last executing test programs: 1m7.554529665s ago: executing program 1 (id=554): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r0, 0x96f83000) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) r3 = epoll_create1(0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x4, 0x3}, 0x10) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000000)={0x2}) r5 = userfaultfd(0x80800) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_POISON(r5, 0xc020aa08, &(0x7f0000000380)={{&(0x7f0000898000/0x3000)=nil, 0x3000}, 0x1}) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@getsa={0x28, 0x12, 0x1, 0x70bd27, 0x25dfdbff, {@in6=@local, 0x4d8, 0x2, 0x6c}}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x20000804) r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000363000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0xfffffffffffffe68) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000040)={[0x1, 0x2, 0x80, 0x5, 0x4, 0x7f, 0xa0cc, 0x0, 0x81, 0x9c1, 0x8001, 0x5, 0x7, 0x4dba, 0x6, 0xfffffdfffffffffd], 0xdddd1000, 0x80300}) ioctl$KVM_RUN(r7, 0xae80, 0x0) 1m7.261184758s ago: executing program 1 (id=558): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = syz_usb_connect(0x1, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="120100004f92b90857152077ebb7000000010902120001000000000904"], 0x0) syz_usb_connect$cdc_ecm(0x2, 0x78, &(0x7f00000008c0)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x66, 0x1, 0x1, 0x8, 0x0, 0x40, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x2, 0x6, 0x0, 0x4, {{0xa, 0x24, 0x6, 0x0, 0x0, "3bb666cbea"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x8, 0x0, 0x0, 0xf6}, [@mbim={0xc, 0x24, 0x1b, 0x7f, 0x8, 0x5, 0x50, 0x1, 0x7}, @country_functional={0x8, 0x24, 0x7, 0x20, 0x5, [0x8]}, @country_functional={0xa, 0x24, 0x7, 0x20, 0x2, [0x1, 0x8]}, @country_functional={0x8, 0x24, 0x7, 0x6, 0x5, [0x100]}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200, 0x8, 0x8, 0x6}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x9, 0x1, 0x5}}}}}]}}]}}, &(0x7f0000000bc0)={0xa, &(0x7f0000000940)={0xa, 0x6, 0x200, 0x8, 0x2, 0xe, 0x40, 0x9}, 0xfa, &(0x7f0000000980)=ANY=[@ANYBLOB="050ffa0005d3100bfb094aa01b2c974cc3523454ed210e934483c467657ccafa94fa0799c77fa47e334bc89dcfb09ad77a78bd4ba5e6fef1f63896f94122463d3c95c254a37c113140929a4f480c8f4643b5c1594cb7b9896129d253997875c0b301465ac72527f307b7c3b73c9cc13ac4ddcf353be51542176d8c59da4238c7b7cfe3a86ce0a981110f47d0c34d5dd8cbe51231402d3e6593eb5c9a8e575bda33bf3da8425a19e4113cf1640b21448148989bc90800e1895d1846dcd3340d2b31491a91c0aa65cb828a9f4cf5d5f54121ddbf1aa558fcaeacf006d6776086eb0a10030004008107cc080710020059c341071002082e05000a10"], 0x4, [{0x5d, &(0x7f0000000a80)=@string={0x5d, 0x3, "14e5d13e6a50b86722f391d802c5d8fce1f0fe855b00c46d15c8ffd959d8dbbc5c245e0ae5453522d057b2fbe6234cb1d07e9446ce80d6003107498ad3c2324ca9949d31ca5b67e5b9c3d04ba122844ccea2c36678e50e55140ae2"}}, {0x17, &(0x7f0000000b00)=@string={0x17, 0x3, "e265b57690228f6956b9d4a13a1a5be0133842cfef"}}, {0x4, &(0x7f0000000b40)=@lang_id={0x4, 0x3, 0x807}}, {0x4, &(0x7f0000000b80)=@lang_id={0x4, 0x3, 0x441}}]}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x40, 0x13, 0x6, @remote}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000340)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001600)={0x40, 0x19, 0x2}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000240)={0x1c, &(0x7f0000000180)=ANY=[@ANYBLOB="00040300000020"], 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000140)={0x2c, &(0x7f0000000400)={0x0, 0x2, 0x2, {0x2, 0x2}}, 0x0, 0x0, 0x0, &(0x7f0000000080)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x8, 0x1, 0x30, 0x0, 0x7, 0x5}}}, 0x0) syz_usb_control_io$uac1(r0, &(0x7f00000004c0)={0x14, &(0x7f00000003c0)={0x40, 0x6, 0xa7, {0xa7, 0x3, "d4f23535a97d8da4fc5c798d7c0394e6f0f3ff9c3cc380b868c4217c65163c57bc73cc8f30d6bfc7c0fd6f1dc0bd66c2d09d78112ed6643e82ba2d1d9a4334a180654a045415e206844c0f1a4998425d014edee58bd2d700ea5de3b8e029c1dd5b1749e9e78dd426f4dcd1bc3417059ec34c68e1463e445ae552d48ae7e09155cdd42c3c412740301a5948fef789db6a1630ca3e09cfb784b62e3f35abb36b222d53f46ce2"}}, &(0x7f0000000480)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x40a}}}, &(0x7f00000007c0)={0x44, &(0x7f0000000500)={0x0, 0x0, 0xd9, "d8c0b5c293e72719ab3d1036f334a3ba4645ac679edab980da632303136cf75651fc146728dfb4f28f553b3946552bc1d7d11c3bd8db23d1734a17bc29e15d509e30209292ca464ecb8831cfbf405f6fc18799af84230daa84f7f9f16ea05efbd9d3999f7f783dc97141ed370d2348708a59ff9a2f6183d8f846d90dc32978b7dbbfed80bbcd8e69e5f75632a3004d4ca1856154aead99df5ae655706c57244b08cfc9da47ffcacd7446a7ca861dc426a238179bf49b199e5dca7a8bffb7a9f14d2e6ffae67198e31faeb6c6d16f15679854217bb7c693c274"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000680)={0x20, 0x81, 0x2, "36eb"}, &(0x7f00000006c0)={0x20, 0x82, 0x3, "5237ee"}, &(0x7f0000000700)={0x20, 0x83, 0x3, "df3dd0"}, &(0x7f0000000740)={0x20, 0x84, 0x4, "a67fc72c"}, &(0x7f0000000780)={0x20, 0x85, 0x3, "ad62c7"}}) 1m3.9255601s ago: executing program 1 (id=584): r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x73, 0x101301) r1 = syz_open_dev$usbfs(&(0x7f0000000040), 0x20000007d, 0x0) preadv(r1, &(0x7f0000000200)=[{&(0x7f0000000100)=""/12, 0xc}, {0x0}], 0x2, 0x2a0800, 0x0) ioctl$USBDEVFS_CLAIM_PORT(r0, 0x80045519, &(0x7f0000000040)=0x1) 1m3.905094562s ago: executing program 1 (id=585): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffa) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f00000007c0)='\x00\x00\x03\x06\x00\x00\x00\x1f\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\x87\xa3\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Hd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xd5\b^[D~\x00\x00\x00\x00\x00\x00\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) (async) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) (async) umount2(&(0x7f00000000c0)='./file0\x00', 0xc) (async) r3 = socket(0x8000000010, 0x2, 0x0) write(r3, &(0x7f00000008c0)="fc0000001c000704ab5b2509b86803000aab02000000000000000e93210001c0f003058405006b49153312f2ba60100000000081039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d440000405608ec30033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e2c8d594dcc4ebc21077a9ca38ca070914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c8", 0xfc) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f00000034c0)='\x00\x00\x03\x86\x00\x00\x00\x01\x00x\x92\x12\xbc\x00\x00\xbb\x0642\x9c\x1a\xd1\xcbx\xb0\xd6\x1e\x10gQ\xca\x0e;\xf7\'\x8c\x95\x83=\t7\x94\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcbzA\x8e\xf6\x89\xc2\'\xdfn\x054Y\xd4\x91s\x00\x00\x00-<\r\xd1?$\x8b\x17Bn\xe0\\\x98\xe1%\x1c\xf4\xd0\xf5\xd5\x80\xc4\xb4a \xac\xc4K\x03\xfa\x13Vz\xbf\xe3c\x8d \x0f\xb1\xe9\xf2oci(\xcb\x82\x05\xfe[H\xaf\x01\x18\xc8\x1b\x1e\xbe\xd8>\a\x00\x00\x00\xf7\xafd%\xf1\xdbjE\x01\xd1sD5hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\x851Y9OB\xdeB\xe1\x02-&\"1hS\x92\xe4$-\x02\x00\xe4\x8e\"\x85\xc9x\xef\x81E.r\x89\xe5\x00\x9e\x97\x96\xb8j\x81\xf0\xa5a\xfb\xa6\xff\xfbj\x11\x12\xc0\xbb\xfdq~#\xf7\xa8\"$,\xf4\x84|\x89o\x00<\xa6-\xb0\xd3\x80\xbe\xcf\a\x00\xfc\xa6\xb1\x05\x94\x84l\x05\x00\xeb\xd8\t\x00\x00\x00CvNx461\x04Nl\xedV\xcet\xaa~\x01j\x94\xec\x92\x86uY\xf6\xb5\t?,~\xa67\\\xb9\xc9K\xf8\x9d\x96\xc0\xb5\xc7wF\f\x00\x97T\x90.\x9c\xe3\x9a\xf1\xb9\x9c\x13\xbc\x19\xde/\xaahB\t\x97\a03\xcd\xb3\xc8\xd5l\x14!