last executing test programs: 6m0.697706803s ago: executing program 3 (id=3749): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000480)={0x42, 0x5, 0x1, 0x3}, 0x10) sendmsg$tipc(r1, &(0x7f0000000400)={&(0x7f00000008c0), 0x58, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x20) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCADDRT(r4, 0x890b, &(0x7f0000000380)={0x0, {0x2, 0x4e27, @empty}, {0x2, 0x0, @remote}, {0x2, 0x4e21, @empty}, 0x107, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000300)={0x2, 0x0, [{0x80000000, 0x5, 0x7, 0x1285, 0x1003, 0x2a, 0xc}, {0x7, 0x6, 0x4, 0x3ff, 0xd, 0xffff0000}]}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfee, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x40000000000000, 0xe}, @fda={0x66646185, 0x1, 0x0, 0x38}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0x1d}}, &(0x7f0000000180)={0x0, 0x28, 0x48}}, 0x400}], 0x50, 0x0, &(0x7f0000000300)="6cc2517326f0182dfaea8b9b0efefe72ca2b3f10c526bb82d4a3786efb2df4fda2a1e2888f71a664cc5a261719fe4cead4d24dcc14edceace088490d882b563ef630b62d95fb3e1b01b472ec8da1d1df"}) 6m0.485718587s ago: executing program 3 (id=3752): mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1000, 0x0) lstat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(0xffffffffffffffff, r0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x3, 0x3, 0x0, 0x4, 0x5}) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x1cb480, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, &(0x7f0000000240)=0x10, 0x4) r4 = dup2(r3, r2) read$FUSE(r4, &(0x7f0000001000)={0x2020}, 0x2020) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x28000, 0x10) faccessat2(r5, &(0x7f0000000040)='./file0\x00', 0x10, 0x300) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000040)={0x4000000, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={0x2, 0xf, 0x0, 0x7, 0x10, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}, @sadb_x_policy={0x8, 0x12, 0x0, 0x4, 0x0, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in6=@empty, @in6=@private2}}, @sadb_address={0x3, 0x6, 0x0, 0x20, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x80}}, 0x0) r7 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r8 = socket$tipc(0x1e, 0x2, 0x0) socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r8, 0x10f, 0x87, &(0x7f0000000100)={0x41, 0x3}, 0x3c) sendmsg$tipc(r7, &(0x7f0000000180)={&(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x1, 0x3}}}, 0x10, 0x0}, 0x40015) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000500)=[@decrefs={0x40046307, 0x200002}], 0x0, 0x0, 0x0}) 5m59.615871924s ago: executing program 3 (id=3765): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000000)={0x73622a85, 0x200b, 0x1}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x70, 0x0, 0x1, 0x401, 0x11, 0x0, {0x2, 0x0, 0xfffd}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0xc, 0x6, 0x0, 0x1, [@CTA_NAT_V4_MINIP={0x8, 0x1, @rand_addr=0x64010101}]}]}, 0x70}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$inet(r3, &(0x7f0000000740)={&(0x7f0000000140)={0x2, 0x4e22, @local}, 0x10, 0x0, 0x0, &(0x7f0000000600)=[@ip_retopts={{0x2c, 0x0, 0x7, {[@timestamp_prespec={0x44, 0x1c, 0x17, 0x3, 0x5, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x7188}, {@broadcast, 0x9}, {@dev={0xac, 0x14, 0x14, 0x22}, 0xfffffffa}]}]}}}], 0x30}, 0x4000014) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_int(r4, 0x29, 0x49, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x4}, @fd={0x66642a85, 0x0, r0}, @fda={0x66646185, 0x6, 0x0, 0x200000000000024}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) 5m59.524722366s ago: executing program 3 (id=3767): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x1501) socket$nl_xfrm(0x10, 0x3, 0x6) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x3, 0x44, &(0x7f00000001c0)={0x20, 0x3, 0x17, 0xd}, 0x8, 0x20, 0x3, 0x0, 0x4bf, 0x404, 0x0}) (async) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$USBDEVFS_REAPURB(r1, 0x4008550c, 0x0) ioctl$sock_bt_hci(r0, 0x400448e1, &(0x7f00000000c0)) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='vfat\x00', 0x808081, 0x0) 5m59.34888072s ago: executing program 3 (id=3768): mkdir(&(0x7f0000000000)='./file0\x00', 0x2) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x400, &(0x7f0000000100)=ANY=[@ANYBLOB='noswap,huge=never,nr_blocks=G']) r0 = gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(0x0, 0x0, 0x0, &(0x7f00000000c0)={[0x8001a0ffffffff]}, 0x8) ioctl$int_in(r1, 0x5452, &(0x7f0000000180)=0xffffffffffffffff) fcntl$setsig(r1, 0xa, 0x12) ppoll(&(0x7f0000000100)=[{r2}], 0x1, 0x0, &(0x7f0000000080)={[0x8001a0efffffff]}, 0x8) dup2(r1, r2) fcntl$setown(r2, 0x8, r0) tkill(r0, 0x13) openat$procfs(0xffffff9c, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r4, 0xa02000000000000, 0x60, &(0x7f0000000100)={'filter\x00', 0xb001, 0x4, 0x408, 0x238, 0x130, 0x238, 0x320, 0x320, 0x320, 0x7fffffe, 0x0, {[{{@arp={@local, @empty, 0x0, 0x0, 0x0, 0x0, {}, {@mac=@local, {[0x0, 0x0, 0x0, 0x0, 0x0, 0x1fe]}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pimreg\x00', 'veth0_to_bridge\x00'}, 0xc0, 0x130}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f67b23ffdfa27f907a03732da3acbc6518e62a77ca06f258762e88c0d9f9d2f413b94a105f4bdf01425ce81c5d000000000000000500ffffffff00"}}}, {{@arp={@multicast2, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0_to_team\x00', 'ip6tnl0\x00'}, 0xc0, 0x108}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x10001, 'syz0\x00', {0x7b}}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x8000, 0x101}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x458) chmod(&(0x7f0000000080)='./file0\x00', 0x2) read$FUSE(r3, &(0x7f0000006b40)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x206e) ioprio_get$pid(0x3, r5) 5m58.389661869s ago: executing program 3 (id=3773): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x1000, 0x8, '9P2000.u'}, 0x15) r3 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r3, 0x8946, 0x0) r4 = dup(r3) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000004380), 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[], [], 0x6b}}) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cpuinfo\x00', 0x0, 0x0) sendfile(r0, r5, 0x0, 0x20000023896) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000100)={0x1, 0x9, 0xd, 0x766425b1, 0x18, "0f6dd54109be6eae2d4ea9522a508e543476e4"}) timer_settime(0x0, 0x0, &(0x7f0000000640)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_usb_connect(0x0, 0x36, 0x0, 0x0) r6 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) ioctl$TCSETSF2(r6, 0x402c542d, &(0x7f00000003c0)={0xfffffff8, 0xfffffff9, 0x1, 0x9, 0x7, "ea713977e0715f01bbff00", 0x6, 0x75}) ioctl$TIOCSTI(r6, 0x5412, &(0x7f00000001c0)=0xd) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSETAF(r7, 0x5408, &(0x7f0000000080)={0x49de, 0x0, 0xfffc, 0xbfff, 0x19, "ec28a144f13d7607"}) sendmmsg(0xffffffffffffffff, &(0x7f0000000540), 0x0, 0xc88c4) write$binfmt_aout(r7, &(0x7f0000000280)=ANY=[], 0xff2e) ioctl$TCSETS(r7, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x12, "0062ba5d8200"}) r8 = syz_open_pts(r7, 0x30802) dup3(r8, r7, 0x0) r9 = creat(&(0x7f0000000080)='./file0\x00', 0x47) cachestat(r7, &(0x7f0000000040)={0x1, 0xe}, 0x0, 0x20) ioctl$VT_RELDISP(r9, 0x5605) ioctl$TIOCSTI(r7, 0x5412, &(0x7f0000000000)=0x44) 5m43.405019171s ago: executing program 32 (id=3773): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x1000, 0x8, '9P2000.u'}, 0x15) r3 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r3, 0x8946, 0x0) r4 = dup(r3) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000004380), 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[], [], 0x6b}}) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cpuinfo\x00', 0x0, 0x0) sendfile(r0, r5, 0x0, 0x20000023896) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000100)={0x1, 0x9, 0xd, 0x766425b1, 0x18, "0f6dd54109be6eae2d4ea9522a508e543476e4"}) timer_settime(0x0, 0x0, &(0x7f0000000640)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_usb_connect(0x0, 0x36, 0x0, 0x0) r6 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) ioctl$TCSETSF2(r6, 0x402c542d, &(0x7f00000003c0)={0xfffffff8, 0xfffffff9, 0x1, 0x9, 0x7, "ea713977e0715f01bbff00", 0x6, 0x75}) ioctl$TIOCSTI(r6, 0x5412, &(0x7f00000001c0)=0xd) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSETAF(r7, 0x5408, &(0x7f0000000080)={0x49de, 0x0, 0xfffc, 0xbfff, 0x19, "ec28a144f13d7607"}) sendmmsg(0xffffffffffffffff, &(0x7f0000000540), 0x0, 0xc88c4) write$binfmt_aout(r7, &(0x7f0000000280)=ANY=[], 0xff2e) ioctl$TCSETS(r7, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x12, "0062ba5d8200"}) r8 = syz_open_pts(r7, 0x30802) dup3(r8, r7, 0x0) r9 = creat(&(0x7f0000000080)='./file0\x00', 0x47) cachestat(r7, &(0x7f0000000040)={0x1, 0xe}, 0x0, 0x20) ioctl$VT_RELDISP(r9, 0x5605) ioctl$TIOCSTI(r7, 0x5412, &(0x7f0000000000)=0x44) 5m42.742167134s ago: executing program 4 (id=4070): r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x62, 0x0, &(0x7f0000000200)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x138a, 0x1000000003}) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000002400070dfeffffff00000000017c000004008e000c0001800600", @ANYRESOCT=r0, @ANYRES64=r0], 0x3c}, 0x1, 0x0, 0x0, 0x4048011}, 0x4044000) (async) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000040)={0x1}) 5m42.649663516s ago: executing program 4 (id=4075): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) r1 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r2, 0x5452, &(0x7f0000b28000)=0x3) fcntl$setsig(r2, 0xa, 0x12) poll(&(0x7f0000b2c000)=[{r3}], 0x2c, 0xffffffffffbffff8) dup2(r2, r3) fcntl$setown(r2, 0x8, r1) tkill(r1, 0x13) ptrace(0x8, r1) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r5, 0x4068aea3, &(0x7f0000000140)={0xa8, 0x0, 0x1}) ioctl$KVM_GET_DIRTY_LOG(r5, 0x4010ae42, &(0x7f00000000c0)={0x0, 0x0, &(0x7f000000f000/0x2000)=nil}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000002680)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0xffffffffffffff8b, 0x18, &(0x7f00000004c0)={@ptr={0x70742a85, 0x2, &(0x7f0000000280)=""/226, 0xe2, 0x2, 0x138}, @fda={0x66646185, 0xffffffffffffffff, 0x0, 0xe}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x28}}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}, 0x40}], 0x0, 0x0, 0x0}) 5m42.424226081s ago: executing program 4 (id=4081): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_group_source_req(r2, 0x0, 0x2e, &(0x7f0000000080)={0xd, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @multicast2}}}, 0x108) setsockopt$inet_MCAST_MSFILTER(0xffffffffffffffff, 0x0, 0x30, &(0x7f0000000800)=ANY=[@ANYBLOB="090000000000000002000000e000000200"/88], 0x290) write(r1, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) r4 = fsopen(&(0x7f0000000680)='sockfs\x00', 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r4, 0x7, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCFLSH(r3, 0x400455c8, 0x0) syz_usb_connect(0x0, 0x4a, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) umount2(&(0x7f0000000000)='./file0\x00', 0x8) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 5m39.692569984s ago: executing program 4 (id=4140): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x40902, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x8fe69000) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000331000/0x400000)=nil) futex(0x0, 0xd, 0x0, 0x0, 0x0, 0x2) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000)=0x1, 0x0) madvise(&(0x7f00001e2000/0x400000)=nil, 0x400000, 0x17) 5m39.601530386s ago: executing program 4 (id=4143): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0xfffffffffffd) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000040)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000240)={@flat=@weak_binder={0x77622a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0x0, 0x3}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x200000000000001}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder1\x00', 0x800, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0xfffffffffffd) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000040)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000240)={@flat=@weak_binder={0x77622a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0x0, 0x3}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x200000000000001}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) (async) 5m39.530373657s ago: executing program 33 (id=4143): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0xfffffffffffd) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000040)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000240)={@flat=@weak_binder={0x77622a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0x0, 0x3}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x200000000000001}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder1\x00', 0x800, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0xfffffffffffd) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000040)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000240)={@flat=@weak_binder={0x77622a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0x0, 0x3}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x200000000000001}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) (async) 4.457812743s ago: executing program 0 (id=8107): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) getpgid(0x0) r1 = getpid() syz_pidfd_open(r1, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={r1, 0x40001, 0xd51}) r2 = syz_open_pts(0xffffffffffffffff, 0x4c0701) ioctl$KDGKBDIACR(r2, 0x4b4a, &(0x7f0000000100)=""/197) (async) ioctl$KDGKBDIACR(r2, 0x4b4a, &(0x7f0000000100)=""/197) 4.449304703s ago: executing program 0 (id=8108): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x103, 0x3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000200)=[@enter_looper], 0x50, 0x0, &(0x7f0000000380)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) r1 = socket(0x10, 0x803, 0x0) recvmsg$unix(r1, &(0x7f00000007c0)={0x0, 0x0, 0x0}, 0x40000001) r2 = mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioprio_get$pid(0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x100, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}, @acquire={0x40046305, 0x3}, @free_buffer={0x40086303, r2}, @acquire={0x40046305, 0x3}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000280)={0x30, 0x30, 0x30}}, 0x40}], 0x0, 0x0, 0x0}) 3.581698269s ago: executing program 0 (id=8119): syz_usb_connect(0xa, 0x752, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x6, 0x21, 0xeb, 0x10, 0x5e0, 0x600, 0xacdb, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x740, 0x4, 0x81, 0x8, 0x90, 0x8, [{{0x9, 0x4, 0x89, 0x89, 0x5, 0xe8, 0xb4, 0x59, 0x3, [@hid_hid={0x9, 0x21, 0x6, 0x1, 0x1, {0x22, 0x95e}}], [{{0x9, 0x5, 0xb, 0x3, 0x20, 0x9, 0x1, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0xf7, 0x101}, @generic={0x13, 0x10, "c0f9a758418a537d546a6a5a142f1ab229"}]}}, {{0x9, 0x5, 0xb, 0xb27317013a303bd2, 0x3ff, 0x3, 0x6, 0x0, [@generic={0x26, 0x7, "a82eb53c4e716cf707693b0b81af2feb72cbb1afaa23d0ad21ab11e3230475daab241932"}, @generic={0xdc, 0xa054bac8d4e2a1fb, "665611bbbb123d9aa7e83feb8ac76cd3e0abb956a713c751eb80786bffb769234c3b0978c2824189342357394f43b9b09adb8180bf64e5d9706bae11f580f0ec1b32071d62808f0a25e2de6768be3cac1a1a0b03203638071a8135028b3f8461c266bec4dd254b28412af1a5449febb260b90ea754e09160424169a0fcda4ec91ae603d96fdb835a3b4eaf65609e5d96bde3515e2537f34085e701351b957bd7036246d54a2db99171d4b4badebaa41e2e9b621a6d19d1ffe27ca7ab609aef20cb2624ebe570138fc3ccab3ce9968355bb45dd780a0c507f52e0"}]}}, {{0x9, 0x5, 0xb, 0x10, 0x40, 0x74, 0xe8, 0x10, [@generic={0x8c, 0x30, "85f104fc039a2417d4bb1cfab17ddb22ffe216837a0e257230aed7e6ee2abed1241e59c7c43781ae9b5b7266900cdf9d039eff162824e13e1ddc230d66122f0436ef878b6a044669847f56cbc218e5dcf8aa6b6dacc242e1a2f7ec43ddcf0c7f7f05648c75a3ce914c987eba4fb6291f54f36304bb2abfd3922d9f07f6a72a375920708315b97e218642"}]}}, {{0x9, 0x5, 0x2, 0xc, 0x0, 0xb, 0x6, 0x81}}, {{0x9, 0x5, 0xa, 0x8, 0x40, 0x5, 0x9, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x6d, 0x500}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0xbf, 0x3}]}}]}}, {{0x9, 0x4, 0x50, 0x60, 0x2, 0xff, 0x15, 0x78, 0x51, [@generic={0x8d, 0x23, "fd42a3a87a5006fc15be7b7cc4b44d20690b2971c0158dc47e74eea401f67974d02007537acfcc17614d328971e1d9d48c61ee8944b978f55308abc933b0833682cd4d8166af727f3beeb3657dab47692b208d82b4afb0b0b739d5ac7753c78e4e09b898352472026428cdb6e645455ee22acc7de3c1a74106b9dae0d469ee2aead098381b26d1568b0867"}], [{{0x9, 0x5, 0xf, 0x10, 0x10, 0x3, 0x4, 0x40, [@generic={0x31, 0x10, "8a07f4c3db93526a83bb4d61f08668395257c24e8b8bf2b9f2a554128853df1cdae0c1eea21e0955c878cc344ba5fb"}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x80, 0x3ff}]}}, {{0x9, 0x5, 0x1, 0x4, 0x200, 0x5, 0x2, 0x0, [@generic={0x95, 0x24, "791993ea1d4f2a721c214e844070b5a114ec157bccaee97a7b440da8cdcdd59b0b3eea4733e48a957f1d0437e08bd0b999d9f87470de6e81d4d6929d70afd4752aaa7c1f28420410050327e3de0b27837cbe4dd9e4f5f1ab77f540654ad9af58ae692764fb330bae4e3673d450c9064f84aca647a8a2cf26741dcb026ef03fffc266e2260102519ba2d54896f010ee3c43652a"}, @uac_iso={0x7, 0x25, 0x1, 0x3, 0x4, 0x1}]}}]}}, {{0x9, 0x4, 0x3e, 0x2, 0xc, 0x56, 0x32, 0xe, 0x1, [@hid_hid={0x9, 0x21, 0x8, 0x7, 0x1, {0x22, 0x205}}], [{{0x9, 0x5, 0x0, 0x1, 0x40, 0x9, 0x7, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x3, 0x38}, @generic={0x3d, 0x21, "86c635baea77c3be9e64d81b89a81782c106bebfb7231d3f33cba545f12f1c4969d2ddafe665973ae0a054fa99c9eb2dac39c5c34ab889fea2edf5"}]}}, {{0x9, 0x5, 0x9, 0x10, 0x40, 0x2, 0x5e}}, {{0x9, 0x5, 0x5, 0x0, 0x600, 0x2, 0xf2, 0x5}}, {{0x9, 0x5, 0xfa0b234a28843061, 0x0, 0x10, 0x8, 0x2, 0x3}}, {{0x9, 0x5, 0x2, 0x0, 0x20, 0x10, 0x4, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x4, 0x8001}, @generic={0x3d, 0x6, "ced18879620cdb08fea5fbf366b24575ae7cb53692d0a5f1a0317fcf180f5ccd3257ba8f592f89a2afe551a4fca02109998be7663595c7e354b422"}]}}, {{0x9, 0x5, 0xb, 0x10, 0x10, 0x2, 0x4c}}, {{0x9, 0x5, 0x80, 0x10, 0x0, 0x0, 0xb1, 0x5, [@generic={0xc6, 0x21, "11c0e61db5e6a9808c0261f017406f9dbe2a1c1b4618667786acbdcd0a7a5af49ff9e7143f7cd66688c1cb8d41ea691b6f10431e729e033264a1397b7c5051cd0b68869f3a65da265ef2e73af22baba9388699275a4e840ab9ec546a3903b9eb90b4e9c703c13e2303c4ecb6a257aaf4c39febb03cc0272ca60978ef4ba57537bb90c9f464f98931d8abf5961b5fa1c7cd19f4d38bcbfeafb15195960be1a3f5aba0bd681f3c5d7d30e5df959a3fc1fed9bac0fe4374e66c841c899d21fe2b1da0f80046"}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x40, 0x1}]}}, {{0x9, 0x5, 0x8d, 0x10, 0x40, 0x5, 0x95, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x6, 0x1}, @uac_iso={0x7, 0x25, 0x1, 0x1, 0x1, 0x1ff}]}}, {{0x9, 0x5, 0xc, 0x3, 0x200, 0x58, 0x13, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x4, 0x6}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x9, 0x3e}]}}, {{0x9, 0x5, 0xf, 0x10, 0x10, 0x6, 0x1, 0x2, [@generic={0xd4, 0xd, "ae2dfe1eef08c42e42faf7867fd7e54aeaecc04db780e97ca2ee4bcc9aedab42cb313f479081c21f3d7f71cd7ab30a058eae8dfbcb49e1049cae87e7df9939858ec3757821e47c10239d28c3d40d159eebba2ba96dc28f041dec258ab7d89c2c105492c274537377e1d34d6e4ca513e5623c316cc4e01b139f9d0831c052f2b47b261af28a79313654637c99728b56dc255b8689459d3d2dbfa4f3ff1a240fafd72e3c75973315f6da2ba972c9fb9b45311fa19b686e7e98191a277ff55b809e7f743de3d1511b37a08a56065f7b38a2087a"}, @uac_iso={0x7, 0x25, 0x1, 0x1, 0xd, 0x2}]}}, {{0x9, 0x5, 0xf, 0x1, 0x400, 0x4, 0xff, 0x2}}, {{0x9, 0x5, 0xf, 0x10, 0x40, 0xff, 0xa, 0xff, [@generic={0x68, 0x23, "8dcc9b3aae73a7b975866543beee56b14f39ee4da5f15350df91d45cd9703fff36a04e8b868812e9cd380cc9a668df1f24329e9a3bf9b307852b7fa6b621e4df5ec02305c40d78de2f114251b3a2ca5b6ec9411101f2343847f2be2bad757a698ed9f6fe4dbf"}]}}]}}, {{0x9, 0x4, 0x8, 0x4, 0x3, 0x5b, 0xfa, 0xa, 0x7, [], [{{0x9, 0x5, 0x3, 0x10, 0x40, 0x8, 0x7, 0xfc, [@generic={0x62, 0x22, "2917cf2d7158c02d0f3e5cc154a115adc15c2bae722e8053fc1b414dc460332195a6fd3d49a72d722a0c053bc2390d380dd62ba81fc1bf4ae3d6625b1496c2aeb54241f842760009a5f82625aa35984d561025f2db794e6bd08d67a0d1eedd37"}]}}, {{0x9, 0x5, 0x80, 0x4, 0x10, 0x3, 0x80, 0xfc}}, {{0x9, 0x5, 0x9, 0x10, 0x40, 0xf7, 0x2, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x7, 0xfd, 0xe1}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x7a, 0x9}]}}]}}]}}]}}, &(0x7f0000000b00)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x300, 0x0, 0xc, 0x40, 0x40, 0x5}, 0x4d, &(0x7f0000000040)={0x5, 0xf, 0x4d, 0x4, [@ssp_cap={0xc, 0x10, 0xa, 0x83, 0x0, 0xfe, 0xff0f}, @ss_container_id={0x14, 0x10, 0x4, 0x70, "3e57af7293179e59d8650a5658b79435"}, @ss_container_id={0x14, 0x10, 0x4, 0xac, "ff85a0e3d8a1c82f297b68ac5cfc8c19"}, @ss_container_id={0x14, 0x10, 0x4, 0x81, "6059cc1283019b96add62616ad720690"}]}, 0x7, [{0x32, &(0x7f0000000880)=@string={0x32, 0x3, "2048e182befa098a6575f5e3e0476058e1c7d05f42fad7a70c7f10abcae58cf8c771b4866a273db94f55b484f77e190b"}}, {0x69, &(0x7f00000008c0)=@string={0x69, 0x3, "9e6475eef80c1a32b6eafef4ccbe25da3636137fff1605503601005aadec3d05b4f9702192d9fedc8f33d5b5ec65528296f7282c4816ea035564f3dc5e8ee4b7c55710b9bb2d0d1794c89fcc625501d6880db9df4018cee2e1ae742155499b44a0777cd2e350a5"}}, {0x4, &(0x7f0000000940)=@lang_id={0x4, 0x3, 0x448}}, {0x4, &(0x7f0000000980)=@lang_id={0x4, 0x3, 0x410}}, {0x4, &(0x7f00000009c0)=@lang_id={0x4, 0x3, 0x412}}, {0x0, 0xfffffffffffffffd}, {0xdf, &(0x7f0000000a00)=@string={0xdf, 0x3, "d843e586fca4df4ceeeb63de8fce177fbe496a8c376ef23c2a0a3027facf38805e59f220976b0b8cbedfefbd5327b69099fdf3dd9ba9e9ff5918cd669640a98e5afba88121168eccf61e883c5ecfba0e34edd81b25522ec720b7f72035dfa330743d4b83a7ebf6ec853f867d8cfd69ad980afd99e7f85f169b73f498995f92bed90964bcc94e7b3d5a5e1b0402b104f4b70373b730a7eb9b6643b5d120f27b41dea2b1b3d42c4b152e2ad903c10fb2480c24575f60f756cc5d0fcd3d5909bb0515bf24ffd26431262d9be3954f355056a0268380983f704f5c130df8ae"}}]}) (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000100)='system.posix_acl_default\x00', &(0x7f0000000200)={{}, {0x1, 0x1}, [{0x2, 0x3}], {0x4, 0x5}, [], {0x10, 0x7}, {0x20, 0x4}}, 0x2c, 0x1) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) (async) openat$ashmem(0xffffffffffffff9c, &(0x7f00000000c0), 0x88602, 0x0) 3.025455501s ago: executing program 0 (id=8132): socket$pppl2tp(0x18, 0x1, 0x1) (async) socket$pppl2tp(0x18, 0x1, 0x1) fstat(0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) timerfd_create(0x0, 0x0) (async) r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000140), 0x0) clock_adjtime(0x0, &(0x7f0000000000)={0xffff, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3b9ac9ff, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc}) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x41c881, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0xffff8000) getrandom(&(0x7f0000000240)=""/286, 0x11e, 0x3) unshare(0x20040600) (async) unshare(0x20040600) r2 = syz_clone3(&(0x7f0000001880)={0x100000200, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) tgkill(r2, r2, 0x27) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 2.855386804s ago: executing program 0 (id=8136): mount(&(0x7f0000000080)=@md0, &(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0)='ext3\x00', 0x200000, 0x0) 2.777938205s ago: executing program 0 (id=8139): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x20a00, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0xa, 0x8010, r0, 0xa6717000) (async) preadv2(r0, &(0x7f0000000580)=[{&(0x7f0000000000)=""/118, 0x76}, {0x0}, {0x0, 0xfe91}], 0x3, 0x9, 0xd, 0x9) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000080)={r0, 0x7fffffff, 0x7f, 0x63}) (async) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) capset(&(0x7f0000000c00)={0x20080522}, &(0x7f0000000140)) (async) mlockall(0x2) (async) brk(0x689d80000000) (async) r3 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) (async) ioperm(0x3, 0x7, 0x7) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x1, 0x0) fchdir(r4) (async) mount$bpf(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000180), 0x0, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x11) ioctl$UI_SET_LEDBIT(r2, 0x40045569, 0x2) (async) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000280)={{0x101, 0x200, 0x4, 0x5}, 'syz1\x00', 0x1c}) ioctl$UI_DEV_CREATE(r2, 0x5501) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000009e602206d0414c300a00009049000010301592de704f164011e0937f97e689ad47200086ce822"], 0x0) syz_usb_control_io$hid(r5, &(0x7f00000001c0)={0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="00020c000000"], 0x0, 0x0, 0x0}, 0x0) (async) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) (async) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x1000, 0x1}) 2.090176659s ago: executing program 2 (id=8149): r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x2000}) ioctl$SNDRV_TIMER_IOCTL_TRIGGER(0xffffffffffffffff, 0x54a6) read$FUSE(r0, &(0x7f0000000040)={0x2020, 0x0, 0x0, 0x0}, 0x2020) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000002080)={{{@in6=@dev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@initdev}}, &(0x7f0000002180)=0xe8) r4 = getgid() write$FUSE_ATTR(r0, &(0x7f00000021c0)={0x78, 0x0, r1, {0x3, 0x9, 0x0, {0x1, 0x1, 0x9ab, 0xfff, 0x8dee486, 0x8001, 0x2, 0x5, 0x1000, 0xb000, 0x3, r3, r4, 0xf, 0x7}}}, 0x78) r5 = openat2(r0, &(0x7f0000002240)='./file0\x00', &(0x7f0000002280)={0x20800, 0x101, 0x19}, 0x18) read$rfkill(r5, &(0x7f00000022c0), 0x8) ioctl$TIOCL_GETKMSGREDIRECT(r5, 0x541c, &(0x7f0000002300)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000002380)={0x4, &(0x7f0000002340)=[{0x1400, 