last executing test programs: 2.181550095s ago: executing program 0 (id=953): creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182) (async) creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182) pipe2$9p(&(0x7f00000001c0), 0x0) (async) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="38010000fe0000"], 0x138) mount$9p_fd(0x0, &(0x7f0000000400)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000003c0), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB="2c63616368653d6c6f6f73652c00b3237550e8c4ce379d86faf37159a0720b296857794e53515a2334f55bbd4001c896c3167287b5ae8d232a82c024fed6bfaf8844ea8b264b08a4388da64dcfcaea76ada8b6c49f2e30b28966f3ba7bf66cb5c7c85c27b8080c7658cd739e0849731b636d5bb5558703d32ceee1b420b87db14803ca97e61d543d21b52122d49ada3054c9ff5cf91b4d9e8f8adcb75851bd57552e1a668975580af8a91af2ae8e4a5eef580f76183143bc09645c3a85bd2853"]) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r3, &(0x7f00000029c0)={0x2020}, 0x2020) (async) read$FUSE(r3, &(0x7f00000029c0)={0x2020}, 0x2020) 2.127397629s ago: executing program 0 (id=954): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f0000000a40)=ANY=[@ANYBLOB="f28f3cbc3d8e7ec6ab27ab393bba6e97d29648b8b0c597caa377651787d933933efac34010a312a69530a636d811073420271d0e2bf671255208322a5a643d6ff1d74369b08ec80870b4977e474f841d7e164398ae4238aca47d4fdb163b8c154028873a960f3033cc600260c4e8e2ce3014fdd3ccf36b809b8faeb2b07a918ddb87027580ed2564c7d6456988b3fd27d8d2eb452f2f76c5233efa62a8fed79921eb84fd712523d7c5d1d79a8bd0401de7bb980da8d50640a53a0d0b1d1ab37522f9ea0805b5bee7f20be813f1b870baa1e391fc2c36fbb603245cccbeda33006f92a96f1a573fe42b8e6292780c2fe58f3ab4587326b3932c14c96de6d9d11801f3e34e8268ccf1e2abb99a2a2983b4cdafdb250198e8adb70c77212507923266e16839b2de4a35c6b3d9f62c2a91913dcacad289592a87d87f80e04821a2c010e721072ad7fc1544850dc8ae1f7c580965a047730b33eed084f8596605b6bddfbc3a64db0168fcb786766d6032f8b9437c7a609586871b075a7e5d51743867bff10bc416561f"], 0x8) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) r2 = socket$key(0xf, 0x3, 0x2) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, 0x0, 0x400c8c0) sendmsg$key(r2, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000400)={&(0x7f0000000040)={0x2, 0xa, 0xfc, 0x0, 0x7, 0x0, 0x70bd28, 0x25dfdbfe, [@sadb_x_filter={0x5, 0x1a, @in=@empty, @in=@rand_addr=0x64010100, 0x2c, 0x30}]}, 0x38}}, 0x40408c0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f00000006c0)={@ptr={0x70742a85, 0x2, 0x0, 0x0, 0x0, 0x15}, @flat=@binder={0x73622a85, 0x100, 0xfffffffffffffffc}, @flat=@weak_binder={0x77622a85, 0x0, 0x2}}, &(0x7f0000000180)={0x0, 0x28, 0x40}}, 0x400}], 0x0, 0x0, 0x0}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) recvmmsg(r6, &(0x7f00000076c0)=[{{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000003400)=""/4096, 0x1000}, 0xfffffffb}, {{&(0x7f0000000800)=@qipcrtr, 0x80, &(0x7f0000000a00)=[{&(0x7f0000007b40)=""/129, 0x81}, {&(0x7f0000000dc0)=""/48, 0x30}], 0x2}, 0x4}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000cc0)=""/127, 0x7f}, 0xfff}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000e00)=""/99, 0x63}, 0xfffffeff}], 0x5, 0x0, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_STATUS(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="e6cf26f9637175b2c475417c0600"], 0x14}, 0x1, 0x0, 0x0, 0xc800}, 0x20000000) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f00000006c0), 0x140, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r9, 0x4068aea3, &(0x7f0000000fc0)={0xa8, 0x700}) r10 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) write$vga_arbiter(r10, &(0x7f0000000040)=ANY=[@ANYBLOB="7472796c6f636b20e358d44f305f98"], 0xf) syz_genetlink_get_family_id$nfc(&(0x7f0000000440), r7) r11 = syz_genetlink_get_family_id$nbd(&(0x7f0000000700), r7) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r11, @ANYBLOB="0100c923418e9d00002326bd7000fbdbdf25000000000700010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x184}, 0x80) sendmsg$NBD_CMD_STATUS(r4, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x4c, r11, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x1ff}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x1000}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x78, 0x0, &(0x7f00000005c0)="2078b98d43d07572a4ac17e070f6e4ffd39036ed0af8f56f83f08868dc94aaa397e205bed98262b9477344a911603869d9f3f877f7aad1829f47273251843760bd7de0381b6c857784bb0ddc8246ff1e0b7dfd6c9276f53e0667dd48f28b11c6b3c7ee46fd0943891c35a7ab3218af5c438fbfe1deef085e"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001fc0)={0x14, 0x0, &(0x7f0000000080)=[@increfs_done={0x40106308, 0x1}], 0x0, 0x0, 0x0}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000340), r5) 1.86218843s ago: executing program 0 (id=960): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0) syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x87, 0xa7, 0x0, 0x40, 0x3f0, 0x307, 0x1, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x10, [{{0x9, 0x4, 0x17, 0x0, 0x2, 0x44, 0xb1, 0xb6, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x3ff}}, {{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xfe}}]}}]}}]}}, 0x0) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) (async) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x5) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) write$cgroup_devices(r1, &(0x7f0000000280)=ANY=[], 0xfffffd81) mmap(&(0x7f0000018000/0x2000)=nil, 0x2000, 0xa8ca3411d3c26009, 0x13, r0, 0x22e7c000) 1.247617309s ago: executing program 3 (id=966): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) userfaultfd(0x1) (async) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0) (async) ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0) socket$inet(0x2, 0x4, 0x1) (async) socket$inet(0x2, 0x4, 0x1) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$F2FS_IOC_GARBAGE_COLLECT(r3, 0x4004f506, &(0x7f0000000040)) (async) ioctl$F2FS_IOC_GARBAGE_COLLECT(r3, 0x4004f506, &(0x7f0000000040)) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_GET_DEBUGREGS(r4, 0x8080aea1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0xdd9a000) openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x40d00, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$HIDIOCGDEVINFO(r6, 0x801c4803, &(0x7f0000000380)=""/173) ioctl$SIOCSIFHWADDR(r6, 0x8914, 0x0) write$tun(r7, &(0x7f00000002c0)=ANY=[], 0xfdef) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) (async) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) syz_usb_connect(0x2, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 888.620748ms ago: executing program 1 (id=974): openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167342, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000000)=0x200, 0x4) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000180)=0x2, 0x4) sendmmsg$inet6(r0, &(0x7f0000002900)=[{{&(0x7f00000001c0)={0xa, 0x4e21, 0x0, @dev}, 0x1c, 0x0}}], 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x8000000, 0x19) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) creat(&(0x7f0000000100)='./cgroup\x00', 0x2c) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) madvise(&(0x7f000042f000/0x800000)=nil, 0x80fd00, 0x15) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_STATUS(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB="c9f77ee7adaa32e354823471d4f994baeb7b5ef4264c", @ANYRES16=0x0, @ANYBLOB="04002dbd7000fcdbdf2505000000"], 0x14}, 0x1, 0x0, 0x0, 0xc800}, 0x20000000) fsetxattr$trusted_overlay_upper(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000740)={0x0, 0xfb, 0x10e, 0x0, 0x0, "ef413486d25da8860942107bd775a7ec", "54666bbc177f035b1e2c061b4a9ac86b62ea2588fa766619eebf2a4253bc31aca155afe609975808e7ab4b1cfe93863b63de357a1b794ee5e9eacdff922baef0e3aff223c734271f7be4f7a9c9684d5b70486eb44fd5c965cceb834cf15ab3f444e132bf59c10eb6d68c8e3fb1362a272187edfc467eb5e687cdb00e0e8344ec329c3260be0e53470f1cbb9eb64e1b9cfae80e2dfeebc6bb4f4974e78176bc060a498c6919ef81e65697bedcc4eb88374f382e0fc2338da7d9f5881636547717360d070aaa31b717493d29e299b30e9e4f352285d5e004fac37aa904c9dabe183ad8d939c12e7b67d8ef246065eff44b741e1179c1552c1806"}, 0x10e, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000180)={0x14, 0x2, 0x6, 0x201, 0x0, 0x0, {0x3}}, 0x14}, 0x1, 0x0, 0x0, 0xc040}, 0x0) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f00000004c0)={0x3, &(0x7f0000000340)=[{0x20, 0x0, 0x1, 0xfffff00c}, {0x20, 0x0, 0x0, 0xdffff010}, {0x6}]}, 0x10) sendmmsg$unix(r4, &(0x7f00000000c0), 0x3f, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000440), r3) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000700), r3) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x1c, r6, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x184}, 0x80) r7 = userfaultfd(0x801) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x511}) ioctl$UFFDIO_WRITEPROTECT(r7, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000800000/0x800000)=nil, 0x802000}, 0x2}) fcntl$dupfd(r7, 0x0, r7) socket$inet6_tcp(0xa, 0x1, 0x0) 801.542625ms ago: executing program 1 (id=976): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x60303, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f00000000c0)="8689d46205a34100bf2bbe11a5ce7839edaf02afe39ead95913e9c4f8cf31440006769ebdf12cfacae8e8c03f5db079da7d9", 0x32, 0x0, 0x0, 0x0) r3 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) r4 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f0000000240)='asymmetric\x00', &(0x7f0000000180)=@keyring={'key_or_keyring:', r3}) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0xf000, 0x2000, &(0x7f0000f9a000/0x2000)=nil}) r6 = dup(r5) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4400ae8f, &(0x7f0000000000)=@arm64={0x1, 0xa, 0xb, '\x00', 0x7}) ioctl$KVM_SET_VAPIC_ADDR(r6, 0x4008ae93, &(0x7f00000002c0)=0x10000) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) setpriority(0x1, 0x0, 0xe) prlimit64(0x0, 0xd, &(0x7f0000000140)={0xa, 0x88}, 0x0) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) ioctl$KVM_CAP_SPLIT_IRQCHIP(r7, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, 0xa8c}) r8 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) getpriority(0x1, r8) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x50, 0x0, &(0x7f0000000580)="c6547e22bade76f1a03b79e954ee20b943f7fe47218a02ff8ba942478a7b6946e9a6000055002cc15e854564e7d309f20d222f9220c8d9b1b0d196137252587ab1794808000000000000000e647c2e70"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 747.88153ms ago: executing program 3 (id=977): syz_create_resource$binfmt(0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$uhid(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) write$UHID_CREATE(r0, &(0x7f0000000540)={0x0, {'syz0\x00', 'syz1\x00', 'syz1\x00', 0x0, 0x0, 0x6, 0x4, 0x9, 0x9, 0xc08}}, 0x120) 746.22906ms ago: executing program 3 (id=978): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x2, 0x4, 0x4, 0x7, 0x2, 0x0, 0x70bd27, 0x25dfdbfc}, 0x10}}, 0x4000040) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x60140, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000580)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f00000005c0), 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8c) r3 = openat$incfs(r2, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x40046721, 0x0) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x0, 0x32, 0x0, 0xffffd000) ioctl$KVM_SET_SIGNAL_MASK(r5, 0x4004ae8b, &(0x7f0000000840)) r6 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000240), 0x60a00, 0x0) r7 = accept$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @multicast2}, &(0x7f0000000140)=0x10) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f00000001c0)={0x2, &(0x7f0000000180)=[{0x1, 0x0, 0x2, 0x800}, {0xe5, 0x80, 0x5, 0x5}]}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r6, 0xe6683000) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r8 = socket$xdp(0x2c, 0x3, 0x0) fcntl$getownex(r2, 0x10, &(0x7f0000000200)) getsockopt$XDP_MMAP_OFFSETS(r8, 0x11b, 0x1, &(0x7f0000000000), &(0x7f00000000c0)=0x80) 745.1651ms ago: executing program 3 (id=979): ftruncate(0xffffffffffffffff, 0x398a0bdb) r0 = add_key$user(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) keyctl$invalidate(0x15, r0) r1 = openat$binfmt_register(0xffffff9c, &(0x7f0000000180), 0x1, 0x0) write$binfmt_register(r1, &(0x7f00000001c0)={0x3a, 'syz3', 0x3a, 'M', 0x3a, 0x7fffffff, 0x3a, '/_', 0x3a, '\\x@K-^{', 0x3a, './file0'}, 0x30) add_key$keyring(0x0, &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000001c40)='./binderfs/binder0\x00', 0x0, 0x0) syz_clone(0x102311, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005938d74010973077339600000001090212000100001e000904"], 0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r3, 0x0, 0x0) getsockopt$bt_BT_VOICE(r3, 0x112, 0xb, 0x0, &(0x7f0000000180)) pipe(&(0x7f0000000000)={0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r4, 0x0, r5, 0x0, 0x80, 0x4) sendmmsg$sock(r5, &(0x7f0000001bc0)=[{{&(0x7f0000000100)=@isdn={0x22, 0x3c, 0x6, 0x2, 0x8}, 0x80, &(0x7f0000001480)=[{&(0x7f0000000200)="adb546afce2f77d6f1cbdb13bc1e08c03dbad79e1dd5bf1ad0f374bacf79e5bd768d3b189dfa753066b1b13c0b6e824ae18ef45c1373b294137a6a4da670563654b2490e07c173154bbfda1da4cdeb7509bdeee6a7a2f2787f749f4ee8a157c7b7dfa0b04288818bf091ea707dd2eae2362da03246eb060ea5f6bedd175817bb282fe5bf65f49543ea27f25a9450671060d17cea3619f6d017a7110b3c8862c2d8165819d513", 0xa6}, {&(0x7f00000002c0)="00a6fdc4d73352a6f8f2b4616033d1f00c7d695c766d82111973e39a3fae0644c5761c10252d70", 0x27}, {&(0x7f0000000300)="892961336b5073cf13c8c9138dd05807b480f111c190ac36220cb5b01ad27adcc88f249b2a48521970578a1ec7a8ae009708531469307211555f7fb821b89cbb9556f98766ff99389bf163e2b8d64567f3fcc891c00247461906b4005bc72f4911598e733d49211df3bd8381dc5bcffa101fb98bf228e218b30ce5b8173a832f9af9c1e90270cdc5526b35ad9b13777ee3754f7ab025f3a1a15ececd2d37f37edb674c010fa3fb659e0f9a9815a156e05d195f6699e0eff0aef43a1eabe4b06d80050655", 0xc4}, {&(0x7f0000000400)="846365995f3c520122f388b5a1041874270f6c54082dcb6e77af1527b73f5e088e37c45dd9e257f63d84fedcbc11db6182c0c987190eb4675f9bed18bc83ae32957cd9bb14eab94824fc58fb589bfd2f1b99a1bf64cf32cecbfc5282a7937f79daf239e3bb1de917eff0940b23bf3e3ae9d33dcb7e", 0x75}, {&(0x7f0000000480)="7cc241ccaa986cd6c55e21b1af91fc04c38b2afb05607c8de14b505ebff5fdeef39b4e22838d70394b118d823afeb82d4f414e41792a96798a28a9c0df61edcaa1a8d8434f437af8c3409d908b66cc8133fdca7098dacd4ce0827073f6eb55eb169bb935694ba39aad701b448b44ba720c1bd6dc7d67c05437710d92e479a496b3f4d0ccf37a144a3c961e4a70735e2ebe7541781ca07afa932831500e68fa41e8c9967b2d2078b7c210b1c31bbf0c6c1fb93796b2a7d048790c0aaf3f100ff728847005eb62089a3f9a19e143423d9a26c58f825ca7aba18d29cc41cc74bc35325a164ecb6f420f3a572204823de68be7a00f3929ce9426769fca6d356216dbcb5051c7dc14cbbba44649ab4d8f5e1a0e1602efd2ee5ee3f3d6844e211ca2c08dedec5e6755d34ba0a91564eb8f4d04a2738d5fe41339a65b57c63e9c0d7895f6df65e96bc17db0eae1b3c888880fee62aafcecad7fb68c4d23c056b14402881789f751d6977406e7d2e5532bcc30bcde13634af66c93e9b3b4251b9f5373038366aa491ac689de48f5f58e6e40489fa6d2ad5bbe1c5c2dfd497bd761abf68dc9b7372b7b8c6d404cfe5ddfec22e078245e19112b5313195921de7ef053b38b47870638a556a236e789a6a2c5e167ef5441e3d69fcb51f84933d4388d27f2ab1b2bcce43d7c1c2f05f2c22b7d1e76de29ba10b753e4e4691ea6ac2a324eab5e3bfcc8c67888d7225d3bfda34f8d58535fca2d0dd9b8764e7c6dce63b901f6beb5fc2fbe738121f35fcc929839db64c7bde6e844f96584eee5416979341e5e1801f4f634f3638d1499953b825b862467858aea89a8a9fc668327ac310c2fb38cb0a376a6841a557bea6ed46fe7ae49c5144185fcb1532555513830a44829ba23582d35e7d866a5defb413660195881c345d1a72374b1401307f2b5d5f05c0aea477e16fc9f3915206e9bd9073d2e2c2a8b9328cf0648d84ec3bd7153ca420df614de93825dcfedc18a74656ac2abc5bfa71e6483a066aadaa7f51b8b1b6a771ae3250ed750b3158e8f687e45abec55b1205da4e885b776af573643d194775f5fa8c0353ed8cb9ba77acf6ac7ea3fbacb1872937b6e49d1502f68eb3cb45f8480d8cfd0196fe153b5e8954f11a5f69c1c83447e8c651e23ae1c2b0e5e0df6119721d435b4b43b74bf460846ebb61aaa45b9102e2003878904b3630371e47162f0b8d652c79d7464a0adccd2f9c06a49c2a2b2934995e2fd49526ebdf68c8a6fd7b2009fec52859ec5ff669c1c34962e5d97e68d19fb120c0136c17fd36d92ed77a2abba12e5f1612af4baba3e5dff4a6c94436bc37b56c562432ef18b4c40b643b483e4ff677b4ec021a9119d1ffbffec09782889eef0b9a075b09005be36af482551687e4a2a44f3cf9d838acb64091eec9180ccf3ace113d80b3fe0f0a2791e6957891f75f2f8c2aeb5152ff475f084bdc1d16191ebe5f5c8584e5b1a9dca02521eab39d1107fb9d9d50ab11e1b4ed9c2bba66fe4c1da9ce8bccedc3998a2b7485029bc08824e28a0df578b7d84d53a52328c889899a59266f33278396279e54282d7a7a8daaae740b00652fe3cc5c1bbe6e42b8013c2e10e7b308cfbb728febed27006cbb7d65c16e407f7d1f1512cbd9b459951d774840768e0d03a92af2f518e1b807c8826a6977144db5992fa72028d3463bbe158e552a1ecc76d118bfa100aeaefddd1d1afd1189ed83a9505ca85397f96528cd0a0f8514d5ac6da1f581a3e5f00f093cfb4e1ab10a95d3ffaf41acc75dc308a3d4be6857273e6d64e509d038e200609cd4faeb2127d0e1dcc05b291268f684e41bb801f08e072026b056351432e307eac70692ec31106e05c7120b6a14c9f7ceb27aef561261b953532fed093f623fa506904670179c88f4ac214ec39af747f32a65ee4b0ec03dde37dfb8870645434401f62d1ba1cb7f32e9158d6fe45f07a2bd94f2bedbbb182bc9d918cff530cd3c8aa775d8dd68297d3ac433d5ed625ee65f288244215ede2887301f34ffad5c597bb8c4d5397ebe4d8684080ae1e07068dd9099ae2284dbb83b3485455d1d7208205b2259aad32b6d42eada35480d2db1b241e8f0f2a63a96cb8cb2425d11bf151cf07956d82f0f538b63ea7585a12fd940676607f7e3c4bb69c9fd5df5ace92b53206a0c3d0733143e29408c70a76cb6b117d9f3e5fbdc561808897918d0ab70f626491bd28db71ef757d8bdb321fe91f2220f9338148b52982c38835eb76e470bac432802c8b24b422c47e9d87a3040e29744447f21b42aeb3199d0cafa26c41e05b7414a561f462a13fccea024f3a290978b12cd5ba81f680af030fd056703405af5adc0bd6005b7e5937fbe415e670b167453ac66e254e1bfd6df96759741606d2e0b0c099c21ddba58d7be8937a58fdaebfc58cfa64ca1beb172757f9b1edcd8a10ede064127d3f9a2d7fd5e599019081e2b195645bb592011eaa1f37a83731082687e01cb4d62a5311be77a990755837e765a8159f248a455928d5e339a32b77ba3cd91136bdb82ad3389a3c267708d3f36730e1ff2b53ed7ff8a5db487b3d2a1c7878f4c38fe6ba082de319db5707b4b2eb8403fac909b4dc8ccbc5ef9e00ce31a391c042aa434f38656576b430563f37a66703da745125529fa3907054bcdb87c25610e8486045402d74fee327c200645486a7cdf9c5f283fb1a81fcaa93373bc232b617f316375150ae4d4197e2fb1080f7a10c33594fec2e1fde6650751969be0255b9e76308361c6de68b1a75ea83cdb49d7c40186316f1d01cd49abbce69dc7d8028f522f1ea5c18d1248a3df877cb9e6321b00fcb99808ca9ae4479ee0eb8342c3807f8d05ff4d00d9d9bc0564b3b75c2a427d71da30c933d404b02a68b7f518cee08640af3782fdb7012acc65ae2899595ea060d7fa510bbbf2c292d6da19ae6b62dd9f74200ca80f66c99cd3946db22617b5b0bdfda49d46baa5f9c2135db793bb108b00c379fc95af514614db0e0dc76df49192e9333f82be637f60207199846bd0959ec5c166efb81d25c1ae67f1b7169d1f7d6cd382b0d468b53be8c2ff896427651cdb51b04a01fca8d6bbd0be8df99b69f6c3cc692bdfc5b157b3d0c1c552ff7d8ec73d124ec8fc4b9605bda45036c010014e6bed9286c75e9fe282ea8001d7fe44e19410a46dd136cfb3f96fe76a8a52501bab288062a3997d583a29fbea00a47c67e9673195fabbe28d527597b540566cac64e4424a36da0060bd438e080cd65998b9f0e953df9c16b1879b65609f47b324a72e1c93d9cbcb33b479c13d484338c548aa9bd4fae0bdf0305f59b492ef7a1613773b72875c054196290f88bcf6cc95783d94ac4e24602c94a7b9dc5f662d8e11ad86c866dcf9d26c1179a2f091d51c9d05a6f33ba2a5e33e918c499aa885192385ee939abeed593db43ab5723d924bae7138314fa3e3e42902ac29ff753dd997b0ba2a0edfb31fc7d4d9223e8ef04d2b37bc2133b93bbe240e691a7544a788f044278a96b4c7cb76bc38e63b2412d88e4a201ea6dd93e84cffba2c51003e0689a3eb4d9144f2f2df5adf28de0f676af07f420e8254a18cd24aed218eff776e65cfcc38e79147d2b2ae041de5c3b8237acd95f998df06dbaa95178f8e4e35669a773a8500c629ee898a1ac79fbded84a1c976c07361488529e684d229f1eb419fd38ee363dbcc4142f3efc94198eeb726ed40f787ec0fbc9dc07b7d0a973785c94c3244d6a6dc65356398302d0e9db08bd8aeb194cc8b127bc5601a13c89c261848f87986127cbf91a9f469d90ec881c122fcb8306e435b1b53cbe066203b36e8f53bee2b01b731abbccdbca50038a7d62d500b7023aab11d9f42cdb3d168338cade62f90a3e9ad47b86a39a0041a68efe00c44a068633fcd2dc2c5f5b890f66b4f1e88d3d2b666d7d653e1817ddb8fc6d3a5d7e67800c3a15d547a92d4d333d42c5f07cfea18725e97addcaf1db6b470a498c8848da7058702e4d42df70224111d446d4838b199c63a96ff8dd32fc9873ee51bcbd07a234e70f4a519efc988bd322c1a69f0b972af15d08576a669c4b8c179899f46692eb6dab9202fae35539b793777d1885cccf01bc88853542fe186a2a011e0fd6853f0aad42777e02344de987c887d5ff03f9c3cf2b86d4c9de4c0b41de35a4412bd1eeb6e87594324ec08fc95840435afe9741adc88e732c5b3747da18a029b3e5be955891d12d29e5a455ce5b6e869f616d29732336f88ee053923a121c24697283ed401f4e2352d3dfece7396f38dc190e3f7e3450387f43f7793706e2cb7c6ef7973f05356cf477330710da4a7a997d8a88a8f92f99311fe6b805d92c0fb984c70b7a213214696a6f8a82f3f7d5c491db1bfe91ff830df906e312bfb4aec110e898056f7ffbbe9b96d628c8660bec3597e2da9d2a4815aca080f30be7f0b7d8bcd8c476f74fe04cf94850a511ae7291bccbaf89ee3e7d1b0213162d046e863f76217ab56c698caca68c137b0e81adbf1ee1b6263e55564d51e4558efe9c5e51a26110f1caa489e2dc85fa781cf268555b10eb4a020380a4bd959f42d6013e24da9ff97d7101ec88effa6c27820eef073cf7195a61bb0832a32f40e7a83638c61dc42a1460bfbbf064e219d37444f0628c2333ddb03bac6ee60eb76b40546d8dce4bfe849754eceed34a381ab7fe3e9629c3730a5639f672d90908c7dc8526ab567eb48336461c6aeac51affe36ba98eff4daf142274bbf7686f4ecdfa7d08c064b8485dec899373adf8cc9ffce0142f8d4ed71e875db4ba08d134a72fe618274b6d2983ca777b52ee6570700a8877ddc236b68e67d3ba285643d4d8eeeb1eca02ea19f1685f60bf2cd65aeab0908723a2209073929f65241f94ddcf381623e2a62d2b08c53beee22074a6fb2d0a338842006a685c3140d56ff31d946d828454c306a2ed45e558ba5b500d1c5b5bce0e2697287fb3b40004f319fc8b3659932f11ea3a91d964f0561b2af8c8bda73a318aecefb0e92a9d07fca6c14f77b56fc251420ca872e3896cfeb066f8af9a5205cf7c148cf8c3af2335ad62d8436ae3fc2c825445377f1f9bc7a865764e7ce793d4c9a2ea7cc5266ffc24d736234ddd2d7b3f6dfd3874489ae350a9bd05d6971700e2ec99966ccd8aede4feae6b784e0bc7cc540d8a7cd4e7c118ab7e21c863a2aff366581cfc97610af33e9c7fc30c3ee83c58e9a2d03d2ab2d936ccaeb37dfae6017c1874755867a23f960f9972a06fbba8900f6f503afcfb485c43db254cbbc481cb5650dae78e6214808debe5e3f061077661b73c7d391dbf992f42df144020728f912bc2015ace727d118ae19b442fa04c94e83f60a69106940a0ce418b110c81078e72fb1423a71b9f6641bf9dd939adeba55730c798cf61ede41e00acad23c8c0eacf38846019ef23df9edbf2da5c9fa868ee44c9e1da2d4e5e6337120f345ddb60040b2c3ca07900dac86430558ffde03aa37b68b5116f74c7a13b06951af1d1e38e4e32ea99bbce91273636562fe6784ed825ba0d525ffb5aca90f78cf3ad6aa4680eeaef1c9e088044773ba2164779d9f3866812624f2220828520b8c97517a5e5ec7a69a00a6304ab674e1b32e5f69a208e9055f6fdf92efada12dbe92c6176c230a42cd2fef8c2af44d9729ed0495cecc2cd6f4d3858a1563c2a5261895de347264d47cf198871b61aa162b3963f8f08b812e31295c2ea211043e65c014df334e63803b6ed6cd2130c6bfdf3bd0d6b3d5", 0x1000}], 0x5, &(0x7f0000001500)=[@mark={{0x14, 0x1, 0x24, 0x9}}, @mark={{0x14, 0x1, 0x24, 0x8}}, @timestamping={{0x14, 0x1, 0x25, 0x2e6d}}, @mark={{0x14, 0x1, 0x24, 0x6}}, @txtime={{0x18, 0x1, 0x3d, 0xfffffffffffffffd}}, @timestamping={{0x14, 0x1, 0x25, 0x2}}], 0x90}}, {{&(0x7f00000015c0)=@generic={0x27, "e93fb81a2d0b3e7a62820a2dd6b61af196cdedc2d04db5e7b8cef247afc82d473fb33113656f01e9d602ac5d579001c251e2de10936b84657933e2778b5f479ca5914e38fe421f90a63bfa247f0e2a661bb556563f2e05ebdb4883c44ff462c6a863a5fe5b1670e556cd4bf99589eea6f8abf743beac07e1cd74c3a0c7f5"}, 0x80, &(0x7f0000001ac0)=[{&(0x7f0000001640)="5d1d4a0b3eb968fa129f5093410bcc5b79ae10558e97fc8b8f462191652d37c93270044d22a1abe27e0138ae729d17aeb3bd463a985b9018a752d86e49f2246ec738f5a04281c0e6f5cf832f6e4a5fc898b2b2f36deb8a40aa9221b19b6474e7376d59cbe5880543545fba7769ce653b06dacd6b7506554060055594f55f7c551520442f350c2c86116230ed9b357a454d243aef562c724b1ba6bde6cc34d13fa6b93469aec44b68d002043b39c1ccaa50f1a74f0cb3a83e396b048389095380d14d8d5943931efcddfd1944933bc333231de57591b09980d8da804edc29e6bde664ecb549f0334762c7", 0xea}, {&(0x7f0000001740)="51f97a9d4ad62a214fa77c6918cd6dd2d5a147b32dd1206b47", 