\xf9Xg\xc52\x1d\xeeB\xccT\x0e\xd8\xef\xc8\xe9\xb4\xf3l\xc3\x99f.\xeb\xe9\x05\xcbkz3+\xdd\xe1*8\x95@0t0\xad\xe3#\xd7\x19\xe7Q\xdfmI\xe5\x1e\xe4\x87\xc9\x8f\xa7\xe0\xd9v\xf6\x01\x9d\x8f`,\x1a8\x81I\x86l\x8f2\r:\xc1\x02\xdeZ%\xa7\x01\x00\x00\x00\x01\x00\x00\x00\xbe\x97\x1fGe\x94\xa6\xa3\xab\xdb\r\x17\xff[\xb1\x00\xff\x7f\x00\x00\x1c\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\"Y\xad\xaf\x83\xaf\x93\xdaHg\xd4\x8c\xee\x0f\x00\x1c/\x9a\xf83\';:q\x92\x010g\\Ym\xd8,\x8d\b\xab\x9dq\xed\xcc\xba\x06\x1ej\xb7s33\xe5\xec\xe90M\xd1\xfd\xbb\xdf\xedc\xd1\xbbI\xa3\xbdqU\x02\x00\x00\x00\x00\x00\x00\x00\xee\xb0\v\x84\xc7\xac\xec\x92t\x00\x00\x00\x92\x1a\f\xbbM\x1cG\xb8\xa4\x05\x16\x06\xb6\x1a\tL\xe3C$K~\xf7\xa1mt\x87E\xc4\xb6h\xf3\x8cG=&\xbd\xa16\xaa\xa2N\xac\xad,Q\x97\xd6\x15\xc46v\x9a\x97\xa6\xb9`\x03\x8ff,V\xe8\xeb\x8bJn\x12o\x8b\xe7K)+\xe0\x06\x8a\\\xfc\nw\xf8\x01\xc4\xd8\x97\xd2\x9cF\xda6F\xfa6I\x03o\xa7\x15&*\xf6Wn\xb9\x00~Y\x17:\x03\xef\xf9\x03\xe7\x8d\x16\\/\xe3\xfcV\x9d\xf2g\xbcFy\xca\x8a\x10*\xbdU#\x7f\xbb\'6\x9e\x1d\n\x19\xff[\x92n\xe1\x81q\xfe\x10\xfd\xa6pL\xc6\x0fN\x06&W\xa2\x9dPWp\x94r\xe2\x92X\x12\x87\xe5\x94\xb3Aa\xb1/\\\xde\x9c\x93\xf5(,u|\f`\x8e\x86\xeb\xcb\x18J+\xdcv\x894\x01\xd0\xc6\x95\xea^j(x\xa5\x9b\xd6f1\x9d\x8fcr\x18\x1fs%\x91~\x19@\x84!u\xc8u\x8aL\x021k\xb4\b\xbb_#A{dw<\xb9\x9dR\xef\xaf]\xe0\xca\xd9x\xdab7@\xfd\x0e\x94\xf8\xab\x8c\xf4\xf1\xb0\xd6\xbe\x8e,\xa2Y\x000F\xe6q\xe3~\xc9\xaa!\xf3\'UF\xf0\xc0\x11\x11\xc2\xc9\x93#K\xea\xc2c\xb9\xe7)\xa4\xd9X\xb9\xaay\xd1\xc7\xab\xe9F\xc6r5\xdf\xa0\'y\r\xbf\xbd\x97\x9d\x8aS\xdb\rF\x9e99\xb4\xf7\x8c\xf9\xca;\xef\xc7]\xa4\xdd<6wc5\xc6\xdeS\xe5*H\xed\xc8^a-\xe8\xb1\xc2\xca\xfa\t\xd0\\\xfc\xe9\x90\x83oj\xa9E\xfb\x8du\x94\x97\x1cF\x0f\xe9d\xf2\xe4\fc\xdf\xde\x1c\xd8u\x9b\xd7\x9c\x11\xbe\b\xb5\x1e\x04\xa0\xdc\xe1Oxu\xd7O#\n%\x89+\xcc\x9f\x8e\xb2:\xa0\xb0\xdc\xd1\xba\xbd@\xf4\x00\x00\xfd\aqn:\x83\x84N\x83K\xbf^\xd8&\xde\x14\x17\x9d\xcd\xed\x19\xd0\xc1$*K\b$\x12\xf3\x88#\xb1#\xb6RX\x11\x86X\x94\x84\x8e\xdd\x82b\x19b\x9fQ\x91\x98\x9e\xf7\xf6`\x03\xb3\x8a\x86\xf9\x00\x00\x00\x00\x00P\x00'/1066) (async, rerun: 32) ioctl$ASHMEM_SET_NAME(r0, 0x40087707, &(0x7f0000000040)='\x00\x00\x03\x06\x00\x00\x00\x05\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xf0:\xfd$\xad\xbb\x9a|c\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b7\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Xd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84x\x00\x00X\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xd5\b^[D~~\x84\\\xe4\x00') (rerun: 32) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x0) openat$incfs(r4, &(0x7f0000000000)='.pending_reads\x00', 0x0, 0x0) (async) ioctl$ASHMEM_SET_NAME(r4, 0x41007701, &(0x7f0000000000)=':&\x00') 1m3.827448898s ago: executing program 1 (id=586): r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0xfffffffd, @local, 0x2}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4001c00) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = dup(r2) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) statx(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x4000, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000080)="f3450fbc475aa766ba4200ed66baf80cb8398a888aef66bafc0cb0f0ee000000400f22c042a7a70f49f70f00d86536400f00d335000004000f22c066ba200066ed", 0x41}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) syz_kvm_setup_cpu$x86(r3, r1, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 1m3.827210768s ago: executing program 1 (id=587): write$tun(0xffffffffffffffff, &(0x7f0000000340)={@void, @val={0x0, 0x3, 0x8, 0x1, 0x800, 0xff}, @ipv6=@gre_packet={0x4, 0x6, "ef37b0", 0x50, 0x2f, 0xff, @private2={0xfc, 0x2, '\x00', 0x1}, @private0={0xfc, 0x0, '\x00', 0x1}, {[], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x0, 0x3}, {0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800, [], "bdc765290bd0d93865a9ae55"}, {0x0, 0x0, 0x0, 0x1}, {0x8, 0x88be, 0x3, {{0x3, 0x1, 0x3, 0x2, 0x1, 0x0, 0x1, 0x3}, 0x1, {0x7}}}, {0x8, 0x22eb, 0x0, {{0x2, 0x2, 0x70, 0x0, 0x1, 0x2, 0x2, 0x2}, 0x2, {0x3, 0xff, 0x2, 0xc, 0x0, 0x1, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}, 0x82) unshare(0x64000600) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f00000006c0)={'mangle\x00', 0x0, [0x95e, 0x2, 0x5, 0x400, 0x306a]}, &(0x7f0000000180)=0x54) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r3 = openat$selinux_policy(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={0x0, 0x80}, 0x1, 0x7}, 0x0) write$selinux_load(r2, &(0x7f0000000000)=ANY=[], 0x6000) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="13010000bd460e10490d1070900c010203010902120001000000000904"], 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000040)={[0x4, 0x2, 0x80, 0x5, 0x4, 0x7f, 0x4232, 0x0, 0x81, 0x9c1, 0x8001, 0x5, 0x7, 0x4dba, 0x0, 0xfffffdfffffffffd], 0xdddd1000, 0x80300}) r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000100), 0x90000, 0x0) ioctl$KVM_SET_LAPIC(r6, 0x4400ae8f, &(0x7f0000000400)={"3ac1229f26f534b66a3688a60b0aa2e7a016e6f9eaeefd4b88a6196fc84e252306cfc0a748853d0605d1a14c34087aa7d163115f0d63d249f5d7e76265e9830c39da7ca197670efd7f81341480a9303ce980ab831d59be0f2dcc5477d7956fe78004570b11aea3b8832fe3b19f258b626490e40e8f2ce40b5ca94387f5f1c967e8a523713a41f46fb0ec9c8d5aad5c0079241a59e89c43b43553733c98b9ff91cddaeb18afcc2f59509b9867c7a56cd3c4db44ae66bd43e88adaaec12248668288bd25b7832d80db72025df7a96a6a1fb153f98989c6013053e1d4727ae930f938b641de8919259ecf5d8da39dc2b355fab0abce7e2ed285c819b8384b861d299823fb5e72c6db3c0298d8875c1c686c777d8574e646734256754c6810a8be7e4323ed3c07cf414b64e8d27a38fc94839df2bee4d6d970b2eee4f8d44c65fec968195dc6cb1ada821074cce96106f4e8d21471031b08cbb609c4ef0e3b97b0b51c3e8ea9d92d38e32aab746cc9963f3301157e86180d003c65b070185561cefc5ab5dba2fc345e3001fa41e4de4667256ee61329d8118636363d552dbc1a079681ac36bdb3f41a476f31653e73a6dfb81e0db198b47a51efd012cc4f45f40658c9edc5ddeba00d80ff7f166af50f983e9c7cf5e60ea8ed8aced48453839bc5021f333036c6a25dab9f4f96f0c4665500c9cd06e0c070c1bebff79817b07effa2098b69175c99c09605db3c06de02d7f7afec0a3f9295cb6277e6c3e625bab3a856503fa6576468ce00381afe588dde8c83cc5141ced73ef0301d6bd28f996b47815cb8133434ccf532dc7afafb3654e1d4a2b1ee81cac191d1afa42affea242eaaf4b397f850bf36ed926bfa19de7f51cc03377897d679c08a431b3dbaeeba4603c1bcc70b5514050d07fda521cf089f606c15e905ce7d5408e95ca6ce6253a000ea88aa91e60e06b86b52d6d6ec57f1162d2f531772034813c3a93dd3e38d60bd7619c3475733d51fb3c46c74d0576be9aefc550acfab6a2943070b5cbf7680e4bfed2f2702179e776b62de00e09c3e27398d19d2095692fe128b2eaac3f822dab5e5b5acf0ca115a575f60bd1c51c47e4e39cfd5a0814a70b39c5e4e45845fb5d4a38e6c12713d65d5dd6d518fda64fc4fdac86d5995bbb0d4aa95e888871643c5aada5af3760d4dbec1089442ef66f82c2a374206ba940fea15c581185fed04cf0024b45c06c32aa937014767569cac2f6999de6b9216ab39fa7ba3d75dc274b9403f48d921dda85cbd53394e715739c1a592a07c0802ea06db490a1f9971b9bd33e004e0508ec8d5d2beadc24a25b571eea4b35d9d18caa77a8e6d87a2742fa4d608814f562ef3882f72d313178e753bfc32d1479498858fcc19cd42cdb120c450f88968ffad646b27e651c4e4e467f7e9c541ae394ddbcc981ef907761d"}) ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0xfd, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff}) ioctl$KVM_RUN(r5, 0xae80, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r1) 1m3.764305523s ago: executing program 32 (id=587): write$tun(0xffffffffffffffff, &(0x7f0000000340)={@void, @val={0x0, 0x3, 0x8, 0x1, 0x800, 0xff}, @ipv6=@gre_packet={0x4, 