last executing test programs: 13.826559406s ago: executing program 0 (id=290): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x1000, 0x8, '9P2000.u'}, 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_INIT(r2, &(0x7f0000001740)={0x50, 0x0, 0x0, {0x7, 0x21, 0x0, 0x14210000, 0x7d, 0x1005, 0x0, 0x3}}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$cgroup2(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f00000004c0), 0x800010, 0x0) chroot(&(0x7f0000000100)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000180)='./file0\x00', &(0x7f0000000300)='./file0\x00') mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000004380), 0x1815808, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@cachetag={'cachetag', 0x3d, '}&-}'}}], [{@audit}, {@permit_directio}, {@context={'context', 0x3d, 'sysadm_u'}}, {@permit_directio}], 0x6b}}) r3 = syz_open_procfs(0x0, &(0x7f00000003c0)='mountinfo\x00') r4 = open(&(0x7f0000000200)='./bus\x00', 0x141a42, 0x0) read$FUSE(r3, &(0x7f00000017c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_BMAP(r2, &(0x7f0000000000)={0x18, 0x0, r5, {0xa6}}, 0x18) sendfile(r4, r3, 0x0, 0xffffffff) 13.824153766s ago: executing program 0 (id=291): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$P9_RVERSION(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setown(r3, 0x8, 0x0) fcntl$getownex(r3, 0x10, &(0x7f0000000080)) r4 = dup(r2) write$FUSE_BMAP(r4, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r4, &(0x7f0000000180)=ANY=[@ANYBLOB="b0000000000000ab284dc9a94095f54e34f11a5a480d2115805745f8a24d"], 0xb0) r5 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000140)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$trusted_overlay_nlink(r6, &(0x7f0000005dc0), 0x0, 0x0, 0x1) ioctl$PAGEMAP_SCAN(r5, 0xc0606610, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x11, &(0x7f0000001300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[{@cache_fscache}]}}) r7 = mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000000000)={@mcast1, 0x6, 0x1, 0x0, 0x5, 0x81, 0xfff9}, 0x20) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xc, 0x0, &(0x7f0000000440)=[@free_buffer={0x40086303, r7}], 0x0, 0x0, 0x0}) 13.823831306s ago: executing program 0 (id=292): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x138a, 0x1000000003}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r1, 0x1, 0x3, &(0x7f0000000100)=""/193, &(0x7f0000000040)=0xc1) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x1}) 13.816025886s ago: executing program 0 (id=293): ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6(0xa, 0x2, 0x0) r0 = getpgid(0x0) r1 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setns(r1, 0x66020000) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_BT_RCVMTU(r2, 0x112, 0xd, &(0x7f0000000000)=0x8, 0x0) mount$9p_fd(0x0, &(0x7f0000000980)='.\x00', 0x0, 0x104000, 0x0) syz_clone(0x498144ee5f62e149, 0x0, 0x17, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x80001) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x262) umount2(&(0x7f0000000040)='.\x00', 0x2) ptrace$ARCH_SHSTK_DISABLE(0x1e, r0, 0x2, 0x5002) connect$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x20}}}, 0x1c) syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000009980708b5192100c7980400000309021b00012000ac000904"], 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) mount$binderfs(0x0, &(0x7f00000000c0)='./binderfs\x00', &(0x7f0000000140), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="6d6178303030303030023031373737373737373737372c00"]) 12.605665464s ago: executing program 0 (id=304): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1000, 0x0) (async) connect$unix(0xffffffffffffffff, 0x0, 0x0) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) (async) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) r5 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee1, 0x11, r5, 0x0) ioctl$KVM_NMI(r4, 0xae9a) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async) r6 = openat$incfs(0xffffffffffffffff, 0x0, 0x0, 0x130) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x12, &(0x7f0000000540)={@ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/208, 0xd0, 0x1, 0x40}, @flat=@weak_handle={0x77682a85, 0x1, 0x2}, @fda={0x66646185, 0x0, 0x2, 0x19}}, &(0x7f0000000000)={0x0, 0x28, 0x40}}}, @enter_looper, @decrefs={0x40046307, 0x2}, @dead_binder_done], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x5c, 0x0, &(0x7f0000000180)=[@request_death={0x400c630e, 0x1}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xc40}], 0x5, 0x0, &(0x7f0000000380)="65240c31f4"}) syz_kvm_setup_cpu$x86(r6, r6, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000280)=[@text16={0x10, &(0x7f0000000200)="8b9f00000f01ca66b9830b00000f32fa0fae940900f4360f09f20f2bb600000f01fb6766c7442400b20bae1f6766c7442402370000006766c744240600000000670f011c24", 0x45}], 0x1, 0x60, &(0x7f00000002c0)=[@cr0={0x0, 0x10}, @cr0={0x0, 0xa0040008}], 0x2) 12.524843555s ago: executing program 0 (id=305): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) (async) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x5, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x3, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x8, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@local, 0x0, 0x0, 0x3, 0x0, 0x1}]}]}, 0xfc}}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000b80)=@migrate={0xec, 0x21, 0x1, 0x0, 0xfffffffe, {{@in6=@private2, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0xfffc, 0x0, 0x0, 0x0, 0xa, 0xe0, 0x80}, 0x2}, [@migrate={0x9c, 0x11, [{@in=@local, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in6=@private2, @in6=@local, 0x32, 0x3, 0x0, 0x2, 0x2, 0x2}, {@in6=@ipv4={'\x00', '\xff\xff', @loopback}, @in6=@ipv4={'\x00', '\xff\xff', @private=0xa010102}, @in6=@empty, @in6=@private2, 0x3c, 0x0, 0x0, 0x0, 0x2, 0x8}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x800}, 0x42000) (async) sendmsg$nl_xfrm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000b80)=@migrate={0xec, 0x21, 0x1, 0x0, 0xfffffffe, {{@in6=@private2, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0xfffc, 0x0, 0x0, 0x0, 0xa, 0xe0, 0x80}, 0x2}, [@migrate={0x9c, 0x11, [{@in=@local, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in6=@private2, @in6=@local, 0x32, 0x3, 0x0, 0x2, 0x2, 0x2}, {@in6=@ipv4={'\x00', '\xff\xff', @loopback}, @in6=@ipv4={'\x00', '\xff\xff', @private=0xa010102}, @in6=@empty, @in6=@private2, 0x3c, 0x0, 0x0, 0x0, 0x2, 0x8}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x800}, 0x42000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x5c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000280)={@flat=@binder={0x73622a85, 0xa, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/7, 0x7, 0x2, 0x21}, @fda={0x66646185, 0x9, 0x0, 0x29}}, &(0x7f0000000100)={0x0, 0x18, 0x40}}, 0x1000}, @clear_death={0x400c630f, 0x1}], 0x56, 0x0, &(0x7f0000000380)="f22439c47e109c6096ea2bae1f7d03b8c44245ee48a8a255e0db445a21505ddddb4f9e2515db95a1de45d524bb52899f326bab2c88053f7a7475b3ec0373c50a7a4d67df5fde31db1a31325bebcf85b344c0596e65b8"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3e, 0xfe9, &(0x7f0000000200)={@fd={0x66642a85, 0x0, r0}, @flat=@weak_binder={0x77622a85, 0x1000, 0x3}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x2, 0x28}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) 12.521088175s ago: executing program 32 (id=305): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) (async) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x5, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x3, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x8, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@local, 0x0, 0x0, 0x3, 0x0, 0x1}]}]}, 0xfc}}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000b80)=@migrate={0xec, 0x21, 0x1, 0x0, 0xfffffffe, {{@in6=@private2, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0xfffc, 0x0, 0x0, 0x0, 0xa, 0xe0, 0x80}, 0x2}, [@migrate={0x9c, 0x11, [{@in=@local, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in6=@private2, @in6=@local, 0x32, 0x3, 0x0, 0x2, 0x2, 0x2}, {@in6=@ipv4={'\x00', '\xff\xff', @loopback}, @in6=@ipv4={'\x00', '\xff\xff', @private=0xa010102}, @in6=@empty, @in6=@private2, 0x3c, 0x0, 0x0, 0x0, 0x2, 0x8}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x800}, 0x42000) (async) sendmsg$nl_xfrm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000b80)=@migrate={0xec, 0x21, 0x1, 0x0, 0xfffffffe, {{@in6=@private2, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0xfffc, 0x0, 0x0, 0x0, 0xa, 0xe0, 0x80}, 0x2}, [@migrate={0x9c, 0x11, [{@in=@local, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in6=@private2, @in6=@local, 0x32, 0x3, 0x0, 0x2, 0x2, 0x2}, {@in6=@ipv4={'\x00', '\xff\xff', @loopback}, @in6=@ipv4={'\x00', '\xff\xff', @private=0xa010102}, @in6=@empty, @in6=@private2, 0x3c, 0x0, 0x0, 0x0, 0x2, 0x8}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x800}, 0x42000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x5c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000280)={@flat=@binder={0x73622a85, 0xa, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/7, 0x7, 0x2, 0x21}, @fda={0x66646185, 0x9, 0x0, 0x29}}, &(0x7f0000000100)={0x0, 0x18, 0x40}}, 0x1000}, @clear_death={0x400c630f, 0x1}], 0x56, 0x0, &(0x7f0000000380)="f22439c47e109c6096ea2bae1f7d03b8c44245ee48a8a255e0db445a21505ddddb4f9e2515db95a1de45d524bb52899f326bab2c88053f7a7475b3ec0373c50a7a4d67df5fde31db1a31325bebcf85b344c0596e65b8"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3e, 0xfe9, &(0x7f0000000200)={@fd={0x66642a85, 0x0, r0}, @flat=@weak_binder={0x77622a85, 0x1000, 0x3}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x2, 0x28}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) 2.762182941s ago: executing program 4 (id=469): getpgrp(0xffffffffffffffff) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x40) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYBLOB="080000000000000093000040"]) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000001c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r6, 0x80585414, &(0x7f0000000380)) r7 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r7, 0xae44, 0x5) dup3(r0, r4, 0x80000) bind$bt_l2cap(r4, &(0x7f00000021c0)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, 0xe) r8 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r8, 0x89f0, &(0x7f0000000180)={'sit0\x00', &(0x7f0000000100)={'sit0\x00', 0x0, 0x47, 0x8, 0x3, 0x8, {{0x5, 0x4, 0x2, 0x1b, 0x14, 0x66, 0x0, 0x81, 0x29, 0x0, @loopback, @broadcast}}}}) accept4$bt_l2cap(r4, &(0x7f0000000040), &(0x7f0000000080)=0xe, 0x80000) listen(r4, 0x9) close_range(r0, 0xffffffffffffffff, 0x0) 2.569178352s ago: executing program 4 (id=473): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_buf(r1, 0x0, 0x8008000000010, &(0x7f0000000000)="17000000", 0x4) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0)='ext3\x00', 0x200000, 0x0) sendmsg$AUDIT_USER_TTY(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x78, 0x464, 0x200, 0x70bd2b, 0x25dfdbfd, "cd0fc8e1257e5d2a5b7f3b1131bc308c2292d062c33a4bf11b5beaaeb8d804c32d77b3ebfd8e68b9c091c2bf042698e2e1cd93c2858dd4d887902f0338500a9c92e37b2f776278bbfeb4f455fc0329d48599b1f113236582df2b656d952871da365ea440ee33", ["", "", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0xc5}, 0x4002) 2.556763793s ago: executing program 4 (id=474): r0 = socket(0x1e, 0x1, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000020bd28940000000000000109022400010000000009040100010300000009210000000122070009058103"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB='@\n\a'], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io(r1, &(0x7f00000002c0)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB='@\n\a'], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r1, &(0x7f00000001c0)={0x2c, &(0x7f0000000200)={0x0, 0xb, 0xd, {0xd, 0x3, "12aee7c28fbe4c0127e546"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000080)={0x5, 0x9, 0x3, 0x81, 0x7, 0x99, 0x3}, 0xc) (async) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000080)={0x5, 0x9, 0x3, 0x81, 0x7, 0x99, 0x3}, 0xc) sendmmsg$sock(r0, &(0x7f0000000600)=[{{&(0x7f0000000000)=@tipc=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x1}}, 0x80, 0x0, 0x0, 0x0, 0x0, 0x1000000}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) (async) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_open_dev$loop(&(0x7f0000000500), 0x7, 0x880) ioctl$BLKBSZSET(r5, 0x40081271, &(0x7f0000000540)=0x8) (async) ioctl$BLKBSZSET(r5, 0x40081271, &(0x7f0000000540)=0x8) pipe(&(0x7f0000000040)) (async) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r7, 0x0, 0x39000, 0x0) splice(r6, 0x0, r3, 0x0, 0x408c8, 0xe) write$binfmt_elf64(r4, &(0x7f0000000100)=ANY=[], 0xfffffe3e) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x0) (async) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x10000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) r8 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000380)={'team_slave_0\x00', &(0x7f0000000200)=@ethtool_sset_info={0x12, 0x0, 0x101}}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfdf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) 1.48786599s ago: executing program 2 (id=484): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x3}) r1 = mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x50, 0x0, &(0x7f0000000040)="c77f63941720024fcb205ad3f3502124f14eba8419d2d70aade14d22ca5137369a7e2f7c68839e02d428fe526929aaaeb71b01b4a33854d4ca7681b53a970b1a4175371ccff2ad1d15ed65d48b413559"}) (async) r2 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000d00)={0x2, {{0xa, 0x2, 0x5, @mcast1}}, 0x0, 0x22, [{{0xa, 0x4e24, 0x1, @empty, 0x801}}, {{0xa, 0x4e22, 0x7fff, @empty, 0x9}}]}, 0x90) r3 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000140)={'veth1\x00', &(0x7f0000000100)=@ethtool_cmd={0xa, 0xc, 0x8, 0x7, 0x2, 0xc, 0x3e, 0x9, 0x10, 0x7, 0x9, 0xfffffff9, 0x401, 0x4e, 0xe5, 0x1, [0x9, 0xfffffda0]}}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x0, &(0x7f00000004c0)={@ptr={0x70742a85, 0x100000, 0x0, 0x0, 0x2, 0x7}, @flat=@weak_binder={0x77622a85, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x28}}, 0x0}}], 0x0, 0x0, 0x0}) quotactl_fd$Q_QUOTAON(0xffffffffffffffff, 0xffffffff80000202, 0x0, &(0x7f0000000340)='./file0\x00') (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000900)={0x9c, 0x0, &(0x7f00000007c0)=[@free_buffer={0x40086303, r1}, @acquire_done={0x40106309, 0x2}, @release={0x40046306, 0x3}, @acquire_done={0x40106309, 0x3}, @dead_binder_done, @clear_death, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000780)={0x30, 0x30, 0x30}}}], 0x29, 0x0, &(0x7f00000008c0)="4b30174b442288c3a9def15973bb88f9681daaf870436e821da0bd6350d981151041f99854174eafdb"}) 1.41206641s ago: executing program 2 (id=485): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000036c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000008280)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) (async) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) syz_open_procfs(r2, &(0x7f0000000080)='oom_score_adj\x00') (async, rerun: 32) bind$unix(r1, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e22}, 0x6e) (rerun: 32) r3 = socket(0x11, 0x3, 0x1000) ioctl$sock_inet_SIOCADDRT(r3, 0x890b, &(0x7f0000000100)={0x0, {0x2, 0x1, @dev}, {0x2, 0x0, @local}, {0x2, 0x4e20, @broadcast}, 0x8, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x3}) (async) close_range(r0, 0xffffffffffffffff, 0x0) 1.41169285s ago: executing program 2 (id=486): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000440)={0x0, 0xfffffffc, 0xffdffff8, 0xffffffff, 0x7, "ff000000000000000000000000000200"}) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x13) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)) ioctl$TCSETA(0xffffffffffffffff, 0x5406, &(0x7f0000000200)={0xfffe, 0x81, 0x8, 0xb3, 0xc}) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000100)={0x0, 0xaaa, &(0x7f0000000240)="23591363ad", 0x0, 0x5}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x1002000000, 0x0, 0x2004cb, 0x0, 0xa1d, 0x8, 0x9, 0x0, 0x3, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f0000000100)={{0xd000, 0x0, 0x0, 0x7, 0x8, 0x0, 0x0, 0x3, 0x0, 0x8, 0x6}, {0xffff1000, 0x10000, 0xc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7, 0xff}, {0x2000, 0x8080000, 0xc, 0x0, 0x7, 0xc4, 0x0, 0x0, 0x8, 0x3, 0x0, 0xfc}, {0xeeef0000, 0x33331000, 0x18592cbc7c573fc6, 0x9, 0x1, 0x0, 0x9, 0x0, 0x8, 0x0, 0x4}, {0x80a0000, 0xeeee8000, 0xe, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3c}, {0x100000, 0x0, 0x0, 0x78, 0x5, 0x1, 0x2, 0x0, 0x0, 0xff, 0x1}, {0x0, 0xeeee0000, 0xa, 0x4, 0x0, 0x0, 0xa1, 0x20, 0x0, 0x0, 0x8}, {0x2, 0x6000, 0xc, 0x0, 0x0, 0x7, 0x8, 0x40, 0x26, 0x0, 0x0, 0x2}, {0x80a0000, 0x8cc}, {0xdddd1000}, 0xddf8ffdb, 0x0, 0x0, 0x110, 0x0, 0xf801, 0x0, [0x80000001, 0x0, 0x1, 0x1]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ftruncate(0xffffffffffffffff, 0xffffffffeed6b53c) ioctl$BLKCRYPTOGENERATEKEY(0xffffffffffffffff, 0xc030128a, &(0x7f00000002c0)={&(0x7f0000000280)=""/9, 0x9}) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000140)=0x4) r4 = socket(0x21, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000340)={0x3f, 0x2, 0x9}, 0x10) write(r4, &(0x7f00000000c0)="240000001e005f0214fffffffffffff807000000a600000000000401080008001d000000", 0x24) r5 = socket$inet6(0xa, 0x80002, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) tee(r5, r6, 0xfffffffffffffc01, 0x0) r7 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x28e00, 0x0) ioctl$BLKRRPART(r7, 0x125f, 0x0) r8 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r8, 0x0, 0x16, 0x0, 0x0) ioctl$BTRFS_IOC_QGROUP_ASSIGN(r4, 0x40189429, &(0x7f0000000300)={0x1, 0x1, 0x100}) ioctl$BLKOPENZONE(r7, 0x40101286, &(0x7f0000000000)={0xfffffffffffff703, 0x474}) 1.354829191s ago: executing program 2 (id=487): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0x20000, 0x191) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x90, 