0x19}, {&(0x7f0000001780)="24b578311067fbe913caf41ab689a3d1bde6d081effc963c02b358c948b861032de659f7e7545cbc55782d", 0x2b}, {&(0x7f00000017c0)="4233f85f967619371855e408fdaf790ebf7711f4e0574e52934d5a27a342703f53ad0d3ca63ab1188fb724dda640", 0x2e}, {&(0x7f0000001800)="454060edde7158486cc183bc8e8aaf1dd932942ddc3e4b57d38df52e158c318ea359f6e1162491a5b243c356337372ec9af1957e501b71e91c1a456ab5160bad1cf15a93f89eebb1ac8dbbcd0deba1486c0bed9a83b52e7634dc526d84da841c680b6009316da0613a1ee656552958ec448b38a82dd3f4", 0x77}, {&(0x7f0000001880)="5c5fd813bac7578ef572e5aa17a98d3419d46d17e27bf72af4416acc830de00c4bbf0023fb05d4f91990bfb4b4b1", 0x2e}, {&(0x7f00000018c0)="36999e29a7fe8b6b521dc25ea0f92c335a9a55b1ad22dfe74dec374553d66b089e3411cc7db0f790ac025b8d53b7d3c65d836d7928d8bde7068e22107ad602ebe9ca233daf866de764732d39b0b19865655dab6b52f3fda07db1070c923dc87a6b3e3d90a4be66d2c61b153b8bb8700fa55e396d2d1f11e106caf3ecfe151ac88d8aa5a4d9e07cc73fd43b9259dda8e406d8f45a68bc1e2004c9b0e4099cce0db3564056b6403da3f5f76d86221f0658a0", 0xb1}, {&(0x7f0000001980)="f6a726835769e9f034510247c873da1ae422bea05669adc3b5827f4d1c6382b06a4e7578d3dea71941029b1eb38b", 0x2e}, {&(0x7f00000019c0)="6e1575c2a6b6eabd63c19dc898b880b37dfc662e023676d3fe875c5873a8623471d87ca299123485ff6878f5c9b89a07a518cfff8ee1f681bddea2c40a34d68988a22ec476d3f42cb7c320518f67582e44a922a9fefbd52a9d8dfde7ac2beae240a62bb9dc3069c4a7a7225630fb9669d33ce51974da2923c37b8d801ce64e3c0fd9ce226cae9d4895f02043b4f79e93d2a4c0caae6f72f8e0309eafd38c7ca0267ea75820010b42e21d17780799641bebd45c1e8e26cfe0b3054c267617470775f8c45bb5e23f9b2e79754eb86bb89bf7a02b81674f", 0xd6}], 0x9, &(0x7f0000001b80)=[@timestamping={{0x14, 0x1, 0x25, 0x1}}], 0x18}}], 0x2, 0x20040018) r6 = dup(0xffffffffffffffff) connect$bt_l2cap(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0x2000, @any, 0x8}, 0xe) getpeername$tipc(r6, 0x0, &(0x7f0000000080)) close_range(r2, 0xffffffffffffffff, 0x0) 545.125826ms ago: executing program 0 (id=981): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x4000, 0x2000, &(0x7f0000006000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) timer_create(0xfffffffffffffffd, 0x0, &(0x7f00000000c0)=0x0) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/pm_async', 0x1, 0x0) write$cgroup_pid(r4, &(0x7f00000004c0)=0xffffffffffffffff, 0x12) timer_create(0xfffffffffffffffd, 0x0, &(0x7f00000000c0)=0x0) timer_settime(r5, 0x0, &(0x7f0000000080)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timer_settime(r3, 0x1, &(0x7f0000000000)={{}, {0x0, 0x989680}}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) prctl$PR_MCE_KILL(0x35, 0x0, 0x10) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$SEG6(&(0x7f0000000040), 0xffffffffffffffff) mkdirat(r4, &(0x7f0000000240)='./file0\x00', 0xa) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='exofs\x00', 0x0, 0x0) ioctl$KVM_CAP_VM_DISABLE_NX_HUGE_PAGES(r1, 0x4068aea3, &(0x7f00000001c0)) r8 = inotify_init1(0x0) inotify_add_watch(r8, &(0x7f00000000c0)='./file0\x00', 0x60004ce) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x141800, 0x0) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r10, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmsg$inet(r7, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0x4, @broadcast}, 0x6f, &(0x7f00000001c0), 0x0, &(0x7f0000000080)=ANY=[], 0x38}, 0x24000006) ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) close_range(r6, 0xffffffffffffffff, 0x0) 457.090113ms ago: executing program 0 (id=982): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000003940)=ANY=[@ANYBLOB="1800000011000100e4ffffff02000000070000000400e380"], 0x18}}, 0x0) madvise(&(0x7f000026d000/0x2000)=nil, 0x2000, 0x16) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 436.364525ms ago: executing program 0 (id=983): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffffc, 0x0) r2 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r2, &(0x7f0000000000)={0x18, 0x2, {0x0, @local}}, 0x1e) connect$pptp(r2, &(0x7f0000000080)={0x18, 0x2, {0x0, @rand_addr=0x64010102}}, 0x1e) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2300, 0x0) ioctl$PPPIOCATTCHAN(r3, 0x40047438, &(0x7f0000000040)=0x1) close(0x4) ioctl$PPPIOCSDEBUG(r3, 0x40047440, &(0x7f0000000140)=0x6) setpriority(0x1, 0x0, 0xe) r4 = fsopen(&(0x7f0000000580)='tracefs\x00', 0x0) r5 = fcntl$dupfd(r4, 0x0, r4) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000100)='mode\x00', &(0x7f0000000140)='7', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000080)=[{0x40, 0x2, 0x0, 0x8}, {0x6, 0x6, 0x10}]}, 0x10) r8 = socket$netlink(0x10, 0x3, 0x6) ioctl$sock_SIOCBRDELBR(r8, 0x89a2, &(0x7f0000000000)='bridge0\x00') write$binfmt_aout(r6, &(0x7f0000000000)=ANY=[], 0x9ffc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x50, 0x0, &(0x7f0000000580)="c6547e22bade76f1a03b79e954ee20b943f7fe47218a02ff8ba942478a7b6946e9a6000055002cc15e854564e7d309f20d222f9220c8d9b1b0d196137252587ab1794808000000000000000e647c2e70"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a41, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) write$tun(r9, &(0x7f0000000340)={@val={0x0, 0x18}, @val={0x3, 0x1, 0x3, 0x4, 0xc4, 0x10}, @ipv4=@gre={{0x5, 0x4, 0x0, 0x26, 0xd8, 0x68, 0x0, 0x4d, 0x2f, 0x0, @multicast1, @broadcast}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x19, 0x0, [], "1c794c5fcd565649050022835ac3ac97cb9fb274d4d9998212"}, {0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800, [], "7fb5875c8cb1e5103810f3514c5859085f8bcd044121d872d527be9db6ccba47166b45027b4ebb9222f071ff96f3443ec4461c325c516f1698e1f011fa3bfab0dedf7bd62f68af"}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x9, 0xfff9]}, {0x8, 0x88be, 0x3, {{0xa, 0x1, 0x3, 0x3, 0x1, 0x2, 0x0, 0x4}, 0x1, {0x5}}}, {0x8, 0x22eb, 0x3, {{0x9, 0x2, 0xe, 0x3, 0x1, 0x3, 0x7, 0x3}, 0x2, {0x8, 0x8, 0x0, 0xd, 0x0, 0x0, 0x1, 0x0, 0x1}}}, {0x8, 0x6558, 0x1, "a33ce789860dc984c201b1e28a9fe3cd0d2bcc93a01e37ac14a0f11b"}}}}, 0xe6) r10 = userfaultfd(0x180000) dup3(r4, r10, 0x80000) 355.688061ms ago: executing program 1 (id=985): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x20002, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x11, r0, 0x45809000) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async, rerun: 64) ioctl$BLKFRASET(r0, 0x1264, &(0x7f00000000c0)=0x3) (rerun: 64) timer_create(0x0, 0x0, 0x0) (async) timer_settime(0x0, 0x0, 0x0, 0x0) (async) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) (async) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x1cbd81, 0x0) fadvise64(r1, 0x6b, 0x4000000000f7c, 0x4) (async) syz_clone(0x80842111, 0x0, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) (async) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r4, 0x2, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x4e}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0x6, r3, &(0x7f00000001c0)='m', 0x1, 0x1}]) sendmsg$IPCTNL_MSG_EXP_DELETE(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)={0x14, 0x2, 0x2, 0x5, 0x0, 0x0, {0x7, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0xc041}, 0x814) (async, rerun: 32) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='ns\x00') (rerun: 32) getdents64(r5, &(0x7f0000000100)=""/4096, 0x1000) 355.023231ms ago: executing program 1 (id=986): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000540)={0x73622a85, 0x7cab6ced6415609}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2/binder1\x00', 0xc02, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x8, 0x0, &(0x7f0000000040)=[@release={0x40046306, 0x1}], 0x50, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x73, 0x0, &(0x7f0000000400)="8b0b4c404981a6ef39f577efb9c2c64f47b576cec3dab5adbd25d802c31aa20f47283d909cfc1520a8ebb223d441539406505ea001848d180490b7a70bc561639b136ecae6c156d04957009916c1b24ba79c86ea06832ee972c31e6a0359b8b206c9498c06983956a604106001a616cb4d1c1b"}) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f00000004c0)=@newsa={0x198, 0x10, 0x713, 0x0, 0x0, {{@in=@broadcast, @in6=@remote}, {@in6=@remote, 0x0, 0x32}, @in6=@mcast1, {}, {}, {}, 0x0, 0x3, 0xa}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @algo_auth_trunc={0x5e, 0x14, {{'cmac(aes)\x00'}, 0x90, 0x0, "0a55b0ca9cce75f5c9b871603e40f7ec06b2"}}]}, 0x198}}, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000140), 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000180)={@fd={0x66642a85, 0x0, r0}, @flat=@weak_binder={0x77622a85, 0x100a, 0x3}, @flat=@weak_binder={0x77622a85, 0x10a, 0x3}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000540)={0x73622a85, 0x7cab6ced6415609}) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2/binder1\x00', 0xc02, 0x0) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x8, 0x0, &(0x7f0000000040)=[@release={0x40046306, 0x1}], 0x50, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x73, 0x0, &(0x7f0000000400)="8b0b4c404981a6ef39f577efb9c2c64f47b576cec3dab5adbd25d802c31aa20f47283d909cfc1520a8ebb223d441539406505ea001848d180490b7a70bc561639b136ecae6c156d04957009916c1b24ba79c86ea06832ee972c31e6a0359b8b206c9498c06983956a604106001a616cb4d1c1b"}) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f00000004c0)=@newsa={0x198, 0x10, 0x713, 0x0, 0x0, {{@in=@broadcast, @in6=@remote}, {@in6=@remote, 0x0, 0x32}, @in6=@mcast1, {}, {}, {}, 0x0, 0x3, 0xa}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @algo_auth_trunc={0x5e, 0x14, {{'cmac(aes)\x00'}, 0x90, 0x0, "0a55b0ca9cce75f5c9b871603e40f7ec06b2"}}]}, 0x198}}, 0x0) (async) prlimit64(0x0, 0x7, &(0x7f0000000140), 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000180)={@fd={0x66642a85, 0x0, r0}, @flat=@weak_binder={0x77622a85, 0x100a, 0x3}, @flat=@weak_binder={0x77622a85, 0x10a, 0x3}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) (async) 289.133647ms ago: executing program 1 (id=987): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x5f875000) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000180)=ANY=[@ANYBLOB="0100000000000000e1"]) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x17) r4 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000080)='syz0\x00', 0x200002, 0x0) close_range(r4, r2, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x60a00, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x5f875000) (async) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) (async) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) (async) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000180)=ANY=[@ANYBLOB="0100000000000000e1"]) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x17) (async) openat$cgroup(0xffffffffffffffff, &(0x7f0000000080)='syz0\x00', 0x200002, 0x0) (async) close_range(r4, r2, 0x0) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) 194.641184ms ago: executing program 2 (id=992): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="94000000000105050000218aa6168918a88800003c0002802c00018014dd8400ff01000000000000000000000000000114000400ff020000000000000000000000003c0001800c00028005000100000000002c00018014000300ff02000000000000000000000000000114000400200100000000000000009e4d7c5cff071806f407bb0569f95e0000000000010800074000000001"], 0x94}, 0x1, 0x0, 0x0, 0x4041}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000013c0), r6) sendmsg$NL80211_CMD_SET_CHANNEL(r6, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000001480)={&(0x7f0000001400)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="010026d07000ffdbdf254100000008000300", @ANYRES32=r5], 0x1c}, 0x1, 0x0, 0x0, 0x20040000}, 0x44) (async, rerun: 32) sendmsg$NL80211_CMD_SET_MPATH(r2, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)={0x4c, r3, 0x200, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x5, 0x35}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24048040}, 0x48811) (async, rerun: 32) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)={0x54, 0x0, 0x1, 0x505, 0x88, 0x0, {0xa, 0x0, 0x5}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_NAT_SRC={0x4}]}, 0x54}}, 0x0) (async, rerun: 32) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (rerun: 32) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000002c0)={0x68, 0x0, &(0x7f0000000180)=[@dead_binder_done, @exit_looper, @enter_looper, @acquire_done, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000500)={@fd={0x66642a85, 0x0, r8}, @flat=@handle={0x73682a85, 0xa, 0x3}, @fda={0x66646185, 0x1, 0x2, 0x1f}}, &(0x7f0000000040)={0x0, 0x18, 0x30}}}], 0xffffffffffffffc6, 0x0, &(0x7f0000000400)="8b0b4c404981a6ef39f577efb9c2c64f47b576cec3dab5adbd25d802c31aa20f47283d909cfc1520a8ebb223d441539406505ea001848d180490b7a70bc561639b136ecae6c156d04957009916c1b24ba79c86ea06832ee972c31e6a0359b8b206c9498c06983956a604106001a616cb4d1c1bb6acb016cfecfc7ec3b0b2b9ad9ab9ad605bc7f30634cd84a3fa558165a23ef2774c87ec29f64cbf0b7d687933d9e1b3d23238f45fa89ff9f03aeed168cc4492998e962f5fc8d328b4204e969666ffdeb879c288373569757aa945c11bfc5a6d01cefde1031b79382c34c2da32f2058e7357c3d1fa5931bb923f0ebd396a976c32940686"}) 164.194026ms ago: executing program 2 (id=993): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x2, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) sendmsg$inet(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000019c0)="acedcb5716acf9793303fb3843", 0xd}], 0x1}, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, '\x00', "c0b6c58d86b8d37dfd3223972d00", "9064c662", "bb10000000000001"}, 0x28) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffa) r2 = socket$unix(0x1, 0x2, 0x0) bind$unix(r2, &(0x7f0000000000)=@abs={0x0, 0x0, 0x4e20}, 0x6e) open(0x0, 0x15b341, 0xfe) unshare(0x68040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = socket$unix(0x1, 0x2, 0x0) bind$unix(r3, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x6e) r4 = socket$unix(0x1, 0x2, 0x0) bind$unix(r4, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) bind$unix(r5, &(0x7f0000000380)=@abs={0x1, 0x0, 0x4e21}, 0x6e) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f0000000ac0)='\x00\x00\x03\x06\x00\x00\xda\xfb\x8c#\x8cI\x8d\xaa^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\x00\x00\x00\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\x87\xa3\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\xe5\x8b\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9}\xf7\xa9\x96P\x920Hd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\xd3\xfc\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xce\x1c\xb5\x85maJ\x0f\xf7+Y\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+W\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xdb\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc2]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xd5\b^[') 51.635316ms ago: executing program 2 (id=994): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) socket$key(0xf, 0x3, 0x2) r1 = socket$netlink(0x10, 0x3, 0x0) syz_open_dev$hidraw(&(0x7f0000000240), 0x1714eb09, 0x12400) r2 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r2, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) bind$tipc(r2, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) bind$tipc(r2, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x20000003}}}, 0x10) bind$tipc(r3, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) bind$tipc(r3, &(0x7f0000000440)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x3}}, 0x10) bind$tipc(r2, 0x0, 0x0) getsockopt$sock_buf(r1, 0x1, 0x1c, &(0x7f0000000140)=""/237, &(0x7f0000000080)=0xed) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f00000006c0)={@ptr={0x70742a85, 0x2, 0x0, 0x0, 0x0, 0x15}, @flat=@binder={0x73622a85, 0x100, 0xfffffffffffffffc}, @flat=@weak_binder={0x77622a85, 0x0, 0x2}}, &(0x7f0000000180)={0x0, 0x28, 0x40}}, 0x400}], 0x0, 0x0, 0x0}) preadv2(r2, &(0x7f0000000740)=[{&(0x7f0000000280)=""/23, 0x17}, {&(0x7f00000002c0)=""/137, 0x89}, {&(0x7f0000000380)=""/46, 0x2e}, {&(0x7f0000000480)=""/233, 0xe9}, {&(0x7f00000003c0)=""/47, 0x2f}, {&(0x7f0000000580)=""/204, 0xcc}], 0x6, 0x80000000, 0x80000000, 0x12) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x10, 0x0, &(0x7f0000000100)=[@clear_death={0x400c630f, 0x2}], 0x0, 0x0, 0x0}) 50.286675ms ago: executing program 3 (id=995): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167342, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) sendfile(r0, r0, &(0x7f0000000040)=0x9, 0xa4) ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc018aa06, &(0x7f0000000100)={{&(0x7f0000800000/0x800000)=nil, 0x800000}, 0x1}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async, rerun: 32) readv(r0, &(0x7f0000000080)=[{&(0x7f0000001400)=""/4096, 0x1000}, {0x0}], 0x100000000000015a) (rerun: 32) 48.673396ms ago: executing program 2 (id=996): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x0, 0x0) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r1) sendmsg$IEEE802154_START_REQ(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)={0x54, r2, 0x0, 0x0, 0x0, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x12}, @IEEE802154_ATTR_SF_ORD={0x5, 0x18, 0x7f}, @IEEE802154_ATTR_BAT_EXT={0x5, 0x1a, 0x5}, @IEEE802154_ATTR_BCN_ORD={0x5}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}, @IEEE802154_ATTR_PAN_COORD={0x5, 0x19, 0x4}, @IEEE802154_ATTR_COORD_REALIGN={0x5, 0x1b, 0x8}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6}]}, 0x54}, 0x1, 0x0, 0x0, 0x18000}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan4\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x200, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0x8000) (async) r4 = mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0xc, 0x0, &(0x7f0000000240)=[@free_buffer={0x40086303, r4}], 0x0, 0x0, 0x0}) 47.964246ms ago: executing program 2 (id=997): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) (async) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000007c0)=ANY=[@ANYBLOB="58011303", @ANYBLOB="08002bbd7000fedbdf2513000000200007800c000400490000000000000008000200cf00000008000200090000002c000380080001000300000008000300090000000800020004000000080003001378000008000300030000004c0004803c0007800800010004000000080001000d000000080001000e00000008000300030000000800040002000000080004000c0000000800020002"], 0x158}}, 0x4004080) (async) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000840)={0x28, 0x1e, 0x21, 0x0, 0x0, {0xe}, [@typed={0x5, 0x0, 0x0, 0x0, @str='\x00'}, @typed={0xa, 0x2, 0x0, 0x0, @str='w\xa9\xe2\x00\x00\x00'}]}, 0x28}}, 0x0) (async) mkdir(&(0x7f0000003080)='./file0\x00', 0x108) (async) mount$bpf(0x0, &(0x7f00000030c0)='./file0\x00', &(0x7f0000003100), 0x800, &(0x7f0000003140)={[{@gid}, {@mode={'mode', 0x3d, 0xc1c7}}], [{@dont_measure}]}) (async, rerun: 32) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) (async, rerun: 32) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) (async) r2 = mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) (async) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000008300), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r2]) (async) syz_fuse_handle_req(r3, &(0x7f00000021c0), 0x2000, &(0x7f00000041c0)={&(0x7f00000001c0)={0x50, 0x0, 0x3, {0x7, 0x29, 0x3c, 0x2100039, 0x0, 0x0, 0x1, 0x57, 0x0, 0x0, 0x80}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x800, &(0x7f0000000500)) (async, rerun: 32) syz_fuse_handle_req(r3, &(0x7f0000004280)="419fbfa825e2d2033b2b177ffb34cf0cabf67d439e2a5828fca486002e6c315015f37ec9053c7695f1b4b7cd5037be54c7daa1b32ef46aef9ecaf4df490baa0f081d29b574dfa6f77916d9b23c99c0ba0c7237203cada6be64cdfc8a5cd992eb65f799b2c3c812db57a0f7758b24d5aa8e246e31614e7ef52d799d0ad2da93c4b78ad70a26c5e0cc9b57eb951c4e9597816782e424f7fde7d1eb26a0bc583b84bb925f62435b41ad1a8c6d2acad43ed86914ff3df3233808fe447688563015a81aadd04eb9ce6b37f2171f173016ec1625f82fcf7310d6a7bcce4d9110f81efec3a94cba9d1376246df84a829683b96b8150043725c5e587b24b007f76e0a6d7a3cdc8968595e890625ed54717cc51d826cb505b7217fc35906fe3b091226330677b62816f20ede2292c0bd9453e8a0d3104d83d8da26af6397ab116cb916bfeb03dba4fc8b5fef48f842c8d832db1e6c0fe50a6447ba0d991b669e28bf8e59820930b2d0e62e88612430cedd805d57d9854cfc63747a321a395f0f4fd0512a02c1548a539cd4d9540934380e9eb74bfd8c7baaeb4d14b265111885ab8abf55b2eee391638b6159be6b4fccc58a97907c91e17949ad22373db1b0fd1709b70f4c927f4cc47d15410ee71e57b71528a0e40ef2cf8d3d757418993367bcb4079517bc0ab6e91643230a7662cc1a235e340a526156dd02b7f4c25ebe4c66c7d0e3065be5c518a70a8a2e0611e9e83fd77a36b6f1bce60841a4a57e1b8a8c8b6cd29ddea816aec0c1c32ab85c55bcb121d2a0f5d697b2e74222d6f2e194bb88b01a69fad19f22610afd83b7767210126ce230eae640d45349e30851a87c0e9741ef3857fa67588167fdb05a83665165a05918f9ed7aa57678ae52b98443b5a0a56ea70171dd503addd94d55b63412cbc5ada7bcec8769aa3bceb5f35738d8b94fb7ddc017c2f8d5bc8c43d2ac4c5f4786601cd660e76c4de747969e33f58a5ea94dfff63d0db5cacae7a14d2919bf64645fe183759561ac5c7828a8c7bb7550516429918fa52beb3a4f299742952ca61d8fbb9fea4d0668f4b041cce06e819ddb99fd2058859c811d89ad99316ae9bab56784565fc4f74c278a7e656e974cf98a692503cbdd59dccbb0c6277f9e8bfb5cdf3210cb9f47bc3b3d801f817d553ea11e0d45c18068fa4999025b9b0afcf72f782f6a3e53eb80c9862233bf6dd01a8fd72f1d645e9a32ec4018f5b629e8d3a4d45bed5db188d854b0f4ae858c7887a8a6d0cf11f46ca4549b41236728a79e51787ef4955ab776da4160f86722fd397ba0a17351d912b99984c6f8bc2f6ba3c7abb7b2ca7c1ab2d345a7aa70d4fbdda118694d9931dd9ad6487bd75d1175e7a682d33ce29082200cd521004c78fa009e7721461dd9224685a0816ce0c65a3c9c4ef0954c6ae230adaf50421cfe2febfbc06e9f215dd867b2a32b8189a5f9192e583bdea99222bec85b4b6e86486490c9f1fa039314321c9d36718cbd15bc75aa7e7817d3591adf40d44a098f2c429390648b3cd7b4b59adf35a3f2db9b90a372ab606e9c9e8310ef1be7b0a801c2ddea35d4153f570af60ae78c342da7adb784b69e10da5a56ebd781ce248042a545a632b2f3f40c825a9b7f7940f4424d9a5a49acb766d4dbbed72b9e22b822b157a8bb635093c7bbb2746df8d77a77455a1bbc9b97c4363c5cac91d66f64bac6bd930ff3b22a130d72a083902b00d23a9c26ba0246c83eb846393901f01b12b21b465d84451a32cb5ff95a3ad7446f44cfae36240ddd87836e053b93d895b98fa9f46a0f08683540aecce1820c8e6c35b64c0896df868d9bbfbf59315f7713f492572e4e68dc5f6cfda67998748835acd8f0bb857f9904c08e94b5ef394832660de9c40ff7bd0f44451e7a7b9caebbd260135c047589de2daa5b20f294616d297c4d6fdbb8e4292fa0aa9ca5192b81cc78356e8c23da36933270795ceadb7a913810b9ca69fe2427129cadb93db30c3e0214e8537e934bb8bd882b9efabe5970eea8678f6e37cfdf2547d987392db519d0dfd825a1b47f48854896a1b8454a91c5314ac9ffe66e6928acb5978c894d8e6b81eeed5173a2fb6233a53225b78959d3430789244b34e30ce18a6c7918b2a10393c552299fc1b9a5a15a4291fa3198b0705fb985e6e0411ce2dc344007f16d4745bc2cc98472f813f4649bf2d17a49e6ceb5563011641872082b209e70fd0bab152a5b20f95e7f79c2c789e4fd72463b4011f19358cb4b462f1612cfff926f024cda694c62af4fe1f47ebc888ace97ce2081fb25c36245d04d76a28c3a5a7657c4793e755b16e7f7fbe5fb2b519022867a3f622f480c532068f2060a0097e03ba688c19dc3090377f6e6b7386a05afde76a0252b3348d697e33c1e7a965efcf38a18c62bfccad0be312f9a2f3ae092f416a3ed54f8bf75437cc4dacf5fe302268bcf5b944a4d4a40ba6ada17cf3e9334ae34e2e16df5fd86e1acf63667f523b42cefbeeff916e3ba288fad249bca1a59cef725e5e15b842e03aa21cd193f9bb46d0bf77dbc234cedbec93b990aceaef057496e46ec91f598a7849facc51c1670a0c10c1e6ec9ba51ab0a2b3ba1231841f8a97f7563c4be78c40d9ece443231f471742fdf1adc295081c2eeb8898f3c537c5bd2d181a35e0cd3768b4af4c074e3c6c75171b36f11f5298ed629903efcdd7602d21ac4b8048e71845a73610e691331ffbf0b34189ae7e6482b4e4c6695ca0fb6808ead075e21f2627355e43c65b32a7b15bf0950e321b8e5c07fd7bfcb3a5355c1ba452c6b7b4ad648b5b10768c862a2d7c79b9be1e5ccc9bfb639f11b22d0563959c8616fe6fe63a89d240d40a82d01b3763d26b385a270a7a48fe8d3cc1bac4de6afc84c3b93bfb8dad9b5aaea21f4a8da6529d0ccc4b5527707bb04ccff36fbddec154bf9934655c4e6993a30ef34aae1f9d7f4393dd9ba47262eff697839e5574341d69bdc077343fe5236ac175ac31f471d6a6fc3169f990fece2a2442afa16cf5be91c2cb612f6a9f6c6821f9925675479b742717f795cb54eb733a92cf772e5dbd11a204a2d47269bda0207d123db794431d755fb6947f5a749a935338307c67f6ec9fe09182ad0ab68e