0x6, "ef37b0", 0x50, 0x2f, 0xff, @private2={0xfc, 0x2, '\x00', 0x1}, @private0={0xfc, 0x0, '\x00', 0x1}, {[], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x0, 0x3}, {0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800, [], "bdc765290bd0d93865a9ae55"}, {0x0, 0x0, 0x0, 0x1}, {0x8, 0x88be, 0x3, {{0x3, 0x1, 0x3, 0x2, 0x1, 0x0, 0x1, 0x3}, 0x1, {0x7}}}, {0x8, 0x22eb, 0x0, {{0x2, 0x2, 0x70, 0x0, 0x1, 0x2, 0x2, 0x2}, 0x2, {0x3, 0xff, 0x2, 0xc, 0x0, 0x1, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}, 0x82) unshare(0x64000600) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f00000006c0)={'mangle\x00', 0x0, [0x95e, 0x2, 0x5, 0x400, 0x306a]}, &(0x7f0000000180)=0x54) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r3 = openat$selinux_policy(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={0x0, 0x80}, 0x1, 0x7}, 0x0) write$selinux_load(r2, &(0x7f0000000000)=ANY=[], 0x6000) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="13010000bd460e10490d1070900c010203010902120001000000000904"], 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000040)={[0x4, 0x2, 0x80, 0x5, 0x4, 0x7f, 0x4232, 0x0, 0x81, 0x9c1, 0x8001, 0x5, 0x7, 0x4dba, 0x0, 0xfffffdfffffffffd], 0xdddd1000, 0x80300}) r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000100), 0x90000, 0x0) ioctl$KVM_SET_LAPIC(r6, 0x4400ae8f, &(0x7f0000000400)={"3ac1229f26f534b66a3688a60b0aa2e7a016e6f9eaeefd4b88a6196fc84e252306cfc0a748853d0605d1a14c34087aa7d163115f0d63d249f5d7e76265e9830c39da7ca197670efd7f81341480a9303ce980ab831d59be0f2dcc5477d7956fe78004570b11aea3b8832fe3b19f258b626490e40e8f2ce40b5ca94387f5f1c967e8a523713a41f46fb0ec9c8d5aad5c0079241a59e89c43b43553733c98b9ff91cddaeb18afcc2f59509b9867c7a56cd3c4db44ae66bd43e88adaaec12248668288bd25b7832d80db72025df7a96a6a1fb153f98989c6013053e1d4727ae930f938b641de8919259ecf5d8da39dc2b355fab0abce7e2ed285c819b8384b861d299823fb5e72c6db3c0298d8875c1c686c777d8574e646734256754c6810a8be7e4323ed3c07cf414b64e8d27a38fc94839df2bee4d6d970b2eee4f8d44c65fec968195dc6cb1ada821074cce96106f4e8d21471031b08cbb609c4ef0e3b97b0b51c3e8ea9d92d38e32aab746cc9963f3301157e86180d003c65b070185561cefc5ab5dba2fc345e3001fa41e4de4667256ee61329d8118636363d552dbc1a079681ac36bdb3f41a476f31653e73a6dfb81e0db198b47a51efd012cc4f45f40658c9edc5ddeba00d80ff7f166af50f983e9c7cf5e60ea8ed8aced48453839bc5021f333036c6a25dab9f4f96f0c4665500c9cd06e0c070c1bebff79817b07effa2098b69175c99c09605db3c06de02d7f7afec0a3f9295cb6277e6c3e625bab3a856503fa6576468ce00381afe588dde8c83cc5141ced73ef0301d6bd28f996b47815cb8133434ccf532dc7afafb3654e1d4a2b1ee81cac191d1afa42affea242eaaf4b397f850bf36ed926bfa19de7f51cc03377897d679c08a431b3dbaeeba4603c1bcc70b5514050d07fda521cf089f606c15e905ce7d5408e95ca6ce6253a000ea88aa91e60e06b86b52d6d6ec57f1162d2f531772034813c3a93dd3e38d60bd7619c3475733d51fb3c46c74d0576be9aefc550acfab6a2943070b5cbf7680e4bfed2f2702179e776b62de00e09c3e27398d19d2095692fe128b2eaac3f822dab5e5b5acf0ca115a575f60bd1c51c47e4e39cfd5a0814a70b39c5e4e45845fb5d4a38e6c12713d65d5dd6d518fda64fc4fdac86d5995bbb0d4aa95e888871643c5aada5af3760d4dbec1089442ef66f82c2a374206ba940fea15c581185fed04cf0024b45c06c32aa937014767569cac2f6999de6b9216ab39fa7ba3d75dc274b9403f48d921dda85cbd53394e715739c1a592a07c0802ea06db490a1f9971b9bd33e004e0508ec8d5d2beadc24a25b571eea4b35d9d18caa77a8e6d87a2742fa4d608814f562ef3882f72d313178e753bfc32d1479498858fcc19cd42cdb120c450f88968ffad646b27e651c4e4e467f7e9c541ae394ddbcc981ef907761d"}) ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0xfd, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff}) ioctl$KVM_RUN(r5, 0xae80, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r1) 2.399377315s ago: executing program 2 (id=1036): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100b, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0xfffffffffffffffb, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x1100, 0x0, 0x30}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 2.375160607s ago: executing program 2 (id=1037): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000340)=""/4096, 0x1000}], 0x1) ioctl$USBDEVFS_RESETEP(0xffffffffffffffff, 0x80045503, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x100, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r1, 0xe5444000) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000131000/0x400000)=nil) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x1, {{@in=@empty, @in=@remote, 0x0, 0x2400, 0x1000, 0x0, 0x2, 0x0, 0x20, 0x84}, {0x0, 0x0, 0x0, 0xd07}, {0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x20000, 0x0, 0x1, 0x0, 0x3}}, 0xb8}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="280000002100010002000000000000000a00000000000001016200000c0018"], 0x28}], 0x1, 0x0, 0x0, 0x8000}, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) clock_gettime(0x4, &(0x7f00000004c0)) 2.291344173s ago: executing program 2 (id=1038): socket$packet(0x11, 0x2, 0x300) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r2, &(0x7f00000002c0)=ANY=[@ANYBLOB="080086dd0001110004000000a60c6eec00be00442ffffe8000000000000000000000000000aaff020000000000000000000000010001"], 0x7a) 2.223826619s ago: executing program 2 (id=1039): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x82) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x13, r0, 0x1f) 2.21215531s ago: executing program 2 (id=1040): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x77, 0x29, 0x4, 0x20, 0x424, 0x9901, 0xc257, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x43, 0x0, 0x2, 0x31, 0x7d, 0x55, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000400)={0x44, &(0x7f0000000200)=ANY=[@ANYBLOB="401504"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = openat$kvm(0x0, &(0x7f0000000080), 0x2382, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r4, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, 0xfa7}) ioctl$KVM_IRQ_LINE_STATUS(r4, 0xc008ae67, &(0x7f0000000200)={0x3, 0x2007}) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x60, 0x0, &(0x7f0000000100)=[@transaction_sg={0x400c6314, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @acquire_done={0x40106309, 0x2}], 0x0, 0x0, 0x0}) 2.196511972s ago: executing program 0 (id=1042): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1002, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x1) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r1, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) write$vga_arbiter(r3, 0x0, 0x0) preadv(r3, &(0x7f0000001500)=[{&(0x7f0000000140)=""/37, 0x25}, {0x0}], 0x2, 0x1, 0x1) write$FUSE_INIT(r1, &(0x7f0000004200)={0x50, 0x0, r2, {0x7, 0x29, 0x2, 0x80000}}, 0x50) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r4, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000000040)={0x50, 0x0, r5, {0x7, 0x1f}}, 0x50) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000140)={0x50, 0x0, r5, {0x7, 0x2b, 0x401, 0x7fffffffc1148025, 0x5, 0x5e6, 0x2, 0x5, 0x0, 0x0, 0x188}}, 0x50) syz_fuse_handle_req(r1, &(0x7f00000042c0)="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000160000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000eeffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e1ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={0x20, 0x0, 0x0, {0x0, 0x4}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) close_range(r0, 0xffffffffffffffff, 0x0) 1.861686579s ago: executing program 3 (id=1044): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x11, r2, 