0x0, &(0x7f0000002680)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f00000004c0)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/226, 0xe2, 0x2, 0x4}, @fda={0x66646185, 0xffffffffffffffff, 0x0, 0xe}, @ptr={0x70742a85, 0x0, &(0x7f0000002740)=""/243, 0xf3, 0x0, 0x28}}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}, 0x1000}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@fda={0x66646185, 0xffffffff7fffffff, 0xfffffffffffffffe, 0x10}, @ptr={0x70742a85, 0x1, &(0x7f0000000580)=""/173, 0xad, 0x0, 0x14}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000000)={0x0, 0x20, 0x48}}}], 0x0, 0x0, 0x0}) 1.319003861s ago: executing program 2 (id=488): r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfc3c, 0x40402) write$evdev(r0, &(0x7f00000005c0)=[{{}, 0x11, 0xfff8, 0x815}], 0x18) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0)='ext3\x00', 0x208003, 0x0) 1.234657922s ago: executing program 2 (id=489): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r3 = mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r2, 0x8000) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000cb27281017270000090400000028680800"/36], 0x0) (async) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000cb27281017270000090400000028680800"/36], 0x0) syz_usb_disconnect(r4) (async) syz_usb_disconnect(r4) r5 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x80000) ioctl$EVIOCGRAB(r5, 0x40044590, &(0x7f0000000040)=0xfffffffb) (async) ioctl$EVIOCGRAB(r5, 0x40044590, &(0x7f0000000040)=0xfffffffb) syz_usb_disconnect(r4) (async) syz_usb_disconnect(r4) msync(&(0x7f0000ff9000/0x1000)=nil, 0x1000, 0x4) syz_usb_control_io$hid(r1, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220f00"], 0x0}, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x2000000000032, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x2000000000032, 0xffffffffffffffff, 0x0) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r6, 0x400452c8, 0x0) (async) ioctl$FS_IOC_GETFSLABEL(r6, 0x400452c8, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000580)=ANY=[@ANYRESOCT=r3, @ANYRES32=r7, @ANYRES64=r5, @ANYBLOB="810000000000000023000000000000007a00000000000000810000000000000005000000000000000500000000000000060000000000000005000000000000000600000000000000a9240000008000000000000000a000000800000000000000faffffffb36b6e000201020100000000d1000000000000000a00100001"], 0xcc}, 0x1, 0x0, 0x0, 0x401c844}, 0x20000010) (async) sendmsg$nl_xfrm(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000580)=ANY=[@ANYRESOCT=r3, @ANYRES32=r7, @ANYRES64=r5, @ANYBLOB="810000000000000023000000000000007a00000000000000810000000000000005000000000000000500000000000000060000000000000005000000000000000600000000000000a9240000008000000000000000a000000800000000000000faffffffb36b6e000201020100000000d1000000000000000a00100001"], 0xcc}, 0x1, 0x0, 0x0, 0x401c844}, 0x20000010) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x3, 0x2, 0x201, 0x0, 0x0, {0x2, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x4008800) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x165142, 0x0) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x165142, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) r9 = socket$packet(0x11, 0x0, 0x300) socketpair(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r10, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0x6000, 0x0) sendmmsg(r9, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0xdd86, r11}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) readv(r8, &(0x7f0000000640)=[{&(0x7f00000003c0)=""/209, 0xd1}], 0x1) syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) (async) syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.009320803s ago: executing program 4 (id=490): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000001c0)={{0xeeee8000, 0x4, 0xe, 0xf1, 0x5, 0xfd, 0xff, 0xd4, 0x0, 0x4, 0x7, 0x4f}, {0x5000, 0x80a0000, 0xd, 0x9, 0x8, 0x3, 0x6, 0xb, 0x5, 0xf, 0x3, 0xc0}, {0xdddd0000, 0xdddd1000, 0x8, 0x3, 0x0, 0x7, 0x4, 0xd, 0x7d, 0x0, 0x6, 0x5}, {0x8000000, 0x2000, 0x8, 0xf8, 0x3, 0x46, 0x3, 0xd, 0x6, 0x3, 0x4f, 0x1}, {0x100000, 0x4000, 0x9, 0x1, 0x3, 0x9, 0x5, 0x6, 0x5, 0x7f, 0x4, 0x4b}, {0xa2000, 0x8000000, 0xb, 0x6, 0x3, 0x6e, 0x1, 0xff, 0xc, 0x90, 0x1, 0xfa}, {0x6000, 0x4000, 0x8, 0x9d, 0x3, 0x5, 0x0, 0xb, 0x5, 0x7, 0x9, 0xf8}, {0xf7f63004, 0x8000000, 0xf, 0x5, 0x28, 0x3, 0xa, 0x7, 0x54, 0x7b, 0x2, 0x7}, {0xeeef0000, 0x5}, {0x4, 0x1}, 0x0, 0x0, 0x4000, 0x300, 0x5, 0x3000, 0x8000000, [0x0, 0x401, 0x7, 0xc5]}) close_range(r0, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000580), r4) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r4, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000440)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="090327bd7000fedbdf2516000000140001800d000100fbbb61803b9a2f8de529"], 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000000)={0xb09}) 950.040244ms ago: executing program 4 (id=491): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) r1 = syz_open_dev$loop(&(0x7f0000001040), 0x4, 0x200) ioctl$LOOP_SET_BLOCK_SIZE(r1, 0x4c09, 0x5) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f00000000c0)={'veth0_to_bridge\x00', 0x400}) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000080)=0x1) setresuid(0x0, 0xee01, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0xa, 0x2, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000000680)=0xfeab) fchown(r2, r4, 0xee01) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000280), 0x46001, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454da, &(0x7f00000001c0)={'bond_slave_0\x00'}) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000000)={'dvmrp1\x00', 0x1}) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x200000a, 0x80010, r5, 0x725a5000) readv(r5, &(0x7f0000000040)=[{&(0x7f00000000c0)=""/72, 0x48}, {0x0}, {&(0x7f0000000000)=""/57, 0x39}], 0x3) r7 = syz_open_procfs(0x0, &(0x7f0000000140)='net/bnep\x00') openat2(r7, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x410000, 0x8d, 0xf}, 0x18) 898.612264ms ago: executing program 4 (id=492): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x1002, 0x0) socket(0x1e, 0x6, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x256c, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) r3 = fsopen(&(0x7f0000000140)='ext3\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v1\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000000)='test_dummy_encryption', &(0x7f0000000080)='v1\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) dup2(r1, r3) eventfd(0x8) close_range(r0, 0xffffffffffffffff, 0x0) 845.148384ms ago: executing program 1 (id=493): mkdir(&(0x7f0000000000)='./file0\x00', 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000abb000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f00005f3000/0x2000)=nil) (async) mremap(&(0x7f0000abb000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f00005f3000/0x2000)=nil) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x400, &(0x7f0000000100)=ANY=[@ANYBLOB='noswap,huge=never,nr_blocks=G']) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r0, &(0x7f0000006b40)={0x2020}, 0x206e) 778.549074ms ago: executing program 1 (id=494): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x4fa3e3ad9948be0d, {0x42}}, 0x10) bind$tipc(r1, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r2, &(0x7f0000000380)={&(0x7f0000000140)=@name={0x1e, 0x2, 0x3, {{0x42, 0x1}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x5) mmap(&(0x7f0000018000/0x2000)=nil, 0x2000, 0xa8ca3411d2c2600e, 0x13, r0, 0x22e7c000) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$uinput_user_dev(r3, &(0x7f00000000c0)={'syz0\x00', {0x0, 0x2, 0x7f, 0x3}, 0x36, [0x48000, 0xf3af, 0x7fff, 0x4, 0xb, 0x3, 0x6, 0xd0, 0x8, 0x81, 0xfffffff7, 0x43, 0x21810fcb, 0x1, 0x0, 0x0, 0x6, 0xe2, 0x7, 0x9, 0x1000, 0xfffffff7, 0x0, 0x0, 0x8, 0xfffffff1, 0x100, 0x2, 0x8, 0x424e363c, 0xffffffff, 0x7, 0x80000001, 0x7, 0x5, 0x361, 0xbb3b, 0x6ac9, 0xf9101912, 0x4, 0x4, 0x41c63120, 0x17b0, 0x1, 0x0, 0x3, 0x1, 0x4, 0x9, 0xfffffe00, 0x1000, 0x100, 0xfe0, 0x4, 0xacf6, 0x3ff, 0x6, 0x3, 0x81, 0xfffffffd, 0x101, 0x10000, 0x9, 0x3], [0x2, 0x800, 0x8, 0x1, 0x1, 0x6, 0x608, 0x1000, 0x2, 0x7, 0x4, 0x4, 0xffff, 0x8, 0x3, 0x1, 0x3, 0x3000000, 0x1e00, 0x6, 0x3e, 0x7, 0x2, 0x7, 0x7, 0x7, 0x927, 0x0, 0x1, 0x10, 0x6, 0x84000, 0x5b, 0x8, 0x9, 0x8, 0x9, 0x80000001, 0x7, 0x0, 0xfffffff8, 0x9, 0xd77, 0x0, 0x7, 0x8, 0xfffffffd, 0x3, 0x3, 0xc98f, 0x9c0, 0x0, 0x223, 0x8, 0xd262, 0x98, 0x2, 0x2, 0x10000, 0x3f, 0xf0c1, 0x101, 0x1, 0x6], [0x0, 0x4d66, 0x400, 0xfffffff8, 0xfffffffd, 0xa, 0x80000001, 0x9dc, 0x10, 0x9b2d, 0x5, 0x80000000, 0x0, 0x8, 0x8, 0x2, 0x7fff, 0x200, 0x7, 0x0, 0x3, 0x2, 0xfffffff7, 0xfffffffc, 0x4, 0x6, 0x8, 0x8, 0x1, 0x9, 0xd54, 0xfffeffff, 0x6, 0xfffffffe, 0x400, 0x7, 0x3, 0x9878, 0x77d, 0x1, 0x80000001, 0x5, 0x9, 0x1, 0xfffffff7, 0x8, 0x800, 0x40000000, 0x3, 0xff, 0x1, 0x3, 0x7, 0x9, 0x6, 0x8, 0x1c, 0x158e, 0x401, 0x5, 0x2, 0x1ed, 0x10000, 0x7f], [0x8, 0x10, 0x0, 0x2e2a17ee, 0xf, 0xbf, 0x4, 0x57, 0x4, 0x3, 0x18, 0x7, 0x8, 0x0, 0x9, 0x9, 0x81, 0x6, 0x4, 0x4, 0xa, 0x400, 0x4, 0x5, 0x52, 0x733b, 0xa1ac, 0x63ed, 0x2, 0x5, 0x6, 0xe3, 0x1, 0x8, 0x7, 0x5, 0x1ff, 0x9, 0x7ff, 0x5, 0x3, 0x9, 0x74, 0x8, 0x7, 0xfffffbff, 0x7, 0x0, 0x80000000, 0x0, 0x2, 0x28, 0x7, 0x2bfca9c7, 0x1, 0x815, 0xffffffff, 0x401, 0x5, 0xfffffff8, 0x10001, 0x6, 0x9, 0x9]}, 0x45c) 722.578275ms ago: executing program 1 (id=495): r0 = syz_open_dev$loop(&(0x7f0000000000), 0x4, 0x208100) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) r2 = accept$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, &(0x7f0000000080)=0x10) setsockopt$IP_VS_SO_SET_DELDEST(r2, 0x0, 0x488, &(0x7f00000000c0)={{0x33, @dev={0xac, 0x14, 0x14, 0xd}, 0x4e20, 0x1, 'dh\x00', 0xa1199ee941a3e80f, 0x40, 0x6c}, {@rand_addr=0x64010101, 0x4e23, 0x2, 0xb, 0x80000000, 0xc9d}}, 0x44) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='pimreg0\x00', 0x10) socket$inet(0x2, 0x1, 0xc) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4e20, 0x1, @dev={0xfe, 0x80, '\x00', 0x23}, 0x5}, 0x1c) setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000001c0), 0x3) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) connect$802154_dgram(r3, &(0x7f0000000200)={0x24, @none={0x0, 0x1}}, 0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl2\x00', 0x0, 0x4, 0x5, 0x5, 0x9, 0xb, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast1, 0x1, 0x7, 0x1, 0x4}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000440)={'syztnl2\x00', &(0x7f0000000300)={'gretap0\x00', r4, 0x81, 0x80, 0x4a5, 0xc000, {{0x3d, 0x4, 0x3, 0x0, 0xf4, 0x68, 0x0, 0x6, 0x29, 0x0, @rand_addr=0x64010102, @multicast1, {[@timestamp_addr={0x44, 0x24, 0xc0, 0x1, 0x0, [{@local, 0xf967}, {@broadcast, 0x27}, {@multicast2, 0x3}, {@multicast2, 0x8}]}, @generic={0x89, 0x5, "9ed8d3"}, @timestamp_addr={0x44, 0x14, 0x42, 0x1, 0xb, [{@broadcast, 0x70e1}, {@multicast2, 0x7}]}, @cipso={0x86, 0x56, 0x0, [{0x5, 0xd, "e8bd56e7690bc6219755e1"}, {0x7, 0xd, "53b60e948b9b80b43a988b"}, {0x2, 0xb, "0304928d36e47e9063"}, {0x7, 0x5, "6bbccc"}, {0x6, 0x5, '2FN'}, {0x6, 0xc, "13415fab4fe330ac766a"}, {0x5, 0x12, "0f00c0223fa38dafdcd61f52bdec1c7a"}, {0x1, 0x3, "bc"}]}, @cipso={0x86, 0x23, 0x0, [{0x5, 0xb, "fd7872c026d25acfc0"}, {0x6, 0x12, "3821be06d2b6edad41bc8eb907998f97"}]}, @ssrr={0x89, 0x1b, 0x46, [@dev={0xac, 0x14, 0x14, 0x15}, @loopback, @multicast2, @local, @local, @private=0xa010100]}, @generic={0x82, 0xf, "488ab40ef6d906c09b24ab526e"}]}}}}}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x35f3378b3e1edbb5}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x44, r7, 0x10, 0x70bd2d, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x1324}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x8c0}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x4eb}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}]}, 0x44}}, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r3) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000600), 0x24100, 0x0) write$tun(r8, &(0x7f0000000640)={@val={0x0, 0x8906}, @void, @x25={0x0, 0xa1, 0x1f, "7a34a109827fb91591a75eb5fe4973aeb8179053f3b2b36b7696c2adf5b8700b3dd634cde888c77daf5bad2565ef9d8d181868b41cd94a99ed5ba169a3298a9b74fe15cd017c518ccdf45c19d82fc533ab1c9a63e62c61c34fbf1b96cec48e518a06a93f3a7142871965ebe4e96a6c85aa1905fd8b6df45fc29bb4e6f03767de778f8e91ecc4a74e3219fef788d5f98be4ed"}}, 0x99) getsockopt$inet_tcp_int(r1, 0x6, 0xc, &(0x7f0000000700), &(0x7f0000000740)=0x4) close_range(r6, r6, 0x2) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000780), 0x4) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000880)={'erspan0\x00', &(0x7f00000007c0)={'syztnl2\x00', r5, 0x8000, 0x1, 0x6, 0x2, {{0x1a, 0x4, 0x1, 0xe, 0x68, 0x65, 0x0, 0x7, 0x4, 0x0, @private=0xa010100, @remote, {[@noop, @end, @ra={0x94, 0x4}, @timestamp={0x44, 0x1c, 0x34, 0x0, 0xb, [0x4c, 0x4, 0x6da87edd, 0x7, 0x8, 0x8]}, @lsrr={0x83, 0x13, 0xc6, [@local, @multicast1, @loopback, @private=0xa010102]}, @ra={0x94, 0x4}, @generic={0x22, 0x4, "aa05"}, @noop, @timestamp_addr={0x44, 0x14, 0x4f, 0x1, 0x6, [{@dev={0xac, 0x14, 0x14, 0x3a}, 0x7}, {@remote, 0x2}]}]}}}}}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000900)={0x3, &(0x7f00000008c0)=[{0x1, 0x4, 0x4e, 0x9451}, {0x5, 0x2, 0x62, 0x6}, {0x2, 0xc, 0x7, 0xffff56db}]}, 0x10) truncate(&(0x7f0000000940)='./file0\x00', 0x225e1de9) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000980)={0xffffffffffffffff}) setsockopt$TIPC_GROUP_LEAVE(r9, 0x10f, 0x88) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r10, &(0x7f0000000a80)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000a00)={0x20, 0x1, 0x9, 0x301, 0x0, 0x0, {0x7, 0x0, 0x6}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x8080}, 0x4004050) socket$nl_route(0x10, 0x3, 0x0) 722.269485ms ago: executing program 1 (id=496): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder1\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r1 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2b, &(0x7f0000000240)={0xfffffffb, {{0xa, 0x4e20, 0x0, @mcast1}}, {{0xa, 0x4e21, 0x0, @loopback, 0x8}}}, 0x108) futex(0x0, 0x86, 0x0, 0x0, 0x0, 0x40) ioctl$BINDER_FREEZE(r0, 0xc0046209, 0x0) 721.533855ms ago: executing program 1 (id=497): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167342, 0x0) (async) r1 = accept4$vsock_stream(0xffffffffffffffff, 0x0, 0x0, 0x80800) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000500)='memory.events.local\x00', 0x26e1, 0x0) close(r3) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x7101}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (async) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f00000001c0)={'batadv0\x00', 0x500}) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x30, 0x0, 0x400, 0x70bd26, 0x25dfdbfb, {{}, {}, {0x14, 0x19, {0x1, 0xfffffa96, 0x4, 0x5}}}}, 0x30}, 0x1, 0x0, 0x0, 0x20000084}, 0x4000000) (async) readv(r0, &(0x7f00000004c0)=[{&(0x7f0000002400)=""/4093, 0xffd}, {0x0}, {&(0x7f0000000540)=""/199, 0xc7}, {&(0x7f0000000640)=""/204, 0xcc}], 0x4) (async) r8 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r8, &(0x7f00000000c0), 0x10) (async) sendmsg$can_bcm(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="05000000000400000200000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0xea60, @ANYBLOB="0000003f01"], 0x48}}, 0x0) (async) r9 = gettid() (async) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.numa_stat\x00', 0x275a, 0x0) write$cgroup_subtree(r10, &(0x7f0000000100)=ANY=[], 0x32600) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r10, 0x0) (async) r11 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r11, 0x1, 0xf, &(0x7f0000000000)=0x6, 0xa) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r12 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r12, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000010c0)=ANY=[@ANYBLOB="14001e8000"/20], 0x14}], 0x1}, 0x0) (async) fstat(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(0x0, r13) (async) sendmsg$netlink(r3, &(0x7f0000000300)={&(0x7f0000000040)=@kern={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)=[{&(0x7f0000000100)={0x10, 0x25, 0x100, 0x70bd29, 0x25dfdbfb}, 0x10}, {&(0x7f0000000200)={0x18, 0x3a, 0x4, 0x70bd2d, 0x25dfdbfd, "", [@typed={0x8, 0xd, 0x0, 0x0, @ipv4=@dev={0xac, 0x14, 0x14, 0x12}}]}, 0x18}], 0x2, &(0x7f0000000280)=[@rights={{0x18, 0x1, 0x1, [r8, r6]}}, @cred={{0x1c, 0x1, 0x2, {r9, r13}}}, @rights={{0x28, 0x1, 0x1, [r7, r6, r3, r1, r2, r2]}}, @rights={{0x1c, 0x1, 0x1, [r3, r1, r6]}}], 0x80, 0x84}, 0x4000000) 697.058595ms ago: executing program 1 (id=498): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = socket$inet(0x2, 0x6, 0x55c6f6c5) setsockopt$sock_int(r4, 0x1, 0x3c, &(0x7f0000000040)=0xa, 0x4) connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) mkdir(0x0, 0x0) r5 = socket$nl_audit(0x10, 0x3, 0x9) r6 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_usb_disconnect(r6) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12015002000000086a05f4004000010203010902"], 0x0) ioctl$EVIOCRMFF(r6, 0x4004550f, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000380)={'erspan0\x00', &(0x7f0000000100)=@ethtool_rxnfc={0x31, 0xd, 0x8, {0x11, @usr_ip4_spec={@loopback, @multicast2, 0xfffffff9, 0x7f}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3d}, 0xf, 0x8, [0x7, 0xd]}, @usr_ip6_spec={@private2={0xfc, 0x2, '\x00', 0x1}, @private0={0xfc, 0x0, '\x00', 0x1}, 0x8, 0x0, 0x3}, {0x0, @broadcast, 0x0, 0x80, [0x8, 0x3]}, 0xda7c}}}) socket$igmp6(0xa, 0x3, 0x2) socket$can_bcm(0x1d, 0x2, 0x2) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001100)=ANY=[@ANYBLOB="a0000000210001000000000000000000fc0200000000000000000000000000006401010200000000000000000000000000000002000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="040000000000000050001100ac1414aa000000000000000000000000fff7ffff000000000000000000000000e0000002000000000000000000000000fe8000000000000000000000000000aa3c040000020000000a000a00"], 0xa0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmmsg$inet(r8, &(0x7f0000005280)=[{{&(0x7f00000011c0)={0x2, 