last executing test programs:

5m43.452571574s ago: executing program 0 (id=129):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x100, 0x0) (async)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x4, @mcast2={0xff, 0x3}}, 0x1c) (async)
setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000000340)=ANY=[], 0x8)
setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10)
sendto$inet6(r1, &(0x7f0000000140)="8469b66f", 0x20, 0x0, 0x0, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x8fe69000)
r2 = syz_open_dev$usbfs(0x0, 0x7, 0x2000)
ioctl$USBDEVFS_SETINTERFACE(r2, 0x80085504, &(0x7f0000000380)={0x7})
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4)
connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async)
setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000000c0), 0x4) (async, rerun: 64)
setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000340)=@gcm_256={{0x303}, '\x00', "ec094e071cc80f218d360356a936a7e3971a8c35c47e580400", "cf00", "fffffffffffffffd"}, 0x38) (async, rerun: 64)
r4 = socket$nl_audit(0x10, 0x3, 0x9)
ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000380)={'team_slave_0\x00', &(0x7f0000000000)=@ethtool_link_settings={0x4c, 0x3, 0xe, 0x5e, 0x6, 0xc, 0x3, 0xa, 0x1, 0x6, [0xfb1f, 0x7f, 0x77, 0x1, 0xfffffffd, 0x2c, 0x6, 0x1]}})
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040), 0x200000, 0x0) (async)
setsockopt$inet6_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000200)=0xffffffffffffffff, 0x4)
writev(r3, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1)

5m42.584666871s ago: executing program 0 (id=142):
add_key$fscrypt_v1(&(0x7f0000000380), &(0x7f0000000240)={'fscrypt:', @desc3}, &(0x7f0000001580)={0x0, "e5cf9087c0bc4eecd575619bf7fe717b09a75040d67944bdf74658aa573ec7ec5fd9ecb3bf2ad2cceb6d2f7879709ab2db2fcfa073f7ab9055774346282c82cc", 0x17}, 0x48, 0xfffffffffffffffb)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180)
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0)
mkdir(&(0x7f0000000040)='./file1\x00', 0x0)
chdir(&(0x7f00000003c0)='./bus\x00')
mkdir(&(0x7f0000000580)='./file0\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0)
mkdir(&(0x7f00000001c0)='./bus\x00', 0x14c)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]})

5m42.442947594s ago: executing program 0 (id=144):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000012300)=ANY=[@ANYBLOB="3400000011000100000100dffddbdf25070000f61600000008000000", @ANYRES32, @ANYBLOB="14001a8008000900ffffffff0800be"], 0x34}], 0x1, 0x0, 0x0, 0x4000}, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1})
mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000640)={0x4c, 0x0, &(0x7f0000000740)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000240)={@flat=@weak_binder={0x77622a85, 0x100}, @flat, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}, @acquire={0x40046305, 0x2}], 0x0, 0x0, 0x0})
r3 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd)
add_key$keyring(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, r3)
openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async)
socket$netlink(0x10, 0x3, 0x0) (async)
sendmsg$netlink(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000012300)=ANY=[@ANYBLOB="3400000011000100000100dffddbdf25070000f61600000008000000", @ANYRES32, @ANYBLOB="14001a8008000900ffffffff0800be"], 0x34}], 0x1, 0x0, 0x0, 0x4000}, 0x0) (async)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) (async)
mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async)
openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000640)={0x4c, 0x0, &(0x7f0000000740)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000240)={@flat=@weak_binder={0x77622a85, 0x100}, @flat, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}, @acquire={0x40046305, 0x2}], 0x0, 0x0, 0x0}) (async)
add_key$keyring(&(0x7f0000000100), &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) (async)
add_key$keyring(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, r3) (async)

5m42.285937127s ago: executing program 0 (id=145):
openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0)
r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, &(0x7f0000000180))
getgid()
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0)
mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) (async)
mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) (async)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]})
pidfd_send_signal(0xffffffffffffffff, 0x0, 0x0, 0x4)
chdir(&(0x7f00000001c0)='./bus\x00')
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_cpus\x00', 0x275a, 0x0)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000080)=0x80000)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000080)=[@request_death={0x400c630e, 0x2}], 0x0, 0x0, 0x0})

5m42.228919098s ago: executing program 0 (id=146):
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x20000)
splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x9, 0x0)
syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000680)={{0x12, 0x1, 0x110, 0x7, 0x1, 0x2, 0x40, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x10, 0x0, 0x80, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x45, "", {{{0x9, 0x5, 0x1, 0x2, 0x40, 0x3, 0x4, 0x9}}}}}]}}]}}, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0})
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @private0}, &(0x7f0000000080)=0x1c, 0x800)
connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e24, 0x2, @local, 0x6}, 0x1c)
socket$nl_audit(0x10, 0x3, 0x9)
r2 = memfd_secret(0x0)
mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0x13, r2, 0x8000000)
mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000002, 0x13, r2, 0x8000000)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xffffffffffffffe2, 0x0, &(0x7f0000001400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000480)={@flat=@binder={0x73622a85, 0x100, 0x3}, @fda={0x66646185, 0xa, 0x2, 0x7}, @fd}, &(0x7f00000001c0)={0x0, 0x4b, 0x38}}}], 0x0, 0x0, 0x0})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/timers\x00', 0x0, 0x0)

5m42.16075073s ago: executing program 0 (id=147):
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
getsockopt$sock_buf(r0, 0x1, 0x3b, 0x0, &(0x7f0000000480))
openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4c8e83, 0x0)
openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x75bc02, 0x0)
r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x8000, 0x0)
ioctl$BLKRRPART(r1, 0x125f, 0x0)

5m42.103105051s ago: executing program 32 (id=147):
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
getsockopt$sock_buf(r0, 0x1, 0x3b, 0x0, &(0x7f0000000480))
openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4c8e83, 0x0)
openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x75bc02, 0x0)
r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x8000, 0x0)
ioctl$BLKRRPART(r1, 0x125f, 0x0)

3m35.01694562s ago: executing program 2 (id=1572):
personality(0x5000002)
r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0)
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000001780)=ANY=[@ANYBLOB="0203000320020000ff0e00000000000002000900100000009d09000000000000030006000000000002000000e0000002000000000000000002000100000004d300000503010000c0030005003c00000002000000ac141400000000000000000005001a0020010000000000000000000000000000ff0200000000000000000000000000011d0000000102080000800000ee3fbec9e0cba133f73ad299ee34924bb6b5c04db2a97c180d06c141adabeaa25c5ee4137122f693be294184847f7d563c13823746e4251def213156c092a66441d2697b70d242dd373ce5466db1e3233022b28735c1f63b6f94cd9a3dc02ed595ab0f4920ba149f9e2b776a673cba6fd1b1a0b7afc324c7415f9f10bc0e1b9be3ecdd4ee2dafc8920be27da28fd485d760193bfd14753cfeda8980e9d7b5d309e7135f18873dec0e1aac30a5e0fb3e76837c966d2beb0a6ca532718688b10d1522993460d48e51400a4db815306c563cd51273f67fc2b5f354bd2f9b5399f98d22e303c2d7a73be0710637c0ba3ab300cff9eaaf1308e0993b337ca704b62a06332c76baf4146cc34343f935bdde85add31c6f41057628282e78bff38e1afe16c2de8da167421a725c57c3018248b7ddef4538a0486aaac0fac9a0d6f1128da0c93736f1f690a226c4576c07d139e011e88769db1963d7006505155656da5f0001f15cf7f98a3f19ac5dfa9a9f46abec62127968c754599bfb172a7c232f4036a42dd16b4e8be8269f62df816406b3168c4e731d572422201f89d4508222bb22a35326a3cc5249d2f0c30c949678a10c9a89e496fdde1b9d0d435806e9e7b87e1867922c6fa0edb4a1354039d6d24ee6208c43d657ef8c4037ac83d97b40e35514ad749bd7532becf06a9cb74e5fcca8eaf30563a3dffb41a9972a373f27c30184e1b0b2aec02af308904cebfa1f0e10a293353707fd5712dfd5eb6f71cea4603a2e7285c11dc4810897a1fff4698fb7c411a5655271a80e1d56fd43ee43cdd49ae6b4382a4e074f6f2f2054e42b865ae13f819a2be2c58cf0acb03c9e3988d41dc51566953ca34abd8ea4089f7b95ba5c06cc879fcb1b0f75c068c549397c61dab3599b9830903c20135f7263f893116ec7a24fada06ada39a4ded8abca5ac03d2405804184f7a5fe73f0af7ec465bd5dcbc682c33009331fca66e8a783c20bbd9f1be03847d80e5473e9cbd280d4d38813e29e5eac24f3be9241011b908076d6419af18620819822a55f03adf118437e50aa89111441f6768154747d1169a3cc3a1b8ca19fee05fdda3d1b226dae467e2b5eecada92cc0257a26c5ad073420a9d6f409b5694d616087eb2bcbd80b7982be14f2487711294e38330599fde6b29ad7e47d0c8e5219145517a78e91448dde7585d7310ad74282dbd6350b1e21c97757ea85be98a618d0f9d27e0b23e76be07d062aeccd54c1c36d8222139d925898e9b833c9ba3d676738c1fb0df1175ba70353a20633019af5c0ea4084f1a95c5895c998d04fd72f31a5aca0128bdc4357970f2ef428956cab03ca4789cdc467beaac3c00cf249b5910a55062f4370341e3707e34481d3c3157ee01cfb22c778f1697f311a46c2c4568e13a517ceb71ccc1722c195b850a111f705d1365913cb9694f476eb6ae732b97325faed2e2df43db0d1096abd3ceb5955e126f2eaebc6ae1057be9d8b6dddf575a40d97ebed64bcfdbd5bf941a9750de451566cbf3d1026f749fc4574641183daff715556a6d1a5a04b885cf7d00ba04e8c56df4192d97f8f3834975bfdd7d2cfc7d054192ed45cac9ef27305ab75eebc59543caf84218a62f2d748b14e5d69756d869ba345567a4e4f0aa561c85ace548ca03ecbd5a2325b3b8df00d8260ba2625ce7c0b4c8a9bea3ff57ba5dcc7cbe1d24ae9ab5ffa186d0d945b976342eb4f0c69c31f88207e7b22638b27f1cf75f9cfae3fabb54af777d29023d4cdf3d674f154158e34264093b92cd185210c792566bf7f729ee440d1a764569d5e4f1512a674959c1671876d27c7a6e4adf6fd205bdd7ebf29db8349a1195132cb816f3311b3a7d7be73da80aea65ab27f1c603676bf9e2869817a276f437c8ad9cc2a5ce80f578502bb70d1806b00877ada92e84f7c82bf0a731bc13ced283b0dddd5ed59bec47d881104ce6be5edc42c2359f99564d79839c8ab50b6445bb0670c0dd9d8253c482906df9f554b4e59da8c959c7af7748255e03e5ebb5b98f78adcafd60c1b418359a427c8227c88c740053c906b20ecadc4b3e2766fee8e21cebdc1ae6fdd6ec10730671e97fa51b06936a07d712ff75578210a36aeec1dc89f690847e4cdaf56f75c5e4b29d8d3256fc3c4c0c58645beea9ccc1a3c897cb8a452a215d5894b5bb5e68b4ff09b8cebfa0952ef5a20426a03c51c4b3d34b9f0aa3ef152268b10eee348129b3ce59b24f5e1005f501cd67f50bfdd59c1c8ed2d86d5aa83eb9e7e454525a89cf8f4fbdd2bfbc3303e1e686b40a94075486bc5e7ca345dc8d32c9aa0b34823ecca97aa65265723b7044c99a04436315c7d09614b9211990df72d50c4fce6b668acbf95f53574f06f3044e47958500e299baacfb27b5e67850dc05e1b540b8089e7085378f33b2b3c2ceb5cd45cd933600cc9c886a722d50470bf3a0b7221607168d2f439a7bd7a1b02ac8cf2f2819369e5d0aba01dc2ac0df41cc33cbbf26f5931445dd6135dcd94e8239974f939b789d919d6558629e9ea9f3181824976770c0fb83f598070447460bf249b45ce5388d45c32f03ee5585f492d4fda9a72404eaec85cbbb02038c0f06636c639dabfe52b50ca6918dc5601a365ab0aa591439686934e1e39fffb01435b010d3985f74ff14f925a1c310e69a4d3ba7edcc816783cff5063eec754b99651ebb48c3681c4f61bca75f6859a456abc2458142ec6e002d7cbe06802581fcd9555ba46671e25ac293a6fc16fc1d87e87c9e724c9218e849c223a9d1e36b6f1908f588e7fcccd671f435146d92874eae168d4f561a7af45ea8de4aa011c6a79484773c42d7226c5b4936b45b59752404ee4a609c220f8b5343a763ca36f2705689f191cfa511aa4da4be8b2b333c9a029a6f3292101e9f651e1266ab2ca551b7bdf56462bfcd6fa9dd9fe07421ea451df802bdbbceceb83360c9c36df52c97f3072b7fb94a8ef3acc80ec14b8682d9eafbd2e228825e9cdfe762a2cedad1b87f92485a771bb701ff35bf260dc15d08a8ea6c6f3b4d5f7eb8e3b8c536f106899f73dbe43f91343ace6fffaa2e0197b44b730cefcaed1ceba9140c05706e4fa52313b7507f18888b8f00542b6029633ae3bea9aeffef4072a97f6566b84900ff6d6f30a80754e79fa5a83fc6efad719e38c413290b26c9755117469b87a903cc18491ad1b26ce14a8a7362006430f1387ca0d446a8a861ed65bb9d8d03614c79724b84cf607ebbc9374f6a5d494286ce75383f314ad743822f8534f23ddef60b4fd0e03dc6c810ea3ced898493fc73b0455774187b6ad55b9fec781bb715d2140ded272bd7f16d2cc2ed61a6ed2ed46d6327d3eaa5afdea3388a2a449d25d40413824b667da120ef3a453fc5416c83c5d197b6e0c2e7dbb385f4cdc62a550768fbf29fc85474daa441e8e6a61abce6985d9c1d8308437c21c09a2a02aeba119e17b8d7aa9bc93fd1f750a69acbd08885ffd4bd1165b880f2c070e3f32b113d99ebf491420e74ef556bcf2129769ee44d3a155dfd2a6ed7b794ace72b3b3a46d6bcf30dd79228752a32f876aff52bffaf8e5dcb5cbd206c0fc64979e326e52ccb8ed8453ab88a0224800cb7b48a21e935f510bdd1627967058c5af93b41b5b1a0d76bc1262d16aeb5776599a184c52da521dd1f365740bc6e931b38299659a30835bc94b7ef9dd631a5d5a1d3742c39d603584dc44de77dc16f6a502bdcdf9e2af755b8a28fb7592c48f7155677dabfd79e82b4dd769b40850d4cabebf2e6be3a82c7fc19a09056849125d541e8159a2561feb05a97222c0e040bab549c4754d9a0881bd7cd973628eacf5b76883094fb9aea9aff2df9651fb95af274749d880817482f342c1dba80277f96f0b4881ae6845763cd8f6df2a8392494581b7c2783c115f99c8f5fa9a6269457152dd3ee914ac9e3d7c4af131f3f3efee61e44d123c245ae4a7445acfb0f1a74d90c8a2010893786442af9fcaca3e67270fd8b2056a426b9c52549180daecb20e8e8b253ea64ea94cc4cf68c00ccbe00214b889145ee3caed1a2388a47e1f51c9c5a88921fa909033d5f518a3bed4263a435c1a6ac218728ae4309b0b411dac79a6e63ae14633786037ad33a88b17ce953356de60ea77fc07ba686867d7396d13ee765970392f7df778376ebf67109408d57ba29a7128829874c044eeefb66b2998370b5b8007373c186ac3a6fb31413f99b5d35a77ee65017a04de89f64f91f34e1f7625a9fce29f11c07d04075f445c145bcf115d82320b8416a11349020cbaf140115851fde9802df0b806940519605d03f72064921747ea004810a70e5d9c9b7a6c9d0f880571303f5376c6bf20ea0eb4a230b051b7a94b81a4f687bc50fe90fe2d85b6c0224e333fc00adb995f75c222f890fde71c127f5c221bef8436df64d4b3720a3b9986bf20f4851905bd94282865320f7ef44bbc861750b48a4f7eec51ef69cbddf588a28aa0e3d0e0a16084f2004857f245db41a2888b1ed4b1e6e18621307ebc6b517bb62f51999abc067988a6eccc027aecf155aa791cb12dcb5ba91902dff604d766fc9c6be584c928f79229bac0db9160379dfd88266c86b8bd45b34d42a33c3c7b3e1d3f6eb10e4121a9f32e5219ce8c981738c61654a362ed6e0e25213897eb7da6d78163f3c7467f668dbb50e3bb5669916346a389cc81e35643b0cf0e321a17805233a64635a4d6740afe11927b48330be755eeb02e3c3280530a86369e80902abc2888c0f1d2a6637669a71659eb442dda2274210ab252f11c0d3d9c14986d708e260fdf7298c3a1e6efa6551040db09e0a576c0535e5cda297dd577e336fb4c50e19f1ba15f579e6749bc276a57dd341b7bd092ff2ffbba30a687014f1aaaaa6285570ee6c69f6a9a801449998585046a9d70fb5481aef2aaa17d6c4640e20a09594d42fb71176603db2b4270e90801f7dd79820e601f22836fee393bd90d7b4688aff4f1ca0f9ba69dc53eaae694e3a5f468dbc4fcc77b2a3c5dc01146c3f6d69fe6aa6d88ee80087f4db3c11cabc295c747df1d6f8d7ab20db2982fd3b13d485e87f4c95647b6a0bb9f241fbc1ef60a5883384973b45c99a4fb04219d08b01feea5331c4287f1a1a09cc83212a7414df53a858a35e015abc85780a687ec0c346e378d9157b64a2180af54d40e98a58125246d6c1e03204ef777abc650702e80a76497ba5202ff1ad9cf8d113ec89032d89de01a324d75242e09de75ad97ad4ee7152008c152e44b3e8da323be66dcc642198dee5b9b42eca4cbbdc048a6798983a32e8f8caa1424aa2061b7f2c6f96abdd39cb1d7d2f6cfcfa920cb2373b8e5d8ce1ae283621f6aeb5234147d7b9606655d51ebd34020cc155a3090169cc4453f8f24e24e756e67f63ec8bd029c6e6ff3411475b921f792d875428b3809382e7b5c00f814f1a72582d954086761bec57ebb0ead769bfb03e35ecb609afa3c35791991896b2db78aebceb980b9b44176263358a5f9a09626c2e924a3afc98ed2b1f901dbfb59a0731cac12e710195f52d7f7f41f84bdf9fae08ee16efb8efad9276b5a0242821e2e6088f2f4096c67747f6792c3ecd2560991106e1db16984c8cba99fc2c0a5b3decb4463b9b9db61cfc3182fd25bc26ef178caa23b812ee4f2c6219c26a1fd823282f9ebfeab52972ef043f67cec56c3820a1213a8a34f17eb09d984fc09664a407bf71378a8578f24b66bcd4ade3d92c5f1ec915ecf27de1b5d6444287b4deab0e05ee3b6151b001001400030000000d00180009065c"], 0x1100}, 0x1, 0x7}, 0x0)
ioctl$KVM_SET_LAPIC(r0, 0x4400ae8f, &(0x7f0000000540)={"135e3a41be2fc1846c370844755edd4d74930172053c49257874a8ce1b0bc1b70f755daf5c80a371004e69094640caacf20b767c3795222574378450b0567d365addae3e9bb4969f96ed24f77f6d0e9df1591c1b08330c218bdcf89e6b3bb581fd1967ffc8e684519261b4088a3c99899401d9bea9022fdfab6c809bca717f198eb13aecad8916fd07f2ba2100bf8e4ff0dcd1b935ecc0a7d5b884063d8b0af73564c1d8ad177e1e54bdf91afb44a766413ecfa33e97b4d66cec1ff3798842902a92f4bd32253c539455a4d7f54ee9882d7f3412e0205f4744db17c71e0abf5e04b9c1a8eb503270f59901c28232b4de438460c813b6ab652f3f56aceda935cb14893338b56dc22089ddf819f71ee77cf14e11e33bde5d05854cb4ee543fab1d2b54bfff87a05c540b9b4891025cb9526242210d6d94cce5d3ec7c150ba2084a401abd6f69b84084021efaee4311e14cbe92c1b08ce4f4d961c92459ad300f8f294b27b8f96db2d09cd67593f0c5201e7e97c59147b005ae5db6db7ad32a1fd6e2ae49ef0119fffb2885687379535c824deae4717ccd163ccbd1e96901fa29695791a06861c8986aea5590db3af04a5d15d0ae3cbd618e99cee00af2ee8820179f6f64150db2f128a641259a07979860d8c60369a6bf547418f28fc3835da0f82eeb25a9a1f06dd418048998ac44d9126634515e0003eb63d71dba95b3eab3506624e56d8d71fc5d216bbbf64a5c2306a26c4972dc9416090bf0bf20db67d35d1f91ed26f6c15f3cbf119328a3429b0910473d155ef3366d48e1a6241a06ef077d0ca0388af2a1b8b9edfe042ad12dd3f334cbf32b88056b9cceefc767d4a2f4aaf8d47fdf4d686011690d99b78b7e83222bbe2cf443922b4445a4919fb17d2f93dc472112eb2105fcc6bf22ba9dd611e2582b8185233e7333add618c9f789b660fc298025136cac2aefc969d710971bc273ada99b6eea2346e2f3fc16f07147767dd0762341b220fb82e8942f8711b518782e0e183d919d9527dcef0b86b0261112b2b1f2bcbc5b66d2148f8211ac91d5ffa45b966197438c9d0bc623b63b0e77270cff757e224020d138b5da5b51f48e36c724054248684a415f357e8dec4e99962a7c9818e7ab5eb0c8b56ec4f000dd54a4ce475508a318d7d8b23362a1a0c2d1ef296590632c0749a42957cfe5328cded4b3ee3557d1f70f9aecae609c415c266d8160eea88f4994e8e6e54e519343bcdb0f5d3c52eeadc55762d863a8aad8e12b46cd51979ec68cd6a7ed5803df72b5e9b5b6ded1f5f278dccac4c3e7162ca0c8943ac6a841922d9b1a2aaa43474822acb6641aecce754e49769ae6a0c167ea2ca6164d3e87fabc76e4c1360ef0df3c0e182628ef0fd6d6fcbcbf4e5ef46362682f271738ba23fd9a56426709fe11f6842f7f08f8872d503c168aac7b03"})
write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000a00)={0x30, 0x5, 0x0, {0x0, 0x5, 0x1cd, 0xfffffffe}}, 0x30)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="ffffffff0000000000000000000000000200ffff0800010001000026"], 0x1c}}, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x20000091}, 0x240000d0)
uname(&(0x7f0000000140)=""/62)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000006a80), 0x1, 0x0)
write$vga_arbiter(r4, &(0x7f0000000100)=ANY=[@ANYBLOB='unlock i+'], 0xe)
uname(&(0x7f0000000000)=""/244)
r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1800, 0x0)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x62c581, 0x0)
sendmsg$key(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="021709082d0000002bbd7000ffdbdf25010015004e200000010014000700000008000800b0010000361eb69f2ee022538293db21200489be8a44053706013cb2e04d26516eea613bb2a9f9202e4401e07ce610ca4d3fdde02cfe149b200a000002000b0003000000030000000000000002001000000004d4000004d30000000002001000000004d2000004d400000000030006003240000002004e220a010100000000000000000007001900000000000a004e2100008000fc0000000000000000000000000000000101000002004e227f00000100000000000000000000000011001800070a7a00131d101d489b7075e88c2f38c45e3a1eab67520ea5bda6748e04bfdf806db1f1addd5f0f4c74d1c0ad80e525cf52072f989c57179b3167272094f167809b88e0600cc55d45b2bc3c7ca09d6f79d0d758c03ea3dea847eb67e227c170b576a39f9e15128681deb98b4674b4ed5c5df21be9555e6b9611f3d50bdc8804924e2aaa5d167d85000000000000"], 0x168}}, 0x40804)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="180000001a0001002abd70000000000081ff80"], 0x78}], 0x1, 0x0, 0x0, 0x20400}, 0x0)
r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000005c00), 0x0, 0x0)
ioctl$TIOCGSERIAL(r8, 0x541e, 0x0)
r9 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
r10 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000940), 0x2000, 0x0)
fsetxattr$security_evm(r2, &(0x7f0000000980), &(0x7f00000009c0)=@sha1={0x1, "51df2564c9600418f0202bc4263dfa72f064f34c"}, 0x15, 0x2)
ioctl$TIOCEXCL(r10, 0x540c)
write$selinux_access(r0, &(0x7f0000000280)=ANY=[@ANYRESOCT=r5], 0x56)
ioctl$KVM_GET_STATS_FD_vm(r9, 0xaece)
close_range(r5, 0xffffffffffffffff, 0x0)
mprotect(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0)