0x8, 0x3, 0x9}, {0xe, 0x3, 0x3, 0x7ccb}, {0x81, 0x2, 0x5, 0x3ff}, {0xffff, 0x8, 0x5, 0x8}]}) ioctl$VHOST_GET_FEATURES(r5, 0x8008af00, &(0x7f00000023c0)) pipe(&(0x7f0000002400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000002440)={0xaa, 0x200}) ioctl$UI_SET_PROPBIT(r0, 0x4004556e, 0x1f) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000002580)={'tunl0\x00', &(0x7f0000002480)={'sit0\x00', 0x0, 0x10, 0x8000, 0xe44, 0x9, {{0x29, 0x4, 0x2, 0xb, 0xa4, 0x64, 0x0, 0x5, 0x2f, 0x0, @loopback, @remote, {[@lsrr={0x83, 0x23, 0x1b, [@multicast1, @empty, @rand_addr=0x64010100, @multicast1, @loopback, @local, @loopback, @broadcast]}, @ssrr={0x89, 0x2b, 0xab, [@multicast2, @rand_addr=0x64010101, @empty, @rand_addr=0x64010100, @dev={0xac, 0x14, 0x14, 0xa}, @initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, @private=0xa010102]}, @timestamp={0x44, 0x4, 0xe4, 0x0, 0x8}, @lsrr={0x83, 0xb, 0x1e, [@broadcast, @multicast2]}, @lsrr={0x83, 0x1f, 0xab, [@rand_addr=0x64010102, @private=0xa010102, @remote, @multicast1, @private=0xa010102, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback]}, @timestamp_addr={0x44, 0x14, 0xa3, 0x1, 0xb, [{@private=0x1, 0xfff}, {@local, 0x1}]}]}}}}}) ioctl$VHOST_RESET_OWNER(r6, 0xaf02, 0x0) chroot(&(0x7f00000025c0)='./file0\x00') recvmmsg(r6, &(0x7f0000006ac0)=[{{0x0, 0x0, &(0x7f00000037c0)=[{&(0x7f0000002600)=""/91, 0x5b}, {&(0x7f0000002680)=""/4096, 0x1000}, {&(0x7f0000003680)=""/33, 0x21}, {&(0x7f00000036c0)=""/231, 0xe7}], 0x4, &(0x7f0000003800)}, 0xb848}, {{&(0x7f0000003840)=@sco={0x1f, @fixed}, 0x80, &(0x7f0000005ac0)=[{&(0x7f00000038c0)=""/4096, 0x1000}, {&(0x7f00000048c0)=""/60, 0x3c}, {&(0x7f0000004900)=""/188, 0xbc}, {&(0x7f00000049c0)=""/4096, 0x1000}, {&(0x7f00000059c0)=""/92, 0x5c}, {&(0x7f0000005a40)=""/108, 0x6c}], 0x6, &(0x7f0000005b40)=""/211, 0xd3}, 0x7ff}, {{0x0, 0x0, &(0x7f00000060c0)=[{&(0x7f0000005c40)=""/124, 0x7c}, {&(0x7f0000005cc0)=""/216, 0xd8}, {&(0x7f0000005dc0)=""/74, 0x4a}, {&(0x7f0000005e40)=""/61, 0x3d}, {&(0x7f0000005e80)=""/86, 0x56}, {&(0x7f0000005f00)=""/61, 0x3d}, {&(0x7f0000005f40)=""/216, 0xd8}, {&(0x7f0000006040)=""/72, 0x48}], 0x8, &(0x7f0000006140)=""/212, 0xd4}, 0x3}, {{0x0, 0x0, &(0x7f0000006280)=[{&(0x7f0000006240)}], 0x1}, 0x6}, {{&(0x7f00000062c0)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000006440)=[{&(0x7f0000006340)=""/202, 0xca}], 0x1}, 0x7}, {{&(0x7f0000006480)=@l2tp6={0xa, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000006680)=[{&(0x7f0000006500)=""/33, 0x21}, {&(0x7f0000006540)=""/111, 0x6f}, {&(0x7f00000065c0)=""/111, 0x6f}, {&(0x7f0000006640)=""/59, 0x3b}], 0x4, &(0x7f00000066c0)=""/236, 0xec}, 0x7}, {{&(0x7f00000067c0)=@vsock={0x28, 0x0, 0x0, @hyper}, 0x80, &(0x7f0000006a00)=[{&(0x7f0000006840)=""/174, 0xae}, {0xfffffffffffffffc}, {&(0x7f0000006900)=""/168, 0xa8}, {&(0x7f00000069c0)}], 0x4, &(0x7f0000006a40)=""/66, 0x42}, 0x3f}], 0x7, 0x2000, &(0x7f0000006c80)={0x0, 0x989680}) r9 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$inet_mtu(r9, 0x0, 0xa, &(0x7f0000006cc0), &(0x7f0000006d00)=0x4) write$rfkill(r0, &(0x7f0000006d40)={0xfffffffb, 0x4, 0x3, 0x0, 0x1}, 0x8) sendmsg$netlink(r5, &(0x7f0000008380)={&(0x7f0000006d80)=@proc={0x10, 0x0, 0x25dfdbfc, 0x8000000}, 0xc, &(0x7f0000008300)=[{&(0x7f0000006dc0)={0x28, 0x33, 0x20, 0x70bd2b, 0x25dfdbfc, "", [@generic="0cc0b26f353ae9d449c9285a60e770220d", @typed={0x4, 0x54}]}, 0x28}, {&(0x7f0000006e00)={0x1058, 0x3b, 0x8, 0xbbb, 0x25dfdbfc, "", [@nested={0x100c, 0x87, 0x0, 0x1, [@generic="4fa0893f2d1e32cab62cd03e2a7ff67f7c8dceefb4c869c147acd01b987489c4ec37b5a60a9eee768936632fa556be11270d713eb79178d2235c5c73ca5e4c6d74bf7b6525b27003b26d25d3f39ec2960e57d50ed5071d52e15cfcb1d279647d5b41c7c0d02f6fbc79015d72346e8ea539666c5063d11a60ce1a658e29963374d11a35c89c4593f4e8736be1d46bffbf93c75c5529d438db29b1be132ee9f70574c623de709d108303c5036e593f6018c9fff43f84a2adee0f826df15a5ea310777805d91a5c4c4a6b8a2e9f92597ada4a92f7ad995af42aa6b3e0efc4b5c74d8d00928ef3475ebd52c9c9c73b0aabba0aeb0cbf08a301f7916de3a1f67de053d7dad38c2b32d39f0850fc77d009983948fb17e6cdca0757818ae94d80d8575667c7a4f92de6e3bfabb2eabf067106b90d7271187adb5bc094a7f9dd53d24522226b2254c84a19ebf493b7265648894f9b1c4efce304358ab2d323fd436638325fd5937feaf3f4a0623cc401b0afc821d783cd76b9e1fdd964e03169c0c77ad0a9ca9a16512fc6d653bb1cbc6bb0aa901bc581b5c082d0d9260aa48320acd23df31905cd93513585dfa2bbd46492a04b5836020519f9cfdaaeb20827f8605feac5cd951039e9ba09935e9af797395f2a96a530a410fc8c23705a4f2a28c0c815fa4a39066206a8ace5eed05c01a943c0b4287e428e9013983a6742d2ead3d9f27f1d0a1fe68b16b9062ad8feaf308fec138a4a08c614061d6831ab5c5f402ba50aad280038f36868cb14ea4368bbd0ebe1d4c7c471fd159d24314f8f7774cd72a77a99082ce3cfe962363d7b196a6df339b1c6a6b05ef6eb10005fafc2bc09d9ef245b7c1a15ceebb682114e7d3ae6b5c02ec5474753b43c4c33585d763974b5598d29d814a7588710c80fd6bf7fd9a1dd1b0952a8ca02ea33b02ee71ab71e1e4f962ba768308582464cde9722e342e095c827dad5b1a317e2dc538e4dc80ffc8c1ff7d23488b548dc0b243d9687069851311ef8e154498823f9ecc48dcaae3144cb6ecdeaa4f07596db3c249627805cdc569f62db9ae1d15da402ff45f9afb886d806eedf9f13165e3dd59c124aeba3f1745d8fc19479253c731b325d5341066519636464125f71a797d03eb6da1a7637015ac15a2d1d0f1bac04aef930085deb7362bb0ccfba6866eef98a9a232ed85db339a1ab2eda605645d833f9f9bd45cd0c3df1d883fdff3c0c772fb95af651d5070b2846216d5076a0d09226d4904d7c6428f22e2b1360ee37f35fce7cf28127caa5a4b36f68ec2e09a562a905a1fb0d006fd19cc1b6f77eead6852fa407b93a9e920eac9eba38566a4a22fe5b15a2b6284711cdca520654a7de033d16eae7805995b0b432611a280d74e5041158af63eb487027a82b9d4340b55774375ac9f6c6812e4fba7d17803a5f5dd168647375e22433b41020c07319786691e64407ef89de1fe8af79c2c96765cefc7135b171868497787c9d0d84d66ab26cbc7dd7ab95bd7361f136cfccf6c1f9ff7fef14c07007bdc703da02feec0806573df0bd856ab6f14b1f68f5cfa9c0e35d7315aef567d2202dc2e7e08a2f44876388e6d1cf17150305dfa06630e769d770e40000fefd07441caf8a396460e4384df7bf7121442899f044c837913dc76ad39cee9afcc1d3d1878259ca236b85becd17f8daacd3a61f2f93adc6f7dd9a9941387ef7de961aac247a8971ba67b8c75ce410d5d17b708f6582069e3aac04543db1cc4374a931a9580cb972e238e43464deb336ca6c3df03b2a935e4d7227d00f9256aa5f226de95fd53cc4635ed281401449f93c9dbcf9e55828039cc7a7c62fa0e2d126e65c13a89ef756cdeea4fc55020a87e38f7f66ebc204c006709af87d1aedc2a31963a7175267cdaa081a58207fdccc6b60d3e358a8d537a600eb4dff07f576968c5996905f36c733a545d22e4917072352f794b4a6e82354a662a1dba58e4ceb337c7a16645047fd01261fb18b5a370159be627239bfa6e5690fdd695654abe583ff3469abac2f258bc7618d02744b4e36637fff62e3b010fb9f7eb88b5dc5e7eac57ea32d92e9d36f0d53f4388a53fee9bf61ce92cb00128bfadf9bec318d3af96e9fba78e3f4d62d0bd3d13033f30e1a4ee519c0f9e87b889b8e3906d9c0363a3edab2f121114924f75775164c9049f2311a871a0d922fae81d0dc55b7ff2283af8ac3375f7caa7acbe5dd1988622abc9710450ab9206342d3a90dadb26d732b00a60f165f4801bcc80f30d7e4e4882447b2619469e7080965ecc085f252ae8f9488f4786949511f677c33440ee50075ac41450921ff2e9873424463fa888ea8e96f1152b46cf9bf59ce5e587c39e1a8a6dd6b4c341c3ebffa259fa0a01ba8091686654c3bbd92ee6f671a5914da159b754a53d1a07cd8e66e25d5a3b16ab321569041e7436edf548302079f5c2cddfceecb5d4493c2d03c467e38f4388851062ddb1158cb3060f6c347d65b5e52d162935ee382af75329d98df6fbfca2fb5e1ecd568738a1d54004768a531e08594dc5a6e6d5fb819efe3bd398ff30d2a27649f5594118cc8fae775ddb5ec2b887b9313140dc9d69a28afcf0896a95dfd0c5c65ef1cff7c9b5848763887c0e47ddab01c3bd1a275adbb288dd7a186814407f60da7879e59cd46da8aa600097f2fef6b8979e01c7b0610f9e5961d161535cc5c8854e03d60eeedd394c8454eebdd180d0ed5311613badc94b7d6e94b1b20534550be2fd31ade2559171ba47b6d0c7b7bed6e2f3a84e2be7e3c6e6e10d0ab666e3205a98998d3211db99c6eecabd4bcaab50b372a0a971442f65ea895eb48605a76042fae8c91c3f65cf80a932b3ae21068a014d0feb19970d42d9e2b0643d6d197fc0990b2d500f9fe26e1e40b18651860ec384b239b18f37f00f302f7c76f595bfd9bff488b88fd37b17119470c13e6c56de860119e53f4c711cae6796682ea32cd8cf0beacc73482a039c99d6b175a417fb016e8f724f4d6b03e60801ab7198bce2df2b4bed1b27f02eeee17cb36381095c19530887bc8ab66fcb709a1b29ef54db040982681dbdec3b0a67940f1646cce5e995ec431c07ca276f7bc5e0818b41dec915f1477a5a3e7aecd30a4449bf7b25399bb22e88b45d8a097cd1b9c0f03e1e79883d50126fa70b37cf5d02012b0770fca88c76c9460fd006875397ca61ac75deb9604566d1054b724cfcdf00638e25163cbcb51be1cfc99abaed444f996ceec508e91a008d7ee86b2061cdf4b1ceacdaa0c8abb6e1ed4c9934ebe39bba9a2d37bb903f09cf6869f502fd5c35d24b9422fc219c8cf7c70a6a9a2981241c1d7c6b4907295173c9e6c29394bc8154815503c65f04a6013f26003f9524d0330aaf23b333cf86b5c7ce11fe615f61187f82de50ba4a28fec0ff6fc183e2fd58ea5a74d5d2b70f0a56053273f8534c6b2031687dac1d550e4746c0ea3869c575389ceda35b70ca8f904625a74970f245485c0613e1a3c047c456e3011379b52427f50ac6701fd723145e21fc6bd862589e4fe639f94cee7bd1886c8b2c22da86790b56fb9759a015da54ceb458d478b7c4cdd70a673980e44faa0d345221241c467b56b42f12469d9c07706b72a4f3167c60870324d0fdc7745ff565e6d8a1151c674667e2ea8750a8dc175680b69efc7e0ccdd13ce45e6fb9e1b8b988f2f3a625468cfc1851025c88603d2e485a87be1d6a7c56629e26a44daca736c101d5f1152a5021165ea4986f5d66b1c5e6baeef68f516d64c2f776b4f7ed8e7556e520f22f8767194a1da415d293d092c24f5437605b8ecb11f38027047cd8ec17067933ff3d533a2f557f11e3e0979bae1ded6049fb6d259abe3583864e3742bb09af38178741f10ccbc076b3385fb486face803148134e2caa8d92efdebc1795b7c72392496892070adaa6dbe0008a4269976c5291333eb3617a3d49c084a4ea6fba968dd3c841d183bf5f2c7d07789be0af31701708e2a7d6a4179584522533953134f5e8c4634730a4d2ac2f5277e803a896091fd2deac308720bf536aee5b283b624cc62e2693c563bb3c3eb598996671cb3b8339a12432c216131b2a6287e3f49ce2636560631b959ca8dd08f4c5c394adffcb28ccdd4091d5088252a551a1450c2e4af1ac6e825fd0b9faeadabb3930c5152ba8f3a641e4ae707ccd61b6ee6cc092a962b82c85cd66e99811856d7b87ce37b59c67d02084a5121385bc7be1188c93fd3f2cac5075f3a574bf86b3d379321668418c2a0b8cbfd684cc32a1efd518f5172aca5d36f092c563c71f63f0e7f89c1fe585e715522167b6186a5fb7a2344a05ecb4094301b062f119f5973fa8169c91c56c12295816422d90712dc008944c468728b9dafaf24991e02a879c23711b2fd21141b3022d4f274b75427e7ca3ed04a73c8ec20adbef73bc4f5702ecf949572d67a788050db86080e6cca5acfd11ffb24be7c1ced9967e9dcf659e605513e598365e3a9ff5821eb3d195daeffbf457ae03542de96dfc5f0319345e1f51ca0f77d5fade4c31997373ddde515e87421133fa05f2ca44dbaeb517f964fbd74ce91bf0eec0d37a0e2069235b6e80b22e58cbfb0c789fd21bc3d96c775ad7a7de0151f22413157de123ea067be4c5a8b97d818ba9ce116f53a7178e81f617457483d24ccddd5e051f9e4fee15dd24e735ff5a04db662736020f51c6783d27ec3fb72b77623ec6880e9a43d50f3667cf9dee92d237e2900b4e91d2177bec4049ec5f94b3c3376ddac105b985d24ebfc5ca83c1e91c2c59ee1d4fb18deee9dacf4520436a9df8ff54ac741896bf11a96add11a90eeb66d7318abfe92cc76be72d042ad25a228be9645de893c15496d3564de848df76f30d3c14d496abd54e70e90bc7365a33db4ea8b1574d6e317fc06c17f8361bab6e8978705f0c0d44401c9a0a7bb2683cc818dd6ff6013cfbedf1ee3aa2497f1c845d8c4717153ef6f01c708d4725a93b9e4d98646e693b1dbc5705e2dfadc08483f3cf68cc0ea54faca9ead4527127cd8e6c91dc1108de6cfec6b9fee73bfec28b34479d3123bd69adab6c9cc2573a35600b394997cbdda790b9cbe96ee3c7d7e8326c0cbe1107a878687e37df7abcddc4a266900ad483f7410535510729e1fac3da333e98152d76ca475bd5a009b8fe6e4dc1a435aa0145811e24d521d44cadafa96245b679afc66728360ca28dcb28437d295f1b3106eccff023739b439c251d8e23064e032b6d8817ee862ff99a8289204c636059d91a41f26dfdb2f3c51c4eb73e1c7da694612e6909b3355fdd93b06c31e8f135c8b2f13d3e99ccc7aa2a0ba1af5c0db566db6c4315c3d2e8a7b9bc79ef9b0ae8bb19d6ec00d83b5a79c7250c39f77787ad993d0e21156ab5a89ed0c59d42eca9ecf6ae33ebfc085c772a97d348309128f23368c603930ae82acfa605427806548f2bea6fd9c568cd53a2c532170d230433287f4897cd3b6107eaed56139ff6c48cec6e2121fbb96b147aff33f61da799668a0e9689c93343e7bf58c8f9d17e863b0aaba17d4b3fb4d51f15a45fc0f5fc223e6d7d4ddbf0a9468b7427a7fc898b78e63e26c6249f84c5adc85ecbbb3122acf33d09ec83084f16c392e85f28cfc3e57a1d5dd262480915b6ec674d9c24fe48b2f511379e311d91be1b9353a2250465b60a89462b5c444b447ae1e6f1c21dfd349a1e41597c16ea36137fff87ffdf19fdaeb2810e1ca26faac6e89eb431b6cdf98acff7d81e859e5515cdcd9134d5c91", @nested={0x4, 0x81}, @typed={0x4, 0x149}, @generic]}, @typed={0x28, 0x117, 0x0, 0x0, @binary="c598d355b7f386aed20fb01f8f1e05da685666e11ef8f852b676afbe58beeacceefae9c0"}, @typed={0x14, 0xef, 0x0, 0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}, 0x1058}, {&(0x7f0000007e80)={0xe4, 0x13, 0x200, 0x70bd29, 0x25dfdbfc, "", [@nested={0xd1, 0x4e, 0x0, 0x1, [@generic="ea59f5c628a403eeed69fb519fe08626af3acea39daadd626f74ded4abfb16933826bf10783f4be1b73362633c9d119e659627dcb31677de91a1bd4daccee4085f8a9177c9ec194410232d8facd24cd91dcad084bf7c436764d9b2b3ca2159d48b0f7b734e8db135bff1e0ac10febe8bdaacbd3a1dd0c43da3b47d946e786634c6b89290a01735a32271217acef6a41d1fb2f48aa94e0e2c14103a8b981235b1ad3ae9433b128fccd5742484f226b4933187b64d91dfe2a551e0d13f74efda09a962d039ab", @nested={0x4, 0x9f}, @nested={0x4, 0x94}]}]}, 0xe4}, {&(0x7f0000007f80)={0x2f0, 0x22, 0x10, 0x70bd28, 0x25dfdbfd, "", [@typed={0x8, 0x52, 0x0, 0x0, @u32=0x6f}, @nested={0x176, 0xef, 0x0, 0x1, [@nested={0x4, 0x13e}, @generic="7f6613eb4633741101d28447f016f6864a1471ef5e6f2b8f93f691f7a62a594bb18f3a465257d6eb534ed9d4f7224dfdc27d711409a2bb3dbdee0136f3611709559ffe7ff80ba1d7e215018af70ed56cdc6211376eec85d81cd706ff60f3fad8f4170cc8ea8afc46d74f36a5c04351f4c470dbbab5e12198ebe04e07ac1101da65843b45937860e4f0a99b7b0ff1", @typed={0xa, 0x2d, 0x0, 0x0, @str='tunl0\x00'}, @typed={0x8, 0x2f, 0x0, 0x0, @ipv4=@broadcast}, @typed={0x8, 0x93, 0x0, 0x0, @u32=0xf20}, @nested={0x4, 0x4c}, @nested={0x4, 0x27}, @typed={0x8, 0x61, 0x0, 0x0, @uid=r3}, @generic="3c12eb72ed403fb17e524f93956bef2de5d730c665b8fe119f330c05e079d2319b2acc17d619e0eaf7e46cd21863a6c163c0bd5032b6cdaadcbb5bf73d7b72f9d7587f3d98609d55249f471eff90573dc63df374eddd49a3204ed74559e79b5071aad235c2046b3236a6b81b19172df6b9be5a71120aed0177ce95c939ee94b697a11d41a7a7d9206c527c01c633f09346c8eed3fdc71049f9858665e1142e48b3e05ec5ccfbbf58c6550eecaf71a1de5a6def9d"]}, @nested={0x15d, 0x6e, 0x0, 0x1, [@generic="3632abda7b4247f42ff168f8e0d41ae7a56426722e7cca7193c18ff1422070a71cc28f63c49c0ffa8dc5dfee80bac2be1ddf0fd6ed9783e1c3d9213e617522bc3d6864cad2c32bd145528b9a51dfaff5aba39d141863015b6090509cceec47f9d9bc5c576d44caa4c50b21a8fd33b864", @nested={0x4, 0x133}, @generic="bb83717bbd12616ecc14fd98d62c25c88afb89022617ba87a8d6a4aa84941b74bc062d3d586775266d5d04c721de832115cac98260b5281857796a1bc91deb9b74e7d0b4e0bc277bdd60e7f9255c2f808b5cc1fa68f337e12072c4286855150dc58b6916eb967b3824529b41c323d016643b14f7671a6bfa3e50d1f6e6cec4732bd668425c7953141397ec64ab71d673638b526a0f27c2e7432dd2f176c8b82e85955e389a28964ee932ac932cac6f4049cc82a8f628139e0a2f885b71b58989fbc9b39e21fcaefb1fac9dc260770ffa1d2ec1f99f7d", @generic="608c9926fdbc92c763994e272dfcbf"]}]}, 0x2f0}, {&(0x7f0000008280)={0x78, 0x42, 0x8, 0x70bd26, 0x25dfdbfd, "", [@typed={0x65, 0xce, 0x0, 0x0, @binary="56b5cbe4de412dddce0f4dd9049de6fcf066566b06fa26383ff08348599337f3a2106687c6a06a09a79ab1b4bd4097e0587a95130f3ce63c332cc3adff35a520e69689d15899bbde37a0cf2857e4dbfe92c9908c05c0bae228f8ac52d3037fde03"}]}, 0x78}], 0x5, 0x0, 0x0, 0x4000004}, 0x8004) r10 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_IP_XFRM_POLICY(r10, 0x0, 0x11, &(0x7f00000083c0)={{{@in6=@mcast1, @in=@empty, 0x4e22, 0x0, 0x4e23, 0x9cf6, 0x2, 0x80, 0x0, 0x87, r8, r2}, {0xfffffffffffffc01, 0xf94, 0xffffffffffffffff, 0x7, 0x9, 0x0, 0x6b, 0x101}, {0x3, 0x6, 0x8e39, 0xfffffffffffff181}, 0x2, 0x6e6bb8, 0x1, 0x1, 0x3, 0x3}, {{@in=@remote, 0x4d3, 0x33}, 0x2, @in=@remote, 0x3501, 0x0, 0x2, 0x9, 0x8001, 0x2, 0xc7a}}, 0xe8) setsockopt$inet6_buf(r6, 0x29, 0x23, &(0x7f00000084c0)="646fc9b19a5d32e2b07b36445640f307219262e1ec26bc36552442cf57823e4dab15cbe439ec6fe8612a6499403ec7abf8741b66613be266f60646ba4e63270ce7a3260be746ab35dbc2a740365130ecb5e069912b19135182e8c6b21b77930aa46df03fa557dceea00fa2294ccc11c6680491376c97ef9d49ae7e26fb2890224870b896c456bca6a35f7bcdd5243e0e42963e98b2aa939cb408713be5de1180a337f30c9f175f2a7003004625b5a7dcd10717fe2de497133400a158366df60adcd7686db857338ae3aa2ffa8cc7fc8ff5e2e8ac00b7eee666e1e570d38a15", 0xdf) ioctl$SIOCGETVIFCNT(r7, 0x89e0, &(0x7f00000085c0)) r11 = socket$inet6(0xa, 0x3, 0x7fffffff) pread64(r11, &(0x7f0000008600)=""/4096, 0x1000, 0x8) sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f00000097c0)={&(0x7f0000009640)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000009780)={&(0x7f00000096c0)={0xb8, 0x0, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_SERVICE={0x50, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x2b}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x47}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@dev={0xac, 0x14, 0x14, 0x25}}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_PROTOCOL={0x6}]}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@broadcast}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1000}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xfffffffc}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@dev={0xfe, 0x80, '\x00', 0x39}}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x20004800}, 0x880) 2.01842652s ago: executing program 2 (id=8153): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000180), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000040)={{0x1}}) (async) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r2, 0x40505412, &(0x7f0000000200)={0x5, 0x2, 0x6, 0x0, 0x6}) (async) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000140)=@gcm_256={{0x303, 0x3a}, "c4d65ab71f5ef2fe", "9e8e00828f711330ff2bb16b550800000600", "dc5db43f", "80031f0000000200"}, 0x38) (async) rt_tgsigqueueinfo(0x0, 0xffffffffffffffff, 0x1c, &(0x7f0000000140)={0xfffffffe, 0x8, 0x27}) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f00000083c0)={{0x1}}) (async) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r2, 0x54a2) (async) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r3, 0x54a2) (async) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r3, 0x54a2) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000004c0)={0x2c, 0x18, 0x15, 0x70bd2a, 0xfeffffff, "", [@typed={0xa, 0x0, 0x0, 0x0, @str='\x02\x02\x00\x00\x00\x00'}, @nested={0x10, 0x9, 0x0, 0x1, [@nested={0xa, 0x3b, 0x0, 0x1, [@generic="538ebda148ba"]}]}]}, 0x2c}], 0x1}, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0xc6225a99193a0f6e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) 2.002473871s ago: executing program 5 (id=8154): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x5423) r1 = socket$inet(0x2, 0x801, 0x0) setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xffffffff, 0x4) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0xc6225a99193a0f6e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) 1.942059912s ago: executing program 5 (id=8155): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') syz_usb_connect(0x1, 0x330, &(0x7f0000000240)={{0x12, 0x1, 0x300, 0xb9, 0xbc, 0x2a, 0x40, 0x2357, 0x100, 0x22fd, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x31e, 0x3, 0x2b, 0x6, 0x80, 0x91, [{{0x9, 0x4, 0xcc, 0x5, 0x6, 0xf1, 0xd8, 0x6d, 0x2, [@cdc_ncm={{0xb, 0x24, 0x6, 0x0, 0x1, "49929799f1d0"}, {0x5, 0x24, 0x0, 0x32}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x401}, {0x6}, [@mdlm={0x15, 0x24, 0x12, 0x4}, @acm={0x4, 0x24, 0x2, 0x8}, @network_terminal={0x7, 0x24, 0xa, 0xbd, 0x7f, 0x8, 0x5}, @mbim={0xc, 0x24, 0x1b, 0xbb82, 0x9fc3, 0xc7, 0x4, 0x6, 0x5}, @call_mgmt={0x5, 0x24, 0x1, 0x0, 0x6}, @dmm={0x7, 0x24, 0x14, 0xfff2, 0x3}]}], [{{0x9, 0x5, 0x80, 0xc, 0x40, 0x8, 0x6, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x3, 0x6ca3}]}}, {{0x9, 0x5, 0xa, 0x10, 0x40, 0x80, 0xc, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x7, 0x1, 0x9}]}}, {{0x9, 0x5, 0x9, 0x10, 0x8, 0x40, 0x10, 0x5, [@generic={0x7e, 0xf, "d428ffb671498f3dfd3cbd0397e3431f8e6964cf8534496941dc52dd567826da355aa0273ce3c8ecff5873d65bd3df98e8502ea5c45e5f0ad166702ed4564153aabd09c4e69ebdfb303cd8e829ac942bbcc5d4b8519a27eca9fb59a25c663f7cabae5beb1016033673e29aed99318dee0ce4810fcfbc43bc16e6afc8"}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0x90, 0x4}]}}, {{0x9, 0x5, 0x3, 0xc, 0x10, 0x78, 0x0, 0x4}}, {{0x9, 0x5, 0x6, 0x8, 0x200, 0x72, 0x6, 0x40, [@generic={0xbc, 0x3, "d3c608021168fa408e2b92101df49fc5f37122e94042d7267d7ff16065ce15a55640c46a91d815a234953c67031d69048580f65c68808061142113f3f26193dc2c3760e920a122e80fb2feee16e50696746e3ad3481593e0567a185a13a8f1a16a584001ae3a314cb33cf1ffe0148b5f097570540a8a392e82525dd40d61a6622b88004489648266e997b8d69de687e425d8336c7c5cb3a9e3c0da5f26aefe83071c01bc11894368839e92a2c1238611a298d1f60dfd2b0f1a96"}]}}, {{0x9, 0x5, 0x9, 0x10, 0x200, 0x6d, 0x9, 0x32}}]}}, {{0x9, 0x4, 0x4, 0x3, 0x3, 0xef, 0xc2, 0xc7, 0x8, [@hid_hid={0x9, 0x21, 0x400, 0x10, 0x1, {0x22, 0x4c8}}, @uac_control={{0xa, 0x24, 0x1, 0x8, 0x2}, [@selector_unit={0x8, 0x24, 0x5, 0x4, 0xb3, "bf9ed1"}, @mixer_unit={0xa, 0x24, 0x4, 0x6, 0x9, "4ad90031df"}, @output_terminal={0x9, 0x24, 0x3, 0x1, 0x303, 0x5, 0x1, 0x4}, @feature_unit={0xd, 0x24, 0x6, 0x4, 0x4, 0x3, [0x1, 0xa, 0x9], 0xa}, @output_terminal={0x9, 0x24, 0x3, 0x3, 0x307, 0x2, 0x4, 0x9}]}], [{{0x9, 0x5, 0x9, 0x8, 0x8, 0x5, 0x3, 0x3}}, {{0x9, 0x5, 0x3, 0x0, 0x200, 0x6, 0xff, 0x2}}, {{0x9, 0x5, 0x9, 0x8, 0x10, 0x1, 0x6, 0x81, [@generic={0x8a, 0x21, "c647e1e5568f1fc7f9dbeacc2294c3a1770fc83ceb16dbdd7fba02a72480471408eb732ecf36ad9048a6c4652956c362f153be30aef69030978b668d43ddb8cbc7110764e3e36867c8824e3100419d74c5368d3e678257f7d1f3f7c4846ad3002d64df9550f0fa69de1cbeebb67ecf31ffa31098384c7f32fa296d2126a3e34a461393bfa90743c3"}]}}]}}, {{0x9, 0x4, 0x35, 0xd1, 0x4, 0xff, 0x4, 0x17, 0x6, [], [{{0x9, 0x5, 0x8, 0x0, 0x220, 0xff, 0x9, 0x40}}, {{0x9, 0x5, 0x0, 0xc, 0x10, 0x8, 0x9, 0x3}}, {{0x9, 0x5, 0x6, 0x8, 0x400, 0x0, 0x3, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x3b, 0x4}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x51, 0x1ff}]}}, {{0x9, 0x5, 0x8, 0x0, 0x8, 0x0, 0x29, 0x4}}]}}]}}]}}, &(0x7f0000000100)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x201, 0x9, 0x8, 0x0, 0x8, 0x1}, 0xf, &(0x7f00000000c0)={0x5, 0xf, 0xf, 0x2, [@ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x10, 0x2, 0xa, 0x9}]}}) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f0000000200)='fdinfo/3\x00') read$eventfd(r1, &(0x7f0000000080), 0x8) 1.889708373s ago: executing program 2 (id=8156): r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000000a00)) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000000)={0x60, 0x0, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x16, &(0x7f00000000c0)=[{0x8, 0x7f, 0x6}], 0xaaaaaaaaaaaad64, 0xfffffffffffffffa, 0x11, 0x0, 0x3, 0x30}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x800, 0x0) r2 = socket(0x2b, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0x0, 0x0, 0x40000, 0x0, 0x2, 0x1}}) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x2c, 0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x8, 0x0, 0x0, 0x0, 0xff}}) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)=0xf) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000040)={'veth0_to_team\x00', 0x3fa1dc947ffe4b82}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x138a, 0x1000000003}) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x4f}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x2}, {{@in6=@mcast2, 0x404d3, 0x2b}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}, 0xe8) close(r4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x1000000000003, 0x0, 0x14}, @flat=@binder={0x73622a85, 0x1000, 0x2}, @flat=@weak_binder={0x77622a85, 0x1100}}, &(0x7f0000000240)={0x0, 0x20, 0x38}}, 0x1000}], 0x0, 0x0, 0x0}) 1.866145403s ago: executing program 2 (id=8157): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r2, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) splice(r1, 0x0, r3, 0x0, 0x25a5, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0xffffc000) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) 1.798679775s ago: executing program 2 (id=8158): mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) (async, rerun: 64) r0 = socket$vsock_stream(0x28, 0x1, 0x0) (rerun: 64) getsockname$packet(r0, 0x0, &(0x7f0000000480)) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f00000008c0)=ANY=[@ANYBLOB="3c010000100013070000000000000000ffffffff000000000000000000000000fc02000000000000000000000000000100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000000003c000000ff01000000000000000000000000000100000000000000000000000000000000000000000020000000006000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000013500000200000000000000000000004c001400636d616328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007195653b0f666238e213efb08f9f455a6ec45bbbaa2a72cf1a2e88d9cbc1b9f47928898e15352aacafe24f1fe3d1bd360335994a2409ce386dee79f6b237701c3632b49ce04bad7692f5d85396c162c4664b9d1a812c35bb7c3e5b8897223f83b8313b00f9d4f4374002f2cca201e8f56481114425229cd93249283d539e9b41f4b92c5b824beb41ab2f8e371d70d3c9896d4cc341e472ee9cbeb340818a4eefa4215d0acf833548883c0b42b22a4188f1976fa959cbbf70b6a510c3443b1396f77f5b662c83e666ff11cc8e8a3ef5956032a765590d6f447ebc6a0d4cec5be231f19674797751ea6d1116d0de1985bd0b5256c1189cd9789a4ce0248353873bcb23725af449d6d84429083604c798c012faadf11f424cd4d77d99523f6ab03596facef54dadcf94ada141feb75a0dd38f60"], 0x13c}, 0x1, 0x0, 0x0, 0x11}, 0x50) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) (async) r6 = gettid() (async) socket$inet6(0xa, 0x801, 0x800) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) (async) ioctl$int_in(r2, 0x5452, &(0x7f0000000180)=0x1) (async) fcntl$setsig(r7, 0xa, 0x12) (async) rt_sigprocmask(0x0, &(0x7f0000000040)={[0xfffffffffffffff9]}, 0x0, 0x8) (async) ppoll(&(0x7f0000000100)=[{r0, 0x10}], 0x1, 0x0, 0x0, 0x0) (async) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) (async) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) (async, rerun: 