29478f2e33dece95290aefb0e148bfa963525a0e9114f2130a86b61faca4e178fa391cb1cc13d1457614601aa45d38dd307d4c22fd3eebc5ae7c2d3b04e2a3cc1bba1f3fc62cbe966cda59c02a2c3ebb758523ce6cf13bea6b1b0eb3e037cdc6dd4e1c84ab180867d5b2ddef3bb6cb9c19e1f499199da7d4d919f74b25a19d1809c5acb362b366606547d6e250379dde875c22618d7f76ed5e62410124c59e31c493719ee6e36fc0f1b892c1f1e08ac05a33d30a46adb3b7e09f4d3b8c8ab915fae4ba8b63a0c39a7e5685f1db558f71ddb7de012094a126ed7111c4e78dbcf57f4b53b564c903d7c245b85ce7a4eedd2bb775687a037bcf5d4e4c9bd7a37abbb1d5512add3efdfe08cecb1a1aa1d0ee54e774a84968bf9ccc91be9ffce996fc16d9697544833445acf8e94f229b72b9d8285bc9fd4c5bb95ebbbb962a8aef6cfc2b6d006386ec6a2a313011016d3e43c784c2090f3b0eddbd940fb804f088716227e113647b245778c7230c2fdceb73fb3a69c1d771d0bd153a3e38ffb24352c6475d6e52d8bc03a174145bea3754ca1d6c5a483a78b1d5469fd1a82324421faea2948533f8b7d01568dd8900b2015feb8972dc9a6aa628fbec45405d4c8f2ddfa4c1795de4b97f0236c6beb63dd689086aa2984db85f5dcfe3b3d35a6ff99d652765fd9e9fd8350488168426d68353781ea0c8ea8132c1983a79f7420a0eaf52d7e969d951a97701c648dd9aa6cd9ffd6176bd209cd0c0ca6afd35b9870af1e7e63ee9f0e5dde6b3c4278af4e75cd18fe55198d30294d7494ecc5cb9e03c9236eb66135d4069d01815503af19e2582c0355be96859738c4abcb4de1bb8fc678a57b2f6e7ded038e8ad44f100c39aecc3bc357228578e2ede2fe7cfb11054e6ad18eb36d4a9b747d17654e296388f73cf13695bac3e9d6a80ceaf193d8d036f843dab2075f90f1eafa060fbd561e0b7a5d27100776fe223ec241cbdc1cd78dfae080e1df5a3d27cdbd8db81f728e8a80fd43edb1604b99398fa82ec605355df4eb51e044bb318c5a5a5c6040bf84e80fa8888f37c158d3698458a3a49c40748e6eabc87ac594124792bfb6ad7cdca69e325e230168d088a174e02d56754bcc883b7ecda5ee3364e164f5bd98b48f9e7a9c6e75e7e910bca57c5880f18b0dddc1ce39bb561d6da571c02abb300a7bd674aab54e016d80fc61f65b128de6b5ad6581160382865587c5b15d6cf80eca6504ffffffc5fa67b9dcaa74c41db96c0b0c52d3279f65d9c3a27c77f0a6b23c92d0e08e2e882306216028d0c7f6d85a48c9e3d13cce299a8c79bb1dfb1877cd1caf34746bb5c83d6ccb3bf5864ec5dd342de86e5d57b9bc65bea0f304b9aac40741917c9e68fc661e8b61911db333a7baeef6d4291b3d2085a07ad566c23b41e734ca9fd587dfd885e65764ee9284d17fd228e0dbcec33e6a29f75cf8bec4b24f3d159c657f252823c11bf6b58b767fbaa0ea59f4014d00c0bc1de0db9123eddc53325503992bd410532ca22b64984e65f0e0fc386fd56c60f536d4aafe59b0456fabdab85379397729196f9edbe0f57103f34152d32c050118d68434bceab0a5738cfce80d4f92522e6594b8f578ade8e378de8efe13c8d2e61f231412938684f9617c5067c8b35e689f32338eaa8b60019751c3f28ec017b2b53c8fe1e920765c2f9277b265526f2835090fb6a83e35c22a63d2d9a2dbcbe79f7b15828864996ff14f90e2c0acaa48ad2dfe15cef92ed8d054d9e8f460d335e0bfca813c3ae4bc259c8efcf513d8929b7c794fa2624a3b0f8ca72528c1b38fec571234b0805bdcf938f842bcf57d2c6bb339058652bd2fbe076bcfac5cf5e15ed4163819f100a7e4c81b545ce63a50643ca6d0d681e2c7a51299becaa83e6aaf8ce2eae9705e0e797023f9b8a8d5e55dea89374ede3eb40b64558df78b8119e8c01d1bb89783b3622642bbb3b4b675f903daa9f8b748e0f24a92d640b473c724132d7d8517187541eeb6781ec07e4f4ea014af10614853232cc26dc56e251e834a724e0a81000ac6d56331838b321e0dc7ba66a78696076223250e17ed181085a1f10e811d4335b21a29cd415cb8666c6398cefe9360fc4328eef6cc844f16c0adc4b04251ca1f66fedd0cef15c10c06b8a6a2db84f4c88d525aa897819d83a08684e10ccf118eaf7b426f62859cef8572a5d811e4be443b5690a20f12b41e2f607ce3d99d945eac5c605825bad857827c8759dfc4e0077c0dd34884d286b535cb0ed222bdb6ad578aaa7987509e85cf9e1f77bc694276ff553ef73812d2dd4246994df98e0b544070d37ab62b5cad10ae5b839b63386e1d56378fcc7460d456d494fe97d50a7b35f5d3ceaa5107a0694f87b5bbeb0809618a5e8bd48fc5a523e99e7e5f55d0f42deb803ba74c873e8e222653337b95034c19b88f36849418924284a5275cfa22f45a2074906a1b8db53ea769bc6a00bc0441184d861442c78970763c45738cd2689380a7aa1aecee49042c7f4ba26361712ae16bdcf6c88638969a8fd351d1146b0514cffb06a9d29ca04d3d2f42813bf27244e54b2e7d2c6a9af53e3cbb44bf83cc39514ea96b514c2d763bdd087674a3863554c8f8e0b9075cfdc384c4810593fb0ad86c5d651221af0ab1446ce8c639feafc33b4ae07aecd1d2cff818363bbfe7a7ebeca54f3e908b4c2fa0a6bdc95bac308fc7ac1cbb7126d675849c0b1d3628ba8475f6d4c5010db56b807a9cbf9ddfb4ae66e8cbb72d4c3a613609f9818995841734ba75139fad10dd4c9e09dc68737977c73866700e9b3ddefac72ef7399ed56c33fd0a9d1c6cfc7d5c703dfc6d9720712914213f90d2ac2c70c4df429abab9270df4638177ae1f86ad9dd6bfff3b015605cf397028cb4227004bbd2a36d45c74f70f04d65de30d32067969434790032cad13273f748daece4a627843562c4f9631f394d9800369f3c1adb797e872b305e59db02c0f10edc89da727dd638083147a99f4f761bdffd948798d0e67fe939259f9e115a8b690077055eb88317c6e1258d83a65fd92b9f4a4b65c61825089a70e90c37e9f0d6f25bd44f55a15cc04564aa0039f280870b64a6493772b19713f670cbc0a901fefd8194727e43a38494bfef57e8b554cb3e6da7880e8e6b89cbc3a0787b75a28fb1a6b57e24a4d4bfe2fa323d5771e6a2ed93223353c4d612e91d0a4c16171a16b844266fb63e24155dac230b49a8f2898681788de40dcf9469db6d3a9976b061c7eec7e81f4ab7f76a8929d0db7924f2e85a2954f0933ef6392f99b17a728d288249f009c5d9d68049396c890dc6e1bf75b284b1e7c846e69d5ba84cb2e5a063fbf774e80102b791a5d10d27c09302b80297b0108990854fc501b43102d8e0c3dd32b199df8037cbe9e9903cc7db5e5e3bf4a0191ee0a8661b930c5f49500f2c0e6aff975e03dcbb1d85079f21fac15493c2e23b9a8d04b10cd4f2b591afc25cc057acb6a276225f1dd9cdc1eedb99ac12435020d51e2e9fb8486ef705b6d281cbc0f10b440d08ea4796179461842a648abc119114df67dcbc5cbcfef46ade4dfa3653d407b64f7e59488a579d26f270cebfeef168933a6efccc39de7e1d6b999ce72010a57e651008b482be739448bd3590ce64afa7814f74de1090d0c52d01e194cc18c7898195ba79ff4382414155fe4a4ccfcf9f4cde93da7c7f831af0a48682ff79db9374d9567da1e0632cc799cdd4d4e0e7f5b3ccf202c5a52a4c472529075282b3f7d54c9e36f20296e109b4e344c845cd59816996ba1b033310b64a43e21c244e80a5a2ca3acd5af84986ae6829457816e62e0c1a77600a5f12089ede6e346011d29636f9b574422bac8fbff048f07d9d21605c85bc77de1c7a449a2318a209a4ece50fc545cb1456dfe171cb1725b7236916a35b31a34f7e515b1cbf5e0c6733709fac41665df6f075f2e9b2a1808b46b84d6375c9144b009e24eff262316d340b17ce2eec232193d2e9a90644702f9e110730d3a92cfe341624f963eb0ff3098367634aa71b6701b7681a9504c820dd9e9b6ab3c4c5165a9d57f99924b9020ef3b5aa8ab6e6c52776a47725ff10e486aa28ddb4c4b73b56138e8f8794bdf42a9fec1d561cd2a01e4e3e2f7f525b4316f2ed0f7c38e76c74230a8bfdd44e8e1fa4dacaa2024428ca15cf2cfdc79303ed946642fd72877f4099ad81a6dd11477bcd77d4de279f209d62cb0b358e7ebef097215b37ade7761b0b6f6cf2a2e1cffed4ed494515f83fba7bd9808fc331c0ea4d5300a3d2a51564660bf0dbcbaf84bb0024332862d1c4493fa6efdea299a6f53822ac81341beea5b3d1b2405e58220169186a3c428b0226994a37334383068b63abcf179ce329d86653b46af74fb43ca7fb4fc7eb3d8d825e7aaeb5757c24d2716024c006a510d1e0056251e8d8cfd62c1df4b33e1b633c4c0e26b8881621964862b176c49564e3920f415e460fb563ebbb309236822bcf9ed1c42056f96c9cabee61fb66aca2664c5020c44c6b23cc9788a7897c7b6aadb57808d649a31d2e6c826da51f81c843bbb955affd406f96616ebdbf9e52eaac07327a557abdf93c2e9a6ad6a3cdc96de487f412881032b5c6e4c0922ab07d5824bf53b1bae7af287f3e830461192c4f70c51c62abe87f408fef1d3b702c9d5feb14731a2144c56aea0d3eaa896d31d652de845d1302ab798b6e1b62f576479a3572c2fa30dcf54462c59d26b321a77c6b346e4fd54c27f370727015e2b13a08bad71fcc8faf731e524a57816a3abbdfde7b3a0cc1dcb094721ea18a1dfc9685c4c9b703d1731f88249092bdc7891b01613c0189eaf54b2dad17919d9ae52937cc3c1686ce75aec66a1c8fd9bf34b741f39835af2f4902f0030e390817ceae59ce67e5248c6d48c167013b6c4e92d60805af122d8f4cb111e3170d248be4a93ee832de54bfe1c71abe3f228177d9a8fe3a97b90e136fe798294cf186a844ec18ac1406466ecb2725a3d560f87a9624a162b0bd27ff4907530349e186498ae3411e9cc3e3f6aed514a7d1ec8fc2f06c360c6cba512c68c093e2beec664aaa0a93a15d1312dcd1f2439ae7a6c9496c91530aa16464dc00dac932ac0bb31ff3db2255ebc3328096367446711542baf815a114abb3eb7b146b74438673ba522e84fb86cd5adda668d1e8b71e9fd5a60ba24957760a165cf47588a08eccd549c9b0b54c986f440cf181aed97d2e2d81c3be908b81a60ed583b255c2bae37a164cb716bca14daa2c531c735127ce3fad27a08f5e31b8cefd5c4375de5cb47988b2ce22162b689a43b1e2fa74948dd1baf0c73c4d299124647544b2d6efd15904a2a947d0feb70f08800b92878b4858334bab3868ccd953b19297bfad4b5edc73e444da1a6a8606cb1d7773d670ef000711ce9ffa744bc0246545378264918be1ad9c746986c2350e25a5ee2e4d958f331317ef1b95709b230e86b8275b79d079c7c4b5135e531f4c8b295907b5b16ccc4b424be8714e6f1a00d7c56463ac856f575701b588c5d530417f55818231fc278404d6d90a2a6ddf52e15d57d380954ceea5d7bb19703bf25139d74d3db580f6f0451beabae7459134e4f2204a9311debccb7868aa4d36be49a105a0193c4eb5d22c9591f6ae0f87dce88f91f2b2eb3c44ad645916358a411ce46705711a7c03a4b32f5f18b552908fdf9011053228b7e428947964b05f9a133bafcf65c8908ebbe49cdf05ade6590a700fa0c0935f26e1a579a04ef166c0fa53ffc0e8b7ad6e4aed4a892d9716527c2f5b8ae3957ae4b150b6d1d9c80ba2eb800477a5e508648aacd60b2295d6a4f5bdcf3b1fd33ed41f2bc40321dcde664b332a8e8853f3679e682666d086536953de2ca3e83bfaf7b08c60e8ab55441df0157e9750f36f76dc8e636d70d9f13df0d462146ee87ba63117a634ec1d063fd2957c44fd9cca02dd41b079207e4c3ccd1a6b8458f0d473d1139b07aded68dcc8a92b63368d4d09f45de0231b96c94b29bde58b14d38f7c39cdb263ebd3557759c5a0ad31c858f6df8d04db632c917eb7a484f6d2466345b35a00c8ce5dc243113eb90e4032b4eb7574b3151f7285e34d69fe6ab3dfdfdd45d2a03e2db0da3a757dc1366f004187c77104aa581ceec2046f325c75623f5f3d6c0476f2c8dbc73476a3f018b4506baced9ee062fd2d80e69e56f448ffeaab0ed17cd5c2329d56b087455a8377078a7f589490dd758e70fe0ae175ed64c7d8ab788291ecd65170e0c7b49d92e8430cc54f87d4346b7aaa632798e228dbd41c1250f7ea30a5e716e3df03b0aafd1c8ebe20323ca4884015c68bbdd7bece1691c693550ecc3fcad86527222035c5bd1fb51dfb0d551c0768b38e0d8f0fbcfda560f51368e9f0c60acb7f3f67bd10fa138110a6bd8d59b3a758b61c732ec614479cb6491e4c9f1fe2b78ff1c1ab523c548bcf44bbaf14eef628035e03a1511171b7eedc5e635630cf85520917a60195b10adb6397ec3c37b623040fb4e95b3d85342bca1ae0e35e0aa66c75a376f165e3136dcc1c2b44586ba7c588a822406c349340660290c29840bc966ebbbdd98da590aab18283a98ba8c6bf2806ede39ee92ff8f8e282433588c4fdcac92c9bd311c5f502b0290229ce9f3c5298330dcdf45d7b21609d3f0d662a689e3ec831405fc8e95c1a80064adcd4b21b2283e8d23cba8224541883ee8b49f019452ab235b4f9edf9259520a91eb692ca0a5c30bc6dac1506a6629a3af87e31255e827e32d933c4638341da2eb7df2e93ad5038b62c2a284493da9498853cd4fb1910f9c8f2884d30699d99dbecfd22134ab17fc60e6726d7f2a818f0b6a054669591ee5a06ce9712f8f42ca2598c6ade1eeb357ece7fbd3e4f6b41b3907cc3b2407d42521c1339062d47716116ae2a6247e9da37193e13359a79ed8769a960d3c8dbd72ce1a94656867416a5e5aaba01229b9cb7d37730e8de335de4012688f697062f6a655a34a351ff700539f7f65a402c6cfa107eca6cf47805ca5e45422c6b4d83787ae2fb5c845ecabff404815ce73db2dd4e3045bf1f4c1e5cfa641a0c9e9a8b7251954e1201c9a6f3ed952a6506aaf28ae12d7c7fe6fce6908ae56b2f5df3a03c81bd33ea3a12dc449e1f16144e39579b442a2baf932928f11196e2de3dab6dc7744c5d64e81b1baa5f11faabb9e7268a8f86de5cfda9677140131f43480f6e9f7b2b62342c0fb081a345aee376518e93bbfce2fffbe9bb366dd8cbd19b2ee64900de257acca91ee90c479837e1079289eed25c5852cc665318a5a0eb0d99262ec2e882cfe5af68e4b06d0864741aed48e3d086a4b9dda5e52a37b4d2a723304ec2afdbc8d51a6a140806353cdff243b59f91244e84345e7aaba56c9ad03291500e7e4ae69739d0707123cdeb4eacb9b80cbb48fdec46f60b7b8b733c19c1cb586df9e2c842c8d8c623b98c20f9823974a24a8e319444fe2eb8eb60f492a17d0450d7302da8e826b52fc63803626ac19599fddf94877a20426f07be54dc807ab6642e8645309a7405c6c3b10562267daa81f670b27c6c0aa7f34f2a3fd66c1ddb847d8004f11d528628d2de2aa079cbdc4b91310996c74aa8ffd56a0c66f58367c780606541d61772159b6c7922d4e512742823b9556142a426e042b247dbd084123c02c6f5eca752503bb9ea9c8d5f3495e9c07477fd9f1e8504d49df56274f4167be27f99e57fff729515d2bddda2fecd7fee2a3317cefb90cbb976b921455fc8d8985196f5967429d507b384aa69ab8e22b4e56084c13a1ad2f696c626d89b625211cf7203ebdbb5368c95d8b6799fcf9ee2c0fba0addaedabaf242629ed9eced6eedf3005493826ae45a120ff9c8e821a4324a5adb384fa72f2a351e6e33b77955963f252391547f064a5918f5ec8e7aaeda5924ef66e69e0cf509fed98cf3fd009717b235ff73d1eb531e9c8f7fe0801fc6600d8addc6c93023b1e40b54d9a7f7c6c1c730be9c815eab946bd91c892f230f38f6ac72909f779aa248f9b595ed18c0cd4700ba1b5208cfc9a6d65600bf098ff6f5d5de866707e02fa0b2cdb60f81ded84277f436333e84bef83f530f0f97bde68541cedd83e67b100a427a2ddf3fabad45201da4229029b7d4cab33322431eb1efc49af19cac0154dabd92c9411f19994c86971a723366ab0b36ebb6be8f7caac17e81613690834b908053b4eab66b7db66b4b5e122e88f176ade8d30f22572148e80f4dd924915d3b250ab0ccd01da5e751e24a7c85d414f0a9eeff6bf9246a9e95eb5a0bb2d7e675de7ccc1c9722f6e6a151a28f600c9d3d8613a19cd019eb67a5117e29d1247d366cc47d6382ea54e268ddda3a49765a6dfd54f4a791403e63cb67bf0866ac63ac073f5f61838608e046f8decbbfddbd0a239", 0x2000, &(0x7f0000001440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0)={0x78, 0x0, 0x2, {0x3, 0xa, 0x0, {0x6, 0xfffffffffffffffa, 0xe2a, 0x1000, 0x4, 0x7, 0x5, 0xb, 0x6, 0x6000, 0x2, 0x0, 0x0, 0x7, 0x7}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 32) lsetxattr$security_capability(&(0x7f0000000100)='./file1\x00', &(0x7f0000000380), &(0x7f0000000480)=@v1={0x1000000, [{0xd, 0x1}]}, 0xc, 0x2) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) (async) ptrace$setregs(0xd, r4, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") (async) ptrace$getregset(0x4204, r4, 0x200, &(0x7f0000000240)={&(0x7f0000000140)=""/96, 0x60}) (async) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r5, 0x29, 0x4e, &(0x7f0000000100)=0xfffffff7, 0x4) sendmmsg$inet6(r5, &(0x7f0000000e40)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0x0, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000140)=[@pktinfo={{0x24, 0x29, 0x32, {@mcast1={0xff, 0x11}}}}], 0x28, 0x7ffffff7}}], 0x19, 0x0) (async, rerun: 32) newfstatat(0xffffffffffffff9c, 0x0, 0x0, 0x400) (async, rerun: 32) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfee, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x40000000000000, 0x16}, @ptr={0x70742a85, 0xfffffffc, &(0x7f00000029c0)=""/201, 0xc9, 0x1, 0x14}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0x1d}}, &(0x7f0000000180)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0}) 47.060066ms ago: executing program 3 (id=998): syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005938d74010973077339600000001090212000100001e000904"], 0x0) (async) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005938d74010973077339600000001090212000100001e000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000780)=ANY=[@ANYBLOB="020080"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000780)=ANY=[@ANYBLOB="020080"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x3e, &(0x7f0000000040)=0xfffffffe, 0x4) (async) setsockopt$sock_int(r1, 0x1, 0x3e, &(0x7f0000000040)=0xfffffffe, 0x4) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000005c0)={0x2c, &(0x7f0000000300)={0x20, 0x31, 0x2, {0x2, 0x22}}, &(0x7f0000000440)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44e}}, &(0x7f0000000480)={0x0, 0xf, 0x5, {0x5, 0xf, 0x5}}, 0x0, 0x0}, &(0x7f0000000bc0)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0)={0x20, 0x0, 0x4, {0x200, 0x2}}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1002, 0x0) (async) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1002, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = socket$key(0xf, 0x3, 0x2) setsockopt$SO_BINDTODEVICE_wg(r4, 0x1, 0x19, &(0x7f0000000080)='wg0\x00', 0x4) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) close(r5) socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYRES16=r4, @ANYRESOCT=r6, @ANYRESDEC=0x0], 0x38}, 0x1, 0x0, 0x0, 0x20000001}, 0x40800) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYRES16=r4, @ANYRESOCT=r6, @ANYRESDEC=0x0], 0x38}, 0x1, 0x0, 0x0, 0x20000001}, 0x40800) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) close_range(r2, 0xffffffffffffffff, 0x0) 43.237856ms ago: executing program 1 (id=999): r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r1, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000015c0), 0xffffffffffffffff) (async) r2 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) (async) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000200)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}}}, 0x108) (async, rerun: 64) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000400)={0x5, {{0xa, 0x4e21, 0x200000b, @mcast2, 0x10000}}, {{0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}, 0xdbd4}}}, 0x108) (async, rerun: 64) write$selinux_load(r0, &(0x7f0000000000)=ANY=[], 0x2000) (async, rerun: 64) r3 = socket$xdp(0x2c, 0x3, 0x0) (rerun: 64) fsetxattr$security_evm(r3, &(0x7f00000001c0), 0x0, 0x0, 0x3) (async) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0xc}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0xc}, @flat=@handle={0x73682a85, 0x101, 0x7}}, &(0x7f0000000080)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 0s ago: executing program 2 (id=1000): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000013c0)=ANY=[@ANYBLOB="280000002500010026bd70000000000008007300", @ANYRES32=0x0, @ANYBLOB="09000080080000000000000004000180"], 0x28}], 0x1}, 0x0) (async, rerun: 64) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) (rerun: 64) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0xa, 0x0, &(0x7f00000001c0)=[@free_buffer], 0x0, 0x0, 0x0}) (async) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c010000100900070000a144ec3551e5bc6165162bdbdf25200100000000000000000000000000007f00000100000000001de32e7d65ed200000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fc010000000000000000000000000000040000fe32000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000990000000000000000000000000000000000000000000010000000000000000045050000000000000900000000000000ffffffffffffff7f00000000000000000000000000000000fdffffff000000000000000026bd7000003500000a00000000000000000000004c001200726663343130362867636d28616573292900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000"], 0x13c}, 0x1, 0x0, 0x0, 0x4048010}, 0x24040014) (async, rerun: 32) syz_usb_connect(0x0, 0xf5, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a29731524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0) (async, rerun: 32) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="160415fb9b9e635f4d38e9fc5199a2f52f57ee41d1043f3f4550a6ce2a0d82dd037803f0f89a2881e6ac7e7e417f35949b2864c1d92a164df07ea8da393c0d6538b5b77a1a4851f1fe251051dc11b51063cea8cfe653a199f4a5fea1e898e585512806304225fdce7af3a5ccf3d9012e385ed2250bc7cead22a141a0579f0ad6b4ddfdd72776e2a738233149c71d2607112630cf022ab720d6f3f680df4f757aad3da3c573097734351b98e85e41ee8f3327b718921df37efb52e9fbcc0e9b4e5bbbb976b2d24d512fde1b949bd0b63b1aec70e6d3d15f4f0a725362bb873a73f15e2fc63dee262f1f9d86a6e80fc2896bff0b2537576052baa6a8a62926ed18ad8424f324a71577b3a9f8dd1dfc35f08d95e764fa876c7af81570ee59b59ea91f78cad8c7c56ae96a506e09f89b50f02d543c360b66d766d5d74d7402f9a737e9c1175fe1bfa201d35307054cefae5774158a9ae8d193d64fd6bd248ce152b96edb9cfe9c7843e1982ef08fa960941c215284e52c798e8032aa98b1187b4813c8a09805535c1d4e621e6f7feb51fecca81a95a4bacb350cf169316e621acfdebf2919dcc0a3efc0fb15ce0792286fdad42a2a28bbd84c081e7900ea31c61624144a10dd3ce4c314b847012f8a03b7822bd7cc23c987040663e4e7de26673ab3acb2d1239f2b1f4cf11b82450858b73b78ca8de28b54741c15c69a1fcce5fa27f3d184c82388955c747c97f9d6386ed53238e67c0d135f9d4eaf3f115eb38dd11fc3348f329541ab5fd4e297538171e7510092d2c453401ce782eff4df4b2c91151993f5d3ebcf25fd4d2b95e15b13f94f1ef06b1485a792b418cfe35db2f1c45b891026394c30e10e38d30ebe2ed781115c1c6e02dcb789323efc1a9c2c3d979525427d8054fb752cb029da314e10e33c2d62722f6aaa0dcd0bf9a9bbf8b737826094b0ec0bbc343101bb0d80172b32ac67f9002f613ce365f9b7b79f77aec002da5b6c4db9a7c6fcc446f4c433f54f83e7701ca50a92e5b5fae758cf94da6b6028aef39aab2e3d29952daffb4c6f4bdadc81d34d564cf53fe89b61957dd365781c8f01eb0388aa37adaef960bb742e4fabe917e5160690ae5e7864077186c991ebae994e5b648f7c6943dae215eea8bd90a9076192e54c1db3369e1f8df4634681c6cfc1eb835fb96e29d703a2d59891203fcb4d333d89cca5f354bbce73c17e741215122afd5a3bacf6ecdf92a27f5a43ed0aaea5c629f77f272dc35cd8f7fadb34e3346dc522daa047f5b6ec1d6becd15b4ee357bad04c7a242bd3d885f9a4538c4332d16b7e60d51046996a4f2b4c0cfa7d8180e10c0bee2647efd3d1990d496596787343d511568860173494cf1387bf87e6dc39d97195765f700c47bdef1cecc479c359f4042579d3aace618286f5cd69bfcfb720a65a0490caca2a2e75f4b841773c16470b0def2d8a0458a790a3444bda380ba7233898e0bf76df8979608826fca92abfd8af8d0268bef4b2a15d0f77205361c87463476a421dc99b5a8fb4483380ded667a0f83ff6d7c96d2dd463522435079825548df6bcfecac86916e96353e290b206649ec98d2aa4a6f965f01f2872c74b0a7abe55a06d63c2428ed320a0f05126fdda167aae35442af78daef9377489aca5c9942741e37e328580c72e39b37db81d77100686e7d2d51795bea1c9d964209730b86df88b2fabb45c3334c9b161f045defde476c755e2f62ab8687230fd75130e71248d55cc29f455043fdce151668a9a6fa7ad80f083ea518e1c2e24d027fffdce35cb6105e3e31aa6b9747b04e921626884a8f5fdd7956ef4e8a3b4207c41c3c48ea538c55b82eb0f910581fe086b6a2c5c14b4c56271e97c2e308e8ee0b9bf085d96422a54db4f51a9224f908a5ea11243b6b168a377dc62029f7f761dbe03018dbdca3d4189bdd64e55ace03f46d44dedb1312d1a73532dcf7a5a733f107fc8a63b14f43692a7fe3f7a8d0243b54e55a16a8e152153ec9634b2853c6fd934783508a3988aabbe5d70e4bad4431bcfa098ca167b0f53c44b1462773d4a5e11ccccd5faa8504929aad1cbc6339fcc8d1c98009b0a89eea267e1d990da596f6c0bc0414fbe50be2a0eedd53753d7165b032811aac0b8fb50a3e79797b19ee0afc64380337994d67795c0ee9aa331fc0f4467a01b8d51f0de98273956870fd748aa5857798f0b21fa046d5be78932d3c924dcc33908d8e24173f66e3e5a6f9de1c99c695b71b57e5dadf6f18a8293053392b32bf7c5b04aa8b81079d96f37e56231dd0de1dfdd982f1eda3fb6c7822bae308c921671cde5cd09b08661530477dfb40c6391baa67afc792978a5194bef9d8130652fc79593a11e1f92dc5676a7fdb898be332970b00734cab5905ca30fd1736f0dd111c65f0e1081a6eb53f997a8c65d9795dfe5253c289ef7f22944aefddb5af67aa0a2b63a49d34493123e1a8be2bc05645e4c18c1c207d12bb7d83385e7baf68579b6dd6d2445625fe4f9a0ab83440b8fdc4538c27edd9a154fcf16f1b64c2a5209912a95185f9952ba3a61b47d3df2cfc641ae231262d99b47cdeed42c201fad5c8535da63769e585d9c4044eeb1318f63fd2ee6814fd7c0a4e50a0c88761d59df5c070d7adc1bc2b18291d4695e1530dba8cbf0622d8b7ec291994ee7dad20ab9744c8d18c18e5f320845f03dd6c45771f3b9f55f0e318569bf6ea33bc9c129f42c90f72baab80785d30bf7fb17739084a2e4e54b406e2367b418ba406f4926d7a14c1309d3492cae1ba6115f31394a139a83355d652e862a99cde496778ec4af5239530ca2f96a3139c377a3176eebb03249b479c46047d7c88c702c4d4b1b85b239aef5758d0e9a900cacbbef5e8e1024753bdd08ff36a2ffc841444d5a879f2f0a84d7e154d860ade1e3bd8c47d3a352bbd467e425cdf187c77e4d7dd8fd59b4e41505ebf2b4f5b639fa956d6fdefd1bb043c739aef23073f8446c005bf1475e4dd1ce19e6895e8594d04f09aa97eeb5d39dce6877bef4ae92d53b0a7aa282cb8663189c84138e9ad943a63e546115db6f51fa73a9189205d269cc0010cd2f53352cebce4c8cf406a03740a52533de72893dee1c353a9a8b079eaa260f3840ce4b9df5c51ade5b4c174a974e5129046fd16aee488a11aedac9d79df147ab18f8688ce5e4c6828aa17882f1fa08496b2a4fb27d854713b620d744a80947358044d468d30ca0b7bd7ec64408ea81758b36ba6d78ab06e9b2a962801cc9c06f556f3285bd83f4532f3aa88e9edbe2396cc46c3323ced47d1c0eaabd3db406e775598d05a7ab77380b0c12aa3b52e2374a7176a71dd717aa8c293c20b58bf3e995da88d488299893ebd01f7b88779037378021ccaf682f365975774b1d7a5bb328184becfc67bb32f856630f122ed941e430ef98c5f237cbe07c6f0664c5ebb0e74bb5d3c799cc06b5d24ac01afd8f74ca5d39b77cc28ef172fe1329ae5dff048fe580041a09dfe7bc2c5f71fdc057ebe10cbeadcb8143dd6ff59bfe246a580b9d51fce92c7ca8bd19f4ca06ae6248b89fd1edc79a17693041f945b44bb323fc75fb227b5d358ccde6c118d25c1b99cbd865291fa94130086bd63907b451115816d74ac441c2d7b50558bac1b15613d30ad9a48febec0a1eecfd1f3e062da0928ca51778d51c3905b7df864ed4ac9fb71abe0d06ca08f24f00987c3ff8866d67ea83206c1caae5b13a99d5f70f131a030d0a1666dc885f3b93b31163c9e3fe2f674204f9ad03408fe33a5835d7644dff06e4edb2d02135adb9c0d4b08deb2b33f6c945f584b8a62d821a760574d4a4e8cc978e7d0c768bfc7aad17b6c075efd7d2172f07d1624ced7707ce623258f4edba63824e6c91c7d3954e019a7b7762d9b76870d7495094d1784938413c78cb6ee60da2f75dd5943ac2eb5d9706bf2f780cd4fed895e7a45d36e130855a70e6016fff391197936f2758ee5fc3f96c54da9923021fe4c31f8b558321d055057a16c8e842380cccd3868fce3058b3f9012bcc72658a74b16e94c0658011380f760bbddc5894fd1d2fef268e232e571be11ffcee26e1126bbfb0cdc6dd842979fcf99ea4f198172294975a9d19f2c0d0836f72408fd4e9d0db8f763b42b03eac1d6bf3d37528c781815c9e8ef795eadd4bc25893e9955d485940b9cc6b0f026f2375a56c7062cc9b623356be3a2b9067bd39c3546b17a6a50a76cd9929a02e50ad2757f4e3de700098a562ee52ebdd8e0b1d06054f7eb628c3c029f85e13c955b9470aa60136c9811c754de74f9d072829b3ba9ce06a9029dc4a0d0dac78959633f9d5468b7a9b24d9165c4a0bdee3597576e7f003531a777a2c53b75f5d83515735e658d0cea028a18f80f081453aae101868c5d16eb5b589ed7a5ad5dfbafbb2a0fcb93a00a1dde1af8d0619cbc45b0cec06e057b6c98aeb16b13f607f49f0e6ba85260ed02342732b8606cd91d63bd213d1e868325beed799f0155fcb48d4a48d4817d07ac0f3efc88d957a49ddde3eaa100b4c4b440187383c24dccc41899565816699b49d50975ad9350b639670d70df8c5d88c0db24d9dcd2cb54a3fab6acb43dabb48a006e19d2adefcf2842d8014695ced91e2b18f7cdfbb2429502a8d1102f3b81fa0ebd57d80fea9ebfff488af104f9c86ee70ae9e90c4ecc372ab11f54a4919ede11c2656f724c36dee856d0611044e5ddce712501d2bad3d37d8462fd96a3e70e5e24a107b5552dad4e62b0e9d562f1a1f35f919d8b931bebe061df7250abd2e444af04bd9d7f2dc9fe973be75fb92d0e8453a1891be8c733cab5d7ceb3ff1ef4939b1430411035aec9dca80dd8745f29343cec8aea7d7239751529bfb132175fe2f746768216d12c44aff71ffaea1442c2e88b02d0da6b25853eafc8768a04a6873f1aec7605233e723a99153a847ac1f5d006521b6b935dd926a75b1e95ef0afa14aa73be61e761bc21add0cd3aea4197c9657d96d8e3b9ea19874e8de85b512640e2d0ad7500e079bede6a4eb881568fa2c8e49ec0eac5a226a2d1c80b2682251a3045ccbf07d2b30e5d54ab661c092eb93f3f020c5f1be9bacc5faf5e3bf5d758c753f70178acc42f64c3529e9f598a8a27409da681b2f8e2e35b59f8df89b3baa4700285639e6e8b9d79306744e582094fd58864f8773d2e3490401752ef4c15c97639c9d6fccb122456cef930b66c46605fb636e86ab43d3b1d8ae56e51a34d24eb830ed12d1a769ba60cc82d62a881deec13e01270e76ebfc2a39af42210edd16b647d96b0e643ff0dcde1f6ad5538aa2ed28e09b24cedd2eb762786aef9289876cef479071b0a53b5e1a1cb9de873b3bbc9ab2674bc04f63f4dc4e6e98084523ec53b66c1add4ca97f3529c9b69a9d4a51e7a492989c016f4c3e9f2565005405c35450a41d322f63f3f50dbf1b6fef70301215302896fb28af05ff01c77389bdd2ec12491f3eb01522e886c670ecf16c30639967b55953f83fed4889e06e252372b2c56710b83d3e8551257b684ad93a0cedebc9e5f8dd0420adf3566a7e778b221cf33d0de0d9f44e525e521507127ac210dad44813e1fcafab6078eeb1d4e25a4d3e426dd652710808c8751a144eab07eaeeac18ef9e8fc41efbc6201bd3f7c6b41ba010823561f7bd0997885c276fd542bb16166ce12b30cdce68a386978eb3f082cc39ef4fbbb6fd550caebd5a382f4312dee1c34ba04e7f8f1be953eea35c2aad77b14a314f1295217a9c21b8723193050fbf04d9d31220", 