3m34.917368931s ago: executing program 2 (id=1575):
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0)
write$UHID_INPUT(r0, &(0x7f0000010140)={0x8, {"7f9654d636ab18b7938a2804505c72e9994ca22404fc203334cc21ed3d6a776fd12d13f9602b2980f983c31a5d1e431db778099ce3af3fb20e1ee1f4fdb77cbb36154982a93c19825d6fd273ab1eb5bcd47adad50de8a6791486e482e29ecc94284921f33b941cfc1000c9781d9a828c5ec7a2c77b4e624a5aa0e9e39782bad733eda81ba47e1c6116e4170e6587dd6210a57abe91f1f80c4e31139d8b73fe35ac1f99ea82dd6aa9c9aa67de88ae3e141020e1a876bbc449d2d843aa7e6d90b948b7e28770e6ac71010c63f17e90fd20806a9f8d9f418ee3af74aac64b04a27c4f5e3626ca2da546c79d24acadd11e8d272a22fc54078fd5e64475993668980a9f95aff964ded28f79c862e674356af492b8377a759d8ccf1accb9a18ef7ad16f438dde69cd020d71552b0810688c882a26a22b23f4b35471b08b379193db1cd7934a4049ff1b00d9795cda6e73951641d5e2365c24facd5afd09ed1d096d758b4fef66fe1aa22395d67b7e1db623d4a60a7dc93893d6c4a91df79535a855868c5dc0033d5c428cd25b85c5deb6e81068553bc84cead4d1eba8aa57e2b354a6899e44acbd3834491219b3e231cd55d82f161774a689efe197cc193ac0124c67738a0a1d5f16a6768c2c2ba7386c8c95ca08c55117f344f5a2bca0d09e79ea3fc49491f2c7adc513c2779c1bf62b1a8643d23e9e8b2ae41d4a59f1b82b82e092b36eb851b8456da871b4057aec325a9d4cccafde61f2abc85e3cabeabb856f6ffbfe23d69219ec8fae6beb54abe7870dbae823d49806a967a1c7f252999804f106745f20490bb3347b59321dc69765567abcbd89de04d89622170005df5871ed0fb72345a11da074060d7d4ee2e437f71a45723fb6b02de56067e54f54c52d10f7874a13cbfb3bd65ce54f9d6719ea210e0cf79e4e2157736ec07ac5915682ab81bced665c1e72fab8d8cfe509de0f21fe374b957b379fd5918061e21c2e96985cc1354b2de859b0f1a463ab04683b1253eda671c2353b5c208aca652f5419ffc4949a7fa909b95653f42d97390c400b4a1c308b11e73e9a06d3b164d3361e75584d70e6bc61d570a7e0c7da330f643194c1893fcd6489fac605eead61b53dff18caf526ecccc9bbd9146bc3c3bb67677695e6fddaab081786e9084014e60f5c03ae5a9087726b05e17402cd2fbb80d773b8a41470b1f901a8c2b2d57450181f4fc5bc53c7cb3dc032b84567492607cb08832eca9f79da9210d197863e5db5a74a9823dc0cc8bd9f3a9b6ff5a7d15d4747a9b26e088f4fad96d81cd1214226b1c4585d418d593220fcbb9ad949266cc48163e3498b46ebcdf7b2b5ecfe67539a61ed9e39b02d5b35ac0d0e7fa830034ca2da8a7ddf04bcf2cee939994369feb77023e0e3de04b21db7a640a92c17748245005cd75a7deba4ff0e4c104a9db2d9a98ec8edb3562050a3bac5f322290e3d8b6fb21770ac436d4cb12b97fc8f76d7bb9eeed85663eb0626f1ad1719ee4b07f7de2c1d1a31c27c6879f4fa3dbdfb2bfc0898beabafbeca9f13050e6b2f6c432e423cd5cb6b8fa56fe32c3e50104e44462c0a5c69de6a7ac5ae3d9f07ceed64dbffa42e4663838bfcde92f0fcb895f3b93c59b0e48c09890dfc36436db56b708f6e7cbbd2a6305f573cee099dbcd263cb96d9fb69cbc3cb06d8f5e3789698a17e71d22b4665ff5447fcc17a31bb136c8bb4b984573bcaf1cb650198c1266e6ddfd42d44f9de02cb9d915c5334c550fac3fcee56790aeb09d81e7690a32d8b0cc477b23f15257820de227be1ffaec2f63f3266b8f5dd78947dcee355fe59bfb100e5244425532bb1d115acd211b8c16b0ec0aae00fca5d4511a05c3ff027a1cac56210a10d81c01b90e156cc7b33de0fac825dc516d398166096013e068db935483c93ba95da39b5ae4087d84479a4c4809f28f93790dc279637bd6f3dc441d315cf6bd7b0e3d92070a45baf4445ce063fd12690eb002f5ca068a256bc54100c99a02a346beca39072163c4b297d117f1ed9fef42e3dbc11d36a0a0db52e84461c6fbb4aad62cd6c8dc9ae6a3390a5e8773ac599e67436220c8d541a9039762bffaa7f490e31dddbc362fb4ff686cda905f3b02a1db76d4d570d970434921ca8a4765af6d5c8b881e1f4ffa7e2d9ef5f5511b94f88474674ec790bb5186c73446a227bf1ffd19b605733abd1bd41e421aeaf2ed4617088c7ceef85451225056435993e89e4bccd2c2e4b39af99feef11fea645eeb5cf9f77b1e19a72d3efb613100969b84302789714bca65bcbc96762b4012a5700c62aed706433b9f142b7302442b6a9958b0e28e8b1cfa9eeb4ac0d71f497b23babf9f0221dcb658d9f4db5d45bee30d2ad7c97d6a562e014a7701c15325ec5d42ab732b37714a77a95c03fb15bbfba6fade32bf50f985a1df362ca7216cc152907dd931acb58a63920f581e82b590c0d6a0033009f8e50c3263d3f58596b63d507cadbc809a6690561f74d0772bf92d04e06c47a350724b106f5e83f7e71c4b2a983bf5ad7d8684e7b8b5dc1273d0fa5879b8e61bde33d602bc8ff0913b6d32dcac366d568dc7cf82bbfc405cbe418a2644c26592b32ca1a632fc95123efb784cfb6953a94ebeccd24fba389a0e56b043df07d9a2dd38a1196e5e55576b25f85cb96f6560802a4a58b7a6857e8454faa2c880bf32d464562b2bdc5f0df22b663f2c01fc944f1cfd1908f617f8295a5440bb79ae178ea46a95baeea48322105146ac3ed2de7d3796ddddcc848a8ecf4a00dd055733b4f59211f5a40deea44e74b3bc57953b26ed61e6fd67889edfe8d0902385e37666aacec072735630ecc441c3cc6b09bb2f63aa4e332c6df728dc74078a83ce20454dfd616d116270666ddc09c5fea2e8442bc43455d0257fac92f3780061178f9420bf8e463f29896c12383dbb9a81bc5c87376e647c8a9786cb514fb9696d9c0a8d303c5c4b5b7c5f601c01fa19323e02f675c371bc44fbc1ac5704d41a89a2a4ccec6ac8440c532f07da25aa2dce6a5d2ebe694eb4017d178b221213bfe2a01d9cfe689bd190776bca6c032f446eb8862587a7826e35f3f691763212eee6af2e49bbeb0a27e07c5714b74e373798c7bebce265f7ebef3a1ea64078cf1e8a9d433af32c53090c972ffedbadafb50b9a6e540abd84f8e938583ea725954be3b236c5d8aca7d486d21902a2902f25a7c02dbe83c39bd0b81513f9ef198c49d560e930ae224ff47f92e4851e1f7ab5bb406abcf6596569261e6b0c67bb3b854e9c6de60bfb60fcf29241ff237151310ecd19f8b2cfe764c1df1a2de9d840eca47aa169ba9a415901204ec31ccdfd76e908029ae34fb12dc286758c64fd6d42bc82b14e07e421f4b42b180cd6ef40cac8062928b4a420a4577f24295f54de9048ac9d34307bf93e463cea4967cf4880166f68ed1eb965db2e4fb9f5f0b1c695d621e427ccb9a3188073ee6fde729c6698346efa1c0ba643c1efd20858965511da750060d551c44c435a5f1603fae7357e0bc78e92aad3d88790ec2aa1a42d6fe7e0ffc57f3599e406db63be7dd32692df32ce33dee0a2becdb02d6e435e09de3d356497543db23f53da25643f9c585e275297800d8beed47f0e622f86fc25d2e87036fdceebfe7257cb6de0c02412d1c0758acfcd0862e99ad17a118f46f635a87477e8b825423d94ada35bf0b5444aa7d3de4bb7eec7ae5129fcc2cba651cc972f5500fc5161149d29f452962afb102a01ae76825cb4477460be0b85d75058595c27e9b7fae3492ec3925c671bee5f4ca534d5a294f783d6cc073c992139b61d21fd98297b04c0578dafd5f7ebcaf8d4d9185aea3d76e813421f4573b38c25093c015a65e44fb297f0f6ac2d02c4237b37a3bfca2406c5c95ae5812816bacad59ba7c6f72d7c644ff25b592ed1e89b276e05866c01a4ced7fc6dd9f190c20d420d7c8a1fe908833a24c5e5bd7a95a2a6fbf147fc4b29a179718166dd0fbae2fc6b8c8aac6194fa6baf0d3edc36b2316c56c441ba53e3e7aaaf0a1405566ff584f73a637b74dde9bcb4d41da2be6c9df5d533fbac54f5fb52a8a793757cfe19aa90048c6d07e3474136ae1be2455b0d0d02eb4b5961ba883209355c0dd2af4aad98e7b971e358a7d9b55fe17cd6095f257355d9b99e5ea52848f17b35a80792d9ed0fef6fe3eef9a324902409969823be20bbe0e8dba9c747cd1a14d3642d877b86271f3f0c322a142c4ff635b37d542c3265b5fe8589a732bb1a55010b930dd0196cd43ac3634c01b4a44c517197d03a3d89c67f5c09aab409e84c0af466bfbd0c96d240101a2542c66b4b4b8ef65b41b0079995c52cc9720d2c1d7c128c6f17a65cc798c1986cfbd8888460c54438edc4f91f3580391c8b57d9aee209a59a116c1c44775437e9c30e6d87e82ce84e28532b19441e32ab9aea22177bac9daad25a6c88395e9348d6780de630cddb266c411011175bdb6255a36535180818447d43ffba3758d311539fe9f6811fa470bf3767b4c2d4cdf37854c7ee28730bb1d39d5c0dfffcdbf353cca3e13079f3ae66b839c7dd36914022a0e75bca5b622f521420b73249ef47f03c1fb03ecf7557882afcaa7cf454a68ad237d4ce860bd6b1531c1cafe2cfb76bc4188271ef6bdfb304ee0e6932463a1909f03d6e8a27b5f137d6b342841d613863dfdf37d5ec3a98d667810fb6f82d67620bdefed8b3ff98420a6c7ee577c3ba68b95a20403608a7ba6526ec9e8662c6e15ab09b1a9019d4958af04cb2e4890ee6b1077fcaa5cc0817f388461b230fe631e75f18ab392a5ca5de4a024ca16dd05fcfdf92114e43a5c4a169d462ff0dba57deeaf5eaafd892f8ccbd72ac56471162e1416bca39859b4184ba0d1b3f7ec05db4ef4cf0142867fa9be328a0be8aa74c716aad9411008607980861f4f72e9bfa60195e2f939d3f6a44a6cec07dd376d1bccaa126686f313d5f7918ecd1215026982c82ed1922ef70e36e8ed59b2d5ceab3b4aad7e53049062dd5ba0e87f7005c3f4d2b788245cdc2f35ef2572bea5ea92dfad406ade6d5ad18be8eeb4c652e5277b244645c68c0c0f5a68d42e00d59b75941917b2cdf31fdf809f2078ca97fd5beba65b34e0621138ea0e94feb87166b2dac2232ebca575e5c0a4d565d9992f733bbfbe68a63d99ee93398604065d5517c33ed0e067bdb643e73102f16137afd7d4bf21e8065ea028c392a6dcefbe642dc3fb03a239d9c8b17023eacc8e19fea11c34a10644af1b786fc0f4504038c2ee59c1b353f3d7b9313df025b4b5874ca63ec164a3fe35bf390d266f53dcda6a8e190e63a56ffdf4f7c5c02aa22d376db06d4d2b96be5b331f897d1ecfd25c13a1c194c265dd95a5724a6435bc8138224d9db28b689b9cea5132cd19601dbc4a43e70c71e27e8fd0689d09484974e8a4605f8553735fffaf5654a087e323ca14e02b681b9bbe592bd6b719ae2e86bdf918b27c79d52dd334d1aa7ebc1bff76e97572faad092010a1022f7d33089049107a89c364ae7dd022d119e8f6ab795fd71d76a90e8202339401ff9e9918ea8c8e12f7b0ba10d9ebde5d1bc5988f2d07b34579d8c282628204f2978d8b0cf95dc41f3775a4053f833267c64b42336d7c850f2918ef0dd6d62e43fcc173254eb34748efd4754609ce25ade162ba3c91bb844aaf6fd648ee5a8fc5c64346603f8258592d67b9613e8f7ac0def0958f13436581d729e0b3e062738eb06b2116abe837529690a614fc5d3f53b4d4602e57060", 0x1000}}, 0x1006)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0)
cachestat(r0, 0x0, &(0x7f00000000c0), 0x0)

3m34.828863224s ago: executing program 2 (id=1577):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = dup(r1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sysvipc/shm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r2, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000080)='./file0\x00', 0x36e1, 0x85)
ioctl$KVM_CREATE_VCPU(r5, 0x40047705, 0x2)

3m34.694230436s ago: executing program 2 (id=1581):
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00')
socket$netlink(0x10, 0x3, 0x0) (async)
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0)
mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) (async)
mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]})
chdir(&(0x7f00000001c0)='./bus\x00')
unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200)
stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) (async)
stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0))
getsockopt$netlink(r1, 0x10e, 0xa, 0x0, &(0x7f0000000180))
mount(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000080)='proc\x00', 0x189, 0x0) (async)
mount(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000080)='proc\x00', 0x189, 0x0)
r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r1)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_SET_CPUID2(r5, 0x4008ae90, &(0x7f0000000300)={0x1, 0x0, [{0xc0000000, 0x0, 0x4, 0x7, 0xd, 0xfffffff9, 0xa4}]}) (async)
ioctl$KVM_SET_CPUID2(r5, 0x4008ae90, &(0x7f0000000300)={0x1, 0x0, [{0xc0000000, 0x0, 0x4, 0x7, 0xd, 0xfffffff9, 0xa4}]})
r6 = socket$inet6(0xa, 0x80000, 0x9)
sendto$inet6(r6, &(0x7f0000000340)="5ca5f7b95c3484e750aec6d34b547d670ad4f152659cfeb9afa014f460970b1b8eebe49860ff74291d58cd2514b9e2dd2110d0ef7c13114d5e611f7e2c423a72b575c609b338f91de653ce367b0ba43a6109fa14158a13c7b90864abc8ecbaef40eab4aaead535bb4567bdf980408613019acd82d2f5236f7c4a8b77313188cae1c2544ceb8890d0fedc151baf", 0x8d, 0x80, 0x0, 0x0)
sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000540)={0x70, r2, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [{@pci={{0x8}, {0x11}}, {0xd}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x70}, 0x1, 0x0, 0x0, 0x20004000}, 0x44850)
prctl$PR_SET_THP_DISABLE(0x29, 0x0)
read$FUSE(r0, &(0x7f00000005c0)={0x2020}, 0x2020) (async)
read$FUSE(r0, &(0x7f00000005c0)={0x2020}, 0x2020)
socket$packet(0x11, 0x3, 0x300) (async)
r7 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r7, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'bridge0\x00', <r8=>0x0})
sendto$packet(r7, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r8, 0x1, 0x0, 0x6, @multicast}, 0x14)

3m34.315733093s ago: executing program 2 (id=1601):
openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x8c83, 0x0)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000d00)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x1, @local, 0xa}, 0x1c, 0x0}}], 0x1, 0x20084800)
r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x141103, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000340)={[{0x122e, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0xff, 0x1f}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe7000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000200)={[0x6, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x4002004c4, 0x1006, 0x45c5, 0xc597, 0x7, 0x6, 0xffffffffffffffff, 0x8000, 0x80000003fffffe, 0xc], 0x80a0000, 0x2010d3})
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000f478ef8"])
ioctl$KVM_RUN(r5, 0xae80, 0x0)

3m34.132944807s ago: executing program 2 (id=1608):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfee, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x40000000000000, 0xe}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x800000000000001, 0x1d}}, &(0x7f0000000180)={0x0, 0x28, 0x40}}, 0x400}], 0x52, 0x0, &(0x7f0000000300)="6cc2517326f0182dfaea8b9b0efefe72ca2b3f10c526bb82d4a3786efb2df4fda2a1e2888f71a664cc5a261719fe4cead4d24dcc14edceace088490d882b563ef630b62d95fb3e1b01b472ec8da1d1df52fc"})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/cpuinfo\x00', 0x0, 0x0)
socket(0x26, 0x2, 0x3)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$ETHTOOL_MSG_EEE_SET(r2, &(0x7f00000003c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000380)={&(0x7f0000000540)=ANY=[@ANYBLOB="44010000", @ANYRES16=r1, @ANYBLOB="200025bd7000fddbdf251800000005000600010000000500060001000000200102802b000500c64e334bbc2274ffd610af5b653d7d1df0703d1d201fb30662a8a278679508914fc3a902d2adc1d65956f8e389001800038014000180060002002c00000008000100080000007900050044ac72004e28bef54ceb1ef58538a34308fa0af68f744319f2c753770be4b9d245562521fceecce666a0b6bf86632cc8ea4c45c51f925cfed907424c1022e06b4e0ed6f98d835c0e82d46d3d5c2b6e168b8bc1cb61db097b895c0000005c000380200001800b0002007b407d295d2d00000400030005000200000000000400030038000180170002002e2f62696e64657266732f62696e646572310000080001004408000007000200265b0000050002000000000004000300"], 0x144}, 0x1, 0x0, 0x0, 0x804}, 0x4008810)

3m34.110200527s ago: executing program 33 (id=1608):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfee, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x40000000000000, 0xe}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x800000000000001, 0x1d}}, &(0x7f0000000180)={0x0, 0x28, 0x40}}, 0x400}], 0x52, 0x0, &(0x7f0000000300)="6cc2517326f0182dfaea8b9b0efefe72ca2b3f10c526bb82d4a3786efb2df4fda2a1e2888f71a664cc5a261719fe4cead4d24dcc14edceace088490d882b563ef630b62d95fb3e1b01b472ec8da1d1df52fc"})
openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/cpuinfo\x00', 0x0, 0x0)
socket(0x26, 0x2, 0x3)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$ETHTOOL_MSG_EEE_SET(r2, &(0x7f00000003c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000380)={&(0x7f0000000540)=ANY=[@ANYBLOB="44010000", @ANYRES16=r1, @ANYBLOB="200025bd7000fddbdf251800000005000600010000000500060001000000200102802b000500c64e334bbc2274ffd610af5b653d7d1df0703d1d201fb30662a8a278679508914fc3a902d2adc1d65956f8e389001800038014000180060002002c00000008000100080000007900050044ac72004e28bef54ceb1ef58538a34308fa0af68f744319f2c753770be4b9d245562521fceecce666a0b6bf86632cc8ea4c45c51f925cfed907424c1022e06b4e0ed6f98d835c0e82d46d3d5c2b6e168b8bc1cb61db097b895c0000005c000380200001800b0002007b407d295d2d00000400030005000200000000000400030038000180170002002e2f62696e64657266732f62696e646572310000080001004408000007000200265b0000050002000000000004000300"], 0x144}, 0x1, 0x0, 0x0, 0x804}, 0x4008810)

1m52.15041767s ago: executing program 4 (id=3548):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
pipe(&(0x7f0000000300))
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={0x2, 0x3, 0x0, 0x2, 0xe, 0x0, 0x0, 0x0, [@sadb_key={0x2, 0x8, 0x8, 0x0, "fd"}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x8, @multicast1}}, @sadb_spirange={0x2, 0x10, 0x4d3, 0x4d5}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @local}}]}, 0x70}, 0x1, 0x7}, 0x0)
setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2, &(0x7f00000001c0)=0x7ff, 0x4)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000180)={0x0, 0x0})
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000300), r2)
sendmsg$IEEE802154_LIST_PHY(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r3, 0x1, 0x70bd2b, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x40)
sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4004c00}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, r3, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000082}, 0x20004000)
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='vfat\x00', 0x808081, 0x0)

1m52.110263251s ago: executing program 4 (id=3549):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x7c, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x7c, 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0) (async)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000001c0)={{0x2000, 0xeeee0000, 0x8, 0x9, 0xfb, 0xe2, 0x40, 0x7, 0x0, 0x2e, 0x19, 0x7}, {0x5000, 0xeeee6001, 0x3, 0x0, 0x40, 0x5, 0x7d, 0x6, 0x5, 0x3, 0x3}, {0xeeef0000, 0xdddd0000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x9, 0x1, 0xa7, 0x5, 0x81}, {0x6000, 0x100000, 0xa, 0x6, 0x4, 0x42, 0xd, 0xff, 0x8, 0x7, 0xe}, {0xeeee0000, 0xd000, 0xb, 0x3, 0x15, 0x7, 0xab, 0x7f, 0x7, 0x83, 0xf7, 0x83}, {0x1000, 0x80a0000, 0xc, 0xa0, 0xb1, 0x8, 0x1, 0xa0, 0x80, 0xf, 0x1, 0x7}, {0x3000, 0x8000000, 0x4, 0x5, 0x7, 0x5, 0x7, 0x3, 0x66, 0x83, 0xff, 0x70}, {0x100000, 0x1000, 0xe, 0x5, 0xf, 0x7, 0x1, 0x34, 0x2, 0xc, 0xb0, 0x9}, {0xf000, 0x30}, {0x10000, 0x7}, 0x80000031, 0x0, 0x8000000, 0x2024, 0x3, 0x0, 0x5000, [0x6800000000000000, 0x4, 0x5e, 0xff]})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2200, 0x0) (async)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2200, 0x0)
ioctl$KVM_GET_EMULATED_CPUID(r4, 0xc008ae09, &(0x7f0000000380)={0x4, 0x0, [{0x1, 0x80000000, 0x3, 0x11, 0xffffffff, 0x6, 0x9}, {0x40000000, 0x4, 0x6, 0x6, 0x53a, 0x7f, 0x157}, {0x0, 0xfffffffd, 0x1, 0x0, 0x0, 0x9, 0xffff}, {0x80000001, 0x5, 0x5, 0x6, 0x8, 0x400, 0xdd61}]})
close_range(r0, 0xffffffffffffffff, 0x0)

1m52.109756041s ago: executing program 4 (id=3550):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder1\x00', 0x1002, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc0040, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r4 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000000)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
r5 = add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000000c0)={'fscrypt:', @desc4}, &(0x7f0000000100)={0x0, "7a78a5cf4cb6d9fd24675318fd663cd8c8263dc1c62ba35cb9af646ae1d6f6bcc4da4effa514e97ae52807099349a4b8072fa60a653761af288c5c2f0a63cb08", 0x14}, 0x48, r4)
keyctl$link(0x8, r4, r5)
close(r3)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local})
write$cgroup_devices(r2, &(0x7f0000000840)=ANY=[@ANYBLOB="1e0308004d6b71ef288563"], 0xffdd)
r7 = openat$binfmt_format(0xffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0)
write$binfmt_format(r7, &(0x7f0000000000)='0\x00', 0x1)
close_range(r0, 0xffffffffffffffff, 0x0)
mknod$loop(&(0x7f00000001c0)='./file0\x00', 0x2, 0x0)
r8 = accept4$unix(r6, 0x0, &(0x7f0000000200), 0x0)
close(r8)

1m52.109416651s ago: executing program 4 (id=3551):
r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0))
ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece)
r1 = socket$nl_sock_diag(0x10, 0x3, 0x4)
ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000000c0)={'veth1\x00', &(0x7f0000000080)=@ethtool_wolinfo={0x1, 0xb, 0xe0, "51756fa0d073"}})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x90000, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000000)={'geneve1\x00', @random="01000094a500"})
setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4)
r3 = socket$inet6_udplite(0xa, 0x2, 0x88)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', <r4=>0x0})
setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, &(0x7f0000000180)=0x800, 0x4)
setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f0000000300)=0x1, 0x4)
bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x0, r4}, 0x10)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@private0, @in=@remote, 0x4e23, 0x0, 0x4e21, 0x7f, 0xa, 0x40, 0x90, 0x21, r4, 0xffffffffffffffff}, {0x3ff, 0x7, 0x1, 0x3, 0x0, 0x3, 0x0, 0x1}, {0x1, 0x8, 0x5, 0x2}, 0x5cf88405, 0x6e6bbf, 0x0, 0x1, 0x0, 0x1}, {{@in6=@mcast2, 0x4d4, 0xff}, 0xa, @in=@rand_addr=0x64010101, 0x3504, 0xe0058ad06b533581, 0x0, 0x2, 0x80000001, 0x3, 0x8}}, 0xe8)
ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffff1)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x51)
ioctl$FS_IOC_FSSETXATTR(r5, 0x401c5820, &(0x7f0000000080)={0x8})
read$FUSE(r5, &(0x7f0000000540)={0x2020}, 0x2020)
mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x4, 0x12, r0, 0xa03c0000)
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x6a)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@verity_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
r6 = syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00')
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0)
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
read$FUSE(r7, &(0x7f00000042c0)={0x2020}, 0x2020)
read$FUSE(r6, &(0x7f00000039c0)={0x2020}, 0x2020)
mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000fff000/0x1000)=nil)

1m52.109111191s ago: executing program 4 (id=3552):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000480)={0x73622a85, 0x0, 0x2})
r1 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r1, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x1}, 0x1c)
r2 = socket$inet6(0xa, 0x2, 0x0)
ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000680)={<r3=>0x0, 0x3, 0x100, 0x1})
ioctl$BTRFS_IOC_GET_DEV_STATS(r1, 0xc4089434, &(0x7f0000000a80)={r3, 0xf73, 0x0, [0x100000000, 0x10000, 0x0, 0x1, 0xffffffff], [0x8, 0x4, 0x8, 0x9, 0x3, 0x0, 0x3, 0x2, 0x11, 0x200, 0x9, 0x8, 0xfffffffffffffffe, 0x7ff, 0x1, 0x0, 0x2, 0x8, 0x5, 0x6, 0x5, 0x6, 0xb3c, 0x31b, 0x3, 0x0, 0xf7eb, 0x10001, 0xffffffff, 0x0, 0x4, 0x8000, 0x786, 0x7, 0x200, 0x1c9, 0x6, 0xfffffffffffffffd, 0x10000000000000, 0x200, 0x80, 0x5, 0x5, 0x8, 0xfffffffffffffff8, 0x8, 0x0, 0x9, 0x10000, 0x7, 0x2, 0x1, 0x8, 0x4, 0x0, 0x400, 0x3d, 0x5, 0xff, 0x2, 0x7, 0x5, 0x4, 0x8, 0x3, 0x6, 0xffff, 0x4, 0x3ff, 0x5, 0x8000000000000001, 0x2, 0x6, 0xff, 0x5, 0x80000000, 0x2c, 0x9, 0x4eaf, 0x6, 0x2, 0xfff, 0x9, 0x2, 0x1, 0x0, 0x800, 0x1124, 0x97, 0x2, 0x1, 0x9, 0x7f, 0x100000001, 0x49, 0xb2d, 0x5, 0xf1, 0x10000, 0x1, 0x7, 0x1, 0x7, 0xf7e, 0xe, 0x80000001, 0xd9c6, 0x65b, 0x7, 0x6, 0x3, 0x905, 0xffffffffffff25e5, 0x2, 0x0, 0x7, 0x46, 0x6, 0x8, 0x1, 0x7]})
bind$inet6(r2, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c)
r4 = socket$inet6(0xa, 0x2, 0x0)
r5 = userfaultfd(0x801)
ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000140))
ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000180)={{&(0x7f000072b000/0x2000)=nil, 0x2000}, 0x1})
r6 = fsopen(&(0x7f00000000c0)='overlay\x00', 0x1)
fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000080)='source', &(0x7f0000000180)=':..:\x00\x8e\xf7\xd4\t\xe1\xae\x19\xe5\xf7c\x84\x9c\x06\x00\x00\x00\x11\x01\xf2 \xec\xbe#\'S\xc4\xbd\xb5\x1e\x98MM\x06\x1a\x7f5U\x18\x90\x99\xb2\xfa\')Z\x9ew\xae\xe8\xdd\b\t\xf0\xc4\xbfj\xb6\x88/)~\x93E\x1d4\xa7\xcb\xeb\x0f\xd4(\xb6>\x87\xc3\t\xb0\x80\xf7\xe6\x8b?\xa4\xb3\b\x00\x81\xbe\xea\x1f\xfe\xed\x9d\x1a\x8aQ\xafQ\x06\x0fJ\xc0\xc0=}\x7f\xaeB\xb1\xed\xa4\xf3c#\xbe\b\x1f\xa4L[\xfa\x01Uu\xe0\x8b\x94E\xda\xd9j\x93\xc8~\xd9\x82\x8f\xcam\x17\xa2\xed\xf3\xc3_h\xfc6\t\x96@\xaf\xe6\xd0!)\xc3\xcfe\xe1g\xe7\xe5F\xbdC\xd9$\x9b@\xaf\xc2j1p\xa9\xb2d\x92\x8fo\xcbg\x9fZ\xd7\xef\xb2z\xf5\x0fq\x7f\b\xc2\xa7\x90\xc5\xf5Y\xbc\xf1s\x93X\xb6\xeb\x86&\xa7\x14%B', 0x0)
fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='ceph\x00', 0x0)
setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4)
bind$inet6(r4, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c)
r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0)
r8 = epoll_create1(0x0)
r9 = socket(0x1, 0x80802, 0x0)
r10 = epoll_create1(0x80000)
epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r10, &(0x7f0000000100)={0xa000000d})
epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r9, &(0x7f0000000000))
epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r9, &(0x7f00000000c0)={0x10000001})
pselect6(0x40, &(0x7f0000000200)={0x9, 0x93, 0x80000001, 0x0, 0x6200000000000000, 0x4, 0xb, 0x7fff}, 0x0, 0x0, 0x0, 0x0)
shutdown(r9, 0x0)
ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r11 = dup3(r7, r0, 0x0)
ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f0000000640)={0x18, 0x0, &(0x7f0000000100)=[@decrefs={0x400c6314}, @request_death={0x400c630e, 0x1}], 0x0, 0x0, 0x0})

1m51.942642704s ago: executing program 4 (id=3558):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) (async)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000200)=[@enter_looper], 0x50, 0x0, &(0x7f0000000380)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) (async)
mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async)
signalfd(r0, &(0x7f0000000040)={[0xffffffff80000001]}, 0x8) (async)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r1, 0x6, 0x4, &(0x7f0000000bc0)=0x6, 0x4) (async)
prlimit64(0x0, 0x7, &(0x7f0000000140), 0x0) (async)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/238, 0xee, 0x2, 0x4}, @fda={0x66646185, 0x1, 0x0, 0xe}, @fd={0x66642a85, 0x0, r0}}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0})

1m51.909370334s ago: executing program 34 (id=3558):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) (async)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000200)=[@enter_looper], 0x50, 0x0, &(0x7f0000000380)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) (async)
mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async)
signalfd(r0, &(0x7f0000000040)={[0xffffffff80000001]}, 0x8) (async)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r1, 0x6, 0x4, &(0x7f0000000bc0)=0x6, 0x4) (async)
prlimit64(0x0, 0x7, &(0x7f0000000140), 0x0) (async)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/238, 0xee, 0x2, 0x4}, @fda={0x66646185, 0x1, 0x0, 0xe}, @fd={0x66642a85, 0x0, r0}}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0})