0x147a5000) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_NESTED_STATE(r3, 0x4080aebf, &(0x7f0000001180)={{0x3, 0x0, 0x80, {0xeeee0000}}, "a47913346dd6456639c75e5614940752a08b19629def4377793940c909754c75c11fcb9d190af604731db97bbf7935b062ad19cda9731b551eab3c44632fabc2af2d73a2c4d3eb681e9204f19d7b828d4f021c444bb664363ec6d7c9ac97327f6c6e18a67b58a0ca3b4b7d60581db757aba14122c2874823816aac1d472dcb37c9bf92783893357e636387b9748556aa32e6ee244db6162e0c3b3841a88a8f8bc93438475bec6ca94ebfa5e27b97144601bb9919155bce9b86bb0c08617185c748b15503dbcd6b748a6d50145b2371dd54585e5733eec920781298d9cac02e81d47b89dc3dc844c287453afa7116e56ce3d134c5616b060856e31c5aaafac523f156dd0e4fc59b00544947126a4b642cb4e322a1ee45f692524ec27363d5a1a6045ef025c68377db970231a0b1a35381841503fd216c8aa8340ce66662d5e3aaecdddfb0379e60a8013e6d7a5f9fc0555a5684b410121218778b94fcdce908342238448c5f9fe1af220b18a9dd1df890607dbe4cbe048c67a5ae7811e6472d886d3b33ee86dba9b2311d6655be6f48bdff3f2eca2beb3f00637dc19b4ec3a11d5684fe89a901d1eb2a4209896b0ed182a693a23141f96ac13875275a674f2261cb6a22b964b4450796e761514d22eb87329d2025f7bb50964c9d26e032fca68a39ed337fbbb377a716a31fb29925b3ac4cc866fa69575893e837b58d8de9a95767e769f4bd8ff138881524f7855649042baa9fce771fd981bbd9ec031844d2243537f39fc668bc4904a065d50e1c80d2e4e4e761e0f3f80b48f24759fd73bccd9a389889cb394502cb7e8fbbb7f2d9cd71501fe36e8772f8e8910d0221971b65cf6e8bf18b56794ce0d5e2a990e43ba8bf3c9ae27ca2175be963d5211e2993baaf2b1bd857b508ff845e29378b1bf790358708dc61a130c85d6d61c9846a32f7ea73e2f29e16545e92676e5f16d050f11f73c84a400e380fb2020bb6209d8e3df1be391e89e1c4a60db5d680771ea6ce030c8de440add8c7724304a87f1859b546c51658b92c39b3fad4569b6589a7d97028118036d2e284e34fe5c73c28b07ce0850fc1e6d501a7538d1a3124a12faa1301017e508c2a78f3951d86690a1e92b580ad7a9be39464ee0ced48278921277d948e268e9088345c9c792f953c9e554d6ec0252924b67f5083ecb970e2df9f9fcefdf9f4d2429ce5e7d939b57d16cb244f5f6fa80988c74130a3774e85c3d048f10f7a3782e8cb9aa249457e318a4007b0616166f47eae5d1a0387c572aa17d0b3293d44e15d3c0c6bc58b0d6ec5e46d1437407ac24a3107cbe8c06845bf8d4e6e27f205b02ecbea27644b491f057329630027ea21be5a1bcbabe8d4182defbbb00bf8221548695485c7bcc7a5a6140936fa13c0ea6009e4d898c318c7d659f4748f4144f82d9c31bc6fa55e07a6fd5d6fb2bb8107be0dc6edd850d60eab560f83b651bb50963a1d7be881804703fb1535ba65339694c15f55e76aa95491512fd6a6a436eb7ae10115ec1f45ce145b14b0144ada05379fd87b4f125449e8eb1db468297d82b89eb7061179a2193a478708c3bb89e60acbb10ade5e90ff824175c31dd78f818b44a02e34bbbb21aaf9083b90d6e2f3cbed6bff785762ff046f25ee1141555effc7a0a47400fa813f4550683cf4768ae429bb9b267d7ee63c37348cf7a6c8edba32c314ce095784aa8efbda60b3497efd0fa1ccd1f53085c8c4b0c4467cca017ca7bdf0edc91267d3dc1ad78862ae2a15cdc87dbd52d8bf35db9b12125cb5f1b2be7745a11d2d4abfc0ccd7672e579956c0049f1c8676aff9c57126b9f2cab917700fd2a4f9ed654c9c1549a13f327ff6a4eff3fb60a027150607a21afb130b5d060464fe66830309d816452f5fd16f9f74b558b052a9eca8848426314a1dbd8a1befbd438b3a05c6c9712d764fff7f290b2cd137361bd2c44d4888871448b35ffe61ce904768ae9137c2223eb8ba23e679508d775b45dd48278d96621e666b27278ae42f0d94015452dee6143b660bdd504a8d5ee4e3da21df144e6131c7b926c91094d4dcfa95b2618694fba0af50b4fc63678c1c8f1a54f37f0b549735314998b2ea115027bac6cf751126ac7048afdac2c178b23bbd7fa3904414cd440c6721388e09cac19ea3a3f0d2528d1fff23b9895f050963ecd80e2ff4ca6cde866440e868eb65a57b232329714ea3138814323cbabb78121b54084d2042c3557ae94b2ab7b0c305473b1f3c01b6dbe6731441de9d27162e595cfe4ca6867358ff0cd03124fd0f5a4fea05f336e2b351dbca5008c80d1999e65cd64c287e31a096b946871453b87d1ecdd98303eebbaadc75bf5348393a9cfaffc10e69c774a43504e78f3dadbc2a5a395dd8a1e13c249e0b00a3d9f783577dec7107471091bd1faa94565c0600fe1e21a9e8d809eb17d185d7d3eff364dc7cd62725a36b8b223a95542b9723483e39135d2f10e1378b011fb5972a4274502b2aebbd86537b0a6f0f507f36c272347b02cf0bcc398b57283522bd5f0b88b1fed5d82fe8791b7ad932e6ce57685d8e0e7bd3e890a713eadc95060cba5d1beb6d40d3e76fed18a5902fd2232984cddfe5f86fdfd683f0ee6a48b2c9e70989833a22d6314f5e6ccc98328b877fbb5461ed1a29d5b4d4de0caebf10704dab73be53145b2bad28ac6d694cda23acc1fb7fe682711fee67b0b1973aa93a8374f4e09325d57c9eff01c707e27a2452afbc3da5d216063dc999e443aab9403f8f56a9d2debd8409ecfef9aeb9fabde66432891d465e9e7d960f10e72bd6668e9222d3c26c6a3170ec529f77d0e6a664375c136eb4994a645c26ae08b4e5e2a2f369268761a1f4912f47a2b228a99ac738d775a57e08d2d1c2ba87e8bf5adddd1ba64d565b161d6dfd00447ef245b7923b061d645f5b6c2b89286b2fd6954d5a74f778e301fbde3d28dc45347447f11e0a84d6b13cb5e50d1c5e61556af2949bdbbf8a5e8888b3f3a4c7fc558c8040d2b2ca2727dd13a984dd7d6bef52bbea8d891f4139fb4a1d9f20b36571efa8795bb350efe2773ecd7a513c35819b8894de25d416d3eed09262b2bd2b9ae26460eb467a3b1bb262d63379e575db49c1184b68dd169aa41fbc8db12198f013dbde3d4eeaa694d8d2f466bc3ed9c4ffc2c2cb00fe18e5f393861cae36a5c92eb2ebba471041a19cf06e202b972e1436242fdf9ed356132fc30212d9005bb3f04323905f1dc35fe43943d5ce53e5aeb3cc82914a8f546216854fe26380d9317d16b6e4de19c46fff43ee275815d2ca55c635aaf71782f48b85ffd8b7ab630183012d70a3b2318c40300bc075b3dd64ea0c7233925ab0009dfa3c398926cd71a5e929560e103b8c2e9454ec7efcf031784adf4b5a64c8fdff0dfc229f58579ed5211353ea172dbd0de4dac4b30b8ffb77fc62d7779fbe2fb55eadba92f6cc6454bfb118ab04b90f42cda61553a128734cab4c6974cab55ef2e4b2359f457ea767d140d4a0c9ca30c37ad3906cbdd05801832989b10d3ebbf004801c1329a7259e226f84c67fe59b571382eecd5fcee072693560ae27a36676198e6d22f29e118f5a76de9cdc7928293600ccabbd43066d3083b3e709f0a21d694230d4c8029fa870b2e7c3d3ad9bc0b502e6f173680408e3a44906b1dc30d930b3da79f78ca2b0fc2b6d060a85378dd6e95bff65b417e765a421dac93a932e34c23b081866060d84d3aa0a08ff2f086fccfef4100f8dcc82c744fc5b6696a24b0152ecc37ae2772fdc1a5178c828596c39854b0b872d34237c884b62fa2fb8ec2203a1f8400443681a6c5c4d51fbe49b6cc918f44b3757e85b8dd836634297f6c14add50f6b5f38c7eff349cf193719c688fb20b35d063525ecaf3e203c67ae01af343d12fbf007bdfdddaa0efb5f9bd7ed15848ab43ae33009458dd52d36be97634abf8fab045d3547cdae94356c94d4c085297cee8d3a7a6debbb2761e47e5c3b1ed44ae57e14b6ed29d8d9ec87411cfff6eae8c01616a3bb3e6dcb9a12e46d2b11d973d96b7f49dec59475279204751df71a80cc3c7dfdbca405c1db5fa90e8c25b5a19a45b0af6043f9d291fcd710a908eeec619d390161e395f6a16b458522f7fce428ca38267a55ec0ca65d990725a67be8ed0a9addad332d46c54ad5945f031af0c0a2f61941f3b7dee3b5fc4ac97b67f5d2a10b59cadc70d4deef621d4f6f0e665f121803e699e13c291d6ece24046cd826fffd3d8d963fd9af1a06ebf08e70aa90bf276a648e2209f10ab55a5cdfed3cca7bc6252567c99cfa514a77810c825adff025f4cac9811ec95a011fec9d6d36b475c923dc9468f47363b7b82eb4ed03f36b9147b47a886e239981a762f6fbd9cb0db0bd520e0db488eccf42ee32815d42b24d0ef0232cb7710b4b1349f11eb78b000ec544b13fdaec892afb573d110ba9b1e3dbe77a6ba8547ebfb5c94809f6186d4dfbddd0d2f3f468810a1de58918d6e8a8577daf2e7fa2bccb73e44a3e7d24b6f48cb6d573bf1a4968d6bec51f4613eccd41ae0deb80cfa2b97b44456e5c7f470d4826ee875101c6f21ffb4af1c866baee45fa7b5c73c565ec31fc806ff733174e8c53bc404aa65dcd83ecf04c1b0f99edbee29512c25f45edaf40b136e38dd2e6efff1abdc4f58fccd5847c63ed70f0fd6cfafa3cd95b44081719105135c04e85ded24e2fc54838c615cdc19cd885fd4da9171653722b9d2a40a35f683a1a28818de6f2aab4c5d1ab20eba009e7d9c2bbae8afc1d091414b4ac6872bd358825e256447df859ee2f92be6df980b9bbe8354682f3456547716dfb7070ba0f98d42c51c792a1dd9cd2dafad4ad82ff642d243b15b6babf7b458580f108de493efd9c5395eb6ab8829719e685bdbe07e8a3f0d3425b5a9b412ece76cdd945db7281ea89e5b3dfc6e078b1359109f6f8922fe66d8c10c1294dd8e7ab18ea2753659fbc502990620def1aeb1f29f96488b17b4db8e23fc8f6a84f64f32a58e929159a779ae20febe80d34da3cb26ba2079683fc38d3a6e9a18af1da8640ec62369