0x1000}], 0x1, 0x5) kernel console output (not intermixed with test programs): ][ T747] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 41.836134][ T759] rust_binder: Failed copying into alloc: EFAULT [ 41.836154][ T759] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 41.842810][ T759] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 41.851567][ T759] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:115 [ 42.020577][ T747] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 42.036978][ T747] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 42.117660][ T419] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 42.268757][ T419] usb 1-1: config 0 has an invalid interface number: 18 but max is 0 [ 42.276922][ T419] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 42.287082][ T419] usb 1-1: config 0 has no interface number 0 [ 42.293209][ T419] usb 1-1: New USB device found, idVendor=050d, idProduct=011b, bcdDevice=6f.a4 [ 42.302328][ T419] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 42.311032][ T419] usb 1-1: config 0 descriptor?? [ 42.317288][ T419] usb 1-1: bad CDC descriptors [ 42.447195][ T45] cdc_ether 3-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.2-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 42.603306][ T419] usb 1-1: USB disconnect, device number 7 [ 42.648179][ T31] usb 3-1: USB disconnect, device number 7 [ 42.655197][ T31] cdc_ether 3-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.2-1, CDC Ethernet Device [ 43.110197][ T36] kauditd_printk_skb: 19 callbacks suppressed [ 43.110216][ T36] audit: type=1400 audit(1756208081.300:258): avc: denied { mount } for pid=815 comm="syz.3.143" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 43.138859][ T816] overlayfs: failed to clone lowerpath [ 43.170262][ T36] audit: type=1400 audit(1756208081.360:259): avc: denied { setopt } for pid=819 comm="syz.2.145" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 43.417644][ T419] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 43.567630][ T419] usb 3-1: Using ep0 maxpacket: 32 [ 43.574109][ T419] usb 3-1: unable to get BOS descriptor or descriptor too short [ 43.582572][ T419] usb 3-1: config 1 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 43.593514][ T419] usb 3-1: config 1 interface 0 has no altsetting 0 [ 43.601511][ T419] usb 3-1: New USB device found, idVendor=05ac, idProduct=024e, bcdDevice= 0.40 [ 43.610632][ T419] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.618649][ T419] usb 3-1: Product: syz [ 43.622804][ T419] usb 3-1: Manufacturer: syz [ 43.627403][ T419] usb 3-1: SerialNumber: syz [ 43.837928][ T419] usb 3-1: USB disconnect, device number 8 [ 43.987711][ T826] TCP: out of memory -- consider tuning tcp_mem [ 44.022154][ T830] rust_binder: Write failure EFAULT in pid:124 [ 44.022777][ T830] rust_binder: Write failure EFAULT in pid:124 [ 44.104540][ T842] rust_binder: 833 RLIMIT_NICE not set [ 44.131257][ T36] audit: type=1400 audit(1756208082.320:260): avc: denied { create } for pid=843 comm="syz.0.152" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 44.156303][ T36] audit: type=1400 audit(1756208082.320:261): avc: denied { read } for pid=843 comm="syz.0.152" name="uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 44.352523][ T856] netlink: 8 bytes leftover after parsing attributes in process `syz.2.156'. [ 44.617645][ T419] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 44.767633][ T419] usb 3-1: Using ep0 maxpacket: 16 [ 44.774036][ T419] usb 3-1: unable to get BOS descriptor or descriptor too short [ 44.782502][ T419] usb 3-1: config 9 has an invalid interface number: 63 but max is 1 [ 44.790650][ T419] usb 3-1: config 9 has an invalid interface number: 159 but max is 1 [ 44.798864][ T419] usb 3-1: config 9 has no interface number 0 [ 44.804948][ T419] usb 3-1: config 9 has no interface number 1 [ 44.811077][ T419] usb 3-1: config 9 interface 63 has no altsetting 0 [ 44.819078][ T419] usb 3-1: New USB device found, idVendor=0582, idProduct=0005, bcdDevice=5c.87 [ 44.828165][ T419] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.836268][ T419] usb 3-1: Product: syz [ 44.840470][ T419] usb 3-1: Manufacturer: syz [ 44.845091][ T419] usb 3-1: SerialNumber: syz [ 44.968698][ T863] rust_binder: 133: no such ref 1 [ 45.028377][ T865] rust_binder: 863 RLIMIT_NICE not set [ 45.028959][ T36] audit: type=1400 audit(1756208083.220:262): avc: denied { map } for pid=862 comm="syz.0.158" path="socket:[6234]" dev="sockfs" ino=6234 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 45.059534][ T36] audit: type=1400 audit(1756208083.220:263): avc: denied { read accept } for pid=862 comm="syz.0.158" path="socket:[6234]" dev="sockfs" ino=6234 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 45.067738][ T31] rust_binder: 862: removing orphan mapping 0:24 [ 45.148855][ T419] usb 3-1: USB disconnect, device number 9 [ 45.162677][ T365] udevd[365]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:9.63/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 45.178444][ T36] audit: type=1400 audit(1756208083.350:264): avc: denied { setopt } for pid=871 comm="syz.3.161" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 45.328296][ T369] usb 2-1: string descriptor 0 read error: -32 [ 45.341227][ T369] usb 2-1: USB disconnect, device number 8 [ 45.358505][ T36] audit: type=1400 audit(1756208083.550:265): avc: denied { ioctl } for pid=874 comm="syz.1.162" path="socket:[6319]" dev="sockfs" ino=6319 ioctlcmd=0x8982 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 45.440428][ T881] input: syz0 as /devices/virtual/input/input9 [ 45.629619][ T888] netlink: 228 bytes leftover after parsing attributes in process `syz.0.166'. [ 45.692914][ T36] audit: type=1400 audit(1756208083.880:266): avc: denied { rename } for pid=898 comm="syz.0.170" name="file0" dev="tmpfs" ino=294 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 45.754133][ T36] audit: type=1400 audit(1756208083.940:267): avc: denied { read } for pid=904 comm="syz.2.173" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 45.777882][ T369] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 45.907650][ T369] usb 2-1: device descriptor read/64, error -71 [ 45.957653][ T419] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 45.987638][ T31] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 46.003475][ T908] fuse: Bad value for 'fd' [ 46.107684][ T419] usb 1-1: Using ep0 maxpacket: 8 [ 46.115204][ T419] usb 1-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 46.124334][ T419] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 46.132522][ T419] usb 1-1: Product: syz [ 46.136716][ T419] usb 1-1: Manufacturer: syz [ 46.141326][ T419] usb 1-1: SerialNumber: syz [ 46.146428][ T419] usb 1-1: config 0 descriptor?? [ 46.151447][ T369] usb 2-1: device descriptor read/64, error -71 [ 46.159398][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 46.170375][ T31] usb 3-1: New USB device found, idVendor=1b96, idProduct=0003, bcdDevice= 0.00 [ 46.179444][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 46.188193][ T31] usb 3-1: config 0 descriptor?? [ 46.193419][ T905] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 46.397678][ T369] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 46.413965][ T419] usb 1-1: USB disconnect, device number 8 [ 46.537678][ T369] usb 2-1: device descriptor read/64, error -71 [ 46.592165][ T925] fuse: Bad value for 'fd' [ 46.614450][ T31] ntrig 0003:1B96:0003.0007: hidraw0: USB HID v1.01 Device [HID 1b96:0003] on usb-dummy_hcd.2-1/input0 [ 46.777674][ T369] usb 2-1: device descriptor read/64, error -71 [ 46.811785][ T905] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 46.822114][ T31] usb 3-1: USB disconnect, device number 10 [ 46.881597][ T944] overlayfs: failed to clone upperpath [ 46.887732][ T369] usb usb2-port1: attempt power cycle [ 46.913839][ T948] overlayfs: failed to clone upperpath [ 46.972267][ T961] netlink: 'syz.3.195': attribute type 6 has an invalid length. [ 46.982332][ T961] tmpfs: Bad value for 'huge' [ 47.076874][ T985] binder: Unknown parameter 'contextÀifÆ"Îj„Š™€×Ï–í‰6“+ì#2¸€Z÷¾É[LÅɵÖ{îΉ¦rÅj쪙6e$' [ 47.193744][ T990] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:163 [ 47.227650][ T369] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 47.258678][ T369] usb 2-1: device descriptor read/8, error -71 [ 47.332616][ T992] overlayfs: failed to resolve 'redirect_dir=follow': -2 [ 47.355632][ T995] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 47.355649][ T995] rust_binder: Read failure Err(EFAULT) in pid:83 [ 47.364174][ T995] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:83 [ 47.398682][ T369] usb 2-1: device descriptor read/8, error -71 [ 47.657651][ T369] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 47.678682][ T369] usb 2-1: device descriptor read/8, error -71 [ 47.808674][ T369] usb 2-1: device descriptor read/8, error -71 [ 47.917744][ T369] usb usb2-port1: unable to enumerate USB device [ 47.927410][ T1007] netlink: 140 bytes leftover after parsing attributes in process `syz.3.211'. [ 47.965505][ T1015] process 'syz.3.214' launched './file1' with NULL argv: empty string added [ 47.978559][ T369] rust_binder: 987: removing orphan mapping 0:24 [ 48.169238][ T1021] fuseblk: Unknown parameter 'jd' [ 48.174610][ T36] kauditd_printk_skb: 16 callbacks suppressed [ 48.174628][ T36] audit: type=1400 audit(1756208086.360:284): avc: denied { remount } for pid=1020 comm="syz.0.216" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 48.227795][ T36] audit: type=1400 audit(1756208086.420:285): avc: denied { ioctl } for pid=1020 comm="syz.0.216" path="socket:[6517]" dev="sockfs" ino=6517 ioctlcmd=0x8954 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 48.252196][ T36] audit: type=1400 audit(1756208086.420:286): avc: denied { read write } for pid=1020 comm="syz.0.216" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 48.277678][ T36] audit: type=1400 audit(1756208086.420:287): avc: denied { open } for pid=1020 comm="syz.0.216" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 48.385930][ T1026] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:90 [ 48.970042][ T1034] rust_binder: Error in use_page_slow: ESRCH [ 48.976133][ T1034] rust_binder: use_range failure ESRCH [ 48.976150][ T1034] rust_binder: Failed to allocate buffer. len:120, is_oneway:false [ 48.981689][ T1034] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 48.990223][ T1034] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:173 [ 49.210712][ T1057] rust_binder: Error while translating object. [ 49.210783][ T1057] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 49.223675][ T1057] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:94 [ 49.377666][ T369] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 49.405800][ T36] audit: type=1400 audit(1756208087.590:288): avc: denied { create } for pid=1067 comm="syz.0.230" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 49.427495][ T36] audit: type=1400 audit(1756208087.590:289): avc: denied { write } for pid=1067 comm="syz.0.230" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 49.487648][ T419] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 49.537656][ T369] usb 2-1: Using ep0 maxpacket: 8 [ 49.546537][ T369] usb 2-1: too many endpoints for config 0 interface 0 altsetting 250: 255, using maximum allowed: 30 [ 49.559621][ T369] usb 2-1: config 0 interface 0 altsetting 250 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 49.572914][ T369] usb 2-1: config 0 interface 0 has no altsetting 0 [ 49.579702][ T369] usb 2-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 49.588796][ T369] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.597539][ T369] usb 2-1: config 0 descriptor?? [ 49.617709][ T419] usb 3-1: device descriptor read/64, error -71 [ 49.672588][ T36] audit: type=1400 audit(1756208087.860:290): avc: denied { mounton } for pid=1071 comm="syz.0.231" path="/64/file0" dev="tmpfs" ino=377 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 49.672652][ T1072] fuse: Unknown parameter 'Æ' [ 49.705228][ T36] audit: type=1400 audit(1756208087.890:291): avc: denied { ioctl } for pid=1071 comm="syz.0.231" path="/dev/fuse" dev="devtmpfs" ino=23 ioctlcmd=0xf509 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 49.706655][ T1072] rust_binder: Write failure EFAULT in pid:203 [ 49.745952][ T36] audit: type=1400 audit(1756208087.930:292): avc: denied { getopt } for pid=1073 comm="syz.0.232" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 49.857856][ T419] usb 3-1: device descriptor read/64, error -71 [ 49.987631][ T9] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 50.010827][ T369] gt683r_led 0003:1770:FF00.0008: hidraw0: USB HID vf4.f6 Device [HID 1770:ff00] on usb-dummy_hcd.1-1/input0 [ 50.097702][ T419] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 50.137668][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 50.143936][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 50.155017][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 50.164898][ T9] usb 1-1: New USB device found, idVendor=0458, idProduct=5012, bcdDevice= 0.00 [ 50.174055][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 50.182734][ T9] usb 1-1: config 0 descriptor?? [ 50.237689][ T419] usb 3-1: device descriptor read/64, error -71 [ 50.477707][ T419] usb 3-1: device descriptor read/64, error -71 [ 50.597839][ T419] usb usb3-port1: attempt power cycle [ 50.791995][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 50.799188][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 50.810161][ T9] usb 1-1: USB disconnect, device number 9 [ 50.937711][ T419] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 50.958798][ T419] usb 3-1: device descriptor read/8, error -71 [ 51.089280][ T419] usb 3-1: device descriptor read/8, error -71 [ 51.327541][ T1085] rust_binder: validate_parent_fixup: new_min_offset=18, sg_entry.length=0 [ 51.327567][ T1085] rust_binder: Error while translating object. [ 51.337504][ T1085] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 51.343880][ T419] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 51.361145][ T1085] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:207 [ 51.395037][ T1087] netlink: 'syz.0.237': attribute type 4 has an invalid length. [ 51.419259][ T419] usb 3-1: device descriptor read/8, error -71 [ 51.430365][ T1087] netlink: 'syz.0.237': attribute type 5 has an invalid length. [ 51.438521][ T1087] netlink: 3657 bytes leftover after parsing attributes in process `syz.0.237'. [ 51.548826][ T419] usb 3-1: device descriptor read/8, error -71 [ 51.657802][ T419] usb usb3-port1: unable to enumerate USB device [ 52.059251][ T36] audit: type=1400 audit(1756208090.250:293): avc: denied { ioctl } for pid=1095 comm="syz.3.240" path="socket:[7851]" dev="sockfs" ino=7851 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 52.112436][ T45] usb 2-1: USB disconnect, device number 13 [ 52.120720][ T351] gt683r_led 0003:1770:FF00.0008: failed to send set report request: -19 [ 52.128895][ T1104] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 52.310806][ T1109] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 52.326595][ T1128] incfs: Error accessing: ./file0. [ 52.338495][ T1128] incfs: mount failed -20 [ 52.343553][ T1128] fuseblk: Bad value for 'fd' [ 52.398472][ T1134] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 52.398505][ T1134] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:99 [ 52.408001][ T1134] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 52.417089][ T1134] rust_binder: Read failure Err(EFAULT) in pid:99 [ 52.567698][ T419] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 52.727637][ T419] usb 2-1: Using ep0 maxpacket: 16 [ 52.733837][ T419] usb 2-1: unable to get BOS descriptor set [ 52.740507][ T419] usb 2-1: config 1 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 52.753341][ T419] usb 2-1: config 1 interface 0 has no altsetting 0 [ 52.761350][ T419] usb 2-1: New USB device found, idVendor=0c70, idProduct=f011, bcdDevice= 0.40 [ 52.770455][ T419] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 52.778450][ T419] usb 2-1: Product: syz [ 52.782779][ T419] usb 2-1: Manufacturer: syz [ 52.787359][ T419] usb 2-1: SerialNumber: syz [ 52.882786][ T1136] devpts: called with bogus options [ 53.417648][ T45] usb 3-1: new low-speed USB device number 15 using dummy_hcd [ 53.569085][ T45] usb 3-1: LPM exit latency is zeroed, disabling LPM. [ 53.576730][ T45] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 8 [ 53.587541][ T45] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 53.602503][ T45] usb 3-1: string descriptor 0 read error: -22 [ 53.608745][ T45] usb 3-1: New USB device found, idVendor=0eef, idProduct=7302, bcdDevice= 0.40 [ 53.617811][ T45] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.627175][ T1141] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 53.644381][ T1145] netlink: 'syz.0.256': attribute type 4 has an invalid length. [ 53.652271][ T1145] netlink: 3657 bytes leftover after parsing attributes in process `syz.0.256'. [ 53.675300][ T1148] netlink: 12 bytes leftover after parsing attributes in process `syz.0.257'. [ 53.685423][ T1148] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:230 [ 53.836539][ T1141] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 53.854314][ T1141] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 53.864840][ T45] usbhid 3-1:1.0: can't add hid device: -71 [ 53.870837][ T45] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 53.881706][ T45] usb 3-1: USB disconnect, device number 15 [ 54.377308][ T1157] rust_binder: Got transaction with invalid offset. [ 54.377379][ T1157] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 54.384122][ T1157] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:106 [ 54.394851][ T1157] netlink: 12 bytes leftover after parsing attributes in process `syz.2.260'. [ 54.555112][ T36] kauditd_printk_skb: 2 callbacks suppressed [ 54.555132][ T36] audit: type=1400 audit(1756208092.740:296): avc: denied { write } for pid=1169 comm="syz.0.265" name="pfkey" dev="proc" ino=4026532478 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 54.646958][ T1176] rust_binder: 236: no such ref 0 [ 54.652154][ T1176] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 54.662353][ T1176] rust_binder: 236: no such ref 0 [ 54.806083][ T1180] rust_binder: inc_ref_done called when no active inc_refs [ 55.057655][ T369] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 55.157672][ T419] usbhid 2-1:1.0: can't add hid device: -71 [ 55.163660][ T419] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 55.180160][ T419] usb 2-1: USB disconnect, device number 14 [ 55.196485][ T1193] rust_binder: Failed to allocate buffer. len:8389754715015903632, is_oneway:true [ 55.196516][ T1193] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 55.205847][ T1193] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:114 [ 55.227658][ T369] usb 3-1: Using ep0 maxpacket: 16 [ 55.243331][ T369] usb 3-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 55.262863][ T369] usb 3-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 55.273789][ T369] usb 3-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 55.283605][ T369] usb 3-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 55.296397][ T369] usb 3-1: config 7 interface 0 has no altsetting 0 [ 55.303808][ T369] usb 3-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 55.312886][ T369] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 55.334500][ T36] audit: type=1400 audit(1756208093.520:297): avc: denied { write } for pid=1197 comm="syz.1.275" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 55.399387][ T1201] rust_binder: Error while translating object. [ 55.399432][ T1201] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 55.405644][ T1201] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:122 [ 55.426489][ T1203] 9pnet_virtio: no channels available for device /dev/rnullb0 [ 55.446631][ T1205] fuse: Bad value for 'user_id' [ 55.451572][ T1205] fuse: Bad value for 'user_id' [ 55.472930][ T36] audit: type=1400 audit(1756208093.660:298): avc: denied { mount } for pid=1210 comm="syz.1.279" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 55.495355][ T36] audit: type=1400 audit(1756208093.680:299): avc: denied { mounton } for pid=1210 comm="syz.1.279" path="/45/file0" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=dir permissive=1 [ 55.521555][ T36] audit: type=1400 audit(1756208093.710:300): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 55.533750][ T1213] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 55.541257][ T1213] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:131 [ 55.564923][ T36] audit: type=1400 audit(1756208093.750:301): avc: denied { getopt } for pid=1214 comm="syz.3.281" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 55.617979][ T1219] netlink: 5 bytes leftover after parsing attributes in process `syz.1.282'. [ 55.701778][ T351] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 55.753485][ T369] input: HID 0458:5010 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:7.0/0003:0458:5010.0009/input/input11 [ 55.779367][ T369] kye 0003:0458:5010.0009: input,hiddev96,hidraw0: USB HID v2.00 Device [HID 0458:5010] on