64) dup2(r7, r8) (async, rerun: 64) fcntl$setown(r8, 0x8, r6) tkill(r6, 0x13) sendmsg$netlink(r5, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000f80)=[{&(0x7f0000000100)=ANY=[@ANYRES8], 0x24}], 0x1}, 0x8004) (async) r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r9, &(0x7f0000000100)={0x1f, 0x0, @none, 0x4}, 0xe) (async, rerun: 32) connect$bt_l2cap(r9, &(0x7f00000000c0)={0x1f, 0x80, @any, 0x0, 0x2}, 0xe) (async, rerun: 32) ioctl$FS_IOC_RESVSP(r5, 0x40305828, &(0x7f0000000080)={0x0, 0x1, 0x1c00000000, 0x3}) (async, rerun: 64) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r4, 0x0) (async, rerun: 64) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) 1.653004877s ago: executing program 2 (id=8159): r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000), 0x200c80, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syzkaller1\x00', 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_START_P2P_DEVICE(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x20, r1, 0x100, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0xffff6364, 0x12}}}}, ["", "", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x91}, 0x80) r2 = syz_usb_connect$sierra_net(0x1, 0x3f, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x6, 0x2, 0x200, 0x8, 0x8f, 0x9}, {0x9, 0x5, 0x80, 0x2, 0x3ff, 0x1, 0x4}, {0x9, 0x5, 0xa, 0x3, 0x8, 0x46, 0x7, 0xa}}}}}}]}}, 0x0) syz_usb_control_io$sierra_net(r2, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0x7, 0xeb, {0xeb, 0x6, "622d0d12c3db47af7815ccf5c1d48a12134dc09b194199a0ddeacf3209010a1de4bb307097d81793b1df6ea8c6cc658613a1fb405875e4ea7e5196f9184131ad0b724c9eb86745d452910c14d483252e81886f4280edf1511097c4565de64d38200be067c0c89c5b3b76215d7a7048fa2177a3fa4b4c30178988665ce97f68f7c344ef08ed8f55a545cf918e533ece11033290f5ec097bfd647389de6de06311f82deb68961b56aa4bb0dac5e5649e1a6fb543e50f41d52f861b26631345546764da6c45b74c1975a9638b0e77ae718754423c0c0748752880face3eb2ef190a2c28842852607e5718"}}, &(0x7f0000000300)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x810}}}, &(0x7f00000008c0)={0x1c, &(0x7f0000000380)={0x20, 0x4, 0xaa, "82b6f1823279baecde326c5ca92bc8a714e10c8c06958d7e6c6a4a6439c75962e71e7495b7a050d029485d90b15552c8d9e954bcf15019b2448ebbbd68cf1e5a3bc1730451634472d33743dc8582ba3b7e2a20e9b154acdd63eddfab017c136d49cb94a00b562795b22f5ff4132beb2a6f4a3818f10ceab48609af02fc2e41623cc4e51ca24f3b9b7deef46dad23382ce2e95eb8bd96b06b62ae2722bba8ed56aafb24cc5aee8419234a"}, &(0x7f0000000440)={0xa1, 0x1, 0x400, "5c79f97a7fe2f266646be36255e1028e9f379c4363ec4821acc5cce01fa85d02330b13488feb6834a8e23ec5159b9c52b8b908d161825ebc2a050a43f79b3dbfe81f369550a06bc95815d43b0063bdfa5316216e95a9ff3f2166c57a380806f03e0a82a20a7387db347f5cb467ec7eec925f41c06da5ef0e18f9412cfb42980b0b2217412c600c5f913973661a7011cbfcf78ded023da23cf97ff3308e2eeab63a9b4b776b7297d2f813e3976ce83fb28fcdfe5a71cf62c720a19e3778f2be4f3cae878b64357df5255a9fb3397dd8cf5c5bc24862ccc9d17a937a536f36159e2a82bab1a9d09bf3e535b4bf20a2781f6fd6e54a2e330b4ea2c43fe5d455a344172fd698ec76ddf2b2da770a98facc8b0bc43ac117da1d6987c2e554ab4f0379329982e9747a75d08809af4c48176ba2f23cf9a29d353037c637357d93279fcfe3ada6124c5fe7d1450973eaa608936aab51b551ecfaeb1ca41dfa39d91ad2723d38266344c4301b6585790bcfa06de05c84c2cebc801dea6742f70a26ee41c1289e6689359626eadd56ab3145056fc190337577c0837838c90b651752f72094c226d2a689a75b9c54d553faad924593a7bc523dfa9eeb52bfd7464ff316140859a4af0be67764ef458d0be99cb1b918b124cdfb211cd5cec54fa2fc44ebd22b9735451604541ce383bf213611d80534f865442eb6fa33df66b96cf89ca524335bee010534e087b72b05b21f91d6d2b6b261fa6b38f7cc04876409d6feac25b8b67a0f72d909e7081d0ecc9556a77e45db6e5e670616cab06c06f7a3b9f63aa3cfd525575b5acbe0a229e65d9f4fcf8d258da8cadea64d6beb695335962633f0e4a5cc3533de6050888780501adba972a9da7c894f8ce6dce1326598b32da3a0ec70cc51ba24b5c5cda6080ca6c341f97a306fc80c935251f0e79aa2cc82c558e1c6c9c5182c4cd14d9e47657a0ff274abe394685089e67d021a508c02b482839e295f5db1817a20d21b8bae3c7202a6679a641cb1d6867de887b9072c35bdc53bc965f95c2d7b670739b5bd6d55b7cf2225234754a691166277efb064fb8e40d044ddafa04ecd2cf34951d9e0dc57b400594973d496a7a758ca3d2b124f250f6539ec5fa0b6edf15e26174354d77b811378c2713fa3da629b98613bcb6b46a8c796200738a10aafe520c618463216aa7ab41f548a66a96da5e20ebbb34394e6bcfc259540bb9800456273eb2f63b13eb41e66e30f5148e8126ddb2ca01d55dc0c2cc3f004c45d6fe6907faeb01fd095dce5136986eb5b7bfd03239b33469224a72042bc27f365985a63d141ab60ed70a99717b5bf0449f1ef48d720804d8130add146d92d80a44c027c26202d7094df0760f81bdece6ce163c926b29d7e342a45ce249ab2d7c063d394b8fe0d9bf64df8b041267dd46545736d5008b48dea79"}, &(0x7f0000000880)={0x21, 0x0, 0x4, "eeaf42e6"}}) syz_usb_control_io$sierra_net(r2, &(0x7f0000000a80)={0x14, &(0x7f0000000900)={0x40, 0x2, 0xa4, {0xa4, 0xe, "58b06530eb3986ed3464b3d9ddcc68d73333350d7c7585b24001235c2f270213b7588fc7c65c865e21bdcf7213d19f3e0e0cc4d7026b817069511862bd6b6571987bba5434111ed4735802a09185fa4648b7685e8d0cc020644f397297541b67b8c49040ecf65a66f6de0331d41f62314a6a94c907ce75ca75dd3439a4eac29f6a013d6ec451ccfda4e460c2eb02d3b8b250eb2162755f5002ae986767de51d11575"}}, &(0x7f00000009c0)={0x0, 0x3, 0x9c, @string={0x9c, 0x3, "d1796f99f2fc2abf2b0a295b9665135d857e6715da4dd010814fd3b2b23f939439876bd5cd75de78ae5bb596312d0529b14a6e378581d2f3d713c1765952c9a6b3e3bad2cb18a602955d8a5d1b36d52c45003c427451c62d2e5e5c7f3358c8ad72a88fe8d6b7f19c4b4cbccd160671b66f74ed6cdf0f9a91a3a0992c913bf8dd8decf6bf90b1e6f62538daa0e36d5772e8d6106e336ea2126f82"}}}, &(0x7f0000000fc0)={0x1c, &(0x7f0000000ac0)={0x20, 0x18, 0x64, "1f66cbe1ee8feadbb9779fb18314f0b7945f80341708157afe1f477c938d4a13d62edf7b35d0e4c758f5ff581acf9d1ac82ac76b72cc6b117e5aea3bf67a6bba943d548955c7d56dbf71e0b39f130580e990b4d8e52cddfb75a5b27599c8ca181d05ef7c"}, &(0x7f0000000b40)={0xa1, 0x1, 0x400, "09683f549c39105106cc58ce1a5f5ac3834315fd16c5f91e65ed66633d399d9a0f923dab07081307031fcf9e71bd25939e83141bb0e2e56e439d6e2b76365d9bbb95fbbbdb531999d6af67a3638a9cdb212ec1275d6fe5e6a5348f57775e01c4aa103bce418554eb1ce219705780eec7d48a032cec797a05e78954e1bfa966a03d50fa3dfe741e9c5fec1a03878f92b03d5e9e47aeb1ddfed70f9204c20af1c65c9aaf53ff1aef23c678173012dac871c8eedc528b60e0588ec893b542937e9a2d3f206ad8c2b54d268d876e43fc2c6a2579b3cecb2ea13d58d6378c427438ed82e7ac039eb3e5d12c2db80fde8ad9f34233cae2533199ffc731481c3672399d1bdaf5ece8311de580d6ca80bd46d2f74200464286705873835036ed97212ecf8df9214937bbb0bcbdcfefa3d1018b6a98b4769d6df30be7bfb570bbbfd33384e3a031ad8217c1374059133b760b57b26d340494add77dd9c5e1d9c23ac99ef9609f96d701ab3ff567f5084109b7f195fe317c119bb663cc9a7897b0a1848517781ef83bb26d4b6eddfb4bcb3b12730c53210bcd08161b2031bc76771fbe64bff53e9be0bcff770b2d366c12371bd39e38042a982ab70c8b6e1235e446184b7fe03ddb48329afb72fc2f61bf477d8c5b271936e0fa8aa9ac725e672751b0539e53fb8a220139d0b3addbc2f3f26744cf633ca1d7fcddc90538f70fa79ec865926be1e44ef743e92e5f476560254ced37bc6356897a3244f3145f51ff51a10d2bed41586111248a209e4abba8b90333ac2a783417c4a27644f91259456ba76e4adc796816b17373f478748d56e79dcfa82a9616cb754d30de3c2fd56d1614e7601aac89a1cebe2983a51eaff322948c213d769dac9cfac9a5e3ce58457aa75201273bdd841aafbe67ec6a16086dc617249b8c39a81d97db8f0c4c26c20298ae2ea14fdde62021b0f2d09860d901bc9985edb765f850a1e61d40bc8de47039e07daf74d26b1d7ea3286d88838c6435e01f09e46ac7c1ada0e2fc51112169ad1dc9ac22563454192609988c62efb6e46191fdf14338d3df38a7c33fe085fee32da06a1290a1f1eb008f7d4f272182673a2e8047336fafd89c77f6f2fda7f3a4e71a77ddcd2f4c2f806b809bce94fc7d0c33a5a00f238fb261e3f7d5d7fd1df2f0b693d77bd3cba974a272b22137cf449ab07ea65bbb484b733b26c091c4c9203aeb821f82fefd9232b0b407b093b3e90b2a6161ee0f112631add4db0b471551631a1a5ebfd4674db68674d27229470511eab59ed94a7825977e1c5c25d6dca14bfbc4cc39bcc0dfce1be820879dcd594b1b63a6e38bbe9efa76d3a95b9aa29fb6f925848e66a38f974e1248fd979b62cedeaf2c866e22814b3da105382510ea4d583e021f1c340d1b7dde471c4c34dcba71ebb7ef5f4b6f3958c50f0382ad1ba357"}, &(0x7f0000000f80)={0x21, 0x0, 0x2, '8K'}}) syz_usb_ep_write(r2, 0x7, 0x67, &(0x7f0000001000)="fd776fa2b2336e3acde61a6c5c8f6509aa4a98a758b2442580000f33adbec8baf5dbf2cae8c320454f1c5f2f2fc2115d5f660fbeb9c8c96562c153f235ae77b094aeac99825abf0035d7059162f452ff3179d3828c20b711b658f74ed9a8fc3142854610060601") syz_usb_control_io(r2, &(0x7f0000001280)={0x2c, &(0x7f0000001080)={0x40, 0xb, 0xe7, {0xe7, 0xd, "77de92af99ce17ddd0b550ed631db58bbeec1a0ff3aab30c73ac497592da97af09f1be0b4bbe8d9eb1b4ba66c7ec47b249e8229f95829c7e2f2fc1f36fc3312b616d347a1c6a8e783fed63f61a8cb1a01ee0e838a8b70da6ec280ee8e578ab3db4109c28ca04091fe5e20b5cc1c89e1080fc610af126e8053e46a0910e359123a11f682a216b13c151814f32db7700c839fb26e5f7263e97a31aecf0fed6245113a98d46eab8791bf2434aac318ae212e1e0fe747f2cd87a05a7e11951726896f19607294e9f3ec7ad93032c6683d7a063b0242cfbc1a3dc273a64584dc5d2a42b9ca96fc6"}}, &(0x7f0000001180)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc08}}, &(0x7f00000011c0)={0x0, 0xf, 0x15, {0x5, 0xf, 0x15, 0x1, [@ssp_cap={0x10, 0x10, 0xa, 0x4, 0x1, 0x4, 0xf0f, 0x5, [0xfff0]}]}}, &(0x7f0000001200)={0x20, 0x29, 0xf, {0xf, 0x29, 0x3, 0xeb8b2941b25a560d, 0x76, 0x3, "d87a95f6", "b1cf9349"}}, &(0x7f0000001240)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x5, 0x2, 0x8, 0x1, 0x8, 0x9, 0x8}}}, &(0x7f00000016c0)={0x84, &(0x7f00000012c0)={0x0, 0x11, 0x24, "52a2d67830fe6f02a5545cae7b7334b34cc18ba4f440c6169d9b34b2386d7a731f03af23"}, &(0x7f0000001300)={0x0, 0xa, 0x1, 0xe}, &(0x7f0000001340)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000001380)={0x20, 0x0, 0x4, {0x2}}, &(0x7f00000013c0)={0x20, 0x0, 0x4, {0x2, 0x10}}, &(0x7f0000001400)={0x40, 0x7, 0x2, 0x8d}, &(0x7f0000001440)={0x40, 0x9, 0x1, 0x4}, &(0x7f0000001480)={0x40, 0xb, 0x2, "b0b2"}, &(0x7f00000014c0)={0x40, 0xf, 0x2, 0x53a5}, &(0x7f0000001500)={0x40, 0x13, 0x6, @random="a8c1113e309e"}, &(0x7f0000001540)={0x40, 0x17, 0x6}, &(0x7f0000001580)={0x40, 0x19, 0x2, "a90e"}, &(0x7f00000015c0)={0x40, 0x1a, 0x2, 0x2c3a}, &(0x7f0000001600)={0x40, 0x1c, 0x1, 0x79}, &(0x7f0000001640)={0x40, 0x1e, 0x1, 0x6}, &(0x7f0000001680)={0x40, 0x21, 0x1, 0xf}}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000017c0), r0) sendmsg$NL80211_CMD_LEAVE_OCB(r0, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x14, r3, 0x8, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void}}, ["", "", "", ""]}, 0x14}}, 0x40080) sendmsg$AUDIT_DEL_RULE(r0, &(0x7f0000001d80)={&(0x7f00000018c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001d40)={&(0x7f0000001900)={0x430, 0x3f4, 0x8, 0x70bd2b, 0x25dfdbfd, {0x1, 0x0, 0x20, [0xa, 0x1, 0x3, 0xdeb, 0xa, 0xc6, 0x7, 0xe, 0x9fb, 0x1948, 0x0, 0x7, 0x3, 0xffffffff, 0x100, 0x7, 0x7, 0x6, 0x3ff, 0x23b, 0x8, 0x4, 0x2, 0x7, 0x6, 0x7, 0xffff, 0x0, 0xfd2ac2a, 0xffff3e5d, 0x80000000, 0x8000, 0x101, 0xfffff000, 0x37b, 0xffffffff, 0x4, 0x7, 0x9, 0x6, 0x84, 0xf, 0x9, 0x10000, 0x5, 0x5, 0x9, 0xfffffffe, 0x3, 0x2, 0xff, 0x7fff, 0x6, 0x6d4, 0x0, 0x3, 0xfffffff9, 0x3, 0x6, 0x3, 0x7, 0x9, 0xfffffff9, 0x800], [0x1, 0x374, 0x2, 0x7f, 0x2, 0x3, 0x9, 0x1, 0x9, 0x8, 0x161, 0x8, 0xfffffc00, 0x40, 0x0, 0x5, 0x2, 0x0, 0x81, 0x8, 0xffff51bb, 0x0, 0x1, 0x4, 0x8, 0x168, 0x8, 0x1, 0xfffffffa, 0x80000000, 0x7, 0x1ff, 0x7fff, 0x0, 0x80000001, 0x2, 0x80, 0x6, 0x7, 0x7ff, 0xfffffff8, 0x6, 0x0, 0x9, 0x8, 0x0, 0x9, 0xbf, 0x9, 0x8134, 0x6, 0x6, 0x1, 0x100, 0xf8f, 0x1, 0x4, 0x1ff, 0x8, 0x3, 0x9, 0x0, 0x7fff, 0xffffffd6], [0xffffff81, 0xffffabd9, 0x7f3, 0xffff, 0xb, 0x6, 0x3ff, 0x8, 0x6, 0x4, 0x3, 0x1, 0xb1f, 0x4, 0x10, 0x4, 0x80000000, 0x7fff, 0xa0b, 0x9, 0x6, 0xf3, 0x7, 0xe, 0x2, 0x4, 0xfff, 0x10000, 0x7fffffff, 0x6, 0xdabc, 0x3f5, 0x7, 0x40, 0x3, 0x5, 0x7, 0x5bb, 0xfffffff6, 0x2, 0x8, 0x8001, 0x5, 0x5, 0x5, 0x8, 0x5, 0xb15, 0x10000, 0x4, 0x2, 0x4c43625d, 0x6, 0x2, 0x7fff, 0x8, 0x200, 0x1, 0x800, 0x2, 0x0, 0x0, 0x9, 0x6], [0xd, 0xc1, 0x81, 0x0, 0x7fff, 0x3, 0x3, 0x10, 0xfffffffd, 0x9, 0x1, 0x8001, 0xd2, 0x5a30, 0x1, 0xc4bb, 0x421, 0x1, 0x9, 0x6, 0x9, 0x2, 0x1a, 0x1, 0xff, 0x7, 0x1, 0x1, 0xfffffffe, 0x11, 0x6, 0x4, 0x4, 0x6, 0x6, 0x0, 0x1, 0x9, 0x4, 0x2, 0xd, 0x5, 0x4, 0x7c, 0x7ff, 0x4, 0x1484, 0x7, 0x4, 0xb, 0x7ff, 0x3, 0x74, 0x7, 0x2, 0x2, 0x78, 0x3, 0x4, 0xc3, 0x9, 0xc79, 0x0, 0x20], 0xe, ['\x00', '\x00', 'nl80211\x00', '$#\x00', '\x00']}, [""]}, 0x430}, 0x1, 0x0, 0x0, 0x4000004}, 0x0) syz_usb_control_io$sierra_net(r2, &(0x7f0000001e40)={0x14, &(0x7f0000001dc0)={0x20, 0x7, 0x2a, {0x2a, 0x5, "fbe44eb2698ed7fd71f3eb2a90082f01512089ab304bbd5101e5d0bc95197cb0d5f35945efe65eaf"}}, &(0x7f0000001e00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc64}}}, &(0x7f00000023c0)={0x1c, &(0x7f0000001e80)={0x0, 0x10, 0x8e, "733e051266b31359a9916b1ede87eb756089790613e6a2fa5df7e9c1dae56b397cc42b65c7a9aee2d536fbcef55ded98614e43319e00d0c1ef851848665eefac6969b5b2ed090f36ee1dde79c7a93de5ec9ecb50623bddeb6e6d3ccc6f37e1e8bd9523eb2b4749fbf8f108a40fbacf0972779194b35418b862d89e05263a1c766da31990668955ae23f602dbbf63"}, &(0x7f0000001f40)={0xa1, 0x1, 0x400, "3328477c37345fa7bdd0bb4e2cff27c5e37116b98b350269a9a47135258fe760cabf7ca859720f1a86c8cfcf158648107c3d99a30de5a771513fb9a7c161aace477c2a9f373450907ede960639773efa8cf75bea5753b4c5cddc697a2de93a622b1937efacd2e11263e71cc3bb69a8645d97415290faf6b69ad000ddc1804f5f6a1528ffa556afaf4d3bd2c910612f01291e5c33fa5d083ef41535097583a293baa4088ce6c729d13caa63e7c6d1608faf2a58e3c46800f6b8f01868ccc329ccbdb96ec10af2bacfb6a7d671f23b59931ff34c5039b43b74f08fd0085923b897ae5535ea0badcfca455e152d84cefb793871ada040fe29328a6a4360a4b507c9a3f56fef8dc9bb90bce4cf18439213922a8d81f4be68338fd18c7f9aa8de58c20419aa0c369bd8d90b9b1c58c81edc17b8fdaf4bd2f3c4f0e95702615f905bb3fa405bad2d7510742d8dcb7441c3ac5f421e47c45f82630ff637f8f6740e1df6ac373a0084abed995a7511439f63c126fd926c21c855a3226f056ebcaad7bf3fa05092ca542739a5cc294bc6d8a6cf01c9f9ec25709942d93f556bd41b30eadb3174dcad34df2ec5d40d91e6df69dde882a002b7bf395c4996dfaa09887f778bf43cf773efb4cbf90a61f338c540022fdf236c811ab48325ed952ec1e753c5d29933daee4b97ab2435ca753b42d6e7e3fd75fee3cce1e4ca983abb03c6e61d3eabd6717d612f84417af0c8320d0d1fbc7b90fe7f257ce69909848e0cfe2f30dfe28cc95ee02cd5705b41c3618365737cad2f60f4072e8ce17e1a56ec613a966dac6b51c70435cc63f610921fd8cd33744461c9b15c516b1250ecf1b6d607c9df87899b7ef9be2920e0b28624f59cd30167c2f1c6368714973ecbab37d386c38ce67a3bc594d77029ea3ed48442f3e83c7c3af4a0affb998be485d00d288275167ef399245ac129c0b8d65ca54b592b76d28c5e3301e8a5fba23d88bfcf1acc0901b990af8aa04bc030b2a3657331e4d522368e886ee56a65c90a3eb5b8149f6d44082212d8c963d161c05f3f221654eef1f666d44c53d5a0396bd4ebbfe469a1880502e5abf6b32175fc2282d42675cc6903b936e661263c31935894f636d9dc76e9510972df4b9d41dff6804858c250d22fdd02131ba0c6002b491c843bfd21d1e21a6ba2d7f9d13f9448dbbb5db4cedf590c91c62e6756cd3a7036d5df96d769b450577a17e128f71f053448ea9af36d087e59e72d4dfbac604c2e024e5ed81a12cf27610e6120325b237456af9e7c8a95c60eb859c85981eda033149ea7e27cd7e72216c070c619affa12d1d4e1b735c5b8f8a6bed120f8b0ccd1b3694fd7ae0c8de3deef82ff71b38127229140ca9b6ddb58052ec3bbc59e6f4d3d32708526b500e3b0a88a368e15d0165b88166866312d93ac1ba3a227cd947a700df186"}, &(0x7f0000002380)={0x21, 0x0, 0x4, "b47a18aa"}}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000002540)={&(0x7f0000002400)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000002500)={&(0x7f0000002440)={0xbc, r1, 0x100, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x7d}}}}, [@NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES={0x79, 0xbe, "f26c1ffa96d0c6e74c86a1920cfb970fc1d89b5fa450d66dc14a6fe247966c7e43f49c1167683375d361b0eaac862c046478c97d8037675f86bc9da93c70c2cf9476ca0c077a06d756eef0df3b894884aeec1d4ae8db5cca4384bdbe69130d78004812eb444688447381d3c0b30a66d01a9ab46841"}, @NL80211_ATTR_STA_FLAGS={0x14, 0x11, 0x0, 0x1, [@NL80211_STA_FLAG_AUTHORIZED={0x4}, @NL80211_STA_FLAG_TDLS_PEER={0x4}, @NL80211_STA_FLAG_SHORT_PREAMBLE={0x4}, @NL80211_STA_FLAG_MFP={0x4}]}, @NL80211_ATTR_STA_SUPPORTED_CHANNELS={0x4}]}, 0xbc}, 0x1, 0x0, 0x0, 0x854}, 0x8884) syz_usb_ep_read(r2, 0x9, 0x75, &(0x7f0000002580)=""/117) sendmsg$NL80211_CMD_NEW_KEY(r4, &(0x7f00000026c0)={&(0x7f0000002600)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000002680)={&(0x7f0000002640)={0x34, r3, 0x400, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x8, 0x72}}}}, [@NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040800}, 0x40408d0) shutdown(r0, 0x1) r5 = syz_open_dev$mouse(&(0x7f0000002700), 0xffffffffffffffff, 0x18900) sendmsg$NL80211_CMD_NOTIFY_RADAR(r5, &(0x7f0000002840)={&(0x7f0000002740)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000002800)={&(0x7f0000002780)={0x54, r1, 0x100, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xd000}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x9}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x15cc}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x80000000}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1711}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004800}, 0x0) r6 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000002880), 0x0, 0x0) sendmsg$NL80211_CMD_DISASSOCIATE(r6, &(0x7f0000002a40)={&(0x7f00000028c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002a00)={&(0x7f0000002900)={0xd0, r1, 0x100, 0x70bd25, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x6, 0x33}}}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x200}, @NL80211_ATTR_MAC={0xa, 0x6, @random="5a5832626b7f"}, @NL80211_ATTR_SSID={0x4}, @NL80211_ATTR_IE={0x65, 0x2a, [@random_vendor={0xdd, 0x48, "b32a8d2e6cb409332f50e2cc2b0b9327dc7dc35e4c79622f6d688d222165588dd7f4a987e4d40970640c3e56510bbda32784320e59d81fb0e77cad09fcd4ee424edbd86700cf411d"}, @mesh_id={0x72, 0x6}, @chsw_timing={0x68, 0x4, {0x4, 0x7}}, @mesh_config={0x71, 0x7, {0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0, 0x9, 0x29}}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @random="1c33e71b3a2b"}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_REASON_CODE={0x6}]}, 0xd0}, 0x1, 0x0, 0x0, 0x4040050}, 0x801) mount(&(0x7f0000002a80)=@sr0, &(0x7f0000002ac0)='./file0\x00', &(0x7f0000002b00)='ntfs3\x00', 0x20001, &(0x7f0000002b40)=':+)*,)\x00') quotactl$Q_GETQUOTA(0xffffffff80000702, &(0x7f0000002b80)=@nullb, 0x0, &(0x7f0000002bc0)) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000002c80), r4) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(r4, &(0x7f0000002d80)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002d40)={&(0x7f0000002cc0)={0x64, r7, 0x10, 0x70bd2a, 0x25dfdbfc, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x4}, {0x6, 0x16, 0x4}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x9}, {0x8, 0xb, 0x3ff}}]}, 0x64}, 0x1, 0x0, 0x0, 0x40015}, 0xac96da589048a05b) r8 = syz_usb_connect$cdc_ncm(0x0, 0x99, &(0x7f0000002dc0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x87, 0x2, 0x1, 0x1, 0x40, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x7, 0x24, 0x6, 0x0, 0x1, "877a"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x5, 0x2, 0xfffa, 0xe6}, {0x6, 0x24, 0x1a, 0x6bd, 0x8}, [@mbim={0xc, 0x24, 0x1b, 0x7, 0x5, 0x8, 0x67, 0x8, 0x5f}, @dmm={0x7, 0x24, 0x14, 0x8, 0x9}, @network_terminal={0x7, 0x24, 0xa, 0x9, 0x5, 0x3, 0xa}, @network_terminal={0x7, 0x24, 0xa, 0x7, 0x5, 0x4, 0x1}, @mbim_extended={0x8, 0x24, 0x1c, 0x2, 0x47, 0x8}]}, {{0x9, 0x5, 0x81, 0x3, 0x400, 0x9, 0x81}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x9, 0xce, 0x80}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x4, 0x6, 0x5}}}}}}}]}}, &(0x7f0000003040)={0xa, &(0x7f0000002e80)={0xa, 0x6, 0x201, 0x18, 0x5, 0x28, 0xff, 0x6}, 0x41, &(0x7f0000002ec0)={0x5, 0xf, 0x41, 0x5, [@ss_container_id={0x14, 0x10, 0x4, 0x1, "fbe50b376323898d7c6ce13c581ec7d7"}, @wireless={0xb, 0x10, 0x1, 0xc, 0x2, 0x9, 0x3, 0x3ff, 0x11}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x0, 0x9, 0xe63}, @wireless={0xb, 0x10, 0x1, 0x8, 0x4, 0x0, 0x1, 0x2, 0x42}, @wireless={0xb, 0x10, 0x1, 0x4, 0xc, 0x5, 0x40, 0x5, 0x7}]}, 0x2, [{0x14, &(0x7f0000002f40)=@string={0x14, 0x3, "f3ab248812f79f2223e68ff7f0dc04a27a4e"}}, {0x84, &(0x7f0000002f80)=@string={0x84, 0x3, "c7a3302dc5548d033dead4389d42653080de79700b65b4671ac349ce18524ce7ba7b56024be95197938042551c3ce33137dbd11aed6a2dff22eca823dceda90cbfb0d677abfe2981ed48dffc1856bad0cba437288aae661c079f0655ce18a936fa62c941fdfa3ee2f1a0bf249496f71f65dca11c8ba686b3f1f5feb4881fbd1cd9ae"}}]}) syz_usb_control_io$cdc_ncm(r8, &(0x7f0000003100)={0x14, &(0x7f0000003080)={0x0, 0x27, 0x39, {0x39, 0x6, "e01a03bfe97354aed4936b04ba1ddc7fd7c34896d97bb3a2c986c7ec6ec03916877b1fcdc19ab130740cd7d38d632fad1f37230e095d52"}}, &(0x7f00000030c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000003380)={0x44, &(0x7f0000003140)={0x0, 0x9, 0x6b, "ead070182ca6a347ea5ad7ec3439f58909c801e389c849e30c9ffc3cfefa4280cc0045c87ef1d4df2cf43e8ec7828e3168b714a9b1cd02a1f38560bfcf9fdb02b5adb3c060ed7df84f8954fa88fb0c96299a68a3d241aaf67c024da9923d94e8728b0bd4738ff4a7ddf168"}, &(0x7f00000031c0)={0x0, 0xa, 0x1, 0x7f}, &(0x7f0000003200)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000003240)={0x20, 0x80, 0x1c, {0x0, 0x1d94, 0x10, 0x9, 0x3, 0x1a, 0x2, 0x101, 0x9, 0xffff, 0x5, 0x4}}, &(0x7f0000003280)={0x20, 0x85, 0x4, 0x30a}, &(0x7f00000032c0)={0x20, 0x83, 0x2}, &(0x7f0000003300)={0x20, 0x87, 0x2, 0x2}, &(0x7f0000003340)={0x20, 0x89, 0x2, 0x674}}) ioctl$KVM_CAP_VM_TYPES(r5, 0x4068aea3, &(0x7f0000003400)={0xeb, 0x0, 0x1}) sendmsg$TIPC_CMD_SET_LINK_WINDOW(0xffffffffffffffff, &(0x7f0000003540)={&(0x7f0000003480)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000003500)={&(0x7f00000034c0)={0x30, 0x0, 0x400, 0x70bd28, 0x25dfdbfb, {{}, {}, {0x14, 0x18, {0x1, @bearer=@l2={'ib', 0x3a, 'ip_vti0\x00'}}}}, ["", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x4010) 1.283789625s ago: executing program 5 (id=8160): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x141342, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) recvmsg(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000005c0)=""/240, 0xf0}], 0x1, 0x0, 0x0, 0xf5ffffff}, 0x0) close(0x4) ptrace(0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0xffff8000) clock_adjtime(0x0, &(0x7f0000000500)={0x7de, 0x6b, 0x0, 0x1000, 0x1, 0x9, 0x85a5, 0xa11a, 0x9, 0x0, 0x2000000, 0x7fff, 0x81, 0xfffffffffffffff9, 0x3, 0x6, 0x8000000000000001, 0x4, 0x58fd, 0x3, 0x9, 0x2, 0x6, 0x6, 0xab, 0x5}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r5 = signalfd(0xffffffffffffffff, &(0x7f0000000080)={[0x8000000000000000]}, 0x8) fcntl$setstatus(r5, 0x4, 0x400) r6 = openat$cgroup_freezer_state(r5, &(0x7f0000000040), 0x2, 0x0) preadv(r6, &(0x7f00000002c0)=[{&(0x7f0000000140)=""/24, 0x18}, {&(0x7f0000000180)=""/83, 0x53}, {&(0x7f0000000200)=""/173, 0xad}], 0x3, 0x4, 0x3a0) fcntl$setstatus(r5, 0x4, 0x4000) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f00000083c0)={{0x1, 0x3}}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="2400000025000100000000000000000008000000", @ANYRES32=r7, @ANYBLOB='\x00\x00\x00\x00', @ANYRES32], 0x24}], 0x1}, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r4, 