1m6.349478647s ago: executing program 3 (id=4268):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f00000000c0)={{0x1, 0x0, 0x0, 0x3, 0xfffffffd}})
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3})
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10b})
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4)
setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f00000002c0)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x6, 0x37, 0x0, 0x9}]}, 0x10)
r3 = socket$inet(0x2, 0x3, 0x6)
setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000140)='xfrm0\x00', 0x10)
sendto$inet(r3, 0x0, 0x0, 0x8000, &(0x7f00000001c0)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x23}}, 0x10)
r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000000)={0x3c})
sendto$inet(r3, &(0x7f0000000000)="9a9c94a4190e99829ee64c8477", 0xd, 0x20000800, &(0x7f0000001080)={0x2, 0x4e24, @multicast1}, 0x10)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x44, 0x0, &(0x7f0000000600)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x50, 0x0, &(0x7f0000001d40)="1d488055d3f1688c4e797b10f650c33bb295362f0d05fd380896aba267b2b8cad21dae8af42636cd1ca4f92ffd194cd6519e07c189705bbc9b9fc2fd1ac553684decb13566191e525ee138cbdd4dc3ad"})

1m6.346289656s ago: executing program 3 (id=4269):
ioctl$ASHMEM_SET_SIZE(0xffffffffffffffff, 0x40087703, 0x40000100000200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f00000000c0)='\xc2\xedE\\\xe3\xd5>\x8c\x1b\xa7\bj\xa4\xc4\xde\xd8\x15\xa6|,\xfdD\xcc\x8a\r_H!\x11t\xfc\xac\xe0s\x81\xf8\xae\x98It\x12&\x12\xd6&\xc3\xe4\x11\x8b\xae\xc1#B\x11\xa2\xb2\xf9\x90\xff0\x1e]\x8a]n`\xff\x97\xdf\xe3|i\xd0\xe4Z^\x8cD\x82\x92\xfd\x84\x13\x83n\xc2VW>4\x06\xe6j\x1d\x05\xfc\xa5o\xbc\x93\xcd\x8cSg\xa9\xefo\x11|\x10\xe6\x1b\x02/m\xcd\xdeN\xcb\xb1\xfel\x0f\xeb\xc5\xefF\xa85\x99D\xb0\xf2]\xdf\x93\xc4Z\xf1\xb3\xce\xcc\xe2qc\xc6\x1c\x0e\x12\xbdx\x01\xe8\x0e\x13\xe3r\x9csAJV\x99\xe6qN>$\xb3V\x12Kd\xb7\xc8\xd3\xcb\x88S\x90j^\\x\x1f\v\xc9\xc2{e\x82{\tEH\x90\xa8\x18\x0fG\xeb\xf8\xde\x91\x99\xaf\xe1\x88q\x81IQN\x92h\x980\x03+\xf3\x1a\xd1}\xf7\x87\xd1\xe5@4l\xdci\xd5\x1f\x7f\xaa\xb3k\x8a\xba\x12\x91^\xcb3H\xf00\x8b\x11\x1b\xfcR\xc3\x11\xe2\x8dU\x01\xee\x8eU\xf2\xd8Y>\x86+')
r0 = socket$tipc(0x1e, 0x5, 0x0)
pipe2$9p(&(0x7f0000000040), 0x40080)
ioctl$FAT_IOCTL_GET_ATTRIBUTES(r0, 0x80047210, &(0x7f0000000000))
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=ANY=[], 0x11e4}}, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000280)={0x9})
fsopen(&(0x7f0000000000)='pipefs\x00', 0x0)
r3 = socket$tipc(0x1e, 0x2, 0x0)
setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000680)={0x42, 0xfffffffa, 0x1}, 0x10)
r4 = socket$tipc(0x1e, 0x5, 0x0)
setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000140)={0x10000042}, 0x10)
setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10)
r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
fsopen(&(0x7f0000000080)='nilfs2\x00', 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000003c0)={[0x60000000001, 0xd4, 0x20000000, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x5, 0x5, 0x7, 0x3, 0x400000000], 0x80a0000})
ioctl$KVM_RUN(r5, 0xae80, 0x0)

1m6.288965088s ago: executing program 3 (id=4270):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x2d00, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2c41, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000001100)=[{&(0x7f00000033c0)=""/4094, 0xffe}], 0x1, 0x34, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x0, 0x0)
flock(r2, 0x5)
r3 = socket$netlink(0x10, 0x3, 0xf)
r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x5)
pipe(&(0x7f0000000080)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
open_tree(r6, &(0x7f00000008c0)='\x00', 0x1001)
ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000280)={{0x5, 0xf, 0x4, 0x5}, 'syz1\x00', 0xb})
ioctl$UI_DEV_CREATE(r4, 0x5501)
bind$netlink(r3, &(0x7f0000000a40)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc)
accept$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000001c0)=0x14)
setsockopt$sock_int(r5, 0x1, 0x1d, &(0x7f0000000000), 0x4)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r3)
syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0), r3)
ioctl$EXT4_IOC_GET_ES_CACHE(r4, 0xc020662a, &(0x7f0000000140)={0xa2, 0xfd, 0x4, 0x7fffffff, 0x1, 0x0, [{0x2, 0xabd, 0xb5, '\x00', 0x200}]})
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)

1m6.285656998s ago: executing program 3 (id=4271):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = epoll_create1(0x80000)
r2 = fcntl$dupfd(r0, 0x406, r1)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)={0x60000001}) (async, rerun: 64)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000040)) (async, rerun: 64)
epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r2, &(0x7f0000000180)={0xa0000008}) (async)
r3 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) (async)
sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x880}, 0x4000) (async)
r4 = socket$inet6(0xa, 0x3, 0x8100c)
connect$inet6(r4, &(0x7f0000000a40)={0xa, 0x4e02, 0x7ffe, @remote, 0x9}, 0x1c) (async)
sendmsg(r4, &(0x7f00000000c0)={0x0, 0x953a, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xfff2}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) (async)
r5 = fsmount(r3, 0x0, 0x86)
fchdir(r5) (async)
r6 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc)
close(r6)
execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) (async)
openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) (async)
r7 = getpgrp(0x0)
getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xa, 0x0, &(0x7f0000000040)) (async)
madvise(&(0x7f00005bc000/0x4000)=nil, 0x4000, 0xb) (async)
syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) (async)
prlimit64(r7, 0x3, &(0x7f0000000140)={0xa, 0x47f}, 0x0) (async, rerun: 64)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (rerun: 64)
r8 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_tx_ring(r8, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) (async)
mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x7fa962bfffff, 0x13012, r8, 0x0)
clock_getres(0xfffffffffffffffd, 0x0) (async, rerun: 32)
socket$inet6_tcp(0xa, 0x1, 0x0) (rerun: 32)

1m6.274394828s ago: executing program 3 (id=4273):
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (async)
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x13, 0x0, 0x0)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0)
r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]})
syz_clone3(0x0, 0x0)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r3=>0x0)
fcntl$lock(0xffffffffffffffff, 0x26, 0x0)
syslog(0x4, 0xfffffffffffffffe, 0xff14) (async)
syslog(0x4, 0xfffffffffffffffe, 0xff14)
ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000340)) (async)
ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000340))
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r3, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) (async)
timer_settime(r3, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000000))
ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000140))
bind$inet6(0xffffffffffffffff, 0x0, 0x0) (async)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15)
socket(0x2, 0x2, 0x1)
mmap$KVM_VCPU(&(0x7f00005c1000/0x1000)=nil, 0x0, 0x0, 0x82010, 0xffffffffffffffff, 0x0)
gettid() (async)
gettid()
ppoll(0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000180)=0xffffffffffffffff) (async)
ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000180)=0xffffffffffffffff)
fcntl$setsig(0xffffffffffffffff, 0xa, 0x12)
rt_sigprocmask(0x0, &(0x7f0000000040)={[0xfffffffffffffff9]}, 0x0, 0x8)
ppoll(&(0x7f0000000100)=[{}], 0x1, 0x0, 0x0, 0x0)
timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000))
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0)
syz_open_dev$evdev(&(0x7f0000000000), 0x6, 0x8040) (async)
syz_open_dev$evdev(&(0x7f0000000000), 0x6, 0x8040)

1m6.052883593s ago: executing program 3 (id=4275):
r0 = creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182) (async)
pipe2$9p(&(0x7f00000001c0)={<r1=>0xffffffffffffffff}, 0x0)
mount$9p_fd(0x0, &(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000004500), 0x800, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) (async)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xac4242bdfc06f76b, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'\x00', 0x2})
ioctl$TUNSETGROUP(r2, 0x400454ce, 0x0) (async)
r3 = socket$tipc(0x1e, 0x5, 0x0)
setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) (async)
ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)=<r4=>0x0)
prlimit64(r4, 0x7, &(0x7f0000000180)={0x0, 0x4}, &(0x7f0000000200)) (async)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x2000) (async)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc) (async)
r7 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_group_source_req(r7, 0x29, 0x2b, &(0x7f0000000180)={0x1589, {{0xa, 0x4e24, 0x3, @mcast2, 0x7}}, {{0xa, 0x4e22, 0x400, @private2={0xfc, 0x2, '\x00', 0x1}, 0x81}}}, 0x108)
sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000000)={0x0, 0x6, &(0x7f0000000040)={&(0x7f0000000280)={0x80, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x100e}, @CTA_SEQ_ADJ_REPLY={0x14, 0x4, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x5}, @CTA_SEQADJ_OFFSET_BEFORE={0xe6ba7615268e7f7}]}]}, 0x80}}, 0x0)
sendmsg$tipc(r3, &(0x7f0000000400)={&(0x7f00000008c0)=@id={0x1e, 0x3, 0x3, {0x4e20, 0x2}}, 0x10, 0x0}, 0x20)
r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000100)={0x5, 0x0, &(0x7f0000000080)=[@release={0x40046306, 0x2}], 0x0, 0x0, 0x0})

50.063210272s ago: executing program 35 (id=4275):
r0 = creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182) (async)
pipe2$9p(&(0x7f00000001c0)={<r1=>0xffffffffffffffff}, 0x0)
mount$9p_fd(0x0, &(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000004500), 0x800, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) (async)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xac4242bdfc06f76b, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'\x00', 0x2})
ioctl$TUNSETGROUP(r2, 0x400454ce, 0x0) (async)
r3 = socket$tipc(0x1e, 0x5, 0x0)
setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) (async)
ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)=<r4=>0x0)
prlimit64(r4, 0x7, &(0x7f0000000180)={0x0, 0x4}, &(0x7f0000000200)) (async)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x2000) (async)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc) (async)
r7 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_group_source_req(r7, 0x29, 0x2b, &(0x7f0000000180)={0x1589, {{0xa, 0x4e24, 0x3, @mcast2, 0x7}}, {{0xa, 0x4e22, 0x400, @private2={0xfc, 0x2, '\x00', 0x1}, 0x81}}}, 0x108)
sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000000)={0x0, 0x6, &(0x7f0000000040)={&(0x7f0000000280)={0x80, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x100e}, @CTA_SEQ_ADJ_REPLY={0x14, 0x4, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x5}, @CTA_SEQADJ_OFFSET_BEFORE={0xe6ba7615268e7f7}]}]}, 0x80}}, 0x0)
sendmsg$tipc(r3, &(0x7f0000000400)={&(0x7f00000008c0)=@id={0x1e, 0x3, 0x3, {0x4e20, 0x2}}, 0x10, 0x0}, 0x20)
r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000100)={0x5, 0x0, &(0x7f0000000080)=[@release={0x40046306, 0x2}], 0x0, 0x0, 0x0})

4.818778047s ago: executing program 5 (id=5119):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) (async)
r1 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000180)={0x3, {{0xa, 0x4e20, 0xa3f, @mcast1, 0xbfd}}, {{0xa, 0x4e23, 0x4000, @empty, 0xfffffe01}}}, 0x108)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async)
getsockopt$inet6_buf(r1, 0x29, 0x30, &(0x7f0000000180)=""/214, &(0x7f0000000080)=0xd6)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) (async)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
r2 = syz_open_procfs(0x0, &(0x7f00000005c0)='smaps_rollup\x00')
lseek(r2, 0x2000, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000380)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) (async)
r3 = openat(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x200002, 0x2)
setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000180)={0x80, {{0x2, 0x4e24, @remote}}}, 0x88) (async)
syz_clone(0x20100000, 0x0, 0x0, 0x0, 0x0, 0x0)
r4 = socket(0x10, 0x803, 0x0)
setsockopt$sock_int(r4, 0x1, 0x10, &(0x7f0000000040)=0x3, 0x4) (async)
socket$nl_xfrm(0x10, 0x3, 0x6)
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2})
writev(r5, &(0x7f00000006c0)=[{&(0x7f0000000080)="2e9b3d0007e03dd65193df163e75963f86ddf06712e9001c2f8db0049d90491ceaebfd26d4eef23248000000f858dbb8a19052343f", 0x35}, {&(0x7f00000002c0)="8d09327c", 0x4}, {&(0x7f0000000100)="b03ef9880b815221ff28eac1d4f49bcad59f71c0ef", 0x15}], 0x3) (async)
sendto(r4, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async)
setsockopt$sock_int(r4, 0x1, 0x22, &(0x7f0000000000)=0x3, 0x4)
recvmmsg(r4, &(0x7f0000004840)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=""/24, 0x18}, 0x40}], 0x1, 0x10002, 0x0) (async)
r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) (async)
ioctl$TUNSETLINK(r6, 0x400454cd, 0x339)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r7=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @link_local})
mremap(&(0x7f000000d000/0x2000)=nil, 0xfffffffffffffe74, 0x1000, 0x3, &(0x7f0000007000/0x1000)=nil)

4.756874408s ago: executing program 5 (id=5120):
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6)
ioctl$sock_bt_hci(r0, 0x800448d2, 0x0)
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0)
ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f0000000040)={0x2})
ftruncate(0xffffffffffffffff, 0x398a0bdb)
add_key$user(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xffffffffffffffff)
r2 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff)
r3 = add_key$keyring(0x0, &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe)
keyctl$read(0xb, r3, 0x0, 0x0)
syz_usb_connect(0x3, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000acb48c20520c6128370101020301090224000100000000090489010287702a00091000102000080404090508"], 0x0)
r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0)
r5 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_int(r5, 0x0, 0x33, &(0x7f0000000040)=0x80000003, 0x4)
listen(r5, 0x3)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_int(r6, 0x0, 0x33, &(0x7f0000000040)=0x80000003, 0x4)
bind$inet(r6, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x10}}, 0x10)
syz_clone(0x809aa311, 0x0, 0xfffffffffffffc9f, 0x0, 0x0, 0x0)
r7 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f0000000280)={0x4000, 0x9, 0x0, 0x3}, 0x10)
sendmsg$nl_generic(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000001600010a00"], 0x20}}, 0x40816)
syz_usb_connect(0x2, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005938d74010973077339600000001090212000100001e000904"], 0x0)
keyctl$reject(0x13, r2, 0x610, 0x0, 0x0)
close_range(r4, 0xffffffffffffffff, 0x0)

3.338399366s ago: executing program 5 (id=5131):
mount_setattr(0xffffffffffffffff, 0x0, 0x8100, &(0x7f0000000300)={0x8, 0xf4, 0x40020}, 0x20)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_connect(0x0, 0x24, &(0x7f0000000580)=ANY=[@ANYBLOB="1201911ae49f80085a04108452010101020301090212000106bd0e0f0904f808007af54c"], &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0})

1.56228258s ago: executing program 1 (id=5139):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3})
mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0)
r1 = syz_open_dev$hidraw(&(0x7f0000000080), 0x7fffffffffffffff, 0x40)
ioctl$HIDIOCGRDESC(r1, 0x90044802, &(0x7f0000000580)={0x1f0, "80e446eea0bd3a86d1d1ee3d52472ab41368bb5ac532f11eac60d0b3028d404615564aa5c0315d5de1dd3f0a58a1af76eec54d390cd5576b984bc9b84ae508c51163d331d6cf424777e28f3b80611ebcdac4d4265b5cc5c9f13e3ed387c7a5a7acf26ab923792a6679577b6261adc6a6ebd355dbb06ee52aba238c278abe802455664d3e459059e39af1130a142c42b70f5d159539c7760fe19fdbdd37e2c2241b8a5b41e8081d74d7cf0d687747f3d3b2d8564a10f74371d606aa9732e692177b3ad75539ee8703ecf7a16953e22f785f3bee3c2c098e264763c21312ea7787f8b625fb6346f157ff07f70d080bf0187ca200ed0b70ab630a47cd2a60e852065e26c2f7de5c9db8c394da229476ed4d41087c64d5dd716aef64abf76e17f0604ad4d4b5ae471d20e0142d50ad31d9d4ed52c608bb7644cf141ef78d9374a80ed92c58bde719cf3840633f96bfebfa3a855d826390511507550977ad4cd0d340e1dda506783355f3e91fcfdebd27fde43d85115a464c555b4fb6a9bb6bbfc356cab4a312a7bdb59329d41ac2af702fc36e22c3a00049f4f5d9c38aede259f61d0bf3ede936e50e455b20412bb79b76cf1fbbd93d134c354ae03f6bcd15cb9cdc86e521d43b79a0a092152f19cbf68c2b4a2b15767b9d964b042b658f9f8a778d859523f8f3d546689f78afb7598ba94e"}) (async)
ioctl$HIDIOCGRDESC(r1, 0x90044802, &(0x7f0000000580)={0x1f0, "80e446eea0bd3a86d1d1ee3d52472ab41368bb5ac532f11eac60d0b3028d404615564aa5c0315d5de1dd3f0a58a1af76eec54d390cd5576b984bc9b84ae508c51163d331d6cf424777e28f3b80611ebcdac4d4265b5cc5c9f13e3ed387c7a5a7acf26ab923792a6679577b6261adc6a6ebd355dbb06ee52aba238c278abe802455664d3e459059e39af1130a142c42b70f5d159539c7760fe19fdbdd37e2c2241b8a5b41e8081d74d7cf0d687747f3d3b2d8564a10f74371d606aa9732e692177b3ad75539ee8703ecf7a16953e22f785f3bee3c2c098e264763c21312ea7787f8b625fb6346f157ff07f70d080bf0187ca200ed0b70ab630a47cd2a60e852065e26c2f7de5c9db8c394da229476ed4d41087c64d5dd716aef64abf76e17f0604ad4d4b5ae471d20e0142d50ad31d9d4ed52c608bb7644cf141ef78d9374a80ed92c58bde719cf3840633f96bfebfa3a855d826390511507550977ad4cd0d340e1dda506783355f3e91fcfdebd27fde43d85115a464c555b4fb6a9bb6bbfc356cab4a312a7bdb59329d41ac2af702fc36e22c3a00049f4f5d9c38aede259f61d0bf3ede936e50e455b20412bb79b76cf1fbbd93d134c354ae03f6bcd15cb9cdc86e521d43b79a0a092152f19cbf68c2b4a2b15767b9d964b042b658f9f8a778d859523f8f3d546689f78afb7598ba94e"})
openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
r2 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
readv(r2, &(0x7f0000000300)=[{&(0x7f0000000040)=""/39, 0x27}], 0x1)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, 0x0, 0x20, 0x2, 0x4}, @fda={0x66646185, 0x1, 0x0, 0x11}, @fda={0x66646185, 0x6, 0x0, 0x200000000000024}}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0})

1.56184147s ago: executing program 1 (id=5140):
ioctl$FITHAW(0xffffffffffffffff, 0xc0045878)
r0 = open(&(0x7f0000000000)='./file0\x00', 0x204a00, 0xa0)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$F2FS_IOC_GET_COMPRESS_OPTION(r1, 0x8002f515, &(0x7f0000000040))
ioctl$KVM_HAS_DEVICE_ATTR_vm(r0, 0x4018aee3, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000080)={0x3}})
getsockopt$IPT_SO_GET_ENTRIES(r0, 0x0, 0x41, &(0x7f0000000100)={'filter\x00', 0xb, "4703cde6e8513d2159b34d"}, &(0x7f0000000140)=0x2f)
setsockopt$inet_int(r0, 0x0, 0xa, &(0x7f0000000180)=0xe469, 0x4)
getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f00000001c0)={'broute\x00', 0x0, 0x0, 0x0, [0x40, 0x7f, 0xc7, 0x1ff, 0x0, 0x1ff]}, &(0x7f0000000240)=0x78)
ioctl$HIDIOCGSTRING(r0, 0x81044804, &(0x7f0000000280))
setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f00000002c0)=0xc0c, 0x4)
setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000380)={&(0x7f0000000300)=""/77, 0x102000, 0x1000, 0x4, 0x1}, 0x20)
fcntl$getownex(r1, 0x10, &(0x7f00000003c0)={0x0, <r2=>0x0})
fsetxattr$security_capability(r1, &(0x7f0000000400), &(0x7f0000000440)=@v1={0x1000000, [{0x6}]}, 0xc, 0x2)
io_setup(0x7, &(0x7f0000000480)=<r3=>0x0)
io_cancel(r3, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x7, 0xc, r0, &(0x7f00000004c0)="474e1bfba394c2ea447b3e30110f743fb4c2558af4cc2f2edaef3b307aa45f612e19f8ac27cf37c8eb8fb0d0e4fc959eca314d74cf48baf04a651f4ef5c850e9f319303a28d4b4444e5405e89cfda8c088587328de84e0b4f9eb6784b1cec70e38937b10e02b01a93d92ff5cf89f4f73996652ccc345c960f1b61371e070395ea12e33a4b7e7a810280068db01d18f1d950131dbe6d4c7991efaa5112771ed966c5bf20c2727d4d79b33c577ab944e4ee4f9585fb3169471ec8c6aed60b36c6d235c3e0476b9074080b1be90faf110c8521804f266546ea23a0f27795a3f", 0xde, 0xfffffffffffffffa}, &(0x7f0000000600))
ioctl$VFAT_IOCTL_READDIR_SHORT(r0, 0x82307202, &(0x7f0000000640)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}])
openat$cgroup_devices(r0, &(0x7f0000000880)='devices.deny\x00', 0x2, 0x0)
fstatfs(r0, &(0x7f00000008c0)=""/187)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000009c0), r0)
sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000a80)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000a40)={&(0x7f0000000a00)={0x38, r4, 0x800, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x1, 0x71}, @void, @val={0xc, 0x99, {0x5, 0x2d}}}}, [@NL80211_ATTR_PID={0x8, 0x52, r2}, @NL80211_ATTR_PID={0x8, 0x52, r2}]}, 0x38}, 0x1, 0x0, 0x0, 0x40010}, 0x8000)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000ac0), 0x101000, 0x0)
setsockopt$IP_VS_SO_SET_EDITDEST(r5, 0x0, 0x489, &(0x7f0000000b00)={{0x2, @rand_addr=0x64010100, 0x4e21, 0x4, 'sh\x00', 0x0, 0x2, 0x31}, {@local, 0x4e24, 0x2, 0x6, 0x474, 0x8}}, 0x44)
sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000c80)={&(0x7f0000000b80)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x7c, 0x0, 0x1, 0x5, 0x0, 0x0, {0xa, 0x0, 0x7}, [@CTA_TUPLE_ORIG={0x68, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @rand_addr=0x64010102}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @loopback}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20008800}, 0x54fee8045e904b20)
ioctl$HIDIOCGREPORT(r0, 0x400c4807, &(0x7f0000000cc0)={0x1, 0x1, 0xffff8001})
ioctl$BTRFS_IOC_SET_FEATURES(r5, 0x40309439, &(0x7f0000000d00)={0x3, 0x2, 0x10})
r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000d80), r5)
sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000e40)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000dc0)={0x30, r6, 0x8, 0x70bd28, 0x25dfdbfb, {}, [@TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xf}]}]}, 0x30}}, 0x4048000)
r7 = openat$cgroup_freezer_state(r0, &(0x7f0000000e80), 0x2, 0x0)
write$cgroup_freezer_state(r7, &(0x7f0000000ec0)='THAWED\x00', 0x7)
write$binfmt_script(r0, &(0x7f0000000f00)={'#! ', './file0', [{}, {0x20, 'nl80211\x00'}, {0x20, ','}, {0x20, '\x00'}, {}, {0x20, 'security.capability\x00'}, {0x20, 'THAWED\x00'}, {0x20, '\':\''}, {0x20, 'broute\x00'}], 0xa, "1d62bc3873ba1722d67edcac9cc11b0895c7a8bff1"}, 0x58)