0x4e24, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000001640)=[@ip_retopts={{0x1c, 0x0, 0x7, {[@lsrr={0x83, 0x7, 0x4, [@local]}, @ssrr={0x89, 0x3, 0x4e}]}}}], 0x20}}], 0x1, 0x4008000) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f00000004c0)=ANY=[@ANYBLOB="010000000000000080000040"]) close_range(r0, 0xffffffffffffffff, 0x0) 192.101649ms ago: executing program 3 (id=504): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/locks\x00', 0x0, 0x0) pread64(r0, &(0x7f00000006c0)=""/112, 0x70, 0x42) getdents(r0, &(0x7f0000000000)=""/103, 0x67) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0x3) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) lseek(r1, 0x8, 0x1) 134.629579ms ago: executing program 3 (id=505): ioctl$KVM_CLEAR_DIRTY_LOG(0xffffffffffffffff, 0xc018aec0, &(0x7f0000000080)={0x10001, 0x2c0, 0x400, &(0x7f0000000140)=[0x8, 0x6, 0x6, 0xffffffffffff6653, 0x2, 0x100000000, 0x7f, 0x1, 0x7fffffffffffffff, 0x1, 0xc, 0x6, 0x3a06, 0x4, 0x4, 0x8, 0x6, 0x7, 0x2, 0x3, 0x7, 0xc, 0x8, 0xae2a, 0x2, 0x9, 0x8cbc, 0x1, 0x7, 0x1, 0x9, 0xebe, 0x7d63, 0x9, 0x9, 0x3, 0x0, 0x4, 0x4, 0x8, 0x4, 0x6, 0x100000000, 0x9, 0x2, 0xfe, 0x8, 0x3, 0x99cd, 0x3ff, 0x6, 0xffff, 0x7, 0x2a02c2e5, 0x0, 0x100000, 0xf, 0x6, 0x7, 0x7, 0x2, 0x100000000, 0x6, 0x1, 0x0, 0xfffffffffffffffd, 0xd9d, 0xbf27, 0x34, 0x3, 0x557, 0x40, 0x7ff, 0x9, 0x8, 0x7, 0x6f, 0x99, 0x1, 0x6, 0x4, 0x9, 0x7, 0xfffffffffffffffa, 0xa, 0xa554, 0x2, 0x5e3d63a9, 0x4, 0x5, 0xebff, 0x8b, 0xffffffffffffffff, 0x29, 0xed, 0x4b, 0x2, 0x0, 0x3, 0xfff, 0x3, 0x2, 0x10, 0xffff, 0x8, 0xf, 0x9, 0x9, 0x7039, 0x2, 0x80000001, 0x5, 0x3, 0xfffffffffffffffa, 0x7f, 0x8, 0x2, 0x9, 0x4, 0x7, 0x0, 0x1, 0x0, 0x2, 0x7fff, 0xc, 0x6, 0x5]}) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x2, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1a}}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0xd}, 0x1c) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) sendmsg$inet6(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000880)="b1", 0x1}], 0x1}, 0x10) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)=[{0x0}, {&(0x7f0000000a00)}], 0x2}, 0x0) setsockopt$inet6_opts(r3, 0x29, 0x40, &(0x7f00000001c0)=ANY=[], 0xd0060) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ptrace$getsig(0x4202, 0x0, 0x100000000, &(0x7f0000005b00)) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r6, 0x400452c8, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x5c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000280)={@flat=@binder={0x73622a85, 0xa, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/7, 0x7, 0x2, 0x21}, @fda={0x66646185, 0x9, 0x0, 0x29}}, &(0x7f0000000100)={0x0, 0x18, 0x40}}, 0x1000}, @clear_death={0x400c630f, 0x1}], 0x56, 0x0, &(0x7f0000000380)="f22439c47e109c6096ea2bae1f7d03b8c44245ee48a8a255e0db445a21505ddddb4f9e2515db95a1de45d524bb52899f326bab2c88053f7a7475b3ec0373c50a7a4d67df5fde31db1a31325bebcf85b344c0596e65b8"}) writev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f00000000c0)="480000001500257f09004b01fcfc8c860a881300f217e006", 0x18}], 0x1) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_buf(r7, 0x0, 0x40, &(0x7f0000000080)="8c5d7b87b32ecae06ac8cfe890364ab911d8c33439477a7591f6914e91c6821ee7163f8ae1896184d48797997716158aad89f66dd67480ce8ff178ef748cfcdcf54127d5ff95cbcaebf10a3b7cddafa2c0fa6aa2eaef0d457680203c02d0c623", 0x60) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000059c0)=ANY=[@ANYBLOB="cc0000001b0001032dbd7000fbdbdf25ac1414aa000000000000000000000000fe8000000000000000000000000000aa4e2300004e2300080200802084000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000001040000000000000500000000000000f8000000000000005e0000000000000001000000040000002f060000000000000c00000000000000f8fffffffffffffffaffffffffffff7fff01000000000000f9ffffffc06b6e00020003010000000002000000000000000a00100000000000000000009f13b20da71bf681aeb265e70cc0eb68d8840193732a717a8e6d002a55d91da378e1c147138d66122dfa6d8e1c914742c2695851dfb10c38461aaec16599be462bb30872a5bbe736f1d2c8492f3acb9d720ec3950eba13f3cccb1e1fa282e0434854c3a087196b8560474458ea90"], 0xcc}}, 0x0) r9 = socket(0x10, 0x803, 0x0) sendto(r9, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r9, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) bind$802154_raw(r9, &(0x7f0000002400)={0x24, @long={0x3, 0xffff, {0xaaaaaaaaaaaa0302}}}, 0x14) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) 103.247629ms ago: executing program 3 (id=506): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x4000, 0x0) readv(r0, &(0x7f0000000140)=[{&(0x7f0000001400)=""/4096, 0x1000}, {0x0}], 0x2) 86.725769ms ago: executing program 3 (id=507): r0 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000000)) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000040), 0x0, 0x0, 0x1) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', &(0x7f0000000140), 0x104800, &(0x7f0000000000)=ANY=[@ANYBLOB="6673636f6e74651d35998b"]) 86.23768ms ago: executing program 3 (id=508): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000100)=@nameseq={0x1e, 0x1, 0x1, {0x42, 0x0, 0x1}}, 0x10) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x6000009, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_X86_SET_MSR_FILTER(0xffffffffffffffff, 0x4188aec6, &(0x7f0000002cc0)={0x1, [{0x0, 0x4d88, 0x6, &(0x7f0000000640)="7a650e526bd0998268bb5847d9beacc47a22df873eab4b8b91133675482eaa56ace8db59bed9aa07d4e390c7c9f98c462b55612196911e3c4e510ede3efde35eec990f22a76cf752e507c1e2de2920a9fc0790cc176bd2b901e4127b09835ae6d0d196048bb19a64d26f20a05b95c69f371882ef2e20c5606ed1b2ebcf09a4a333f6e1c3c4fb64d8182df4ab09d0a381d966977fc041cea9bdf0aa31fe51efe9211b9b8e6e4551b6438f8efcc41265574ff6504435eb22a678a99768f0327ded8fdcb41f27c2024d2b923f7dc5df5bf62af447b121dd9f94d766d6cebdeb02f611ab10e57af4b3268fb3f9777373bd5fd6b82f730e67c4eab113d8e65d7405be3e5d92dc5e7e85d34bb8b7c894cbed629ecc25c288b3d4556a85a1e2150cac5b686a8de29ab7c35040b77875bfa0e451dc0869cfe105bd115e7cf48f44dfdf26be65f3b727fd88d6395d051e49c060998e84b19377fcb20fe2eb392335e5a9d84555ef037aab37169ce761aa8a8ec08ea87e3a3b896f3d1b2380bc8256e0f7ea7dc488382e6112b53a7bb269d6261f87e0e0e0cef9152f8a67f412148f34880c970101fbd7b0e8fc49d6a5c87e487b7b175b15be26b6b8e1ed8527614dcefcfd80f8392560c8b706418b7de8fbb7a666a7e7f322dc70373606bf39efa04616cb99d662dfc591061bde5ed27a66aa7edbfec1eb0b1e843c372b84c3ed514a0aadf523b8669e526765d429824aeaa0a6f4c185754d437d977a1f586431dc256ce5aa7c25be259de3a0ae6e5bcdf56b4c7e8199fe6b461e78467cfac19de6956056ef57e93d3a7df8f646f4a9002b100edb0a6caa72b3f6eb29dc54de58120d27daff9cd61c64107e1bcb3b3212e1e2aa24fb24dc2dafc636c82ad25da9d934e46c7783d8f915337612feb348857ce2262240dfe51ec94d9d61074959f167b9840b20f003883bf167149228d7f03eafde851427cd1966a96aeae05b51ae4cd82f4b4dad60a070c01a8b500e2683f7136e331602e76845262825d7f3764cf1a05ad95d88aab71d41484f63fa6a43c044c7f03130552321933bc40b888fd0cc55939ff79a5059516f3b80c7ba8188ffb6a259a34567ee52c1f9df0f6c91737d688e36d076a49d1045cac30d5ed52a10381c96d9f22e469cc531bb06853d18b8f8625d2a917e795ffa4407fa75713510a3f5370e1ecbf7a5ff68a90a1eda077531cf4d399d4908f138c936e1931c72240070c6a6255f5fd03966e9a06c1d481e8e3d128e880776e572177780a3481c49bd86c174e152bafed245d58ef3428c645b08e48833960d1b5223d7be0c67a2b2c7531390d1837a84ed004a00cb4b0cd6e78824da032b48c49ec006d14206dc3d0c67d7ca87e9ea0faddc3e0b0c917c64eefeebf79e3a16c958db63a08a5d4d7210273aba3e56a4cd4cccb044750ff97749505ff1332b2dd30990849ab1500e1947d0abfb0c59760f0a502806ee1bce56fbb42251dd6ac8b709c73a6b8c548c2b23cf351dc498810e477bd082464e76702703b56d3cd2f3d8a2e00f19d8ffa3c236d3601f169c9dfe9c316f8cbe63c3801a51ea5ac785694a0c653cd28d68c5a81c2590d2aeea8c8688b2e88f46c4f99890e51b42cce485fcb4d91557fb3912b36b0dbeac8df44e945eb9937141402fb2aa1476185e1f8c37f6c98bc937f36d9c7237135132a54a03067b002b9c657ab0daa253af66eee78b0309cb8532dd2dee800c8349b731da0efa66ead82eebe0102279df5aa281fe1d86c0dbf154910d5e8a113ecbddbd046367b9e2acfa7cc406f61b472bbec6919534615ed81b664da956ce6586bf4c92d63ef371dfec5f9ce748931d585cadc9372a95a1372c7213e2c52fca253945afeee02e9f2de2d9452c85fd2dbdc87cb6c25697dfcbed8a0eba381835e6c360f3861367ec98a9a9ccf956d6cbfb706fee0d391cf82a0d4662792274f52fc2b5d72a43ec74a86400e62d3652f607774cfad1504bc0476570d532b527bf0d7012804b2e6fdf9a9414f10b16c9374f2b065348d865b309e37750d3a7e12394e356c48c9fa0d4a9a43f689f6cbf70b09a3b9782cc3d5d93480f8a7a21a049780fc6bf21f1eca938a37afcbb2b929a0c502e164d2571e78d214b359d97e3edc0ad5c7fd1625b4ece33e1f569676e9a7262ead857873f77ef149d2f8c5a09ab19ae384a7f957f612a24283c35327aa969b20711309644c5b3e6c89da94e1f5da54246bd771468a1adc8a8d601e0b12769604f0f07ca43ce2a8a2f4b5654c0b76b146c49038e07db54dae702580b97096911f034fc1797029de8b7c213c902d1d754e77ff85e6222e745db9d5d2d45c5d29a8b6de0f27e5701fdf12b09fd6c70baa0f85a424c21ce0796dbe1fd366b94fcdf64ea232b3e88b89a38d728de77e84decc804f07a48f2716ca6f76b24923cea1a4da0d1f1dc73611269e784c4fd921f9b26c11f35b5cda45842a81b603ce2155d95c273fa0743a571b52e68c9ea3f28009fc37406b9e329ce50fedfb20dfb4cdf3a94769aee2586c2a17e68a07abfcd18aceddfd3876b14558e4d092eadb9120796c44e89610494085117bc41b5c4619a8c160b97811df49fc7d9bf222d7a002640644337ef5af53ed50661131f7c042665b276c0adf0c9a74f3542729beb7632a6027e65eddff7bb27915826701ec9b6a4c672f08877eefd859e0aa6e75a2e841e1ea98dff994e5a58be628df86bff17497a4d0f92ab39db421eb1062a2a393656bbb1d92becbb91a59619156b51585cd2eafd8a18d6326166312efeaa7258bddad63e0c7372ffb7ce1f1adf1ac2ffa0f278e4be6684d762f8971ed7bb04096b96f8126bf5fd32142e745d421f495327dde0f1e2d9a1d8ba63c1453101396a2e54e89cdabac2c6a01f23a5c1d5a2dfa2a3c634176e97c9c62b41ea28102b5a08af2fba1d311bb323df086ea97726c9d8c7b7b53a3399a80f040d434fdcc2148fb1da3b7d7f0f3e3fd56471a310ee275da611c79f86be8ed6343f6ed0ad91dfeffebc3ab6389d0566d6db904c1db499ae7d2698fdc7170320f85cc3d3d0d9d0d0c7d45db7b53c5eb79a2fed2a048d9d74419532122fac62f6315a9e13b461cb4e26514491debd366927987271be963ea5805a49b8b480c6a393fda1b11fd5634890cf02948cb5bfea237afb30d081c7403cd334a02e5bb8db542c4d5fa5ec5c8a0dd36b62156881c98e01948b4775a502c5d8453439fd930df52caac9d71c28b712000b306b913c10918ca0bc194f2533334462e5cd2b2e6c978a4838febfbc2d4375b8108bd0aa32aeaf05e7ba30c781cace6470ead574f5cbfa68aa8c8d835e9b3ab2bd7dd90b5e3e6cd62d8e04c3b45326e1f560a8dd8f3db4177e9e5ccd61f21dacb5c40c8030559cdfe88f7aa98bdcde90c1214cf293b3df093d0630bc3073cbaffa025b1f5537b49d799731745de7d36cded4a9db25915a511ba505b4ddd885cd226c24ea37fd926dbd90b887"}, {0x0, 0x0, 0x41ff7484, 0x0}, {0x0, 0x0, 0x100d5ba, 0x0}, {0x2, 0x0, 0x4, 0x0}, {0x0, 0x0, 0x9, 0x0}, {0x0, 0x0, 0x3, 0x0}, {0x2, 0x0, 0xa2d, 0x0}, {0x1, 0x0, 0x1, 0x0}, {0x1, 0x0, 0xf3f, 0x0}, {0x4, 0x0, 0x1000, 0x0}, {0x3, 0x0, 0x6, 0x0}, {0x3, 0x0, 0x1000, 0x0}, {0x2, 0x0, 0x8, 0x0}, {0x0, 0x0, 0x1543, 0x0}, {0x3, 0x0, 0x3, 0x0}, {0x1, 0x0, 0x40007, 0x0}]}) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001000)='/proc/consoles\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000006380)={0x2020}, 0x2020) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x3b) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1b) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0xfffff000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000040)={0x4, 0x1, 0x0, 0x2000, &(0x7f000079c000/0x2000)=nil}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$tipc(0x1e, 0x5, 0x0) socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000200)=@name={0x1e, 0x2, 0x3, {{0x41, 0x1}, 0x2}}, 0x10) sendmsg$tipc(r4, &(0x7f0000000380)={&(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x80000009}}}, 0x10, 0x0}, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x101, 0x2}) socket$packet(0x11, 0x2, 0x300) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r6, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) sendto$inet(r6, &(0x7f00000004c0)="3ce2de4d8d", 0x5, 0x805, 0x0, 0x0) recvmmsg(r6, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000003100)=""/4099, 0x1003}], 0x1}, 0x100}], 0x1, 0x10022, 0x0) r7 = socket(0x2, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) 0s ago: executing program 3 (id=509): sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000001c0)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x27f, @mcast2, 0xffff}, 0x1c, 0x0}}], 0x1, 0x4400c800) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000280)={0x73622a85, 0x1000, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x2, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) (async) mkdir(&(0x7f0000000040)='./file0\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x50) (async, rerun: 64) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) (rerun: 64) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x1000000, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) (async, rerun: 64) mkdir(0x0, 0x0) (async, rerun: 64) mount$incfs(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='./file1\x00', &(0x7f0000000380), 0x80, &(0x7f0000000580)={[{@rlog_wakeup_cnt={'rlog_wakeup_cnt', 0x3d, 0x6}}, {@rlog_pages={'rlog_pages', 0x3d, 0x10001}}, {@read_timeout_ms={'read_timeout_ms', 0x3d, 0xcf}}, {@readahead={'readahead', 0x3d, 0x1}}, {@rlog_wakeup_cnt={'rlog_wakeup_cnt', 0x3d, 0x7ff}}]}) setxattr$system_posix_acl(&(0x7f0000000000)='./bus\x00', &(0x7f0000000040)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x2}, [], {0x4, 0x1}, [{0x8, 0x1}], {0x10, 0x1}}, 0x2c, 0x3) getxattr(&(0x7f0000000100)='./bus\x00', &(0x7f0000000140)=@known='system.posix_acl_access\x00', 0x0, 0xed) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0x0, 0x1000000, 0x0}) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0) (async) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000140)="d2ffb49ede31518d65a476b76e4a4e0b75db47c327ab597233001000006db41df04709094056af33a6db1e301a74db81f27f6aa6a8ca9d22a565ff96d46e88fa99b284c26c46494072fc2e47da240c71"}) (async, rerun: 32) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000640)={0x8, 0x0, &(0x7f0000000000)=[@decrefs={0x40086315}], 0x0, 0x0, 0x0}) (rerun: 32) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.63' (ED25519) to the list of known hosts. [ 22.333761][ T36] audit: type=1400 audit(1762402580.989:64): avc: denied { mounton } for pid=281 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.334788][ T281] cgroup: Unknown subsys name 'net' [ 22.356410][ T36] audit: type=1400 audit(1762402580.989:65): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.383686][ T36] audit: type=1400 audit(1762402581.029:66): avc: denied { unmount } for pid=281 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.383867][ T281] cgroup: Unknown subsys name 'devices' [ 22.550999][ T281] cgroup: Unknown subsys name 'hugetlb' [ 22.556593][ T281] cgroup: Unknown subsys name 'rlimit' [ 22.708106][ T36] audit: type=1400 audit(1762402581.359:67): avc: denied { setattr } for pid=281 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.731258][ T36] audit: type=1400 audit(1762402581.359:68): avc: denied { mounton } for pid=281 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.755982][ T36] audit: type=1400 audit(1762402581.359:69): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.763959][ T283] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.787781][ T36] audit: type=1400 audit(1762402581.439:70): avc: denied { relabelto } for pid=283 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.813203][ T36] audit: type=1400 audit(1762402581.439:71): avc: denied { write } for pid=283 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.826635][ T281] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.838802][ T36] audit: type=1400 audit(1762402581.489:72): avc: denied { read } for pid=281 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.872968][ T36] audit: type=1400 audit(1762402581.489:73): avc: denied { open } for pid=281 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.137300][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.144367][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.151568][ T289] bridge_slave_0: entered allmulticast mode [ 24.157718][ T289] bridge_slave_0: entered promiscuous mode [ 24.164648][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.171758][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.178788][ T288] bridge_slave_0: entered allmulticast mode [ 24.185139][ T288] bridge_slave_0: entered promiscuous mode [ 24.192633][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.199691][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.206723][ T288] bridge_slave_1: entered allmulticast mode [ 24.212924][ T288] bridge_slave_1: entered promiscuous mode [ 24.221059][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.228078][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.235153][ T289] bridge_slave_1: entered allmulticast mode [ 24.241312][ T289] bridge_slave_1: entered promiscuous mode [ 24.292925][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.299984][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.307002][ T290] bridge_slave_0: entered allmulticast mode [ 24.313246][ T290] bridge_slave_0: entered promiscuous mode [ 24.325533][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.332571][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.339619][ T290] bridge_slave_1: entered allmulticast mode [ 24.345758][ T290] bridge_slave_1: entered promiscuous mode [ 24.375429][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.382529][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.389739][ T291] bridge_slave_0: entered allmulticast mode [ 24.395848][ T291] bridge_slave_0: entered promiscuous mode [ 24.402180][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.409256][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.416287][ T291] bridge_slave_1: entered allmulticast mode [ 24.422522][ T291] bridge_slave_1: entered promiscuous mode [ 