e7c4ac8497bcf1bc8bd5157761776a057d8427c68b38a58d2b706ea2a3a99c3c8832acb3f56e0029c32792acf23fa08e93192e60c090cabbf7b2c0800c8dcd453aff7e1164499175a6e9c45b8eacd8d35be2aad1fd59cb1a3ff4f8f4bcb30352f750c01eaebe7c8c8ff298ca05d84ad6b2a1be0cc5ff0c5772e7a3de1c0875e0d24ea7639237b33ac3a9863b3725610fb7bfc8c86b292dbc3cdaa63e7a4654907e7694584823637247c1a15a3eed4ff9d666dd204416c3435902e7a8daaf00f65e02bc44e6f04b581ced30580a202fe4c0df739ff480014baaa9ecf596866994fb608048e55eed340011613c8499f0d15e2ec1598dd90ab8ab6a01e7210b8114e93cc13276af7fb787d11d5c142b4d8f17cb24533a5ff8471b4ef5dd7d61eb9c796549628b90e20b6a04ae3ea6645a96db6320d5042194f4879e1c9dc061777ebd0118200c9de022b7c50b08464b64dc5510cf2db532de45b6275a5560a208ddbcb8cfceb4faad4fa6a151d40e893c6326d2e23183e6e1355f33fdcdc18879ed5fca802d37704c697225f55ddfbb86110b8d36572462c8f5850e6f0d670b7ee36edd2410a7f0c810b668c085d685e21214d3dec38d9e77db892779a865dfe6dc3c9b82574a62ef907008af32800aa643c8a1b317af91e800b175fc40e6eeb31ebe8618d155a0082abd491248d17605f3d30894a5fe8f13ff20e77e", "5119f006cc1c9789471143bfc412869195a4135015833e88435c450283abff8962a68bddcebe5a5b3deaf6cc419474c6ed035054f36d5e1bfa6601ba3654cd38f5b43d541241d4c2a267412a694258e0dadfbd808f538ea6b58f3f602a19cf6ab44ca1029566eaa7ef6a1bcb9ebccccaa78562e37f5b075a87d9bf1543f47eaac5c496d385d7a0830fa45cf1dfef0d61170d078d2b41bd012c441c32a502ebad01c0118a9e9ba1b5d86ede4969fdb940dfd9c518af2269730b0804ae5c7c39d9d8da63d4f18d82092b06ce21f27e81b0b5997efaa8485757b9617714e7cc3af6ea79917004454e63ccaca937b0346647fe6bde864e83fb835c450563878c8e2507846a6761dcc961025bc0c142bd2c20db277fcd2711325bcca1142b689fc18687f3a6cf95fb748ae1604a765b8dcb2f6e2285fe7cc23f5ba7e893e2c1d71bde5ae963d09dd8cc4c4ffa7863f6bbedbd0954e2feae9f1bde7b4ed142118b4ddaf5c41c7fb206020d5d3d615cbd3e451cfacc18c655d0c5e3ee0ab910a91c1db86720ebab460bebea65f2dd6e54e958d940a028b7a98af934789642798fa05185e0d40e20ad38df9d23e409273bec4e508a57d1e0b854ce7ffb8e95399fc9a0c21d9b9295e7641c17c2b1a955836b06763dffac45067573633e8a3acbefb307fa9d1464ff28e0b8a3c12b866d72c788c008f606c8c729a8175952ba18451740e52a6c480397f574c49312adc6e95d1270381b57492bef7b403d8b83396aa89c13fd17c30224727322eb3daac35de9a968c950955ae7458d5d8a92d547b7417c7f4e2ca99ed0d26247866431a52b924e20d22ef1f8769b68e04b70e2f6a1c79d3fd6f95baf1b462863f0bf0d9655971ce27e08153102f18e466aa340e408bcc7a7c385a9e684af2b02cde5d7fba51ee30bbbb775df19a527e55066ac14c221214e8d7df53af87d4c9c9bb9c1abbbe7812b659d549e733cde952d634433410a57029c2c596647a2fbbdea165a34f56b9447487f7e12f0eebea4f082c7ec490216cb3bd3d3311da6f983079b7c1abbfd151e07a5a29040e6e1e4e8dd5e2b705d748a801980a46468de8085379c2416ff5720bff085f82500697fcc97c10a432337eb4a9bef49d6adf9a6470bac75b8ec5852ac7c126c4a7bc92c836351919098df93e15bc09aa035a8590933ca867c1d887aea2cb3f721cc55bf8d8bc7b832b9b855a43c9653d43ffd6a3c0c3124b4cee7786755c682c04da1f50404ea7535161ea4d624d8aa2d777b70a6b4199b71d4eb36ca488326a9c30bd2ea61c899d3c0fd3df41e8813b8e5f176dfc9c9a3cfb0df2ba2707ca3da145cc8ea6dfcd23608c176ef811c07a4754a3cd28ec00271862751cfb5f2af370c86eac8a32704511323fb68332bc51ddbd82396cef11cd6a2dc576c648a7cbb17da711a4a140cba0c82f5f316c550c81f8405c9f2059918beadfee152fa39f932e8d90f1b713bedb6c175bb51856c5c42182b3175ed4476499974ebf7e0f6bf4a10383181d69c28c0e6f666117b3b4c031f8a570ad1c4581859e789e82388c3484c01abc44c0f9dbd03b3e7332f4aed9590e8d13b52b015442af071fc85c14250803af5bf469ccd51e1e5902b58ebf534708c32aec8485ede7fe8f46b7fbfefbad405027cfcd0dced53396273e654f80c0b91361c07f32b21e1cf6ce616ffaf20c63de6c2bf6b6a6cefb524fd1f97e902774c87f803516a53eb407f04b31ff833bcb5df1272c9be392eead6799c775f620f54cfa09fcc22341fdfb3de13446a44c0298a43e2b33df8f06ad5619e83f908b3762bdbf5d0f43b38e79347b5398da7b4b1680d2646a36fc14a2a3bb841dcf4f0d2f0695066a682fe0af43a63755a1ae709aef86237478c15d548be28fe9cb9cd18d3ae9c92993edfee9b09a2bb212de70768b6364121cda2da000a8c87f0a2c8d23947e8630ef5ddc2a36c2c554b56155d80924695d34c30758b60465c6f3cf7c745a234ff8825a38e61a297a266be61f3f0843f58e13d716143b5051ff59713dd39cc0278ee64683e66156a08204dcb991dfed439ade377850b023aeb3fac8a024918e7743952e4560beb80e0e58af87b50716e386888f7c26558afe09674a3626af9aee49eaa6ff8325a9f463b6a35fab59739728d1f7213fd3bf1cb2a5bbba0f254e6b2631c2393da5104789755d09ee327ae2cd9b6b22769af4f59afd7e38740291098cdcac090001deaef4e62deb976176da17aca7d673d20ff8150333e7ed79f1439d923e48139d23ae415772be862e8ba569f1b34d20561596adaa633b1f96d4f4effcecb842cfb4486bad97cd7eeaa82d61ad06a981428d88898638246d26dd7bcdf6dc11b6c6c5605a67f7429491c3e5dbf6f1c0a9fdcdee4a58649b9fdc14898713a25fb49663dc9674199bfa286dca035f1174f72965f589eb1369dd46fafea7ed7d4e88291c47d3bbfe780c190b5b4c51b37758163d7751455172a2919bacd16e870ec2ee4179e9a6a7aa6df66ca8ad2f2e4d26b19ae975247fc6b16bd8b64936eefdefa143ba0ebf198a262b2bf511e52d24891fae9ee7b0ea25796e6781880c5f6322c1cce478d6b8cc39ab3f3cfd1fbb497099c9449525db6ae5915e490d599a93045506469c6115cc8c1ba535231ca8db9e2d85634ecc8ed56c358b8af92d703c719ba9ae6128f589cbe1fb4f2bec119f6bfe53c207aaaac6c413e11295818da5fd3779d33a27f6c313e35a51f49f4420ad9956af3bf749748d7e5aed89b9e5eb7134197ff128d8db26f34036a6514142506d6ee2d6b3014d2078ae9ea9612b4bbbc9eecabafb30eb62f1b058237ae4d5f49c8ed33b933872c22f68f3dda68a9981819063e34754908af69719b0b8849b4a134040c36ae48b373e1deb8ef3a314be7d622cfe51ee0196aebf738480bf4fbe034ff7b4c76f3e2ba4a26f9a303a9dd3411dbcf78738af3c9051ee1a178875c8adbfc65bb31cef6bd4897917941f4e7f1a9e2d0b487576c46928771b047ada76c361c8fc582b14f1ca86cb66f555e680be751ed8abd67d07e7185916545fe6c7669144abef61698c5cfb781bd7e511913aad58a8359632284afe08cf4d680187fd2f9ee67e0fd43d1536f7e432d757cdc14797f6aeb5cf931923c4df4cf7063196dac72a6453e8720be820238319841204a5ca807e708027d8a6004bb00abc8e39527840e31f9e12407d7e4f0f9cabacca0ce93b22d5cd14961534fadf6724975f6fdacc47e2e47c9f702e3d63084931adefd6c4ecf6eea3a4f8114aa068aa3e1472fc0811bbbb58919d5750f1cf3768ca5b23b3b34f6b5726ffeec15db782a410b86f024909eb30c84d235c91265b641a17a97d035d8ad5d87d269835e146001a0403517b0f36e29d1f71be09f26a8bba8d607805d241401dcf98a09419eef63f4d5ccfc2d14fdb7f78a05565c772b8845b1a2b54bbab04cb99e897d72165bb5a7f327e83907bc38683fb5259e07c569e43cc000c4a9bffe24a6a049d1e758543349664858421f52ea41cf24f7968a1eb454be01fee1fda7d4b140c3522758265d6ad752b35449418fb3b81d96607e4081c9c9047a633817c92621d83303a44f37938d074a7633b7f739eeee0bae868b0cf6103a52309e7bcc6168f7eb568a69080c689c62a27575243a17265fc24742cef2de748fd2ebd18e9b0d245d7c3c3e7ad86b6ec26019ab02add854be749043484abb666e984d1d7e20ddbe12c606ea45aeb04618e94b8f3b40c1a4b4a9fc3723702653f8ca5d5920094026d49a07ddbb23237e7440de5e28d69d8eb21fd2003ec44e408620de02d5d82b7edeb8010685aa6cd3834277f9e34a18cb725a08049878a7af40a64d4fc0daf0fdd34573fb85740242b113c5676ada15f6a739f240a521d423b029c091d77ba61423630df332fe12b51896a7cc5f566fbf156b3a02fbe8ee30b6d6d8f9211ba88f9daee051397030aa01be348c8648694f4eafe0b8c9b6fe796344a7c6f4452ebe5f6ec7f3387f9c5578d9505cfecf9a9a8f2c77d5c6b01350a56520ffd528f518d227a5dc6953010f6d70f7f2a8738c06ee1749dc0d0e8b99ca94aa7afe525acec708e98641f40e3995b562451f61f60d42a6e0e5e7b1fc80b403249a114febc82e588b4466e4f1420fae53762f96195d1a4b27ac8ff65e577429b34e5d14eb7906dd61de872fe9dedf3a2d62d50ba13ee394f9a3811c7aa2ab319fffcb4dce76e0d25ba945ce9058a2aecf1e46dbbb8f247b011cd28df56066c615a261f4e35794969de715721d0138ade0b71bdcd2028c4eec53a4d5b45e6fc9e2606ae9d3e1d67121e2f623d02738720e4138d74146966217c48efa70f453c1bc583227923b36a70413022fff56bb83969107c36a2555e98d7c47f7819a377681250d3f93edc1e853d43f9e03c7a4efa7b0b38e468b79516727a533577b73a688c119ca4bbf09926680709