0x40505412, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x1}) write(r1, &(0x7f0000000b80)="83699b0dbb3c9a9c00a9fcf4ef986bf0d50adb7cf699c9288930e971a0b6e42e2c5c2ef4b66e57614411389b0f5c902195503093144767fdafd26471fe70ef333fe70e450d0a05f83b3beee6be3eb805acb96a4e571772039b641da1d2930332a74574f04c5d84a8e0a06f062c355fe57eb572e30174d3f4e24b59e11218edbc3a90bd9ae75749aefbb3ba48891f96e302fc70c37ad996a60857013fea89652ce45baef6aa7fdd847f4ad52562b935d011fda70b5d5bcfeaa449ba3eed03167bd93cf4628e5b3e33e138bee164fd8f321b85c7317c9831498660fc6089eab87bd3f9a603e3bd8fa3f7822dfc062dbc0586d85a2d81e9c156bf062b494e214f1613becb2b47a7d96bbc2a99f473d3b44fc300868c65b5ec8940d63be58d923cbac73b968f22d0d16bd858633c1ec7de8e6fcda2bbcdb91743b15aab727e78d5a2a9988268202c96be3f27f6f5f6b858dc16ffd088d1da89d058096362975d8c16bd99e0a63c3105e129ca923b3a1133306f7d1596ec2340f3351eb40db6f5073eb6aa6e41715026faa2a71d88c2a385eb727bf38ea3324da1df8944576906d19f146a07145c0aaf36b81d8ebf2b4dd63572eb8ea558fa88284e5fdb233278e389ecca68d23121ac0553ca7e891942fc28defa4ff15407b953f5c67b21c35f4fc6ffa774a792debc2970bcb4369dae5b9a8a9217cdedbecb6fadf71f8de4171eaa526a8b3bee99aaeaa975dcd8c5efeaf5a86bd8a384b0bb071c643cf9e69a3ad61b6b8f1a3da64fb3622824ffd358620c1c453f41577ea7e55de450203c9c89460a2385b9a09eb7cc91cac71325cac711df188b6415d1283cf7069d8c4403c8dc45b20c8cc56b76897955fe52fb034e62219815d64005598f12133c32f21e3f608d9e71cb04448485056ebac36a46169c8fe63d8289d94dd6cd06181bf8b2d6c4d280c00198a92a89ddcd6f0296210c7e597eb85e2cce0e4b9ad6be61522e7f7d7ae7dbda03dda268c9bd650759925e623f5fad6a4604168f51adab90a206ff36b89b9436499eb6b406af0f0441594352c2706bee812984c58172fc9fc002db3ff63889c14dca424bb9821d814619e730a8f976e896be844f3364b4cadcdb6ac3319dcd67fec2e39d40da45a1f776cd565be29c0bb36eefd5145e89adea8bd33605c24823fee6219f678ae1574ef8a2101f655106a262f476d2bd14153575e1dbd0ab43d30cee3ce46790fb1060f9538cdccb3e7241b1f5b75fb43a8be537be169db72737a7117132e775505afad0acae2d2f593f851c8736e0b0e1383c3fe9bf35114e5daf1f978dfdc3fb0fd3518eedc4a30992db217a8393412f07602238c9173925f48f31af37162c11f872865feffb8f7dc8fe43d0d8867dcb1cfd60d1140cada11fbb6dffb8366e356e3327f271b1ab2938699740953e4a07780b13f957bcc984c7f9315f3de2103128ec96374d2a84dee1bcd5f390aa95a650f92aa3d4fa11cca70a43c3d819b2edcd0dd80348be818f226eb716d863bbfc0901463cccfdd08a2fe970985f92c895265c45255dc91d9036e1ca55cf978718c56f6da3f57baaa140a04d4c9eecaf95d9051f6a8946a84ec783c8f65849a48ae1ab9bcf6ef76ce67b18906457e084b40de34743da5bdcf97eb64ef7cf1738968cf78317b7d2b3e9fadd3ce81901a7c407020451c8d7c076632ed85c8e939b5040129c2ed49fd130cffe51abf4d991942b0baf8559622c0f65fae9c0c14b525f0317b2e7ed8d6c5b810c83c8d5474041356313fd60fa4a302af80843ccbf4e892d210aecc4f272acc2e294211d62ae4d9d9a189152d67428b095077cfa13a17284576b14b134065ee1be5f3dbc4e0f9c00e3578ce234a77c12ac21d21485c54390d40c0fbce453b7d8c1246c1c8873c03d634498fe3c68be0b586e351ad28f67552937851b9652dedd0124150f51b4085edf579d4ceef19337fe259d8002a17a71b470e29c26140f4c8a666536338f45815878f12b5194779aea076679b669329e99b67e499da400f765d7ee5f59f88fe4859a94361d23b98c5dd2b3bbd615bdf97ce4e021731b9382526bbdc31f8eabb03966280ba0de437180f4090aa9141c7962c9c522108963b6776b1ba7379bad59d4c361151de7ace19d94b9a88628797e744cd3327249a7df4a8f95418fbb5d5d7faff8b168fc0588e35c18b45e92b5aec0d2e2a88bfb69b7e2453f93272499e50bb75a0f41b2cf5d248f38c439192c9960b56c9990d5c63780abd90882ba3477b8c67ec1680d8c216f01b9aa678febcb515c9b55c8c130b73cb8ab182b03b754ec6085b0a074349bb2f4b4bfa4f8050289822b975dba999d7bc1fdb632f06e884ab8b9a11db5367d04a03fc9f2309846c89445effbdbc3610a8267f9414c8f8fe4bf1447662ddbe1c2baa785e672befe51298f10e1be6359d9aa70a06b6ceec218e76d26cac2e2174b49c30668a970564b08d51f77865a5b02e54ce98f5d21ffc1a6a421ff0a0819056e3a33e0cd27a4ddeb7b33c806e1891e86aeba504a307b82c614aaf3e8add6b7a61e29dcdffb70f9ad84988298cb03da8f51f145f2bec15d452b44d49b6063a0a2078ae68628b097f3a4e87c9d33dbe0ed6480057b4f8fad5e1566e3c1ffbe40c47799570ce85581a48b713315cf6eb5911e1c58b52c85e4e2af72caf072c6bfb9b2beb99d880ebf0012bab6ff55f3fbf0b003cf41f8e95a16655f3fd9cd45be4ed6837c768043945a759df4d58ef8a170bdc83cb26efb8b60938258b9e71ccf409d3988a9a2b8c669daaa99450adc05d7caf93aefd09d55ee757d0174f6617e762a7241e5dea332fb84943bda0e6d7eb080f796ad2ac8cf3d3327b4ee204463695e0352c2fbbbb63fef41c5ff026df1f3cd942c6fb1ad3f7222985782923f5bd24185cf0d44ac5f63e788c6876b0041756a3db8889034d621b82476c50a4cf8e39afa05626c208b22683cce3852d7cfbc4a3e2593e0fd74f908c1cf287ed1709996eba97ef9c4db809088b08ba04a4ed6060754b46967057a56f46e389db3cbcd457daf0e63ed58c68b3b6d33a8540cfe4cd9e3538294c51a10536c855c7a8233b4ea1dfbdb599ec6b0f53505104ef09857593eb0ed380a131bddab81f6fef95b1b2557287ebf5826b65b44897123d47a58c83d3ffe8e194c197a1fcee0bdd0ba966ff140f15a1f8186d2389a1271237c2d5d62b06d295ceb9ca24a7258130dbe7a72272ff4f35d142d2f0377502bc7cb62a04fe251df7acb86556ea1e1c4289878b406ea6e03d6ce820457badb6ce9cb72acf1becf5d94cd89b24aa89eb649057cd2e629dfdc3dac412faad0210d3144cc295727622dc72f446846d652574609ef2a0c4d38bde8f02cd0c7b1b19c571e54e736d9f97c8aef2b84705d6258f16cffe3e6502462158912d88d3a3c77421cbf8b706dcfc132830a60d6ce9749f6138833600c0419876a028cf1a0613c68e7b3b9666c8a88b7b42d93b635c451126832ae6526056fdd96844ff27bf0ac8f187774db84ae62a20898804cb64f30dd86391265c64dbd8f2c06d07974c1dcad81bd66b1ea294b7184e0c5ab06e0d1bff900a9d3e3f40283d1889178d86afa84cb86b625952b7f53f09786e8ea93206b6405ea4af19b17495476209b797de79bf391b3a3d788c3f14b4c84794d1c5ae3143eb491cf6101581962c48c59161d67cafc128011f2ae1a71d3f51ecb1584778f471eeb52e2186db7700a684844444a149e1c99befa77300b89835259f00d6e98a324f47a8659df7278f10cdc5ea4ce5ba9b86b7784fb83cdad899e9786345adc17c4eedc8e5be49abfd89929a666054152adc6400979128f2bd1b46f71d2d6ffd25d385f316609483cdd1f577f1327196f8662cf8e0ae9338af3888f2ebc79d59527833f7106292d4306b4f40a5b2e29601d65e75a13d89f807356d6ef440f626cda628c43c812217a16cbbc55d16916533e5ac01cfe159eae33136ed663559ff0dddea45584a60a4cdb0f5a0e679bc32d422a4880b46362cf95ee7c364ea1326283f39532a844781e851f8bbf3fd71071a164fff8beedf5bbac37e56c23dbe13d244175044fc347a0d66c6ef6dd50d93097003c325ce4f40ddfab490c6cdcc3c8a50608c1d146b20fe03e2ec5dad9e14595e3c3d71a276925c29aab92a7a94a2e90e14a53c2a7c5fd585abfa5b77926066eec5009558a280306aeeb80ec70f56b5efbfffef2693f60f382660cc8f02be6083632dbbc5634ccad3b81b0707f27fc56d68732a494fb0c172dc40671d9386005945300a489338d1ad44b3d016fb75cc1296a01e17dda2b7113b812582bc31cd247ed15fb7c3fb5314b900e68399bc5b9655f2ffa949aeda0ae031a667ccd14cb628c07f78c3f8a99925f8bebeed4d69309780510e16a334909b058e4d05e98136d1ce1a32d253dca8bff5d7f39d7ba458559017b8f75873385a1dff0ef619862ba6df558405acd89c1008f614255c47a899c547bb15a14a8582830a8606e766c7c8fcbb31c9237882e5a89a8ee1795d76445c53034892eb11bb0c8fa71a65cafa1d3f86d347bba1b246f441c47c045f2c1ce69770cfa326b4ef32fcb000f11051df5772ffdf2c3b34d73737b61944fdb83bc8bbb2ece25d98999267ecc29df67cd5b83b6714284aaafb3f9614ef0fd4ee222aee43f490b26437bb24342c164230232e31471a9ace0e0858ae957fe20543278531e43b91cd489cba33581a9222888f46a192e1f8d7530ddbf943b11f4970ad4933024d0453e8d9cbaba154ff13c7a638bdeaf61dd8920f9f467473d38faa0b1e4f3c4a83c0886e1d0c6968d151406a157171a3da99ba25b043590e03f76070ff19c628d36dde3cf682a256f98eec20951b8de81ef03248f77d2dac3f26a01ae37102b3a175614ed9a60b960b9fad65d03b326f036659788d4a3dbaecb9e25a622bcb5d451278a1b4c94f67758462ff42b4d6b1ad9deb55a600c8fc9b4180ddec6bde10cd201e2134d4c5ca729329f5bd7b3245391bf841c41cfc8fbb9c0b2211e2b7b6f9adf6a556b7388545ee99fec78380d424fba12c4672339ad205f2300244c53d19c2f46ed4d7b143e0757870e34a95210665856393b235c7dfff9b0ba98fe143a37bb3a374f99cd9b1789eb0b781d64b2eb1a8acb9e2a7172101ba67c4509b8dbd2f1413251202b64107fe7b6ac613279d9879894490a625b467a74369becb207de589ebdc18103a5aba1030f067ddbec26c83c6fbb57fefc02a167c819322211cbf9b37c74473173d65f87e25165366904a355716cd43874a53e53d8d99229ae24bb067678c3047311850b1afe6217835d1328197d8eeabbf2e1e2836fdda77fc23206e602c07b063530a8d892e3501995005b6bbc3b63f27e8e78658c0b3c5205ac6f4c16b37625aa5b93ab8f52a6368abf4eae72b334cd4720b80863853340ad9dae418f68324ab33d559a2f223f1785e9a2b968af0f641a8a1312c9637878e9f0f27cb7074c3be5cd553370094099e5e76e33989d89caeaf9ac99f0b7666fd82f953d0ee0ecd695124d8990b6b264bcb376cc1ca91f4cb942f83bd4f01b4f4e62523bcacab38583cf6edf4fca0c407d0e365e51fd92f73cb675963f2a4d212bb365f729d0a6f0387d05f2a6c993009bebf2a8e4bc846a6e77116cd5160d72718b84263802614d89acdfabf0f3d0d249c6170bac09a343ea1994fdb661ef4d6141e29043a2fe82aab4ea343c4e5e9783e6c17db8dd836d7036dfe0e9be1e676fa9", 0x1000) ioctl$BLKRRPART(r0, 0x125f, 0x0) 425.762991ms ago: executing program 1 (id=8171): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x121001, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) (async) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'wg1\x00', 0x400}) (async) ioctl$TUNSETCARRIER(r1, 0x400454e2, &(0x7f0000000000)=0x1) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) 407.228802ms ago: executing program 5 (id=8172): socket$nl_route(0x10, 0x3, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000940), 0x2000, 0x0) ioctl$TIOCEXCL(r0, 0x540c) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x121400, 0x0) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) write$tcp_congestion(r1, 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 389.443342ms ago: executing program 1 (id=8173): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0xcc02, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_LOOPBACK(r1, 0x65, 0x3, 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x400001000001fe) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_SET_GSI_ROUTING(r3, 0x4008ae6a, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000006a0b00000100000000000000000000000000000006009900"]) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_clone(0x0, 0x0, 0xfffffffffffffe7b, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) ioctl$sock_SIOCETHTOOL(r4, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000100)=@ethtool_ringparam={0xa, 0x0, 0x300, 0xed}}) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x13, r0, 0x66053000) 329.743013ms ago: executing program 5 (id=8174): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r1, &(0x7f0000000280)={0x1f, 0x0, @none, 0xfff9, 0x2}, 0xe) listen(r1, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 316.665874ms ago: executing program 5 (id=8175): getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) syz_clone(0xa61a2100, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000000/0x1000)=nil, 0x4000}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r2 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2a, &(0x7f0000000200)={0x8, {{0xa, 0x4e20, 0x6de, @local}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) setsockopt$inet6_group_source_req(r2, 0x29, 0x2f, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x4, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e21, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x7fffd}}}, 0x108) close_range(r1, 0xffffffffffffffff, 0x0) 294.010784ms ago: executing program 1 (id=8176): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffff1) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3000001, 0x10010, 0xffffffffffffffff, 0xef7f8000) futex_waitv(&(0x7f0000000340)=[{0x0, &(0x7f0000000000), 0x82}, {0x7, &(0x7f0000000040)=0x3, 0x2}], 0x2, 0x0, 0x0, 0x0) futex(&(0x7f0000000140), 0x5, 0x0, 0x0, &(0x7f0000000000), 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000280)={0x0}, &(0x7f00000002c0)=0xc) sched_setscheduler(r1, 0x0, &(0x7f0000000300)=0xff2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0xa23bc000) futex_waitv(&(0x7f00000001c0)=[{0x6, &(0x7f0000000080)=0x81, 0x82}, {0x6, &(0x7f00000000c0)=0x3a4f, 0x2}, {0x5, &(0x7f0000000100)=0x1, 0x2}], 0x3, 0x0, &(0x7f0000000240)={0x77359400}, 0x1) mremap(&(0x7f00007ff000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000fff000/0x1000)=nil) 177.634276ms ago: executing program 1 (id=8177): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f40)=[{{0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f00000002c0)="91199893b794f675ec88239fef317c764ee3a8ecbdc2a8c32d46f77944d1de9f924d05d3566b8eb8f5750393c669559d05543efa2927ef0d2b10e3d4f8541f34e1c7c8ca2d1e811f67f3dc50fdd469af72a49e684e28a364f5da124dff2b55a5536aa670b82da70bf0f19cd42037", 0x6e}], 0x1}}], 0x1, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000100)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000013000/0x4000)=nil, 0x3000, 0x3}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff) r3 = socket(0x80000000000000a, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000000540)={'ip6gre0\x00', &(0x7f00000004c0)={'ip6gre0\x00', 0x0, 0x2f, 0x1, 0x7, 0x6, 0x30, @empty, @empty, 0x40, 0x20, 0x0, 0xa7a}}) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000380)={0xbc, r2, 0x0, 0x70bd29, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x1c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_ADDR={0x20, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @remote}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @ipv4={'\x00', '\xff\xff', @multicast1}}]}, @MPTCP_PM_ATTR_ADDR={0x44, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xeb}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}]}, @MPTCP_PM_ATTR_ADDR={0x20, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0x4008010}, 0x1) fsetxattr$trusted_overlay_upper(r1, &(0x7f0000000240), &(0x7f0000000580)={0x0, 0xfb, 0xca, 0x1, 0x2, "deb03096099a60f49fca01d5e7f8bec6", "ab093ed7f4f0324b0b9c11060d1b318924b3900f3ed05c848fdde701838ca327193f24ecb24bc086bcafab4cb6e12b10b1d5fbbba7d18776605db753dcde6bd9f47952b64adc1c625739c4e7babe5f4ccb4634b77c28aa1aa7e8a9ef1ccfd66080779c4165ce8964e76ecd982f24d9e1db27fd264dc1a4a885897e6a4c3b2bfd9af1a7e2cc71a80a5828e8d27bfa47dd093960e6b2d62812c86d6fa00ac576bf032b7c5a1283a08de14b712c4a3814ec82a26f0ef8"}, 0xca, 0x2) r4 = syz_open_procfs(0x0, &(0x7f0000002040)='pagemap\x00') readv(r4, &(0x7f0000000840)=[{&(0x7f0000000480)=""/14, 0xe}], 0x1) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) fcntl$lock(r5, 0x7, &(0x7f0000000000)={0x1, 0x2, 0x1b8, 0x2}) fcntl$lock(r5, 0x6, &(0x7f0000000200)={0x0, 0x0, 0x3b5, 0x1fd}) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r6, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r7 = socket$inet6(0xa, 0x3, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r7, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@remote, @in=@loopback, 0xfffd, 0x0, 0x4e20, 0x0, 0x2, 0x20, 0x80}, {0x0, 0x4, 0x1, 0x0, 0x0, 0x9}, {0x1ff, 0xffffffffe, 0x401, 0x20}, 0x6, 0x5, 0x1, 0x0, 0x1, 0x2}, {{@in=@loopback, 0x1, 0xff}, 0xa, @in6=@private0, 0x3502, 0x1, 0x0, 0x0, 0x6, 0xfffffffd}}, 0xe8) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x0, 0xffffffff, @ipv4={'\x00', '\xff\xff', @dev}, 0x9df}, 0x1c) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r6, 0x80489439, &(0x7f00000004c0)) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000fc0)=[@reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 115.406077ms ago: executing program 1 (id=8178): openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) 0s ago: executing program 1 (id=8179): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2/custom0\x00', 0x800, 0x0) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000005c0), 0x2, 0x0) r2 = openat$selinux_policy(0xffffff9c, &(0x7f0000000300), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f00000000c0)="0f78400ed83d660f3882740036660f3835300f0d1db80c008ed80f01df66b9800000c00f326635010000000f300f0179b9b868028ec0"}], 0x1, 0x7c, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) write$selinux_load(r1, &(0x7f0000000000)=ANY=[], 0xfd50) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x380, 0x2}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272df9f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) flistxattr(r2, &(0x7f00000001c0)=""/253, 0xfd) kernel console output (not intermixed with test programs): 616.833409][T22507] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:261 [ 616.949362][T22516] SELinux: ebitmap: truncated map [ 616.977805][T22516] SELinux: failed to load policy [ 617.080053][T22525] rust_binder: Error while translating object. [ 617.080112][T22525] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 617.086377][T22525] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:269 [ 617.091274][T22528] netlink: 'syz.0.7352': attribute type 16 has an invalid length. [ 617.112996][T22528] netlink: 'syz.0.7352': attribute type 3 has an invalid length. [ 617.120905][T22528] netlink: 64066 bytes leftover after parsing attributes in process `syz.0.7352'. [ 617.184502][T22533] futex_wake_op: syz.0.7354 tries to shift op by 32; fix this program [ 617.724435][T22542] can0 (unregistered): slcan off ttyS3. [ 617.750626][T22545] __vm_enough_memory: pid: 22545, comm: syz.2.7358, bytes: 18014402804453376 not enough memory for the allocation [ 617.810846][T22548] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 617.812984][T22548] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:939 [ 617.822293][T22548] rust_binder: Error in use_page_slow: ESRCH [ 617.843585][T22548] rust_binder: use_range failure ESRCH [ 617.855124][T22548] rust_binder: Failed to allocate buffer. len:1160, is_oneway:false [ 617.869509][T22548] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 617.879138][T22548] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:939 [ 617.905826][T22548] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 617.915663][T22548] rust_binder: Read failure Err(EFAULT) in pid:939 [ 618.401693][T22578] netlink: 316 bytes leftover after parsing attributes in process `syz.1.7363'. [ 618.458611][T22578] rust_binder: Write failure EINVAL in pid:279 [ 618.931349][T22586] binder: Bad value for 'max' [ 619.129266][T22593] rust_binder: Failed to allocate buffer. len:208, is_oneway:true [ 619.551969][ T331] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 619.636036][T22620] binder: Bad value for 'max' [ 619.761964][ T331] usb 2-1: Using ep0 maxpacket: 32 [ 619.770292][ T331] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 619.779964][ T331] usb 2-1: config 0 has no interface number 0 [ 619.791054][ T331] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 619.801499][ T331] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 619.810890][ T331] usb 2-1: Product: syz [ 619.816246][ T331] usb 2-1: Manufacturer: syz [ 619.820871][ T331] usb 2-1: SerialNumber: syz [ 619.836843][ T331] usb 2-1: config 0 descriptor?? [ 619.842716][ T547] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 619.849970][ T331] smsc95xx v2.0.0 [ 619.902003][ T45] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 620.019168][ T547] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 620.028765][ T547] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 620.037062][ T547] usb 3-1: Product: syz [ 620.041261][ T547] usb 3-1: Manufacturer: syz [ 620.047817][ T547] usb 3-1: SerialNumber: syz [ 620.069102][ T45] usb 6-1: config 1 interface 0 altsetting 3 endpoint 0x81 has an invalid bInterval 159, changing to 11 [ 620.090119][ T45] usb 6-1: config 1 interface 0 altsetting 3 endpoint 0x81 has invalid maxpacket 25120, setting to 1024 [ 620.102722][ T45] usb 6-1: config 1 interface 0 altsetting 3 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 620.116478][ T45] usb 6-1: config 1 interface 0 has no altsetting 0 [ 620.148231][ T45] usb 6-1: New USB device found, idVendor=0458, idProduct=0138, bcdDevice= 0.40 [ 620.164390][ T45] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 620.182660][ T45] usb 6-1: Product: syz [ 620.186881][ T45] usb 6-1: SerialNumber: syz [ 620.393533][ T36] kauditd_printk_skb: 1320 callbacks suppressed [ 620.393554][ T36] audit: type=1400 audit(2000000722.378:107665): avc: denied { search } for pid=22642 comm="sed" name="resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 620.423435][ T36] audit: type=1400 audit(2000000722.378:107666): avc: denied { read } for pid=22642 comm="sed" name="eth0.dhcp" dev="tmpfs" ino=435 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 620.428482][ T45] usbhid 6-1:1.0: can't add hid device: -71 [ 620.464325][ T45] usbhid 6-1:1.0: probe with driver usbhid failed with error -71 [ 620.471603][ T36] audit: type=1400 audit(2000000722.378:107667): avc: denied { read open } for pid=22642 comm="sed" path="/run/dhcpcd/hook-state/resolv.conf/eth0.dhcp" dev="tmpfs" ino=435 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 620.497972][ T45] usb 6-1: USB disconnect, device number 63 [ 620.504235][ T331] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000030: -71 [ 620.531942][ T331] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error writing E2P_CMD [ 620.540182][ T36] audit: type=1400 audit(2000000722.378:107668): avc: denied { getattr } for pid=22642 comm="sed" path="/run/dhcpcd/hook-state/resolv.conf/eth0.dhcp" dev="tmpfs" ino=435 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 620.555948][ T331] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 620.568311][ T36] audit: type=1400 audit(2000000722.438:107669): avc: denied { search } for pid=22643 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 620.595526][ T331] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 620.604029][ T36] audit: type=1400 audit(2000000722.438:107670): avc: denied { search } for pid=22643 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=421 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 620.635228][ T36] audit: type=1400 audit(2000000722.438:107671): avc: denied { search } for pid=22643 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=425 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 620.659714][ T36] audit: type=1400 audit(2000000722.438:107672): avc: denied { search } for pid=22643 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 620.661964][ T331] usb 2-1: USB disconnect, device number 87 [ 620.698634][ T36] audit: type=1400 audit(2000000722.458:107673): avc: denied { ioctl } for pid=22596 comm="syz.1.7368" path="/dev/binderfs/binder1" dev="binder" ino=35 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 620.737951][ T36] audit: type=1400 audit(2000000722.458:107674): avc: denied { set_context_mgr } for pid=22596 comm="syz.1.7368" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 621.014172][T22657] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 621.022920][T22657] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 621.827670][T22713] cgroup: No subsys list or none specified [ 622.168262][T22724] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 622.177977][T22724] rust_binder: Failed to allocate buffer. len:160, is_oneway:false [ 622.389778][T22730] rust_binder: Error while translating object. [ 622.397822][T22730] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 622.411937][T22730] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:317 [ 622.425813][T22731] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 622.582652][ T6968] usb 3-1: USB disconnect, device number 62 [ 622.996570][T22766] rust_binder: Write failure EFAULT in pid:686 [ 623.102003][ T6968] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 623.272101][ T6968] usb 3-1: Using ep0 maxpacket: 8 [ 623.283758][ T6968] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 623.293575][ T6968] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 623.304400][ T6968] usb 3-1: config 0 descriptor?? [ 623.512380][ T6968] asix 3-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 623.741956][ T45] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 623.891965][ T45] usb 2-1: Using ep0 maxpacket: 32 [ 623.899636][ T45] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 623.909860][ T45] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 623.919752][ T45] usb 2-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 623.932725][ T45] usb 2-1: config 0 interface 0 has no altsetting 0 [ 623.939519][ T6968] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 623.949510][ T45] usb 2-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 623.958683][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 623.967024][ T6968] asix 3-1:0.0: probe with driver asix failed with error -32 [ 623.980666][ T45] usb 2-1: config 0 descriptor?? [ 623.985826][ T6968] usb 3-1: USB disconnect, device number 63 [ 624.383308][T22807] fuse: Bad value for 'fd' [ 624.406640][ T45] hid-thrustmaster 0003:044F:B65D.0029: unknown main item tag 0x0 [ 624.422221][ T45] hid-thrustmaster 0003:044F:B65D.0029: unknown main item tag 0x0 [ 624.430335][ T45] hid-thrustmaster 0003:044F:B65D.0029: unknown main item tag 0x0 [ 624.455724][ T45] hid-thrustmaster 0003:044F:B65D.0029: unknown main item tag 0x0 [ 624.464340][ T45] hid-thrustmaster 0003:044F:B65D.0029: unknown main item tag 0x0 [ 624.480585][ T45] hid-thrustmaster 0003:044F:B65D.0029: hidraw0: USB HID v0.00 Device [HID 044f:b65d] on usb-dummy_hcd.1-1/input0 [ 624.512093][ T45] hid-thrustmaster 0003:044F:B65D.0029: Wrong number of endpoints? [ 624.609308][ C1] hid-thrustmaster 0003:044F:B65D.0029: Unknown packet type 0x0, unable to proceed further with wheel init [ 624.640346][T22819] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7432'. [ 624.815726][T22780] overlay: ./file0 is not a directory [ 624.844767][T22780] 9pnet: p9_errstr2errno: server reported unknown error 18446744073 [ 624.868216][T22780] rust_binder: Error while translating object. [ 624.868270][T22780] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 624.881678][T22780] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:327 [ 625.211608][T22861] 9pnet_fd: p9_fd_create_unix (22861): problem connecting socket: ./file0: -111 [ 625.274145][T22863] veth0_vlan: left promiscuous mode [ 625.423697][ T36] kauditd_printk_skb: 656 callbacks suppressed [ 625.423718][ T36] audit: type=1400 audit(2000000727.408:108331): avc: denied { read write } for pid=18228 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 625.455639][ T36] audit: type=1400 audit(2000000727.408:108332): avc: denied { read write open } for pid=18228 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 625.481878][ T36] audit: type=1400 audit(2000000727.408:108333): avc: denied { ioctl } for pid=18228 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 625.508605][ T36] audit: type=1400 audit(2000000727.428:108334): avc: denied { read write } for pid=22869 comm="syz.2.7449" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 625.537580][ T36] audit: type=1400 audit(2000000727.428:108335): avc: denied { read write open } for pid=22869 comm="syz.2.7449" path="/dev/raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 625.563095][ T36] audit: type=1400 audit(2000000727.428:108336): avc: denied { ioctl } for pid=22869 comm="syz.2.7449" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 625.576192][T22874] netlink: 156 bytes leftover after parsing attributes in process `syz.5.7450'. [ 625.589253][ T36] audit: type=1400 audit(2000000727.428:108337): avc: denied { ioctl } for pid=22869 comm="syz.2.7449" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 625.622976][ T36] audit: type=1400 audit(2000000727.428:108338): avc: denied { ioctl } for pid=22869 comm="syz.2.7449" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 625.650647][ T36] audit: type=1400 audit(2000000727.428:108339): avc: denied { ioctl } for pid=22869 comm="syz.2.7449" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 625.676012][ T36] audit: type=1400 audit(2000000727.548:108340): avc: denied { ioctl } for pid=22869 comm="syz.2.7449" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 625.702275][ T6968] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 625.842019][ T6968] usb 3-1: device descriptor read/64, error -71 [ 626.081993][ T6968] usb 3-1: device descriptor read/64, error -71 [ 626.321968][ T6968] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 626.330565][T22891] bpf: Bad value for 'mode' [ 626.339875][T22891] bpf: Bad value for 'mode' [ 626.346640][T22891] bpf: Bad value for 'mode' [ 626.352587][T22891] bpf: Bad value for 'mode' [ 626.379336][T19921] usb 2-1: USB disconnect, device number 89 [ 626.481945][ T6968] usb 3-1: device descriptor read/64, error -71 [ 626.504315][T22900] 9pnet_fd: Insufficient options for proto=fd [ 626.678942][T22923] rust_binder: inc_ref_done called when no active inc_refs [ 626.721972][ T6968] usb 3-1: device descriptor read/64, error -71 [ 626.842462][ T6968] usb usb3-port1: attempt power cycle [ 627.157608][T22927] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=22927 comm=syz.5.7467 [ 627.181996][ T6968] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 627.211824][ T6968] usb 3-1: device descriptor read/8, error -71 [ 627.344882][ T6968] usb 3-1: device descriptor read/8, error -71 [ 627.397013][T22949] fuse: Bad value for 'fd' [ 627.442228][T22952] netlink: 'syz.5.7476': attribute type 1 has an invalid length. [ 627.450550][T22951] netlink: 'syz.5.7476': attribute type 1 has an invalid length. [ 627.515926][T22957] sit0: entered promiscuous mode [ 627.524921][T22957] netlink: 1 bytes leftover after parsing attributes in process `syz.5.7478'. [ 627.581029][T22962] netlink: 188 bytes leftover after parsing attributes in process `syz.1.7477'. [ 627.591985][ T6968] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 627.611484][T22962] input: syz1 as /devices/virtual/input/input65 [ 627.625007][ T6968] usb 3-1: device descriptor read/8, error -71 [ 627.677177][T22973] netlink: 92 bytes leftover after parsing attributes in process `syz.5.7482'. [ 627.687021][T22973] veth1: mtu less than device minimum [ 627.701988][T22973] netlink: 92 bytes leftover after parsing attributes in process `syz.5.7482'. [ 627.756733][ T6968] usb 3-1: device descriptor read/8, error -71 [ 627.786786][T22981] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 627.795833][T22981] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 627.806310][T22981] overlayfs: missing 'lowerdir' [ 627.827024][T22981] netlink: 48 bytes leftover after parsing attributes in process `syz.5.7484'. [ 627.893000][ T6968] usb usb3-port1: unable to enumerate USB device [ 628.014146][T22988] netlink: 'syz.5.7487': attribute type 25 has an invalid length. [ 628.397380][T22995] incfs: Options parsing error. -22 [ 628.407166][T22995] incfs: mount failed -22 [ 628.481522][T22998] overlayfs: failed to clone lowerpath [ 628.482790][T22995] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 628.504161][T23001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 628.512861][T23001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 628.581084][T23004] tipc: Enabling of bearer rejected, failed to enable media [ 628.701656][T23011] rust_binder: Write failure EFAULT in pid:344 [ 628.815120][T23019] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7498'. [ 628.830394][T23019] erspan0: default FDB implementation only supports local addresses [ 628.852015][ T6968] usb 3-1: new full-speed USB device number 68 using dummy_hcd [ 628.992200][ T6968] usb 3-1: device descriptor read/64, error -71 [ 629.007748][T23024] rust_binder: Write failure EFAULT in pid:356 [ 629.062515][ T63] hid-generic 0000:0000:0000.002A: unknown main item tag 0x0 [ 629.082592][ T63] hid-generic 0000:0000:0000.002A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 629.241983][ T6968] usb 3-1: device descriptor read/64, error -71 [ 629.481993][ T6968] usb 3-1: new full-speed USB device number 69 using dummy_hcd [ 629.587844][T23062] netlink: 164 bytes leftover after parsing attributes in process `syz.5.7511'. [ 629.621128][T23064] 9pnet: Could not find request transport: fdIrfdno=0xffffffffffffffff [ 629.632006][ T6968] usb 3-1: device descriptor read/64, error -71 [ 629.806587][T23082] netlink: 44 bytes leftover after parsing attributes in process `syz.0.7520'. [ 629.815849][T23082] netlink: 59 bytes leftover after parsing attributes in process `syz.0.7520'. [ 629.824905][T23082] netlink: 59 bytes leftover after parsing attributes in process `syz.0.7520'. [ 629.881965][ T6968] usb 3-1: device descriptor read/64, error -71 [ 629.992030][ T6968] usb usb3-port1: attempt power cycle [ 630.260683][T23092] netlink: 'syz.1.7523': attribute type 4 has an invalid length. [ 630.268682][T23092] netlink: 3657 bytes leftover after parsing attributes in process `syz.1.7523'. [ 630.331946][ T6968] usb 3-1: new full-speed USB device number 70 using dummy_hcd [ 630.354752][ T6968] usb 3-1: device descriptor read/8, error -71 [ 630.396792][T23099] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 630.396830][T23099] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:379 [ 630.448287][ T36] kauditd_printk_skb: 452 callbacks suppressed [ 630.448311][ T36] audit: type=1400 audit(2000000732.428:108793): avc: denied { read } for pid=23101 comm="syz.1.7526" name="binder1" dev="binder" ino=39 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 630.488601][ T36] audit: type=1400 audit(2000000732.428:108794): avc: denied { read open } for pid=23101 comm="syz.1.7526" path="/dev/binderfs/binder1" dev="binder" ino=39 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 630.519892][ T6968] usb 3-1: device descriptor read/8, error -71 [ 630.527815][ T36] audit: type=1400 audit(2000000732.428:108795): avc: denied { read } for pid=23101 comm="syz.1.7526" name="binder1" dev="binder" ino=39 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 630.552435][ T36] audit: type=1400 audit(2000000732.468:108796): avc: denied { read open } for pid=23101 comm="syz.1.7526" path="/dev/binderfs/binder1" dev="binder" ino=39 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 630.578686][ T36] audit: type=1400 audit(2000000732.468:108797): avc: denied { ioctl } for pid=23101 comm="syz.1.7526" path="/dev/binderfs/binder1" dev="binder" ino=39 ioctlcmd=0x6207 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 630.607077][ T36] audit: type=1400 audit(2000000732.468:108798): avc: denied { set_context_mgr } for pid=23101 comm="syz.1.7526" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 630.654652][ T36] audit: type=1400 audit(2000000732.468:108799): avc: denied { ioctl } for pid=23101 comm="syz.1.7526" path="/dev/binderfs/binder1" dev="binder" ino=39 ioctlcmd=0x9423 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 630.687598][ T36] audit: type=1400 audit(2000000732.478:108800): avc: denied { read write } for pid=21230 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 630.728018][ T36] audit: type=1400 audit(2000000732.478:108801): avc: denied { read write open } for pid=21230 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 630.754277][ T36] audit: type=1400 audit(2000000732.488:108802): avc: denied { ioctl } for pid=21230 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 630.781950][ T6968] usb 3-1: new full-speed USB device number 71 using dummy_hcd [ 630.814410][ T6968] usb 3-1: device descriptor read/8, error -71 [ 630.921114][T23123] tmpfs: Bad value for 'huge' [ 630.923081][T23124] tmpfs: Bad value for 'huge' [ 630.955622][ T6968] usb 3-1: device descriptor read/8, error -71 [ 631.092453][ T6968] usb usb3-port1: unable to enumerate USB device [ 631.321967][ T331] usb 2-1: new full-speed USB device number 90 using dummy_hcd [ 631.474271][ T331] usb 2-1: too many endpoints for config 253 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 631.485417][ T331] usb 2-1: config 253 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 631.508837][ T331] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 631.528842][ T331] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 631.537453][ T331] usb 2-1: SerialNumber: syz [ 631.757378][T23134] rust_binder: Error while translating object. [ 631.757411][T23134] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 631.763688][T23134] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:390 [ 631.786068][ T331] usb 2-1: USB disconnect, device number 90 [ 631.902033][ T45] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 632.054286][ T45] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 632.065227][ T45] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 632.075139][ T45] usb 3-1: New USB device found, idVendor=04d8, idProduct=f372, bcdDevice= 0.00 [ 632.084499][ T45] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 632.094114][ T45] usb 3-1: config 0 descriptor?? [ 632.351580][T23172] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7548'. [ 632.378242][ T45] usbhid 3-1:0.0: can't add hid device: -71 [ 632.390223][T23172] bridge_slave_1: left allmulticast mode [ 632.396060][ T45] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 632.403879][T23172] bridge_slave_1: left promiscuous mode [ 632.411786][ T45] usb 3-1: USB disconnect, device number 72 [ 632.417895][T23172] bridge0: port 2(bridge_slave_1) entered disabled state [ 632.426922][T23172] bridge_slave_0: left allmulticast mode [ 632.433575][T23172] bridge_slave_0: left promiscuous mode [ 632.440468][T23175] rust_binder: 392: no such ref 1 [ 632.451885][T23175] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 3 [ 632.464185][T23172] bridge0: port 1(bridge_slave_0) entered disabled state [ 632.908638][T23193] tipc: Enabled bearer , priority 0 [ 632.958658][T23193] tc_dump_action: action bad kind [ 632.971628][T23192] tipc: Disabling bearer [ 633.023026][T23207] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found [ 633.031406][T23207] rust_binder: Write failure EINVAL in pid:412 [ 633.177857][T23215] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 633.197646][T23216] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 152, size: 18446744073709551507) [ 633.197676][T23216] rust_binder: Error while translating object. [ 633.211062][T23215] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 152, size: 18446744073709551507) [ 633.217414][T23215] rust_binder: Error while translating object. [ 633.230699][T23216] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 633.233127][T23215] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 633.238172][T23216] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1017 [ 633.246483][T23215] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1017 [ 633.331958][ T331] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 633.492092][ T331] usb 2-1: Using ep0 maxpacket: 16 [ 633.514087][ T331] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=29.00 [ 633.531951][ T331] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 633.540053][ T331] usb 2-1: Product: syz [ 633.544795][ T331] usb 2-1: Manufacturer: syz [ 633.557918][ T331] usb 2-1: SerialNumber: syz [ 633.567403][ T331] usb 2-1: config 0 descriptor?? [ 633.579946][ T331] ftdi_sio 2-1:0.0: FTDI USB Serial Device converter detected [ 633.588713][ T331] usb 2-1: Detected FT4233HP [ 633.610540][T23227] netlink: 'syz.5.7567': attribute type 22 has an invalid length. [ 633.624638][T23229] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 633.724116][T23229] rust_binder: Error in use_page_slow: ESRCH [ 633.730893][T23229] rust_binder: use_range failure ESRCH [ 633.737092][T23229] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 633.744043][T23229] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 633.752281][T23229] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:1028 [ 633.787280][ T331] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 633.826039][ T331] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 633.843033][ T331] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 633.861724][ T331] usb 2-1: USB disconnect, device number 91 [ 633.868108][T23236] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 633.869741][ T331] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 633.886469][T23236] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 633.886504][T23236] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:1031 [ 633.896357][ T331] ftdi_sio 2-1:0.0: device disconnected [ 633.989810][T23240] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 633.993003][T23240] rust_binder: Error in use_page_slow: ESRCH [ 633.999529][T23240] rust_binder: use_range failure ESRCH [ 634.005736][T23240] rust_binder: Failed to allocate buffer. len:4240, is_oneway:false [ 634.011312][T23240] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 634.020565][T23240] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:1035 [ 634.192762][T23243] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 634.424500][T23252] netlink: 'syz.5.7577': attribute type 4 has an invalid length. [ 634.432488][T23252] netlink: 17 bytes leftover after parsing attributes in process `syz.5.7577'. [ 634.561768][T23256] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 634.563650][T23256] rust_binder: Error in use_page_slow: ESRCH [ 634.570124][T23256] rust_binder: use_range failure ESRCH [ 634.571993][ T31] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 634.576345][T23256] rust_binder: Failed to allocate buffer. len:4256, is_oneway:false [ 634.589364][T23256] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 634.597465][T23256] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:1043 [ 634.749201][ T31] usb 2-1: New USB device found, idVendor=0b95, idProduct=772b, bcdDevice=a2.4c [ 634.756326][T23267] rust_binder: 1047: no such ref 3 [ 634.758997][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.782423][ T31] usb 2-1: Product: syz [ 634.786691][ T31] usb 2-1: Manufacturer: syz [ 634.795716][ T31] usb 2-1: SerialNumber: syz [ 634.805457][ T31] usb 2-1: config 0 descriptor?? [ 634.814419][T23267] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:1047 [ 634.890855][T23274] binfmt_misc: register: failed to install interpreter file ./file0 [ 634.927588][T23274] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 634.986309][T23280] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 634.987364][T23280] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 634.993916][T23280] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:1051 [ 635.121007][T23289] overlayfs: failed to clone lowerpath [ 635.433772][ T31] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 635.451479][ T31] asix 2-1:0.0: probe with driver asix failed with error -71 [ 635.460648][ T31] usb 2-1: USB disconnect, device number 92 [ 635.507197][ T36] kauditd_printk_skb: 938 callbacks suppressed [ 635.507219][ T36] audit: type=1400 audit(2000000737.488:109741): avc: denied { create } for pid=23290 comm="syz.5.7592" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 635.533916][ T36] audit: type=1400 audit(2000000737.498:109742): avc: denied { write } for pid=23290 comm="syz.5.7592" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 635.554927][ T36] audit: type=1400 audit(2000000737.518:109743): avc: denied { create } for pid=23290 comm="syz.5.7592" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 635.575056][ T36] audit: type=1400 audit(2000000737.518:109744): avc: denied { setopt } for pid=23290 comm="syz.5.7592" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 635.594995][ T36] audit: type=1400 audit(2000000737.528:109745): avc: denied { create } for pid=23290 comm="syz.5.7592" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 635.615094][ T36] audit: type=1400 audit(2000000737.528:109746): avc: denied { create } for pid=23290 comm="syz.5.7592" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 635.634990][ T36] audit: type=1400 audit(2000000737.528:109747): avc: denied { setopt } for pid=23290 comm="syz.5.7592" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 635.661461][ T36] audit: type=1400 audit(2000000737.608:109748): avc: denied { sys_module } for pid=23295 comm="syz.5.7593" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 635.687141][ T36] audit: type=1400 audit(2000000737.608:109749): avc: denied { mounton } for pid=23295 comm="syz.5.7593" path="/294/file0" dev="tmpfs" ino=1586 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 635.712190][ T36] audit: type=1400 audit(2000000737.608:109750): avc: denied { mount } for pid=23295 comm="syz.5.7593" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 636.210808][T23340] rust_binder: 421: no such ref 0 [ 636.216476][T23340] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 636.223857][T23340] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 636.353291][T23344] fuse: Bad value for 'fd' [ 636.638195][T23364] binder: Unknown parameter 'coltsy"te_uGй :*?tH$^"Lt3* fp' [ 636.686029][T23367] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 636.686358][T23367] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 636.697824][T23367] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 636.705273][T23367] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 636.712754][T23367] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 636.719597][T23367] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 636.727328][T23367] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 637.071977][ T31] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 637.242053][ T31] usb 3-1: Using ep0 maxpacket: 16 [ 637.250258][ T31] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 637.260716][ T31] usb 3-1: config 1 has an invalid interface number: 255 but max is 2 [ 637.274223][ T31] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 637.286104][ T31] usb 3-1: config 1 has 4 interfaces, different from the descriptor's value: 3 [ 637.299202][ T31] usb 3-1: config 1 has no interface number 3 [ 637.306199][ T31] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 637.316797][ T31] usb 3-1: config 1 interface 255 has no altsetting 0 [ 637.329175][ T31] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 637.340015][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 637.372556][ T31] usb 3-1: Product: syz [ 637.376774][ T31] usb 3-1: Manufacturer: syz [ 637.393354][ T31] usb 3-1: SerialNumber: syz [ 637.581933][T23426] rust_binder: Write failure EFAULT in pid:439 [ 637.616785][T23426] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 637.634264][T23426] rust_binder: 439: no such ref 0 [ 637.673126][ T31] usb 3-1: USB disconnect, device number 73 [ 637.722645][T22458] udevd[22458]: setting owner of /dev/bus/usb/003/073 to uid=0, gid=0 failed: No such file or directory [ 637.861297][T22743] udevd[22743]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 638.258668][T23443] rust_binder: Write failure EFAULT in pid:449 [ 638.313777][T23449] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=6 sclass=netlink_route_socket pid=23449 comm=syz.0.7641 [ 638.339449][T23451] binder: Bad value for 'max' [ 638.635084][T23459] binder: Bad value for 'stats' [ 639.284190][T23468] rust_binder: 23467 RLIMIT_NICE not set [ 639.284646][T23467] rust_binder: Write failure EINVAL in pid:463 [ 639.299826][T23468] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 639.350488][ T31] rust_binder: 23466: removing orphan mapping 0:1168 [ 639.470642][T23475] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7650'. [ 640.527418][ T36] kauditd_printk_skb: 35318 callbacks suppressed [ 640.527438][ T36] audit: type=1400 audit(2000000742.510:145054): avc: denied { mounton } for pid=23489 comm="syz.2.7655" path="/376/file0" dev="tmpfs" ino=2042 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 640.589481][ T36] audit: type=1400 audit(2000000742.550:145055): avc: denied { mount } for pid=23489 comm="syz.2.7655" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 640.622021][ T36] audit: type=1400 audit(2000000742.550:145056): avc: denied { create } for pid=23489 comm="syz.2.7655" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 640.656587][ T36] audit: type=1400 audit(2000000742.550:145057): avc: denied { ioctl } for pid=23489 comm="syz.2.7655" path="socket:[102000]" dev="sockfs" ino=102000 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 640.702060][ T36] audit: type=1400 audit(2000000742.550:145058): avc: denied { sys_module } for pid=23489 comm="syz.2.7655" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 640.742109][ T36] audit: type=1400 audit(2000000742.550:145059): avc: denied { setopt } for pid=23489 comm="syz.2.7655" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 640.762366][ T36] audit: type=1400 audit(2000000742.570:145060): avc: denied { mounton } for pid=23491 comm="syz.5.7656" path="/304/file0" dev="tmpfs" ino=1640 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 640.787352][ T36] audit: type=1400 audit(2000000742.570:145061): avc: denied { unmount } for pid=18228 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 640.812113][ T36] audit: type=1400 audit(2000000742.590:145062): avc: denied { read write } for pid=18228 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 640.837552][ T36] audit: type=1400 audit(2000000742.590:145063): avc: denied { read write open } for pid=18228 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 641.002142][T23503] rust_binder: Error while translating object. [ 641.002177][T23503] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 641.012773][T23503] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:473 [ 641.961950][ T63] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 642.103092][T23552] netlink: 'syz.0.7678': attribute type 11 has an invalid length. [ 642.124730][ T63] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 642.141795][ T63] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 642.153865][ T63] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 642.167531][ T63] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 642.187353][ T63] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 642.213743][ T63] usb 2-1: config 0 descriptor?? [ 642.481966][T19921] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 642.629396][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.637048][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.645571][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.653575][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.661046][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.668668][T19921] usb 3-1: config 1 has an invalid descriptor of length 61, skipping remainder of the config [ 642.678923][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.686510][T19921] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 642.695475][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.702913][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.710334][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.717859][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.726731][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.734642][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.742413][T19921] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 642.751487][T19921] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 642.759727][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.767172][T19921] usb 3-1: SerialNumber: syz [ 642.771958][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.779397][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.788586][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.796107][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.803946][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.811435][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.818907][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.826387][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.851974][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.859457][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.879862][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.888083][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.896404][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.903979][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.911401][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.918875][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.926316][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.933818][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.941267][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.948735][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.956216][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.963682][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.971281][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.978812][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.986959][ T63] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 642.994757][ T63] plantronics 0003:047F:FFFF.002B: No inputs registered, leaving [ 643.006517][ T63] plantronics 0003:047F:FFFF.002B: hiddev96,hidraw0: USB HID v0.00 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 643.022811][T19921] usb 3-1: 0:2 : does not exist [ 643.027739][T19921] usb 3-1: unit 5: unexpected type 0x0b [ 643.046360][T19921] usb 3-1: USB disconnect, device number 75 [ 643.052432][ T63] usb 2-1: USB disconnect, device number 93 [ 643.144510][T23563] udevd[23563]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 643.149605][T23564] fido_id[23564]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 643.811426][T23584] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 644.401963][ T45] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 644.554334][ T45] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 644.565599][ T45] usb 2-1: New USB device found, idVendor=0419, idProduct=0600, bcdDevice= 0.00 [ 644.577867][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 644.603827][ T45] usb 2-1: config 0 descriptor?? [ 644.816473][T23611] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 644.834747][T23611] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 644.862482][T23611] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 644.901644][T23611] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 