24.521524][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.528554][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.535824][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.542854][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.564570][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.571619][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.578853][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.585882][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.602731][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.609816][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.617048][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.624075][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.637119][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.644163][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.651425][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.658447][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.695474][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.702753][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.710320][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.717454][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.724598][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.732235][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.739430][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.746533][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.759721][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.766744][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.780436][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.787459][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.796136][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.803170][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.820644][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.827658][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.859792][ T290] veth0_vlan: entered promiscuous mode [ 24.867710][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.874742][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.882240][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.889267][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.896743][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.903780][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.911283][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.918287][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.935982][ T288] veth0_vlan: entered promiscuous mode [ 24.954872][ T288] veth1_macvtap: entered promiscuous mode [ 24.962511][ T290] veth1_macvtap: entered promiscuous mode [ 24.978059][ T289] veth0_vlan: entered promiscuous mode [ 25.005265][ T291] veth0_vlan: entered promiscuous mode [ 25.016572][ T289] veth1_macvtap: entered promiscuous mode [ 25.028794][ T290] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 25.047250][ T291] veth1_macvtap: entered promiscuous mode [ 25.088716][ T333] tc_dump_action: action bad kind [ 25.185617][ T353] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.203060][ T354] rust_binder: Write failure EFAULT in pid:2 [ 25.284429][ T361] rust_binder: Write failure EFAULT in pid:19 [ 25.321478][ T365] rust_binder: Error while translating object. [ 25.327680][ T365] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 25.335034][ T365] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:23 [ 25.370454][ T329] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 25.539489][ T329] usb 3-1: Using ep0 maxpacket: 16 [ 25.545782][ T329] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 25.558278][ T329] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 16 [ 25.576046][ T329] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 25.585407][ T329] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 25.586868][ T378] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 25.593558][ T329] usb 3-1: SerialNumber: syz [ 25.607004][ T378] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 25.619715][ T329] usb 3-1: bad CDC descriptors [ 25.626050][ T378] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 25.640560][ T378] tipc: Started in network mode [ 25.645444][ T378] tipc: Node identity ac14, cluster identity 4711 [ 25.652020][ T378] tipc: Enabling of bearer rejected, failed to enable media [ 25.829755][ T342] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.839004][ T342] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.855360][ T330] usb 3-1: USB disconnect, device number 2 [ 25.885856][ T384] ======================================================= [ 25.885856][ T384] WARNING: The mand mount option has been deprecated and [ 25.885856][ T384] and is ignored by this kernel. Remove the mand [ 25.885856][ T384] option from the mount to silence this warning. [ 25.885856][ T384] ======================================================= [ 25.946051][ T387] netlink: 8540 bytes leftover after parsing attributes in process `syz.2.17'. [ 25.957684][ T387] netlink: 4 bytes leftover after parsing attributes in process `syz.2.17'. [ 25.988700][ T394] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 25.988730][ T394] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:17 [ 26.359846][ T419] SELinux: security_context_str_to_sid (sytem_uÝGй) failed with errno=-22 [ 26.379168][ T391] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.538159][ T391] usb 2-1: config index 0 descriptor too short (expected 7768, got 18) [ 26.549685][ T432] rust_binder: Error while translating object. [ 26.549732][ T432] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 26.555954][ T432] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:49 [ 26.565578][ T391] usb 2-1: New USB device found, idVendor=0483, idProduct=3747, bcdDevice=52.4d [ 26.588587][ T391] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.598934][ T391] usb 2-1: config 0 descriptor?? [ 26.605990][ T391] ftdi_sio 2-1:0.0: Ignoring interface reserved for JTAG [ 26.608168][ T435] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 26.652654][ T447] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 26.667562][ T452] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:33 [ 26.675294][ T452] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 26.684380][ T452] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:33 [ 26.707303][ T454] rust_binder: Failed to allocate buffer. len:1192, is_oneway:false [ 26.742502][ T458] input: syz0 as /devices/virtual/input/input4 [ 26.795979][ T467] cgroup2: Unknown parameter 'euid' [ 26.803616][ T470] overlayfs: overlapping lowerdir path [ 26.806691][ T411] rust_binder: Write failure EFAULT in pid:6 [ 26.819982][ T330] usb 2-1: USB disconnect, device number 2 [ 27.019230][ T488] rust_binder: Error while translating object. [ 27.019283][ T488] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 27.025609][ T488] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:54 [ 27.085780][ T495] netlink: 'syz.2.52': attribute type 12 has an invalid length. [ 27.329188][ T329] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 27.371832][ T36] kauditd_printk_skb: 133 callbacks suppressed [ 27.371847][ T36] audit: type=1400 audit(1762402586.029:207): avc: denied { create } for pid=517 comm="syz.1.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 27.398914][ T518] tipc: Started in network mode [ 27.419152][ T518] tipc: Node identity 1, cluster identity 4711 [ 27.425319][ T518] tipc: Node number set to 1 [ 27.439516][ T518] tipc: Cannot configure node identity twice [ 27.445552][ T36] audit: type=1400 audit(1762402586.029:208): avc: denied { connect } for pid=517 comm="syz.1.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 27.449610][ T518] netlink: 4 bytes leftover after parsing attributes in process `syz.1.59'. [ 27.480060][ T36] audit: type=1400 audit(1762402586.059:209): avc: denied { ioctl } for pid=509 comm="syz.3.58" path="/dev/rnullb0" dev="devtmpfs" ino=31 ioctlcmd=0x125f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 27.504849][ T518] netlink: 16 bytes leftover after parsing attributes in process `syz.1.59'. [ 27.523437][ T329] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.538696][ T329] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.558165][ T329] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 27.576074][ T36] audit: type=1400 audit(1762402586.229:210): avc: denied { ioctl } for pid=520 comm="syz.1.60" path="socket:[4613]" dev="sockfs" ino=4613 ioctlcmd=0xf504 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 27.576684][ T521] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=521 comm=syz.1.60 [ 27.609143][ T329] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 27.629594][ T522] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pid=522 comm=syz.1.60 [ 27.649140][ T329] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.657644][ T36] audit: type=1400 audit(1762402586.229:211): avc: denied { bind } for pid=520 comm="syz.1.60" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 27.679630][ T329] usb 3-1: config 0 descriptor?? [ 27.699171][ T36] audit: type=1400 audit(1762402586.339:212): avc: denied { ioctl } for pid=520 comm="syz.1.60" path="socket:[4615]" dev="sockfs" ino=4615 ioctlcmd=0x5410 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 27.739132][ T36] audit: type=1400 audit(1762402586.339:213): avc: denied { bind } for pid=520 comm="syz.1.60" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 27.776082][ T36] audit: type=1400 audit(1762402586.339:214): avc: denied { accept } for pid=520 comm="syz.1.60" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 27.779991][ T529] rust_binder: 23: no such ref 0 [ 27.819185][ T36] audit: type=1400 audit(1762402586.359:215): avc: denied { create } for pid=523 comm="syz.1.61" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 27.834495][ T534] rust_binder: 28: no such ref 0 [ 27.848794][ T534] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 27.848812][ T534] rust_binder: Read failure Err(EFAULT) in pid:28 [ 27.849844][ T36] audit: type=1400 audit(1762402586.419:216): avc: denied { bind } for pid=523 comm="syz.1.61" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 27.865580][ T534] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 28.092776][ T329] plantronics 0003:047F:FFFF.0001: unknown main item tag 0xd [ 28.100989][ T329] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 28.110512][ T329] plantronics 0003:047F:FFFF.0001: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 28.123029][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 28.208125][ T546] netlink: 12 bytes leftover after parsing attributes in process `syz.3.67'. [ 28.217741][ T546] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 28.279164][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 28.285301][ T9] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.296208][ T9] usb 1-1: config 0 interface 0 has no altsetting 0 [ 28.302824][ T9] usb 1-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 28.311848][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.320256][ T9] usb 1-1: config 0 descriptor?? [ 28.361013][ T391] usb 3-1: USB disconnect, device number 3 [ 28.463356][ T560] overlay: ./file0 is not a directory [ 28.479162][ T330] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 28.533433][ T537] capability: warning: `syz.0.64' uses deprecated v2 capabilities in a way that may be insecure [ 28.543377][ T564] rust_binder: Failed to allocate buffer. len:4224, is_oneway:false [ 28.544336][ T537] incfs_lookup_dentry err:-13 [ 28.557158][ T537] incfs: Can't find or create .index dir in ./bus [ 28.558966][ T567] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem [ 28.564176][ T537] incfs: mount failed -13 [ 28.630526][ T330] usb 4-1: config 0 has an invalid descriptor of length 220, skipping remainder of the config [ 28.640952][ T330] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 28.643693][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 28.653514][ T330] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 28.656611][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 28.671018][ T330] usb 4-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 28.681047][ T9] usb 1-1: USB disconnect, device number 2 [ 28.686292][ T330] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.699875][ T330] usb 4-1: Product: syz [ 28.704021][ T330] usb 4-1: Manufacturer: syz [ 28.708580][ T330] usb 4-1: SerialNumber: syz [ 28.713788][ T330] usb 4-1: config 0 descriptor?? [ 28.718981][ T550] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 28.726852][ T330] dm9601 4-1:0.0: probe with driver dm9601 failed with error -22 [ 28.819177][ T538] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 28.933925][ T579] binder: Bad value for 'defcontext' [ 28.970134][ T538] usb 2-1: config 1 has an invalid interface number: 105 but max is 0 [ 28.978302][ T538] usb 2-1: config 1 has no interface number 0 [ 28.984427][ T538] usb 2-1: config 1 interface 105 has no altsetting 0 [ 28.992393][ T538] usb 2-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=31.6d [ 29.001427][ T538] usb 2-1: New USB device strings: Mfr=107, Product=102, SerialNumber=146 [ 29.009934][ T584] devpts: called with bogus options [ 29.009961][ T538] usb 2-1: Product: syz [ 29.019298][ T538] usb 2-1: Manufacturer: syz [ 29.023892][ T538] usb 2-1: SerialNumber: syz [ 29.174353][ T588] rust_binder: Failed to allocate buffer. len:120, is_oneway:false [ 29.200092][ T591] netlink: 8540 bytes leftover after parsing attributes in process `syz.0.85'. [ 29.217066][ T591] netlink: 4 bytes leftover after parsing attributes in process `syz.0.85'. [ 29.275367][ T330] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 29.419152][ T330] usb 3-1: device descriptor read/64, error -71 [ 29.658901][ T603] rust_binder: Write failure EFAULT in pid:95 [ 29.662637][ T330] usb 3-1: device descriptor read/64, error -71 [ 29.688545][ T609] rust_binder: 99: no such ref 0 [ 29.693583][ T609] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:99 [ 29.695070][ T609] rust_binder: Error in use_page_slow: ESRCH [ 29.704288][ T609] rust_binder: use_range failure ESRCH [ 29.710348][ T609] rust_binder: Failed to allocate buffer. len:104, is_oneway:true [ 29.715851][ T609] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 29.723725][ T609] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:99 [ 29.741284][ T612] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 29.750268][ T612] rust_binder: Read failure Err(EFAULT) in pid:104 [ 29.760270][ T613] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 29.766834][ T613] rust_binder: Read failure Err(EFAULT) in pid:104 [ 29.833829][ T569] rust_binder: Error while translating object. [ 29.840743][ T569] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 29.846923][ T569] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:48 [ 29.857432][ T569] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 29.868237][ T626] rust_binder: Failed to allocate buffer. len:1160, is_oneway:false [ 29.909162][ T330] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 29.975656][ T630] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 29.996035][ T538] aqc111 2-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 30.024474][ T538] aqc111 2-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 30.041463][ T634] kvm: kvm [549]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 30.059399][ T634] kvm: kvm [549]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 30.059418][ T538] aqc111 2-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 30.069051][ T330] usb 3-1: device descriptor read/64, error -71 [ 30.088386][ T538] aqc111 2-1:1.105 eth1: register 'aqc111' at usb-dummy_hcd.1-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 8e:b3:62:7d:89:67 [ 30.111441][ T538] usb 2-1: USB disconnect, device number 3 [ 30.129617][ T538] aqc111 2-1:1.105 eth1: unregister 'aqc111' usb-dummy_hcd.1-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 30.171039][ T538] aqc111 2-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 30.180471][ T538] aqc111 2-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 30.190218][ T538] aqc111 2-1:1.105 eth1 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 30.329166][ T330] usb 3-1: device descriptor read/64, error -71 [ 30.449224][ T330] usb usb3-port1: attempt power cycle [ 30.619157][ T538] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 30.749187][ T538] usb 2-1: device descriptor read/64, error -71 [ 30.789167][ T330] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 30.810144][ T330] usb 3-1: device descriptor read/8, error -71 [ 30.940212][ T330] usb 3-1: device descriptor read/8, error -71 [ 30.989176][ T538] usb 2-1: device descriptor read/64, error -71 [ 31.189156][ T330] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 31.210126][ T330] usb 3-1: device descriptor read/8, error -71 [ 31.229184][ T538] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 31.291890][ T9] usb 4-1: USB disconnect, device number 2 [ 31.309806][ T700] rust_binder: validate_parent_fixup: new_min_offset=18, sg_entry.length=0 [ 31.309820][ T700] rust_binder: Error while translating object. [ 31.318454][ T700] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 31.324662][ T700] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:51 [ 31.334061][ T700] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 31.343126][ T700] rust_binder: Read failure Err(EFAULT) in pid:51 [ 31.351972][ T330] usb 3-1: device descriptor read/8, error -71 [ 31.370030][ T538] usb 2-1: device descriptor read/64, error -71 [ 31.469198][ T330] usb usb3-port1: unable to enumerate USB device [ 31.619148][ T538] usb 2-1: device descriptor read/64, error -71 [ 31.709166][ T9] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 31.729211][ T538] usb usb2-port1: attempt power cycle [ 31.860487][ T708] /dev/rnullb0: Can't open blockdev [ 31.860875][ T9] usb 4-1: config 0 interface 0 altsetting 66 endpoint 0x81 has invalid wMaxPacketSize 0 [ 31.877177][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 31.884039][ T9] usb 4-1: New USB device found, idVendor=04b4, idProduct=0001, bcdDevice= 0.00 [ 31.893116][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.903702][ T9] usb 4-1: config 