a16d50ffe4ba2b4ed40657c4e93f67c512e606a33312fa78859e164cc0fe9f2504e5f232a7848d529764a8a759b593744588014fa7fe2123cba76da568aa184fb6521b88dd5b5fb3669a9ee9721a929429557762c57ac82b2c9b404ea7e3e513162938cf6c0db3f8df18320dc0a7e196c2188220008f0288702902a2b58bc3ff60b69a045253d78ff8396766797dcab63b2a32217b0b690475ab1bb8d5572fd11a838a0e6c2c6ab82b5463bde76ba5a9dd211ce86c2ce1b28d5148b0a5e9d39903c220719282632481e397428e7a934d653af7f7b146d0daed88e8962ddc07a5aac9931de43e07b7cfea959fcea4fbd2eceb99d7de8c8cb5c1de33a59a3a198d6dd593aa7320e0a83199a6fe94b2f376f147919b7c53fe7e2ab9fd44442cc7519a7a73abb8f2ffe4222e90edba1d69a06a1f3c5442a4e71cb424972305204ac3854c5f10cec28559f42a98d233397af109430b56308d308560531b2d71e629e377c2a0dd972770d79c00b5ae5cf66f04eb21796b191d12a2b5620dbac2070630aae30377577378641e41cdb51d8e8b29d4e80935394835263798973d7461f0b944292de4f7985c131853e46b431d68e78b454693fe58e147af995199787bc88eaf675bf9da409aad7b8f9908d26302a2ef0a3e91cbc8a1b169fb2d0120ffc1c51d88b5d6033304ae0b164dd76b582952fb81b62143faec94f5ed41a7adfe0728e55072cabbe21a00ca2b445521e319b08cb311af6ff65369cbe4f4173fc4e5f37c6cffdb048cc035208008961c089c3f6b3de1ebbe09d6e922fe4d161b0e1749dcd45e26cf4dddcb756bb9ad958f83804b4c76c7ace06f2a15e4b3cf3a3a432c5e5a42f0005bdc148bb827f46cd9bb4cd98e65d3e081a00675a24d86acfc1b73eaed6410ff966fba176e196760657b4bb8bc32bb658897441b7be7365f35ce317bf070e690990b9bb0d672194816f61a0ebb9bf35fbfc388be58a28c5f38208f10c414a2a1a251b05fd1a712315a028aa731876c88ecc90ad67e224e8496527359891e90e5a34899ead151a67eebb60cff5faa20e16c377a4916cf233e8b3943d67580124daeb317f9599b391353a7e459f248dee7ada4975212ebea4ef57c2d82bd34b421d32ad54d53378281d3024b2e7464b121d557bdce1916366213be46f90e4bd619b5c1a6d3b88e0bbb06d0f43566ac3cb35c039fa9b91153e7bf0ce165dee6e9e88d8890b3bce348723db13463fff5bf440ed9f6ce78fc6c11243b45c74d2a1ed6e065c225069ff7a4069c85832741a6b5d6b323debe811e87b"}) 1.804350033s ago: executing program 3 (id=1045): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0xfff, 0x101800) read$FUSE(0xffffffffffffffff, &(0x7f0000000100)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@volatile}]}) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) sched_setscheduler(r1, 0x6, &(0x7f0000000000)) mmap(&(0x7f00000db000/0x4000)=nil, 0x4000, 0x1000002, 0x12, r0, 0x0) 1.753268008s ago: executing program 3 (id=1046): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100b, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486313, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x1100, 0x0, 0x30}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 1.753045118s ago: executing program 3 (id=1047): socket$inet6_icmp(0xa, 0x2, 0x3a) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) syz_clone3(0x0, 0x0) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167342, 0x0) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000001400)=""/4096, 0x1000}, {0x0}, {&(0x7f0000000040)=""/106, 0x6a}], 0x3) 1.699410322s ago: executing program 3 (id=1048): socket$packet(0x11, 0x2, 0x300) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r2, &(0x7f00000002c0)=ANY=[@ANYBLOB="080086dd0001110004000000a60c6eec00be00442ffffe8000000000000000000000000000aaff020000000000000000000000020001"], 0x7a) 1.663000735s ago: executing program 3 (id=1049): r0 = socket(0x10, 0x3, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/wakeup_count', 0x4aa82, 0x0) write$cgroup_int(r1, &(0x7f0000000000)=0xfe8e, 0x12) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x20400, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'rose0\x00', 0x112}) ioctl$TUNATTACHFILTER(r2, 0x401054d5, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000280)={0x4000, 0x2}, 0x10) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/softnet_stat\x00') write$P9_RREADDIR(r3, &(0x7f0000000c80)={0x103, 0x29, 0x2, {0x1ff, [{{0x4, 0x1, 0x7}, 0x8, 0x5, 0x7, './file0'}, {{0x1, 0x1, 0x1}, 0x2, 0x5, 0x7, './file0'}, {{0x80, 0x10000, 0x2}, 0xffffffffffffffff, 0x5, 0x7, './file0'}, {{0x20, 0x3}, 0x9, 0xf7, 0x7, './file0'}, {{0x10, 0x2, 0x1}, 0x10, 0x2, 0x7, './file0'}, {{0x20, 0x1}, 0x7fffffff, 0x4, 0x7, './file0'}, {{0x8, 0x1, 0x7}, 0x6, 0xb9, 0x7, './file0'}, {{0x20, 0x4, 0x4}, 0xfffffffffffffff9, 0x9, 0x7, './file0'}]}}, 0x103) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r3, 0xc400941d, &(0x7f0000000740)={0x0, 0x8, 0xa3}) r4 = socket(0x1, 0x2, 0x0) setsockopt$sock_int(r4, 0x1, 0x2e, &(0x7f0000000040)=0x7, 0x4) readv(r4, &(0x7f0000003600)=[{&(0x7f0000002340)=""/138, 0x8a}], 0x1) splice(r2, &(0x7f0000000100)=0xffffffff, r1, &(0x7f0000000300), 0x4, 0x6) syz_usb_connect(0x4, 0x1a2, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000b6a57e4086805b0bc5e10102030109029001020000000009040000020e0100000a2400002208020102092100000001220000090500000000000000a7008d566539461c701919d99a91c3af134dfaf61ea66b8f08810855d90c55c91f11c4a6d847caf7b449c6c760e60f6b890d99ed23074bf2538ca7bba727dfe7c00b90d0bc7f2da56768ed5ce8df38c07183564831596fd52da49a92adafa6277df5a120c898fc51ca04089f110dfbe1b258e9b9a83bf95fb0a4a24ca6acae78e1c291f671fcdca77c7128d319f7a4b51bbc2ed4bab8aac95498fb6033f760602c1a8b1eac2150072501000000000905000000000000000725010000000007250100000000090400000eb03748000a2401000000020102052405"], 0x0) 1.35030317s ago: executing program 0 (id=1050): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x82) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x13, r0, 0x20) 1.295353215s ago: executing program 0 (id=1051): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0xfffffffc, @local, 0x9}, 0x1c) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1800, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x180862) r2 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x180862) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f0000000080)={r3, 0x0, {0x0, 0x0, 0x0, 0x6, 0x4000000000000ffd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e43ac61b7ad33", [0x2, 0x7]}}) io_setup(0x1, &(0x7f0000000200)=0x0) io_submit(r4, 0xdfb, &(0x7f0000000340)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x4, r1, &(0x7f00000001c0)='a', 0x1, 0x5}]) 1.193045013s ago: executing program 0 (id=1052): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) (async) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) (async) eventfd2(0x0, 0x80001) syz_open_dev$usbfs(&(0x7f0000000240), 0xffffffffffffffff, 0x101f03) (async) socket(0x10, 0x3, 0x0) (async) keyctl$KEYCTL_PKEY_QUERY(0x18, 0x0, 0x0, 0x0, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setownex(r1, 0xf, &(0x7f0000000140)) (async) fcntl$getownex(r1, 0x10, &(0x7f0000000080)) socket$vsock_stream(0x28, 0x5, 0x28) (async) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000080)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r2, @ANYBLOB="05"], 0x0) r3 = syz_open_dev$loop(&(0x7f0000000040), 0x6, 0x80000) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$sock_int(r4, 0x1, 0x47, 0x0, &(0x7f0000000680)) (async) socket$xdp(0x2c, 0x3, 0x0) (async) r5 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$sock_int(r5, 0x1, 0x50, &(0x7f0000000000)=0x5, 0x4) (async) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000080)={0x0, 0x2}) (async) ioctl$IOC_PR_REGISTER(r3, 0x401870c8, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfee, 0x0, 0x0, 0x68, 0xffffffffffffffc0, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x40000000000000, 0xe}, @flat=@binder={0x73622a85, 0x200, 