1.56088814s ago: executing program 1 (id=5143):
ioctl$KVM_UNREGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae68, &(0x7f0000000080)={0x0, 0x100000})
madvise(&(0x7f0000137000/0x2000)=nil, 0x2000, 0x11)
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x165342, 0x0)
ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0)
mprotect(&(0x7f000000b000/0x2000)=nil, 0x2000, 0x4)
write(r0, &(0x7f0000000400)="547bbee68789313efe846d6698abfeac0d12b144933fa6f684f1ba13b34680bf4b9ea70f71faa2a82a45ab47458c1f827355ad34033fbb8b9699eb0b279252dfcf29e377e14dcfbde42857cbf2aa88d3dad8ec2deea7afe4e747fa392fe01d425970fb2dd7a000ea3889f0d9021f347818106963e18c256e3df26b41c61d30284a8ad61c6269756119d62e3a7a24c1dcd09d3eb35dfee6ec945ac190c4797988e0d7f6f38bf9b124431dd8208a9208195a70c8e558c216e78d5f5b3f6df6f155e16bf7dd8f4e9eaf61d5142a82da7a87aeca19c25b631cd8a14ce9f2fc8dbcd05f51dc9260abc82d780c9358bd6411ebf48520694d413024432d0bfc3759a620289c9c8705009fd829da6eb5b72b454436b0af8e9dc4941ca2cff92561cad984e15849dcd73f04c7f70a30304da2fbc17f421767ad5ce47ed79d6698428eada9a39faa02f978699bc8c482224a2d5f85cc1135ea92ac1c610e32f1e7c82da6d91e0c8634da679760c32c3e891db352b76b61a65bbdd023e093a8e0d37fd8cd00679cb1bceaac84b05861740c221b2cb4afa1ce8b091c815fc4bd83995b5bf5dcdf2912572cf6180ec27445404917ff9e8e6604e2afc19a1bb3745914f0a101e03e44ea5f64d40402f12a81310c97086fb01d04e82799c40f29348eb283ad58a40d608a47fbf9a25dbb308aa03b2425ffa896e1a70a37cf49e6dbdeda39ee88aadb26811eba78a0dfe5400a51428c31582edcc5f75b5dd963707a54b9b1e35f9966995d6474acbf7094124cecf38369aba3f6a5e3ad071f5e3df902843a3947623fe01571d97625c3e27721b08a6f85fd7b879acd400de5beabdd2603d566fdb4018bf8bd74c3ea1ae67c988992c7dab4ebcf501a73815e1b527d3ff1cf9e729d55127118565f794d253fef25609e5a415615d1b5fca5381b49446d9b9e75fbfcdd9218b0d8d8d965871b897544e32fd0b4cb5600ffdcdb0056bcad75216759590f8a94db82b0acd2a5a34e5c34241a19f1a7a7cceb894341f55c6b474f3cc052f9863a67519dfadee6576f08d7448929424c13e845e2e636b87dc14e1ab4ad05d69f896ca1bc5c1267befb686c4207e21aa30bdae1d1602d3e4080784834e213c426ba5446f90d3b3885a5d6942c6b0e637f5bb9c7908460bd7d04497ab054c8fc7f89068f7535976ad051bfe94c243ce7604a63b2099b69f1ed73590a318fad9a170fa0cddfe60e981a92de2e1aab3465b11a968108e08deadfa1fa546c4cbc0c34ac28597848562583ae8d93cb60f2e06c7a1f743add51eb8cd732b40d48fde00117cb2d654100dfcc66b7c9fefac80e137caa5cf43ae897780251a3ebbc4ddd3b003168963c9e2c9446cb29731fc4bbb5e551aca6913f7b8576ce34012581b5a363917970399ca369688e637cf06ff3c8114383d2fcbf9c69f1ca63cd21695254a440df5ef0a8abfdbd0a651a533b6cdb82382e3bd70f87c1d3eb0a6e22452605026fafe6d35158c0728c1050a39330c80ee2ee0b09366fc6382883ecd0796feec657b36aee4091471e406e9faffd5ede27943e5fbf1b7249ab8bad71f60063697f04db52e980a9fb3eb5e53b89be8a5f0e6afea7435789ecd444c28eb411cdc2158e434178749f36cc957dbd17efb2b218592f78d6864f2708e8c6db2da0d3f6de53959afec0c90d3d62a13a0bc3857bce58d81223eddd05cf3c1ec6b3fc5307d0f16d470f2065300295197e9fa81d2e5574b2c7b18f1c6c85156a9b1174d62dcd3cb026f4b67e6babd66c8f427b9687585f37b18c82e0100507035e78ce010b78ea1b5d3884db25df36ae929dd535a854a31cba5e47655873df72be7463c600b704e9da0e7cb2d61d0710248814ecced2eef8f227c8aec308c2c9d0a39d1a6b306080e8eaef8edece0f6d0d1612c582d70c3999a1a6bd529538f51ba4869ce74bc8509a7126d96db118cdb55411a36f4361d53c8027c12a7486e9c84e4de445b454630be27bdc2ec268702d9c1890297bdd1fc7a235f1a47f4645d286146f3cb9a7ce650f4157a1e7f134eb1815001d59905d3103efad3c66479330e8a5da941c9c38bf21bc0770e3fd56cafa19ad6e9d51f94ed4f900062b5602653aacdcc956aeecfb1dd613caf918e1ca8ef2e1504c42768e77df43569d5fe4b48c237cad5285c578b26b4e47c8ce06fd2686e17eb6d5df5645d0fdde7782216be07a1135dabc3a59598bdbab249c5391832f18ac5163aa7a1a890128a4520835a53eb750604c5e328ecb3216516b3eba3f97652caeb4327da8865880a932dc8e7668666ac3b76a2a424ca37b5dfb52495710611e20790427a9f9e7ac59bb86f0fb7a17a5def347a98dd8e733b784d78d5c7f16f327a2606d4252411457465540a60b0757802f470d08337c0fe4eee5f5cfe4f296d0f7068e80828a022c95632beb7b7f802135e246b1adebebf24c821dee7205e9fe1a437b16aaa8dcb4a58b0bdbc8dbc2fce09271c27430cc9ca8141955ec5ff4228627c3816cfe1bb2c0f40f6a61e8bfa4e2dd744e41ed80b83e9aef77119f4b062b98e86690711e83e795bafa7a8db16f241cee76aa01ff749100c113fda966aa8c83ebe975f760c18e3864065a5de6e8028a9e3199f4acff11e14bb13bc50faf97fdeab46edc371e55cab78841a2de17ca116b0183ac38b658c57a64ab11bb0de071c971a7a5175ad0bac6ac1d1118230a5412a35bd005b369df0e04e749ea93d7e56f713b9ceff580547a2a76ea4753a78b4a5cd0311024c5536b536c8ede63bac8e8b4c5851248d9098a7c6bcc3d5f209178b45aef3c1afa4ab73d8feac3e1f771626d73d85f72dc15d16bd3b7b93e622626f6f3d96b4425d328236cf1579f1ca834a7b318b012e27b9a2dc528189cf1eb3705d90de50ce7ac0c256b7e41500113e164fb7d53c74c6f829552a5bce73eeab9a46d01551bdab18fd3a7e82b036872f1e876b12c5676f63a6ef0c6ff159788a0c2fc40f179a259c656e8aba9295e90027e74ef910ce3c56d6e2de917947410b05603b6a5052453f13e6ac058b3f621573bfe6224bad8c3a5f575e1eb774839cb554c53c9b3ad623df6c5c9627cce856f9ba5847557bc9f854cbb37a936f20a733ba352ee5b343b941290a399fb862434d1b551da420053cad3bad65195cde40b345740e30e9a22619add8aedb763473b729c0649f7a1ea45325534c9b629a1fe3a54a78fe44969715182c6df5c9ecf6878380831b2996579332ac37286e72ab16824c3fc9ef8d74a7f1f5cf80fa37f6bb990db3a7a70139887a4eba0763247c58f4fe770a0496a5ef49a3ba4d62bb900644d49b5fba7e58d58af6ae50c96da346618434ed46b8f4c27cde5e8863d5b090dc117f3b16db2c4273fa84f8b06d3df436bf4a8cfa6d33d7f0e78ef422d5d7640c821398c9adf4d6ccb1b2f7cd0e497023cfdd6b5bb9ad6a29edb8b78fb3322414cad1458eb12699853acb165076db7088f518386380850c111cbe74034ddbfe217db714325ebc4d6b46eba640cf125b87eed0832077ab775e475e431079756b3da6f9bb3c861ce7eabf6adf70b76eb9642a1bab3d7afef2d7b40c8a19b98123ad7449c1039c494e73bc91a86e8e92c39a9482cf60605b9e5c209262c4fcfde76ee370bd6a78253b64c5cbb19a11b34c5a9ccf634c52751277268cd97e795b43867af5a4db51bd631ac547906fd52aff43eb98edacecf08f94a060902b5cb82e87ec856305005bd1150e581d9717460e31ba724da5e7ad72fa580f8509fe838dbc1bfbbf53e29688f25ca602d2de702e4411d3d133e2ab2f454f71f98efc2cd0eb468544cacf608c6689ef122009cf61e813e26b7b2b1695143fcd510f509ec2bf7205e674ba6767eaa29605c51e434c298bde0969617292e960d22b085632d241aa2a8e0f6ac6f2d56d0ed2c6bd3eca306a3224915065894480e737c7d7a11901bb7f977525cfcab652476baab0fd3b68dc59fd14ccdd6248bd5c5a0ab1dbae28a848b2d4ad0d973bb149ff4115b0436b7d145a6f8081d314039131f60dc8ed0ccf2c4971f0a59a65b3b1ef638e6d009dff793a4b7266c58f88bb117d665cae8fc6f6c2840470333bdbc8df12c6633a6ac7b664e089a85dc6d49f52459dd2df1be552194eef6027c1b45f62b97647788c3325f05609c1e02cbc9a18be72e4b502df719e4f9cb82615e3a03b5732328e552023dbfdcf91ed5ab51242e7d09a9b73674f0946976d8a8fa9288dce4d54d5820a0f0053b892685f79a6c8dbac724fce4d24a7b75e383f54ac58af3951d666a22f158637acc4f0e09e248e85f8e1439501afc0d5b7e9eab40fa737ae93482a1e29f3e327fa31d0d764c65ab976af1eb91fe08c5bc10a48b93453ad192d1d538cf93b792a70246bde99f46a78b670edea552840e08c787c928ee311f954b73d07287a59b470e38d4e624ddba8e4b21a74d7c07cc684b0ea82212129901029e74312866722dfa2dc53de3e8ddc00adc21deb7510ed15c50d139296297408da3d6beb589e7bb3f1d74e4e8dddec14b9cdf371d7f142136cdca5644d09edd97228a0abcd2e7b402c5cc68683cb980f50ca7aea8338dc5990a6ebb2d2b95a3deecc45f5a4f4e0e40a57e29f3e227c41db00e17dc962e2ea3184b5057c89974bcab651a22e588a527d7d8ec695e7ab5622c1ad3763d045a8393b7acfa04488556ac957777d1aebfc5d0e2a8150a6984d5607ac2400789d8f622c837d6a9b78fcc2d8aa872949edde53e3a99b5f5bf35bff5f0db7874ad3f172f9d8dd6cbb17a770b1482c79b9a15605cd0d89c6bae9aa6db8e886cfff8f843b99df95dde88c96202ae6ced4d539a3f70997ee7b2bdb7bbe529f9bc55b143066de8d9dcd7fa38c54094f2235e4a17ef8e910b4d48c373ce5e6fc9824ca8f115e579b002df16c591557cd6cac1363b8d8fc656075ca703a87f1efa76e4122eb7358389f659681fb49cb82215f73b284a7678b8b1528472d0cfab1980ee3d4410bdc1c31f1f798c3ca5744077e2f6cb4ca6e415f1e3afc8c00dd95d3307de5428883513f01ed19dde487e1c103619fd78583f09d02982512e0ee20a670b3b24986dcb7431f1ef3fd12e801bb2454213ff7b1962a464647eb4c8125cf2ed098160da880024a98add9b2917e133dcee7a8e25387fd5bf2b3f8fb05b2f7ed5f719b30b9cca4b1754e31d48bd2ec79e7e9c155130ea5f0876f3bb4d94ac74b209633ecb03deb8b9448e8cf4b4bcb04ffdb38ac457881f84636246a4e5e7773166129fb8b7803c6dde0ee69fd1f76f1d93b729eacc9d8dbd6e61e638a3f8de972a824936b1d869a15daaa21db04760e9110c5b7c736671d31a72fcd57a6f7424c898791cafa21a48921215a78d60a367aa7c6284a1aaa1fee0c5291bdc91bf8c032c9917fd28e68fc046ea4b17952f1abbe01af5f19e4fa99fc6a985f6264f9efbb208e6146d3465cc603ef36d3d59b5197bca1696bf5658b60cf0e0455cb1e174e52c4acb712a3ed9202a1ae334427b93305939c7f15e9e5eed09b5fc8d1e3836720d46d133841d4482ec2427d3002d95bce996b4b2d5b59b2a43970afe35517674bfdd8807931697422045f60641138fefa27865b9d477ef04847dd02d305e8f15e228522e54d1ffda6d5b26ad831146c66e6f9153ebeb0785ea75283df66816d771c7e4297c1686d06494a59046313169f2e2b4988a2758198fcb166d9d112d187a4456503e6c0bdfb390c89dcebf3cb8260a27fdebddbc6071857010ad4c59c062db35a4", 0x1f000)

1.541446051s ago: executing program 1 (id=5144):
ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000100)=ANY=[@ANYBLOB="d00000001e00090002000000ffdbdf2505"], 0xd0}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000280)={0x9})
setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
sendmsg$tipc(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="a39c7250ba52a8400d82708b751cccb1d23df03ad76f6fb631163495e06fd7e7e706a91fa81db593d9dae8db1cd85783b1468a208172345af7b9706b23a7378639bd91bf43c421bdb6d7d26d130e14f6858c3117f977f70f8fbeab15", 0x5c}], 0x1, &(0x7f0000000140), 0x0, 0x20008081}, 0x20000081)
fsopen(&(0x7f0000000080)='nilfs2\x00', 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000001, 0xd4, 0x20000000, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x5, 0x5, 0x7, 0x3, 0x400000000], 0x80a0000})
ioctl$KVM_RUN(r2, 0xae80, 0x0)

1.458390592s ago: executing program 1 (id=5145):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0)
mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0)
r1 = getpid()
r2 = syz_pidfd_open(r1, 0x0)
r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x9e, 0x17, 0x36, 0x10, 0x17ef, 0x721e, 0xde06, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6}}]}}]}}, 0x0)
syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000380)=ANY=[@ANYBLOB="000a04000000d5620963"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
recvmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x2, 0x0)
r4 = pidfd_getfd(r2, r2, 0x0)
setns(r4, 0x66020000)
mount$9p_fd(0x0, &(0x7f0000000980)='.\x00', 0x0, 0x104000, 0x0)
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380), 0x1000000, &(0x7f00000006c0)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1000}}]}})
getsockopt$inet_mreqn(r4, 0x0, 0x23, &(0x7f00000004c0)={@local, @multicast1, <r6=>0x0}, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x39, &(0x7f0000000200)=@fragment={0x73, 0x0, 0x4, 0x0, 0x0, 0xb, 0x66}, 0x8)
sendmsg$can_bcm(r4, &(0x7f0000000880)={&(0x7f0000000540)={0x1d, r6}, 0x10, 0x0, 0x1, 0x0, 0x0, 0x44085}, 0x8004)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000380)="c7"})
mount$incfs(&(0x7f0000000580)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f00000005c0), 0x0, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8c)
r8 = openat$incfs(r7, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130)
ioctl$TIOCL_GETKMSGREDIRECT(r8, 0xc058671e, &(0x7f00000000c0))

1.287730035s ago: executing program 6 (id=5148):
openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = socket$pptp(0x18, 0x1, 0x2)
bind$pptp(r0, &(0x7f0000000000)={0x18, 0x2, {0x0, @local}}, 0x1e)
bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0x1, @multicast2}}, 0x1e)
openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x2, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}})
openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
socket$pptp(0x18, 0x1, 0x2) (async)
bind$pptp(r0, &(0x7f0000000000)={0x18, 0x2, {0x0, @local}}, 0x1e) (async)
bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0x1, @multicast2}}, 0x1e) (async)
openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) (async)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x2, 0x0) (async)
syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') (async)
mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) (async)

1.277626316s ago: executing program 6 (id=5149):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0)
r1 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x0)
r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00')
prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0)
unshare(0x20000400)
pipe(&(0x7f0000000380)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r4, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4)
setsockopt$inet_tcp_int(r4, 0x6, 0x14, &(0x7f00000000c0)=0x100000001, 0x4)
connect$inet(r4, &(0x7f0000000300)={0x2, 0x0, @remote}, 0x10)
sendto$inet(r4, &(0x7f0000000200)="e1", 0xfea8, 0x0, 0x0, 0x0)
splice(r4, 0x0, r3, 0x0, 0xfeac, 0xa)
read$FUSE(r2, &(0x7f00000005c0)={0x2020}, 0x2020)
ioctl$KDSKBMETA(r1, 0x4b63, &(0x7f0000000040)=0x4)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3})
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000000)={0x1})

688.557187ms ago: executing program 7 (id=5152):
pipe(&(0x7f0000000400)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000300)=@gcm_128={{0x303}, "fc674d000000f8f7", "c5991ee20139b401046a89606ffcf92e", "2c5be7c6", "a0ca05c0707e52f4"}, 0x28)
recvfrom$inet6(r1, &(0x7f00000000c0)=""/3, 0x3, 0x0, 0x0, 0x0)
prlimit64(0x0, 0x7, &(0x7f0000000180)={0x1, 0x8}, 0x0)
syz_io_uring_setup(0x3b45, &(0x7f0000000000)={0x0, 0xc5f8, 0x1, 0x1, 0xc3}, 0x0, 0x0)
splice(r1, 0x0, r0, 0x0, 0x10000008ebc, 0x0)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000200)=[@enter_looper], 0x50, 0x0, &(0x7f0000000380)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"})
r3 = getpid()
r4 = syz_pidfd_open(r3, 0x0)
setns(r4, 0x24020000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901)
move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0)
umount2(&(0x7f0000000000)='./file0\x00', 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182)
pipe2$9p(&(0x7f00000001c0)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff}, 0x0)
write$P9_RVERSION(r7, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4c"], 0x15)
r8 = dup(r7)
write$FUSE_BMAP(r8, &(0x7f0000000100)={0x18}, 0x18)
write$FUSE_DIRENTPLUS(r8, &(0x7f0000000000)=ANY=[@ANYBLOB="38010000fe0000"], 0x138)
mount$9p_fd(0x0, &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000200), 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r6, @ANYBLOB="2c7782646e6f3d", @ANYRESHEX=r8, @ANYBLOB=',\x00'])
utimes(&(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000140)={{0x0, 0x2710}})
getegid()
socket$netlink(0x10, 0x3, 0x0)

688.180247ms ago: executing program 7 (id=5153):
io_submit(0x0, 0x1, &(0x7f0000000280)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}]) (async)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x4, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0x10000, 0xeeee0000, 0x8, 0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x2}, {0x1000, 0x2000, 0x10, 0xfe, 0x0, 0x0, 0x9, 0x0, 0x8, 0x0, 0x5}, {0x3000, 0x100000, 0x0, 0x2, 0x0, 0x0, 0x40, 0x0, 0x3, 0x0, 0x4}, {0x10000, 0xffff1000, 0xf, 0x0, 0x0, 0x8, 0x0, 0x4, 0x7, 0x0, 0xfe}, {0x5000, 0xffff1000, 0xf, 0x2, 0xfe, 0x10, 0x6, 0x0, 0x58, 0x8, 0x4}, {0x0, 0x8000000, 0xb, 0x0, 0x0, 0xfd, 0xfc, 0x0, 0x0, 0x5}, {0xe000, 0x100000, 0xc, 0x8, 0x9, 0xfb, 0x0, 0x7, 0x1a, 0x2}, {0x0, 0x3000, 0x0, 0x2, 0x0, 0x54, 0x7, 0x2, 0x0, 0x0, 0x7, 0x5}, {0x2000, 0x400}, {}, 0xddf8ffdb, 0x0, 0x1, 0x34, 0x8, 0x8000, 0x2000, [0xdd41, 0x0, 0xa, 0xffffffffffffffff]})
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0)
r4 = epoll_create1(0x0) (async)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r3, 0xc018620c, &(0x7f00000001c0)={0x2}) (async)
pipe(&(0x7f00000007c0)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
close(r6) (async)
eventfd(0xffffffff)
splice(r5, 0x0, r6, 0x0, 0xfffd, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, <r7=>0xffffffffffffffff})
epoll_pwait(r4, &(0x7f0000000140)=[{}], 0x1, 0x2d516fb6, 0x0, 0x0) (async)
epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r7, &(0x7f0000000100)={0x20000014}) (async)
r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0)
r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(r9, r10, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000000)="2ef36644f7e62e3e672e450f078f29d095abaa960000b890a4f084ef66bafc0c6d8f297812cf66ba410066ef48b800100000000000000f23d00f21f835100000080f23f866baf80cb88ef01480ef66bafc0c66b80c0066efc7442402d8650000c7442406000000000f011c2466ba4200ec2e64f30f5a8e6c000000", 0x7b}], 0x1, 0x52, &(0x7f0000000200), 0x0) (async)
ioctl$KVM_SET_REGS(r10, 0x4090ae82, &(0x7f0000000240)={[0x3, 0xec, 0x401, 0x3, 0xffff, 0x4, 0x8000000000000001, 0x80000001, 0x1, 0x200, 0x4, 0x6, 0xfffffffffffffffe, 0x10000000003a, 0x4, 0x9], 0x0, 0x2280})
ioctl$KVM_RUN(r10, 0xae80, 0x0) (async)
ioctl$KVM_GET_SUPPORTED_CPUID(r8, 0xc008ae05, &(0x7f0000000300)={0x9, 0x0, [{0xb, 0x0, 0x4, 0x800, 0x9, 0x8, 0x30}, {0x40000000, 0x6, 0x0, 0x80000000, 0x8, 0x3, 0x1}, {0x80000000, 0x7f, 0x1, 0x2, 0x8000, 0x10001, 0x1}, {0x80000000, 0xffffff00, 0x0, 0xbbd, 0x45ef, 0x0, 0x1}, {0x0, 0x8, 0x3, 0x7, 0x40000000, 0x5}, {0x80000000, 0x7, 0x1, 0xb8e1, 0x1, 0xc, 0x5}, {0x80000007, 0x9, 0x4, 0x8, 0x2, 0xc36e, 0x8}, {0x40000001, 0x2, 0x4, 0xffff, 0xf, 0x3, 0xffff}, {0x0, 0x5, 0x2, 0x6, 0x3d9f, 0x6be3, 0x10001}]}) (async)
close_range(r3, 0xffffffffffffffff, 0x0)

587.087439ms ago: executing program 7 (id=5154):
setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0)
r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
r1 = socket(0x10, 0x803, 0x0)
fsetxattr$security_selinux(r1, &(0x7f0000000100), &(0x7f00000001c0)='system_u:object_r:devpts_t:s0\x00', 0x1e, 0x3)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
timer_create(0x0, &(0x7f0000000080)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000))
r2 = inotify_init()
inotify_add_watch(r2, &(0x7f0000000000)='.\x00', 0x14000a7e)
prctl$PR_MCE_KILL(0x35, 0x1, 0x8)
symlink(&(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00')
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0)
r3 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0)
r4 = fsmount(r3, 0x1, 0x0)
openat$cgroup_procs(r4, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0)
r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]})
close_range(r5, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x1000008, 0x31, 0xffffffffffffffff, 0xfffff000)
r6 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000200)={'veth0_to_hsr\x00', &(0x7f0000000280)=@ethtool_cmd={0x8, 0x4, 0x7, 0x7fff, 0x9d, 0x4, 0x4, 0xd, 0x5, 0xe9, 0xf, 0x3, 0xfff8, 0x2, 0x1a, 0x2, [0x7de0, 0x7ff]}})
madvise(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0)

496.87922ms ago: executing program 7 (id=5155):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder1\x00', 0x1002, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
rename(0x0, 0x0)
r3 = socket$inet(0x2, 0x3, 0x6)
ioctl$sock_inet_SIOCSARP(r3, 0x8955, &(0x7f0000000000)={{0x2, 0x4e23, @broadcast}, {0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x18}}, 0x6f631b4376e74f1c, {0x2, 0x0, @rand_addr=0x64010102}})
mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1)
ioctl$sock_inet_SIOCSARP(r3, 0x8953, &(0x7f0000000000)={{0x2, 0x0, @dev}, {0x0, @local}, 0x4a, {0x2, 0x0, @broadcast}, 'syz_tun\x00'})
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
close(r4)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180))
ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local})
r5 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x24c200, 0x0)
ioctl$KDGKBENT(r5, 0x4b46, &(0x7f00000000c0)={0x8, 0x81, 0x1})
write$cgroup_devices(r2, &(0x7f0000000840)=ANY=[@ANYBLOB="1e0308004d6b71ef288563"], 0xffdd)
close_range(r0, 0xffffffffffffffff, 0x0)

390.915263ms ago: executing program 7 (id=5156):
setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, 0x0, 0x0)
r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
mount$fuse(0x0, 0x0, &(0x7f0000000080), 0x0, 0x0)
read$FUSE(r0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000000)=@arm64={0x8, 0x5, 0x2, '\x00', 0x2})
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000280)=[@text16={0x10, 0x0}], 0x1, 0x8, 0x0, 0x0)
r4 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0)
r5 = fsmount(r4, 0x0, 0x0)
fchdir(r5)
r6 = creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39dcca)
write$binfmt_elf32(r6, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c46000000000000000000000000030006000000000000000000380000000000000000191bda0000200021"], 0x69)
execve(&(0x7f0000000800)='./file0\x00', 0x0, 0x0)
r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000940)={0x6, 0x0, &(0x7f0000000300)=[@request_death={0x400c630e, 0xfffffffd}], 0x0, 0x0, 0x0})

381.210713ms ago: executing program 6 (id=5157):
openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x100, 0x0) (async)
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x100, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x8fe67000)
mlockall(0x2)
brk(0x689d80000000) (async)
brk(0x689d80000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x1c0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00'}) (async)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00'})
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='gid_map\x00')
read$FUSE(r1, &(0x7f0000000980)={0x2020}, 0x160e) (async)
read$FUSE(r1, &(0x7f0000000980)={0x2020}, 0x160e)
setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f0000000180)=0x1, 0x4) (async)
setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f0000000180)=0x1, 0x4)
socket$xdp(0x2c, 0x3, 0x0) (async)
r2 = socket$xdp(0x2c, 0x3, 0x0)
r3 = openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
ioctl$FIBMAP(r4, 0x1, &(0x7f0000013c00))
ioctl$KVM_CAP_STEAL_TIME(r4, 0x4068aea3, &(0x7f0000000200))
sendfile(r0, r3, &(0x7f0000000100)=0xe5a, 0x80)
setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, &(0x7f00000001c0)=0x100, 0x4)
setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c)

370.610383ms ago: executing program 6 (id=5158):
r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0x2000000000000000, 0x181440)
write$binfmt_elf64(0xffffffffffffffff, 0x0, 0xe5)
close(0xffffffffffffffff)
execveat(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x1000)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$MON_IOCX_MFETCH(r0, 0xc0109207, &(0x7f0000000180)={0x0, 0x0, 0xffffffff})
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
read$FUSE(r3, &(0x7f00000004c0)={0x2020}, 0x2020)

320.981734ms ago: executing program 6 (id=5159):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0)
r1 = openat$sysfs(0xffffff9c, &(0x7f00000002c0)='/sys/power/wake_unlock', 0x42, 0x80)
write$binfmt_register(r1, &(0x7f0000000180)={0x3a, 'syz1', 0x3a, 'M', 0x3a, 0x6, 0x3a, 'tr6=fdZ', 0x3a, './binderfs/binder1\x00', 0x3a, './file0'}, 0x41)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$inet6_tcp_int(r2, 0x6, 0x18, 0x0, &(0x7f0000000000))
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0)
r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x3)
syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000000000)="2ef36644f7e62e3e672e450f078f29d095abaa960000b890a4f084ef66bafc0c6d8f297812cf66ba410066ef48b800100000000000000f23d00f21f835100000080f23f866baf80cb88ef01480ef66bafc0c66b80c0066efc7442402d8650000c7442406000000000f011c2466ba4200ec2e64f30f5a8e6c000000", 0x7b}], 0x1, 0x52, &(0x7f0000000200)=[@vmwrite={0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x85200000c}], 0x1)
ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000240)={[0x3, 0xec, 0x401, 0x3, 0xffff, 0x4, 0x8000000000000001, 0x80000001, 0x1, 0x200, 0x4, 0x6, 0xfffffffffffffffe, 0x10000000003a, 0x4, 0x9], 0x0, 0x2280})
ioctl$KVM_RUN(r5, 0xae80, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)

320.693754ms ago: executing program 6 (id=5160):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
r1 = socket(0x10, 0x2, 0x0)
recvfrom$inet(r1, 0x0, 0x0, 0x20, 0x0, 0x0)
write(r1, &(0x7f0000000500)="1c0000001a009b8a14e500"/28, 0x1c)
r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r1)
sendmsg$tipc(r1, 0x0, 0x20044010)
r3 = socket(0x400000000010, 0x3, 0x0)
sendmsg$key(r3, 0x0, 0x80)
syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
getsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f0000000000), &(0x7f0000000040)=0x4)
close_range(r0, 0xffffffffffffffff, 0x0)
r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000006c0), 0x0)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r4, 0xc0145401, &(0x7f0000000700)={0xffffffffffffffff, 0x3, 0x3, 0x0, 0x7})
r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3})
mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r5, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x4}, @fda={0x66646185, 0x3fffffffffffffff, 0x0, 0x11}, @fda={0x66646185, 0x6, 0x0, 0x200000000000024}}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0})

320.253494ms ago: executing program 7 (id=5161):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000300)={0x1, 0x3}, 0x4)
setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000080)=0xf3e, 0x62)
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendmsg$tipc(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x73220c8b}], 0x1}, 0x0)
recvmmsg(r1, &(0x7f0000005c00)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000340)=""/138, 0x8a}], 0x1}, 0xffffff2f}, {{0x0, 0x0, 0x0}, 0xfffffffd}], 0x2, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3})
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$IP6T_SO_SET_ADD_COUNTERS(r3, 0x29, 0x41, &(0x7f0000002b00)={'filter\x00', 0x4, [{}, {}, {}, {}]}, 0x68)
mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x6}, @flat=@weak_handle={0x77682a85, 0x1000}, @fda={0x66646185, 0x1, 0x0, 0x15}}, &(0x7f00000001c0)={0x0, 0xffffffffffffffaa, 0x40}}, 0x1000}], 0x0, 0x0, 0x0})

126.791398ms ago: executing program 5 (id=5162):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0)
mount$cgroup(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x400, &(0x7f00000003c0)={[{@subsystem='cpuset'}, {@subsystem='memory'}, {@subsystem='net_prio'}]})
sendfile(r0, r0, 0x0, 0x8000)

106.081708ms ago: executing program 5 (id=5163):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0)
r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x2982, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$inet_tcp_int(r2, 0x6, 0x1b, 0x0, &(0x7f0000000000))
r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x12)
ioctl$UI_DEV_SETUP(r3, 0x405c5503, &(0x7f0000000100)={{0x0, 0x100}, 'syz0\x00'})
ioctl$UI_SET_SNDBIT(r3, 0x4004556a, 0x6)
ioctl$UI_DEV_CREATE(r3, 0x5501)
r4 = syz_clone(0x82000400, 0x0, 0x0, 0x0, 0x0, 0x0)
r5 = syz_pidfd_open(r4, 0x0)
r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL802154_CMD_SET_LBT_MODE(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="04"], 0x14}}, 0x0)
syz_genetlink_get_family_id$nfc(&(0x7f0000000cc0), r7)
r8 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000012c0), r7)
sendmsg$NLBL_MGMT_C_LISTDEF(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010029bd7000fbdbdf250600000006000b001a000000140006000000000000638ed2cf0699bce4000001100001002f6465762f6164686d656d00729bd6731b958ea7651873e202ab75540b905b12bef6dd7dca642956e68554e3e266671ac0dac19e408b44"], 0x40}}, 0x4000090)
ioctl$EXT4_IOC_MIGRATE(r5, 0xff09)
r9 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/devices\x00', 0x0, 0x0)
read$FUSE(r9, &(0x7f00000028c0)={0x2020}, 0x2020)
writev(r1, &(0x7f0000000240)=[{&(0x7f00000020c0)="bbf73d0c1e2044a11659f21eff48036983349dc43874210e104912bffb8f598101112dcc8dcf8700a489490d63834f650565c06a604a6ee660b0b214d783319103131be66a34144db07a78", 0x4b}], 0x1)
accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0xffffffff, @host}, 0x10, 0x0)
ioctl$sock_netdev_private(0xffffffffffffffff, 0x89f3, &(0x7f0000000080)="76b02e")
close_range(r0, r0, 0x0)