644.930518][T23611] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 644.959708][T23611] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 644.994046][T23611] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 645.010162][T23611] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 645.040251][T23611] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 645.048758][ T63] usb 3-1: new full-speed USB device number 76 using dummy_hcd [ 645.068498][T23611] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 645.112212][ T45] samsung 0003:0419:0600.002C: unknown main item tag 0x1 [ 645.119334][ T45] samsung 0003:0419:0600.002C: item fetching failed at offset 6/7 [ 645.141977][ T45] samsung 0003:0419:0600.002C: parse failed [ 645.151869][ T45] samsung 0003:0419:0600.002C: probe with driver samsung failed with error -22 [ 645.191942][ T63] usb 3-1: device descriptor read/64, error -71 [ 645.316457][T23610] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:515 [ 645.319977][ T45] usb 2-1: USB disconnect, device number 94 [ 645.451955][ T63] usb 3-1: device descriptor read/64, error -71 [ 645.543818][ T36] kauditd_printk_skb: 588 callbacks suppressed [ 645.543840][ T36] audit: type=1400 audit(2000000747.530:145652): avc: denied { ioctl } for pid=23638 comm="syz.0.7707" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=103646 ioctlcmd=0xaa00 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 645.592792][ T36] audit: type=1400 audit(2000000747.570:145653): avc: denied { ioctl } for pid=23622 comm="syz.2.7701" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 645.618981][ T36] audit: type=1400 audit(2000000747.570:145654): avc: denied { ioctl } for pid=23622 comm="syz.2.7701" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 645.652932][ T36] audit: type=1400 audit(2000000747.640:145655): avc: denied { ioctl } for pid=23622 comm="syz.2.7701" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 645.711941][ T63] usb 3-1: new full-speed USB device number 77 using dummy_hcd [ 645.720379][ T36] audit: type=1400 audit(2000000747.700:145656): avc: denied { ioctl } for pid=23622 comm="syz.2.7701" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 645.761953][ T36] audit: type=1400 audit(2000000747.700:145657): avc: denied { ioctl } for pid=23622 comm="syz.2.7701" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 645.791926][ T36] audit: type=1400 audit(2000000747.740:145658): avc: denied { ioctl } for pid=23622 comm="syz.2.7701" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 645.827241][ T36] audit: type=1400 audit(2000000747.740:145659): avc: denied { ioctl } for pid=23622 comm="syz.2.7701" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 645.881963][ T63] usb 3-1: device descriptor read/64, error -71 [ 645.888435][ T36] audit: type=1400 audit(2000000747.740:145660): avc: denied { ioctl } for pid=23622 comm="syz.2.7701" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 645.931940][ T36] audit: type=1400 audit(2000000747.740:145661): avc: denied { ioctl } for pid=23622 comm="syz.2.7701" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 646.132260][T23645] __vm_enough_memory: pid: 23645, comm: syz.1.7709, bytes: 18014402804453376 not enough memory for the allocation [ 646.151955][ T63] usb 3-1: device descriptor read/64, error -71 [ 646.260979][T23647] 9pnet_fd: Insufficient options for proto=fd [ 646.267458][ T63] usb usb3-port1: attempt power cycle [ 646.611940][ T63] usb 3-1: new full-speed USB device number 78 using dummy_hcd [ 646.645071][ T63] usb 3-1: device descriptor read/8, error -71 [ 646.786507][ T63] usb 3-1: device descriptor read/8, error -71 [ 646.906493][T19432] tipc: Left network mode [ 646.913659][T19432] veth1_macvtap: left promiscuous mode [ 646.987401][T23689] bridge0: port 1(bridge_slave_0) entered blocking state [ 646.994730][T23689] bridge0: port 1(bridge_slave_0) entered disabled state [ 647.005079][T23689] bridge_slave_0: entered allmulticast mode [ 647.011415][T23689] bridge_slave_0: entered promiscuous mode [ 647.019664][T23689] bridge0: port 2(bridge_slave_1) entered blocking state [ 647.027499][T23689] bridge0: port 2(bridge_slave_1) entered disabled state [ 647.034639][T23689] bridge_slave_1: entered allmulticast mode [ 647.040913][T23689] bridge_slave_1: entered promiscuous mode [ 647.052008][ T63] usb 3-1: new full-speed USB device number 79 using dummy_hcd [ 647.074954][ T63] usb 3-1: device descriptor read/8, error -71 [ 647.144835][T23689] bridge0: port 2(bridge_slave_1) entered blocking state [ 647.151895][T23689] bridge0: port 2(bridge_slave_1) entered forwarding state [ 647.159212][T23689] bridge0: port 1(bridge_slave_0) entered blocking state [ 647.166287][T23689] bridge0: port 1(bridge_slave_0) entered forwarding state [ 647.207183][ T63] usb 3-1: device descriptor read/8, error -71 [ 647.221275][T19432] bridge0: port 1(bridge_slave_0) entered disabled state [ 647.228716][T19432] bridge0: port 2(bridge_slave_1) entered disabled state [ 647.242761][T19434] bridge0: port 1(bridge_slave_0) entered blocking state [ 647.249850][T19434] bridge0: port 1(bridge_slave_0) entered forwarding state [ 647.261559][T19432] bridge0: port 2(bridge_slave_1) entered blocking state [ 647.268683][T19432] bridge0: port 2(bridge_slave_1) entered forwarding state [ 647.322894][ T63] usb usb3-port1: unable to enumerate USB device [ 647.352009][T23689] veth0_vlan: entered promiscuous mode [ 647.400138][T23689] veth1_macvtap: entered promiscuous mode [ 647.616953][T23707] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 647.626677][T23707] SELinux: failed to load policy [ 647.672630][ T63] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 647.833199][ T63] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 647.841989][T23732] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 647.843520][ T63] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 647.848884][T23732] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 647.850067][ T63] usb 2-1: Product: syz [ 647.871925][ T63] usb 2-1: Manufacturer: syz [ 647.902219][ T63] usb 2-1: SerialNumber: syz [ 647.963039][ T45] usb 1-1: new full-speed USB device number 110 using dummy_hcd [ 648.128652][T23738] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 648.148407][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 648.163220][T23738] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 648.178482][ T45] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 648.223145][ T45] usb 1-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00 [ 648.232422][ T63] rtl8150 2-1:1.0: couldn't reset the device [ 648.244042][ T63] rtl8150 2-1:1.0: probe with driver rtl8150 failed with error -5 [ 648.247336][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 648.277248][ T63] usb 2-1: USB disconnect, device number 95 [ 648.304671][ T45] usb 1-1: config 0 descriptor?? [ 648.323712][T23726] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 648.351252][ T45] usbhid 1-1:0.0: can't add hid device: -22 [ 648.380191][ T45] usbhid 1-1:0.0: probe with driver usbhid failed with error -22 [ 648.436012][T23749] rust_binder: Error while translating object. [ 648.436049][T23749] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 648.442314][T23749] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:537 [ 648.674652][ T63] usb 1-1: USB disconnect, device number 110 [ 649.082319][T23784] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7742'. [ 649.407739][T23800] tipc: Enabling of bearer rejected, media not registered [ 649.563769][T23812] netlink: 64 bytes leftover after parsing attributes in process `syz.0.7751'. [ 649.584922][T23812] rust_binder: Write failure EFAULT in pid:16 [ 649.827438][T23823] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 649.852534][T23823] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 649.918482][T19429] veth1_macvtap: left promiscuous mode [ 649.924104][T19429] veth0_vlan: left promiscuous mode [ 649.970642][T19429] vcan0 (unregistering): left allmulticast mode [ 649.994885][ T31] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 650.074966][ T331] usb 1-1: new high-speed USB device number 111 using dummy_hcd [ 650.085008][ T9] usb 3-1: new full-speed USB device number 80 using dummy_hcd [ 650.147853][ T31] usb 2-1: config 160 has an invalid interface number: 200 but max is 0 [ 650.156516][ T31] usb 2-1: config 160 has no interface number 0 [ 650.163018][ T31] usb 2-1: config 160 interface 200 has no altsetting 0 [ 650.173820][ T31] usb 2-1: New USB device found, idVendor=21bb, idProduct=2070, bcdDevice=87.0b [ 650.183390][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 650.191468][ T31] usb 2-1: Product: syz [ 650.195720][ T31] usb 2-1: Manufacturer: syz [ 650.200354][ T31] usb 2-1: SerialNumber: syz [ 650.225058][ T331] usb 1-1: Using ep0 maxpacket: 32 [ 650.234839][ T331] usb 1-1: config 1 has an invalid interface number: 90 but max is 3 [ 650.244295][ T331] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 650.246705][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 650.267857][ T331] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 650.278647][ T331] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 650.288453][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 650.302193][ T331] usb 1-1: config 1 has an invalid interface number: 238 but max is 3 [ 650.312409][ T331] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 650.321343][ T9] usb 3-1: New USB device found, idVendor=0925, idProduct=8866, bcdDevice= 0.00 [ 650.330487][ T331] usb 1-1: config 1 has an invalid interface number: 112 but max is 3 [ 650.338798][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 650.346882][ T331] usb 1-1: config 1 has an invalid interface number: 243 but max is 3 [ 650.355074][ T331] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 650.367353][ T9] usb 3-1: config 0 descriptor?? [ 650.372421][ T331] usb 1-1: config 1 has 5 interfaces, different from the descriptor's value: 4 [ 650.382795][T23826] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 650.390904][ T331] usb 1-1: config 1 has no interface number 0 [ 650.398906][ T331] usb 1-1: config 1 has no interface number 2 [ 650.405231][ T331] usb 1-1: config 1 has no interface number 3 [ 650.411545][ T331] usb 1-1: config 1 has no interface number 4 [ 650.418146][ T331] usb 1-1: config 1 interface 90 altsetting 128 has a duplicate endpoint with address 0x2, skipping [ 650.429319][ T331] usb 1-1: config 1 interface 90 altsetting 128 has a duplicate endpoint with address 0x5, skipping [ 650.440421][ T331] usb 1-1: config 1 interface 90 altsetting 128 has an invalid descriptor for endpoint zero, skipping [ 650.451570][ T331] usb 1-1: config 1 interface 90 altsetting 128 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 650.455924][ T31] usb 2-1: MIDIStreaming interface descriptor not found [ 650.462903][ T331] usb 1-1: config 1 interface 90 altsetting 128 endpoint 0x8 has invalid maxpacket 1024, setting to 64 [ 650.479068][ T31] usb 2-1: USB disconnect, device number 96 [ 650.498315][ T331] usb 1-1: config 1 interface 238 altsetting 128 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 650.511043][ T331] usb 1-1: config 1 interface 238 altsetting 128 endpoint 0xC has an invalid bInterval 132, changing to 11 [ 650.532301][ T331] usb 1-1: config 1 interface 238 altsetting 128 has a duplicate endpoint with address 0x6, skipping [ 650.546542][ T331] usb 1-1: config 1 interface 238 altsetting 128 has a duplicate endpoint with address 0x5, skipping [ 650.558331][ T331] usb 1-1: config 1 interface 238 altsetting 128 has a duplicate endpoint with address 0x2, skipping [ 650.570026][ T331] usb 1-1: config 1 interface 238 altsetting 128 endpoint 0x87 has invalid maxpacket 1024, setting to 64 [ 650.582099][ T331] usb 1-1: config 1 interface 238 altsetting 128 has a duplicate endpoint with address 0x9, skipping [ 650.584461][T22743] udevd[22743]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:160.200/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 650.594449][ T331] usb 1-1: config 1 interface 1 altsetting 2 endpoint 0xB has invalid maxpacket 20625, setting to 64 [ 650.622910][ T331] usb 1-1: config 1 interface 1 altsetting 2 has a duplicate endpoint with address 0x8, skipping [ 650.625600][ T36] kauditd_printk_skb: 568 callbacks suppressed [ 650.625621][ T36] audit: type=1400 audit(2000000752.607:146230): avc: denied { ioctl } for pid=23825 comm="syz.2.7757" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 650.635136][ T331] usb 1-1: config 1 interface 1 altsetting 2 has a duplicate endpoint with address 0xD, skipping [ 650.640141][ T36] audit: type=1400 audit(2000000752.607:146231): avc: denied { ioctl } for pid=23825 comm="syz.2.7757" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 650.708772][ T331] usb 1-1: config 1 interface 1 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 650.720310][ T331] usb 1-1: config 1 interface 1 altsetting 2 has a duplicate endpoint with address 0x2, skipping [ 650.731657][ T331] usb 1-1: config 1 interface 1 altsetting 2 has a duplicate endpoint with address 0x5, skipping [ 650.742981][ T331] usb 1-1: config 1 interface 1 altsetting 2 has an endpoint descriptor with address 0xEA, changing to 0x8A [ 650.754662][ T331] usb 1-1: config 1 interface 1 altsetting 2 endpoint 0x8A has an invalid bInterval 138, changing to 11 [ 650.765979][ T331] usb 1-1: config 1 interface 1 altsetting 2 endpoint 0x8A has invalid maxpacket 57724, setting to 1024 [ 650.777370][ T331] usb 1-1: config 1 interface 1 altsetting 2 has 7 endpoint descriptors, different from the interface descriptor's value: 6 [ 650.790331][ T331] usb 1-1: config 1 interface 112 altsetting 7 has a duplicate endpoint with address 0x5, skipping [ 650.801823][ T331] usb 1-1: config 1 interface 112 altsetting 7 has an invalid descriptor for endpoint zero, skipping [ 650.812775][ T331] usb 1-1: config 1 interface 112 altsetting 7 has a duplicate endpoint with address 0x2, skipping [ 650.823522][ T331] usb 1-1: config 1 interface 112 altsetting 7 has a duplicate endpoint with address 0x6, skipping [ 650.835113][ T36] audit: type=1400 audit(2000000752.816:146232): avc: denied { ioctl } for pid=23825 comm="syz.2.7757" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 650.837212][ T9] smartjoyplus 0003:0925:8866.002D: item fetching failed at offset 3/7 [ 650.869566][ T331] usb 1-1: config 1 interface 112 altsetting 7 has a duplicate endpoint with address 0x2, skipping [ 650.880057][ T36] audit: type=1400 audit(2000000752.816:146233): avc: denied { ioctl } for pid=23825 comm="syz.2.7757" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 650.880390][ T331] usb 1-1: config 1 interface 112 altsetting 7 has a duplicate endpoint with address 0x6, skipping [ 650.916370][ T9] smartjoyplus 0003:0925:8866.002D: parse failed [ 650.922734][ T9] smartjoyplus 0003:0925:8866.002D: probe with driver smartjoyplus failed with error -22 [ 650.934364][ T331] usb 1-1: config 1 interface 112 altsetting 7 has a duplicate endpoint with address 0x7, skipping [ 650.945156][ T331] usb 1-1: config 1 interface 112 altsetting 7 endpoint 0xA has invalid wMaxPacketSize 0 [ 650.955086][ T331] usb 1-1: config 1 interface 112 altsetting 7 bulk endpoint 0xA has invalid maxpacket 0 [ 650.967199][ T331] usb 1-1: config 1 interface 112 altsetting 7 has a duplicate endpoint with address 0x6, skipping [ 650.977986][ T331] usb 1-1: config 1 interface 112 altsetting 7 has a duplicate endpoint with address 0xA, skipping [ 650.989015][ T331] usb 1-1: config 1 interface 112 altsetting 7 has a duplicate endpoint with address 0x9, skipping [ 650.999781][ T331] usb 1-1: config 1 interface 112 altsetting 7 has a duplicate endpoint with address 0x3, skipping [ 651.010691][ T331] usb 1-1: config 1 interface 112 altsetting 7 has 12 endpoint descriptors, different from the interface descriptor's value: 16 [ 651.024446][ T331] usb 1-1: too many endpoints for config 1 interface 243 altsetting 131: 97, using maximum allowed: 30 [ 651.036044][ T331] usb 1-1: config 1 interface 243 altsetting 131 has 1 endpoint descriptor, different from the interface descriptor's value: 97 [ 651.049423][ T331] usb 1-1: config 1 interface 90 has no altsetting 0 [ 651.052436][ T36] audit: type=1400 audit(2000000753.036:146234): avc: denied { read write } for pid=23825 comm="syz.2.7757" name="binder1" dev="binder" ino=29 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 651.056172][ T331] usb 1-1: config 1 interface 238 has no altsetting 0 [ 651.081794][ T36] audit: type=1400 audit(2000000753.036:146235): avc: denied { read write open } for pid=23825 comm="syz.2.7757" path="/dev/binderfs/binder1" dev="binder" ino=29 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 651.111977][ T9] usb 3-1: USB disconnect, device number 80 [ 651.119404][ T331] usb 1-1: config 1 interface 1 has no altsetting 0 [ 651.126131][ T331] usb 1-1: config 1 interface 112 has no altsetting 0 [ 651.133020][ T331] usb 1-1: config 1 interface 243 has no altsetting 0 [ 651.146553][ T331] usb 1-1: Dual-Role OTG device on HNP port [ 651.155186][ T331] usb 1-1: New USB device found, idVendor=03eb, idProduct=7603, bcdDevice=8a.6c [ 651.166656][ T331] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 651.178502][ T331] usb 1-1: Product: 㰊 [ 651.182757][ T331] usb 1-1: Manufacturer: ˂甼޾袍탔ြ謴竗薘뒀殛ꒅ᎖뎓帙핦㳢枅叝嶆جꈴꂠ駿螶芽袖榻ꦕ⠝⍇둅ﻸ淲챥淲┽ގ䛴਋儬⁤柘㏸壶ꁨ嗷竽㮌╺絷宝㙳찭籀쯛驏㷟譞騃窻忤뫄൲鿔㗲ظ線᷆㫮팾⬾贈䚯ᵂ㩬焵启⥬瀑띨⑬䮖켷놙鉪Ⲣ仹뾀닋훚狼㏔㲃䬜駤뺱୊⌈質䝥ȝᑜ㽕꬘ꫪ奄 [ 651.220051][ T331] usb 1-1: SerialNumber: И [ 651.238469][ T36] audit: type=1400 audit(2000000753.116:146236): avc: denied { read write } for pid=21230 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 651.254262][T23837] syz.1.7760: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz1,mems_allowed=0 [ 651.298827][T23837] CPU: 0 UID: 0 PID: 23837 Comm: syz.1.7760 Not tainted syzkaller #0 658fd523d4664e50339751640158cdc1077a64d7 [ 651.298870][T23837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 651.298898][T23837] Call Trace: [ 651.298908][T23837] [ 651.298922][T23837] __dump_stack+0x21/0x30 [ 651.298970][T23837] dump_stack_lvl+0x10c/0x190 [ 651.299005][T23837] ? __cfi_dump_stack_lvl+0x10/0x10 [ 651.299041][T23837] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 651.299075][T23837] dump_stack+0x19/0x20 [ 651.299108][T23837] warn_alloc+0x1bc/0x2a0 [ 651.299142][T23837] ? stack_depot_save_flags+0x38/0x800 [ 651.299169][T23837] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 651.299200][T23837] ? __cfi_warn_alloc+0x10/0x10 [ 651.299234][T23837] ? kasan_save_track+0x4f/0x80 [ 651.299261][T23837] ? __kmalloc_cache_noprof+0x1a5/0x3c0 [ 651.299285][T23837] ? xskq_create+0x68/0x2a0 [ 651.299319][T23837] ? xsk_init_queue+0xb6/0x120 [ 651.299351][T23837] ? xsk_setsockopt+0x43f/0x6f0 [ 651.299383][T23837] ? do_sock_setsockopt+0x26a/0x400 [ 651.299416][T23837] ? __x64_sys_setsockopt+0x1b8/0x250 [ 651.299449][T23837] ? x64_sys_call+0x2adc/0x2ee0 [ 651.299485][T23837] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 651.299526][T23837] __vmalloc_node_range_noprof+0x135/0x1420 [ 651.299568][T23837] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 651.299604][T23837] ? avc_has_perm+0x1f2/0x220 [ 651.299639][T23837] ? kasan_save_alloc_info+0x40/0x50 [ 651.299675][T23837] ? __kasan_kmalloc+0x96/0xb0 [ 651.299704][T23837] vmalloc_user_noprof+0x77/0x90 [ 651.299739][T23837] ? xskq_create+0xdb/0x2a0 [ 651.299773][T23837] xskq_create+0xdb/0x2a0 [ 651.299807][T23837] xsk_init_queue+0xb6/0x120 [ 651.299841][T23837] xsk_setsockopt+0x43f/0x6f0 [ 651.299874][T23837] ? __cfi_xsk_setsockopt+0x10/0x10 [ 651.299906][T23837] ? do_futex+0x356/0x500 [ 651.299941][T23837] ? bpf_lsm_socket_setsockopt+0xd/0x20 [ 651.299974][T23837] ? security_socket_setsockopt+0x33/0xd0 [ 651.300000][T23837] ? __cfi_xsk_setsockopt+0x10/0x10 [ 651.300033][T23837] do_sock_setsockopt+0x26a/0x400 [ 651.300067][T23837] ? __cfi_do_sock_setsockopt+0x10/0x10 [ 651.300104][T23837] __x64_sys_setsockopt+0x1b8/0x250 [ 651.300139][T23837] x64_sys_call+0x2adc/0x2ee0 [ 651.300175][T23837] do_syscall_64+0x58/0xf0 [ 651.300205][T23837] ? clear_bhb_loop+0x50/0xa0 [ 651.300230][T23837] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 651.300269][T23837] RIP: 0033:0x7f463418eec9 [ 651.300297][T23837] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 651.300319][T23837] RSP: 002b:00007f46350dd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 651.300346][T23837] RAX: ffffffffffffffda RBX: 00007f46343e5fa0 RCX: 00007f463418eec9 [ 651.300367][T23837] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000008 [ 651.300385][T23837] RBP: 00007f4634211f91 R08: 0000000000000004 R09: 0000000000000000 [ 651.300401][T23837] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 651.300417][T23837] R13: 00007f46343e6038 R14: 00007f46343e5fa0 R15: 00007ffc56b076e8 [ 651.300439][T23837] [ 651.302675][T23837] Mem-Info: [ 651.313539][ T36] audit: type=1400 audit(2000000753.116:146237): avc: denied { read write open } for pid=21230 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 651.380301][T23837] active_anon:36889 inactive_anon:757 isolated_anon:0 [ 651.380301][T23837] active_file:7834 inactive_file:16884 isolated_file:0 [ 651.380301][T23837] unevictable:16401 dirty:39 writeback:0 [ 651.380301][T23837] slab_reclaimable:4811 slab_unreclaimable:77515 [ 651.380301][T23837] mapped:29839 shmem:16587 pagetables:1064 [ 651.380301][T23837] sec_pagetables:0 bounce:0 [ 651.380301][T23837] kernel_misc_reclaimable:0 [ 651.380301][T23837] free:1455381 free_pcp:2359 free_cma:0 [ 651.380385][T23837] Node 0 active_anon:147556kB inactive_anon:3028kB active_file:31336kB inactive_file:67536kB unevictable:65604kB isolated(anon):0kB isolated(file):0kB mapped:119356kB dirty:156kB writeback:0kB shmem:66348kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:6816kB pagetables:4256kB sec_pagetables:0kB all_unreclaimable? no [ 651.444341][ T36] audit: type=1400 audit(2000000753.126:146238): avc: denied { ioctl } for pid=23821 comm="syz.0.7756" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 651.444389][ T36] audit: type=1400 audit(2000000753.126:146239): avc: denied { ioctl } for pid=23821 comm="syz.0.7756" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 651.479313][T23837] DMA32 free:2960212kB boost:0kB min:19088kB low:23860kB high:28632kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145324kB managed:2965936kB mlocked:0kB bounce:0kB free_pcp:5724kB local_pcp:5724kB free_cma:0kB [ 651.797867][T23837] lowmem_reserve[]: 0 3921 3921 [ 651.808721][ T331] usb 1-1: USB disconnect, device number 111 [ 651.815334][T23840] sit0: entered promiscuous mode [ 651.830857][T23837] Normal free:2862704kB boost:0kB min:25964kB low:32452kB high:38940kB reserved_highatomic:0KB free_highatomic:0KB active_anon:147432kB inactive_anon:3028kB active_file:31336kB inactive_file:67536kB unevictable:65604kB writepending:156kB present:5242880kB managed:4016120kB mlocked:0kB bounce:0kB free_pcp:2048kB local_pcp:2048kB free_cma:0kB [ 651.899791][T23840] netlink: 'syz.1.7760': attribute type 1 has an invalid length. [ 651.976804][T23840] netlink: 1 bytes leftover after parsing attributes in process `syz.1.7760'. [ 652.017419][T23837] lowmem_reserve[]: 0 0 0 [ 652.044022][T23837] DMA32: 5*4kB (M) 2*8kB (M) 3*16kB (M) 4*32kB (M) 4*64kB (M) 3*128kB (M) 4*256kB (M) 4*512kB (M) 5*1024kB (UM) 5*2048kB (M) 718*4096kB (M) = 2960212kB [ 652.086867][T23837] Normal: 186*4kB (ME) 120*8kB (E) 243*16kB (UME) 1131*32kB (UME) 523*64kB (UME) 252*128kB (UME) 201*256kB (UME) 84*512kB (UME) 51*1024kB (UME) 17*2048kB (UME) 627*4096kB (UM) = 2857208kB [ 652.143180][T23837] 58727 total pagecache pages [ 652.148749][T23837] 1027 pages in swap cache [ 652.153208][T23837] Free swap = 120200kB [ 652.176943][T23837] Total swap = 124996kB [ 652.181165][T23837] 2097051 pages RAM [ 652.185001][T23837] 0 pages HighMem/MovableOnly [ 652.195650][T23837] 351537 pages reserved [ 652.200478][T23837] 0 pages cma reserved [ 652.211474][T23837] Memory allocations: [ 652.215512][T23837] 0 B 0 init/main.c:1370 func:do_initcalls [ 652.226995][T23837] 0 B 0 init/do_mounts.c:186 func:mount_root_generic [ 652.242414][T23837] 0 B 0 init/do_mounts.c:158 func:do_mount_root [ 652.255396][T23871] incfs: Error accessing: ./bus. [ 652.260512][T23837] 0 B 0 init/do_mounts.c:352 func:mount_nodev_root [ 652.268513][T23871] incfs: mount failed -2 [ 652.276071][T23837] 0 B 0 init/do_mounts_rd.c:241 func:rd_load_image [ 652.304262][T23837] 0 B 0 init/do_mounts_rd.c:72 func:identify_ramdisk_image [ 652.317083][T23837] 0 B 0 init/initramfs.c:507 func:unpack_to_rootfs [ 652.327139][T23837] 0 B 0 init/initramfs.c:508 func:unpack_to_rootfs [ 652.335090][T23837] 0 B 0 init/initramfs.c:509 func:unpack_to_rootfs [ 652.368212][T23837] 0 B 0 init/initramfs.c:101 func:find_link [ 652.433199][T23879] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 652.468475][T23877] IPv4: Oversized IP packet from 172.20.20.13 [ 652.531216][T23885] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7774'. [ 652.569884][T23885] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 652.575709][T23885] rust_binder: Write failure EINVAL in pid:1176 [ 652.682145][T23877] IPv4: Oversized IP packet from 172.20.20.13 [ 652.700127][T23891] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 