0x2}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0x1d}}, &(0x7f0000000180)={0x0, 0x28, 0x40}}, 0x400}], 0x52, 0x0, &(0x7f0000000300)="6cc2517326f0182dfaea8b9b0efefe72ca2b3f10c526bb82d4a3786efb2df4fda2a1e2888f71a664cc5a261719fe4cead4d24dcc14edceace088490d882b563ef630b62d95fb3e1b01b472ec8da1d1df52fc"}) 690.993774ms ago: executing program 4 (id=1056): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = socket(0xa, 0x3, 0x87) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={@private1={0xfc, 0x1, '\x00', 0x1}, 0x18, r3}) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x8936, &(0x7f0000000000)) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x11, r5, 0x147a5000) r6 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r6, &(0x7f0000000680)=[{{&(0x7f00000000c0)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10, 0x0, 0x0, &(0x7f0000000580)=[@ip_retopts={{0x18, 0x0, 0x7, {[@rr={0x7, 0x3, 0x21}, @generic={0x7, 0x2}]}}}], 0x18}}], 0x1, 0x4044000) r7 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0xfffffffffffffffc) ioctl$KVM_SET_NESTED_STATE(r7, 0x4080aebf, &(0x7f0000001180)={{0x3, 0x0, 0x80, {0xeeee0000}}, "a47913346dd6456639c75e5614940752a08b19629def4377793940c909754c75c11fcb9d190af604731db97bbf7935b062ad19cda9731b551eab3c44632fabc2af2d73a2c4d3eb681e9204f19d7b828d4f021c444bb664363ec6d7c9ac97327f6c6e18a67b58a0ca3b4b7d60581db757aba14122c2874823816aac1d472dcb37c9bf92783893357e636387b9748556aa32e6ee244db6162e0c3b3841a88a8f8bc93438475bec6ca94ebfa5e27b97144601bb9919155bce9b86bb0c08617185c748b15503dbcd6b748a6d50145b2371dd54585e5733eec920781298d9cac02e81d47b89dc3dc844c287453afa7116e56ce3d134c5616b060856e31c5aaafac523f156dd0e4fc59b00544947126a4b642cb4e322a1ee45f692524ec27363d5a1a6045ef025c68377db970231a0b1a35381841503fd216c8aa8340ce66662d5e3aaecdddfb0379e60a8013e6d7a5f9fc0555a5684b410121218778b94fcdce908342238448c5f9fe1af220b18a9dd1df890607dbe4cbe048c67a5ae7811e6472d886d3b33ee86dba9b2311d6655be6f48bdff3f2eca2beb3f00637dc19b4ec3a11d5684fe89a901d1eb2a4209896b0ed182a693a23141f96ac13875275a674f2261cb6a22b964b4450796e761514d22eb87329d2025f7bb50964c9d26e032fca68a39ed337fbbb377a716a31fb29925b3ac4cc866fa69575893e837b58d8de9a95767e769f4bd8ff138881524f7855649042baa9fce771fd981bbd9ec031844d2243537f39fc668bc4904a065d50e1c80d2e4e4e761e0f3f80b48f24759fd73bccd9a389889cb394502cb7e8fbbb7f2d9cd71501fe36e8772f8e8910d0221971b65cf6e8bf18b56794ce0d5e2a990e43ba8bf3c9ae27ca2175be963d5211e2993baaf2b1bd857b508ff845e29378b1bf790358708dc61a130c85d6d61c9846a32f7ea73e2f29e16545e92676e5f16d050f11f73c84a400e380fb2020bb6209d8e3df1be391e89e1c4a60db5d680771ea6ce030c8de440add8c7724304a87f1859b546c51658b92c39b3fad4569b6589a7d97028118036d2e284e34fe5c73c28b07ce0850fc1e6d501a7538d1a3124a12faa1301017e508c2a78f3951d86690a1e92b580ad7a9be39464ee0ced48278921277d948e268e9088345c9c792f953c9e554d6ec0252924b67f5083ecb970e2df9f9fcefdf9f4d2429ce5e7d939b57d16cb244f5f6fa80988c74130a3774e85c3d048f10f7a3782e8cb9aa249457e318a4007b0616166f47eae5d1a0387c572aa17d0b3293d44e15d3c0c6bc58b0d6ec5e46d1437407ac24a3107cbe8c06845bf8d4e6e27f205b02ecbea27644b491f057329630027ea21be5a1bcbabe8d4182defbbb00bf8221548695485c7bcc7a5a6140936fa13c0ea6009e4d898c318c7d659f4748f4144f82d9c31bc6fa55e07a6fd5d6fb2bb8107be0dc6edd850d60eab560f83b651bb50963a1d7be881804703fb1535ba65339694c15f55e76aa95491512fd6a6a436eb7ae10115ec1f45ce145b14b0144ada05379fd87b4f125449e8eb1db468297d82b89eb7061179a2193a478708c3bb89e60acbb10ade5e90ff824175c31dd78f818b44a02e34bbbb21aaf9083b90d6e2f3cbed6bff785762ff046f25ee1141555effc7a0a47400fa813f4550683cf4768ae429bb9b267d7ee63c37348cf7a6c8edba32c314ce095784aa8efbda60b3497efd0fa1ccd1f53085c8c4b0c4467cca017ca7bdf0edc91267d3dc1ad78862ae2a15cdc87dbd52d8bf35db9b12125cb5f1b2be7745a11d2d4abfc0ccd7672e579956c0049f1c8676aff9c57126b9f2cab917700fd2a4f9ed654c9c1549a13f327ff6a4eff3fb60a027150607a21afb130b5d060464fe66830309d816452f5fd16f9f74b558b052a9eca8848426314a1dbd8a1befbd438b3a05c6c9712d764fff7f290b2cd137361bd2c44d4888871448b35ffe61ce904768ae9137c2223eb8ba23e679508d775b45dd48278d96621e666b27278ae42f0d94015452dee6143b660bdd504a8d5ee4e3da21df144e6131c7b926c91094d4dcfa95b2618694fba0af50b4fc63678c1c8f1a54f37f0b549735314998b2ea115027bac6cf751126ac7048afdac2c178b23bbd7fa3904414cd440c6721388e09cac19ea3a3f0d2528d1fff23b9895f050963ecd80e2ff4ca6cde866440e868eb65a57b232329714ea3138814323cbabb78121b54084d2042c3557ae94b2ab7b0c305473b1f3c01b6dbe6731441de9d27162e595cfe4ca6867358ff0cd03124fd0f5a4fea05f336e2b351dbca5008c80d1999e65cd64c287e31a096b946871453b87d1ecdd98303eebbaadc75bf5348393a9cfaffc10e69c774a43504e78f3dadbc2a5a395dd8a1e13c249e0b00a3d9f783577dec7107471091bd1faa94565c0600fe1e21a9e8d809eb17d185d7d3eff364dc7cd62725a36b8b223a95542b9723483e39135d2f10e1378b011fb5972a4274502b2aebbd86537b0a6f0f507f36c272347b02cf0bcc398b57283522bd5f0b88b1fed5d82fe8791b7ad932e6ce57685d8e0e7bd3e890a713eadc95060cba5d1beb6d40d3e76fed18a5902fd2232984cddfe5f86fdfd683f0ee6a48b2c9e70989833a22d6314f5e6ccc98328b877fbb5461ed1a29d5b4d4de0caebf10704dab73be53145b2bad28ac6d694cda23acc1fb7fe682711fee67b0b1973aa93a8374f4e09325d57c9eff01c707e27a2452afbc3da5d216063dc999e443aab9403f8f56a9d2debd8409ecfef9aeb9fabde66432891d465e9e7d960f10e72bd6668e9222d3c26c6a3170ec529f77d0e6a664375c136eb4994a645c26ae08b4e5e2a2f369268761a1f4912f47a2b228a99ac738d775a57e08d2d1c2ba87e8bf5adddd1ba64d565b161d6dfd00447ef245b7923b061d645f5b6c2b89286b2fd6954d5a74f778e301fbde3d28dc45347447f11e0a84d6b13cb5e50d1c5e61556af2949bdbbf8a5e8888b3f3a4c7fc558c8040d2b2ca2727dd13a984dd7d6bef52bbea8d891f4139fb4a1d9f20b36571efa8795bb350efe2773ecd7a513c35819b8894de25d416d3eed09262b2bd2b9ae26460eb467a3b1bb262d63379e575db49c1184b68dd169aa41fbc8db12198f013dbde3d4eeaa694d8d2f466bc3ed9c4ffc2c2cb00fe18e5f393861cae36a5c92eb2ebba471041a19cf06e202b972e1436242fdf9ed356132fc30212d9005bb3f04323905f1dc35fe43943d5ce53e5aeb3cc82914a8f546216854fe26380d9317d16b6e4de19c46fff43ee275815d2ca55c635aaf71782f48b85ffd8b7ab630183012d70a3b2318c40300bc075b3dd64ea0c7233925ab0009dfa3c398926cd71a5e929560e103b8c2e9454ec7efcf031784adf4b5a64c8fdff0dfc229f58579ed5211353ea172dbd0de4dac4b30b8ffb77fc62d7779fbe2fb55eadba92f6cc6454bfb118ab04b90f42cda61553a128734cab4c6974cab55ef2e4b2359f457ea767d140d4a0c9ca30c37ad3906cbdd05801832989b10d3ebbf004801c1329a7259e226f84c67fe59b571382eecd5fcee072693560ae27a36676198e6d22f29e118f5a76de9cdc7928293600ccabbd43066d3083b3e709f0a21d694230d4c8029fa870b2e7c3d3ad9bc0b502e6f173680408e3a44906b1dc30d930b3da79f78ca2b0fc2b6d060a85378dd6e95bff65b417e765a421dac93a932e34c23b081866060d84d3aa0a08ff2f086fccfef4100f8dcc82c744fc5b6696a24b0152ecc37ae2772fdc1a5178c828596c39854b0b872d34237c884b62fa2fb8ec2203a1f8400443681a6c5c4d51fbe49b6cc918f44b3757e85b8dd836634297f6c14add50f6b5f38c7eff349cf193719c688fb20b35d063525ecaf3e203c67ae01af343d12fbf007bdfdddaa0efb5f9bd7ed15848ab43ae33009458dd52d36be97634abf8fab045d3547cdae94356c94d4c085297cee8d3a7a6debbb2761e47e5c3b1ed44ae57e14b6ed29d8d9ec87411cfff6eae8c01616a3bb3e6dcb9a12e46d2b11d973d96b7f49dec59475279204751df71a80cc3c7dfdbca405c1db5fa90e8c25b5a19a45b0af6043f9d291fcd710a908eeec619d390161e395f6a16b458522f7fce428ca38267a55ec0ca65d990725a67be8ed0a9addad332d46c54ad5945f031af0c0a2f61941f3b7dee3b5fc4ac97b67f5d2a10b59cadc70d4deef621d4f6f0e665f121803e699e13c291d6ece24046cd826fffd3d8d963fd9af1a06ebf08e70aa90bf276a648e2209f10ab55a5cdfed3cca7bc6252567c99cfa514a77810c825adff025f4cac9811ec95a011fec9d6d36b475c923dc9468f47363b7b82eb4ed03f36b9147b47a886e239981a762f6fbd9cb0db0bd