743.14µs ago: executing program 5 (id=5164):
r0 = getpid()
r1 = syz_pidfd_open(r0, 0x0)
r2 = pidfd_getfd(r1, r1, 0x0)
ioctl$TIOCL_GETKMSGREDIRECT(0xffffffffffffffff, 0x541c, &(0x7f0000000000))
openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x94)
pipe2$9p(&(0x7f0000001900)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
write$P9_RVERSION(r4, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15)
r5 = dup(r4)
write$FUSE_BMAP(r5, &(0x7f0000000100)={0x18}, 0x18)
write$FUSE_NOTIFY_RETRIEVE(r5, &(0x7f00000000c0)={0x14c}, 0x137)
mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r5}, 0x2c, {[{@cache_readahead}], [], 0x6b}})
truncate(&(0x7f0000000240)='./file0\x00', 0x10001)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x143042, 0x80)
sendfile(r6, r6, 0x0, 0x7a680000)
syz_pidfd_open(r0, 0x0)
setns(r2, 0x4000000)
umount2(&(0x7f0000000080)='./file0\x00', 0x2)

0s ago: executing program 1 (id=5165):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
readv(r0, &(0x7f0000000140)=[{&(0x7f0000001400)=""/4096, 0x1000}, {0x0}], 0x2) (async)
keyctl$restrict_keyring(0x5, 0xfffffffffffffffe, 0x0, 0x0) (async)
request_key(&(0x7f00000000c0)='asymmetric\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='\x00', 0x0) (async)
r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x484840, 0x0)
r2 = dup(r1)
ioctl$PTP_EXTTS_REQUEST2(r2, 0xc0603d0f, &(0x7f0000000000))
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, 0x0)

kernel console output (not intermixed with test programs):

