61.034477][ T1236] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 61.043825][ T1236] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 61.050601][ T1236] CR2: 0000000000000000 CR3: 000000010bb08000 CR4: 00000000003526b0 [ 61.058882][ T1236] Call Trace: [ 61.062172][ T1236] [ 61.065247][ T1236] shmem_rmdir+0x5f/0x90 [ 61.069598][ T1236] vfs_rmdir+0x3e0/0x560 [ 61.073882][ T1236] incfs_kill_sb+0x109/0x230 [ 61.078648][ T1236] deactivate_locked_super+0xd5/0x2a0 [ 61.084145][ T1236] deactivate_super+0xb8/0xe0 [ 61.088957][ T1236] cleanup_mnt+0x3f1/0x480 [ 61.093590][ T1236] __cleanup_mnt+0x1d/0x40 [ 61.098057][ T1236] task_work_run+0x1e3/0x250 [ 61.102665][ T1236] ? __cfi_task_work_run+0x10/0x10 [ 61.107863][ T1236] ? free_nsproxy+0x223/0x290 [ 61.112692][ T1236] do_exit+0x9bc/0x2630 [ 61.117040][ T1236] ? __sched_text_start+0x10/0x10 [ 61.122363][ T1236] ? __cfi_do_exit+0x10/0x10 [ 61.126976][ T1236] ? __kasan_check_write+0x18/0x20 [ 61.132131][ T1236] ? _raw_spin_lock_irq+0x8d/0x120 [ 61.137364][ T1236] ? __kasan_check_read+0x15/0x20 [ 61.142547][ T1236] ? cgroup_update_frozen+0x160/0x990 [ 61.147961][ T1236] do_group_exit+0x22a/0x300 [ 61.152792][ T1236] ? cgroup_leave_frozen+0x16c/0x2b0 [ 61.158124][ T1236] get_signal+0x139d/0x14f0 [ 61.162822][ T1236] arch_do_signal_or_restart+0x96/0x720 [ 61.168400][ T1236] ? common_nsleep+0x93/0xb0 [ 61.173040][ T1236] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 61.179258][ T1236] ? __se_sys_clock_nanosleep+0x300/0x390 [ 61.185223][ T1236] ? __kasan_check_read+0x15/0x20 [ 61.190621][ T1236] ? fpregs_assert_state_consistent+0xb7/0xe0 [ 61.196846][ T1236] syscall_exit_to_user_mode+0x58/0xb0 [ 61.202557][ T1236] do_syscall_64+0x64/0xf0 [ 61.207029][ T1236] ? clear_bhb_loop+0x50/0xa0 [ 61.211730][ T1236] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 61.217717][ T1236] RIP: 0033:0x7f8927dc14a5 [ 61.222446][ T1236] Code: Unable to access opcode bytes at 0x7f8927dc147b. [ 61.229788][ T1236] RSP: 002b:00007f8928cccf80 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6 [ 61.238341][ T1236] RAX: fffffffffffffdfc RBX: 00007f8927fb5fa0 RCX: 00007f8927dc14a5 [ 61.246529][ T1236] RDX: 00007f8928cccfc0 RSI: 0000000000000000 RDI: 0000000000000000 [ 61.255754][ T1236] RBP: 00007f8927e11e19 R08: 0000000000000000 R09: 0000000000000000 [ 61.264094][ T1236] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 61.272299][ T1236] R13: 00007f8927fb6038 R14: 00007f8927fb5fa0 R15: 00007fffc9079558 [ 61.280419][ T1236] [ 61.283462][ T1236] ---[ end trace 0000000000000000 ]--- [ 61.290209][ T1236] ================================================================== [ 61.299007][ T1236] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 [ 61.305534][ T1236] Write of size 4 at addr 0000000000000168 by task syz.0.265/1236 [ 61.313432][ T1236] [ 61.315759][ T1236] CPU: 0 UID: 0 PID: 1236 Comm: syz.0.265 Tainted: G W syzkaller #0 a8cf528afde17777b8d0df17d514b1350887467d [ 61.315787][ T1236] Tainted: [W]=WARN [ 61.315793][ T1236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 61.315803][ T1236] Call Trace: [ 61.315809][ T1236] [ 61.315816][ T1236] __dump_stack+0x21/0x30 [ 61.315841][ T1236] dump_stack_lvl+0x10c/0x190 [ 61.315862][ T1236] ? __cfi_dump_stack_lvl+0x10/0x10 [ 61.315883][ T1236] print_report+0x3d/0x70 [ 61.315901][ T1236] kasan_report+0x163/0x1a0 [ 61.315919][ T1236] ? ihold+0x24/0x70 [ 61.315936][ T1236] ? _raw_spin_unlock+0x45/0x60 [ 61.315956][ T1236] ? ihold+0x24/0x70 [ 61.315973][ T1236] kasan_check_range+0x299/0x2a0 [ 61.315991][ T1236] __kasan_check_write+0x18/0x20 [ 61.316012][ T1236] ihold+0x24/0x70 [ 61.316027][ T1236] vfs_rmdir+0x26a/0x560 [ 61.316047][ T1236] incfs_kill_sb+0x109/0x230 [ 61.316070][ T1236] deactivate_locked_super+0xd5/0x2a0 [ 61.316091][ T1236] deactivate_super+0xb8/0xe0 [ 61.316110][ T1236] cleanup_mnt+0x3f1/0x480 [ 61.316129][ T1236] __cleanup_mnt+0x1d/0x40 [ 61.316145][ T1236] task_work_run+0x1e3/0x250 [ 61.316165][ T1236] ? __cfi_task_work_run+0x10/0x10 [ 61.316183][ T1236] ? free_nsproxy+0x223/0x290 [ 61.316205][ T1236] do_exit+0x9bc/0x2630 [ 61.316224][ T1236] ? __sched_text_start+0x10/0x10 [ 61.316246][ T1236] ? __cfi_do_exit+0x10/0x10 [ 61.316265][ T1236] ? __kasan_check_write+0x18/0x20 [ 61.316286][ T1236] ? _raw_spin_lock_irq+0x8d/0x120 [ 61.316306][ T1236] ? __kasan_check_read+0x15/0x20 [ 61.316326][ T1236] ? cgroup_update_frozen+0x160/0x990 [ 61.316343][ T1236] do_group_exit+0x22a/0x300 [ 61.316361][ T1236] ? cgroup_leave_frozen+0x16c/0x2b0 [ 61.316384][ T1236] get_signal+0x139d/0x14f0 [ 61.316405][ T1236] arch_do_signal_or_restart+0x96/0x720 [ 61.316428][ T1236] ? common_nsleep+0x93/0xb0 [ 61.316448][ T1236] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 61.316471][ T1236] ? __se_sys_clock_nanosleep+0x300/0x390 [ 61.316494][ T1236] ? __kasan_check_read+0x15/0x20 [ 61.316515][ T1236] ? fpregs_assert_state_consistent+0xb7/0xe0 [ 61.316535][ T1236] syscall_exit_to_user_mode+0x58/0xb0 [ 61.316553][ T1236] do_syscall_64+0x64/0xf0 [ 61.316572][ T1236] ? clear_bhb_loop+0x50/0xa0 [ 61.316588][ T1236] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 61.316604][ T1236] RIP: 0033:0x7f8927dc14a5 [ 61.316617][ T1236] Code: Unable to access opcode bytes at 0x7f8927dc147b. [ 61.316626][ T1236] RSP: 002b:00007f8928cccf80 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6 [ 61.316645][ T1236] RAX: fffffffffffffdfc RBX: 00007f8927fb5fa0 RCX: 00007f8927dc14a5 [ 61.316657][ T1236] RDX: 00007f8928cccfc0 RSI: 0000000000000000 RDI: 0000000000000000 [ 61.316668][ T1236] RBP: 00007f8927e11e19 R08: 0000000000000000 R09: 0000000000000000 [ 61.316679][ T1236] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 61.316689][ T1236] R13: 00007f8927fb6038 R14: 00007f8927fb5fa0 R15: 00007fffc9079558 [ 61.316703][ T1236] [ 61.316709][ T1236] ================================================================== [ 61.623809][ T1236] Disabling lock debugging due to kernel taint [ 61.630078][ T1236] BUG: kernel NULL pointer dereference, address: 0000000000000168 [ 61.638172][ T1236] #PF: supervisor write access in kernel mode [ 61.644292][ T1236] #PF: error_code(0x0002) - not-present page [ 61.650267][ T1236] PGD 8000000118be7067 P4D 8000000118be7067 PUD 0 [ 61.656771][ T1236] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 61.663039][ T1236] CPU: 0 UID: 0 PID: 1236 Comm: syz.0.265 Tainted: G B W syzkaller #0 a8cf528afde17777b8d0df17d514b1350887467d [ 61.676079][ T1236] Tainted: [B]=BAD_PAGE, [W]=WARN [ 61.681278][ T1236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 61.691427][ T1236] RIP: 0010:ihold+0x2a/0x70 [ 61.696023][ T1236] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 bd 13 98 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 2c 3f ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 cd [ 61.715892][ T1236] RSP: 0018:ffffc900101af8a0 EFLAGS: 00010246 [ 61.721982][ T1236] RAX: ffff888137f64c00 RBX: 0000000000000000 RCX: ffff888137f64c00 [ 61.730294][ T1236] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 61.738449][ T1236] RBP: ffffc900101af8b0 R08: ffffffff8896a947 R09: 1ffffffff112d528 [ 61.746439][ T1236] R10: dffffc0000000000 R11: fffffbfff112d529 R12: ffff888101fbf48c [ 61.754427][ T1236] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 61.762494][ T1236] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 61.771534][ T1236] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 61.778148][ T1236] CR2: 0000000000000168 CR3: 0000000106f70000 CR4: 00000000003526b0 [ 61.786370][ T1236] Call Trace: [ 61.789839][ T1236] [ 61.792773][ T1236] vfs_rmdir+0x26a/0x560 [ 61.797016][ T1236] incfs_kill_sb+0x109/0x230 [ 61.801603][ T1236] deactivate_locked_super+0xd5/0x2a0 [ 61.806968][ T1236] deactivate_super+0xb8/0xe0 [ 61.811656][ T1236] cleanup_mnt+0x3f1/0x480 [ 61.816179][ T1236] __cleanup_mnt+0x1d/0x40 [ 61.820692][ T1236] task_work_run+0x1e3/0x250 [ 61.825379][ T1236] ? __cfi_task_work_run+0x10/0x10 [ 61.830497][ T1236] ? free_nsproxy+0x223/0x290 [ 61.835279][ T1236] do_exit+0x9bc/0x2630 [ 61.839907][ T1236] ? __sched_text_start+0x10/0x10 [ 61.844981][ T1236] ? __cfi_do_exit+0x10/0x10 [ 61.849578][ T1236] ? __kasan_check_write+0x18/0x20 [ 61.854718][ T1236] ? _raw_spin_lock_irq+0x8d/0x120 [ 61.859924][ T1236] ? __kasan_check_read+0x15/0x20 [ 61.864952][ T1236] ? cgroup_update_frozen+0x160/0x990 [ 61.870412][ T1236] do_group_exit+0x22a/0x300 [ 61.875002][ T1236] ? cgroup_leave_frozen+0x16c/0x2b0 [ 61.880361][ T1236] get_signal+0x139d/0x14f0 [ 61.884863][ T1236] arch_do_signal_or_restart+0x96/0x720 [ 61.890404][ T1236] ? common_nsleep+0x93/0xb0 [ 61.895087][ T1236] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 61.901436][ T1236] ? __se_sys_clock_nanosleep+0x300/0x390 [ 61.907245][ T1236] ? __kasan_check_read+0x15/0x20 [ 61.912279][ T1236] ? fpregs_assert_state_consistent+0xb7/0xe0 [ 61.918430][ T1236] syscall_exit_to_user_mode+0x58/0xb0 [ 61.924148][ T1236] do_syscall_64+0x64/0xf0 [ 61.928557][ T1236] ? clear_bhb_loop+0x50/0xa0 [ 61.933332][ T1236] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 61.939424][ T1236] RIP: 0033:0x7f8927dc14a5 [ 61.943954][ T1236] Code: Unable to access opcode bytes at 0x7f8927dc147b. [ 61.950970][ T1236] RSP: 002b:00007f8928cccf80 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6 [ 61.959551][ T1236] RAX: fffffffffffffdfc RBX: 00007f8927fb5fa0 RCX: 00007f8927dc14a5 [ 61.967564][ T1236] RDX: 00007f8928cccfc0 RSI: 0000000000000000 RDI: 0000000000000000 [ 61.975864][ T1236] RBP: 00007f8927e11e19 R08: 0000000000000000 R09: 0000000000000000 [ 61.983951][ T1236] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 61.994213][ T1236] R13: 00007f8927fb6038 R14: 00007f8927fb5fa0 R15: 00007fffc9079558 [ 62.002224][ T1236] [ 62.005322][ T1236] Modules linked in: [ 62.009292][ T1236] CR2: 0000000000000168 [ 62.013513][ T1236] ---[ end trace 0000000000000000 ]--- [ 62.016087][ T338] usb 2-1: device descriptor read/64, error -71 [ 62.018958][ T1236] RIP: 0010:ihold+0x2a/0x70 [ 62.018991][ T1236] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 bd 13 98 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 2c 3f ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 cd [ 62.019010][ T1236] RSP: 0018:ffffc900101af8a0 EFLAGS: 00010246 [ 62.055582][ T1236] RAX: ffff888137f64c00 RBX: 0000000000000000 RCX: ffff888137f64c00 [ 62.063669][ T1236] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 62.071731][ T1236] RBP: ffffc900101af8b0 R08: ffffffff8896a947 R09: 1ffffffff112d528 [ 62.079704][ T1236] R10: dffffc0000000000 R11: fffffbfff112d529 R12: ffff888101fbf48c [ 62.087679][ T1236] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 62.095911][ T1236] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 62.105281][ T1236] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 62.111984][ T1236] CR2: 0000000000000168 CR3: 0000000106f70000 CR4: 00000000003526b0 [ 62.119973][ T1236] Kernel panic - not syncing: Fatal exception [ 62.126485][ T1236] Kernel Offset: disabled [ 62.130960][ T1236] Rebooting in 86400 seconds..