652.700163][T23891] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:578 [ 652.722832][T23893] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 652.743338][T23893] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:578 [ 652.769766][T23877] IPv4: Oversized IP packet from 172.20.20.13 [ 652.772890][T23896] rust_binder: Write failure EFAULT in pid:29 [ 652.832438][T23877] IPv4: Oversized IP packet from 172.20.20.13 [ 652.924929][T23877] IPv4: Oversized IP packet from 172.20.20.13 [ 652.931112][T23898] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7779'. [ 653.024154][T23877] IPv4: Oversized IP packet from 172.20.20.13 [ 653.066749][T23877] IPv4: Oversized IP packet from 172.20.20.13 [ 653.112336][T23877] IPv4: Oversized IP packet from 172.20.20.13 [ 653.164776][T23877] IPv4: Oversized IP packet from 172.20.20.13 [ 653.215903][T23877] IPv4: Oversized IP packet from 172.20.20.13 [ 653.398170][ T45] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 653.550113][T23926] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 653.550136][T23926] rust_binder: Read failure Err(EFAULT) in pid:1182 [ 653.559133][ T45] usb 2-1: Using ep0 maxpacket: 32 [ 653.591838][ T45] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 653.603459][ T45] usb 2-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 653.604578][T23928] netlink: 'syz.0.7790': attribute type 1 has an invalid length. [ 653.618376][ T45] usb 2-1: config 0 interface 0 has no altsetting 0 [ 653.631326][ T45] usb 2-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 653.642899][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 653.658629][T23929] netlink: 'syz.0.7790': attribute type 1 has an invalid length. [ 653.680310][ T45] usb 2-1: config 0 descriptor?? [ 653.731371][T23931] binder: Unknown parameter 'uid<00000000000000000000' [ 653.764030][T23931] SELinux: security_context_str_to_sid (system_u) failed with errno=-22 [ 653.781265][T23931] binder: Bad value for 'max' [ 653.813249][T23931] binder: Unknown parameter 'obj_role' [ 654.113972][ T45] hid-thrustmaster 0003:044F:B65D.002E: hidraw0: USB HID v0.00 Device [HID 044f:b65d] on usb-dummy_hcd.1-1/input0 [ 654.163372][ T45] hid-thrustmaster 0003:044F:B65D.002E: Wrong number of endpoints? [ 654.317215][ C1] hid-thrustmaster 0003:044F:B65D.002E: URB to get model id failed with error -71 [ 654.326760][ T423] usb 2-1: USB disconnect, device number 97 [ 654.364715][T23958] fido_id[23958]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 654.448346][T23967] netlink: 'syz.0.7800': attribute type 63 has an invalid length. [ 654.466149][T23967] netlink: 5 bytes leftover after parsing attributes in process `syz.0.7800'. [ 654.580913][T23979] rust_binder: Error while translating object. [ 654.580959][T23979] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 654.600934][T23979] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:47 [ 654.611086][T23977] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7802'. [ 654.644136][T23982] fuse: Bad value for 'fd' [ 654.786535][T23977] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7802'. [ 654.787831][T23986] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 654.804457][T23977] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7802'. [ 654.822430][T23977] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7802'. [ 654.833130][T23977] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7802'. [ 654.842673][T23977] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7802'. [ 654.852513][T23977] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7802'. [ 654.863538][T23977] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7802'. [ 654.877264][T23977] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7802'. [ 654.934689][T19429] tipc: Disabling bearer [ 655.005263][T23996] netlink: 'syz.2.7806': attribute type 6 has an invalid length. [ 655.048052][T19429] tipc: Left network mode [ 655.086946][T23996] rust_binder: Failed to allocate buffer. len:136, is_oneway:false [ 655.328296][T24013] fuse: Bad value for 'fd' [ 655.576683][T19432] Bluetooth: hci0: Frame reassembly failed (-84) [ 655.646311][ T36] kauditd_printk_skb: 637 callbacks suppressed [ 655.646331][ T36] audit: type=1400 audit(2000000757.622:146877): avc: denied { read } for pid=24032 comm="syz.2.7818" dev="nsfs" ino=4026533227 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 655.675296][ T36] audit: type=1400 audit(2000000757.632:146878): avc: denied { read open } for pid=24032 comm="syz.2.7818" path="net:[4026533227]" dev="nsfs" ino=4026533227 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 655.700136][ T36] audit: type=1400 audit(2000000757.632:146879): avc: denied { create } for pid=24032 comm="syz.2.7818" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 655.721395][ T36] audit: type=1400 audit(2000000757.652:146880): avc: denied { bind } for pid=24032 comm="syz.2.7818" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 655.748640][ T36] audit: type=1400 audit(2000000757.652:146881): avc: denied { setopt } for pid=24032 comm="syz.2.7818" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 655.770871][ T36] audit: type=1400 audit(2000000757.652:146882): avc: denied { setopt } for pid=24032 comm="syz.2.7818" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 655.812789][ T36] audit: type=1400 audit(2000000757.682:146883): avc: denied { read write } for pid=18228 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 655.839121][ T36] audit: type=1400 audit(2000000757.682:146884): avc: denied { read write open } for pid=18228 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 655.866330][ T36] audit: type=1400 audit(2000000757.682:146885): avc: denied { ioctl } for pid=18228 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 655.937916][ T36] audit: type=1400 audit(2000000757.752:146886): avc: denied { read write } for pid=24035 comm="syz.2.7819" name="binder1" dev="binder" ino=29 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 655.994041][T24046] binder: Unknown parameter 's "gn|2' [ 656.220872][ T423] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 656.332413][T24082] tipc: Enabling of bearer rejected, failed to enable media [ 656.383627][ T423] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 656.394306][ T423] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 656.408474][ T423] usb 2-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 656.418392][ T423] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 656.429252][ T423] usb 2-1: config 0 descriptor?? [ 656.437388][ T423] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 656.637450][ T10] usb 2-1: USB disconnect, device number 98 [ 657.384666][T24112] /dev/sr0: Can't lookup blockdev [ 657.632341][T14990] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 657.632345][T15732] Bluetooth: hci0: command 0x1003 tx timeout [ 657.662806][ T9] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 657.742252][T24116] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 657.828890][T24126] SELinux: failed to load policy [ 657.832453][ T9] usb 2-1: device descriptor read/64, error -71 [ 658.082684][ T9] usb 2-1: device descriptor read/64, error -71 [ 658.322895][ T9] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 658.463053][ T9] usb 2-1: device descriptor read/64, error -71 [ 658.684352][T24161] overlayfs: failed to resolve 'func=FILE_CHECK': -2 [ 658.700748][T24161] overlayfs: failed to resolve '/eJrތ ON]U-j8ariYqK.βpy/Z^W4X&頬# 6f y]Ry pq_#Q?^mW]W2 .H; P}T[ <Uw./file0': -2 [ 658.723491][ T9] usb 2-1: device descriptor read/64, error -71 [ 658.739555][T24164] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 658.741150][T24163] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 [ 658.833564][ T9] usb usb2-port1: attempt power cycle [ 659.173716][ T9] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 659.196655][ T9] usb 2-1: device descriptor read/8, error -71 [ 659.326290][ T9] usb 2-1: device descriptor read/8, error -71 [ 659.574108][ T9] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 659.596918][ T9] usb 2-1: device descriptor read/8, error -71 [ 659.709277][T24191] rust_binder: Error in use_page_slow: ESRCH [ 659.709297][T24191] rust_binder: use_range failure ESRCH [ 659.712501][T24192] rust_binder: Error in use_page_slow: ESRCH [ 659.715374][T24191] rust_binder: Failed to allocate buffer. len:1168, is_oneway:false [ 659.723403][T24192] rust_binder: use_range failure ESRCH [ 659.727866][T24191] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 659.736700][T24192] rust_binder: Failed to allocate buffer. len:1168, is_oneway:false [ 659.741217][T24191] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:1264 [ 659.751624][T24192] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 659.767995][T24192] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:1264 [ 659.768624][ T9] usb 2-1: device descriptor read/8, error -71 [ 659.904464][ T9] usb usb2-port1: unable to enumerate USB device [ 660.068137][T24205] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 660.071636][T24205] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 660.115873][T24211] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 660.187390][T24216] __nla_validate_parse: 29 callbacks suppressed [ 660.187416][T24216] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7872'. [ 660.269123][T24224] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=17938 sclass=netlink_route_socket pid=24224 comm=syz.2.7874 [ 660.373075][T24230] kvm: pic: non byte write [ 660.530178][T24242] netlink: 80 bytes leftover after parsing attributes in process `syz.5.7878'. [ 660.550336][T19429] Bluetooth: hci0: Frame reassembly failed (-84) [ 660.613563][T24247] overlayfs: cannot append lower layer [ 660.666654][ T36] kauditd_printk_skb: 578 callbacks suppressed [ 660.666675][ T36] audit: type=1400 audit(2000000762.647:147465): avc: denied { create } for pid=24248 comm="syz.5.7881" anonclass=[userfaultfd] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 660.695466][ T36] audit: type=1400 audit(2000000762.647:147466): avc: denied { read } for pid=24250 comm="syz.0.7882" name="binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 660.724119][ T36] audit: type=1400 audit(2000000762.647:147467): avc: denied { read open } for pid=24250 comm="syz.0.7882" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 660.749740][ T36] audit: type=1400 audit(2000000762.647:147468): avc: denied { read write } for pid=24250 comm="syz.0.7882" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 660.773698][ T36] audit: type=1400 audit(2000000762.647:147469): avc: denied { read write open } for pid=24250 comm="syz.0.7882" path="/dev/raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 660.798631][ T36] audit: type=1400 audit(2000000762.647:147470): avc: denied { ioctl } for pid=24250 comm="syz.0.7882" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 660.824597][ T36] audit: type=1400 audit(2000000762.647:147471): avc: denied { ioctl } for pid=24250 comm="syz.0.7882" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 660.826384][T24253] netlink: 'syz.5.7881': attribute type 12 has an invalid length. [ 660.883102][ T36] audit: type=1400 audit(2000000762.647:147472): avc: denied { ioctl } for pid=24250 comm="syz.0.7882" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 660.908727][ T36] audit: type=1400 audit(2000000762.647:147473): avc: denied { ioctl } for pid=24250 comm="syz.0.7882" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 660.934990][ T36] audit: type=1400 audit(2000000762.677:147474): avc: denied { ioctl } for pid=24248 comm="syz.5.7881" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=105921 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 661.847699][T24290] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 661.853683][T24290] rust_binder: Failed to allocate buffer. len:128, is_oneway:false [ 661.892389][T24294] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 661.900736][T24295] rust_binder: Failed to allocate buffer. len:4224, is_oneway:false [ 662.008161][T24302] 9pnet: Could not find request transport: d [ 662.212021][T24316] tmpfs: Bad value for 'huge' [ 662.597120][T14990] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 662.597309][T15732] Bluetooth: hci0: command 0x1003 tx timeout [ 663.097435][ T423] usb 1-1: new full-speed USB device number 113 using dummy_hcd [ 663.121966][T24326] netlink: 5 bytes leftover after parsing attributes in process `syz.5.7907'. [ 663.157576][ T45] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 663.260097][ T423] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 663.271063][ T423] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 663.285039][ T423] usb 1-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00 [ 663.295017][ T423] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 663.303583][ T45] usb 2-1: device descriptor read/64, error -71 [ 663.311447][ T423] usb 1-1: config 0 descriptor?? [ 663.318395][T24324] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 663.328494][ T423] usbhid 1-1:0.0: can't add hid device: -22 [ 663.334570][ T423] usbhid 1-1:0.0: probe with driver usbhid failed with error -22 [ 663.533501][ T9] usb 1-1: USB disconnect, device number 113 [ 663.550804][ T45] usb 2-1: device descriptor read/64, error -71 [ 663.788094][ T45] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 663.928235][ T45] usb 2-1: device descriptor read/64, error -71 [ 664.168468][ T45] usb 2-1: device descriptor read/64, error -71 [ 664.279752][ T45] usb usb2-port1: attempt power cycle [ 664.298545][ T9] usb 1-1: new full-speed USB device number 114 using dummy_hcd [ 664.458698][ T9] usb 1-1: device descriptor read/64, error -71 [ 664.618852][ T45] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 664.651864][ T45] usb 2-1: device descriptor read/8, error -71 [ 664.698924][ T9] usb 1-1: device descriptor read/64, error -71 [ 664.792931][ T45] usb 2-1: device descriptor read/8, error -71 [ 664.949156][ T9] usb 1-1: new full-speed USB device number 115 using dummy_hcd [ 664.960715][T24362] rust_binder: Error while translating object. [ 664.960775][T24362] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 664.967314][T24362] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:1291 [ 664.982267][T24362] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 665.034316][T24365] rust_binder: Read failure Err(EAGAIN) in pid:1293 [ 665.034700][T24364] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 665.041406][ T45] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 665.056965][T24365] rust_binder: Failed to allocate buffer. len:1048, is_oneway:true [ 665.056994][T24365] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 665.065452][T24365] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:1293 [ 665.096229][ T45] usb 2-1: device descriptor read/8, error -71 [ 665.119317][ T9] usb 1-1: device descriptor read/64, error -71 [ 665.227263][T24371] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 665.232506][T24371] rust_binder: Error in use_page_slow: ESRCH [ 665.239071][T24371] rust_binder: use_range failure ESRCH [ 665.250132][ T45] usb 2-1: device descriptor read/8, error -71 [ 665.263075][T24371] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 665.263106][T24371] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 665.271204][T24371] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:1300 [ 665.369616][ T9] usb 1-1: device descriptor read/64, error -71 [ 665.389686][ T45] usb usb2-port1: unable to enumerate USB device [ 665.492923][ T9] usb usb1-port1: attempt power cycle [ 665.549760][ T31] usb 3-1: new full-speed USB device number 81 using dummy_hcd [ 665.631520][T24398] netlink: 40 bytes leftover after parsing attributes in process `syz.5.7933'. [ 665.707245][ T36] kauditd_printk_skb: 615 callbacks suppressed [ 665.707266][ T36] audit: type=1400 audit(2000000767.672:148090): avc: denied { read write } for pid=21230 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 665.764164][ T36] audit: type=1400 audit(2000000767.682:148091): avc: denied { read write open } for pid=21230 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 665.790478][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 665.801707][ T36] audit: type=1400 audit(2000000767.682:148092): avc: denied { ioctl } for pid=21230 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 665.809985][ T31] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 665.838472][ T36] audit: type=1400 audit(2000000767.712:148093): avc: denied { read } for pid=24401 comm="syz.1.7935" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 665.863330][ T9] usb 1-1: new full-speed USB device number 116 using dummy_hcd [ 665.873262][ T36] audit: type=1400 audit(2000000767.712:148094): avc: denied { read open } for pid=24401 comm="syz.1.7935" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 665.890112][ T31] usb 3-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00 [ 665.899543][ T36] audit: type=1400 audit(2000000767.712:148095): avc: denied { ioctl } for pid=24401 comm="syz.1.7935" path="/dev/kvm" dev="devtmpfs" ino=13 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 665.918998][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 665.950865][ T9] usb 1-1: device descriptor read/8, error -71 [ 665.959553][ T31] usb 3-1: config 0 descriptor?? [ 665.970869][T24374] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 665.991781][ T31] usbhid 3-1:0.0: can't add hid device: -22 [ 666.002631][ T36] audit: type=1400 audit(2000000767.732:148096): avc: denied { ioctl } for pid=24372 comm="syz.2.7925" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 666.020266][ T31] usbhid 3-1:0.0: probe with driver usbhid failed with error -22 [ 666.060842][ T36] audit: type=1400 audit(2000000767.732:148097): avc: denied { ioctl } for pid=24372 comm="syz.2.7925" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 666.110290][ T36] audit: type=1400 audit(2000000767.732:148098): avc: denied { ioctl } for pid=24372 comm="syz.2.7925" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 666.148290][ T9] usb 1-1: device descriptor read/8, error -71 [ 666.159764][T24414] rust_binder: 618: no such ref 0 [ 666.164965][T24414] rust_binder: 618: no such ref 1 [ 666.171640][ T36] audit: type=1400 audit(2000000767.762:148099): avc: denied { ioctl } for pid=24372 comm="syz.2.7925" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 666.198126][T24414] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 666.214881][T24414] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 3 [ 666.226247][T24414] netlink: 'syz.1.7939': attribute type 16 has an invalid length. [ 666.234936][T24414] netlink: 64130 bytes leftover after parsing attributes in process `syz.1.7939'. [ 666.299122][T24421] rust_binder: Write failure EFAULT in pid:1302 [ 666.390538][ T9] usb 1-1: new full-speed USB device number 117 using dummy_hcd [ 666.423154][ T9] usb 1-1: device descriptor read/8, error -71 [ 666.553301][ T9] usb 1-1: device descriptor read/8, error -71 [ 666.661041][ T9] usb usb1-port1: unable to enumerate USB device [ 666.824260][ T10] usb 3-1: USB disconnect, device number 81 [ 667.112319][T24432] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 667.112346][T24432] rust_binder: Read failure Err(EFAULT) in pid:146 [ 667.448581][T24447] netlink: 44 bytes leftover after parsing attributes in process `syz.2.7952'. [ 667.472513][ T10] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 667.587564][T24453] tipc: New replicast peer: 139.255.255.255 [ 667.601736][T24453] tipc: Enabled bearer , priority 10 [ 667.643966][ T10] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 32 [ 667.668490][ T10] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 32 [ 667.713852][ T10] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 667.723580][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 667.731769][ T10] usb 1-1: Product: syz [ 667.735963][ T10] usb 1-1: SerialNumber: syz [ 667.770216][T24460] rust_binder: Write failure EFAULT in pid:1313 [ 667.812061][T24462] rust_binder: Write failure EFAULT in pid:1315 [ 667.824356][T24462] tipc: New replicast peer: 255.255.255.255 [ 667.836988][T24462] tipc: Enabled bearer , priority 10 [ 667.881987][ T423] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 667.964382][T24432] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7946'. [ 667.975496][ T10] cdc_ncm 1-1:1.0: bind() failure [ 667.984864][ T10] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 667.991685][ T10] cdc_ncm 1-1:1.1: bind() failure [ 668.002127][ T10] usb 1-1: USB disconnect, device number 118 [ 668.032104][ T423] usb 2-1: Using ep0 maxpacket: 32 [ 668.044626][ T423] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 668.055971][ T423] usb 2-1: New USB device found, idVendor=056a, idProduct=033d, bcdDevice= 0.00 [ 668.068048][ T423] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 668.078100][ T423] usb 2-1: config 0 descriptor?? [ 668.370869][T24483] Invalid ELF header magic: != ELF [ 668.432162][T24487] netlink: 12 bytes leftover after parsing attributes in process `syz.5.7966'. [ 668.504895][ T423] wacom 0003:056A:033D.002F: unknown main item tag 0x0 [ 668.511836][ T423] wacom 0003:056A:033D.002F: unknown main item tag 0x0 [ 668.532539][ T423] wacom 0003:056A:033D.002F: unknown main item tag 0x0 [ 668.544432][ T423] wacom 0003:056A:033D.002F: unknown main item tag 0x0 [ 668.569956][T24494] rust_binder: Write failure EFAULT in pid:148 [ 668.571842][ T423] wacom 0003:056A:033D.002F: unknown main item tag 0x0 [ 668.612670][ T423] wacom 0003:056A:033D.002F: unknown main item tag 0x0 [ 668.632656][ T423] wacom 0003:056A:033D.002F: unknown main item tag 0x0 [ 668.646308][ T423] wacom 0003:056A:033D.002F: unknown main item tag 0x0 [ 668.661746][ T423] wacom 0003:056A:033D.002F: unknown main item tag 0x0 [ 668.674000][ T423] wacom 0003:056A:033D.002F: unknown main item tag 0x0 [ 668.681992][ T423] wacom 0003:056A:033D.002F: unknown main item tag 0x0 [ 668.689523][ T423] wacom 0003:056A:033D.002F: Unknown device_type for 'HID 056a:033d'. Assuming pen. [ 668.723610][ T423] wacom 0003:056A:033D.002F: hidraw0: USB HID v0.07 Device [HID 056a:033d] on usb-dummy_hcd.1-1/input0 [ 668.750114][ T423] input: Wacom Intuos P M 2 Pen as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:056A:033D.002F/input/input66 [ 668.785261][ T423] usb 2-1: USB disconnect, device number 107 [ 668.797069][T24510] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 [ 668.808612][ T10] usb 1-1: new high-speed USB device number 119 using dummy_hcd [ 668.892864][ T31] tipc: Node number set to 3885375510 [ 668.946815][T24515] fido_id[24515]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 668.974161][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 668.994541][ T10] usb 1-1: config 0 has an invalid interface number: 105 but max is 0 [ 669.031015][ T10] usb 1-1: config 0 descriptor has 1 excess byte, ignoring [ 669.042686][ T10] usb 1-1: config 0 has no interface number 0 [ 669.085338][ T10] usb 1-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 669.095161][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 669.132217][ T10] usb 1-1: Product: syz [ 669.139359][ T10] usb 1-1: Manufacturer: syz [ 669.143102][ T423] usb 2-1: new low-speed USB device number 108 using dummy_hcd [ 669.158977][ T10] usb 1-1: SerialNumber: syz [ 669.189180][ T10] usb 1-1: config 0 descriptor?? [ 669.224046][ T10] usb 1-1: Found UVC 0.00 device syz (046d:08f3) [ 669.231195][ T10] usb 1-1: No valid video chain found. [ 669.323257][ T423] usb 2-1: Invalid ep0 maxpacket: 64 [ 669.431970][ T45] usb 1-1: USB disconnect, device number 119 [ 669.460055][T24536] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 669.460700][T24536] rust_binder: 1330: no such ref 0 [ 669.483627][ T423] usb 2-1: new low-speed USB device number 109 using dummy_hcd [ 669.496823][T24536] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 669.503965][T24536] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 669.511242][T24536] rust_binder: Read failure Err(EAGAIN) in pid:1330 [ 669.633555][ T423] usb 2-1: Invalid ep0 maxpacket: 64 [ 669.650509][ T423] usb usb2-port1: attempt power cycle [ 669.990326][T24569] tmpfs: Unknown parameter '0000000000000000000000018446744073709551615' [ 669.993923][ T423] usb 2-1: new low-speed USB device number 110 using dummy_hcd [ 670.034676][ T423] usb 2-1: Invalid ep0 maxpacket: 64 [ 670.098996][T24577] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 670.102727][T24577] rust_binder: Failed to allocate buffer. len:4224, is_oneway:false [ 670.164097][ T423] usb 2-1: new low-speed USB device number 111 using dummy_hcd [ 670.214851][ T423] usb 2-1: Invalid ep0 maxpacket: 64 [ 670.218076][T24582] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 670.220413][ T423] usb usb2-port1: unable to enumerate USB device [ 670.272836][T24584] rust_binder: Failed to allocate buffer. len:1120, is_oneway:false [ 670.895976][ T36] kauditd_printk_skb: 1303 callbacks suppressed [ 670.895998][ T36] audit: type=1400 audit(2000000772.867:149403): avc: denied { mount } for pid=24600 comm="syz.5.8007" name="/" dev="ramfs" ino=107896 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 670.950705][ T36] audit: type=1400 