36] audit: type=1400 audit(1758809708.233:43457): avc:  denied  { getopt } for  pid=12869 comm="syz.5.4154" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1
[  306.616072][   T36] audit: type=1400 audit(1758809708.251:43458): avc:  denied  { read write } for  pid=5057 comm="syz-executor" name="loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  306.640563][   T36] audit: type=1400 audit(1758809708.251:43459): avc:  denied  { open } for  pid=5057 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  306.664683][   T36] audit: type=1400 audit(1758809708.251:43460): avc:  denied  { ioctl } for  pid=5057 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  306.690291][   T36] audit: type=1400 audit(1758809708.251:43461): avc:  denied  { mounton } for  pid=12871 comm="syz.5.4155" path="/syzcgroup/unified/syz5" dev="cgroup2" ino=184 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1
[  306.910078][T12876] 9pnet_fd: Insufficient options for proto=fd
[  307.217932][T12902] 9pnet_fd: p9_fd_create_tcp (12902): problem binding to privport
[  307.345090][T12915] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  307.345253][T12915] rust_binder: Failed to allocate buffer. len:1160, is_oneway:false
[  307.441766][T12923] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  307.458309][T12923] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  308.939015][T12967] fuse: Bad value for 'fd'
[  309.052588][T12990] netlink: 5 bytes leftover after parsing attributes in process `syz.5.4194'.
[  309.061806][T12990] 0ªî{X¹¦: renamed from bridge_slave_1 (while UP)
[  309.070034][T12990] 0ªî{X¹¦: entered allmulticast mode
[  309.077724][T12990] A link change request failed with some changes committed already. Interface 
30ªî{X¹¦ may have been left with an inconsistent configuration, please check.
[  309.198475][T13010] rust_binder: 13005 RLIMIT_NICE not set
[  309.198803][T13005] rust_binder: Error while translating object.
[  309.204548][T13005] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM }
[  309.210776][T13005] rust_binder: Failure BR_FAILED_REPLY { source: EPERM } during reply - delivering BR_FAILED_REPLY to sender.
[  309.220113][T13005] rust_binder: Transaction failed: BR_TRANSACTION_COMPLETE my_pid:1267
[  309.243249][T13012] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  309.263402][T13012] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  309.286456][T13018] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  309.295871][T13018] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  309.750978][T13034] tipc: Enabling of bearer <Yth:v> rejected, media not registered
[  309.774070][T13036] overlayfs: failed to resolve './file1/file0': -2
[  309.781374][T13036] overlayfs: failed to clone upperpath
[  310.048906][  T874] Bluetooth: hci0: Frame reassembly failed (-84)
[  310.454418][T13061] netlink: 'syz.1.4219': attribute type 2 has an invalid length.
[  310.496005][T13063] /dev/loop0: Can't lookup blockdev
[  310.531122][T13069] netlink: 'syz.1.4223': attribute type 19 has an invalid length.
[  311.035763][T13075] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4225'.
[  311.045012][T13075] bridge_slave_1: left allmulticast mode
[  311.050692][T13075] bridge_slave_1: left promiscuous mode
[  311.056308][T13075] bridge0: port 2(bridge_slave_1) entered disabled state
[  311.063866][T13075] bridge_slave_0: left allmulticast mode
[  311.069499][T13075] bridge_slave_0: left promiscuous mode
[  311.075436][T13075] bridge0: port 1(bridge_slave_0) entered disabled state
[  312.191682][   T36] kauditd_printk_skb: 332 callbacks suppressed
[  312.191699][   T36] audit: type=1400 audit(1758809713.609:43794): avc:  denied  { create } for  pid=13081 comm="syz.3.4227" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1
[  312.194291][T13082] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4227'.
[  312.197978][   T36] audit: type=1400 audit(1758809713.609:43795): avc:  denied  { write } for  pid=13081 comm="syz.3.4227" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1
[  312.233058][  T464] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  312.247595][  T504] Bluetooth: hci0: command 0x1003 tx timeout
[  312.254262][   T36] audit: type=1400 audit(1758809713.609:43796): avc:  denied  { nlmsg_write } for  pid=13081 comm="syz.3.4227" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1
[  312.287059][   T36] audit: type=1400 audit(1758809713.694:43797): avc:  denied  { create } for  pid=13085 comm="syz.3.4229" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1
[  312.325844][   T36] audit: type=1400 audit(1758809713.722:43798): avc:  denied  { mounton } for  pid=13090 comm="syz.3.4230" path="/472/file0" dev="tmpfs" ino=2658 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1
[  312.348821][   T36] audit: type=1400 audit(1758809713.722:43799): avc:  denied  { mount } for  pid=13090 comm="syz.3.4230" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1
[  312.371274][   T36] audit: type=1400 audit(1758809713.722:43800): avc:  denied  { remount } for  pid=13090 comm="syz.3.4230" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1
[  312.881335][T13095] netlink: 'syz.3.4232': attribute type 27 has an invalid length.
[  312.890556][T13095] sit0: left promiscuous mode
[  312.914525][  T874] ip6_tunnel:  xmit: Local address not yet configured!
[  312.921936][  T874] ip6_tunnel:  xmit: Local address not yet configured!
[  312.936589][  T921] ip6_tunnel:  xmit: Local address not yet configured!
[  312.950217][   T36] audit: type=1400 audit(1758809714.313:43801): avc:  denied  { create } for  pid=13099 comm="syz.3.4234" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1
[  312.975680][   T36] audit: type=1400 audit(1758809714.332:43802): avc:  denied  { create } for  pid=13104 comm="syz.3.4235" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1
[  312.995865][   T36] audit: type=1400 audit(1758809714.341:43803): avc:  denied  { bind } for  pid=13104 comm="syz.3.4235" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1
[  313.043352][  T921] ip6_tunnel:  xmit: Local address not yet configured!
[  313.317895][T13116] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4239'.
[  313.598023][T13124] xt_NFQUEUE: number of total queues is 0
[  313.604360][T13124] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4243'.
[  313.768214][  T921] ip6_tunnel:  xmit: Local address not yet configured!
[  313.779644][T13139] 9pnet_fd: Insufficient options for proto=fd
[  313.848843][  T874] Bluetooth: hci0: Frame reassembly failed (-84)
[  314.583661][T13171] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4259'.
[  314.782572][T13175] bridge0: port 1(bridge_slave_0) entered blocking state
[  314.789745][T13175] bridge0: port 1(bridge_slave_0) entered disabled state
[  314.797353][T13175] bridge_slave_0: entered allmulticast mode
[  314.804359][T13175] bridge_slave_0: entered promiscuous mode
[  314.811485][T13175] bridge0: port 2(bridge_slave_1) entered blocking state
[  314.820229][T13175] bridge0: port 2(bridge_slave_1) entered disabled state
[  314.830205][T13175] bridge_slave_1: entered allmulticast mode
[  314.836566][T13175] bridge_slave_1: entered promiscuous mode
[  314.846366][  T874] tipc: Resetting bearer <eth:syzkaller0>
[  314.863840][  T874] tipc: Disabling bearer <eth:syzkaller0>
[  314.987656][T13175] bridge0: port 2(bridge_slave_1) entered blocking state
[  314.994761][T13175] bridge0: port 2(bridge_slave_1) entered forwarding state
[  315.002047][T13175] bridge0: port 1(bridge_slave_0) entered blocking state
[  315.009106][T13175] bridge0: port 1(bridge_slave_0) entered forwarding state
[  315.018683][  T874] tipc: Disabling bearer <udp:syz1>
[  315.023993][  T874] tipc: Left network mode
[  315.079368][   T46] bridge0: port 1(bridge_slave_0) entered disabled state
[  315.086911][   T46] bridge0: port 2(bridge_slave_1) entered disabled state
[  315.104714][  T329] bridge0: port 1(bridge_slave_0) entered blocking state
[  315.111842][  T329] bridge0: port 1(bridge_slave_0) entered forwarding state
[  315.120717][   T46] bridge0: port 2(bridge_slave_1) entered blocking state
[  315.127796][   T46] bridge0: port 2(bridge_slave_1) entered forwarding state
[  315.176165][T13175] veth0_vlan: entered promiscuous mode
[  315.191391][T13175] veth1_macvtap: entered promiscuous mode
[  315.235322][T13217] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM }
[  315.235358][T13217] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:2
[  315.611478][   T65] usb 2-1: new high-speed USB device number 35 using dummy_hcd
[  315.781990][   T65] usb 2-1: Using ep0 maxpacket: 8
[  315.788141][   T65] usb 2-1: config index 0 descriptor too short (expected 5924, got 36)
[  315.796464][   T65] usb 2-1: config 250 has an invalid interface number: 0 but max is -1
[  315.804786][   T65] usb 2-1: config 250 has an invalid descriptor of length 0, skipping remainder of the config
[  315.815075][   T65] usb 2-1: config 250 has 1 interface, different from the descriptor's value: 0
[  315.825265][   T65] usb 2-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07
[  315.834318][   T65] usb 2-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59
[  315.842880][   T65] usb 2-1: Product: syz
[  315.847092][   T65] usb 2-1: SerialNumber: syz
[  315.854876][   T65] hub 2-1:250.0: bad descriptor, ignoring hub
[  315.861247][   T65] hub 2-1:250.0: probe with driver hub failed with error -5
[  315.984587][  T464] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  316.125707][T13252] 9pnet_fd: Insufficient options for proto=fd
[  316.149793][T13260] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4283'.
[  316.159173][T13259] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  316.187053][   T65] usb 2-1: USB disconnect, device number 35
[  316.911653][  T331] usb 2-1: new high-speed USB device number 36 using dummy_hcd
[  317.082691][  T331] usb 2-1: Using ep0 maxpacket: 32
[  317.100752][  T331] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  317.124781][  T331] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  317.153813][  T331] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00
[  317.164652][  T331] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  317.178108][    C1] ip6_tunnel:  xmit: Local address not yet configured!
[  317.201086][  T331] usb 2-1: config 0 descriptor??
[  317.319152][T13321] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  317.327779][T13321] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  317.452429][T13334] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4303'.
[  317.638327][   T36] kauditd_printk_skb: 340 callbacks suppressed
[  317.638344][   T36] audit: type=1400 audit(1758809718.714:44144): avc:  denied  { ioctl } for  pid=13278 comm="syz.1.4290" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  317.672234][  T331] koneplus 0003:1E7D:2D51.0009: hidraw0: USB HID v0.00 Device [HID 1e7d:2d51] on usb-dummy_hcd.1-1/input0
[  317.858213][   T36] audit: type=1400 audit(1758809718.920:44145): avc:  denied  { ioctl } for  pid=13278 comm="syz.1.4290" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  317.890667][   T36] audit: type=1400 audit(1758809718.948:44146): avc:  denied  { read write } for  pid=5057 comm="syz-executor" name="loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  317.914966][   T36] audit: type=1400 audit(1758809718.948:44147): avc:  denied  { open } for  pid=5057 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  317.916974][T13337] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT }
[  317.939168][   T36] audit: type=1400 audit(1758809718.948:44148): avc:  denied  { ioctl } for  pid=5057 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  317.939675][T13337] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:1336
[  317.948620][   T36] audit: type=1400 audit(1758809718.948:44149): avc:  denied  { read write } for  pid=13336 comm="syz.5.4304" name="uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1
[  318.007105][   T36] audit: type=1400 audit(1758809718.948:44150): avc:  denied  { open } for  pid=13336 comm="syz.5.4304" path="/dev/uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1
[  318.031867][   T36] audit: type=1400 audit(1758809718.948:44151): avc:  denied  { create } for  pid=13336 comm="syz.5.4304" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1
[  318.052029][   T36] audit: type=1400 audit(1758809718.948:44152): avc:  denied  { setopt } for  pid=13336 comm="syz.5.4304" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1
[  318.072373][   T36] audit: type=1400 audit(1758809718.976:44153): avc:  denied  { read } for  pid=13336 comm="syz.5.4304" name="binder1" dev="binder" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1
[  318.182529][T13349] rust_binder: Error in use_page_slow: ESRCH
[  318.182554][T13349] rust_binder: use_range failure ESRCH
[  318.188617][T13349] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false
[  318.199352][T13349] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH }
[  318.215494][T13349] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:1339
[  318.325171][   T31] usb 2-1: USB disconnect, device number 36
[  318.366677][T13361] rust_binder: Error in use_page_slow: ESRCH
[  318.366700][T13361] rust_binder: use_range failure ESRCH
[  318.372939][T13361] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false
[  318.378430][T13361] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH }
[  318.386534][T13361] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:1346
[  318.414009][T13363] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1
[  318.430308][T13363] rust_binder: Write failure EINVAL in pid:1348
[  318.454278][T13371] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  318.469237][T13371] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  318.479920][T13372] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  318.488377][T13372] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  318.498752][T13371] input: syz0 as /devices/virtual/input/input28
[  318.887779][T13406] 9pnet_fd: Insufficient options for proto=fd
[  318.948512][T13415] rust_binder: Write failure EFAULT in pid:1372
[  319.171001][   T31] usb 2-1: new high-speed USB device number 37 using dummy_hcd
[  319.341505][   T31] usb 2-1: Using ep0 maxpacket: 32
[  319.347718][   T31] usb 2-1: config 0 has an invalid interface number: 67 but max is 0
[  319.355861][   T31] usb 2-1: config 0 has no interface number 0
[  319.363319][   T31] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57
[  319.372453][   T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  319.380520][   T31] usb 2-1: Product: syz
[  319.384707][   T31] usb 2-1: Manufacturer: syz
[  319.389328][   T31] usb 2-1: SerialNumber: syz
[  319.396752][   T31] usb 2-1: config 0 descriptor??
[  319.402704][   T31] smsc95xx v2.0.0
[  319.532042][T13425] 9pnet_fd: Insufficient options for proto=fd
[  319.606538][T13422] 9pnet_fd: Insufficient options for proto=fd
[  320.464483][T13439] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  320.473010][   T31] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71
[  320.483957][T13439] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  320.491738][   T31] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD
[  320.509202][   T31] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71
[  320.522240][   T31] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71
[  320.531866][   T31] usb 2-1: USB disconnect, device number 37
[  321.377142][  T921] usb 2-1: new high-speed USB device number 38 using dummy_hcd
[  321.538048][  T921] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  321.548179][  T921] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3
[  321.557805][  T921] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
[  321.566927][  T921] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
[  321.574975][  T921] usb 2-1: SerialNumber: syz
[  321.818237][T13475] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  321.827077][T13475] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  321.845192][T13507] binder: Unknown parameter 'ÿÿ'
[  321.934464][T13507] overlayfs: option "index=on" is useless in a non-upper mount, ignore
[  321.942794][T13507] overlayfs: missing 'lowerdir'
[  322.540463][T13522] rust_binder: Failed to allocate buffer. len:24, is_oneway:false
[  322.899966][T13525] overlay: ./file0 is not a directory
[  322.965966][  T921] usb 2-1: 0:2 : does not exist
[  322.970904][  T921] usb 2-1: unit 5: unexpected type 0x0d
[  322.985213][   T36] kauditd_printk_skb: 475 callbacks suppressed
[  322.985231][   T36] audit: type=1400 audit(2000000001.810:44629): avc:  denied  { read write open } for  pid=13175 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  323.021318][  T921] usb 2-1: USB disconnect, device number 38
[  323.032537][   T36] audit: type=1400 audit(2000000001.810:44630): avc:  denied  { ioctl } for  pid=13175 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  323.037725][T11350] udevd[11350]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory
[  323.062930][   T36] audit: type=1400 audit(2000000001.820:44631): avc:  denied  { ioctl } for  pid=13524 comm="syz.5.4367" path="/dev/binderfs/binder1" dev="binder" ino=8 ioctlcmd=0x6201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1
[  323.099850][   T36] audit: type=1400 audit(2000000001.857:44632): avc:  denied  { read write } for  pid=5057 comm="syz-executor" name="loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  323.126966][   T36] audit: type=1400 audit(2000000001.857:44633): avc:  denied  { open } for  pid=5057 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  323.151567][   T36] audit: type=1400 audit(2000000001.857:44634): avc:  denied  { ioctl } for  pid=5057 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  323.177282][   T36] audit: type=1400 audit(2000000001.867:44635): avc:  denied  { read } for  pid=13533 comm="syz.1.4370" name="binder1" dev="binder" ino=11 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1
[  323.203784][   T36] audit: type=1400 audit(2000000001.867:44636): avc:  denied  { open } for  pid=13533 comm="syz.1.4370" path="/dev/binderfs/binder1" dev="binder" ino=11 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1
[  323.228024][   T36] audit: type=1400 audit(2000000001.904:44637): avc:  denied  { read } for  pid=13535 comm="syz.5.4371" name="ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  323.251283][   T36] audit: type=1400 audit(2000000001.904:44638): avc:  denied  { open } for  pid=13535 comm="syz.5.4371" path="/dev/ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  323.501384][T13574] rust_binder: pid 13574 performed invalid decrement on ref
[  323.508728][T13574] rust_binder: Failure when writing BR_NOOP at beginning of buffer.
[  323.508751][T13574] rust_binder: Read failure Err(EFAULT) in pid:62
[  323.535545][T13583] netlink: 'syz.1.4387': attribute type 27 has an invalid length.
[  323.540829][T13581] fuseblk: Bad value for 'source'
[  323.871232][  T396] usb 2-1: new high-speed USB device number 39 using dummy_hcd
[  324.031182][  T396] usb 2-1: Using ep0 maxpacket: 8
[  324.036873][T13607] rust_binder: Write failure EFAULT in pid:1421
[  324.042156][  T396] usb 2-1: unable to get BOS descriptor or descriptor too short
[  324.057011][  T396] usb 2-1: config 6 has an invalid interface number: 248 but max is 0
[  324.065436][  T396] usb 2-1: config 6 has no interface number 0
[  324.071530][  T396] usb 2-1: config 6 interface 248 has no altsetting 0
[  324.081397][  T396] usb 2-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01
[  324.090546][  T396] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  324.104496][  T396] usb 2-1: Product: syz
[  324.108736][  T396] usb 2-1: Manufacturer: syz
[  324.113329][  T396] usb 2-1: SerialNumber: syz
[  324.204076][T13618] IPv6: Can't replace route, no match found
[  324.292236][T13632] tipc: Started in network mode
[  324.297141][T13632] tipc: Node identity , cluster identity 4711
[  324.303307][T13632] tipc: Failed to obtain node identity
[  324.308982][T13632] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  324.320574][T13634] rust_binder: Error while translating object.
[  324.320613][T13634] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  324.326864][T13634] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1430
[  324.347341][  T396] ums-karma 2-1:6.248: USB Mass Storage device detected
[  324.354612][T13638] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  324.379518][T13638] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  324.392761][T13638] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  324.401703][T13638] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  324.422983][  T396] usb 2-1: USB disconnect, device number 39
[  324.423048][T13648] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4409'.
[  324.941209][T13660] binder: Unknown parameter 'contextÌðÔð[7’'
[  324.972022][T13664] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false
[  324.972051][T13664] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC }
[  324.980506][T13664] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:1434
[  324.999496][T13669] loop9: detected capacity change from 0 to 7
[  325.015197][T13669] Buffer I/O error on dev loop9, logical block 0, async page read
[  325.023193][T13669] Buffer I/O error on dev loop9, logical block 0, async page read
[  325.031032][T13669]  loop9: unable to read partition table
[  325.036750][T13669] loop_reread_partitions: partition scan of loop9 (þ被xüŸÑø éÚ¬§½dG�) failed (rc=-5)
[  325.039262][T11350] Buffer I/O error on dev loop9, logical block 0, async page read
[  325.055140][T13669] Buffer I/O error on dev loop9, logical block 0, async page read
[  325.063674][T11350] Buffer I/O error on dev loop9, logical block 0, async page read
[  325.064276][T13669] /dev/rnullb0: Can't open blockdev
[  325.072308][T11350] Buffer I/O error on dev loop9, logical block 0, async page read
[  325.085268][T11350] Buffer I/O error on dev loop9, logical block 0, async page read
[  325.094241][T11350] Buffer I/O error on dev loop9, logical block 0, async page read
[  325.113088][T13673] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false
[  325.113117][T13673] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC }
[  325.122155][T13673] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:1436
[  325.145467][T13675] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:1438
[  325.155689][T13676] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:1438
[  325.179615][T13678] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4421'.
[  325.198745][T13678] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4421'.
[  325.210261][T13678] 9pnet_fd: Insufficient options for proto=fd
[  325.360794][T13690] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4426'.
[  325.704569][    C1] ip6_tunnel:  xmit: Local address not yet configured!
[  326.352269][T13743] /dev/rnullb0: Can't open blockdev
[  326.359281][T13743] 9pnet_fd: Insufficient options for proto=fd
[  327.021532][T13752] rust_binder: Write failure EFAULT in pid:1472
[  327.169583][T13768] xt_NFQUEUE: number of queues (65532) out of range (got 66665)
[  327.324668][  T396] usb 2-1: new high-speed USB device number 40 using dummy_hcd
[  327.485576][  T396] usb 2-1: config 1 has an invalid interface number: 7 but max is 0
[  327.493592][  T396] usb 2-1: config 1 has no interface number 0
[  327.499736][  T396] usb 2-1: config 1 interface 7 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 8
[  327.509528][  T396] usb 2-1: config 1 interface 7 altsetting 0 bulk endpoint 0xA has invalid maxpacket 8
[  327.519211][  T396] usb 2-1: config 1 interface 7 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7
[  327.531422][  T396] usb 2-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00
[  327.540511][  T396] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  327.548529][  T396] usb 2-1: Product: syz
[  327.552694][  T396] usb 2-1: Manufacturer: syz
[  327.557314][  T396] usb 2-1: SerialNumber: syz
[  327.563232][T13757] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22
[  327.570736][T13757] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22
[  327.793656][T13757] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  327.803678][T13757] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  327.816364][T13757] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  327.827261][T13757] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  327.839821][T13757] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  327.849123][T13757] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  327.860320][T13757] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  327.869489][T13757] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  327.880280][T13757] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  327.889986][T13757] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  328.171792][T13789] netlink: 20 bytes leftover after parsing attributes in process `syz.6.4460'.
[  328.180936][T13788] netlink: 20 bytes leftover after parsing attributes in process `syz.6.4460'.
[  328.215311][T13797] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  328.230669][T13797] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  328.321945][   T36] kauditd_printk_skb: 656 callbacks suppressed
[  328.321962][   T36] audit: type=1400 audit(2000000006.820:45295): avc:  denied  { read write } for  pid=5057 comm="syz-executor" name="loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  328.352378][   T36] audit: type=1400 audit(2000000006.820:45296): avc:  denied  { open } for  pid=5057 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  328.376606][   T36] audit: type=1400 audit(2000000006.820:45297): avc:  denied  { ioctl } for  pid=5057 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  328.402179][   T36] audit: type=1400 audit(2000000006.830:45298): avc:  denied  { read } for  pid=13806 comm="syz.5.4467" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1 trawcon="system_u:object_r:boot_t:s0"
[  328.429079][   T36] audit: type=1400 audit(2000000006.830:45299): avc:  denied  { open } for  pid=13806 comm="syz.5.4467" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1 trawcon="system_u:object_r:boot_t:s0"
[  328.458475][   T36] audit: type=1400 audit(2000000006.830:45300): avc:  denied  { create } for  pid=13806 comm="syz.5.4467" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[  328.479587][   T36] audit: type=1400 audit(2000000006.830:45301): avc:  denied  { write } for  pid=13806 comm="syz.5.4467" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[  328.500181][   T36] audit: type=1400 audit(2000000006.952:45302): avc:  denied  { read } for  pid=13806 comm="syz.5.4467" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1
[  328.523372][   T36] audit: type=1400 audit(2000000006.952:45303): avc:  denied  { open } for  pid=13806 comm="syz.5.4467" path="/dev/ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1
[  328.547330][   T36] audit: type=1400 audit(2000000006.952:45304): avc:  denied  { create } for  pid=13806 comm="syz.5.4467" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1
[  330.277585][T13838] __vm_enough_memory: pid: 13838, comm: syz.5.4476, bytes: 18014402804453376 not enough memory for the allocation
[  330.280003][   T10] usb 2-1: USB disconnect, device number 40
[  330.329604][T13845] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  330.338189][T13845] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  330.911278][T13861] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:1524
[  330.967516][T13868] rust_binder: Error while translating object.
[  330.976972][T13868] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  330.984415][T13868] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1533
[  331.108154][T13873] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  331.126781][T13873] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  331.387760][T13890] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
[  331.437357][T13899] 9pnet: p9_errstr2errno: server reported unknown error 18446744073709
[  331.656375][T13911] bridge0: port 1(bridge_slave_0) entered blocking state
[  331.663557][T13911] bridge0: port 1(bridge_slave_0) entered disabled state
[  331.670687][T13911] bridge_slave_0: entered allmulticast mode
[  331.687233][T13911] bridge_slave_0: entered promiscuous mode
[  331.699890][T13911] bridge0: port 2(bridge_slave_1) entered blocking state
[  331.716048][T13911] bridge0: port 2(bridge_slave_1) entered disabled state
[  331.726520][T13911] bridge_slave_1: entered allmulticast mode
[  331.733191][T13911] bridge_slave_1: entered promiscuous mode
[  331.882573][T13911] bridge0: port 2(bridge_slave_1) entered blocking state
[  331.889677][T13911] bridge0: port 2(bridge_slave_1) entered forwarding state
[  331.892068][T13926] rust_binder: 13926 RLIMIT_NICE not set
[  331.896969][T13911] bridge0: port 1(bridge_slave_0) entered blocking state
[  331.909867][T13911] bridge0: port 1(bridge_slave_0) entered forwarding state
[  331.925443][   T10] rust_binder: 13921: removing orphan mapping 0:1048
[  331.959545][T13928] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  331.970004][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[  331.979535][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[  331.995893][   T13] bridge0: port 1(bridge_slave_0) entered blocking state
[  332.002988][   T13] bridge0: port 1(bridge_slave_0) entered forwarding state
[  332.003956][T13928] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  332.018347][   T13] bridge0: port 2(bridge_slave_1) entered blocking state
[  332.025427][   T13] bridge0: port 2(bridge_slave_1) entered forwarding state
[  332.070813][T13911] veth0_vlan: entered promiscuous mode
[  332.091121][T13911] veth1_macvtap: entered promiscuous mode
[  332.263193][T13933] overlayfs: workdir and upperdir must reside under the same mount
[  332.558098][   T10] usb 8-1: new high-speed USB device number 2 using dummy_hcd
[  332.654045][  T396] usb 2-1: new high-speed USB device number 41 using dummy_hcd
[  332.730402][   T10] usb 8-1: config 14 has an invalid interface number: 21 but max is 0
[  332.738691][   T10] usb 8-1: config 14 has no interface number 0
[  332.744939][   T10] usb 8-1: config 14 interface 21 altsetting 251 bulk endpoint 0xA has invalid maxpacket 32
[  332.755286][   T10] usb 8-1: config 14 interface 21 has no altsetting 0
[  332.764120][   T10] usb 8-1: string descriptor 0 read error: -22
[  332.770339][   T10] usb 8-1: New USB device found, idVendor=c880, idProduct=760e, bcdDevice=35.fc
[  332.779435][   T10] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  332.788840][T13933] raw-gadget.2 gadget.7: fail, usb_ep_enable returned -22
[  332.798284][   T10] usb 8-1: MIDIStreaming interface descriptor not found
[  332.835192][  T396] usb 2-1: Using ep0 maxpacket: 8
[  332.841874][  T396] usb 2-1: unable to get BOS descriptor or descriptor too short
[  332.850502][  T396] usb 2-1: config 6 has an invalid interface number: 248 but max is 0
[  332.858726][  T396] usb 2-1: config 6 has no interface number 0
[  332.864802][  T396] usb 2-1: config 6 interface 248 has no altsetting 0
[  332.873197][  T396] usb 2-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01
[  332.882331][  T396] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  332.890913][  T396] usb 2-1: Product: syz
[  332.895068][  T396] usb 2-1: Manufacturer: syz
[  332.899713][  T396] usb 2-1: SerialNumber: syz
[  333.010635][  T330] usb 8-1: USB disconnect, device number 2
[  333.122501][  T396] ums-karma 2-1:6.248: USB Mass Storage device detected
[  333.171269][  T396] usb 2-1: USB disconnect, device number 41
[  333.660499][   T36] kauditd_printk_skb: 343 callbacks suppressed
[  333.660518][   T36] audit: type=1400 audit(2000000523.837:45648): avc:  denied  { read write } for  pid=13175 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  333.695822][   T36] audit: type=1400 audit(2000000523.865:45649): avc:  denied  { open } for  pid=13175 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  333.721122][   T36] audit: type=1400 audit(2000000523.865:45650): avc:  denied  { ioctl } for  pid=13175 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  333.748520][   T36] audit: type=1400 audit(2000000523.893:45651): avc:  denied  { create } for  pid=13956 comm="syz.1.4511" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1
[  333.769162][   T36] audit: type=1400 audit(2000000523.912:45652): avc:  denied  { write } for  pid=13956 comm="syz.1.4511" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1
[  333.775596][T13957] IPv6: NLM_F_CREATE should be specified when creating new route
[  333.790201][   T36] audit: type=1400 audit(2000000523.912:45653): avc:  denied  { read } for  pid=13956 comm="syz.1.4511" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1 trawcon="system_u:object_r:boot_t:s0"
[  333.818140][T13957] IPv6: NLM_F_REPLACE set, but no existing node found!
[  333.825992][   T36] audit: type=1400 audit(2000000523.912:45654): avc:  denied  { read open } for  pid=13956 comm="syz.1.4511" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1 trawcon="system_u:object_r:boot_t:s0"
[  333.858695][   T36] audit: type=1400 audit(2000000523.930:45655): avc:  denied  { map } for  pid=13956 comm="syz.1.4511" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1 trawcon="system_u:object_r:boot_t:s0"
[  333.886041][   T36] audit: type=1400 audit(2000000523.930:45656): avc:  denied  { execmem } for  pid=13956 comm="syz.1.4511" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[  333.906116][   T36] audit: type=1400 audit(2000000523.930:45657): avc:  denied  { execute } for  pid=13956 comm="syz.1.4511" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1 trawcon="system_u:object_r:boot_t:s0"
[  334.042710][T13969] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4514'.
[  334.219198][T13974] __vm_enough_memory: pid: 13974, comm: syz.1.4516, bytes: 18014402804453376 not enough memory for the allocation
[  334.345147][T13977] cgroup: Need name or subsystem set
[  334.442245][T13983] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=123 sclass=netlink_route_socket pid=13983 comm=syz.6.4519
[  334.456766][T13983] tipc: Started in network mode
[  334.461613][T13983] tipc: Node identity , cluster identity 4711
[  334.467700][T13983] tipc: Failed to obtain node identity
[  334.473175][T13983] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  334.483379][T13983] overlay: Unknown parameter 'euid>00000000000000000000'
[  334.537674][T13991] fuseblk: Unknown parameter 'dons'
[  334.604561][   T10] usb 2-1: new high-speed USB device number 42 using dummy_hcd
[  334.764458][   T10] usb 2-1: Using ep0 maxpacket: 8
[  334.764458][  T396] usb 8-1: new high-speed USB device number 3 using dummy_hcd
[  334.778460][   T10] usb 2-1: unable to get BOS descriptor or descriptor too short
[  334.786846][   T10] usb 2-1: config 6 has an invalid interface number: 248 but max is 0
[  334.795059][   T10] usb 2-1: config 6 has no interface number 0
[  334.801182][   T10] usb 2-1: config 6 interface 248 has no altsetting 0
[  334.809387][   T10] usb 2-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01
[  334.818483][   T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  334.826466][   T10] usb 2-1: Product: syz
[  334.830642][   T10] usb 2-1: Manufacturer: syz
[  334.835256][   T10] usb 2-1: SerialNumber: syz
[  334.934984][  T396] usb 8-1: Using ep0 maxpacket: 16
[  334.941243][  T396] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  334.953306][  T396] usb 8-1: New USB device found, idVendor=0fe6, idProduct=9700, bcdDevice=d1.9a
[  334.962392][  T396] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  334.970425][  T396] usb 8-1: Product: syz
[  334.974588][  T396] usb 8-1: Manufacturer: syz
[  334.979202][  T396] usb 8-1: SerialNumber: syz
[  334.984884][  T396] usb 8-1: config 0 descriptor??
[  334.991037][  T396] dm9601 8-1:0.0: probe with driver dm9601 failed with error -22
[  334.999020][  T396] sr9700 8-1:0.0: probe with driver sr9700 failed with error -22
[  335.057140][   T10] ums-karma 2-1:6.248: USB Mass Storage device detected
[  335.088133][   T10] usb 2-1: USB disconnect, device number 42
[  335.181212][T14005] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  335.192056][T14005] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  335.203294][T14005] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  335.214523][T14005] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  335.217414][T14006] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  335.227484][T13986] overlayfs: missing 'lowerdir'
[  335.234584][T14006] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  335.246408][  T396] usb 8-1: USB disconnect, device number 3
[  335.379883][T14015] overlayfs: failed to clone lowerpath
[  335.453957][T14027] x_tables: unsorted underflow at hook 3
[  335.598647][   T61] I/O error, dev loop5, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 0 prio class 2
[  335.649944][T14043] fuse: Unknown parameter ''
[  335.969981][   T10] usb 2-1: new high-speed USB device number 43 using dummy_hcd
[  336.150200][   T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  336.161309][   T10] usb 2-1: New USB device found, idVendor=056a, idProduct=0319, bcdDevice= 0.00
[  336.170357][   T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  336.179823][   T10] usb 2-1: config 0 descriptor??
[  336.614258][T14094] overlayfs: failed to resolve './file0': -2
[  336.898791][   T65] usb 2-1: USB disconnect, device number 43
[  337.088078][   T10] usb 8-1: new full-speed USB device number 4 using dummy_hcd
[  337.232109][T14115] 9pnet: p9_errstr2errno: server reported unknown error ottle.io_service_bytes_recursive
[  337.249251][   T10] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  337.260011][   T10] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3
[  337.270537][   T10] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00
[  337.279596][   T10] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
[  337.287704][   T10] usb 8-1: SerialNumber: syz
[  337.295214][   T10] usb 8-1: 0:2 : does not exist
[  337.589140][T14122] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  337.597673][T14122] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  337.736090][T14099] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  337.748463][T14099] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  337.763174][   T65] usb 8-1: USB disconnect, device number 4
[  337.768494][T14120] binder: Unknown parameter 'fscontext?}'
[  337.830969][T14127] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state.
[  337.839924][T14128] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state.
[  337.910681][T14133] rust_binder: Fixups oob 165 172 361 173
[  337.910716][T14133] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EINVAL }
[  337.916563][T14133] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  337.924853][T14133] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:40
[  338.249826][   T65] usb 8-1: new high-speed USB device number 5 using dummy_hcd
[  338.378662][T14137] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4571'.