0 descriptor?? [ 31.924317][ T710] netlink: 'syz.0.113': attribute type 29 has an invalid length. [ 31.932070][ T710] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.113'. [ 31.942278][ T710] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=44 sclass=netlink_audit_socket pid=710 comm=syz.0.113 [ 32.029432][ T717] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 32.069178][ T538] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 32.102365][ T538] usb 2-1: device descriptor read/8, error -71 [ 32.209214][ T734] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 32.234083][ T538] usb 2-1: device descriptor read/8, error -71 [ 32.239386][ T738] 9pnet_fd: Insufficient options for proto=fd [ 32.279142][ T10] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 32.310413][ T9] cypress 0003:04B4:0001.0002: item fetching failed at offset 3/7 [ 32.318365][ T9] cypress 0003:04B4:0001.0002: parse failed [ 32.324413][ T9] cypress 0003:04B4:0001.0002: probe with driver cypress failed with error -22 [ 32.430244][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 32.441176][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 32.450897][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 32.463770][ T10] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 32.472798][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.480812][ T538] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 32.488835][ T10] usb 1-1: config 0 descriptor?? [ 32.499176][ T585] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 32.500155][ T538] usb 2-1: device descriptor read/8, error -71 [ 32.513318][ T36] kauditd_printk_skb: 43 callbacks suppressed [ 32.513331][ T36] audit: type=1400 audit(1762402591.169:260): avc: denied { map } for pid=701 comm="syz.3.110" path="socket:[5727]" dev="sockfs" ino=5727 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 32.513367][ T702] mmap: syz.3.110 (702): VmData 29077504 exceed data ulimit 68. Update limits or use boot option ignore_rlimit_data. [ 32.556209][ T702] binder: Unknown parameter 'contextÌðÔð[7’' [ 32.640119][ T538] usb 2-1: device descriptor read/8, error -71 [ 32.649226][ T585] usb 3-1: Using ep0 maxpacket: 16 [ 32.655373][ T585] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 32.664121][ T585] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 32.674213][ T585] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 32.684446][ T585] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 32.693499][ T585] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.701523][ T585] usb 3-1: Product: syz [ 32.705684][ T585] usb 3-1: Manufacturer: syz [ 32.710281][ T585] usb 3-1: SerialNumber: syz [ 32.749231][ T538] usb usb2-port1: unable to enumerate USB device [ 32.904518][ T10] plantronics 0003:047F:FFFF.0003: No inputs registered, leaving [ 32.913491][ T10] plantronics 0003:047F:FFFF.0003: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 33.068737][ T10] usb 4-1: USB disconnect, device number 3 [ 33.078580][ T36] audit: type=1400 audit(1762402591.729:261): avc: denied { setopt } for pid=742 comm="syz.3.124" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.081586][ T743] capability: warning: `syz.3.124' uses 32-bit capabilities (legacy support in use) [ 33.099043][ T36] audit: type=1400 audit(1762402591.739:262): avc: denied { getopt } for pid=742 comm="syz.3.124" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.128337][ T36] audit: type=1400 audit(1762402591.739:263): avc: denied { ioctl } for pid=742 comm="syz.3.124" path="socket:[6316]" dev="sockfs" ino=6316 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.130785][ T538] usb 1-1: USB disconnect, device number 3 [ 33.155082][ T585] usb 3-1: 0:2 : does not exist [ 33.164819][ T36] audit: type=1400 audit(1762402591.779:264): avc: denied { append } for pid=721 comm="syz.0.117" name="binder1" dev="binder" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 33.166597][ T747] netlink: 72 bytes leftover after parsing attributes in process `syz.3.125'. [ 33.253391][ T36] audit: type=1400 audit(1762402591.909:265): avc: denied { setopt } for pid=749 comm="syz.3.126" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 33.279835][ T750] rust_binder: Write failure EFAULT in pid:62 [ 33.280050][ T36] audit: type=1400 audit(1762402591.939:266): avc: denied { ioctl } for pid=749 comm="syz.3.126" path="socket:[5748]" dev="sockfs" ino=5748 ioctlcmd=0x6722 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 33.316785][ T753] netlink: 44 bytes leftover after parsing attributes in process `syz.3.127'. [ 33.379632][ T753] rust_binder: Write failure EFAULT in pid:65 [ 33.387228][ T36] audit: type=1400 audit(1762402592.039:267): avc: denied { write } for pid=755 comm="syz.1.128" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 33.560489][ T585] usb 3-1: 1:0: cannot get min/max values for control 2 (id 1) [ 33.571373][ T585] usb 3-1: USB disconnect, device number 8 [ 33.608138][ T36] audit: type=1400 audit(1762402592.259:268): avc: denied { mount } for pid=764 comm="syz.3.131" name="/" dev="ramfs" ino=5823 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 33.628637][ T769] input: syz1 as /devices/virtual/input/input9 [ 33.879164][ T10] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 33.899137][ T330] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 33.969149][ T538] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 34.030143][ T10] usb 2-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 34.040279][ T10] usb 2-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 34.050177][ T10] usb 2-1: config 1 interface 0 has no altsetting 0 [ 34.057956][ T10] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 34.060245][ T330] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 34.067002][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.078159][ T330] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 34.096348][ T10] usb 2-1: Product: syz [ 34.100723][ T10] usb 2-1: Manufacturer: syz [ 34.101384][ T330] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a5, bcdDevice= 0.40 [ 34.105433][ T10] usb 2-1: SerialNumber: syz [ 34.114594][ T330] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 34.127481][ T330] usb 4-1: SerialNumber: syz [ 34.128734][ T538] usb 1-1: not running at top speed; connect to a high speed hub [ 34.132139][ T769] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 34.140764][ T538] usb 1-1: config 2 has an invalid interface number: 216 but max is 3 [ 34.149187][ T769] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 34.157163][ T538] usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping [ 34.163371][ T330] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -22 [ 34.172762][ T538] usb 1-1: config 2 has an invalid interface number: 169 but max is 3 [ 34.179227][ T36] audit: type=1400 audit(1762402592.829:269): avc: denied { ioctl } for pid=783 comm="syz.2.139" path="/dev/fuse" dev="devtmpfs" ino=23 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 34.187246][ T538] usb 1-1: config 2 contains an unexpected descriptor of type 0x1, skipping [ 34.211773][ T330] usb-storage 4-1:1.0: USB Mass Storage device detected [ 34.220573][ T538] usb 1-1: config 2 has an invalid interface number: 230 but max is 3 [ 34.235547][ T538] usb 1-1: config 2 has an invalid interface number: 60 but max is 3 [ 34.236607][ T330] usb-storage 4-1:1.0: Quirks match for vid 0525 pid a4a5: 10000 [ 34.243844][ T538] usb 1-1: config 2 has no interface number 0 [ 34.251765][ T330] scsi host1: usb-storage 4-1:1.0 [ 34.257466][ T538] usb 1-1: config 2 has no interface number 1 [ 34.268555][ T538] usb 1-1: config 2 has no interface number 2 [ 34.274677][ T538] usb 1-1: config 2 has no interface number 3 [ 34.280796][ T538] usb 1-1: config 2 interface 169 altsetting 7 has a duplicate endpoint with address 0x4, skipping [ 34.291478][ T538] usb 1-1: config 2 interface 169 altsetting 7 endpoint 0xA has invalid maxpacket 1024, setting to 64 [ 34.302431][ T538] usb 1-1: config 2 interface 169 altsetting 7 has an invalid descriptor for endpoint zero, skipping [ 34.313284][ T538] usb 1-1: config 2 interface 169 altsetting 7 endpoint 0x2 has invalid maxpacket 471, setting to 64 [ 34.324146][ T538] usb 1-1: config 2 interface 169 altsetting 7 endpoint 0x5 has invalid wMaxPacketSize 0 [ 34.334009][ T538] usb 1-1: config 2 interface 169 altsetting 7 has a duplicate endpoint with address 0xA, skipping [ 34.344697][ T538] usb 1-1: config 2 interface 169 altsetting 7 has an endpoint descriptor with address 0x91, changing to 0x81 [ 34.356327][ T538] usb 1-1: config 2 interface 169 altsetting 7 has a duplicate endpoint with address 0x81, skipping [ 34.367105][ T538] usb 1-1: config 2 interface 169 altsetting 7 has a duplicate endpoint with address 0x1, skipping [ 34.377806][ T538] usb 1-1: config 2 interface 169 altsetting 7 has 10 endpoint descriptors, different from the interface descriptor's value: 9 [ 34.390952][ T538] usb 1-1: config 2 interface 230 altsetting 127 endpoint 0x9 has invalid maxpacket 512, setting to 64 [ 34.401990][ T538] usb 1-1: config 2 interface 230 altsetting 127 has a duplicate endpoint with address 0xD, skipping [ 34.412923][ T538] usb 1-1: config 2 interface 230 altsetting 127 has a duplicate endpoint with address 0x5, skipping [ 34.423798][ T538] usb 1-1: config 2 interface 60 altsetting 8 has a duplicate endpoint with address 0x2, skipping [ 34.434391][ T538] usb 1-1: config 2 interface 60 altsetting 8 has a duplicate endpoint with address 0x9, skipping [ 34.444981][ T538] usb 1-1: config 2 interface 216 has no altsetting 0 [ 34.451957][ T538] usb 1-1: config 2 interface 169 has no altsetting 0 [ 34.458717][ T538] usb 1-1: config 2 interface 230 has no altsetting 0 [ 34.465484][ T538] usb 1-1: config 2 interface 60 has no altsetting 0 [ 34.473394][ T538] usb 1-1: New USB device found, idVendor=0bda, idProduct=c812, bcdDevice=dc.de [ 34.482930][ T538] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.490951][ T538] usb 1-1: Product: syz [ 34.495133][ T538] usb 1-1: Manufacturer: ä Š [ 34.499740][ T538] usb 1-1: SerialNumber: syz [ 34.715166][ T798] rust_binder: Read failure Err(EAGAIN) in pid:77 [ 34.752397][ T330] usb 4-1: USB disconnect, device number 4 [ 34.776708][ T804] rust_binder: Failed to allocate buffer. len:216, is_oneway:true [ 34.785981][ T806] can0: slcan on ptm1. [ 34.892352][ T806] can0 (unregistered): slcan off ptm1. [ 34.922366][ T538] usb 1-1: USB disconnect, device number 4 [ 34.937176][ T826] rust_binder: Error while translating object. [ 34.937225][ T826] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 34.954254][ T826] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:88 [ 34.963778][ T498] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 35.050497][ T839] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.150225][ T498] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 35.166838][ T498] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 35.177820][ T498] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 35.187572][ T498] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 35.200385][ T498] usb 3-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 35.209555][ T498] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.218444][ T498] usb 3-1: config 0 descriptor?? [ 35.226770][ T498] usb 3-1: MIDIStreaming interface descriptor not found [ 35.253346][ T10] (unnamed net_device) (uninitialized): Assigned a random MAC address: 12:e5:bb:ff:6c:fd [ 35.265040][ T10] rtl8150 2-1:1.0: eth1: rtl8150 is detected [ 35.273454][ T10] usb 2-1: USB disconnect, device number 8 [ 35.444287][ T391] usb 3-1: USB disconnect, device number 9 [ 35.450264][ T330] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 35.610201][ T330] usb 4-1: config 0 has an invalid interface number: 239 but max is 0 [ 35.618402][ T330] usb 4-1: config 0 has no interface number 0 [ 35.624600][ T330] usb 4-1: config 0 interface 239 altsetting 0 endpoint 0x1 has invalid maxpacket 991, setting to 64 [ 35.635645][ T330] usb 4-1: config 0 interface 239 altsetting 0 endpoint 0x82 has invalid maxpacket 511, setting to 64 [ 35.647988][ T330] usb 4-1: New USB device found, idVendor=6189, idProduct=182d, bcdDevice= 1.73 [ 35.657053][ T330] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.665055][ T330] usb 4-1: Product: syz [ 35.669229][ T330] usb 4-1: Manufacturer: syz [ 35.673797][ T330] usb 4-1: SerialNumber: syz [ 35.678841][ T330] usb 4-1: config 0 descriptor?? [ 35.787965][ T885] netlink: 24 bytes leftover after parsing attributes in process `syz.1.152'. [ 35.788525][ T886] SELinux: security_context_str_to_sid () failed with errno=-22 [ 35.885058][ T330] asix 4-1:0.239 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 35.895402][ T330] asix 4-1:0.239: probe with driver asix failed with error -71 [ 35.905608][ T330] usb 4-1: USB disconnect, device number 5 [ 35.961991][ T900] tc_dump_action: action bad kind [ 35.962038][ T903] netlink: 24 bytes leftover after parsing attributes in process `syz.1.155'. [ 36.030847][ T916] rust_binder: Write failure EFAULT in pid:104 [ 36.052770][ T922] netlink: 28 bytes leftover after parsing attributes in process `syz.1.163'. [ 36.170584][ T936] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 36.279148][ T391] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 36.369180][ T585] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 36.419162][ T330] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 36.429153][ T391] usb 3-1: Using ep0 maxpacket: 32 [ 36.435291][ T391] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 36.443586][ T391] usb 3-1: config 0 has no interface number 0 [ 36.449755][ T391] usb 3-1: config 0 interface 184 has no altsetting 0 [ 36.457835][ T391] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 36.466902][ T391] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.474889][ T391] usb 3-1: Product: syz [ 36.479023][ T391] usb 3-1: Manufacturer: syz [ 36.483657][ T391] usb 3-1: SerialNumber: syz [ 36.489196][ T391] usb 3-1: config 0 descriptor?? [ 36.494955][ T391] smsc75xx v1.0.0 [ 36.529142][ T585] usb 1-1: Using ep0 maxpacket: 32 [ 36.535296][ T585] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.546219][ T585] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.556026][ T585] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 36.565297][ T585] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.574143][ T585] usb 1-1: config 0 descriptor?? [ 36.581053][ T330] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.590814][ T330] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 36.603594][ T330] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 36.612635][ T330] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.621191][ T330] usb 2-1: config 0 descriptor?? [ 36.987850][ T585] savu 0003:1E7D:2D5A.0004: hiddev96,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.0-1/input0 [ 37.028150][ T330] kovaplus 0003:1E7D:2D50.0005: unknown main item tag 0x0 [ 37.035347][ T330] kovaplus 0003:1E7D:2D50.0005: unknown main item tag 0x0 [ 37.042513][ T330] kovaplus 0003:1E7D:2D50.0005: unknown main item tag 0x0 [ 37.049663][ T330] kovaplus 0003:1E7D:2D50.0005: unknown main item tag 0x0 [ 37.056768][ T330] kovaplus 0003:1E7D:2D50.0005: unknown main item tag 0x0 [ 37.064455][ T330] kovaplus 0003:1E7D:2D50.0005: hidraw1: USB HID v0.00 Device [HID 1e7d:2d50] on usb-dummy_hcd.1-1/input0 [ 37.095604][ T391] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 37.106418][ T391] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 37.116047][ T391] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 37.126257][ T391] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -32 [ 37.240689][ T924] usb 1-1: USB disconnect, device number 5 [ 37.629612][ T36] kauditd_printk_skb: 15 callbacks suppressed [ 37.629627][ T36] audit: type=1400 audit(1762402596.289:285): avc: denied { listen } for pid=935 comm="syz.1.166" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 37.630929][ T330] kovaplus 0003:1E7D:2D50.0005: couldn't init struct kovaplus_device [ 37.663162][ T330] kovaplus 0003:1E7D:2D50.0005: couldn't install mouse [ 37.670492][ T330] kovaplus 0003:1E7D:2D50.0005: probe with driver kovaplus failed with error -71 [ 37.681057][ T330] usb 2-1: USB disconnect, device number 9 [ 37.778077][ T36] audit: type=1400 audit(1762402596.429:286): avc: denied { bind } for pid=940 comm="syz.0.167" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 37.843363][ T36] audit: type=1400 audit(1762402596.499:287): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 37.912787][ T951] binder: Bad value for 'max' [ 38.169171][ T926] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 38.275607][ T980] random: crng reseeded on system resumption [ 38.275611][ T36] audit: type=1400 audit(1762402596.929:288): avc: denied { write } for pid=979 comm="syz.1.179" name="snapshot" dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 38.309174][ T926] usb 1-1: device descriptor read/64, error -71 [ 38.318774][ T36] audit: type=1400 audit(1762402596.969:289): avc: denied { ioctl } for pid=979 comm="syz.1.179" path="/dev/snapshot" dev="devtmpfs" ino=21 ioctlcmd=0x330d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 38.378364][ T985] rust_binder: Failed to allocate buffer. len:224, is_oneway:true [ 38.390623][ T36] audit: type=1400 audit(1762402597.049:290): avc: denied { remount } for pid=989 comm="syz.3.183" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 38.390629][ T990] tracefs: Unknown parameter 'verity' [ 38.423534][ T36] audit: type=1400 audit(1762402597.059:291): avc: denied { unmount } for pid=291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 38.447782][ T36] audit: type=1400 audit(1762402597.089:292): avc: denied { setopt } for pid=986 comm="syz.1.182" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 38.569172][ T926] usb 1-1: device descriptor read/64, error -71 [ 38.809169][ T926] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 38.939157][ T926] usb 1-1: device descriptor read/64, error -71 [ 39.055293][ T329] usb 3-1: USB disconnect, device number 10 [ 39.084054][ T36] audit: type=1400 audit(1762402597.739:293): avc: denied { lock } for pid=1013 comm="syz.2.188" path="/dev/ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 39.151056][ T1022] overlayfs: failed to resolve './bus': -2 [ 39.167032][ T1024] netlink: 16 bytes leftover after parsing attributes in process `syz.2.191'. [ 39.189144][ T926] usb 1-1: device descriptor read/64, error -71 [ 39.273039][ T1028] __vm_enough_memory: pid: 1028, comm: syz.1.192, bytes: 18014402804453376 not enough memory for the allocation [ 39.299229][ T926] usb usb1-port1: attempt power cycle [ 39.320259][ T868] Bluetooth: hci0: Frame reassembly failed (-84) [ 39.363935][ T1034] rust_binder: BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 39.494782][ T1043] fuse: Bad value for 'fd' [ 39.649154][ T926] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 39.670087][ T926] usb 1-1: device descriptor read/8, error -71 [ 39.800223][ T926] usb 1-1: device descriptor read/8, error -71 [ 39.949155][ T329] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 40.039152][ T926] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 40.064501][ T926] usb 1-1: device descriptor read/8, error -71 [ 40.072965][ T1053] rust_binder: Write failure EFAULT in pid:129 [ 40.100176][ T329] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 40.117287][ T329] usb 3-1: New USB device found, idVendor=050d, idProduct=3201, bcdDevice= 0.00 [ 40.126489][ T329] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.140939][ T329] usb 3-1: config 0 descriptor?? [ 40.146533][ T1051] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 40.200030][ T926] usb 1-1: device descriptor read/8, error -71 [ 40.309240][ T926] usb usb1-port1: unable to enumerate USB device [ 40.379154][ T391] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 40.529514][ T391] usb 2-1: too many configurations: 72, using maximum allowed: 8 [ 40.542351][ T391] usb 2-1: New USB device found, idVendor=7de0, idProduct=676e, bcdDevice=77.db [ 40.551443][ T391] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.560329][ T391] usb 2-1: config 0 descriptor?? [ 40.560589][ T329] belkin 0003:050D:3201.0006: unknown main item tag 0x0 [ 40.574838][ T329] belkin 0003:050D:3201.0006: unknown main item tag 0x0 [ 40.581831][ T329] belkin 0003:050D:3201.0006: unknown main item tag 0x0 [ 40.592411][ T329] belkin 0003:050D:3201.0006: hiddev96,hidraw0: USB HID v1.01 Device [HID 050d:3201] on usb-dummy_hcd.2-1/input0 [ 40.762474][ T391] usb 3-1: USB disconnect, device number 11 [ 40.785955][ T330] usb 2-1: USB disconnect, device number 10 [ 41.329155][ T391] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 41.359146][ T1032] Bluetooth: hci0: command 0x1003 tx timeout [ 41.365181][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 41.386657][ T36] audit: type=1400 audit(1762402600.039:294): avc: denied { accept } for pid=1075 comm="syz.3.206" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 41.479130][ T391] usb 1-1: Using ep0 maxpacket: 16 [ 41.488087][ T391] usb 1-1: unable to get BOS descriptor or descriptor too short [ 41.497639][ T391] usb 1-1: config 13 has an invalid interface number: 50 but max is 0 [ 41.509127][ T391] usb 1-1: config 13 has no interface number 0 [ 41.515302][ T391] usb 1-1: config 13 interface 50 altsetting 167 bulk endpoint 0x8 has invalid maxpacket 16 [ 41.526944][ T330] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 41.530806][ T1087] rust_binder: Error while translating object. [ 41.534572][ T391] usb 1-1: config 13 interface 50 has no altsetting 0 [ 41.539549][ T1087] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 41.542361][ T391] usb 1-1: New USB device found, idVendor=1aca, idProduct=b28e, bcdDevice=92.32 [ 41.547806][ T1087] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:152 [ 41.556858][ T391] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.582969][ T391] usb 1-1: Product: syz [ 41.587123][ T391] usb 1-1: Manufacturer: syz [ 41.591742][ T391] usb 1-1: SerialNumber: syz [ 41.601166][ T1066] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 41.669156][ T330] usb 3-1: device descriptor read/64, error -71 [ 41.794285][ T1085] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1085 comm=syz.1.209 [ 41.811449][ T1066] : renamed from bond_slave_0 [ 41.819573][ T1092] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 41.819600][ T1094] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:196 [ 41.819614][ T1092] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:196 [ 41.849314][ T1085] netlink: 4 bytes leftover after parsing attributes in process `syz.1.209'. [ 41.850185][ T1090] __vm_enough_memory: pid: 1090, comm: syz.3.211, bytes: 18014402804453376 not enough memory for the allocation [ 41.876728][ T391] usb 1-1: MIDIStreaming interface descriptor not found [ 41.901678][ T1096] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 41.901703][ T1096] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:158 [ 41.911164][ T330] usb 3-1: device descriptor read/64, error -71 [ 41.927643][ T1099] random: crng reseeded on system resumption [ 41.937122][ T391] usb 1-1: USB disconnect, device number 10 [ 41.973548][ T1101] rust_binder: Error while translating object. [ 41.973589][ T1101] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 41.981578][ T1101] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:161 [ 42.021593][ T1110] loop2: detected capacity change from 0 to 8388607 [ 42.179152][ T330] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 42.319144][ T330] usb 3-1: device descriptor read/64, error -71 [ 42.330159][ T1131] rust_binder: Write failure EFAULT in pid:164 [ 42.339184][ T732] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 42.416609][ T1138] rust_binder: Write failure EFAULT in pid:169 [ 42.429051][ T1143] veth0_to_team: mtu greater than device maximum [ 42.436694][ T1144] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 42.441686][ T1144] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 42.448175][ T1144] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 42.454770][ T1144] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 42.461375][ T1144] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 42.467833][ T1144] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 42.469828][ T1153] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 152, size: 239) [ 42.474315][ T1144] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 42.485631][ T1153] rust_binder: Error while translating object. [ 42.491234][ T732] usb 4-1: device descriptor read/64, error -71 [ 42.497845][ T1153] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 42.503988][ T1144] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 42.510147][ T1153] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:181 [ 42.519974][ T1144] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 42.545115][ T1157] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.547881][ T1159] netlink: 'syz.0.231': attribute type 1 has an invalid length. [ 42.551705][ T1157] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.573562][ T1157] bridge0: entered allmulticast mode [ 42.579149][ T330] usb 3-1: device descriptor read/64, error -71 [ 42.689204][ T330] usb usb3-port1: attempt power cycle [ 42.759150][ T732] usb 4-1: device descriptor read/64, error -71 [ 42.999153][ T732] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 43.029181][ T330] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 43.050105][ T330] usb 3-1: device descriptor read/8, error -71 [ 43.129154][ T732] usb 4-1: device descriptor read/64, error -71 [ 43.158220][ T1172] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.166714][ T1172] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.175383][ T36] kauditd_printk_skb: 10 callbacks suppressed [ 43.175396][ T36] audit: type=1400 audit(1762402601.829:305): avc: denied { read write } for pid=1170 comm="syz.0.235" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 43.175977][ T1173] binder: Unknown parameter 'defcontext01777777777777777777777' [ 43.181832][ T36] audit: type=1400 audit(1762402601.829:306): avc: denied { open } for pid=1170 comm="syz.0.235" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 43.205445][ T1172] binder: Unknown parameter 'defcontext01777777777777777777777' [ 43.213489][ T36] audit: type=1400 audit(1762402601.829:307): avc: denied { ioctl } for pid=1170 comm="syz.0.235" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 43.270675][ T330] usb 3-1: device descriptor read/8, error -71 [ 43.379170][ T732] usb 4-1: device descriptor read/64, error -71 [ 43.409141][ T329] usb 1-1: new full-speed USB device number 11 using dummy_hcd [ 43.485998][ T1176] rust_binder: 186: no such ref 3 [ 43.489226][ T732] usb usb4-port1: attempt power cycle [ 43.491054][ T1176] rust_binder: inc_ref_done called when no active inc_refs [ 43.496408][ T1176] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 43.510656][ T330] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 43.511667][ T1176] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:186 [ 43.518613][ T1177] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 43.535179][ T330] usb 3-1: device descriptor read/8, error -71 [ 43.549142][ T329] usb 1-1: device descriptor read/64, error -71 [ 43.611645][ T36] audit: type=1400 audit(1762402602.269:308): avc: denied { create } for pid=1185 comm="syz.1.239" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 43.636567][ T1191] __vm_enough_memory: pid: 1191, comm: syz.1.240, bytes: 18014402804453376 not enough memory for the allocation [ 43.670129][ T330] usb 3-1: device descriptor read/8, error -71 [ 43.717265][ T36] audit: type=1400 audit(1762402602.369:309): avc: denied { map } for pid=1205 comm="syz.1.244" path="socket:[8587]" dev="sockfs" ino=8587 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 43.722198][ T1206] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.740336][ T36] audit: type=1400 audit(1762402602.369:310): avc: denied { read } for pid=1205 comm="syz.1.244" path="socket:[8587]" dev="sockfs" ino=8587 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 43.750633][ T1206] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.779502][ T330] usb usb3-port1: unable to enumerate USB device [ 43.799147][ T329] usb 1-1: device descriptor read/64, error -71 [ 43.829163][ T732] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 43.850128][ T732] usb 4-1: device descriptor read/8, error -71 [ 43.959161][ T391] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 43.980149][ T732] usb 4-1: device descriptor read/8, error -71 [ 44.039143][ T329] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 44.110142][ T391] usb 2-1: config 1 has an invalid interface number: 7 but max is 0 [ 44.118167][ T391] usb 2-1: config 1 has no interface number 0 [ 44.124270][ T391] usb 2-1: config 1 interface 7 altsetting 0 bulk endpoint 0xD has invalid maxpacket 64 [ 44.134009][ T391] usb 2-1: config 1 interface 7 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 16 [ 44.143735][ T391] usb 2-1: config 1 interface 7 altsetting 0 endpoint 0xC has an invalid bInterval 112, changing to 10 [ 44.156100][ T391] usb 2-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 44.165162][ T391] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.169146][ T329] usb 1-1: device descriptor read/64, error -71 [ 44.173157][ T391] usb 2-1: Product: syz [ 44.183531][ T391] usb 2-1: Manufacturer: syz [ 44.188094][ T391] usb 2-1: SerialNumber: syz [ 44.193486][ T1207] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 44.200686][ T1207] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 44.219161][ T732] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 44.240116][ T732] usb 4-1: device descriptor read/8, error -71 [ 44.292279][ T36] audit: type=1400 audit(1762402602.949:311): avc: denied { create } for pid=1208 comm="syz.2.245" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 44.323344][ T1214] input: syz0 as /devices/virtual/input/input10 [ 44.346344][ T36] audit: type=1400 audit(1762402602.999:312): avc: denied { getopt } for pid=1215 comm="syz.2.247" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 44.365807][ T36] audit: type=1400 audit(1762402602.999:313): avc: denied { setopt } for pid=1215 comm="syz.2.247" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 44.386297][ T732] usb 4-1: device descriptor read/8, error -71 [ 44.406050][ T1216] netlink: 20 bytes leftover after parsing attributes in process `syz.2.247'. [ 44.408408][ T391] usb 2-1: USB disconnect, device number 11 [ 44.428124][ T36] audit: type=1400 audit(1762402603.089:314): avc: denied { write } for pid=1215 comm="syz.2.247" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 44.447397][ T329] usb 1-1: device descriptor read/64, error -71 [ 44.499263][ T732] usb usb4-port1: unable to enumerate USB device [ 44.549228][ T329] usb usb1-port1: attempt power cycle [ 44.889150][ T329] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 44.910094][ T329] usb 1-1: device descriptor read/8, error -71 [ 45.040428][ T329] usb 1-1: device descriptor read/8, error -71 [ 45.109424][ T1233] netlink: 104 bytes leftover after parsing attributes in process `syz.3.252'. [ 45.172187][ T1234] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 45.279147][ T329] usb 1-1: new full-speed USB device number 14 using dummy_hcd [ 45.310139][ T329] usb 1-1: device descriptor read/8, error -71 [ 45.440440][ T329] usb 1-1: device descriptor read/8, error -71 [ 45.549223][ T329] usb usb1-port1: unable to enumerate USB device [ 45.778047][ T1240] SELinux: Context system_u:object_r:system_cron_spool_t:s0 is not valid (left unmapped). [ 45.795417][ T1242] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 152, size: 18446744073709551507) [ 45.795434][ T1242] rust_binder: Error while translating object. [ 45.807520][ T1242] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 45.813750][ T1242] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:227 [ 45.841814][ T1247] rust_binder: Error while translating object. [ 45.851009][ T1247] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 45.857155][ T1247] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:232 [ 46.167745][ T1252] netlink: 'syz.0.259': attribute type 1 has an invalid length. [ 46.366283][ T1272] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.383775][ T1277] 9pnet_fd: Insufficient options for proto=fd [ 46.416011][ T1284] Zero length message leads to an empty skb [ 46.422689][ T1282] rust_binder: Write failure EFAULT in pid:238 [ 46.422988][ T1282] rust_binder: Write failure EFAULT in pid:238 [ 46.568474][ T1299] binder: Unknown parameter 'contextÌðÔð[7’' [ 47.082405][ T1311] binder: Bad value for 'max' [ 47.218550][ T1320] __vm_enough_memory: pid: 1320, comm: syz.2.281, bytes: 18014402804453376 not enough memory for the allocation [ 47.252647][ T1324] rust_binder: Error while translating object. [ 47.252673][ T1324] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 47.258851][ T1324] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:242 [ 47.349150][ T732] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 47.479309][ T330] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 47.510140][ T732] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 47.521235][ T732] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 47.530982][ T732] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 47.543853][ T732] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 47.552878][ T732] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.561311][ T732] usb 1-1: config 0 descriptor?? [ 47.609148][ T391] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 47.630182][ T330] usb 3-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 47.641116][ T330] usb 3-1: config 0 interface 0 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0 [ 47.650861][ T330] usb 3-1: config 0 interface 0 has no altsetting 0 [ 47.657472][ T330] usb 3-1: New USB device found, idVendor=145f, idProduct=0212, bcdDevice= 0.00 [ 47.666515][ T330] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.675026][ T330] usb 3-1: config 0 descriptor?? [ 47.759122][ T391] usb 4-1: Using ep0 maxpacket: 16 [ 47.765306][ T391] usb 4-1: config 0 interface 0 has no altsetting 0 [ 47.771943][ T391] usb 4-1: New USB device found, idVendor=1345, idProduct=3008, bcdDevice= 0.00 [ 47.780988][ T391] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.789749][ T391] usb 4-1: config 0 descriptor?? [ 47.976890][ T732] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x2 [ 47.984351][ T732] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.991755][ T732] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.999172][ T732] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.006555][ T732] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.013949][ T732] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.021343][ T732] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.028718][ T732] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.036117][ T732] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.043515][ T732] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.050900][ T732] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.058279][ T732] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.065667][ T732] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.073066][ T732] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.080472][ T732] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.088030][ T732] plantronics 0003:047F:FFFF.0007: No inputs registered, leaving [ 48.090930][ T330] uclogic 0003:145F:0212.0008: interface is invalid, ignoring [ 48.096860][ T732] plantronics 0003:047F:FFFF.0007: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 