usb-dummy_hcd.2-1/input0 [ 55.810291][ T369] usb 3-1: USB disconnect, device number 16 [ 55.847653][ T351] usb 1-1: device descriptor read/64, error -71 [ 55.878315][ T1252] binder: Bad value for 'max' [ 55.894670][ T1254] SELinux: security_context_str_to_sid (syste_uÝGй ‰:ÿß) failed with errno=-22 [ 55.916003][ T36] audit: type=1400 audit(1756208094.100:302): avc: denied { getopt } for pid=1255 comm="syz.2.293" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 55.916498][ T1256] bridge0: entered allmulticast mode [ 55.936609][ T36] audit: type=1400 audit(1756208094.100:303): avc: denied { ioctl } for pid=1255 comm="syz.2.293" path="socket:[7155]" dev="sockfs" ino=7155 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 56.064326][ T36] audit: type=1400 audit(1756208094.250:304): avc: denied { accept } for pid=1263 comm="syz.1.296" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 56.084007][ T1264] netlink: 32 bytes leftover after parsing attributes in process `syz.1.296'. [ 56.093695][ T1264] tmpfs: Bad value for 'nr_inodes' [ 56.099018][ T351] usb 1-1: device descriptor read/64, error -71 [ 56.159684][ T1266] tmpfs: Too few inodes for current use [ 56.227098][ T1269] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 56.269026][ T36] audit: type=1400 audit(1756208094.460:305): avc: denied { connect } for pid=1270 comm="syz.3.299" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 56.311280][ T1281] rust_binder: Fixups oob 164 166 363 196 [ 56.311305][ T1281] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EINVAL } [ 56.317177][ T1281] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 56.326941][ T1281] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:146 [ 56.357674][ T351] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 56.410358][ T1294] rust_binder: Error while translating object. [ 56.410417][ T1294] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 56.416671][ T1294] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:154 [ 56.497656][ T351] usb 1-1: device descriptor read/64, error -71 [ 56.747666][ T351] usb 1-1: device descriptor read/64, error -71 [ 56.857727][ T351] usb usb1-port1: attempt power cycle [ 57.197674][ T351] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 57.218701][ T351] usb 1-1: device descriptor read/8, error -71 [ 57.348678][ T351] usb 1-1: device descriptor read/8, error -71 [ 57.587692][ T351] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 57.608698][ T351] usb 1-1: device descriptor read/8, error -71 [ 57.738737][ T351] usb 1-1: device descriptor read/8, error -71 [ 57.847811][ T351] usb usb1-port1: unable to enumerate USB device [ 66.411724][ T36] kauditd_printk_skb: 3 callbacks suppressed [ 66.411745][ T36] audit: type=1400 audit(1756208104.600:309): avc: denied { create } for pid=1326 comm="syz.1.318" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 66.412262][ T1327] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:159 [ 66.439845][ T1329] 9pnet_fd: Insufficient options for proto=fd [ 66.577644][ T372] usb 3-1: new full-speed USB device number 17 using dummy_hcd [ 66.687640][ T419] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 66.728724][ T372] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 66.739767][ T372] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 66.753261][ T372] usb 3-1: New USB device found, idVendor=056a, idProduct=0020, bcdDevice= 0.00 [ 66.762333][ T372] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=4 [ 66.771131][ T372] usb 3-1: SerialNumber: syz [ 66.776341][ T372] usb 3-1: config 0 descriptor?? [ 66.781605][ T1312] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 66.817659][ T419] usb 2-1: device descriptor read/64, error -71 [ 66.899329][ T36] audit: type=1400 audit(1756208105.090:310): avc: denied { bind } for pid=1335 comm="syz.3.320" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 67.057655][ T419] usb 2-1: device descriptor read/64, error -71 [ 67.195355][ T372] usbhid 3-1:0.0: can't add hid device: -71 [ 67.201339][ T372] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 67.210278][ T372] usb 3-1: USB disconnect, device number 17 [ 67.280755][ T36] audit: type=1400 audit(1756208105.470:311): avc: denied { create } for pid=1353 comm="syz.0.325" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 67.300269][ T419] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 67.447655][ T419] usb 2-1: device descriptor read/64, error -71 [ 67.638561][ T1385] netlink: 'syz.3.335': attribute type 29 has an invalid length. [ 67.657650][ T9] usb 1-1: new low-speed USB device number 14 using dummy_hcd [ 67.697642][ T419] usb 2-1: device descriptor read/64, error -71 [ 67.708461][ T36] audit: type=1400 audit(1756208105.900:312): avc: denied { bind } for pid=1396 comm="syz.3.338" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 67.728661][ T36] audit: type=1400 audit(1756208105.900:313): avc: denied { node_bind } for pid=1396 comm="syz.3.338" saddr=172.20.20.170 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 67.807980][ T419] usb usb2-port1: attempt power cycle [ 67.816011][ T9] usb 1-1: config 0 has an invalid interface number: 245 but max is 0 [ 67.824488][ T9] usb 1-1: config 0 has no interface number 0 [ 67.830972][ T9] usb 1-1: config 0 interface 245 altsetting 7 has an invalid descriptor for endpoint zero, skipping [ 67.844744][ T9] usb 1-1: config 0 interface 245 altsetting 7 endpoint 0xC has invalid maxpacket 64, setting to 8 [ 67.855607][ T9] usb 1-1: config 0 interface 245 altsetting 7 endpoint 0x4 has invalid maxpacket 512, setting to 8 [ 67.866547][ T9] usb 1-1: config 0 interface 245 altsetting 7 endpoint 0xE has invalid maxpacket 64, setting to 8 [ 67.877410][ T9] usb 1-1: config 0 interface 245 altsetting 7 has a duplicate endpoint with address 0xC, skipping [ 67.888611][ T9] usb 1-1: config 0 interface 245 altsetting 7 has a duplicate endpoint with address 0xE, skipping [ 67.899478][ T9] usb 1-1: config 0 interface 245 altsetting 7 has 6 endpoint descriptors, different from the interface descriptor's value: 10 [ 67.913197][ T9] usb 1-1: config 0 interface 245 has no altsetting 0 [ 67.952204][ T36] audit: type=1400 audit(1756208106.140:314): avc: denied { read write } for pid=1403 comm="syz.2.340" name="loop-control" dev="devtmpfs" ino=48 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 67.992729][ T36] audit: type=1400 audit(1756208106.160:315): avc: denied { open } for pid=1403 comm="syz.2.340" path="/dev/loop-control" dev="devtmpfs" ino=48 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 68.157678][ T419] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 68.178817][ T419] usb 2-1: device descriptor read/8, error -71 [ 68.310141][ T419] usb 2-1: device descriptor read/8, error -71 [ 68.457678][ T372] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 68.557649][ T419] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 68.578777][ T419] usb 2-1: device descriptor read/8, error -71 [ 68.607647][ T372] usb 3-1: Using ep0 maxpacket: 32 [ 68.614318][ T372] usb 3-1: config 0 has no interfaces? [ 68.621405][ T372] usb 3-1: New USB device found, idVendor=0cf3, idProduct=817a, bcdDevice=eb.19 [ 68.630512][ T372] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 68.638544][ T372] usb 3-1: Product: syz [ 68.642713][ T372] usb 3-1: Manufacturer: syz [ 68.647316][ T372] usb 3-1: SerialNumber: syz [ 68.656437][ T372] usb 3-1: config 0 descriptor?? [ 68.708770][ T419] usb 2-1: device descriptor read/8, error -71 [ 68.827674][ T419] usb usb2-port1: unable to enumerate USB device [ 68.844214][ T36] audit: type=1400 audit(1756208107.030:316): avc: denied { bind } for pid=1415 comm="syz.3.345" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 68.867658][ T36] audit: type=1400 audit(1756208107.030:317): avc: denied { listen } for pid=1415 comm="syz.3.345" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 68.895271][ T31] usb 3-1: USB disconnect, device number 18 [ 68.908166][ T36] audit: type=1400 audit(1756208107.030:318): avc: denied { accept } for pid=1415 comm="syz.3.345" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 69.476339][ T1432] rust_binder: Write failure EFAULT in pid:170 [ 69.675869][ T1452] netlink: 'syz.3.356': attribute type 20 has an invalid length. [ 69.747651][ T372] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 69.824478][ T13] Bluetooth: hci0: Frame reassembly failed (-84) [ 69.898761][ T372] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 69.917641][ T372] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 69.947901][ T372] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 69.967835][ T372] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 70.000877][ T372] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 70.018242][ T372] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 70.041290][ T372] usb 3-1: config 0 descriptor?? [ 70.077637][ T31] usb 2-1: new full-speed USB device number 19 using dummy_hcd [ 70.228844][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 70.247223][ T31] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 70.277631][ T31] usb 2-1: New USB device found, idVendor=056a, idProduct=0020, bcdDevice= 0.00 [ 70.286704][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 70.313088][ T31] usb 2-1: config 0 descriptor?? [ 70.324555][ T1459] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 70.363927][ T9] usb 1-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=fe.32 [ 70.378300][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 70.387837][ T9] usb 1-1: Product: Ñ [ 70.391924][ T9] usb 1-1: Manufacturer: ÑŽ [ 70.397187][ T9] usb 1-1: config 0 descriptor?? [ 70.407722][ T9] usb 1-1: can't set config #0, error -71 [ 70.420816][ T9] usb 1-1: USB disconnect, device number 14 [ 70.713051][ T372] usbhid 3-1:0.0: can't add hid device: -71 [ 70.719147][ T372] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 70.739790][ T31] wacom 0003:056A:0020.000A: unknown main item tag 0x0 [ 70.750951][ T372] usb 3-1: USB disconnect, device number 19 [ 70.762175][ T31] wacom 0003:056A:0020.000A: item fetching failed at offset 3/5 [ 70.770613][ T31] wacom 0003:056A:0020.000A: parse failed [ 70.776634][ T31] wacom 0003:056A:0020.000A: probe with driver wacom failed with error -22 [ 70.948054][ T13] Bluetooth: hci1: Frame reassembly failed (-84) [ 71.104978][ T372] usb 2-1: USB disconnect, device number 19 [ 71.261242][ T1482] rust_binder: 174: no such ref 0 [ 71.266451][ T1482] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 4294967292 [ 71.498764][ T1487] fuseblk: Bad value for 'fd' [ 71.567630][ T1494] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 71.577663][ T1494] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 71.649819][ T1500] SELinux: security_context_str_to_sid (sytem_uÝGй) failed with errno=-22 [ 71.718995][ T36] kauditd_printk_skb: 3 callbacks suppressed [ 71.719013][ T36] audit: type=1400 audit(1756208109.910:322): avc: denied { setattr } for pid=1504 comm="syz.3.372" name="NETLINK" dev="sockfs" ino=9915 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 71.779268][ T1515] netlink: 188 bytes leftover after parsing attributes in process `syz.3.374'. [ 71.799179][ T36] audit: type=1400 audit(1756208109.990:323): avc: denied { mount } for pid=1516 comm="syz.1.375" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 71.857207][ T36] audit: type=1400 audit(1756208110.010:324): avc: denied { setopt } for pid=1516 comm="syz.1.375" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 71.887722][ T499] Bluetooth: hci0: command 0x1003 tx timeout [ 71.893869][ T383] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 71.903583][ T36] audit: type=1400 audit(1756208110.010:325): avc: denied { mounton } for pid=1516 comm="syz.1.375" path="/dev/ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 71.922060][ T1527] 9pnet_fd: Insufficient options for proto=fd [ 71.927086][ T36] audit: type=1400 audit(1756208110.030:326): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 71.958351][ T36] audit: type=1400 audit(1756208110.090:327): avc: denied { shutdown } for pid=1522 comm="syz.2.376" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 72.137644][ T9] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 72.151945][ T36] audit: type=1400 audit(1756208110.340:328): avc: denied { create } for pid=1547 comm="syz.3.388" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 72.193766][ T36] audit: type=1400 audit(1756208110.340:329): avc: denied { write } for pid=1547 comm="syz.3.388" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 72.302242][ T9] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 72.322396][ T9] usb 2-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 72.368934][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 72.388089][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 72.406417][ T9] usb 2-1: Product: syz [ 72.413175][ T9] usb 2-1: Manufacturer: syz [ 72.431027][ T9] usb 2-1: SerialNumber: syz [ 72.445320][ T9] cdc_ncm 2-1:1.0: skipping garbage [ 72.465448][ T9] cdc_ncm 2-1:1.0: NCM or ECM functional descriptors missing [ 72.472635][ T1577] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 72.481359][ T9] cdc_ncm 2-1:1.0: bind() failure [ 72.489112][ T9] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 72.495914][ T9] cdc_ncm 2-1:1.1: bind() failure [ 72.500002][ T1577] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 72.638828][ T1581] netlink: 20 bytes leftover after parsing attributes in process `syz.3.396'. [ 72.650290][ T9] usb 2-1: USB disconnect, device number 20 [ 72.770068][ T1592] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 72.771292][ T1592] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:195 [ 72.771869][ T1593] netlink: 24 bytes leftover after parsing attributes in process `syz.1.399'. [ 72.857652][ T372] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 72.939391][ T1600] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1735060478 (27760967648 ns) > initial count (27267544304 ns). Using initial count to start timer. [ 72.957883][ T1600] kvm: pic: single mode not supported [ 72.958097][ T1600] kvm: pic: non byte read [ 72.968105][ T1600] kvm: pic: non byte write [ 72.972547][ T1600] kvm: pic: non byte read [ 72.976975][ T1600] kvm: pic: non byte write [ 72.981593][ T1600] kvm: pic: non byte read [ 72.986022][ T1600] kvm: pic: non byte write [ 72.990498][ T1600] kvm: pic: non byte read [ 72.994935][ T1600] kvm: pic: non byte write [ 72.997641][ T372] usb 1-1: device descriptor read/64, error -71 [ 72.999447][ T1600] kvm: pic: non byte read [ 73.008331][ T1602] rust_binder: Write failure EFAULT in pid:196 [ 73.009971][ T53] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 73.017704][ T383] Bluetooth: hci1: command 0x1003 tx timeout [ 73.022591][ T1600] kvm: pic: non byte write [ 73.032893][ T1600] kvm: pic: non byte read [ 73.037400][ T1600] kvm: pic: non byte write [ 73.041954][ T1600] kvm: pic: non byte read [ 73.046413][ T1600] kvm: pic: non byte write [ 73.050904][ T1600] kvm: pic: non byte read [ 73.055379][ T1600] kvm: pic: non byte write [ 73.059950][ T1600] kvm: pic: non byte read [ 73.064428][ T1600] kvm: pic: non byte write [ 73.068920][ T1600] kvm: pic: non byte read [ 73.073377][ T1600] kvm: pic: non byte write [ 73.181428][ T1611] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 73.181464][ T1611] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:203 [ 73.247654][ T372] usb 1-1: device descriptor read/64, error -71 [ 73.292356][ T36] audit: type=1400 audit(1756208111.480:330): avc: denied { connect } for pid=1612 comm="syz.3.405" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 73.392599][ T1621] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.392771][ T1621] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.410119][ T36] audit: type=1400 audit(1756208111.600:331): avc: denied { map } for pid=1623 comm="syz.1.409" path="socket:[9091]" dev="sockfs" ino=9091 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 73.439641][ T9] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 73.447321][ T1624] netlink: 'syz.1.409': attribute type 6 has an invalid length. [ 73.469535][ T1628] fuse: Bad value for 'rootmode' [ 73.475222][ T1628] fuse: Unknown parameter '' [ 73.480964][ T1628] overlayfs: missing 'workdir' [ 73.498896][ T1630] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.506185][ T1631] rust_binder: Failed to allocate buffer. len:1144, is_oneway:true [ 73.506212][ T1631] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 73.514442][ T1631] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:211 [ 73.517642][ T372] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 73.598729][ T9] usb 3-1: config 50 has an invalid descriptor of length 0, skipping remainder of the config [ 73.609049][ T9] usb 3-1: config 50 has 0 interfaces, different from the descriptor's value: 1 [ 73.618918][ T9] usb 3-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 73.628097][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=205 [ 73.636261][ T9] usb 3-1: SerialNumber: syz [ 73.667652][ T372] usb 1-1: device descriptor read/64, error -71 [ 73.777666][ T45] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 73.907685][ T45] usb 2-1: device descriptor read/64, error -71 [ 73.914060][ T372] usb 1-1: device descriptor read/64, error -71 [ 74.027837][ T372] usb usb1-port1: attempt power cycle [ 74.157669][ T45] usb 2-1: device descriptor read/64, error -71 [ 74.245194][ T917] usb 3-1: USB disconnect, device number 20 [ 74.367745][ T372] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 74.389212][ T372] usb 1-1: device descriptor read/8, error -71 [ 74.397751][ T45] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 74.518756][ T372] usb 1-1: device descriptor read/8, error -71 [ 74.527687][ T45] usb 2-1: device descriptor read/64, error -71 [ 74.757691][ T372] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 74.767745][ T45] usb 2-1: device descriptor read/64, error -71 [ 74.778412][ T1644] KVM: debugfs: duplicate directory 1644-4 [ 74.778728][ T372] usb 1-1: device descriptor read/8, error -71 [ 74.877712][ T45] usb usb2-port1: attempt power cycle [ 74.918709][ T372] usb 1-1: device descriptor read/8, error -71 [ 75.037711][ T372] usb usb1-port1: unable to enumerate USB device [ 75.217665][ T45] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 75.238649][ T45] usb 2-1: device descriptor read/8, error -71 [ 75.307648][ T372] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 75.368641][ T45] usb 2-1: device descriptor read/8, error -71 [ 75.458639][ T372] usb 3-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 75.469643][ T372] usb 3-1: config 0 interface 0 altsetting 64 endpoint 0x2 has an invalid bInterval 244, changing to 11 [ 75.480887][ T372] usb 3-1: config 0 interface 0 has no altsetting 0 [ 75.487935][ T372] usb 3-1: New USB device found, idVendor=172f, idProduct=0034, bcdDevice= 0.00 [ 75.497083][ T372] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.497127][ T1662] /dev/rnullb0: Can't open blockdev [ 75.517897][ T372] usb 3-1: config 0 descriptor?? [ 75.598067][ T1672] rust_binder: Error while translating object. [ 75.598103][ T1672] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 75.604304][ T1672] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:286 [ 75.617718][ T45] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 75.658703][ T45] usb 2-1: device descriptor read/8, error -71 [ 75.788537][ T45] usb 2-1: device descriptor read/8, error -71 [ 75.897728][ T45] usb usb2-port1: unable to enumerate USB device [ 75.926886][ T372] waltop 0003:172F:0034.000B: hidraw0: USB HID v4.f9 Device [HID 172f:0034] on usb-dummy_hcd.2-1/input0 [ 76.128573][ T1658] rust_binder: validate_parent_fixup: new_min_offset=18, sg_entry.length=0 [ 76.128601][ T1658] rust_binder: Error while translating object. [ 76.137252][ T1658] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 76.143513][ T1658] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:221 [ 76.153936][ T45] usb 3-1: USB disconnect, device number 21 [ 85.862400][ T36] kauditd_printk_skb: 7 callbacks suppressed [ 85.862419][ T36] audit: type=1400 audit(1756208124.050:339): avc: denied { create } for pid=1696 comm="syz.1.435" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 85.894868][ T1694] netlink: 20 bytes leftover after parsing attributes in process `syz.2.433'. [ 86.022707][ T36] audit: type=1400 audit(1756208124.210:340): avc: denied { bind } for pid=1714 comm="syz.1.440" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 86.043561][ T1715] netlink: 4 bytes leftover after parsing attributes in process `syz.1.440'. [ 86.052995][ T1715] netlink: 4 bytes leftover after parsing attributes in process `syz.1.440'. [ 86.061909][ T36] audit: type=1400 audit(1756208124.230:341): avc: denied { setopt } for pid=1714 comm="syz.1.440" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 86.483149][ T1729] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 86.503910][ T1732] rust_binder: 240: no such ref 0 [ 86.509458][ T1734] rust_binder: 240: no such ref 0 [ 86.514739][ T1732] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 86.514756][ T1732] rust_binder: Read failure Err(EFAULT) in pid:240 [ 86.523182][ T1734] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 86.546624][ T1736] binder: Unknown parameter '–º' [ 86.552478][ T1736] rust_binder: Error while translating object. [ 86.552511][ T1736] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 86.560864][ T1736] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:298 [ 86.626075][ T1749] rust_binder: Error while translating object. [ 86.638350][ T1728] tipc: Started in network mode [ 86.649782][ T1749] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 86.649814][ T1749] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:249 [ 86.659509][ T1728] tipc: Node identity 36cefc039d0e, cluster identity 4711 [ 86.684156][ T1747] rust_binder: Error while translating object. [ 86.684195][ T1747] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 86.691108][ T1728] tipc: Enabled bearer , priority 10 [ 86.706914][ T1747] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:224 [ 86.778414][ T36] audit: type=1400 audit(1756208124.970:342): avc: denied { append } for pid=1765 comm="syz.1.456" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 86.811236][ T1766] rust_binder: 227: no such ref 1 [ 86.867696][ T369] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 87.017784][ T9] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 87.026570][ T369] usb 1-1: config 1 has an invalid descriptor of length 102, skipping remainder of the config [ 87.039670][ T369] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 87.053274][ T369] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 87.062829][ T369] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 87.071088][ T369] usb 1-1: SerialNumber: syz [ 87.077701][ T369] usb 1-1: 0:2 : does not exist [ 87.082594][ T369] usb 1-1: unit 48 not found! [ 87.147668][ T419] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 87.169364][ T9] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 87.179070][ T9] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 87.188786][ T9] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 87.202986][ T9] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 87.212129][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 