[  338.397599][T14140] rust_binder: 1591: no such ref 1
[  338.402815][   T65] usb 8-1: device descriptor read/64, error -71
[  338.580271][  T921] usb 2-1: new high-speed USB device number 44 using dummy_hcd
[  338.665771][   T65] usb 8-1: device descriptor read/64, error -71
[  338.750867][  T921] usb 2-1: Using ep0 maxpacket: 8
[  338.757725][  T921] usb 2-1: unable to get BOS descriptor or descriptor too short
[  338.766405][  T921] usb 2-1: config 1 has an invalid interface number: 137 but max is 0
[  338.774778][  T921] usb 2-1: config 1 has no interface number 0
[  338.781060][  T921] usb 2-1: config 1 interface 137 has no altsetting 0
[  338.789487][  T921] usb 2-1: New USB device found, idVendor=22b8, idProduct=2d99, bcdDevice=ee.71
[  338.798873][  T921] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  338.807028][  T921] usb 2-1: Product: ⱇ�旺ﳫ�슿�艓喭�꠰�롪棈룽ꛄ��鰉䪔昭㟜➃�䖩�᱔쵘熇槣�星뺆䆢�㧴ᳬ긱�覠�걡⚗⻾위죥矸̶
[  338.824056][  T921] usb 2-1: SerialNumber: �
[  338.931992][   T65] usb 8-1: new high-speed USB device number 6 using dummy_hcd
[  339.007464][   T36] kauditd_printk_skb: 498 callbacks suppressed
[  339.007482][   T36] audit: type=1400 audit(2000000528.856:46156): avc:  denied  { ioctl } for  pid=14132 comm="syz.7.4569" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  339.045716][   T36] audit: type=1400 audit(2000000528.884:46157): avc:  denied  { ioctl } for  pid=14134 comm="syz.1.4570" path="/dev/ppp" dev="devtmpfs" ino=86 ioctlcmd=0x7451 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1
[  339.050803][  T330] hid (null): invalid report_size 28531
[  339.070625][   T36] audit: type=1400 audit(2000000528.884:46158): avc:  denied  { create } for  pid=14134 comm="syz.1.4570" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1
[  339.084089][   T65] usb 8-1: device descriptor read/64, error -71
[  339.096166][   T36] audit: type=1400 audit(2000000528.884:46159): avc:  denied  { write } for  pid=14134 comm="syz.1.4570" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1
[  339.113960][  T330] hid-generic 0003:0008:000F.000B: invalid report_size 28531
[  339.123664][   T36] audit: type=1400 audit(2000000528.884:46160): avc:  denied  { create } for  pid=14134 comm="syz.1.4570" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[  339.143232][  T330] hid-generic 0003:0008:000F.000B: item 0 2 1 7 parsing failed
[  339.157520][  T330] hid-generic 0003:0008:000F.000B: probe with driver hid-generic failed with error -22
[  339.177160][   T36] audit: type=1400 audit(2000000528.884:46161): avc:  denied  { read } for  pid=14134 comm="syz.1.4570" name="vsock" dev="devtmpfs" ino=207 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  339.178649][  T921] usb 2-1: USB disconnect, device number 44
[  339.200112][   T36] audit: type=1400 audit(2000000528.884:46162): avc:  denied  { read open } for  pid=14134 comm="syz.1.4570" path="/dev/vsock" dev="devtmpfs" ino=207 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  339.229590][   T36] audit: type=1400 audit(2000000528.884:46163): avc:  denied  { read write } for  pid=14134 comm="syz.1.4570" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1 trawcon="system_u:object_r:boot_t:s0"
[  339.257482][   T36] audit: type=1400 audit(2000000528.884:46164): avc:  denied  { open } for  pid=14134 comm="syz.1.4570" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1 trawcon="system_u:object_r:boot_t:s0"
[  339.285034][   T36] audit: type=1400 audit(2000000528.884:46165): avc:  denied  { read write } for  pid=14134 comm="syz.1.4570" name="uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1
[  339.422290][   T65] usb 8-1: device descriptor read/64, error -71
[  339.539792][   T65] usb usb8-port1: attempt power cycle
[  339.901946][   T65] usb 8-1: new high-speed USB device number 7 using dummy_hcd
[  339.924341][   T65] usb 8-1: device descriptor read/8, error -71
[  339.997865][  T921] usb 2-1: new high-speed USB device number 45 using dummy_hcd
[  340.063630][   T65] usb 8-1: device descriptor read/8, error -71
[  340.158784][  T921] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  340.169768][  T921] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  340.180905][  T921] usb 2-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf
[  340.189965][  T921] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  340.197971][  T921] usb 2-1: Product: syz
[  340.202221][  T921] usb 2-1: Manufacturer: syz
[  340.206813][  T921] usb 2-1: SerialNumber: syz
[  340.212484][  T921] usb 2-1: config 0 descriptor??
[  340.218741][  T921] usb 2-1: Found UVC 0.00 device syz (18ec:3288)
[  340.225144][  T921] usb 2-1: No valid video chain found.
[  340.328334][   T65] usb 8-1: new high-speed USB device number 8 using dummy_hcd
[  340.350741][   T65] usb 8-1: device descriptor read/8, error -71
[  340.433909][  T921] usb 2-1: USB disconnect, device number 45
[  340.489442][   T65] usb 8-1: device descriptor read/8, error -71
[  340.605489][   T65] usb usb8-port1: unable to enumerate USB device
[  341.004511][T14170] rust_binder: Got transaction with invalid offset.
[  341.004549][T14170] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  341.011470][T14170] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1604
[  341.348072][T14205] rust_binder: Write failure EFAULT in pid:42
[  342.190561][T14239] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4606'.
[  342.207876][T14239] bridge_slave_1: left allmulticast mode
[  342.213543][T14239] bridge_slave_1: left promiscuous mode
[  342.219454][T14239] bridge0: port 2(bridge_slave_1) entered disabled state
[  342.227243][T14239] bridge_slave_0: left allmulticast mode
[  342.232952][T14239] bridge_slave_0: left promiscuous mode
[  342.238755][T14239] bridge0: port 1(bridge_slave_0) entered disabled state
[  342.250535][   T13] Bluetooth: hci0: Frame reassembly failed (-84)
[  342.620364][T14268] netlink: 'syz.5.4612': attribute type 4 has an invalid length.
[  342.628191][T14268] netlink: 3581 bytes leftover after parsing attributes in process `syz.5.4612'.
[  342.758859][    C1] ip6_tunnel:  xmit: Local address not yet configured!
[  343.416053][   T13] Bluetooth: hci1: Frame reassembly failed (-84)
[  343.417285][T14286] batadv_slave_1: entered promiscuous mode
[  343.430373][T14286] batadv_slave_1: left promiscuous mode
[  343.436948][T14286] /dev/rnullb0: Can't open blockdev
[  343.617506][T14301] netlink: 'syz.1.4625': attribute type 29 has an invalid length.
[  343.625381][T14301] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4625'.
[  344.463855][  T464] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  344.463856][T14287] Bluetooth: hci0: command 0x1003 tx timeout
[  344.483855][   T36] kauditd_printk_skb: 378 callbacks suppressed
[  344.483872][   T36] audit: type=1400 audit(2000000533.988:46544): avc:  denied  { read write } for  pid=13175 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  344.514534][   T36] audit: type=1400 audit(2000000533.988:46545): avc:  denied  { open } for  pid=13175 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  344.514568][T14322] veth1_macvtap: left promiscuous mode
[  344.538778][   T36] audit: type=1400 audit(2000000533.988:46546): avc:  denied  { ioctl } for  pid=13175 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  344.545489][T14322] macsec0: entered promiscuous mode
[  344.569841][   T36] audit: type=1400 audit(2000000533.997:46547): avc:  denied  { read write } for  pid=14319 comm="syz.1.4632" name="ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  344.598370][   T36] audit: type=1400 audit(2000000533.997:46548): avc:  denied  { open } for  pid=14319 comm="syz.1.4632" path="/dev/ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  344.621873][   T36] audit: type=1400 audit(2000000533.997:46549): avc:  denied  { ioctl } for  pid=14319 comm="syz.1.4632" path="/dev/ashmem" dev="devtmpfs" ino=201 ioctlcmd=0x7703 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  344.646609][   T36] audit: type=1400 audit(2000000533.997:46550): avc:  denied  { map } for  pid=14319 comm="syz.1.4632" path="/dev/ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  344.670184][   T36] audit: type=1400 audit(2000000534.007:46551): avc:  denied  { read write } for  pid=13175 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  344.694517][   T36] audit: type=1400 audit(2000000534.007:46552): avc:  denied  { read write open } for  pid=13175 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  344.719849][   T36] audit: type=1400 audit(2000000534.007:46553): avc:  denied  { ioctl } for  pid=13175 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  345.034721][T14332] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=40158 sclass=netlink_route_socket pid=14332 comm=syz.7.4636
[  345.266603][T14346] binder: Unknown parameter 'aefcontext'
[  345.295837][T14348] ./cgroup: Can't lookup blockdev
[  345.325260][T14352] rust_binder: Write failure EFAULT in pid:251
[  345.572368][  T464] Bluetooth: hci1: command 0x1003 tx timeout
[  345.572387][  T504] Bluetooth: hci1: Opcode 0x1003 failed: -110
[  345.596499][  T921] usb 2-1: new high-speed USB device number 46 using dummy_hcd
[  345.608935][T14357] rust_binder: Got transaction with invalid offset.
[  345.608973][T14357] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  345.615852][T14357] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1643
[  345.638159][T14361] __vm_enough_memory: pid: 14361, comm: syz.5.4647, bytes: 18014402804453376 not enough memory for the allocation
[  345.659539][T14361] __vm_enough_memory: pid: 14361, comm: syz.5.4647, bytes: 18014402804453376 not enough memory for the allocation
[  345.671651][T14361] __vm_enough_memory: pid: 14361, comm: syz.5.4647, bytes: 18014402804453376 not enough memory for the allocation
[  345.684204][T14361] __vm_enough_memory: pid: 14361, comm: syz.5.4647, bytes: 18014402804453376 not enough memory for the allocation
[  345.696303][T14361] __vm_enough_memory: pid: 14361, comm: syz.5.4647, bytes: 18014402804453376 not enough memory for the allocation
[  345.708372][T14361] __vm_enough_memory: pid: 14361, comm: syz.5.4647, bytes: 18014402804453376 not enough memory for the allocation
[  345.720440][T14361] __vm_enough_memory: pid: 14361, comm: syz.5.4647, bytes: 18014402804453376 not enough memory for the allocation
[  345.732509][T14361] __vm_enough_memory: pid: 14361, comm: syz.5.4647, bytes: 18014402804453376 not enough memory for the allocation
[  345.744581][T14361] __vm_enough_memory: pid: 14361, comm: syz.5.4647, bytes: 18014402804453376 not enough memory for the allocation
[  345.756655][T14361] __vm_enough_memory: pid: 14361, comm: syz.5.4647, bytes: 18014402804453376 not enough memory for the allocation
[  345.774897][  T921] usb 2-1: Using ep0 maxpacket: 16
[  345.784327][  T921] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00
[  345.793890][  T921] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  345.802026][  T921] usb 2-1: Product: syz
[  345.806305][  T921] usb 2-1: Manufacturer: syz
[  345.808572][T14370] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 224, size: 226)
[  345.810991][  T921] usb 2-1: SerialNumber: syz
[  345.811138][T14370] rust_binder: Error while translating object.
[  345.827243][T14370] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  345.833087][  T921] usb 2-1: config 0 descriptor??
[  345.833704][T14370] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1656
[  345.847119][  T921] ftdi_sio 2-1:0.0: FTDI USB Serial Device converter detected
[  345.868826][  T921] usb 2-1: Detected FT-X
[  345.880490][T14372] 9pnet: p9_errstr2errno: server reported unknown error 
[  345.986010][T14376] ./cgroup: Can't lookup blockdev
[  346.016074][T14379] 9pnet: Could not find request transport: f¢&ôô’F0x0000000000000006
[  346.074837][  T921] ftdi_sio ttyUSB0: Unable to read latency timer: -32
[  346.229097][T14383] binder: Bad value for 'stats'
[  346.254200][T14387] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  346.267292][T14387] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  346.379061][T14391] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  346.379210][T14391] rust_binder: Failed to allocate buffer. len:1160, is_oneway:false
[  346.387709][T14391] veth1: entered allmulticast mode
[  346.401556][T14390] veth1: left allmulticast mode
[  346.422905][T14393] netlink: 12 bytes leftover after parsing attributes in process `syz.7.4659'.
[  346.435060][T14393] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT }
[  346.435088][T14393] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:78
[  346.512282][  T921] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0
[  346.723504][   T65] usb 8-1: new high-speed USB device number 9 using dummy_hcd
[  346.734561][   T10] usb 2-1: USB disconnect, device number 46
[  346.742085][   T10] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0
[  346.751853][   T10] ftdi_sio 2-1:0.0: device disconnected
[  346.877429][T14402] fuse: Unknown parameter 'groupò;&ä8oR:”’WŽ�_id'
[  346.883385][   T65] usb 8-1: Using ep0 maxpacket: 8
[  346.889555][T14402] 9pnet_fd: Insufficient options for proto=fd
[  346.896956][   T65] usb 8-1: unable to get BOS descriptor or descriptor too short
[  346.905414][   T65] usb 8-1: config 6 has an invalid interface number: 248 but max is 0
[  346.913607][   T65] usb 8-1: config 6 has no interface number 0
[  346.919767][   T65] usb 8-1: config 6 interface 248 has no altsetting 0
[  346.928442][   T65] usb 8-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01
[  346.937820][   T65] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  346.945843][   T65] usb 8-1: Product: syz
[  346.952088][   T65] usb 8-1: Manufacturer: syz
[  346.956788][   T65] usb 8-1: SerialNumber: syz
[  347.162814][T14423] veth1_macvtap: left promiscuous mode
[  347.175054][T14423] macsec0: entered promiscuous mode
[  347.182070][   T65] ums-karma 8-1:6.248: USB Mass Storage device detected
[  347.239989][   T65] usb 8-1: USB disconnect, device number 9
[  348.277173][T14453] netlink: 188 bytes leftover after parsing attributes in process `syz.5.4679'.
[  348.364295][T14457] netlink: 'syz.5.4681': attribute type 15 has an invalid length.
[  348.599708][T14476] overlayfs: failed to clone upperpath
[  349.137618][T14505] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  349.206991][  T396] usb 8-1: new high-speed USB device number 10 using dummy_hcd
[  349.377561][  T396] usb 8-1: Using ep0 maxpacket: 32
[  349.389049][  T396] usb 8-1: config 0 has an invalid interface number: 184 but max is 0
[  349.414594][  T396] usb 8-1: config 0 has no interface number 0
[  349.426547][  T396] usb 8-1: config 0 interface 184 has no altsetting 0
[  349.436223][  T396] usb 8-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee
[  349.450481][  T396] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  349.459241][  T396] usb 8-1: Product: syz
[  349.463906][  T396] usb 8-1: Manufacturer: syz
[  349.464762][T14527] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4707'.
[  349.481396][  T396] usb 8-1: SerialNumber: syz
[  349.488387][  T396] usb 8-1: config 0 descriptor??
[  349.498171][  T396] smsc75xx v1.0.0
[  349.530916][T14529] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4706'.
[  350.072378][   T36] kauditd_printk_skb: 1267 callbacks suppressed
[  350.072395][   T36] audit: type=1326 audit(2000000539.233:47821): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14530 comm="syz.6.4708" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f74fcf8eec9 code=0x0
[  350.139008][T14497] binder: Unknown parameter ''
[  350.143994][   T36] audit: type=1400 audit(2000000539.289:47822): avc:  denied  { mounton } for  pid=14496 comm="syz.7.4695" path="/dev/binderfs" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1
[  350.169586][   T36] audit: type=1400 audit(2000000539.326:47823): avc:  denied  { ioctl } for  pid=14496 comm="syz.7.4695" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  350.329549][   T36] audit: type=1400 audit(2000000539.476:47824): avc:  denied  { read write } for  pid=5057 comm="syz-executor" name="loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  350.353791][   T36] audit: type=1400 audit(2000000539.476:47825): avc:  denied  { open } for  pid=5057 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  350.378096][   T36] audit: type=1400 audit(2000000539.476:47826): avc:  denied  { ioctl } for  pid=5057 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  350.382421][  T396] smsc75xx 8-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71
[  350.403739][   T36] audit: type=1400 audit(2000000539.505:47827): avc:  denied  { create } for  pid=14534 comm="syz.5.4709" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1
[  350.435459][  T396] smsc75xx 8-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71
[  350.438441][   T36] audit: type=1400 audit(2000000539.514:47828): avc:  denied  { read write } for  pid=5057 comm="syz-executor" name="loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  350.446012][  T396] smsc75xx 8-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind
[  350.470093][   T36] audit: type=1400 audit(2000000539.514:47829): avc:  denied  { open } for  pid=5057 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  350.480287][  T396] smsc75xx 8-1:0.184: probe with driver smsc75xx failed with error -71
[  350.504244][   T36] audit: type=1400 audit(2000000539.514:47830): avc:  denied  { ioctl } for  pid=5057 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  350.527489][  T396] usb 8-1: USB disconnect, device number 10
[  350.662956][T14550] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT }
[  350.662976][T14550] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:1716
[  350.683975][T14552] 9pnet_fd: Insufficient options for proto=fd
[  350.729353][T14559] rust_binder: 1727: no such ref 2
[  350.734551][T14559] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 3
[  350.741681][T14559] rust_binder: 1727: no such ref 3
[  350.757551][T14561] binder: Bad value for 'max'
[  350.778346][T14563] rust_binder: Write failure EINVAL in pid:1731
[  351.128900][T14600] netlink: 'syz.6.4730': attribute type 27 has an invalid length.
[  351.154968][T14600] veth1_macvtap: entered promiscuous mode
[  351.160893][T14600] macsec0: left promiscuous mode
[  351.220791][T14607] netlink: 68 bytes leftover after parsing attributes in process `syz.6.4732'.
[  351.373572][T14615] __vm_enough_memory: 56 callbacks suppressed
[  351.373585][T14615] __vm_enough_memory: pid: 14615, comm: syz.7.4734, bytes: 18014402804453376 not enough memory for the allocation
[  351.679825][  T330] usb 8-1: new full-speed USB device number 11 using dummy_hcd
[  351.800026][T14619] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  351.808604][T14619] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  351.851614][  T330] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64
[  351.862691][  T330] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4
[  351.875546][  T330] usb 8-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00
[  351.884646][  T330] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  351.894027][  T330] usb 8-1: config 0 descriptor??
[  351.899488][T14617] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22
[  351.908586][  T330] usbhid 8-1:0.0: can't add hid device: -22
[  351.914656][  T330] usbhid 8-1:0.0: probe with driver usbhid failed with error -22
[  352.124359][T14617] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  352.132997][T14617] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  352.153663][  T396] usb 8-1: USB disconnect, device number 11
[  352.620287][  T331] rust_binder: 14524: removing orphan mapping 0:24
[  352.640791][T14642] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4743'.
[  352.649827][T14642] bridge_slave_1: left allmulticast mode
[  352.655469][T14642] bridge_slave_1: left promiscuous mode
[  352.661527][T14642] bridge0: port 2(bridge_slave_1) entered disabled state
[  352.668992][T14642] bridge_slave_0: left allmulticast mode
[  352.674808][T14642] bridge_slave_0: left promiscuous mode
[  352.680456][T14642] bridge0: port 1(bridge_slave_0) entered disabled state
[  352.754501][T14650] rust_binder: Error while translating object.
[  352.754535][T14650] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT }
[  352.762607][T14650] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:119
[  352.774322][T14652] netlink: 'syz.6.4746': attribute type 3 has an invalid length.
[  352.785598][T14643] SELinux: failed to load policy
[  352.799059][  T874] Bluetooth: hci0: Frame reassembly failed (-84)
[  352.959791][T14678] rust_binder: Write failure EFAULT in pid:129
[  352.996033][T14688] rust_binder: Write failure EFAULT in pid:139
[  353.003303][T14688] input: syz0 as /devices/virtual/input/input34
[  353.026981][T14688] rust_binder: Error in use_page_slow: ESRCH
[  353.027004][T14688] rust_binder: use_range failure ESRCH
[  353.033113][T14688] rust_binder: Failed to allocate buffer. len:88, is_oneway:false
[  353.039079][T14688] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH }
[  353.047893][T14688] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:139
[  353.085397][T14701] overlayfs: failed to clone lowerpath
[  353.215768][T14708] netlink: 20 bytes leftover after parsing attributes in process `syz.6.4760'.
[  353.228588][T14710] /dev/rnullb0: Can't open blockdev
[  353.264664][T14713] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  353.273651][T14713] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  353.282562][T14713] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found
[  353.290909][T14713] rust_binder: Write failure EINVAL in pid:1749
[  353.292362][T14715] rust_binder: 14715 RLIMIT_NICE not set
[  353.302681][   T65] rust_binder: 14714: removing orphan mapping 0:1048
[  353.316709][T14717] tipc: Started in network mode
[  353.321696][T14717] tipc: Node identity 9a961d7c2f4c, cluster identity 4711
[  353.329077][T14717] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  353.363475][  T874] Bluetooth: hci1: Frame reassembly failed (-84)
[  353.502430][T14720] tipc: Disabling bearer <eth:syzkaller0>
[  353.835362][T14727] __vm_enough_memory: pid: 14727, comm: syz.5.4769, bytes: 18014402804453376 not enough memory for the allocation
[  353.858891][T14729] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  353.867416][T14729] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  353.882457][T14730] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  354.952025][  T504] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  354.952025][T14287] Bluetooth: hci0: command 0x1003 tx timeout
[  355.411537][   T36] kauditd_printk_skb: 497 callbacks suppressed
[  355.411555][   T36] audit: type=1400 audit(2000000544.243:48328): avc:  denied  { read write } for  pid=14741 comm="syz.5.4774" name="binder1" dev="binder" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1
[  355.441580][   T36] audit: type=1400 audit(2000000544.243:48329): avc:  denied  { open } for  pid=14741 comm="syz.5.4774" path="/dev/binderfs/binder1" dev="binder" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1
[  355.467462][   T36] audit: type=1400 audit(2000000544.243:48330): avc:  denied  { create } for  pid=14741 comm="syz.5.4774" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[  355.468982][T14744] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  355.488436][   T36] audit: type=1400 audit(2000000544.243:48331): avc:  denied  { write } for  pid=14741 comm="syz.5.4774" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[  355.500165][T14744] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  355.518047][   T36] audit: type=1400 audit(2000000544.243:48332): avc:  denied  { read } for  pid=14741 comm="syz.5.4774" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[  355.545434][   T36] audit: type=1400 audit(2000000544.243:48333): avc:  denied  { read write } for  pid=5057 comm="syz-executor" name="loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  355.548972][  T464] Bluetooth: hci1: Opcode 0x1003 failed: -110
[  355.575763][  T504] Bluetooth: hci1: command 0x1003 tx timeout
[  355.581913][   T36] audit: type=1400 audit(2000000544.243:48334): avc:  denied  { read write open } for  pid=5057 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  355.609617][   T36] audit: type=1400 audit(2000000544.243:48335): avc:  denied  { ioctl } for  pid=5057 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  355.641221][T14749] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8192 sclass=netlink_route_socket pid=14749 comm=syz.7.4777
[  355.641828][   T36] audit: type=1400 audit(2000000544.243:48336): avc:  denied  { create } for  pid=14743 comm="syz.5.4775" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1
[  355.675589][   T36] audit: type=1400 audit(2000000544.243:48337): avc:  denied  { map } for  pid=14743 comm="syz.5.4775" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=67432 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1
[  355.756576][T14758] rust_binder: Error while translating object.
[  355.756613][T14758] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  355.762865][T14758] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:164
[  355.784857][T14761] netlink: 188 bytes leftover after parsing attributes in process `syz.7.4781'.
[  355.829275][T14763] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT }
[  355.829305][T14763] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:291
[  356.156282][T14776] tmpfs: Bad value for 'nr_inodes'
[  356.178848][  T396] usb 8-1: new high-speed USB device number 12 using dummy_hcd
[  356.297033][T14782] netlink: 'syz.6.4789': attribute type 13 has an invalid length.
[  356.349374][  T396] usb 8-1: Using ep0 maxpacket: 16
[  356.356717][  T396] usb 8-1: config 0 has an invalid interface number: 126 but max is 0
[  356.367136][  T396] usb 8-1: config 0 has an invalid descriptor of length 52, skipping remainder of the config
[  356.374434][T14799] netlink: 5 bytes leftover after parsing attributes in process `syz.6.4793'.
[  356.377768][  T396] usb 8-1: config 0 has no interface number 0
[  356.395460][  T396] usb 8-1: config 0 interface 126 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87
[  356.407819][  T396] usb 8-1: config 0 interface 126 altsetting 0 endpoint 0x87 has invalid maxpacket 34328, setting to 1024
[  356.419354][  T396] usb 8-1: config 0 interface 126 altsetting 0 endpoint 0xA has invalid maxpacket 512, setting to 64
[  356.431480][  T396] usb 8-1: config 0 interface 126 altsetting 0 endpoint 0x4 has invalid maxpacket 26159, setting to 1024
[  356.443358][  T396] usb 8-1: config 0 interface 126 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 1024
[  356.453603][  T396] usb 8-1: config 0 interface 126 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4
[  356.466693][  T396] usb 8-1: New USB device found, idVendor=0763, idProduct=1015, bcdDevice=56.88
[  356.475775][  T396] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  356.485075][  T396] usb 8-1: config 0 descriptor??
[  356.490648][T14771] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22
[  356.497915][T14771] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22
[  356.631940][   T65] usb 6-1: USB disconnect, device number 17
[  356.720672][  T874] Bluetooth: hci0: Frame reassembly failed (-84)
[  356.736873][T14812] fuseblk: Bad value for 'rootmode'
[  356.745304][T14771] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT }
[  356.745333][T14771] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:174
[  356.768646][  T331] usb 8-1: USB disconnect, device number 12
[  356.844238][T14810] bridge0: port 1(bridge_slave_0) entered blocking state
[  356.851390][T14810] bridge0: port 1(bridge_slave_0) entered disabled state
[  356.859333][T14810] bridge_slave_0: entered allmulticast mode
[  356.865971][T14810] bridge_slave_0: entered promiscuous mode
[  356.873848][T14810] bridge0: port 2(bridge_slave_1) entered blocking state
[  356.881933][T14810] bridge0: port 2(bridge_slave_1) entered disabled state
[  356.889930][T14810] bridge_slave_1: entered allmulticast mode
[  356.896390][T14810] bridge_slave_1: entered promiscuous mode
[  356.966561][T14810] bridge0: port 2(bridge_slave_1) entered blocking state
[  356.973654][T14810] bridge0: port 2(bridge_slave_1) entered forwarding state
[  356.980947][T14810] bridge0: port 1(bridge_slave_0) entered blocking state
[  356.988003][T14810] bridge0: port 1(bridge_slave_0) entered forwarding state
[  357.018452][  T874] bridge0: port 1(bridge_slave_0) entered disabled state
[  357.025994][  T874] bridge0: port 2(bridge_slave_1) entered disabled state
[  357.038419][   T13] bridge0: port 1(bridge_slave_0) entered blocking state
[  357.045533][   T13] bridge0: port 1(bridge_slave_0) entered forwarding state
[  357.062174][   T13] bridge0: port 2(bridge_slave_1) entered blocking state
[  357.069247][   T13] bridge0: port 2(bridge_slave_1) entered forwarding state
[  357.089842][T14810] veth0_vlan: entered promiscuous mode
[  357.100327][T14810] veth1_macvtap: entered promiscuous mode
[  357.210152][T14828] overlayfs: failed to clone upperpath
[  357.587569][T14844] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  357.587598][T14844] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:181
[  357.620890][T14851] usb usb9: usbfs: process 14851 (syz.7.4807) did not claim interface 0 before use
[  357.650107][  T396] usb 6-1: new full-speed USB device number 18 using dummy_hcd
[  357.791629][  T396] usb 6-1: device descriptor read/64, error -71
[  357.936592][T14876] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state.
[  357.973255][T14885] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4821'.
[  358.047554][  T396] usb 6-1: device descriptor read/64, error -71
[  358.085457][T14893] 9pnet_fd: Insufficient options for proto=fd
[  358.305474][  T396] usb 6-1: new full-speed USB device number 19 using dummy_hcd
[  358.387091][T14906] rust_binder: Error while translating object.
[  358.387137][T14906] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  358.394088][T14906] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:218
[  358.412984][T14908] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=513 sclass=netlink_route_socket pid=14908 comm=syz.7.4828
[  358.434957][T14908] netlink: 72 bytes leftover after parsing attributes in process `syz.7.4828'.
[  358.466642][  T396] usb 6-1: device descriptor read/64, error -71
[  358.662548][T14915] netlink: 188 bytes leftover after parsing attributes in process `syz.6.4830'.
[  358.686753][T14917] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4831'.
[  358.692284][   T65] usb 8-1: new high-speed USB device number 13 using dummy_hcd
[  358.735261][  T396] usb 6-1: device descriptor read/64, error -71
[  358.853572][  T396] usb usb6-port1: attempt power cycle
[  358.874927][   T65] usb 8-1: Using ep0 maxpacket: 32
[  358.881137][   T65] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  358.891282][   T65] usb 8-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 22
[  358.904335][  T504] Bluetooth: hci0: command 0x1003 tx timeout
[  358.907175][  T464] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  358.911124][   T65] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  358.925562][   T65] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1
[  358.933626][   T65] usb 8-1: SerialNumber: syz
[  358.942454][   T65] cdc_acm 8-1:1.0: Zero length descriptor references
[  358.949184][   T65] cdc_acm 8-1:1.0: probe with driver cdc_acm failed with error -22
[  359.160309][T14908] netlink: 72 bytes leftover after parsing attributes in process `syz.7.4828'.
[  359.172748][   T65] usb 8-1: USB disconnect, device number 13
[  359.240663][  T396] usb 6-1: new full-speed USB device number 20 using dummy_hcd
[  359.273604][  T396] usb 6-1: device descriptor read/8, error -71
[  359.413365][  T396] usb 6-1: device descriptor read/8, error -71
[  359.483987][T14935] overlayfs: lower data-only dirs require metacopy support.
[  359.492602][T14935] binder: Bad value for 'max'
[  359.557422][T14950] netlink: 188 bytes leftover after parsing attributes in process `syz.7.4841'.
[  359.680823][  T396] usb 6-1: new full-speed USB device number 21 using dummy_hcd
[  359.703576][  T396] usb 6-1: device descriptor read/8, error -71
[  359.845944][  T396] usb 6-1: device descriptor read/8, error -71
[  359.926938][T14979] netlink: 188 bytes leftover after parsing attributes in process `syz.7.4850'.
[  359.971096][  T396] usb usb6-port1: unable to enumerate USB device
[  360.022907][T14983] 9pnet_fd: Insufficient options for proto=fd
[  360.516311][T15003] binder: Unknown parameter '²#› µjódÿž¶Ë¥defContext'
[  360.537660][T15006] netlink: 188 bytes leftover after parsing attributes in process `syz.5.4859'.
[  360.976408][   T36] kauditd_printk_skb: 753 callbacks suppressed
[  360.976425][   T36] audit: type=1400 audit(2000000549.423:49091): avc:  denied  { read write } for  pid=13911 comm="syz-executor" name="loop7" dev="devtmpfs" ino=56 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  360.986992][T15016] rust_binder: Failure when writing BR_NOOP at beginning of buffer.
[  361.006990][T15016] rust_binder: Read failure Err(EFAULT) in pid:274
[  361.017636][   T36] audit: type=1400 audit(2000000549.423:49092): avc:  denied  { open } for  pid=13911 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=56 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  361.022419][T15016] rust_binder: BC_CLEAR_DEATH_NOTIFICATION death notification not active
[  361.024384][   T36] audit: type=1400 audit(2000000549.423:49093): avc:  denied  { ioctl } for  pid=13911 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=56 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  361.085533][   T36] audit: type=1400 audit(2000000549.432:49094): avc:  denied  { read write } for  pid=15015 comm="syz.7.4862" name="binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1
[  361.109052][   T36] audit: type=1400 audit(2000000549.432:49095): avc:  denied  { open } for  pid=15015 comm="syz.7.4862" path="/dev/binderfs/binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1
[  361.135246][   T36] audit: type=1400 audit(2000000549.432:49096): avc:  denied  { ioctl } for  pid=15015 comm="syz.7.4862" path="/dev/binderfs/binder0" dev="binder" ino=16 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1
[  361.142001][  T874] Bluetooth: hci0: Frame reassembly failed (-84)
[  361.160883][   T36] audit: type=1400 audit(2000000549.432:49097): avc:  denied  { set_context_mgr } for  pid=15015 comm="syz.7.4862" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1
[  361.187240][T15028] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=15028 comm=syz.6.4867
[  361.190425][   T36] audit: type=1400 audit(2000000549.432:49098): avc:  denied  { create } for  pid=15015 comm="syz.7.4862" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1
[  361.220334][   T36] audit: type=1400 audit(2000000549.432:49099): avc:  denied  { setopt } for  pid=15015 comm="syz.7.4862" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1
[  361.240242][   T36] audit: type=1400 audit(2000000549.432:49100): avc:  denied  { getopt } for  pid=15015 comm="syz.7.4862" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1
[  361.316038][T15031] tipc: Started in network mode
[  361.321208][T15031] tipc: Node identity , cluster identity 4711
[  361.328289][T15031] tipc: Failed to obtain node identity
[  361.333944][T15031] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  361.346042][  T396] usb 8-1: new full-speed USB device number 14 using dummy_hcd
[  361.508229][  T396] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64
[  361.519233][  T396] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4
[  361.532188][  T396] usb 8-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00
[  361.541364][  T396] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  361.550483][  T396] usb 8-1: config 0 descriptor??
[  361.556007][T15020] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22
[  361.564838][  T396] usbhid 8-1:0.0: can't add hid device: -22
[  361.570797][  T396] usbhid 8-1:0.0: probe with driver usbhid failed with error -22
[  361.784024][  T396] usb 8-1: USB disconnect, device number 14
[  362.147508][T15035] netlink: 188 bytes leftover after parsing attributes in process `syz.6.4869'.
[  362.188098][T15044] netlink: 104 bytes leftover after parsing attributes in process `syz.6.4872'.
[  362.209355][T15050] netlink: 7 bytes leftover after parsing attributes in process `syz.6.4873'.
[  362.422678][T15059] __vm_enough_memory: pid: 15059, comm: syz.7.4876, bytes: 18014402804453376 not enough memory for the allocation
[  362.461885][T15065] netlink: 188 bytes leftover after parsing attributes in process `syz.7.4878'.
[  363.365361][  T464] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  363.371563][  T504] Bluetooth: hci0: command 0x1003 tx timeout
[  363.698584][T15102] netlink: 188 bytes leftover after parsing attributes in process `syz.6.4890'.
[  363.917958][T15120] Invalid logical block size (7)
[  364.067814][T15131] netlink: 188 bytes leftover after parsing attributes in process `syz.7.4900'.
[  364.195824][T15141] warn_alloc: 1 callbacks suppressed
[  364.195840][T15141] syz.7.4902: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz7,mems_allowed=0
[  364.230442][T15141] CPU: 1 UID: 0 PID: 15141 Comm: syz.7.4902 Not tainted syzkaller #0 687dd8cc987f259803714ab19d9ffd663b1e6878
[  364.230478][T15141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
[  364.230495][T15141] Call Trace:
[  364.230502][T15141]  <TASK>
[  364.230515][T15141]  __dump_stack+0x21/0x30
[  364.230547][T15141]  dump_stack_lvl+0x10c/0x190
[  364.230569][T15141]  ? __cfi_dump_stack_lvl+0x10/0x10
[  364.230596][T15141]  ? _raw_spin_unlock_irqrestore+0x4a/0x70
[  364.230622][T15141]  dump_stack+0x19/0x20
[  364.230646][T15141]  warn_alloc+0x1bc/0x2a0
[  364.230672][T15141]  ? stack_depot_save_flags+0x38/0x800
[  364.230694][T15141]  ? __cfi_warn_alloc+0x10/0x10
[  364.230719][T15141]  ? kasan_save_track+0x4f/0x80
[  364.230741][T15141]  ? __kmalloc_cache_noprof+0x1a5/0x3c0
[  364.230761][T15141]  ? xskq_create+0x68/0x2a0
[  364.230786][T15141]  ? xsk_init_queue+0xb6/0x120
[  364.230820][T15141]  ? xsk_setsockopt+0x43f/0x6f0
[  364.230843][T15141]  ? do_sock_setsockopt+0x26d/0x400
[  364.230870][T15141]  ? __x64_sys_setsockopt+0x1b8/0x250
[  364.230895][T15141]  ? x64_sys_call+0x2adc/0x2ee0
[  364.230924][T15141]  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  364.230956][T15141]  __vmalloc_node_range_noprof+0x135/0x1420
[  364.230990][T15141]  ? __cfi___vmalloc_node_range_noprof+0x10/0x10
[  364.231019][T15141]  ? avc_has_perm+0x1f2/0x220
[  364.231046][T15141]  ? kasan_save_alloc_info+0x40/0x50
[  364.231073][T15141]  ? __kasan_kmalloc+0x96/0xb0
[  364.231096][T15141]  vmalloc_user_noprof+0x77/0x90
[  364.231123][T15141]  ? xskq_create+0xdb/0x2a0
[  364.231148][T15141]  xskq_create+0xdb/0x2a0
[  364.231173][T15141]  xsk_init_queue+0xb6/0x120
[  364.231199][T15141]  xsk_setsockopt+0x43f/0x6f0
[  364.231224][T15141]  ? __cfi_xsk_setsockopt+0x10/0x10
[  364.231248][T15141]  ? do_futex+0x309/0x500