48.200652][ T391] sony 0003:1345:3008.0009: item fetching failed at offset 3/5 [ 48.208364][ T391] sony 0003:1345:3008.0009: parse failed [ 48.214034][ T391] sony 0003:1345:3008.0009: probe with driver sony failed with error -22 [ 48.229804][ T391] usb 1-1: USB disconnect, device number 15 [ 48.291094][ T1322] rust_binder: Error while translating object. [ 48.291133][ T1322] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 48.299164][ T1322] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:216 [ 48.302545][ T1344] rust_binder: Write failure EFAULT in pid:251 [ 48.312966][ T732] usb 3-1: USB disconnect, device number 16 [ 48.330929][ T1346] rust_binder: validate_parent_fixup: new_min_offset=26, sg_entry.length=0 [ 48.330947][ T1346] rust_binder: Error while translating object. [ 48.339725][ T1346] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 48.345881][ T1346] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:253 [ 48.403731][ T1332] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 48.421510][ T1332] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 48.430079][ T1332] .N: renamed from veth0_to_bond (while UP) [ 48.459447][ T1332] netlink: 'syz.3.286': attribute type 12 has an invalid length. [ 48.659142][ T391] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 48.809127][ T391] usb 1-1: Using ep0 maxpacket: 8 [ 48.815202][ T391] usb 1-1: config 32 has an invalid descriptor of length 0, skipping remainder of the config [ 48.826022][ T391] usb 1-1: config 32 has an invalid descriptor of length 0, skipping remainder of the config [ 48.836807][ T391] usb 1-1: config 32 has an invalid descriptor of length 0, skipping remainder of the config [ 48.849928][ T391] usb 1-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 48.853320][ T36] kauditd_printk_skb: 17 callbacks suppressed [ 48.853332][ T36] audit: type=1400 audit(1762402607.509:332): avc: denied { remount } for pid=1356 comm="syz.2.294" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 48.860454][ T391] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 48.867519][ T1357] can0: slcan on ptm0. [ 48.884763][ T391] usb 1-1: Manufacturer: syz [ 48.904773][ T391] hub 1-1:32.0: Invalid hub with more than one config or interface [ 48.912814][ T391] hub 1-1:32.0: probe with driver hub failed with error -22 [ 48.940189][ T1357] can0 (unregistered): slcan off ptm0. [ 48.990246][ T36] audit: type=1400 audit(1762402607.649:333): avc: denied { setopt } for pid=1358 comm="syz.2.295" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 49.104787][ T1354] binder: Unknown parameter 'max000000017777777777' [ 49.115006][ T391] usb 1-1: USB disconnect, device number 16 [ 49.123756][ T343] udevd[343]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:32.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 49.179300][ T1363] netlink: 'syz.3.296': attribute type 29 has an invalid length. [ 49.183322][ T31] usb 4-1: USB disconnect, device number 10 [ 49.187139][ T1364] netlink: 'syz.3.296': attribute type 29 has an invalid length. [ 49.210144][ T36] audit: type=1400 audit(1762402607.869:334): avc: denied { execute } for pid=1365 comm="syz.3.297" path="/dev/binderfs/binder1" dev="binder" ino=14 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 49.238802][ T36] audit: type=1400 audit(1762402607.889:335): avc: denied { write } for pid=1367 comm="syz.3.298" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 49.559162][ T31] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 49.665619][ T869] bridge_slave_1: left allmulticast mode [ 49.671693][ T869] bridge_slave_1: left promiscuous mode [ 49.677308][ T869] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.685205][ T869] bridge_slave_0: left allmulticast mode [ 49.698081][ T869] bridge_slave_0: left promiscuous mode [ 49.704297][ T869] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.719141][ T31] usb 4-1: Using ep0 maxpacket: 16 [ 49.727260][ T31] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 49.738659][ T31] usb 4-1: config 0 interface 0 has no altsetting 0 [ 49.745385][ T31] usb 4-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 49.755501][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.764653][ T31] usb 4-1: config 0 descriptor?? [ 49.785641][ T36] audit: type=1400 audit(1762402608.439:336): avc: denied { mounton } for pid=1383 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 49.837538][ T1383] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.844594][ T1383] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.851880][ T1383] bridge_slave_0: entered allmulticast mode [ 49.858076][ T1383] bridge_slave_0: entered promiscuous mode [ 49.864006][ T732] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 49.864889][ T1383] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.878667][ T1383] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.885750][ T1383] bridge_slave_1: entered allmulticast mode [ 49.891976][ T1383] bridge_slave_1: entered promiscuous mode [ 49.898008][ T869] tipc: Left network mode [ 49.903314][ T869] veth1_macvtap: left promiscuous mode [ 49.908817][ T869] veth0_vlan: left promiscuous mode [ 49.974754][ T36] audit: type=1400 audit(1762402608.629:337): avc: denied { write } for pid=1372 comm="syz.3.299" name="udp" dev="proc" ino=4026532587 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 49.976230][ T1373] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1025 sclass=netlink_route_socket pid=1373 comm=syz.3.299 [ 50.016897][ T31] usbhid 4-1:0.0: can't add hid device: -71 [ 50.024058][ T31] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 50.034694][ T870] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.039929][ T31] usb 4-1: USB disconnect, device number 11 [ 50.041742][ T870] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.055104][ T732] usb 3-1: Using ep0 maxpacket: 8 [ 50.059581][ T870] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.062056][ T732] usb 3-1: unable to get BOS descriptor or descriptor too short [ 50.067150][ T870] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.075502][ T732] usb 3-1: config 4 has an invalid interface number: 147 but max is 0 [ 50.091158][ T732] usb 3-1: config 4 contains an unexpected descriptor of type 0x2, skipping [ 50.099072][ T1383] veth0_vlan: entered promiscuous mode [ 50.099894][ T732] usb 3-1: config 4 has no interface number 0 [ 50.112643][ T1383] veth1_macvtap: entered promiscuous mode [ 50.119008][ T732] usb 3-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 50.128115][ T732] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 50.136146][ T732] usb 3-1: Product: syz [ 50.142166][ T732] usb 3-1: Manufacturer: syz [ 50.146848][ T732] usb 3-1: SerialNumber: syz [ 50.152513][ T36] audit: type=1400 audit(1762402608.809:338): avc: denied { mounton } for pid=1383 comm="syz-executor" path="/root/syzkaller.cJy3aq/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 50.202460][ T1398] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:6 [ 50.203212][ T1398] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 50.212443][ T1398] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:6 [ 50.285763][ T36] audit: type=1400 audit(1762402608.939:339): avc: denied { setopt } for pid=1410 comm="syz.4.312" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 50.315174][ T36] audit: type=1400 audit(1762402608.949:340): avc: denied { ioctl } for pid=1412 comm="syz.1.313" path="socket:[10354]" dev="sockfs" ino=10354 ioctlcmd=0x8983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 50.340944][ T36] audit: type=1400 audit(1762402608.949:341): avc: denied { getopt } for pid=1412 comm="syz.1.313" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 50.382327][ T1381] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:230 [ 50.385102][ T732] usb 3-1: Found UVC 0.02 device syz (04f2:b746) [ 50.408370][ T1424] rust_binder: Failed to allocate buffer. len:4248, is_oneway:true [ 50.408393][ T1424] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 50.409488][ T732] usb 3-1: No valid video chain found. [ 50.426837][ T1424] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:23 [ 50.435093][ T732] usb 3-1: USB disconnect, device number 17 [ 50.450322][ T1426] 9pnet_fd: Insufficient options for proto=fd [ 50.790950][ T1459] netlink: 12 bytes leftover after parsing attributes in process `syz.3.329'. [ 50.924664][ T1464] kvm: emulating exchange as write [ 51.000954][ T1471] rust_binder: Failed to vm_insert_page(35184372744192): vma_addr:35184372744192 i:0 err:EBUSY [ 51.000979][ T1471] rust_binder: Error in use_page_slow: EBUSY [ 51.011357][ T1471] rust_binder: use_range failure EBUSY [ 51.017330][ T1471] rust_binder: Failed to allocate buffer. len:8, is_oneway:false [ 51.022954][ T1471] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBUSY } [ 51.030901][ T1471] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBUSY } my_pid:279 [ 51.149325][ T1486] rust_binder: Write failure EFAULT in pid:39 [ 51.159339][ T45] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 51.205903][ T1496] rust_binder: Read failure Err(EAGAIN) in pid:49 [ 51.289181][ T732] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 51.289411][ T1502] rust_binder: Error while translating object. [ 51.303328][ T1502] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 51.309556][ T1502] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:55 [ 51.319482][ T1504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 51.335272][ T1503] rust_binder: Error while translating object. [ 51.335303][ T1503] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 51.341597][ T1503] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:55 [ 51.351484][ T45] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 51.372247][ T45] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 51.383277][ T45] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 51.393013][ T45] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 51.405885][ T45] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 51.414920][ T45] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.423407][ T45] usb 3-1: config 0 descriptor?? [ 51.450167][ T732] usb 2-1: no configurations [ 51.454810][ T732] usb 2-1: can't read configurations, error -22 [ 51.478830][ T1507] binder: Unknown parameter 'statsã醇î˜S' [ 51.589161][ T732] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 51.740168][ T732] usb 2-1: no configurations [ 51.744827][ T732] usb 2-1: can't read configurations, error -22 [ 51.751400][ T732] usb usb2-port1: attempt power cycle [ 51.830249][ T45] plantronics 0003:047F:FFFF.000A: unknown main item tag 0x0 [ 51.837711][ T45] plantronics 0003:047F:FFFF.000A: unknown main item tag 0x0 [ 51.845257][ T45] plantronics 0003:047F:FFFF.000A: unknown main item tag 0x0 [ 51.852670][ T45] plantronics 0003:047F:FFFF.000A: unknown main item tag 0x0 [ 51.860058][ T45] plantronics 0003:047F:FFFF.000A: unknown main item tag 0x0 [ 51.867540][ T45] plantronics 0003:047F:FFFF.000A: No inputs registered, leaving [ 51.876688][ T45] plantronics 0003:047F:FFFF.000A: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 52.089146][ T732] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 52.110464][ T732] usb 2-1: no configurations [ 52.115084][ T732] usb 2-1: can't read configurations, error -22 [ 52.129812][ T45] usb 3-1: USB disconnect, device number 18 [ 52.249288][ T732] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 52.270866][ T732] usb 2-1: no configurations [ 52.275518][ T732] usb 2-1: can't read configurations, error -22 [ 52.282148][ T732] usb usb2-port1: unable to enumerate USB device [ 52.379645][ T1518] netlink: 20 bytes leftover after parsing attributes in process `syz.4.349'. [ 52.899147][ T45] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 53.049126][ T45] usb 3-1: Using ep0 maxpacket: 16 [ 53.055536][ T45] usb 3-1: unable to get BOS descriptor or descriptor too short [ 53.063248][ T45] usb 3-1: no configurations [ 53.067831][ T45] usb 3-1: can't read configurations, error -22 [ 53.199220][ T45] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 53.233496][ T1527] kvm: kvm [1526]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010005) = 0xeb [ 53.243101][ T1527] rust_binder: Error while translating object. [ 53.243127][ T1527] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 53.249310][ T1527] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:75 [ 53.349127][ T45] usb 3-1: Using ep0 maxpacket: 16 [ 53.364541][ T45] usb 3-1: unable to get BOS descriptor or descriptor too short [ 53.372200][ T45] usb 3-1: no configurations [ 53.376787][ T45] usb 3-1: can't read configurations, error -22 [ 53.383114][ T45] usb usb3-port1: attempt power cycle [ 53.719172][ T45] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 53.739456][ T45] usb 3-1: Using ep0 maxpacket: 16 [ 53.745846][ T45] usb 3-1: unable to get BOS descriptor or descriptor too short [ 53.753545][ T45] usb 3-1: no configurations [ 53.758125][ T45] usb 3-1: can't read configurations, error -22 [ 53.847655][ T1534] rust_binder: Failed to allocate buffer. len:4294967304, is_oneway:false [ 53.847676][ T1534] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 53.856263][ T1534] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:82 [ 53.889150][ T45] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 53.919928][ T45] usb 3-1: Using ep0 maxpacket: 16 [ 53.926371][ T45] usb 3-1: unable to get BOS descriptor or descriptor too short [ 53.934051][ T45] usb 3-1: no configurations [ 53.938636][ T45] usb 3-1: can't read configurations, error -22 [ 53.944982][ T45] usb usb3-port1: unable to enumerate USB device [ 53.994507][ T1540] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 53.995222][ T36] kauditd_printk_skb: 16 callbacks suppressed [ 53.995237][ T36] audit: type=1400 audit(1762402612.649:358): avc: denied { read } for pid=1539 comm="syz.3.357" lport=5 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 53.999315][ T1540] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14385 sclass=netlink_route_socket pid=1540 comm=syz.3.357 [ 54.040820][ T1540] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 54.040840][ T1541] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 54.040846][ T1540] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:220 [ 54.059803][ T1541] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:220 [ 54.170816][ T1556] loop2: detected capacity change from 0 to 7 [ 54.188124][ T1562] netlink: 'syz.1.363': attribute type 15 has an invalid length. [ 54.196694][ T1562] netlink: 24 bytes leftover after parsing attributes in process `syz.1.363'. [ 54.205930][ T1562] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1011 sclass=netlink_route_socket pid=1562 comm=syz.1.363 [ 54.244578][ T36] audit: type=1400 audit(1762402612.899:359): avc: denied { create } for pid=1566 comm="syz.4.365" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 54.288700][ T36] audit: type=1400 audit(1762402612.939:360): avc: denied { getattr } for pid=1568 comm="syz.1.367" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 54.329139][ T329] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 54.389128][ T1584] fuseblk: Unknown parameter 'f' [ 54.419914][ T1588] /dev/rnullb0: Can't open blockdev [ 54.489139][ T329] usb 4-1: Using ep0 maxpacket: 32 [ 54.495441][ T329] usb 4-1: config 250 has an invalid interface number: 8 but max is 0 [ 54.503662][ T329] usb 4-1: config 250 has no interface number 0 [ 54.509968][ T329] usb 4-1: New USB device found, idVendor=0ac8, idProduct=3410, bcdDevice=b6.f9 [ 54.519024][ T329] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 54.761751][ T329] usb 4-1: string descriptor 0 read error: -71 [ 54.778167][ T329] usb 4-1: USB disconnect, device number 12 [ 54.886603][ T36] audit: type=1326 audit(1762402613.229:361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1595 comm="syz.4.373" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f221dd8f6c9 code=0x0 [ 55.218611][ T1605] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.532899][ T36] audit: type=1326 audit(1762402614.189:362): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1631 comm="syz.1.388" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0632d8f6c9 code=0x0 [ 56.126227][ T1663] rust_binder: Error while translating object. [ 56.126265][ T1663] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 56.132508][ T1663] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:265 [ 56.378636][ T1670] netlink: 10788 bytes leftover after parsing attributes in process `syz.1.399'. [ 56.428119][ T1683] netlink: 488 bytes leftover after parsing attributes in process `syz.1.403'. [ 56.437568][ T36] audit: type=1400 audit(1762402615.099:363): avc: denied { mount } for pid=1674 comm="syz.4.401" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 56.466944][ T36] audit: type=1400 audit(1762402615.119:364): avc: denied { unmount } for pid=1383 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 56.495850][ T1693] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 56.503703][ T1692] binder: Bad value for 'stats' [ 56.504366][ T1693] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 56.658705][ T1698] SELinux: security_context_str_to_sid (sytem_uÝGй ‰:ÿß) failed with errno=-22 [ 56.712911][ T1703] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 56.713028][ T1703] rust_binder: Failed to allocate buffer. len:1176, is_oneway:false [ 56.719920][ T1693] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 56.736273][ T329] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 56.739036][ T1693] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 56.752463][ T1693] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 56.760839][ T1694] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 56.760959][ T1693] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 56.769333][ T1694] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 