audit(2000000772.917:149404): avc: denied { read write } for pid=18228 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 671.006486][ T36] audit: type=1400 audit(2000000772.917:149405): avc: denied { read write open } for pid=18228 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 671.033076][ T36] audit: type=1400 audit(2000000772.917:149406): avc: denied { ioctl } for pid=18228 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 671.061479][ T36] audit: type=1400 audit(2000000772.947:149407): avc: denied { read write } for pid=24602 comm="syz.2.8008" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 671.085312][ T36] audit: type=1400 audit(2000000772.947:149408): avc: denied { read write open } for pid=24602 comm="syz.2.8008" path="/dev/raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 671.110023][ T36] audit: type=1400 audit(2000000772.947:149409): avc: denied { ioctl } for pid=24602 comm="syz.2.8008" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 671.111837][T24607] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 671.135664][ T36] audit: type=1400 audit(2000000772.947:149410): avc: denied { ioctl } for pid=24602 comm="syz.2.8008" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 671.143371][T24607] rust_binder: Failed to allocate buffer. len:1168, is_oneway:false [ 671.167535][ T36] audit: type=1400 audit(2000000772.947:149411): avc: denied { ioctl } for pid=24602 comm="syz.2.8008" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 671.178186][T24607] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 671.201703][ T36] audit: type=1400 audit(2000000772.947:149412): avc: denied { ioctl } for pid=24602 comm="syz.2.8008" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 671.206528][T24607] rust_binder: Failed to allocate buffer. len:72, is_oneway:true [ 671.233441][ T331] usb 3-1: new low-speed USB device number 82 using dummy_hcd [ 671.276686][T24609] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 671.279534][T24609] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:165 [ 671.290982][T24609] rust_binder: Failed to allocate buffer. len:5168, is_oneway:false [ 671.334566][T24611] tipc: Started in network mode [ 671.347679][T24611] tipc: Node identity b284e762d82, cluster identity 4711 [ 671.354758][T24611] tipc: Enabled bearer , priority 0 [ 671.368434][T24611] 9pnet: Unknown protocol version 9 [ 671.374877][T24611] tipc: Disabling bearer [ 671.380733][ T331] usb 3-1: device descriptor read/64, error -71 [ 671.625466][ T331] usb 3-1: device descriptor read/64, error -71 [ 671.807701][T24633] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=18714 sclass=netlink_route_socket pid=24633 comm=syz.5.8019 [ 671.825693][ T45] usb 1-1: new high-speed USB device number 120 using dummy_hcd [ 671.865700][ T331] usb 3-1: new low-speed USB device number 83 using dummy_hcd [ 671.979322][T24646] netlink: 'syz.1.8023': attribute type 5 has an invalid length. [ 671.987186][T24646] netlink: 'syz.1.8023': attribute type 5 has an invalid length. [ 671.995131][T24646] netlink: 3657 bytes leftover after parsing attributes in process `syz.1.8023'. [ 672.004907][ T45] usb 1-1: device descriptor read/64, error -71 [ 672.025832][ T331] usb 3-1: device descriptor read/64, error -71 [ 672.137863][T24659] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8028'. [ 672.150349][T19434] Bluetooth: hci0: Frame reassembly failed (-84) [ 672.246063][ T45] usb 1-1: device descriptor read/64, error -71 [ 672.266088][ T331] usb 3-1: device descriptor read/64, error -71 [ 672.376667][ T331] usb usb3-port1: attempt power cycle [ 672.486231][ T45] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 672.626421][ T45] usb 1-1: device descriptor read/64, error -71 [ 672.716505][ T331] usb 3-1: new low-speed USB device number 84 using dummy_hcd [ 672.739338][ T331] usb 3-1: device descriptor read/8, error -71 [ 672.866618][ T45] usb 1-1: device descriptor read/64, error -71 [ 672.876996][ T331] usb 3-1: device descriptor read/8, error -71 [ 672.901370][T24676] netlink: 'syz.5.8035': attribute type 16 has an invalid length. [ 672.909336][T24676] netlink: 'syz.5.8035': attribute type 2 has an invalid length. [ 672.918174][T24676] netlink: 64086 bytes leftover after parsing attributes in process `syz.5.8035'. [ 672.933886][T24676] netlink: 16 bytes leftover after parsing attributes in process `syz.5.8035'. [ 672.986995][ T45] usb usb1-port1: attempt power cycle [ 673.116859][ T331] usb 3-1: new low-speed USB device number 85 using dummy_hcd [ 673.139265][ T331] usb 3-1: device descriptor read/8, error -71 [ 673.269342][ T331] usb 3-1: device descriptor read/8, error -71 [ 673.327108][ T45] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 673.349312][ T45] usb 1-1: device descriptor read/8, error -71 [ 673.377167][ T331] usb usb3-port1: unable to enumerate USB device [ 673.480133][ T45] usb 1-1: device descriptor read/8, error -71 [ 673.717400][ T45] usb 1-1: new high-speed USB device number 123 using dummy_hcd [ 673.739580][ T45] usb 1-1: device descriptor read/8, error -71 [ 673.869915][ T45] usb 1-1: device descriptor read/8, error -71 [ 673.977723][ T45] usb usb1-port1: unable to enumerate USB device [ 674.100568][T24698] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 674.207814][T15732] Bluetooth: hci0: command 0x1003 tx timeout [ 674.207852][T14990] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 674.300103][T24711] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 674.402155][T24717] input: syz1 as /devices/virtual/input/input69 [ 674.422859][T24717] input: failed to attach handler leds to device input69, error: -6 [ 674.549069][T24726] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=66 sclass=netlink_audit_socket pid=24726 comm=syz.5.8051 [ 674.922992][T24758] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8058'. [ 674.946556][T24758] bridge_slave_1: left allmulticast mode [ 674.958093][T24758] bridge_slave_1: left promiscuous mode [ 674.990605][T24758] bridge0: port 2(bridge_slave_1) entered disabled state [ 675.010949][T19429] Bluetooth: hci0: Frame reassembly failed (-84) [ 675.022517][T24758] bridge_slave_0: left allmulticast mode [ 675.037780][T24758] bridge_slave_0: left promiscuous mode [ 675.066290][T24758] bridge0: port 1(bridge_slave_0) entered disabled state [ 675.125747][T24770] fuse: Bad value for 'fd' [ 675.148714][ T423] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 675.268809][ T63] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 675.308852][ T423] usb 2-1: Using ep0 maxpacket: 8 [ 675.318383][ T423] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 8 [ 675.334300][ T423] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 675.339378][T24772] netlink: 'syz.2.8063': attribute type 7 has an invalid length. [ 675.358902][ T423] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 675.371679][ T423] usb 2-1: Product: syz [ 675.373062][T24772] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8063'. [ 675.375908][ T423] usb 2-1: Manufacturer: ␉ [ 675.387104][T24772] binder: Unknown parameter '' [ 675.409323][ T423] usb 2-1: SerialNumber: syz [ 675.417700][T24759] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 675.438982][ T63] usb 1-1: Using ep0 maxpacket: 8 [ 675.453185][ T63] usb 1-1: config 1 has an invalid interface number: 249 but max is 2 [ 675.461558][ T63] usb 1-1: config 1 has an invalid interface number: 115 but max is 2 [ 675.471029][ T63] usb 1-1: config 1 has an invalid interface number: 58 but max is 2 [ 675.480099][ T63] usb 1-1: config 1 has 4 interfaces, different from the descriptor's value: 3 [ 675.490189][ T63] usb 1-1: config 1 has no interface number 0 [ 675.496316][ T63] usb 1-1: config 1 has no interface number 2 [ 675.503780][ T63] usb 1-1: config 1 has no interface number 3 [ 675.511812][ T63] usb 1-1: config 1 interface 1 altsetting 5 endpoint 0xA has invalid maxpacket 1024, setting to 64 [ 675.523481][ T63] usb 1-1: config 1 interface 1 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 675.535096][ T63] usb 1-1: config 1 interface 1 altsetting 5 endpoint 0x8 has invalid maxpacket 1032, setting to 64 [ 675.546861][ T63] usb 1-1: config 1 interface 249 altsetting 0 endpoint 0xB has invalid maxpacket 512, setting to 64 [ 675.558746][ T63] usb 1-1: config 1 interface 249 altsetting 0 has a duplicate endpoint with address 0x8, skipping [ 675.571396][ T63] usb 1-1: config 1 interface 249 altsetting 0 has a duplicate endpoint with address 0xA, skipping [ 675.583179][ T63] usb 1-1: config 1 interface 249 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 675.595939][ T63] usb 1-1: config 1 interface 249 altsetting 0 has 7 endpoint descriptors, different from the interface descriptor's value: 11 [ 675.610044][ T63] usb 1-1: too many endpoints for config 1 interface 115 altsetting 88: 85, using maximum allowed: 30 [ 675.622352][ T63] usb 1-1: config 1 interface 115 altsetting 88 has an invalid descriptor for endpoint zero, skipping [ 675.634343][ T63] usb 1-1: config 1 interface 115 altsetting 88 has a duplicate endpoint with address 0xA, skipping [ 675.648651][ T63] usb 1-1: config 1 interface 115 altsetting 88 endpoint 0xF has invalid maxpacket 512, setting to 64 [ 675.660310][ T63] usb 1-1: config 1 interface 115 altsetting 88 has 4 endpoint descriptors, different from the interface descriptor's value: 85 [ 675.674732][ T63] usb 1-1: config 1 interface 58 altsetting 50 has a duplicate endpoint with address 0x7, skipping [ 675.687410][ T63] usb 1-1: config 1 interface 1 has no altsetting 0 [ 675.695306][ T63] usb 1-1: config 1 interface 115 has no altsetting 0 [ 675.702998][ T63] usb 1-1: config 1 interface 58 has no altsetting 0 [ 675.715573][ T63] usb 1-1: New USB device found, idVendor=0e41, idProduct=4650, bcdDevice=4b.dc [ 675.727198][ T63] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 675.736195][ T63] usb 1-1: Product: syz [ 675.741257][ T63] usb 1-1: Manufacturer: Ё [ 675.745858][ T63] usb 1-1: SerialNumber: syz [ 675.870728][ T423] usblp 2-1:1.0: usblp0: USB Bidirectional printer dev 112 if 0 alt 0 proto 2 vid 0x0525 pid 0xA4A8 [ 675.890240][ T423] usb 2-1: USB disconnect, device number 112 [ 675.901411][ T423] usblp0: removed [ 675.967030][ T36] kauditd_printk_skb: 714 callbacks suppressed [ 675.967067][ T36] audit: type=1400 audit(2000000777.923:150127): avc: denied { read } for pid=24752 comm="syz.0.8058" dev="nsfs" ino=4026532647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 676.013256][ T36] audit: type=1400 audit(2000000777.923:150128): avc: denied { read open } for pid=24752 comm="syz.0.8058" path="net:[4026532647]" dev="nsfs" ino=4026532647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 676.041799][ T63] usb 1-1: USB disconnect, device number 124 [ 676.066841][ T36] audit: type=1400 audit(2000000777.923:150129): avc: denied { create } for pid=24752 comm="syz.0.8058" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 676.131872][ T36] audit: type=1400 audit(2000000777.972:150130): avc: denied { read write } for pid=18228 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 676.160874][ T36] audit: type=1400 audit(2000000777.972:150131): avc: denied { read write open } for pid=18228 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 676.187309][ T36] audit: type=1400 audit(2000000777.972:150132): avc: denied { ioctl } for pid=18228 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 676.225274][ T36] audit: type=1400 audit(2000000778.052:150133): avc: denied { create } for pid=24802 comm="syz.2.8072" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 676.248387][ T36] audit: type=1400 audit(2000000778.052:150134): avc: denied { write } for pid=24802 comm="syz.2.8072" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 676.269802][ T36] audit: type=1400 audit(2000000778.052:150135): avc: denied { write } for pid=24802 comm="syz.2.8072" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 676.285679][T24806] audit: audit_backlog=65 > audit_backlog_limit=64 [ 676.494489][T24815] netlink: 'syz.1.8076': attribute type 16 has an invalid length. [ 676.502758][T24815] netlink: 64138 bytes leftover after parsing attributes in process `syz.1.8076'. [ 676.515776][T24815] __vm_enough_memory: pid: 24815, comm: syz.1.8076, bytes: 18014402804453376 not enough memory for the allocation [ 677.056446][T24859] overlayfs: failed to resolve './file1': -2 [ 677.090526][T14990] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 677.090536][T15732] Bluetooth: hci0: command 0x1003 tx timeout [ 677.169718][T24865] netlink: 'syz.5.8090': attribute type 4 has an invalid length. [ 677.180127][T24865] netlink: 'syz.5.8090': attribute type 4 has an invalid length. [ 677.188623][T24865] netlink: 'syz.5.8090': attribute type 4 has an invalid length. [ 677.199828][T24865] netlink: 'syz.5.8090': attribute type 4 has an invalid length. [ 677.209440][T24865] netlink: 'syz.5.8090': attribute type 4 has an invalid length. [ 677.217347][T24867] netlink: 'syz.5.8090': attribute type 4 has an invalid length. [ 677.297188][T24872] rust_binder: BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 677.409191][T24876] netlink: 5 bytes leftover after parsing attributes in process `syz.2.8094'. [ 677.419727][T24876] 1{X: renamed from 30{X (while UP) [ 677.426848][T24876] A link change request failed with some changes committed already. Interface 31{X may have been left with an inconsistent configuration, please check. [ 677.666712][T24885] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=24885 comm=syz.1.8097 [ 677.923408][T24901] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 678.058479][T24919] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 678.118713][T24921] rust_binder: Failed to allocate buffer. len:4096, is_oneway:false [ 678.161475][ T63] usb 3-1: new full-speed USB device number 86 using dummy_hcd [ 678.277432][T24929] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2049 sclass=netlink_route_socket pid=24929 comm=syz.5.8111 [ 678.324514][ T63] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 678.337301][ T63] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 678.351661][ T63] usb 3-1: New USB device found, idVendor=0925, idProduct=8866, bcdDevice= 0.00 [ 678.361053][ T63] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 678.362246][T24933] netlink: 'syz.5.8113': attribute type 4 has an invalid length. [ 678.373480][ T63] usb 3-1: config 0 descriptor?? [ 678.384789][T24933] netlink: 'syz.5.8113': attribute type 4 has an invalid length. [ 678.387373][T24901] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 678.467954][T24936] netlink: 24 bytes leftover after parsing attributes in process `syz.5.8114'. [ 678.808156][ T63] usbhid 3-1:0.0: can't add hid device: -32 [ 678.814650][ T63] usbhid 3-1:0.0: probe with driver usbhid failed with error -32 [ 678.966150][ T45] usb 3-1: USB disconnect, device number 86 [ 679.035895][T24959] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 679.057493][T24959] rust_binder: Error in use_page_slow: ESRCH [ 679.072288][T24959] rust_binder: use_range failure ESRCH [ 679.088138][T24959] rust_binder: Failed to allocate buffer. len:1160, is_oneway:false [ 679.107031][T24959] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 679.124668][T24962] netlink: 104 bytes leftover after parsing attributes in process `syz.1.8122'. [ 679.151730][T24959] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:1409 [ 679.550709][T24992] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8133'. [ 679.688993][T25006] /dev/md0: Can't lookup blockdev [ 679.796187][T25010] input: syz1 as /devices/virtual/input/input71 [ 680.042801][ T63] usb 1-1: new high-speed USB device number 125 using dummy_hcd [ 680.192767][ T63] usb 1-1: Using ep0 maxpacket: 32 [ 680.215264][ T63] usb 1-1: too many configurations: 144, using maximum allowed: 8 [ 680.242179][ T63] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 680.260474][ T63] usb 1-1: can't read configurations, error -61 [ 680.276891][T25033] UHID_CREATE from different security context by process 720 (syz.1.8145), this is not allowed. [ 680.331891][T25033] netlink: 'syz.1.8145': attribute type 1 has an invalid length. [ 680.402786][ T63] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 680.582772][ T63] usb 1-1: Using ep0 maxpacket: 32 [ 680.587314][T25056] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 680.589096][T25056] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1431 [ 680.593951][ T63] usb 1-1: too many configurations: 144, using maximum allowed: 8 [ 680.620710][ T63] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 680.629826][ T63] usb 1-1: can't read configurations, error -61 [ 680.639074][ T63] usb usb1-port1: attempt power cycle [ 680.992829][ T63] usb 1-1: new high-speed USB device number 127 using dummy_hcd [ 680.993548][ T36] kauditd_printk_skb: 1177 callbacks suppressed [ 680.993571][ T36] audit: type=1400 audit(2000000783.954:151311): avc: denied { ioctl } for pid=25066 comm="syz.2.8159" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 681.033466][ T36] audit: type=1400 audit(2000000783.994:151312): avc: denied { ioctl } for pid=25007 comm="syz.0.8139" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 681.058991][ T63] usb 1-1: Using ep0 maxpacket: 32 [ 681.059457][ T36] audit: type=1400 audit(2000000784.014:151313): avc: denied { ioctl } for pid=25007 comm="syz.0.8139" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 681.065642][ T63] usb 1-1: too many configurations: 144, using maximum allowed: 8 [ 681.089365][ T45] usb 3-1: new low-speed USB device number 87 using dummy_hcd [ 681.100146][ T36] audit: type=1400 audit(2000000784.024:151314): avc: denied { ioctl } for pid=25007 comm="syz.0.8139" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 681.130246][ T36] audit: type=1400 audit(2000000784.054:151315): avc: denied { ioctl } for pid=25007 comm="syz.0.8139" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 681.155504][ T36] audit: type=1400 audit(2000000784.064:151316): avc: denied { ioctl } for pid=25066 comm="syz.2.8159" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 681.181829][ T36] audit: type=1400 audit(2000000784.064:151317): avc: denied { ioctl } for pid=25007 comm="syz.0.8139" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 681.181915][ T63] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 681.214840][ T36] audit: type=1400 audit(2000000784.064:151318): avc: denied { ioctl } for pid=25066 comm="syz.2.8159" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 681.240093][ T63] usb 1-1: can't read configurations, error -61 [ 681.241896][ T36] audit: type=1400 audit(2000000784.064:151319): avc: denied { ioctl } for pid=25066 comm="syz.2.8159" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 681.271661][ T36] audit: type=1400 audit(2000000784.084:151320): avc: denied { ioctl } for pid=25007 comm="syz.0.8139" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 681.322812][ T45] usb 3-1: Invalid ep0 maxpacket: 64 [ 681.372810][ T63] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 681.382797][T25072] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8161'. [ 681.391885][T25072] tipc: Started in network mode [ 681.399431][T25072] tipc: Node identity 0000000000002d460000000000000001, cluster identity 4711 [ 681.408439][T25072] tipc: Enabling of bearer rejected, failed to enable media [ 681.417347][ T63] usb 1-1: Using ep0 maxpacket: 32 [ 681.424142][ T63] usb 1-1: too many configurations: 144, using maximum allowed: 8 [ 681.435661][ T63] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 681.444459][ T63] usb 1-1: can't read configurations, error -61 [ 681.451301][ T63] usb usb1-port1: unable to enumerate USB device [ 681.452806][ T45] usb 3-1: new low-speed USB device number 88 using dummy_hcd [ 681.520645][T25078] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=9565 sclass=netlink_route_socket pid=25078 comm=syz.1.8163 [ 681.622796][ T45] usb 3-1: Invalid ep0 maxpacket: 64 [ 681.632712][ T45] usb usb3-port1: attempt power cycle [ 681.982804][ T45] usb 3-1: new low-speed USB device number 89 using dummy_hcd [ 682.023527][ T45] usb 3-1: Invalid ep0 maxpacket: 64 [ 682.172789][ T45] usb 3-1: new low-speed USB device number 90 using dummy_hcd [ 682.223542][ T45] usb 3-1: Invalid ep0 maxpacket: 64 [ 682.235331][ T45] usb usb3-port1: unable to enumerate USB device [ 682.430117][T25126] 9pnet_fd: Insufficient options for proto=fd [ 682.634912][T25128] ------------[ cut here ]------------ [ 682.640450][T25128] WARNING: CPU: 0 PID: 25128 at mm/page_alloc.c:5228 __alloc_pages_noprof+0xe8/0x7b0 [ 682.650033][T25128] Modules linked in: [ 682.653999][T25128] CPU: 0 UID: 0 PID: 25128 Comm: syz.1.8179 Not tainted syzkaller #0 658fd523d4664e50339751640158cdc1077a64d7 [ 682.665717][T25128] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 682.675854][T25128] RIP: 0010:__alloc_pages_noprof+0xe8/0x7b0 [ 682.681813][T25128] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d 22 1f ee 05 00 0f 85 be 00 00 00 c6 05 15 1f ee 05 01 <0f> 0b 31 c0 e9 b0 00 00 00 83 fb 0a 0f 87 a5 00 00 00 44 8b 64 24 [ 682.701525][T25128] RSP: 0018:ffffc90001b9f580 EFLAGS: 00010246 [ 682.707676][T25128] RAX: 0000000000000000 RBX: 0000000000000015 RCX: 0000000000000000 [ 682.715739][T25128] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90001b9f638 [ 682.723780][T25128] RBP: ffffc90001b9f6c0 R08: ffffc90001b9f637 R09: 0000000000000000 [ 682.731791][T25128] R10: ffffc90001b9f620 R11: fffff52000373ec7 R12: ffffc90001b9f5c0 [ 682.739851][T25128] R13: dffffc0000000000 R14: 1ffff92000373eb4 R15: 0000000000000000 [ 682.747898][T25128] FS: 00007f46350dd6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 682.756908][T25128] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 682.763575][T25128] CR2: 000020000000f000 CR3: 000000011ce76000 CR4: 00000000003526b0 [ 682.771600][T25128] DR0: fffffffffffffffb DR1: 00000000000001f8 DR2: 0000000000000083 [ 682.780154][T25128] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 682.788213][T25128] Call Trace: [ 682.791524][T25128] [ 682.794524][T25128] ? vfs_write+0x3bd/0xf30 [ 682.798989][T25128] ? ksys_write+0x141/0x250 [ 682.803614][T25128] ? x64_sys_call+0x271c/0x2ee0 [ 682.808542][T25128] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 682.814365][T25128] ? hashtab_init+0xdb/0x1f0 [ 682.819010][T25128] ___kmalloc_large_node+0x81/0x220 [ 682.824293][T25128] ? hashtab_init+0xdb/0x1f0 [ 682.828931][T25128] __kmalloc_large_node_noprof+0x1e/0xe0 [ 682.834648][T25128] ? hashtab_init+0xdb/0x1f0 [ 682.839288][T25128] __kmalloc_noprof+0x26d/0x450 [ 682.844231][T25128] hashtab_init+0xdb/0x1f0 [ 682.848690][T25128] ? common_read+0x16d/0x480 [ 682.853371][T25128] symtab_init+0x44/0x70 [ 682.857670][T25128] common_read+0x1de/0x480 [ 682.862343][T25128] ? __cfi_common_read+0x10/0x10 [ 682.867397][T25128] ? hashtab_init+0x105/0x1f0 [ 682.872118][T25128] policydb_read+0xaa8/0x28c0 [ 682.876887][T25128] ? kasan_save_alloc_info+0x40/0x50 [ 682.882240][T25128] ? __cfi_policydb_read+0x10/0x10 [ 682.887449][T25128] ? security_load_policy+0x128/0x12f0 [ 682.893045][T25128] security_load_policy+0x162/0x12f0 [ 682.898376][T25128] ? irqentry_exit+0x4a/0x60 [ 682.903045][T25128] ? exc_page_fault+0x66/0xc0 [ 682.907757][T25128] ? asm_exc_page_fault+0x2b/0x30 [ 682.912853][T25128] ? __cfi_security_load_policy+0x10/0x10 [ 682.918630][T25128] ? rep_movs_alternative+0x4a/0xa0 [ 682.923975][T25128] sel_write_load+0x298/0x5e0 [ 682.928710][T25128] ? futex_wait+0x29a/0x7a0 [ 682.933292][T25128] ? __cfi_sel_write_load+0x10/0x10 [ 682.938627][T25128] ? __cfi_futex_wait+0x10/0x10 [ 682.943564][T25128] ? bpf_lsm_file_permission+0xd/0x20 [ 682.948991][T25128] ? __cfi_sel_write_load+0x10/0x10 [ 682.954280][T25128] vfs_write+0x3bd/0xf30 [ 682.958563][T25128] ? __cfi_vfs_write+0x10/0x10 [ 682.963410][T25128] ? __kasan_check_write+0x18/0x20 [ 682.968564][T25128] ? mutex_lock+0x92/0x1c0 [ 682.973065][T25128] ? __cfi_mutex_lock+0x10/0x10 [ 682.977980][T25128] ? __fget_files+0x2c5/0x340 [ 682.982701][T25128] ksys_write+0x141/0x250 [ 682.987128][T25128] ? xfd_validate_state+0x68/0x150 [ 682.992290][T25128] ? __cfi_ksys_write+0x10/0x10 [ 682.997213][T25128] ? __kasan_check_write+0x18/0x20 [ 683.002391][T25128] ? fpregs_restore_userregs+0x11d/0x260 [ 683.008133][T25128] __x64_sys_write+0x7f/0x90 [ 683.012825][T25128] x64_sys_call+0x271c/0x2ee0 [ 683.017567][T25128] do_syscall_64+0x58/0xf0 [ 683.022033][T25128] ? clear_bhb_loop+0x50/0xa0 [ 683.026804][T25128] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 683.032783][T25128] RIP: 0033:0x7f463418eec9 [ 683.037242][T25128] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 683.056990][T25128] RSP: 002b:00007f46350dd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 683.065486][T25128] RAX: ffffffffffffffda RBX: 00007f46343e5fa0 RCX: 00007f463418eec9 [ 683.073542][T25128] RDX: 000000000000fd50 RSI: 0000200000000000 RDI: 0000000000000003 [ 683.081646][T25128] RBP: 00007f4634211f91 R08: 0000000000000000 R09: 0000000000000000 [ 683.089712][T25128] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 683.097749][T25128] R13: 00007f46343e6038 R14: 00007f46343e5fa0 R15: 00007ffc56b076e8 [ 683.105819][T25128] [ 683.108876][T25128] ---[ end trace 0000000000000000 ]--- [ 683.118406][T25128] SELinux: failed to load policy