[  364.231270][T15141]  ? bpf_lsm_socket_setsockopt+0xd/0x20
[  364.231295][T15141]  ? security_socket_setsockopt+0x33/0xd0
[  364.231315][T15141]  ? __cfi_xsk_setsockopt+0x10/0x10
[  364.231340][T15141]  do_sock_setsockopt+0x26d/0x400
[  364.231366][T15141]  ? __cfi_do_sock_setsockopt+0x10/0x10
[  364.231393][T15141]  __x64_sys_setsockopt+0x1b8/0x250
[  364.231420][T15141]  x64_sys_call+0x2adc/0x2ee0
[  364.231449][T15141]  do_syscall_64+0x58/0xf0
[  364.231471][T15141]  ? clear_bhb_loop+0x50/0xa0
[  364.231491][T15141]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  364.231520][T15141] RIP: 0033:0x7f09cff8eec9
[  364.231538][T15141] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  364.231556][T15141] RSP: 002b:00007f09d0dbc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  364.231582][T15141] RAX: ffffffffffffffda RBX: 00007f09d01e5fa0 RCX: 00007f09cff8eec9
[  364.231598][T15141] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000004
[  364.231612][T15141] RBP: 00007f09d0011f91 R08: 0000000000000004 R09: 0000000000000000
[  364.231626][T15141] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000
[  364.231640][T15141] R13: 00007f09d01e6038 R14: 00007f09d01e5fa0 R15: 00007ffd8355cba8
[  364.231658][T15141]  </TASK>
[  364.232890][T15141] Mem-Info:
[  364.536218][T15141] active_anon:42377 inactive_anon:98 isolated_anon:0
[  364.536218][T15141]  active_file:10252 inactive_file:14709 isolated_file:0
[  364.536218][T15141]  unevictable:16394 dirty:21 writeback:7
[  364.536218][T15141]  slab_reclaimable:7273 slab_unreclaimable:76102
[  364.536218][T15141]  mapped:30125 shmem:23475 pagetables:919
[  364.536218][T15141]  sec_pagetables:6 bounce:0
[  364.536218][T15141]  kernel_misc_reclaimable:0
[  364.536218][T15141]  free:1434814 free_pcp:17135 free_cma:0
[  364.581747][T15141] Node 0 active_anon:154296kB inactive_anon:360kB active_file:41008kB inactive_file:58836kB unevictable:65576kB isolated(anon):0kB isolated(file):0kB mapped:120500kB dirty:84kB writeback:28kB shmem:78748kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:6480kB pagetables:3740kB sec_pagetables:24kB all_unreclaimable? no
[  364.614604][T15141] DMA32 free:2960212kB boost:0kB min:19088kB low:23860kB high:28632kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145324kB managed:2965936kB mlocked:0kB bounce:0kB free_pcp:5724kB local_pcp:5656kB free_cma:0kB
[  364.644736][T15141] lowmem_reserve[]: 0 3921 3921
[  364.649648][T15141] Normal free:2795268kB boost:0kB min:25964kB low:32452kB high:38940kB reserved_highatomic:0KB free_highatomic:0KB active_anon:154368kB inactive_anon:360kB active_file:41008kB inactive_file:58836kB unevictable:65576kB writepending:112kB present:5242880kB managed:4016120kB mlocked:0kB bounce:0kB free_pcp:61908kB local_pcp:4580kB free_cma:0kB
[  364.682199][T15141] lowmem_reserve[]: 0 0 0
[  364.686564][T15141] DMA32: 5*4kB (M) 2*8kB (M) 3*16kB (M) 4*32kB (M) 4*64kB (M) 3*128kB (M) 4*256kB (M) 4*512kB (M) 5*1024kB (UM) 5*2048kB (M) 718*4096kB (M) = 2960212kB
[  364.702048][T15141] Normal: 1648*4kB (UME) 5595*8kB (UM) 3365*16kB (UM) 1058*32kB (UME) 193*64kB (UME) 63*128kB (UME) 51*256kB (UME) 18*512kB (UME) 8*1024kB (UME) 8*2048kB (UME) 632*4096kB (UM) = 2794984kB
[  364.720675][T15141] 61215 total pagecache pages
[  364.725361][T15141] 153 pages in swap cache
[  364.729705][T15141] Free swap  = 124016kB
[  364.733842][T15141] Total swap = 124996kB
[  364.737973][T15141] 2097051 pages RAM
[  364.742032][T15141] 0 pages HighMem/MovableOnly
[  364.746707][T15141] 351537 pages reserved
[  364.750882][T15141] 0 pages cma reserved
[  364.756207][T15141] Memory allocations:
[  364.760177][T15141]          0 B        0 init/main.c:1370 func:do_initcalls
[  364.767388][T15141]          0 B        0 init/do_mounts.c:186 func:mount_root_generic
[  364.775476][T15141]          0 B        0 init/do_mounts.c:158 func:do_mount_root
[  364.783129][T15141]          0 B        0 init/do_mounts.c:352 func:mount_nodev_root
[  364.791017][T15141]          0 B        0 init/do_mounts_rd.c:241 func:rd_load_image
[  364.798918][T15141]          0 B        0 init/do_mounts_rd.c:72 func:identify_ramdisk_image
[  364.807532][T15141]          0 B        0 init/initramfs.c:507 func:unpack_to_rootfs
[  364.815444][T15141]          0 B        0 init/initramfs.c:508 func:unpack_to_rootfs
[  364.823338][T15141]          0 B        0 init/initramfs.c:509 func:unpack_to_rootfs
[  364.831309][T15141]          0 B        0 init/initramfs.c:101 func:find_link
[  364.848929][T15155] rust_binder: Write failure EFAULT in pid:318
[  364.965585][T15155] netlink: 68 bytes leftover after parsing attributes in process `syz.7.4905'.
[  365.071540][T15169] binder: Bad value for 'stats'
[  365.087105][T15172] veth1_macvtap: left promiscuous mode
[  365.092741][T15172] macsec0: entered promiscuous mode
[  365.099288][T15172] veth1_macvtap: entered promiscuous mode
[  365.105169][T15172] macsec0: left promiscuous mode
[  365.140851][T15179] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=15179 comm=syz.6.4913
[  365.330548][  T330] usb 6-1: new high-speed USB device number 22 using dummy_hcd
[  365.491595][  T330] usb 6-1: Using ep0 maxpacket: 16
[  365.497866][  T330] usb 6-1: config 0 has an invalid interface number: 41 but max is 0
[  365.506243][  T330] usb 6-1: config 0 has no interface number 0
[  365.512341][  T330] usb 6-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16
[  365.522794][  T330] usb 6-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64
[  365.532744][  T330] usb 6-1: config 0 interface 41 has no altsetting 0
[  365.541053][  T330] usb 6-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a
[  365.550139][  T330] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  365.558252][  T330] usb 6-1: Product: syz
[  365.562415][  T330] usb 6-1: Manufacturer: syz
[  365.567019][  T330] usb 6-1: SerialNumber: syz
[  365.572783][  T330] usb 6-1: config 0 descriptor??
[  365.579561][T15170] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22
[  365.586703][T15170] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22
[  365.809273][T15169] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22
[  365.816798][T15169] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22
[  365.824911][  T331] usb 2-1: new high-speed USB device number 48 using dummy_hcd
[  365.885244][T15193] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=203 sclass=netlink_route_socket pid=15193 comm=syz.6.4918
[  365.967174][T15209] netlink: 188 bytes leftover after parsing attributes in process `syz.6.4924'.
[  365.985544][  T331] usb 2-1: Using ep0 maxpacket: 16
[  365.993176][  T331] usb 2-1: unable to get BOS descriptor set
[  366.000507][  T331] usb 2-1: config 1 interface 0 altsetting 5 bulk endpoint 0x82 has invalid maxpacket 16
[  366.007268][T15213] overlayfs: failed to clone upperpath
[  366.011141][  T331] usb 2-1: config 1 interface 0 altsetting 5 bulk endpoint 0x3 has invalid maxpacket 64
[  366.025709][  T331] usb 2-1: config 1 interface 0 has no altsetting 0
[  366.034717][  T331] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  366.043869][  T330] CoreChips 6-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0
[  366.059739][  T331] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  366.068170][  T331] usb 2-1: Product: syz
[  366.073786][  T331] usb 2-1: Manufacturer: syz
[  366.078462][  T331] usb 2-1: SerialNumber: syz
[  366.085029][T15191] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22
[  366.092402][T15191] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22
[  366.111333][T15224] fuse: Bad value for 'fd'
[  366.111343][T15225] fuse: Bad value for 'fd'
[  366.335844][  T331] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -71
[  366.345969][T15238] netlink: 188 bytes leftover after parsing attributes in process `syz.1.4934'.
[  366.358125][  T331] usb 2-1: USB disconnect, device number 48
[  366.358693][   T36] kauditd_printk_skb: 428 callbacks suppressed
[  366.358707][   T36] audit: type=1400 audit(2000000554.432:49529): avc:  denied  { ioctl } for  pid=15237 comm="syz.1.4934" path="/dev/kvm" dev="devtmpfs" ino=13 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1
[  366.403755][   T36] audit: type=1400 audit(2000000554.479:49530): avc:  denied  { create } for  pid=15237 comm="syz.1.4934" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1
[  366.423582][   T36] audit: type=1400 audit(2000000554.479:49531): avc:  denied  { read } for  pid=15237 comm="syz.1.4934" name="ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  366.451068][   T36] audit: type=1400 audit(2000000554.479:49532): avc:  denied  { open } for  pid=15237 comm="syz.1.4934" path="/dev/ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  366.476326][   T36] audit: type=1400 audit(2000000554.479:49533): avc:  denied  { ioctl } for  pid=15237 comm="syz.1.4934" path="/dev/ashmem" dev="devtmpfs" ino=201 ioctlcmd=0x7705 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  366.502878][   T36] audit: type=1400 audit(2000000554.498:49534): avc:  denied  { read write } for  pid=14810 comm="syz-executor" name="loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  366.527636][   T36] audit: type=1400 audit(2000000554.498:49535): avc:  denied  { open } for  pid=14810 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  366.553537][   T36] audit: type=1400 audit(2000000554.498:49536): avc:  denied  { ioctl } for  pid=14810 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  366.571600][T15241] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  366.588520][   T36] audit: type=1400 audit(2000000554.553:49537): avc:  denied  { read } for  pid=15240 comm="syz.5.4935" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1
[  366.618097][   T36] audit: type=1400 audit(2000000554.553:49538): avc:  denied  { open } for  pid=15240 comm="syz.5.4935" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1
[  366.783974][T15255] SELinux:  policydb magic number 0x20766264 does not match expected magic number 0xf97cff8c
[  366.794315][T15255] SELinux: failed to load policy
[  366.867265][T15259] tap0: tun_chr_ioctl cmd 2147767507
[  366.872814][T15259] tap0: tun_chr_ioctl cmd 1074025677
[  366.878574][T15259] tap0: linktype set to 1
[  366.906477][  T330] CoreChips 6-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9
[  366.923483][  T330] CoreChips 6-1:0.41 (unnamed net_device) (uninitialized): Failed to power up PHY: -71
[  366.933286][  T330] CoreChips 6-1:0.41: probe with driver CoreChips failed with error -71
[  366.942784][  T330] usb 6-1: USB disconnect, device number 22
[  367.100380][T15275] rust_binder: Write failure EFAULT in pid:348
[  367.596061][T15248] 9pnet_fd: p9_fd_create_tcp (15248): problem connecting socket to 127.0.0.1
[  367.662938][T15295] 9pnet_fd: Insufficient options for proto=fd
[  367.688433][T15298] netlink: 188 bytes leftover after parsing attributes in process `syz.5.4953'.
[  367.847028][T15305] binder: Bad value for 'stats'
[  367.968469][T15319] syz.1.4962: attempt to access beyond end of device
[  367.968469][T15319] loop1: rw=0, sector=0, nr_sectors = 1 limit=0
[  367.981387][T15319] exFAT-fs (loop1): unable to read boot sector
[  367.987606][T15319] exFAT-fs (loop1): failed to read boot sector
[  367.993806][T15319] exFAT-fs (loop1): failed to recognize exfat type
[  368.016870][T15324] rust_binder: Write failure EFAULT in pid:369
[  368.027190][T15326] __vm_enough_memory: pid: 15326, comm: syz.1.4964, bytes: 18014402804453376 not enough memory for the allocation
[  368.077250][T15333] rust_binder: Error while translating object.
[  368.077279][T15333] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  368.083799][T15333] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:378
[  368.132039][  T396] usb 6-1: new full-speed USB device number 23 using dummy_hcd
[  368.164251][T15355] rust_binder: Write failure EFAULT in pid:329
[  368.165162][T15352] binder: Bad value for 'defcontext'
[  368.181329][T15359] rust_binder: Failed to allocate buffer. len:64, is_oneway:true
[  368.306731][  T396] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64
[  368.330493][T15367] rust_binder: Write failure EFAULT in pid:394
[  368.364425][  T396] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4
[  368.371961][T15373] overlayfs: failed to clone upperpath
[  368.408162][  T396] usb 6-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00
[  368.434674][  T396] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  368.447883][  T396] usb 6-1: config 0 descriptor??
[  368.453970][T15307] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22
[  368.474152][  T396] usbhid 6-1:0.0: can't add hid device: -22
[  368.480129][  T396] usbhid 6-1:0.0: probe with driver usbhid failed with error -22
[  368.718816][T15307] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  368.730435][T15307] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  368.796664][  T396] usb 6-1: USB disconnect, device number 23
[  368.803323][T15394] netlink: 104 bytes leftover after parsing attributes in process `syz.1.4987'.
[  368.861986][T15394] rust_binder: Write failure EFAULT in pid:413
[  368.988778][T15417] /dev/rnullb0: Can't open blockdev
[  369.142192][T15429] binder: Bad value for 'max'
[  369.159299][T15431] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  369.159326][T15431] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  369.179193][T15436] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  369.202869][T15436] syzkaller0: entered promiscuous mode
[  369.208352][T15436] syzkaller0: entered allmulticast mode
[  369.214168][T15436] tipc: Resetting bearer <eth:syzkaller0>
[  369.222543][T15436] tipc: Resetting bearer <eth:syzkaller0>
[  369.235493][T15436] tipc: Disabling bearer <eth:syzkaller0>
[  369.368457][  T331] usb 2-1: new full-speed USB device number 50 using dummy_hcd
[  369.507143][  T331] usb 2-1: device descriptor read/64, error -71
[  369.645570][   T45] usb 6-1: new high-speed USB device number 24 using dummy_hcd
[  369.762822][  T331] usb 2-1: device descriptor read/64, error -71
[  369.807178][   T45] usb 6-1: config 1 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  369.820018][   T45] usb 6-1: config 1 interface 0 has no altsetting 0
[  369.828147][   T45] usb 6-1: New USB device found, idVendor=056a, idProduct=0059, bcdDevice= 0.40
[  369.837226][   T45] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  369.845258][   T45] usb 6-1: Product: syz
[  369.849455][   T45] usb 6-1: Manufacturer: syz
[  369.854046][   T45] usb 6-1: SerialNumber: syz
[  370.018649][  T331] usb 2-1: new full-speed USB device number 51 using dummy_hcd
[  370.075004][T15450] __vm_enough_memory: pid: 15450, comm: syz.5.5003, bytes: 18014402804453376 not enough memory for the allocation
[  370.093626][   T45] usbhid 6-1:1.0: can't add hid device: -71
[  370.100666][   T45] usbhid 6-1:1.0: probe with driver usbhid failed with error -71
[  370.110289][   T45] usb 6-1: USB disconnect, device number 24
[  370.157215][  T331] usb 2-1: device descriptor read/64, error -71
[  370.166076][T15463] syzkaller0: entered promiscuous mode
[  370.171750][T15463] syzkaller0: entered allmulticast mode
[  370.271387][T15483] 9pnet_fd: Insufficient options for proto=fd
[  370.298945][T15493] 9pnet_fd: Insufficient options for proto=fd
[  370.322001][  T329] Bluetooth: hci0: Frame reassembly failed (-84)
[  370.412991][  T331] usb 2-1: device descriptor read/64, error -71
[  370.530618][  T331] usb usb2-port1: attempt power cycle
[  370.795474][T15534] rust_binder: BINDER_SET_CONTEXT_MGR already set
[  370.800360][T15534] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:80
[  370.840478][T15543] FAT-fs (rnullb0): bogus number of reserved sectors
[  370.856306][T15543] FAT-fs (rnullb0): Can't find a valid FAT filesystem
[  370.892680][  T331] usb 2-1: new full-speed USB device number 52 using dummy_hcd
[  370.926027][  T331] usb 2-1: device descriptor read/8, error -71
[  371.075068][  T331] usb 2-1: device descriptor read/8, error -71
[  371.122619][T15565] __vm_enough_memory: pid: 15565, comm: syz.5.5043, bytes: 18014402804453376 not enough memory for the allocation
[  371.331501][  T331] usb 2-1: new full-speed USB device number 53 using dummy_hcd
[  371.352137][  T331] usb 2-1: device descriptor read/8, error -71
[  371.491283][  T331] usb 2-1: device descriptor read/8, error -71
[  371.607076][  T331] usb usb2-port1: unable to enumerate USB device
[  372.107034][   T36] kauditd_printk_skb: 801 callbacks suppressed
[  372.107049][   T36] audit: type=1400 audit(2016778004.825:50340): avc:  denied  { read write } for  pid=14810 comm="syz-executor" name="loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  372.138047][   T36] audit: type=1400 audit(2016778004.825:50341): avc:  denied  { open } for  pid=14810 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  372.162424][   T36] audit: type=1400 audit(2016778004.825:50342): avc:  denied  { ioctl } for  pid=14810 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  372.193231][   T36] audit: type=1400 audit(2016778004.910:50343): avc:  denied  { create } for  pid=15592 comm="syz.5.5052" anonclass=[userfaultfd] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1
[  372.215006][   T36] audit: type=1400 audit(2016778004.910:50344): avc:  denied  { ioctl } for  pid=15592 comm="syz.5.5052" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=73751 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1
[  372.245495][   T36] audit: type=1400 audit(2016778004.910:50345): avc:  denied  { read } for  pid=15592 comm="syz.5.5052" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1 trawcon="system_u:object_r:boot_t:s0"
[  372.278634][   T36] audit: type=1400 audit(2016778004.910:50346): avc:  denied  { open } for  pid=15592 comm="syz.5.5052" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1 trawcon="system_u:object_r:boot_t:s0"
[  372.306296][   T36] audit: type=1400 audit(2016778004.910:50347): avc:  denied  { ioctl } for  pid=15592 comm="syz.5.5052" path="/dev/rnullb0" dev="devtmpfs" ino=31 ioctlcmd=0x125f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1 trawcon="system_u:object_r:boot_t:s0"
[  372.309508][T15604] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  372.334706][   T36] audit: type=1400 audit(2016778004.919:50348): avc:  denied  { create } for  pid=15592 comm="syz.5.5052" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1
[  372.346615][T15604] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  372.362697][   T36] audit: type=1400 audit(2016778004.919:50349): avc:  denied  { connect } for  pid=15592 comm="syz.5.5052" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1
[  372.513412][  T464] Bluetooth: hci0: command 0x1003 tx timeout
[  372.517166][  T504] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  372.607947][T15614] tmpfs: Bad value for 'nr_blocks'
[  372.683351][  T331] usb 2-1: new high-speed USB device number 54 using dummy_hcd
[  372.694697][T15625] netlink: 188 bytes leftover after parsing attributes in process `syz.5.5060'.
[  372.753824][T15636] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:384
[  372.799759][T15641] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=15641 comm=syz.7.5067
[  372.852512][T15653] netlink: 188 bytes leftover after parsing attributes in process `syz.6.5071'.
[  372.854127][  T331] usb 2-1: Using ep0 maxpacket: 8
[  372.877653][  T331] usb 2-1: unable to get BOS descriptor or descriptor too short
[  372.886587][  T331] usb 2-1: config 6 has an invalid interface number: 248 but max is 0
[  372.895040][  T331] usb 2-1: config 6 has no interface number 0
[  372.901157][  T331] usb 2-1: config 6 interface 248 has no altsetting 0
[  372.909231][  T331] usb 2-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01
[  372.918412][  T331] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  372.926394][  T331] usb 2-1: Product: syz
[  372.930608][  T331] usb 2-1: Manufacturer: syz
[  372.935250][  T331] usb 2-1: SerialNumber: syz
[  372.955784][T15659] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM }
[  372.955812][T15659] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:395
[  372.992408][   T10] usb 6-1: new high-speed USB device number 25 using dummy_hcd
[  373.158644][  T331] ums-karma 2-1:6.248: USB Mass Storage device detected
[  373.174988][   T10] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  373.186591][   T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7
[  373.197861][   T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0
[  373.207702][   T10] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  373.220826][   T10] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  373.229216][  T331] usb 2-1: USB disconnect, device number 54
[  373.229938][   T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  373.245072][   T10] usb 6-1: config 0 descriptor??
[  373.461391][   T45] usb 8-1: new full-speed USB device number 16 using dummy_hcd
[  373.622380][   T45] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64
[  373.633351][   T45] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4
[  373.646607][   T45] usb 8-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00
[  373.655868][   T45] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  373.674814][   T45] usb 8-1: config 0 descriptor??
[  373.681047][   T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0
[  373.684049][T15673] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22
[  373.697548][   T45] usbhid 8-1:0.0: can't add hid device: -22
[  373.700062][   T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0
[  373.703606][   T45] usbhid 8-1:0.0: probe with driver usbhid failed with error -22
[  373.716085][   T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0
[  373.730131][   T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0
[  373.737691][   T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0
[  373.755033][   T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0
[  373.767500][T15684] Bluetooth: received HCILL_WAKE_UP_IND in state 2
[  373.776802][   T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0
[  373.782229][T15684] binder: Bad value for 'max'
[  373.784258][   T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0
[  373.797527][   T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0
[  373.805012][   T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0
[  373.812527][   T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0
[  373.820008][   T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0
[  373.827915][   T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0
[  373.835350][   T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0
[  373.842852][   T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0
[  373.850476][   T10] plantronics 0003:047F:FFFF.000C: No inputs registered, leaving
[  373.861902][   T10] plantronics 0003:047F:FFFF.000C: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0
[  373.945386][   T10] usb 8-1: USB disconnect, device number 16
[  374.448881][   T10] usb 6-1: USB disconnect, device number 25
[  374.474204][T15695] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:125
[  374.751087][   T45] usb 8-1: new high-speed USB device number 17 using dummy_hcd
[  374.921644][   T45] usb 8-1: Using ep0 maxpacket: 32
[  374.927816][   T45] usb 8-1: config 0 has an invalid interface number: 67 but max is 0
[  374.935952][   T45] usb 8-1: config 0 has no interface number 0
[  374.945080][   T45] usb 8-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57
[  374.954161][   T45] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  374.962134][   T45] usb 8-1: Product: syz
[  374.966312][   T45] usb 8-1: Manufacturer: syz
[  374.970902][   T45] usb 8-1: SerialNumber: syz
[  374.976590][   T45] usb 8-1: config 0 descriptor??
[  374.982437][   T45] smsc95xx v2.0.0
[  375.204551][T15722] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=256 sclass=netlink_route_socket pid=15722 comm=syz.6.5094
[  375.309271][T15734] fuse: Unknown parameter 'rootcode'
[  375.689055][  T396] usb 6-1: new full-speed USB device number 26 using dummy_hcd
[  375.849993][  T396] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64
[  375.860951][  T396] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4
[  375.874279][  T396] usb 6-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00
[  375.884205][  T396] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  375.891142][T15749] /dev/loop0: Can't lookup blockdev
[  375.894612][  T396] usb 6-1: config 0 descriptor??
[  375.903894][T15745] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22
[  375.912134][  T396] usbhid 6-1:0.0: can't add hid device: -22
[  375.918157][  T396] usbhid 6-1:0.0: probe with driver usbhid failed with error -22
[  375.925974][  T504] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  376.059301][T15765] netlink: 'syz.6.5112': attribute type 12 has an invalid length.
[  376.061596][T15699] 9pnet: p9_errstr2errno: server reported unknown error 18446744073
[  376.078105][T15699] rust_binder: got new transaction with bad transaction stack
[  376.078129][T15699] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:408
[  376.086360][   T45] smsc95xx 8-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000034: -71
[  376.107034][   T45] smsc95xx 8-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_DATA
[  376.119303][   T45] smsc95xx 8-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71
[  376.130217][   T45] smsc95xx 8-1:0.67: probe with driver smsc95xx failed with error -71
[  376.140480][   T45] usb 8-1: USB disconnect, device number 17
[  376.145912][   T10] usb 6-1: USB disconnect, device number 26
[  376.264882][    C1] ip6_tunnel:  xmit: Local address not yet configured!
[  376.860722][T15800] rust_binder: Write failure EFAULT in pid:441
[  376.904165][   T10] usb 8-1: new high-speed USB device number 18 using dummy_hcd
[  376.929373][T15806] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2072 sclass=netlink_route_socket pid=15806 comm=syz.1.5127
[  376.945425][T15806] overlayfs: The uuid=off requires a single fs for lower and upper, falling back to uuid=null.
[  377.000100][   T65] usb 6-1: new high-speed USB device number 27 using dummy_hcd
[  377.053457][   T10] usb 8-1: device descriptor read/64, error -71
[  377.081997][T15808] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  377.170614][   T65] usb 6-1: Using ep0 maxpacket: 32
[  377.177334][   T65] usb 6-1: config 0 has an invalid interface number: 137 but max is 0
[  377.185665][   T65] usb 6-1: config 0 has no interface number 0
[  377.191764][   T65] usb 6-1: config 0 interface 137 altsetting 1 endpoint 0x8 has invalid wMaxPacketSize 0
[  377.201627][   T65] usb 6-1: config 0 interface 137 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  377.214655][   T65] usb 6-1: config 0 interface 137 has no altsetting 0
[  377.222775][   T65] usb 6-1: New USB device found, idVendor=0c52, idProduct=2861, bcdDevice= 1.37
[  377.231839][   T65] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  377.239858][   T65] usb 6-1: Product: syz
[  377.244020][   T65] usb 6-1: Manufacturer: syz
[  377.248632][   T65] usb 6-1: SerialNumber: syz
[  377.255191][   T65] usb 6-1: config 0 descriptor??
[  377.261781][   T65] ftdi_sio 6-1:0.137: FTDI USB Serial Device converter detected
[  377.269890][   T65] usb 6-1: Detected SIO
[  377.274043][   T65] ftdi_sio ttyUSB0: Overriding wMaxPacketSize on endpoint 8
[  377.282858][   T65] usb 6-1: FTDI USB Serial Device converter now attached to ttyUSB0
[  377.319832][   T10] usb 8-1: device descriptor read/64, error -71
[  377.437442][   T36] kauditd_printk_skb: 3760 callbacks suppressed
[  377.437461][   T36] audit: type=1400 audit(2016778009.835:54098): avc:  denied  { ioctl } for  pid=15779 comm="syz.7.5118" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  377.476134][   T36] audit: type=1400 audit(2016778009.863:54099): avc:  denied  { read write } for  pid=15785 comm="syz.5.5120" name="binder1" dev="binder" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1
[  377.479758][T15786] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  377.499590][   T36] audit: type=1400 audit(2016778009.863:54100): avc:  denied  { open } for  pid=15785 comm="syz.5.5120" path="/dev/binderfs/binder1" dev="binder" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1
[  377.509455][T15786] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  377.533250][   T36] audit: type=1400 audit(2016778009.863:54101): avc:  denied  { node_bind } for  pid=15785 comm="syz.5.5120" saddr=172.20.20.16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[  377.547008][   T65] usb 6-1: USB disconnect, device number 27
[  377.563605][   T36] audit: type=1400 audit(2016778009.863:54102): avc:  denied  { read write } for  pid=15785 comm="syz.5.5120" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  377.578364][   T65] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0
[  377.590861][   T36] audit: type=1400 audit(2016778009.863:54103): avc:  denied  { open } for  pid=15785 comm="syz.5.5120" path="/dev/raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  377.600128][   T10] usb 8-1: new high-speed USB device number 19 using dummy_hcd
[  377.624353][   T36] audit: type=1400 audit(2016778009.863:54104): avc:  denied  { ioctl } for  pid=15785 comm="syz.5.5120" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  377.632077][   T65] ftdi_sio 6-1:0.137: device disconnected
[  377.657196][   T36] audit: type=1400 audit(2016778009.929:54105): avc:  denied  { ioctl } for  pid=15779 comm="syz.7.5118" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  377.675799][T15819] overlayfs: failed to clone lowerpath
[  377.687291][   T36] audit: type=1400 audit(2016778010.042:54106): avc:  denied  { ioctl } for  pid=15779 comm="syz.7.5118" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  377.717752][   T36] audit: type=1400 audit(2016778010.051:54107): avc:  denied  { mounton } for  pid=15818 comm="syz.6.5130" path="/522/file0" dev="tmpfs" ino=2860 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1
[  377.721858][T15819] overlayfs: failed to clone upperpath
[  377.810148][   T10] usb 8-1: device descriptor read/64, error -71
[  378.066000][   T10] usb 8-1: device descriptor read/64, error -71
[  378.188270][   T10] usb usb8-port1: attempt power cycle
[  378.361073][T15827] overlayfs: failed to resolve './file7/../file0': -2
[  378.361244][T15828] overlayfs: failed to resolve './file7/../file0': -2
[  378.439015][  T396] usb 6-1: new high-speed USB device number 28 using dummy_hcd
[  378.556257][   T10] usb 8-1: new high-speed USB device number 20 using dummy_hcd
[  378.578622][   T10] usb 8-1: device descriptor read/8, error -71
[  378.609527][  T396] usb 6-1: Using ep0 maxpacket: 8
[  378.615975][  T396] usb 6-1: unable to get BOS descriptor or descriptor too short
[  378.624899][  T396] usb 6-1: unable to read config index 0 descriptor/start: -61
[  378.632502][  T396] usb 6-1: can't read configurations, error -61
[  378.717157][   T10] usb 8-1: device descriptor read/8, error -71
[  378.769442][  T396] usb 6-1: new high-speed USB device number 29 using dummy_hcd
[  378.929341][  T396] usb 6-1: Using ep0 maxpacket: 8
[  378.935729][  T396] usb 6-1: unable to get BOS descriptor or descriptor too short
[  378.944498][  T396] usb 6-1: unable to read config index 0 descriptor/start: -61
[  378.952083][  T396] usb 6-1: can't read configurations, error -61
[  378.958464][  T396] usb usb6-port1: attempt power cycle
[  378.971992][   T10] usb 8-1: new high-speed USB device number 21 using dummy_hcd
[  378.995514][   T10] usb 8-1: device descriptor read/8, error -71
[  379.132832][   T10] usb 8-1: device descriptor read/8, error -71
[  379.214090][T15834] fuse: blksize only supported for fuseblk
[  379.220449][T15834] incfs: Error accessing: ./file0.
[  379.225630][T15834] incfs: mount failed -20
[  379.249133][   T10] usb usb8-port1: unable to enumerate USB device
[  379.323695][  T396] usb 6-1: new high-speed USB device number 30 using dummy_hcd
[  379.345313][  T396] usb 6-1: Using ep0 maxpacket: 8
[  379.351603][  T396] usb 6-1: unable to get BOS descriptor or descriptor too short
[  379.360346][  T396] usb 6-1: unable to read config index 0 descriptor/start: -61
[  379.367953][  T396] usb 6-1: can't read configurations, error -61
[  379.505042][  T396] usb 6-1: new high-speed USB device number 31 using dummy_hcd
[  379.526557][  T396] usb 6-1: Using ep0 maxpacket: 8
[  379.533015][  T396] usb 6-1: unable to get BOS descriptor or descriptor too short
[  379.541872][  T396] usb 6-1: unable to read config index 0 descriptor/start: -61
[  379.549497][  T396] usb 6-1: can't read configurations, error -61
[  379.555876][  T396] usb usb6-port1: unable to enumerate USB device
[  379.819865][T15842] rust_binder: Error while translating object.
[  379.819897][T15842] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT }
[  379.826178][T15842] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:451
[  380.223242][T15871] 9pnet_fd: Insufficient options for proto=fd
[  380.325608][  T396] usb 2-1: new high-speed USB device number 55 using dummy_hcd
[  380.485469][  T396] usb 2-1: Using ep0 maxpacket: 16
[  380.492973][  T396] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06
[  380.502297][  T396] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  380.510321][  T396] usb 2-1: Product: syz
[  380.514539][  T396] usb 2-1: Manufacturer: syz
[  380.519156][  T396] usb 2-1: SerialNumber: syz
[  380.525732][  T396] r8152-cfgselector 2-1: Unknown version 0x0000
[  380.532024][  T396] r8152-cfgselector 2-1: config 0 descriptor??
[  380.772369][T15879] rust_binder: Error while translating object.
[  380.772403][T15879] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  380.778615][T15879] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:417
[  380.941026][T15892] SELinux:  Context system_u:object_r:devpts_t:s0 is not valid (left unmapped).
[  380.968152][T15863] fuse: Bad value for 'fd'
[  380.975613][  T396] r8152-cfgselector 2-1: USB disconnect, device number 55
[  381.245866][T15909] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL }
[  381.245891][T15909] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:436
[  381.429477][T15913] input: syz0 as /devices/virtual/input/input35
[  381.456915][T15913] netlink: 'syz.5.5163': attribute type 11 has an invalid length.
[  381.464796][T15913] netlink: 'syz.5.5163': attribute type 1 has an invalid length.
[  381.523247][T15916] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI
[  381.535883][T15916] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
[  381.544309][T15916] CPU: 1 UID: 0 PID: 15916 Comm: syz.5.5164 Not tainted syzkaller #0 687dd8cc987f259803714ab19d9ffd663b1e6878
[  381.555955][T15916] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
[  381.566055][T15916] RIP: 0010:iter_file_splice_write+0xace/0x11b0
[  381.572416][T15916] Code: 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 97 d3 e6 ff 49 8b 1e 49 c7 06 00 00 00 00 48 83 c3 08 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 73 d3 e6 ff 4c 8b 1b 48 8b 3c 24
[  381.592481][T15916] RSP: 0018:ffffc9000776f820 EFLAGS: 00010202
[  381.598567][T15916] RAX: 0000000000000001 RBX: 0000000000000008 RCX: ffff88811b0acc00
[  381.606643][T15916] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 7ffffffffffeffff
[  381.614621][T15916] RBP: ffffc9000776fa40 R08: ffff8881f6f72240 R09: 1ffff1103edee448
[  381.622596][T15916] R10: 1ffff1103edee44b R11: 0000000000000fd8 R12: dffffc0000000000
[  381.630572][T15916] R13: 7ffffffffffeffff R14: ffff888144bda810 R15: ffff888144bda800
[  381.638554][T15916] FS:  00007f913ac4a6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
[  381.647491][T15916] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  381.654082][T15916] CR2: 000000110c343019 CR3: 000000012037a000 CR4: 00000000003526b0
[  381.662068][T15916] Call Trace:
[  381.665346][T15916]  <TASK>
[  381.668280][T15916]  ? __cfi_iter_file_splice_write+0x10/0x10
[  381.674200][T15916]  ? __kasan_kmalloc+0x96/0xb0
[  381.678975][T15916]  ? __kasan_check_write+0x18/0x20
[  381.684110][T15916]  ? __cfi_iter_file_splice_write+0x10/0x10
[  381.690012][T15916]  direct_splice_actor+0x279/0x4b0
[  381.695143][T15916]  splice_direct_to_actor+0x4fe/0xbc0
[  381.700524][T15916]  ? __cfi_direct_splice_actor+0x10/0x10
[  381.706167][T15916]  ? __cfi_splice_direct_to_actor+0x10/0x10
[  381.712158][T15916]  do_splice_direct+0x182/0x270
[  381.717020][T15916]  ? __cfi_do_splice_direct+0x10/0x10
[  381.722408][T15916]  ? __cfi_direct_file_splice_eof+0x10/0x10
[  381.728325][T15916]  ? security_file_permission+0x2e/0xc0
[  381.733912][T15916]  ? rw_verify_area+0xac/0x230
[  381.738690][T15916]  do_sendfile+0x5c8/0xfb0
[  381.743125][T15916]  ? vfs_writev+0xcf0/0xcf0
[  381.747631][T15916]  ? __se_sys_futex+0x28f/0x300
[  381.752490][T15916]  __x64_sys_sendfile64+0x193/0x1f0
[  381.757698][T15916]  ? __cfi___x64_sys_sendfile64+0x10/0x10
[  381.763430][T15916]  ? switch_fpu_return+0x12/0x20
[  381.768382][T15916]  x64_sys_call+0xa26/0x2ee0
[  381.772989][T15916]  do_syscall_64+0x58/0xf0
[  381.777419][T15916]  ? clear_bhb_loop+0x50/0xa0
[  381.782101][T15916]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  381.788013][T15916] RIP: 0033:0x7f9139d8eec9
[  381.792439][T15916] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  381.812056][T15916] RSP: 002b:00007f913ac4a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[  381.820488][T15916] RAX: ffffffffffffffda RBX: 00007f9139fe5fa0 RCX: 00007f9139d8eec9
[  381.828476][T15916] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 0000000000000009
[  381.836457][T15916] RBP: 00007f9139e11f91 R08: 0000000000000000 R09: 0000000000000000
[  381.844443][T15916] R10: 000000007a680000 R11: 0000000000000246 R12: 0000000000000000
[  381.852431][T15916] R13: 00007f9139fe6038 R14: 00007f9139fe5fa0 R15: 00007ffc72325cb8
[  381.860421][T15916]  </TASK>
[  381.863444][T15916] Modules linked in:
[  381.867604][T15916] ---[ end trace 0000000000000000 ]---
[  381.879477][T15916] RIP: 0010:iter_file_splice_write+0xace/0x11b0
[  381.885801][T15916] Code: 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 97 d3 e6 ff 49 8b 1e 49 c7 06 00 00 00 00 48 83 c3 08 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 73 d3 e6 ff 4c 8b 1b 48 8b 3c 24
[  381.905588][T15916] RSP: 0018:ffffc9000776f820 EFLAGS: 00010202
[  381.911708][T15916] RAX: 0000000000000001 RBX: 0000000000000008 RCX: ffff88811b0acc00
[  381.919742][T15916] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 7ffffffffffeffff
[  381.927811][T15916] RBP: ffffc9000776fa40 R08: ffff8881f6f72240 R09: 1ffff1103edee448
[  381.935831][T15916] R10: 1ffff1103edee44b R11: 0000000000000fd8 R12: dffffc0000000000
[  381.943814][T15916] R13: 7ffffffffffeffff R14: ffff888144bda810 R15: ffff888144bda800
[  381.951854][T15916] FS:  00007f913ac4a6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
[  381.960807][T15916] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  381.967407][T15916] CR2: 00007f913ac29d58 CR3: 000000012037a000 CR4: 00000000003526b0
[  381.975402][T15916] Kernel panic - not syncing: Fatal exception
[  381.981713][T15916] Kernel Offset: disabled
[  381.986030][T15916] Rebooting in 86400 seconds..