56.889153][ T329] usb 2-1: Using ep0 maxpacket: 32 [ 56.895498][ T329] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 56.904099][ T329] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 56.914449][ T329] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 56.923613][ T329] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 56.933507][ T329] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 56.936208][ T36] audit: type=1400 audit(1762402615.599:365): avc: denied { mount } for pid=1713 comm="syz.4.413" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 56.943488][ T329] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 56.974954][ T329] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 56.979968][ T36] audit: type=1400 audit(1762402615.639:366): avc: denied { unmount } for pid=1383 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 57.004576][ T329] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 57.026116][ T329] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 57.035201][ T329] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 57.044379][ T329] usb 2-1: config 0 descriptor?? [ 57.051124][ T1718] binder: Unknown parameter 'maxl' [ 57.122216][ T1730] rust_binder: Error while translating object. [ 57.122265][ T1730] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 57.128461][ T1730] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:279 [ 57.138505][ T1730] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 57.163125][ T1735] /dev/rnullb0: Can't open blockdev [ 57.237668][ T1740] netlink: 8 bytes leftover after parsing attributes in process `syz.2.419'. [ 57.255920][ T329] usblp 2-1:0.0: usblp0: USB Bidirectional printer dev 16 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 57.283706][ T329] usb 2-1: USB disconnect, device number 16 [ 57.292635][ T329] usblp0: removed [ 57.415337][ T1748] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:235 [ 57.557959][ T1756] netlink: 44 bytes leftover after parsing attributes in process `syz.3.427'. [ 57.709143][ T329] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 57.775016][ T1777] netlink: 12 bytes leftover after parsing attributes in process `syz.3.433'. [ 57.803834][ T1779] netlink: 12 bytes leftover after parsing attributes in process `syz.1.434'. [ 57.819161][ T36] audit: type=1400 audit(1762402616.479:367): avc: denied { mounton } for pid=1780 comm="syz.3.435" path="/84/file0" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 57.859133][ T329] usb 3-1: Using ep0 maxpacket: 8 [ 57.865434][ T1742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.875330][ T1779] netlink: 44 bytes leftover after parsing attributes in process `syz.1.434'. [ 57.875331][ T1742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.897088][ T1788] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 58.076480][ T1742] rust_binder: Write failure EFAULT in pid:289 [ 58.084561][ T329] usb 3-1: unable to get BOS descriptor or descriptor too short [ 58.101012][ T329] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 58.119058][ T329] usb 3-1: can't read configurations, error -71 [ 58.545080][ T1816] binder: Binderfs stats mode cannot be changed during a remount [ 58.614386][ T1820] netlink: 8568 bytes leftover after parsing attributes in process `syz.2.448'. [ 58.629817][ T1820] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 58.629852][ T1820] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:291 [ 58.655877][ T1821] 9pnet_fd: Insufficient options for proto=fd [ 58.674068][ T1821] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found [ 58.694404][ T1821] rust_binder: Write failure EINVAL in pid:160 [ 58.733829][ T1824] rust_binder: Error while translating object. [ 58.740089][ T1824] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 58.746253][ T1824] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:293 [ 58.840170][ T1833] can0: slcan on ptm0. [ 58.999756][ T1833] can0 (unregistered): slcan off ptm0. [ 59.181278][ T36] kauditd_printk_skb: 6 callbacks suppressed [ 59.181295][ T36] audit: type=1400 audit(1762402617.839:374): avc: denied { write } for pid=1877 comm="syz.4.458" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 59.189130][ T330] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 59.257156][ T1845] rust_binder: Error while translating object. [ 59.257181][ T1845] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 59.264835][ T1845] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:372 [ 59.308490][ T1895] netlink: 328 bytes leftover after parsing attributes in process `syz.4.463'. [ 59.329737][ T1895] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1895 comm=syz.4.463 [ 59.349246][ T36] audit: type=1326 audit(1762402617.999:375): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1897 comm="syz.1.464" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0632d8f6c9 code=0x0 [ 59.381509][ T330] usb 4-1: device descriptor read/64, error -71 [ 59.425393][ T1905] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 59.425418][ T1905] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 59.453968][ T1913] rust_binder: Write failure EFAULT in pid:205 [ 59.592253][ T36] audit: type=1400 audit(1762402618.249:376): avc: denied { sqpoll } for pid=1921 comm="syz.2.471" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 59.597963][ T1922] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=50452 sclass=netlink_xfrm_socket pid=1922 comm=syz.2.471 [ 59.630235][ T330] usb 4-1: device descriptor read/64, error -71 [ 59.631054][ T1922] SELinux: security_context_str_to_sid (syste_uÝGй ‰:ÿß) failed with errno=-22 [ 59.680427][ T1929] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 59.680959][ T1929] rust_binder: Error while translating object. [ 59.687481][ T1929] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 59.693707][ T1929] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:302 [ 59.703781][ T1931] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 59.796411][ T36] audit: type=1400 audit(1762402618.449:377): avc: denied { shutdown } for pid=1939 comm="syz.2.478" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 59.796880][ T1941] rust_binder: Error while translating object. [ 59.822825][ T1941] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 59.828976][ T1941] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:312 [ 59.889135][ T330] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 59.919142][ T538] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 60.029163][ T330] usb 4-1: device descriptor read/64, error -71 [ 60.069120][ T538] usb 5-1: Using ep0 maxpacket: 32 [ 60.075316][ T538] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 60.083392][ T538] usb 5-1: config 0 has no interface number 0 [ 60.089522][ T538] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 60.100414][ T538] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 60.110161][ T538] usb 5-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 60.119194][ T538] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 60.127894][ T538] usb 5-1: config 0 descriptor?? [ 60.269154][ T330] usb 4-1: device descriptor read/64, error -71 [ 60.379196][ T330] usb usb4-port1: attempt power cycle [ 60.429118][ T329] usb 2-1: new full-speed USB device number 17 using dummy_hcd [ 60.535995][ T538] uclogic 0003:28BD:0094.000B: pen parameters not found [ 60.543005][ T538] uclogic 0003:28BD:0094.000B: interface is invalid, ignoring [ 60.583266][ T329] usb 2-1: unable to get BOS descriptor or descriptor too short [ 60.591402][ T329] usb 2-1: not running at top speed; connect to a high speed hub [ 60.600239][ T329] usb 2-1: config 4 has an invalid interface number: 56 but max is 0 [ 60.608436][ T329] usb 2-1: config 4 has no interface number 0 [ 60.614646][ T329] usb 2-1: config 4 interface 56 has no altsetting 0 [ 60.627087][ T329] usb 2-1: New USB device found, idVendor=17cc, idProduct=1000, bcdDevice=61.74 [ 60.637717][ T329] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 60.645895][ T329] usb 2-1: Product: syz [ 60.650161][ T329] usb 2-1: Manufacturer: syz [ 60.654750][ T329] usb 2-1: SerialNumber: syz [ 60.719157][ T330] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 60.740402][ T330] usb 4-1: device descriptor read/8, error -71 [ 60.747246][ T1958] rust_binder: 326: no such ref 3 [ 60.752326][ T1958] rust_binder: inc_ref_done called when no active inc_refs [ 60.752342][ T1958] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 60.766612][ T1958] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:326 [ 60.797982][ T1965] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 60.866953][ T329] snd-usb-audio 2-1:4.56: probe with driver snd-usb-audio failed with error -71 [ 60.873212][ T330] usb 4-1: device descriptor read/8, error -71 [ 60.881939][ T329] usb 2-1: USB disconnect, device number 17 [ 60.889660][ T1968] rust_binder: Error while translating object. [ 60.889695][ T1968] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 60.895924][ T1968] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:337 [ 60.914094][ T36] audit: type=1400 audit(1762402619.569:378): avc: denied { append } for pid=1969 comm="syz.2.488" name="event2" dev="devtmpfs" ino=209 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 61.119146][ T330] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 61.140056][ T330] usb 4-1: device descriptor read/8, error -71 [ 61.189142][ T1920] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 61.199556][ T329] usb 5-1: USB disconnect, device number 2 [ 61.271223][ T330] usb 4-1: device descriptor read/8, error -71 [ 61.340075][ T1920] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 61.350960][ T1920] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 61.360691][ T1920] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 61.373563][ T1920] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 61.382848][ T330] usb usb4-port1: unable to enumerate USB device [ 61.389484][ T1920] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 61.399619][ T1920] usb 3-1: config 0 descriptor?? [ 61.619173][ T329] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 61.770128][ T329] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 61.781035][ T329] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 61.790788][ T329] usb 5-1: New USB device found, idVendor=256c, idProduct=006e, bcdDevice= 0.00 [ 61.799839][ T329] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 61.808378][ T329] usb 5-1: config 0 descriptor?? [ 61.814234][ T1972] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 61.823147][ T1997] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 61.823186][ T1972] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 61.832813][ T1997] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 61.896932][ T1999] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 61.897643][ T1999] rust_binder: Error while translating object. [ 61.904194][ T1999] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 61.910385][ T1999] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:286 [ 61.930134][ T2001] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 61.948770][ T2003] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 61.957689][ T2003] rust_binder: 290: no such ref 3 [ 61.969266][ T2003] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:290 [ 61.988575][ T2007] exFAT-fs (rnullb0): invalid boot record signature [ 61.989152][ T732] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 61.997717][ T2007] exFAT-fs (rnullb0): failed to read boot sector [ 62.018243][ T2007] exFAT-fs (rnullb0): failed to recognize exfat type [ 62.025950][ T329] usbhid 5-1:0.0: can't add hid device: -71 [ 62.031909][ T329] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 62.043190][ T329] usb 5-1: USB disconnect, device number 3 [ 62.055594][ T2011] netlink: 'syz.3.505': attribute type 27 has an invalid length. [ 62.071023][ T2011] bridge0: port 2(bridge_slave_1) entered disabled state [ 62.078196][ T2011] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.109160][ T2011] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 62.110239][ T2011] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:298 [ 62.147163][ T2017] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 62.149139][ T732] usb 2-1: Using ep0 maxpacket: 8 [ 62.177223][ T732] usb 2-1: unable to get BOS descriptor or descriptor too short [ 62.187817][ T732] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 62.188671][ T2020] overlay: filesystem on ./bus not supported as upperdir [ 62.196295][ T732] usb 2-1: can't read configurations, error -71 [ 62.203795][ T2019] ------------[ cut here ]------------ [ 62.214165][ T2019] WARNING: CPU: 1 PID: 2019 at mm/page_alloc.c:5234 __alloc_pages_noprof+0xe8/0x7b0 [ 62.223580][ T2019] Modules linked in: [ 62.227647][ T2019] CPU: 1 UID: 0 PID: 2019 Comm: syz.3.509 Not tainted syzkaller #0 0b5ffdee5fcd2f7749818d1ff954e9c21353764e [ 62.239205][ T2019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 62.249592][ T2019] RIP: 0010:__alloc_pages_noprof+0xe8/0x7b0 [ 62.255529][ T2019] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d 32 0f ee 05 00 0f 85 be 00 00 00 c6 05 25 0f ee 05 01 <0f> 0b 31 c0 e9 b0 00 00 00 83 fb 0a 0f 87 a5 00 00 00 44 8b 64 24 [ 62.275163][ T2019] RSP: 0018:ffffc9000c8b7860 EFLAGS: 00010246 [ 62.281296][ T2019] RAX: 0000000000000000 RBX: 000000000000000f RCX: 0000000000000000 [ 62.289290][ T2019] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000c8b7918 [ 62.297258][ T2019] RBP: ffffc9000c8b7988 R08: ffffc9000c8b7917 R09: 0000000000000000 [ 62.305234][ T2019] R10: ffffc9000c8b7900 R11: fffff52001916f23 R12: ffffc9000c8b78a0 [ 62.313214][ T2019] R13: dffffc0000000000 R14: 1ffff92001916f10 R15: 0000000000000000 [ 62.321195][ T2019] FS: 00007f9bfe75e6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 62.330175][ T2019] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 62.336756][ T2019] CR2: 0000200000001000 CR3: 000000011abf8000 CR4: 00000000003526b0 [ 62.344738][ T2019] Call Trace: [ 62.348005][ T2019] [ 62.350936][ T2019] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 62.356999][ T2019] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 62.362730][ T2019] ? incfs_realloc_mount_info+0xa7/0x4d0 [ 62.368357][ T2019] ___kmalloc_large_node+0x81/0x220 [ 62.373557][ T2019] ? incfs_realloc_mount_info+0xa7/0x4d0 [ 62.379201][ T2019] __kmalloc_large_node_noprof+0x1e/0xe0 [ 62.384818][ T2019] ? incfs_realloc_mount_info+0xa7/0x4d0 [ 62.390445][ T2019] __kmalloc_noprof+0x336/0x530 [ 62.395287][ T2019] ? __cfi_lockref_get+0x10/0x10 [ 62.400241][ T2019] incfs_realloc_mount_info+0xa7/0x4d0 [ 62.405699][ T2019] ? incfs_add_sysfs_node+0x118/0x240 [ 62.411072][ T2019] incfs_alloc_mount_info+0x479/0x600 [ 62.416437][ T2019] incfs_mount_fs+0x3ca/0x960 [ 62.421116][ T2019] ? __cfi_incfs_mount_fs+0x10/0x10 [ 62.426314][ T2019] ? vfs_parse_fs_string+0x102/0x170 [ 62.431596][ T2019] ? selinux_capable+0x38/0x50 [ 62.436359][ T2019] legacy_get_tree+0x106/0x1b0 [ 62.441122][ T2019] ? __cfi_incfs_mount_fs+0x10/0x10 [ 62.446343][ T2019] vfs_get_tree+0x9e/0x290 [ 62.450763][ T2019] do_new_mount+0x251/0xb40 [ 62.455255][ T2019] ? security_capable+0xcf/0xf0 [ 62.460117][ T2019] path_mount+0x688/0x1050 [ 62.464531][ T2019] ? putname+0x113/0x150 [ 62.468767][ T2019] __se_sys_mount+0x2bd/0x480 [ 62.473442][ T2019] ? __x64_sys_mount+0xf0/0xf0 [ 62.478196][ T2019] ? __kasan_check_write+0x18/0x20 [ 62.483365][ T2019] ? fpregs_restore_userregs+0x11d/0x260 [ 62.488994][ T2019] __x64_sys_mount+0xc3/0xf0 [ 62.493582][ T2019] x64_sys_call+0x2021/0x2ee0 [ 62.498256][ T2019] do_syscall_64+0x58/0xf0 [ 62.502683][ T2019] ? clear_bhb_loop+0x50/0xa0 [ 62.507353][ T2019] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 62.513240][ T2019] RIP: 0033:0x7f9bfd98f6c9 [ 62.517663][ T2019] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 62.537317][ T2019] RSP: 002b:00007f9bfe75e038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 62.545740][ T2019] RAX: ffffffffffffffda RBX: 00007f9bfdbe5fa0 RCX: 00007f9bfd98f6c9 [ 62.553716][ T2019] RDX: 0000200000000380 RSI: 00002000000002c0 RDI: 0000200000000240 [ 62.561700][ T2019] RBP: 00007f9bfda11f91 R08: 0000200000000580 R09: 0000000000000000 [ 62.569681][ T2019] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000000 [ 62.577646][ T2019] R13: 00007f9bfdbe6038 R14: 00007f9bfdbe5fa0 R15: 00007ffe69cb4d98 [ 62.585618][ T2019] [ 62.588626][ T2019] ---[ end trace 0000000000000000 ]--- [ 62.594240][ T2019] incfs: Error allocating mount info. -12 [ 62.600411][ T2019] incfs: mount failed -12 [ 62.602257][ T1920] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 62.612600][ T1920] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 62.620056][ T1920] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 62.627443][ T1920] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 62.634845][ T1920] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 62.642395][ T1920] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 62.649804][ T1920] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 62.657175][ T1920] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 62.664555][ T1920] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 62.671936][ T1920] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 62.679315][ T1920] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 62.686688][ T1920] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 62.694072][ T1920] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 62.701457][ T1920] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 62.708808][ T1920] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 62.716355][ T1920] plantronics 0003:047F:FFFF.000C: No inputs registered, leaving [ 62.725061][ T1920] plantronics 0003:047F:FFFF.000C: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 62.738982][ T1920] usb 3-1: USB disconnect, device number 25