87.220323][ T9] usb 3-1: Product: syz [ 87.224483][ T9] usb 3-1: Manufacturer: syz [ 87.229200][ T9] usb 3-1: SerialNumber: syz [ 87.279022][ T45] usb 1-1: USB disconnect, device number 19 [ 87.308658][ T419] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 87.318508][ T419] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 87.331395][ T419] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 87.340479][ T419] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.349118][ T419] usb 2-1: config 0 descriptor?? [ 87.436101][ T9] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 22 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 87.568054][ T419] kovaplus 0003:1E7D:2D50.000C: hidraw0: USB HID v0.00 Device [HID 1e7d:2d50] on usb-dummy_hcd.1-1/input0 [ 87.761178][ T419] kovaplus 0003:1E7D:2D50.000C: couldn't init struct kovaplus_device [ 87.777635][ T419] kovaplus 0003:1E7D:2D50.000C: couldn't install mouse [ 87.788343][ T419] kovaplus 0003:1E7D:2D50.000C: probe with driver kovaplus failed with error -32 [ 87.808522][ T419] tipc: Node number set to 2881551363 [ 87.813736][ T372] usb 3-1: USB disconnect, device number 22 [ 87.824460][ T372] usblp0: removed [ 87.915905][ T45] usb 2-1: USB disconnect, device number 25 [ 87.952148][ T36] audit: type=1326 audit(1756208126.140:343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1786 comm="syz.3.463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0037b8ebe9 code=0x7fc00000 [ 88.047671][ T419] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 88.151121][ T1836] /dev/loop0: Can't lookup blockdev [ 88.187651][ T419] usb 1-1: device descriptor read/64, error -71 [ 88.266645][ T46] Bluetooth: hci0: Frame reassembly failed (-84) [ 88.273275][ T1850] binder: Unknown parameter '¿–Jä' [ 88.337689][ T45] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 88.427631][ T419] usb 1-1: device descriptor read/64, error -71 [ 88.488794][ T45] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 88.499774][ T45] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 88.509580][ T45] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 88.518659][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 88.527233][ T45] usb 2-1: config 0 descriptor?? [ 88.667647][ T419] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 88.734688][ T45] cp2112 0003:10C4:EA90.000D: unknown main item tag 0x0 [ 88.742379][ T45] cp2112 0003:10C4:EA90.000D: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.1-1/input0 [ 88.797650][ T419] usb 1-1: device descriptor read/64, error -71 [ 88.937649][ T45] cp2112 0003:10C4:EA90.000D: error requesting version [ 88.948195][ T45] cp2112 0003:10C4:EA90.000D: probe with driver cp2112 failed with error -71 [ 88.964943][ T45] usb 2-1: USB disconnect, device number 26 [ 89.037633][ T419] usb 1-1: device descriptor read/64, error -71 [ 89.147716][ T419] usb usb1-port1: attempt power cycle [ 89.378820][ T1866] /dev/loop0: Can't lookup blockdev [ 89.411299][ T1874] netlink: 8 bytes leftover after parsing attributes in process `syz.3.483'. [ 89.487671][ T419] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 89.508731][ T419] usb 1-1: device descriptor read/8, error -71 [ 89.537135][ T1883] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 89.537456][ T1883] rust_binder: Failed to allocate buffer. len:1160, is_oneway:true [ 89.544089][ T1883] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 89.552275][ T1883] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:264 [ 89.638579][ T419] usb 1-1: device descriptor read/8, error -71 [ 89.797632][ T9] usb 2-1: new low-speed USB device number 27 using dummy_hcd [ 89.887639][ T419] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 89.908660][ T419] usb 1-1: device descriptor read/8, error -71 [ 89.948684][ T9] usb 2-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 89.957846][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 89.966854][ T9] usb 2-1: config 0 descriptor?? [ 89.978801][ T36] audit: type=1400 audit(1756208128.170:344): avc: denied { read } for pid=1886 comm="syz.3.489" name="file0" dev="tmpfs" ino=1207 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 90.048668][ T419] usb 1-1: device descriptor read/8, error -71 [ 90.157721][ T419] usb usb1-port1: unable to enumerate USB device [ 90.173687][ T9] asix 2-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 90.287640][ T383] Bluetooth: hci0: command 0x1003 tx timeout [ 90.287635][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 90.532265][ T1908] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:270 [ 90.575067][ T1883] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 90.613519][ T9] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 90.622239][ T1912] rust_binder: Write failure EFAULT in pid:269 [ 90.635942][ T1912] rust_binder: validate_parent_fixup: new_min_offset=18, sg_entry.length=0 [ 90.642545][ T1912] rust_binder: Error while translating object. [ 90.647616][ T36] audit: type=1400 audit(1756208128.820:345): avc: denied { ioctl } for pid=1911 comm="syz.1.497" path="socket:[12012]" dev="sockfs" ino=12012 ioctlcmd=0x9411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 90.651401][ T1912] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 90.657360][ T9] asix 2-1:0.0: probe with driver asix failed with error -71 [ 90.682653][ T1912] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:269 [ 90.731097][ T9] usb 2-1: USB disconnect, device number 27 [ 90.862212][ T36] audit: type=1400 audit(1756208129.050:346): avc: denied { listen } for pid=1918 comm="syz.0.500" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 91.047755][ T9] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 91.197619][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 91.217627][ T9] usb 2-1: config 0 has an invalid interface number: 230 but max is 0 [ 91.225825][ T9] usb 2-1: config 0 has no interface number 0 [ 91.231976][ T369] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 91.247636][ T9] usb 2-1: config 0 interface 230 has no altsetting 0 [ 91.265993][ T9] usb 2-1: New USB device found, idVendor=0781, idProduct=0005, bcdDevice= 0.01 [ 91.275277][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.287767][ T9] usb 2-1: Product: syz [ 91.291971][ T9] usb 2-1: Manufacturer: syz [ 91.296621][ T9] usb 2-1: SerialNumber: syz [ 91.306537][ T9] usb 2-1: config 0 descriptor?? [ 91.383085][ T36] audit: type=1400 audit(1756208129.570:347): avc: denied { listen } for pid=1923 comm="syz.2.502" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 91.402544][ T369] usb 1-1: Using ep0 maxpacket: 32 [ 91.409145][ T369] usb 1-1: unable to get BOS descriptor or descriptor too short [ 91.417989][ T369] usb 1-1: config 3 has an invalid interface number: 43 but max is 0 [ 91.427625][ T369] usb 1-1: config 3 has no interface number 0 [ 91.434002][ T369] usb 1-1: config 3 interface 43 has no altsetting 0 [ 91.449086][ T369] usb 1-1: New USB device found, idVendor=0421, idProduct=01d4, bcdDevice=9a.31 [ 91.467668][ T369] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.475725][ T369] usb 1-1: Product: syz [ 91.480092][ T369] usb 1-1: Manufacturer: syz [ 91.485010][ T369] usb 1-1: SerialNumber: syz [ 91.490767][ T1926] netlink: 'syz.2.503': attribute type 4 has an invalid length. [ 91.580746][ T1928] 9pnet_fd: Insufficient options for proto=fd [ 91.666727][ T1949] netlink: 132 bytes leftover after parsing attributes in process `syz.3.510'. [ 91.692499][ T1953] /dev/rnullb0: Can't open blockdev [ 91.761292][ T1956] random: crng reseeded on system resumption [ 91.781904][ T369] rndis_host 1-1:3.43: More than one union descriptor, skipping ... [ 91.790041][ T369] usb 1-1: bad CDC descriptors [ 91.794895][ T369] cdc_acm 1-1:3.43: More than one union descriptor, skipping ... [ 91.804183][ T369] usb 1-1: USB disconnect, device number 24 [ 91.871819][ T1958] /dev/rnullb0: Can't open blockdev [ 91.906892][ T1961] 9pnet_fd: Insufficient options for proto=fd [ 91.907798][ T1960] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 91.913195][ T1960] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:288 [ 91.938415][ T36] audit: type=1400 audit(1756208130.130:348): avc: denied { load_policy } for pid=1964 comm="syz.2.514" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 91.947562][ T1965] SELinux: failed to load policy [ 91.980037][ T36] audit: type=1400 audit(1756208130.170:349): avc: denied { read } for pid=1964 comm="syz.2.514" name="msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 92.007674][ T36] audit: type=1400 audit(1756208130.170:350): avc: denied { open } for pid=1964 comm="syz.2.514" path="/dev/cpu/0/msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 92.317675][ T369] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 92.373239][ T36] audit: type=1400 audit(1756208130.560:351): avc: denied { remount } for pid=1977 comm="syz.0.519" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 92.468685][ T369] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 92.478440][ T369] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 92.488225][ T369] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 92.502531][ T369] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 92.511732][ T369] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.519742][ T369] usb 3-1: Product: syz [ 92.523946][ T369] usb 3-1: Manufacturer: syz [ 92.528562][ T369] usb 3-1: SerialNumber: syz [ 92.535181][ T369] hub 3-1:1.0: bad descriptor, ignoring hub [ 92.541189][ T369] hub 3-1:1.0: probe with driver hub failed with error -5 [ 92.735032][ T369] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 23 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 92.986114][ T1984] netlink: 165 bytes leftover after parsing attributes in process `syz.2.515'. [ 93.017798][ T917] usb 3-1: USB disconnect, device number 23 [ 93.028457][ T917] usblp0: removed [ 93.079027][ T2004] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=53805 sclass=netlink_route_socket pid=2004 comm=syz.3.526 [ 93.109370][ T13] Bluetooth: hci0: Frame reassembly failed (-84) [ 93.119473][ T13] Bluetooth: hci0: Frame reassembly failed (-84) [ 93.357733][ T917] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 93.508729][ T917] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 93.518507][ T917] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 93.528256][ T917] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 93.542480][ T917] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 93.551553][ T917] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 93.559665][ T917] usb 3-1: Product: syz [ 93.563816][ T917] usb 3-1: Manufacturer: syz [ 93.568443][ T917] usb 3-1: SerialNumber: syz [ 93.724927][ T369] usb 2-1: USB disconnect, device number 28 [ 93.778267][ T917] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 24 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 93.815514][ T2021] SELinux: security_context_str_to_sid (syste_uÝGй ‰:ÿß) failed with errno=-22 [ 93.837793][ T2024] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 93.866126][ T2026] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 93.878122][ T2026] rust_binder: Error in use_page_slow: ESRCH [ 93.878147][ T2026] rust_binder: use_range failure ESRCH [ 93.884159][ T2026] rust_binder: Failed to allocate buffer. len:1152, is_oneway:false [ 93.889904][ T2026] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 93.898215][ T2026] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:286 [ 94.058670][ T372] usb 3-1: USB disconnect, device number 24 [ 94.074840][ T372] usblp0: removed [ 94.329709][ T2030] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=51 sclass=netlink_route_socket pid=2030 comm=syz.3.535 [ 94.450104][ T2036] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized [ 94.556043][ T2060] 9pnet_fd: Insufficient options for proto=fd [ 94.563071][ T2060] KVM: debugfs: duplicate directory 2060-5 [ 94.663765][ T36] audit: type=1400 audit(1756208132.850:352): avc: denied { audit_write } for pid=2063 comm="syz.1.547" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 94.706984][ T36] audit: type=1107 audit(1756208132.850:353): pid=2063 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 94.757633][ T372] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 95.023006][ T2068] /dev/rnullb0: Can't open blockdev [ 95.038204][ T36] audit: type=1400 audit(1756208133.230:354): avc: denied { ioctl } for pid=2069 comm="syz.1.549" path="socket:[12627]" dev="sockfs" ino=12627 ioctlcmd=0x8982 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 95.078351][ T36] audit: type=1400 audit(1756208133.270:355): avc: denied { shutdown } for pid=2071 comm="syz.1.550" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 95.087632][ T372] usb 3-1: Using ep0 maxpacket: 8 [ 95.104847][ T372] usb 3-1: unable to get BOS descriptor or descriptor too short [ 95.113415][ T372] usb 3-1: config 0 has an invalid interface number: 88 but max is 0 [ 95.121646][ T372] usb 3-1: config 0 has no interface number 0 [ 95.127784][ T372] usb 3-1: config 0 interface 88 altsetting 8 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 95.138790][ T372] usb 3-1: config 0 interface 88 altsetting 8 endpoint 0x86 has invalid maxpacket 16394, setting to 1024 [ 95.150018][ T372] usb 3-1: config 0 interface 88 has no altsetting 0 [ 95.158713][ T372] usb 3-1: string descriptor 0 read error: -22 [ 95.164901][ T372] usb 3-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.31 [ 95.169248][ T2076] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 95.173976][ T383] Bluetooth: hci0: command 0x1003 tx timeout [ 95.174283][ T2076] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 95.180432][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 95.180470][ T372] usb 3-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3 [ 95.186893][ T2076] rust_binder: Read failure Err(EFAULT) in pid:309 [ 95.201851][ T372] usb 3-1: config 0 descriptor?? [ 95.224688][ T372] input: USB Acecad Flair Tablet 0460:0004 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.88/input/input13 [ 95.265048][ T2087] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 95.348638][ T2097] SELinux: policydb table sizes (0,0) do not match mine (6,7) [ 95.362791][ T2097] SELinux: failed to load policy [ 95.368389][ T2097] /dev/nbd0: Can't lookup blockdev [ 95.431042][ T45] usb 3-1: USB disconnect, device number 25 [ 95.607642][ T372] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 95.757625][ T372] usb 1-1: Using ep0 maxpacket: 32 [ 95.763876][ T372] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 95.775439][ T372] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 95.786616][ T372] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 95.797802][ T372] usb 1-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 95.806835][ T372] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.815453][ T372] usb 1-1: config 0 descriptor?? [ 95.820666][ T2097] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 95.828510][ T372] hub 1-1:0.0: USB hub found [ 96.001545][ T36] audit: type=1400 audit(1756208134.190:356): avc: denied { mount } for pid=2098 comm="syz.2.557" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 96.051620][ T2102] /dev/rnullb0: Can't open blockdev [ 96.107879][ T2108] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 96.108720][ T2108] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:319 [ 96.125046][ T2110] rust_binder: Write failure EFAULT in pid:321 [ 96.201331][ T2119] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:329 [ 96.208135][ T2119] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 96.217279][ T2119] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 96.225231][ T2119] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:329 [ 96.287651][ T372] hub 1-1:0.0: config failed, can't read hub descriptor (err -22) [ 96.305891][ T372] usbhid 1-1:0.0: can't add hid device: -71 [ 96.311858][ T372] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 96.338010][ T372] usb 1-1: USB disconnect, device number 25 [ 96.437630][ T333] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 96.588732][ T333] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 96.599414][ T333] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 96.609488][ T333] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 96.621423][ T333] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 96.630258][ T333] usb 2-1: SerialNumber: syz [ 96.811012][ T2140] rust_binder: Error while translating object. [ 96.811052][ T2140] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 96.817328][ T2140] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:341 [ 96.841267][ T2142] overlayfs: overlapping lowerdir path [ 96.841487][ T333] usb 2-1: 0:2 : does not exist [ 96.861726][ T2142] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 96.862221][ T2142] rust_binder: Failed to allocate buffer. len:4200, is_oneway:false [ 96.863780][ T333] usb 2-1: USB disconnect, device number 29 [ 96.882320][ T2142] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 96.882803][ T2142] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:343 [ 96.961029][ T36] kauditd_printk_skb: 5 callbacks suppressed [ 96.961049][ T36] audit: type=1400 audit(1756208135.150:362): avc: denied { append } for pid=2145 comm="syz.0.573" name="ppp" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 97.197629][ T372] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 97.347649][ T372] usb 1-1: Using ep0 maxpacket: 32 [ 97.354131][ T372] usb 1-1: config 1 has an invalid interface number: 152 but max is 0 [ 97.362498][ T372] usb 1-1: config 1 has an invalid descriptor of length 209, skipping remainder of the config [ 97.373502][ T372] usb 1-1: config 1 has no interface number 0 [ 97.379798][ T372] usb 1-1: config 1 interface 152 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 97.392965][ T372] usb 1-1: config 1 interface 152 has no altsetting 0 [ 97.403743][ T372] usb 1-1: New USB device found, idVendor=05ac, idProduct=0264, bcdDevice=d4.ef [ 97.413783][ T372] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.421943][ T372] usb 1-1: Product: syz [ 97.426121][ T372] usb 1-1: Manufacturer: syz [ 97.430749][ T372] usb 1-1: SerialNumber: syz [ 97.642589][ T372] usbhid 1-1:1.152: couldn't find an input interrupt endpoint [ 97.656641][ T372] usb 1-1: USB disconnect, device number 26 [ 97.789649][ T2179] lo: entered promiscuous mode [ 97.794926][ T2179] lo: left promiscuous mode [ 97.800330][ T2179] fuse: Unknown parameter '000000000000000000030x0000000000000000' [ 97.827631][ T45] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 97.879863][ T2189] netlink: 112 bytes leftover after parsing attributes in process `syz.3.588'. [ 97.988830][ T45] usb 3-1: config 0 has no interfaces? [ 97.996053][ T45] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.50 [ 98.005559][ T45] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.013810][ T45] usb 3-1: Product: syz [ 98.018348][ T45] usb 3-1: Manufacturer: syz [ 98.023003][ T45] usb 3-1: SerialNumber: syz [ 98.031051][ T45] usb 3-1: config 0 descriptor?? [ 98.248177][ T2162] netlink: 12 bytes leftover after parsing attributes in process `syz.2.579'. [ 98.258693][ T2162] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 98.258723][ T2162] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:336 [ 98.281032][ T372] usb 3-1: USB disconnect, device number 26 [ 98.332312][ T36] audit: type=1400 audit(1756208136.520:363): avc: denied { setopt } for pid=2200 comm="syz.0.592" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 98.406933][ T2203] kvm: pic: level sensitive irq not supported [ 98.407023][ T2203] picdev_read: 486 callbacks suppressed [ 98.407039][ T2203] kvm: pic: non byte read [ 98.429430][ T2203] kvm: pic: level sensitive irq not supported [ 98.429500][ T2203] kvm: pic: non byte read [ 98.440576][ T2203] kvm: pic: level sensitive irq not supported [ 98.440639][ T2203] kvm: pic: non byte read [ 98.445862][ T2207] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 98.592555][ T2218] rust_binder: Write failure EFAULT in pid:352 [ 98.599838][ T2220] rust_binder: Write failure EFAULT in pid:352 [ 98.813391][ T36] audit: type=1326 audit(1756208137.000:364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2233 comm="syz.2.603" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f11c158ebe9 code=0x0 [ 98.904188][ T2240] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 98.904225][ T2240] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:362 [ 99.016613][ T2255] tipc: Enabled bearer , priority 0 [ 99.034433][ T2255] syzkaller0: entered promiscuous mode [ 99.039971][ T2255] syzkaller0: entered allmulticast mode [ 99.048649][ T2255] tipc: Resetting bearer [ 99.055535][ T2255] tipc: Disabling bearer [ 99.062589][ T36] audit: type=1400 audit(1756208137.250:365): avc: denied { setcheckreqprot } for pid=2252 comm="syz.1.610" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 99.117700][ T36] audit: type=1400 audit(1756208137.300:366): avc: denied { map } for pid=2252 comm="syz.1.610" path="socket:[14016]" dev="sockfs" ino=14016 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 99.123907][ T2258] netlink: 4 bytes leftover after parsing attributes in process `syz.1.610'. [ 99.478117][ T2274] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 99.531120][ T2275] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 99.537671][ T2275] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 99.545693][ T2275] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:391 [ 99.750003][ T36] audit: type=1400 audit(1756208137.940:367): avc: denied { getopt } for pid=2280 comm="syz.2.619" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 99.750584][ T2281] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 4256, size: 18446744073709551610) [ 99.759249][ T2282] rust_binder: Failed to allocate buffer. len:4256, is_oneway:false [ 99.778553][ T2281] rust_binder: Error while translating object. [ 99.778579][ T2281] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 99.790944][ T2282] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 99.799003][ T2281] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:345 [ 99.805407][ T2282] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:345 [ 99.887163][ T36] audit: type=1400 audit(1756208138.070:368): avc: denied { ioctl } for pid=2284 comm="syz.2.620" path="socket:[14563]" dev="sockfs" ino=14563 ioctlcmd=0x8980 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 99.942959][ T2292] tipc: Started in network mode [ 99.947898][ T2292] tipc: Node identity 9a29f7cd4e0f, cluster identity 4711 [ 99.955083][ T2292] tipc: Enabled bearer , priority 0 [ 99.961993][ T2292] syzkaller0: entered promiscuous mode [ 99.967473][ T2292] syzkaller0: entered allmulticast mode [ 99.973927][ T2292] tipc: Resetting bearer [ 99.980301][ T2292] tipc: Disabling bearer [ 100.115636][ T2301] rust_binder: 361: no such ref 3 [ 100.120827][ T2301] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 120, limit: 144, size: 97) [ 100.120846][ T2301] rust_binder: Error while translating object. [ 100.131456][ T2301] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 100.137753][ T2301] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:361 [ 100.387660][ T333] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 100.494633][ T36] audit: type=1400 audit(1756208138.680:369): avc: denied { wake_alarm } for pid=2309 comm="syz.0.627" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 100.524484][ T2312] netlink: 16 bytes leftover after parsing attributes in process `syz.0.628'. [ 100.544987][ T36] audit: type=1400 audit(1756208138.730:370): avc: denied { mount } for pid=2313 comm="syz.0.629" name="/" dev="configfs" ino=931 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 100.567746][ T333] usb 3-1: Using ep0 maxpacket: 32 [ 100.573662][ T2314] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 100.574128][ T2314] rust_binder: Error while translating object. [ 100.574146][ T2315] rust_binder: Error while translating object. [ 100.580657][ T2314] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 100.587294][ T2315] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 100.593076][ T333] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 100.602719][ T2315] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:405 [ 100.622692][ T2314] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:405 [ 100.632151][ T333] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 100.651057][ T333] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 100.663859][ T333] usb 3-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 100.672930][ T333] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.685741][ T333] usb 3-1: config 0 descriptor?? [ 100.693348][ T333] usbhid 3-1:0.0: can't add hid device: -22 [ 100.699490][ T333] usbhid 3-1:0.0: probe with driver usbhid failed with error -22 [ 100.894341][ T333] usb 3-1: USB disconnect, device number 27 [ 100.999428][ T2355] fuse: Unknown parameter 'grouö•³' [ 101.005350][ T2355] netlink: 9 bytes leftover after parsing attributes in process `syz.3.643'. [ 101.014705][ T2355] gretap0: entered promiscuous mode [ 101.044715][ T2357] netlink: 12 bytes leftover after parsing attributes in process `syz.3.644'. [ 101.387676][ T333] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 101.409215][ T369] rust_binder: 2298: removing orphan mapping 0:1048 [ 101.476442][ T36] audit: type=1400 audit(1756208139.660:371): avc: denied { write } for pid=2384 comm="syz.2.654" path="socket:[15452]" dev="sockfs" ino=15452 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 101.538744][ T333] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 101.549866][ T333] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 101.560916][ T333] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 101.570196][ T333] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.579066][ T333] usb 1-1: config 0 descriptor?? [ 101.639019][ T2402] rust_binder: Write failure EFAULT in pid:382 [ 101.907633][ T369] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 101.991155][ T333] pyra 0003:1E7D:2CF6.000E: unknown main item tag 0x0 [ 101.998028][ T333] pyra 0003:1E7D:2CF6.000E: unknown main item tag 0x0 [ 102.004912][ T333] pyra 0003:1E7D:2CF6.000E: unknown main item tag 0x0 [ 102.012275][ T333] pyra 0003:1E7D:2CF6.000E: unknown main item tag 0x0 [ 102.019392][ T333] pyra 0003:1E7D:2CF6.000E: unknown main item tag 0x0 [ 102.026195][ T333] pyra 0003:1E7D:2CF6.000E: unknown main item tag 0x0 [ 102.033275][ T333] pyra 0003:1E7D:2CF6.000E: unknown main item tag 0x0 [ 102.041145][ T333] pyra 0003:1E7D:2CF6.000E: hidraw0: USB HID v0.00 Device [HID 1e7d:2cf6] on usb-dummy_hcd.0-1/input0 [ 102.072019][ T2415] /dev/rnullb0: Can't open blockdev [ 102.077641][ T369] usb 3-1: Using ep0 maxpacket: 16 [ 102.088332][ T369] usb 3-1: config 1 has an invalid descriptor of length 166, skipping remainder of the config [ 102.107621][ T369] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 102.128827][ T369] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 102.137953][ T369] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.145972][ T369] usb 3-1: Product: syz [ 102.150188][ T369] usb 3-1: Manufacturer: syz [ 102.154814][ T369] usb 3-1: SerialNumber: syz [ 102.362089][ T2407] 9pnet_fd: Insufficient options for proto=fd [ 102.368297][ T36] kauditd_printk_skb: 3 callbacks suppressed [ 102.368315][ T36] audit: type=1400 audit(1756208140.550:375): avc: denied { mounton } for pid=2405 comm="syz.2.661" path="/" dev="configfs" ino=931 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 102.417330][ T36] audit: type=1400 audit(1756208140.550:376): avc: denied { create } for pid=2442 comm="syz.3.673" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 102.552507][ T333] pyra 0003:1E7D:2CF6.000E: couldn't init struct pyra_device [ 102.560084][ T333] pyra 0003:1E7D:2CF6.000E: couldn't install mouse [ 102.567148][ T369] usb 3-1: 0:2 : does not exist [ 102.572533][ T333] pyra 0003:1E7D:2CF6.000E: probe with driver pyra failed with error -71 [ 102.581403][ T369] usb 3-1: unit 9 not found! [ 102.588538][ T369] usb 3-1: 4:0: cannot get min/max values for control 1 (id 4) [ 102.596476][ T333] usb 1-1: USB disconnect, device number 27 [ 102.605174][ T369] usb 3-1: 4:0: cannot get min/max values for control 2 (id 4) [ 102.619592][ T369] usb 3-1: 4:0: cannot get min/max values for control 3 (id 4) [ 102.649216][ T369] usb 3-1: 4:0: cannot get min/max values for control 4 (id 4) [ 102.659097][ T369] usb 3-1: 4:0: cannot get min/max values for control 5 (id 4) [ 102.679548][ T369] usb 3-1: 4:0: cannot get min/max values for control 6 (id 4) [ 102.689234][ T369] usb 3-1: USB disconnect, device number 28 [ 102.700398][ T1750] udevd[1750]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 102.897249][ T2457] rust_binder: Failed copying remainder into alloc: EFAULT [ 102.897249][ T2458] rust_binder: Failed copying remainder into alloc: EFAULT [ 102.897271][ T2457] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 102.904811][ T2458] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 102.911798][ T2457] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 102.927645][ T2458] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 102.931902][ T2457] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:383 [ 102.937965][ T2458] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:383 [ 102.964714][ T2462] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 102.974568][ T2462] rust_binder: Failed to allocate buffer. len:1144, is_oneway:true [ 102.981033][ T2462] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 102.989006][ T2462] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:386 [ 102.998815][ T2462] rust_binder: Failed to allocate buffer. len:1144, is_oneway:true [ 103.008019][ T2462] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 103.015911][ T2462] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:386 [ 103.068048][ T36] audit: type=1400 audit(1756208141.260:377): avc: denied { mounton } for pid=2459 comm="syz.2.678" path="/125/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 103.104190][ T36] audit: type=1400 audit(1756208141.280:378): avc: denied { setattr } for pid=2464 comm="syz.1.680" name="binder1" dev="binder" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 103.181095][ T372] hid-generic 0006:0004:0009.000F: unknown main item tag 0x0 [ 103.190496][ T372] hid-generic 0006:0004:0009.000F: unknown main item tag 0x0 [ 103.198085][ T372] hid-generic 0006:0004:0009.000F: unknown main item tag 0x0 [ 103.205569][ T372] hid-generic 0006:0004:0009.000F: unknown main item tag 0x0 [ 103.213030][ T372] hid-generic 0006:0004:0009.000F: unknown main item tag 0x0 [ 103.220546][ T372] hid-generic 0006:0004:0009.000F: unknown main item tag 0x0 [ 103.228082][ T372] hid-generic 0006:0004:0009.000F: unknown main item tag 0x0 [ 103.235488][ T372] hid-generic 0006:0004:0009.000F: unknown main item tag 0x0 [ 103.242923][ T372] hid-generic 0006:0004:0009.000F: unknown main item tag 0x0 [ 103.250345][ T372] hid-generic 0006:0004:0009.000F: unknown main item tag 0x0 [ 103.257822][ T372] hid-generic 0006:0004:0009.000F: unknown main item tag 0x0 [ 103.265325][ T372] hid-generic 0006:0004:0009.000F: unknown main item tag 0x0 [ 103.272797][ T372] hid-generic 0006:0004:0009.000F: unknown main item tag 0x0 [ 103.280274][ T372] hid-generic 0006:0004:0009.000F: unknown main item tag 0x0 [ 103.288531][ T372] hid-generic 0006:0004:0009.000F: unknown main item tag 0x0 [ 103.295914][ T372] hid-generic 0006:0004:0009.000F: unknown main item tag 0x0 [ 103.303327][ T372] hid-generic 0006:0004:0009.000F: unknown main item tag 0x0 [ 103.312408][ T372] hid-generic 0006:0004:0009.000F: hidraw0: VIRTUAL HID v0.09 Device [syz0] on syz1 [ 103.329495][ T2485] fido_id[2485]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 103.455917][ T2491] binder: Bad value for 'stats' [ 104.042759][ T2501] IPv6: syztnl0: Disabled Multicast RS [ 104.048701][ T2502] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 104.077973][ T2508] rust_binder: Error while translating object. [ 104.084531][ T2508] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 104.090732][ T2508] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:453 [ 104.109438][ T36] audit: type=1400 audit(1756208142.290:379): avc: denied { create } for pid=2512 comm="syz.0.692" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 104.287402][ T2520] netlink: 16 bytes leftover after parsing attributes in process `syz.1.695'. [ 104.297664][ T2520] SELinux: policydb magic number 0x100 does not match expected magic number 0xf97cff8c [ 104.307656][ T2520] SELinux: failed to load policy [ 104.427162][ T369] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 104.561179][ T333] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 104.581814][ T369] usb 1-1: Using ep0 maxpacket: 16 [ 104.588017][ T369] usb 1-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 104.598257][ T369] usb 1-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 104.609224][ T369] usb 1-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 104.618995][ T369] usb 1-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 104.631818][ T369] usb 1-1: config 7 interface 0 has no altsetting 0 [ 104.639014][ T369] usb 1-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 104.648215][ T369] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.726319][ T333] usb 2-1: Using ep0 maxpacket: 32 [ 104.732552][ T333] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 104.740602][ T333] usb 2-1: config 0 has no interface number 0 [ 104.746697][ T333] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 104.757586][ T333] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 104.767336][ T333] usb 2-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 104.776390][ T333] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.785022][ T333] usb 2-1: config 0 descriptor?? [ 105.072396][ T369] usbhid 1-1:7.0: can't add hid device: -71 [ 105.078429][ T369] usbhid 1-1:7.0: probe with driver usbhid failed with error -71 [ 105.087141][ T369] usb 1-1: USB disconnect, device number 28 [ 105.210241][ T333] usbhid 2-1:0.1: can't add hid device: -71 [ 105.217811][ T333] usbhid 2-1:0.1: probe with driver usbhid failed with error -71 [ 105.230761][ T333] usb 2-1: USB disconnect, device number 30 [ 105.292173][ T2534] netlink: 24 bytes leftover after parsing attributes in process `syz.0.698'. [ 105.302856][ T2534] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 105.302885][ T2534] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 105.310826][ T2534] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:465 [ 105.332179][ T36] audit: type=1400 audit(1756208143.463:380): avc: denied { watch } for pid=2535 comm="syz.0.699" path="/147/file0" dev="tmpfs" ino=825 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 105.404519][ T36] audit: type=1326 audit(1756208143.541:381): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2541 comm="syz.0.701" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe29fd8ebe9 code=0x0 [ 105.457528][ T2557] netlink: 'syz.3.705': attribute type 4 has an invalid length. [ 105.465288][ T2557] netlink: 17 bytes leftover after parsing attributes in process `syz.3.705'. [ 105.736709][ T2574] netlink: 12 bytes leftover after parsing attributes in process `syz.3.710'. [ 105.873746][ T36] audit: type=1326 audit(1756208143.997:382): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2600 comm="syz.0.717" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe29fd8ebe9 code=0x0 [ 105.901032][ T36] audit: type=1326 audit(1756208143.997:383): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2600 comm="syz.0.717" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe29fd8ebe9 code=0x0 [ 106.093136][ T2613] SELinux: security_context_str_to_sid (--^$-) failed with errno=-22 [ 106.280579][ T36] audit: type=1326 audit(1756208144.386:384): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2622 comm="syz.1.723" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ffb38d8ebe9 code=0x0 [ 106.368854][ T2635] netlink: 20 bytes leftover after parsing attributes in process `syz.2.726'. [ 106.378917][ T2635] rust_binder: Error while translating object. [ 106.378954][ T2635] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 106.385177][ T2635] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:398 [ 106.599230][ T2659] overlayfs: failed to resolve './file1': -2 [ 106.746752][ T2666] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 106.746791][ T2666] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:491 [ 106.764682][ T351] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 106.949691][ T351] usb 2-1: Using ep0 maxpacket: 32 [ 106.955951][ T351] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 106.967155][ T351] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 106.978344][ T351] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 106.987388][ T351] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.995960][ T351] usb 2-1: config 0 descriptor?? [ 107.001393][ T2652] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 107.009083][ T351] hub 2-1:0.0: USB hub found [ 107.165688][ T2682] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 107.174378][ T2682] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 107.257089][ T351] hub 2-1:0.0: config failed, can't read hub descriptor (err -22) [ 107.268787][ T351] usbhid 2-1:0.0: can't add hid device: -71 [ 107.274916][ T351] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 107.305966][ T351] usb 2-1: USB disconnect, device number 31 [ 107.316257][ T2688] fuse: Bad value for 'rootmode' [ 107.616872][ T351] usb 2-1: new full-speed USB device number 32 using dummy_hcd [ 107.771940][ T351] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 107.782937][ T351] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 107.795767][ T351] usb 2-1: New USB device found, idVendor=056a, idProduct=0020, bcdDevice= 0.00 [ 107.804848][ T351] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.815876][ T351] usb 2-1: config 0 descriptor?? [ 107.820091][ T2701] tipc: Enabled bearer , priority 0 [ 107.824341][ T2690] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 107.828190][ T2701] syzkaller0: entered promiscuous mode [ 107.840648][ T2701] syzkaller0: entered allmulticast mode [ 107.849113][ T2701] tipc: Resetting bearer [ 107.855821][ T2701] tipc: Disabling bearer [ 107.929623][ T2706] binder: Unknown parameter '' [ 107.944796][ T36] kauditd_printk_skb: 3 callbacks suppressed [ 107.944815][ T36] audit: type=1326 audit(1756208146.002:388): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2707 comm="syz.2.751" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f11c158ebe9 code=0x0 [ 108.047202][ T351] usbhid 2-1:0.0: can't add hid device: -71 [ 108.054317][ T36] audit: type=1400 audit(1756208146.119:389): avc: denied { name_bind } for pid=2707 comm="syz.2.751" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 108.055922][ T351] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 108.085175][ T351] usb 2-1: USB disconnect, device number 32 [ 108.203983][ T36] audit: type=1326 audit(1756208146.266:390): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2693 comm="syz.3.746" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0037b8ebe9 code=0x7fc00000 [ 108.213900][ T2724] batadv_slave_0: entered promiscuous mode [ 108.231462][ T2726] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 108.238768][ T2724] batadv_slave_0: left promiscuous mode [ 108.319277][ T2729] overlayfs: failed to clone upperpath [ 108.342567][ T2735] /dev/rnullb0: Can't open blockdev [ 108.375691][ T372] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 108.430638][ T2741] netlink: 8 bytes leftover after parsing attributes in process `syz.3.757'. [ 108.508926][ T372] usb 1-1: device descriptor read/64, error -71 [ 108.651744][ T36] audit: type=1400 audit(1756208146.695:391): avc: denied { mounton } for pid=2756 comm="syz.1.767" path="/proc/498/cgroup" dev="proc" ino=17968 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=file permissive=1 [ 108.675499][ T36] audit: type=1400 audit(1756208146.724:392): avc: denied { ioctl } for pid=2756 comm="syz.1.767" path="pid:[4026532293]" dev="nsfs" ino=4026532293 ioctlcmd=0x9418 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 108.765096][ T372] usb 1-1: device descriptor read/64, error -71 [ 108.785735][ T2759] netlink: 8 bytes leftover after parsing attributes in process `syz.1.768'. [ 108.794576][ T2759] netlink: 8 bytes leftover after parsing attributes in process `syz.1.768'. [ 108.834320][ T36] audit: type=1400 audit(1756208146.881:393): avc: denied { watch watch_reads } for pid=2766 comm="syz.1.771" path="/156/file0" dev="incremental-fs" ino=891 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 109.010985][ T372] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 109.011637][ T2789] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 109.025726][ T2789] rust_binder: Write failure EINVAL in pid:517 [ 109.143986][ T372] usb 1-1: device descriptor read/64, error -71 [ 109.173836][ T36] audit: type=1326 audit(1756208147.203:394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2728 comm="syz.3.757" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0037b8ebe9 code=0x7fc00000 [ 109.277037][ T369] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 109.399772][ T372] usb 1-1: device descriptor read/64, error -71 [ 109.430458][ T369] usb 2-1: Using ep0 maxpacket: 8 [ 109.436803][ T369] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 109.447775][ T369] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 109.457555][ T369] usb 2-1: New USB device found, idVendor=046a, idProduct=0027, bcdDevice= 0.00 [ 109.466639][ T369] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.475164][ T369] usb 2-1: config 0 descriptor?? [ 109.512459][ T372] usb usb1-port1: attempt power cycle [ 109.654547][ T2811] tipc: New replicast peer: 255.255.255.255 [ 109.660816][ T2811] tipc: Enabled bearer , priority 10 [ 109.667549][ T2811] binder: Unknown parameter 'contextÀ0x00000000000000030x0000000000000003' [ 109.685450][ T2813] /dev/rnullb0: Can't open blockdev [ 109.691303][ T2814] /dev/rnullb0: Can't open blockdev [ 109.860198][ T372] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 109.881775][ T372] usb 1-1: device descriptor read/8, error -71 [ 109.891124][ T369] cherry 0003:046A:0027.0010: item fetching failed at offset 7/69 [ 109.899759][ T369] cherry 0003:046A:0027.0010: probe with driver cherry failed with error -22 [ 109.942021][ T351] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 110.014633][ T372] usb 1-1: device descriptor read/8, error -71 [ 110.096546][ T351] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1025, setting to 1024 [ 110.098771][ T369] usb 2-1: USB disconnect, device number 33 [ 110.108291][ T351] usb 3-1: New USB device found, idVendor=5543, idProduct=0064, bcdDevice= 0.00 [ 110.122762][ T351] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 110.131475][ T351] usb 3-1: config 0 descriptor?? [ 110.136835][ T2816] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 110.258818][ T372] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 110.280311][ T372] usb 1-1: device descriptor read/8, error -71 [ 110.413604][ T372] usb 1-1: device descriptor read/8, error -71 [ 110.524517][ T372] usb usb1-port1: unable to enumerate USB device [ 110.635384][ T2830] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 110.741365][ T2832] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:524 [ 110.758865][ T2817] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 110.800333][ T369] tipc: Node number set to 3559323597 [ 110.844330][ T351] usbhid 3-1:0.0: can't add hid device: -71 [ 110.852012][ T351] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 110.861706][ T351] usb 3-1: USB disconnect, device number 30 [ 111.074096][ T36] audit: type=1326 audit(1756208149.071:395): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2845 comm="syz.3.796" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0037b8ebe9 code=0x7fc00000 [ 111.105008][ T2856] overlayfs: failed to clone upperpath [ 111.317899][ T2865] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 111.318385][ T2865] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 111.324902][ T2865] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 111.332984][ T2865] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:513 [ 111.351381][ T2867] rust_binder: Write failure EFAULT in pid:515 [ 111.374291][ T2871] __vm_enough_memory: pid: 2871, comm: syz.2.806, bytes: 18014402804453376 not enough memory for the allocation [ 111.409146][ T36] audit: type=1400 audit(1756208149.395:396): avc: denied { watch } for pid=2873 comm="syz.2.807" path="/152/file0" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=dir permissive=1 [ 111.409308][ T2874] overlay: ./file1 is not a directory [ 111.468496][ T2876] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 111.468926][ T36] audit: type=1400 audit(1756208149.454:397): avc: denied { getattr } for pid=2875 comm="syz.0.808" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 111.469103][ T2876] rust_binder: Failed to allocate buffer. len:4232, is_oneway:false [ 111.498727][ T2876] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 111.508704][ T2876] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:519 [ 111.543105][ T329] Bluetooth: hci0: Frame reassembly failed (-84) [ 111.604609][ T2896] bpf: Bad value for 'mode' [ 111.678428][ T2902] syz.3.815 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 112.086070][ T9] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 112.239906][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 112.250225][ T9] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 112.259657][ T9] usb 2-1: config 1 has no interface number 0 [ 112.268350][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 112.278384][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.286560][ T9] usb 2-1: Product: syz [ 112.290882][ T9] usb 2-1: Manufacturer: syz [ 112.295525][ T9] usb 2-1: SerialNumber: syz [ 112.358623][ T2911] netlink: 16 bytes leftover after parsing attributes in process `syz.3.818'. [ 112.453680][ T2931] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=25876 sclass=netlink_xfrm_socket pid=2931 comm=syz.3.827 [ 112.506682][ T9] cdc_ncm 2-1:1.1: skipping garbage [ 112.511927][ T9] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 112.519951][ T9] cdc_ncm 2-1:1.1: bind() failure [ 112.525926][ T9] usb 2-1: USB disconnect, device number 34 [ 112.685362][ T2949] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 112.685400][ T2949] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:489 [ 113.023558][ T372] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 113.040572][ T2956] SELinux: policydb magic number 0x65726977 does not match expected magic number 0xf97cff8c [ 113.051030][ T2956] SELinux: failed to load policy [ 113.146529][ T2967] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.147273][ T2967] rust_binder: Failed to allocate buffer. len:1144, is_oneway:true [ 113.153792][ T2967] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 113.161733][ T2967] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:558 [ 113.171443][ T2967] rust_binder: Failed to allocate buffer. len:1144, is_oneway:true [ 113.180580][ T2967] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 113.188567][ T2967] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:558 [ 113.197658][ T372] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 113.209931][ T2970] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.216880][ T372] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 113.236212][ T372] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 113.245324][ T372] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 113.254192][ T372] usb 3-1: config 0 descriptor?? [ 113.297985][ T2976] tipc: Started in network mode [ 113.302921][ T2976] tipc: Node identity 7270704af0d5, cluster identity 4711 [ 113.310178][ T2976] tipc: Enabled bearer , priority 0 [ 113.317193][ T2976] syzkaller0: entered promiscuous mode [ 113.322845][ T2976] syzkaller0: entered allmulticast mode [ 113.333366][ T2976] tipc: Resetting bearer [ 113.349848][ T2976] tipc: Disabling bearer [ 113.401843][ T2982] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.404169][ T2982] rust_binder: Error while translating object. [ 113.410739][ T2982] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 113.416974][ T2982] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:569 [ 113.426558][ T2983] veth1_macvtap: left promiscuous mode [ 113.441243][ T2983] macsec0: entered promiscuous mode [ 113.446690][ T2983] macsec0: entered allmulticast mode [ 113.458422][ T2983] veth1_macvtap: entered promiscuous mode [ 113.471619][ T2983] veth1_macvtap: entered allmulticast mode [ 113.481707][ T2983] macsec0: left promiscuous mode [ 113.488595][ T2983] macsec0: left allmulticast mode [ 113.491936][ T2989] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.493774][ T2983] veth1_macvtap: left allmulticast mode [ 113.644515][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 113.645314][ T383] Bluetooth: hci0: command 0x1003 tx timeout [ 113.656788][ T2888] Bluetooth: hci0: Opcode 0x1003 failed: -4 [ 113.656931][ T13] Bluetooth: hci0: Frame reassembly failed (-84) [ 113.680961][ T372] kovaplus 0003:1E7D:2D50.0011: hidraw0: USB HID v0.00 Device [HID 1e7d:2d50] on usb-dummy_hcd.2-1/input0 [ 113.706232][ T2995] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 114.001168][ T3009] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 114.008335][ T3009] rust_binder: Write failure EINVAL in pid:543 [ 114.008355][ T3010] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 114.021731][ T3010] rust_binder: Write failure EINVAL in pid:543 [ 114.284383][ T2953] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 114.299076][ T31] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 114.300420][ T2953] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 114.317222][ T372] kovaplus 0003:1E7D:2D50.0011: couldn't init struct kovaplus_device [ 114.325341][ T372] kovaplus 0003:1E7D:2D50.0011: couldn't install mouse [ 114.332777][ T372] kovaplus 0003:1E7D:2D50.0011: probe with driver kovaplus failed with error -71 [ 114.343485][ T372] usb 3-1: USB disconnect, device number 31 [ 114.458291][ T31] usb 1-1: Using ep0 maxpacket: 32 [ 114.464582][ T31] usb 1-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 114.475780][ T31] usb 1-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 114.486645][ T31] usb 1-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 114.495743][ T31] usb 1-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 114.504093][ T31] usb 1-1: Product: syz [ 114.508256][ T31] usb 1-1: Manufacturer: syz [ 114.518252][ T31] hub 1-1:4.0: USB hub found [ 114.722117][ T36] kauditd_printk_skb: 4 callbacks suppressed [ 114.722138][ T36] audit: type=1400 audit(1756208152.645:402): avc: denied { read } for pid=3012 comm="syz.0.854" path="socket:[19747]" dev="sockfs" ino=19747 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 114.841826][ T3039] overlayfs: failed to clone lowerpath [ 114.859363][ T31] hub 1-1:4.0: 2 ports detected [ 114.873090][ T3046] overlayfs: failed to clone upperpath [ 115.040828][ T36] audit: type=1400 audit(1756208152.969:403): avc: denied { bind } for pid=3069 comm="syz.2.876" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 115.075970][ T3028] /dev/rnullb0: Can't open blockdev [ 115.119139][ T36] audit: type=1400 audit(1756208153.048:404): avc: denied { accept } for pid=3074 comm="syz.1.877" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 115.187563][ T3088] input: syz1 as /devices/virtual/input/input15 [ 115.469793][ T36] audit: type=1400 audit(1756208153.383:405): avc: denied { rename } for pid=3090 comm="syz.2.881" name="file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 116.165334][ T31] hub 1-1:4.0: hub_hub_status failed (err = -32) [ 116.171732][ T31] hub 1-1:4.0: config failed, can't get hub status (err -32) [ 116.403488][ T36] audit: type=1400 audit(1756208154.309:406): avc: denied { create } for pid=3111 comm="syz.1.886" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 116.553618][ T3134] /dev/md0: Can't lookup blockdev [ 116.633201][ T3139] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized [ 116.643370][ T3139] netlink: 'syz.1.896': attribute type 28 has an invalid length. [ 116.709486][ T3149] tipc: Enabled bearer , priority 0 [ 116.716561][ T3149] syzkaller0: entered promiscuous mode [ 116.722052][ T3149] syzkaller0: entered allmulticast mode [ 116.966546][ T351] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 117.120154][ T351] usb 2-1: unable to get BOS descriptor or descriptor too short [ 117.128611][ T351] usb 2-1: config index 0 descriptor too short (expected 56594, got 18) [ 117.137308][ T351] usb 2-1: config 176 has too many interfaces: 138, using maximum allowed: 32 [ 117.146364][ T351] usb 2-1: config 176 has an invalid interface number: 218 but max is 137 [ 117.155035][ T351] usb 2-1: config 176 has 1 interface, different from the descriptor's value: 138 [ 117.167702][ T351] usb 2-1: config 176 has no interface number 0 [ 117.174119][ T351] usb 2-1: config 176 interface 218 has no altsetting 0 [ 117.182614][ T351] usb 2-1: New USB device found, idVendor=05ac, idProduct=b231, bcdDevice=85.00 [ 117.191716][ T351] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.199727][ T351] usb 2-1: Product: syz [ 117.203946][ T351] usb 2-1: Manufacturer: syz [ 117.208556][ T351] usb 2-1: SerialNumber: syz [ 117.213857][ T31] usb 1-1: USB disconnect, device number 33 [ 117.361137][ T3154] netlink: 44 bytes leftover after parsing attributes in process `syz.3.903'. [ 117.439773][ T3148] tipc: Resetting bearer [ 117.449980][ T3148] tipc: Disabling bearer [ 117.816906][ T36] audit: type=1400 audit(1756208155.699:407): avc: denied { read } for pid=3161 comm="syz.0.905" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 117.999953][ T351] ipheth 2-1:176.218: Unable to find alternate settings interface [ 118.009301][ T351] usb 2-1: USB disconnect, device number 36 [ 118.666081][ T3215] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.667688][ T36] audit: type=1400 audit(1756208156.538:408): avc: denied { create } for pid=3214 comm="syz.0.922" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 118.766224][ T3228] netlink: 84 bytes leftover after parsing attributes in process `syz.0.927'. [ 118.871767][ T351] usb 3-1: new full-speed USB device number 32 using dummy_hcd [ 119.025014][ T329] Bluetooth: hci1: Frame reassembly failed (-84) [ 119.025083][ T351] usb 3-1: unable to get BOS descriptor or descriptor too short [ 119.039468][ T351] usb 3-1: not running at top speed; connect to a high speed hub [ 119.047916][ T351] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 119.056635][ T351] usb 3-1: config 1 has an invalid descriptor of length 137, skipping remainder of the config [ 119.066950][ T351] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 119.077214][ T351] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 119.086293][ T351] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.094361][ T351] usb 3-1: Product: syz [ 119.098557][ T351] usb 3-1: Manufacturer: syz [ 119.103153][ T351] usb 3-1: SerialNumber: syz [ 119.316920][ T351] usb 3-1: 0:6 : does not exist [ 119.321878][ T351] usb 3-1: 0:36 : does not exist [ 119.329059][ T351] usb 3-1: USB disconnect, device number 32 [ 119.337138][ T1750] udevd[1750]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 119.653788][ T36] audit: type=1400 audit(1756208157.516:409): avc: denied { setopt } for pid=3242 comm="syz.0.932" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 119.878418][ T3267] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 119.878538][ T3266] rust_binder: inc_ref_done called when no active inc_refs [ 119.896669][ T3269] tipc: Enabled bearer , priority 0 [ 119.912587][ T3269] tipc: Disabling bearer [ 119.981613][ T3278] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=263 sclass=netlink_tcpdiag_socket pid=3278 comm=syz.2.945 [ 120.003189][ T3280] rust_binder: 545: no such ref 0 [ 120.008272][ T3280] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 120.015842][ T3280] rust_binder: 545: no such ref 0 [ 120.135371][ T36] audit: type=1400 audit(1756208157.990:410): avc: denied { create } for pid=3281 comm="syz.2.947" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 120.136459][ T3282] overlayfs: upper fs does not support tmpfile. [ 120.156111][ T36] audit: type=1400 audit(1756208157.990:411): avc: denied { setattr } for pid=3281 comm="syz.2.947" name="work" dev="incremental-fs" ino=980 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 120.184800][ T351] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 120.190837][ T3282] overlayfs: upper fs does not support tmpfile. [ 120.192457][ T36] audit: type=1400 audit(1756208158.040:412): avc: denied { remove_name } for pid=3281 comm="syz.2.947" name="work" dev="incremental-fs" ino=980 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 120.221994][ T36] audit: type=1400 audit(1756208158.040:413): avc: denied { rmdir } for pid=3281 comm="syz.2.947" name="work" dev="incremental-fs" ino=980 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 120.244766][ T36] audit: type=1400 audit(1756208158.079:414): avc: denied { nlmsg_read } for pid=3281 comm="syz.2.947" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 120.379710][ T351] usb 1-1: Using ep0 maxpacket: 16 [ 120.386006][ T351] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 120.387786][ T36] audit: type=1400 audit(1756208158.237:415): avc: denied { read } for pid=3285 comm="syz.3.949" path="socket:[19263]" dev="sockfs" ino=19263 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 120.396280][ T351] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 120.433335][ T351] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice=f1.40 [ 120.442413][ T351] usb 1-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 120.450788][ T351] usb 1-1: Product: syz [ 120.454937][ T351] usb 1-1: Manufacturer: syz [ 120.462046][ T351] cdc_ether 1-1:1.0: probe with driver cdc_ether failed with error -22 [ 120.561728][ T45] usb 3-1: new full-speed USB device number 33 using dummy_hcd [ 120.687841][ T9] usb 1-1: USB disconnect, device number 34 [ 120.714790][ T45] usb 3-1: not running at top speed; connect to a high speed hub [ 120.723275][ T45] usb 3-1: config 117 has an invalid interface number: 64 but max is 0 [ 120.731562][ T45] usb 3-1: config 117 has an invalid descriptor of length 36, skipping remainder of the config [ 120.741948][ T45] usb 3-1: config 117 has no interface number 0 [ 120.749596][ T45] usb 3-1: New USB device found, idVendor=0e8d, idProduct=2000, bcdDevice=5d.02 [ 120.758671][ T45] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.766676][ T45] usb 3-1: Product: syz [ 120.770838][ T45] usb 3-1: Manufacturer: syz [ 120.775445][ T45] usb 3-1: SerialNumber: syz [ 120.990495][ T45] usb 3-1: USB disconnect, device number 33 [ 121.107839][ T499] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 121.107866][ T53] Bluetooth: hci1: command 0x1003 tx timeout [ 121.388190][ T3310] netlink: 'syz.0.954': attribute type 3 has an invalid length. [ 121.670065][ T3319] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=28082 sclass=netlink_route_socket pid=3319 comm=syz.2.961 [ 121.736082][ T36] audit: type=1400 audit(1756208159.573:416): avc: denied { setattr } for pid=3316 comm="syz.2.961" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 121.805109][ T351] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 121.957775][ T351] usb 1-1: config 0 has an invalid interface number: 23 but max is 0 [ 121.965935][ T351] usb 1-1: config 0 has no interface number 0 [ 121.972196][ T351] usb 1-1: config 0 interface 23 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 121.982256][ T351] usb 1-1: config 0 interface 23 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1023 [ 121.993648][ T351] usb 1-1: New USB device found, idVendor=03f0, idProduct=0307, bcdDevice= 0.01 [ 122.002709][ T351] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.010717][ T351] usb 1-1: Product: syz [ 122.014862][ T351] usb 1-1: Manufacturer: syz [ 122.019492][ T351] usb 1-1: SerialNumber: syz [ 122.024676][ T351] usb 1-1: config 0 descriptor?? [ 122.030004][ T3315] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 122.037292][ T3315] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 122.048262][ T351] ums-usbat 1-1:0.23: USB Mass Storage device detected [ 122.321349][ T351] ums-usbat 1-1:0.23: probe with driver ums-usbat failed with error -5 [ 122.331249][ T351] usb 1-1: USB disconnect, device number 35 [ 122.387528][ T3344] SELinux: failed to load policy [ 122.523842][ T3359] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:558 [ 122.530062][ T369] rust_binder: 3353: removing orphan mapping 0:1048 [ 122.651868][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.651900][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.658713][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.666383][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.672820][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.679581][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.680130][ T3375] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:565 [ 122.686183][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.694342][ T3365] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.701868][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.714486][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.720901][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.727379][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.733838][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.740288][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.746723][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.753180][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.759617][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.766100][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.772590][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.779084][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.785598][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.792072][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.798605][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.805097][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.811578][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.818112][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.824584][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.831013][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.837471][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.843931][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.850557][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.857181][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.866562][ T3374] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.966815][ T36] audit: type=1400 audit(1756208416.800:417): avc: denied { bind } for pid=3386 comm="syz.0.983" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 123.026823][ T3398] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 123.081802][ T3401] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:654 [ 123.088716][ T3402] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 123.143947][ T3411] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:578 [ 123.165256][ T3413] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 123.185463][ T3413] SELinux: failed to load policy [ 123.205920][ T3416] netlink: 68 bytes leftover after parsing attributes in process `syz.2.992'. [ 123.214935][ T3416] netlink: 12 bytes leftover after parsing attributes in process `syz.2.992'. [ 123.310881][ T3425] rust_binder: Failed to allocate buffer. len:1160, is_oneway:true [ 123.311022][ T3425] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 123.352566][ T36] audit: type=1400 audit(1756208417.180:418): avc: denied { setopt } for pid=3431 comm="syz.3.998" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 123.379829][ T3442] SELinux: failed to load policy [ 123.387957][ T3445] rust_binder: Write failure EFAULT in pid:598 [ 123.389293][ T3442] SELinux: failed to load policy [ 123.390814][ T36] audit: type=1400 audit(1756208417.220:419): avc: denied { setattr } for pid=3440 comm="syz.1.999" name="XDP" dev="sockfs" ino=20854 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 123.396072][ T3442] ------------[ cut here ]------------ [ 123.401049][ T3441] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 123.423044][ T3442] WARNING: CPU: 1 PID: 3442 at mm/page_alloc.c:5228 __alloc_pages_noprof+0xe8/0x7b0 [ 123.428843][ T3443] rust_binder: Error while translating object. [ 123.434911][ T3442] Modules linked in: [ 123.434928][ T3442] CPU: 1 UID: 0 PID: 3442 Comm: syz.1.999 Not tainted syzkaller #0 cf5fa0ddcc8aee0a441189d525bb38feba3bb086 [ 123.434955][ T3442] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2025 [ 123.434967][ T3442] RIP: 0010:__alloc_pages_noprof+0xe8/0x7b0 [ 123.434996][ T3442] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d b1 25 ee 05 00 0f 85 be 00 00 00 c6 05 a4 25 ee 05 01 <0f> 0b 31 c0 e9 b0 00 00 00 83 fb 0a 0f 87 a5 00 00 00 44 8b 64 24 [ 123.435013][ T3442] RSP: 0018:ffffc9000f3af5a0 EFLAGS: 00010246 [ 123.435032][ T3442] RAX: 0000000000000000 RBX: 0000000000000016 RCX: 0000000000000000 [ 123.435047][ T3442] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000f3af658 [ 123.445081][ T3443] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 123.450552][ T3442] RBP: ffffc9000f3af6c8 R08: ffffc9000f3af657 R09: 0000000000000000 [ 123.450573][ T3442] R10: ffffc9000f3af640 R11: fffff52001e75ecb R12: ffffc9000f3af5e0 [ 123.454627][ T3443] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:664 [ 123.465969][ T3442] R13: dffffc0000000000 R14: 1ffff92001e75eb8 R15: 0000000000000000 [ 123.465991][ T3442] FS: 00007ffb39cac6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 123.574970][ T3442] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 123.581579][ T3442] CR2: 00007f11c248ef98 CR3: 0000000136c7e000 CR4: 00000000003526b0 [ 123.589586][ T3442] Call Trace: [ 123.592869][ T3442] [ 123.595816][ T3442] ? do_syscall_64+0x58/0xf0 [ 123.600439][ T3442] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 123.606524][ T3442] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 123.613880][ T3442] ? hashtab_init+0xdb/0x1f0 [ 123.618663][ T3442] ___kmalloc_large_node+0x9c/0x1d0 [ 123.623896][ T3442] ? hashtab_init+0xdb/0x1f0 [ 123.628500][ T3442] __kmalloc_large_node_noprof+0x1e/0xe0 [ 123.634165][ T3442] ? hashtab_init+0xdb/0x1f0 [ 123.638767][ T3442] __kmalloc_noprof+0x26d/0x450 [ 123.643633][ T3442] hashtab_init+0xdb/0x1f0 [ 123.648070][ T3442] ? common_read+0x16d/0x480 [ 123.652720][ T3442] symtab_init+0x44/0x70 [ 123.657006][ T3442] common_read+0x1de/0x480 [ 123.661452][ T3442] ? __cfi_common_read+0x10/0x10 [ 123.666415][ T3442] ? hashtab_init+0x105/0x1f0 [ 123.671103][ T3442] policydb_read+0xaab/0x28c0 [ 123.675819][ T3442] ? kasan_save_alloc_info+0x40/0x50 [ 123.681121][ T3442] ? __cfi_policydb_read+0x10/0x10 [ 123.686257][ T3442] ? security_load_policy+0x128/0x12f0 [ 123.691732][ T3442] security_load_policy+0x162/0x12f0 [ 123.697045][ T3442] ? __kasan_check_write+0x18/0x20 [ 123.702175][ T3442] ? _raw_spin_lock+0x8c/0x120 [ 123.706961][ T3442] ? __cfi__raw_spin_lock+0x10/0x10 [ 123.712176][ T3442] ? sel_write_load+0x226/0x5e0 [ 123.717043][ T3442] ? vmalloc_noprof+0xfd/0x1d0 [ 123.721825][ T3442] ? _raw_spin_unlock+0x45/0x60 [ 123.726693][ T3442] ? __cfi_security_load_policy+0x10/0x10 [ 123.732423][ T3442] ? __kasan_check_write+0x18/0x20 [ 123.737558][ T3442] sel_write_load+0x298/0x5e0 [ 123.742250][ T3442] ? futex_wait+0x29a/0x7a0 [ 123.746768][ T3442] ? __cfi_sel_write_load+0x10/0x10 [ 123.751983][ T3442] ? __cfi_futex_wait+0x10/0x10 [ 123.756851][ T3442] ? bpf_lsm_file_permission+0xd/0x20 [ 123.762257][ T3442] ? __cfi_sel_write_load+0x10/0x10 [ 123.767492][ T3442] vfs_write+0x3c0/0xe80 [ 123.771771][ T3442] ? __cfi_vfs_write+0x10/0x10 [ 123.776581][ T3442] ? __kasan_check_write+0x18/0x20 [ 123.781716][ T3442] ? mutex_lock+0x92/0x1c0 [ 123.786182][ T3442] ? __cfi_mutex_lock+0x10/0x10 [ 123.791052][ T3442] ? __fget_files+0x2c5/0x340 [ 123.795749][ T3442] ksys_write+0x141/0x250 [ 123.800088][ T3442] ? xfd_validate_state+0x68/0x150 [ 123.805216][ T3442] ? __cfi_ksys_write+0x10/0x10 [ 123.810078][ T3442] ? __kasan_check_write+0x18/0x20 [ 123.815204][ T3442] ? fpregs_restore_userregs+0x11d/0x260 [ 123.820847][ T3442] __x64_sys_write+0x7f/0x90 [ 123.825470][ T3442] x64_sys_call+0x271c/0x2ee0 [ 123.830167][ T3442] do_syscall_64+0x58/0xf0 [ 123.834596][ T3442] ? clear_bhb_loop+0x50/0xa0 [ 123.839283][ T3442] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 123.845276][ T3442] RIP: 0033:0x7ffb38d8ebe9 [ 123.849699][ T3442] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 123.869325][ T3442] RSP: 002b:00007ffb39cac038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 123.877781][ T3442] RAX: ffffffffffffffda RBX: 00007ffb38fb6090 RCX: 00007ffb38d8ebe9 [ 123.885800][ T3442] RDX: 0000000000002000 RSI: 0000200000000000 RDI: 0000000000000003 [ 123.893821][ T3442] RBP: 00007ffb38e11e19 R08: 0000000000000000 R09: 0000000000000000 [ 123.901826][ T3442] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 123.909889][ T3442] R13: 00007ffb38fb6128 R14: 00007ffb38fb6090 R15: 00007ffe42333e98 [ 123.917913][ T3442] [ 123.920942][ T3442] ---[ end trace 0000000000000000 ]--- [ 123.928567][ T3442] SELinux: failed to load policy [ 123.933666][ T3442] SELinux: failed to load policy [ 123.938832][ T3442] SELinux: failed to load policy [ 123.944045][ T3442] SELinux: failed to load policy [ 123.949109][ T3442] SELinux: failed to load policy [ 123.955027][ T3442] SELinux: failed to load policy