520e0db488eccf42ee32815d42b24d0ef0232cb7710b4b1349f11eb78b000ec544b13fdaec892afb573d110ba9b1e3dbe77a6ba8547ebfb5c94809f6186d4dfbddd0d2f3f468810a1de58918d6e8a8577daf2e7fa2bccb73e44a3e7d24b6f48cb6d573bf1a4968d6bec51f4613eccd41ae0deb80cfa2b97b44456e5c7f470d4826ee875101c6f21ffb4af1c866baee45fa7b5c73c565ec31fc806ff733174e8c53bc404aa65dcd83ecf04c1b0f99edbee29512c25f45edaf40b136e38dd2e6efff1abdc4f58fccd5847c63ed70f0fd6cfafa3cd95b44081719105135c04e85ded24e2fc54838c615cdc19cd885fd4da9171653722b9d2a40a35f683a1a28818de6f2aab4c5d1ab20eba009e7d9c2bbae8afc1d091414b4ac6872bd358825e256447df859ee2f92be6df980b9bbe8354682f3456547716dfb7070ba0f98d42c51c792a1dd9cd2dafad4ad82ff642d243b15b6babf7b458580f108de493efd9c5395eb6ab8829719e685bdbe07e8a3f0d3425b5a9b412ece76cdd945db7281ea89e5b3dfc6e078b1359109f6f8922fe66d8c10c1294dd8e7ab18ea2753659fbc502990620def1aeb1f29f96488b17b4db8e23fc8f6a84f64f32a58e929159a779ae20febe80d34da3cb26ba2079683fc38d3a6e9a18af1da8640ec62369e7c4ac8497bcf1bc8bd5157761776a057d8427c68b38a58d2b706ea2a3a99c3c8832acb3f56e0029c32792acf23fa08e93192e60c090cabbf7b2c0800c8dcd453aff7e1164499175a6e9c45b8eacd8d35be2aad1fd59cb1a3ff4f8f4bcb30352f750c01eaebe7c8c8ff298ca05d84ad6b2a1be0cc5ff0c5772e7a3de1c0875e0d24ea7639237b33ac3a9863b3725610fb7bfc8c86b292dbc3cdaa63e7a4654907e7694584823637247c1a15a3eed4ff9d666dd204416c3435902e7a8daaf00f65e02bc44e6f04b581ced30580a202fe4c0df739ff480014baaa9ecf596866994fb608048e55eed340011613c8499f0d15e2ec1598dd90ab8ab6a01e7210b8114e93cc13276af7fb787d11d5c142b4d8f17cb24533a5ff8471b4ef5dd7d61eb9c796549628b90e20b6a04ae3ea6645a96db6320d5042194f4879e1c9dc061777ebd0118200c9de022b7c50b08464b64dc5510cf2db532de45b6275a5560a208ddbcb8cfceb4faad4fa6a151d40e893c6326d2e23183e6e1355f33fdcdc18879ed5fca802d37704c697225f55ddfbb86110b8d36572462c8f5850e6f0d670b7ee36edd2410a7f0c810b668c085d685e21214d3dec38d9e77db892779a865dfe6dc3c9b82574a62ef907008af32800aa643c8a1b317af91e800b175fc40e6eeb31ebe8618d155a0082abd491248d17605f3d30894a5fe8f13ff20e77e", "5119f006cc1c9789471143bfc412869195a4135015833e88435c450283abff8962a68bddcebe5a5b3deaf6cc419474c6ed035054f36d5e1bfa6601ba3654cd38f5b43d541241d4c2a267412a694258e0dadfbd808f538ea6b58f3f602a19cf6ab44ca1029566eaa7ef6a1bcb9ebccccaa78562e37f5b075a87d9bf1543f47eaac5c496d385d7a0830fa45cf1dfef0d61170d078d2b41bd012c441c32a502ebad01c0118a9e9ba1b5d86ede4969fdb940dfd9c518af2269730b0804ae5c7c39d9d8da63d4f18d82092b06ce21f27e81b0b5997efaa8485757b9617714e7cc3af6ea79917004454e63ccaca937b0346647fe6bde864e83fb835c450563878c8e2507846a6761dcc961025bc0c142bd2c20db277fcd2711325bcca1142b689fc18687f3a6cf95fb748ae1604a765b8dcb2f6e2285fe7cc23f5ba7e893e2c1d71bde5ae963d09dd8cc4c4ffa7863f6bbedbd0954e2feae9f1bde7b4ed142118b4ddaf5c41c7fb206020d5d3d615cbd3e451cfacc18c655d0c5e3ee0ab910a91c1db86720ebab460bebea65f2dd6e54e958d940a028b7a98af934789642798fa05185e0d40e20ad38df9d23e409273bec4e508a57d1e0b854ce7ffb8e95399fc9a0c21d9b9295e7641c17c2b1a955836b06763dffac45067573633e8a3acbefb307fa9d1464ff28e0b8a3c12b866d72c788c008f606c8c729a8175952ba18451740e52a6c480397f574c49312adc6e95d1270381b57492bef7b403d8b83396aa89c13fd17c30224727322eb3daac35de9a968c950955ae7458d5d8a92d547b7417c7f4e2ca99ed0d26247866431a52b924e20d22ef1f8769b68e04b70e2f6a1c79d3fd6f95baf1b462863f0bf0d9655971ce27e08153102f18e466aa340e408bcc7a7c385a9e684af2b02cde5d7fba51ee30bbbb775df19a527e55066ac14c221214e8d7df53af87d4c9c9bb9c1abbbe7812b659d549e733cde952d634433410a57029c2c596647a2fbbdea165a34f56b9447487f7e12f0eebea4f082c7ec490216cb3bd3d3311da6f983079b7c1abbfd151e07a5a29040e6e1e4e8dd5e2b705d748a801980a46468de8085379c2416ff5720bff085f82500697fcc97c10a432337eb4a9bef49d6adf9a6470bac75b8ec5852ac7c126c4a7bc92c836351919098df93e15bc09aa035a8590933ca867c1d887aea2cb3f721cc55bf8d8bc7b832b9b855a43c9653d43ffd6a3c0c3124b4cee7786755c682c04da1f50404ea7535161ea4d624d8aa2d777b70a6b4199b71d4eb36ca488326a9c30bd2ea61c899d3c0fd3df41e8813b8e5f176dfc9c9a3cfb0df2ba2707ca3da145cc8ea6dfcd23608c176ef811c07a4754a3cd28ec00271862751cfb5f2af370c86eac8a32704511323fb68332bc51ddbd82396cef11cd6a2dc576c648a7cbb17da711a4a140cba0c82f5f316c550c81f8405c9f2059918beadfee152fa39f932e8d90f1b713bedb6c175bb51856c5c42182b3175ed4476499974ebf7e0f6bf4a10383181d69c28c0e6f666117b3b4c031f8a570ad1c4581859e789e82388c3484c01abc44c0f9dbd03b3e7332f4aed9590e8d13b52b015442af071fc85c14250803af5bf469ccd51e1e5902b58ebf534708c32aec8485ede7fe8f46b7fbfefbad405027cfcd0dced53396273e654f80c0b91361c07f32b21e1cf6ce616ffaf20c63de6c2bf6b6a6cefb524fd1f97e902774c87f803516a53eb407f04b31ff833bcb5df1272c9be392eead6799c775f620f54cfa09fcc22341fdfb3de13446a44c0298a43e2b33df8f06ad5619e83f908b3762bdbf5d0f43b38e79347b5398da7b4b1680d2646a36fc14a2a3bb841dcf4f0d2f0695066a682fe0af43a63755a1ae709aef86237478c15d548be28fe9cb9cd18d3ae9c92993edfee9b09a2bb212de70768b6364121cda2da000a8c87f0a2c8d23947e8630ef5ddc2a36c2c554b56155d80924695d34c30758b60465c6f3cf7c745a234ff8825a38e61a297a266be61f3f0843f58e13d716143b5051ff59713dd39cc0278ee64683e66156a08204dcb991dfed439ade377850b023aeb3fac8a024918e7743952e4560beb80e0e58af87b50716e386888f7c26558afe09674a3626af9aee49eaa6ff8325a9f463b6a35fab59739728d1f7213fd3bf1cb2a5bbba0f254e6b2631c2393da5104789755d09ee327ae2cd9b6b22769af4f59afd7e38740291098cdcac090001deaef4e62deb976176da17aca7d673d20ff8150333e7ed79f1439d923e48139d23ae415772be862e8ba569f1b34d20561596adaa633b1f96d4f4effcecb842cfb4486bad97cd7eeaa82d61ad06a981428d88898638246d26dd7bcdf6dc11b6c6c5605a67f7429491c3e5dbf6f1c0a9fdcdee4a58649b9fdc14898713a25fb49663dc9674199bfa286dca035f1174f72965f589eb1369dd46fafea7ed7d4e88291c47d3bbfe780c190b5b4c51b37758163d7751455172a2919bacd16e870ec2ee4179e9a6a7aa6df66ca8ad2f2e4d26b19ae975247fc6b16bd8b64936eefdefa143ba0ebf198a262b2bf511e52d24891fae9ee7b0ea25796e6781880c5f6322c1cce478d6b8cc39ab3f3cfd1fbb497099c9449525db6ae5915e490d599a93045506469c6115cc8c1ba535231ca8db9e2d85634ecc8ed56c358b8af92d703c719ba9ae6128f589cbe1fb4f2bec119f6bfe53c207aaaac6c413e11295818da5fd3779d33a27f6c313e35a51f49f4420ad9956af3bf749748d7e5aed89b9e5eb7134197ff128d8db26f34036a6514142506d6ee2d6b3014d2078ae9ea9612b4bbbc9eecabafb30eb62f1b058237ae4d5f49c8ed33b933872c22f68f3dda68a9981819063e34754908af69719b0b8849b4a134040c36ae48b373e1deb8ef3a314be7d622cfe51ee0196aebf738480bf4fbe034ff7b4c76f3e2ba4a26f9a303a9dd3411dbcf78738af3c9051ee1a178875c8adbfc65bb31cef6bd4897917941f4e7f1a9e2d0b487576c46928771b047ada76c361c8fc582b14f1ca86cb66f555e680be751ed8abd67d07e7185916545fe6c7669144abef61698c5cfb781bd7e511913aad58a8359632284afe08cf4d680187fd2f9ee67e0fd43d1536f7e432d757cdc14797f6aeb5cf931923c4df4cf7063196dac72a6453e8720be820238319841204a5ca807e708027d8a6004bb00abc8e39527840e31f9e12407d7e4f0f9cabacca0ce93b22d5cd14961534fadf6724975f6fdacc47e2e47c9f702e3d63084931adefd6c4ecf6eea3a4f8114aa068aa3e1472fc0811bbbb58919d5750f1cf3768ca5b23b3b34f6b5726ffeec15db782a410b86f024909eb30c84d235c91265b641a17a97d035d8ad5d87d269835e146001a0403517b0f36e29d1f71be09f26a8bba8d607805d241401dcf98a09419eef63f4d5ccfc2d14fdb7f78a05565c772b8845b1a2b54bbab04cb99e897d72165bb5a7f327e83907bc38683fb5259e07c569e43cc000c4a9bffe24a6a049d1e758543349664858421f52ea41cf24f7968a1eb454be01fee1fda7d4b140c3522758265d6ad752b35449418fb3b81d96607e4081c9c9047a633817c92621d83303a44f37938d074a7633b7f739eeee0bae868b0cf6103a52309e7bcc6168f7eb568a69080c689c62a27575243a17265fc24742cef2de748fd2ebd18e9b0d245d7c3c3e7ad86b6ec26019ab02add854be749043484abb666e984d1d7e20ddbe12c606ea45aeb04618e94b8f3b40c1a4b4a9fc3723702653f8ca5d5920094026d49a07ddbb23237e7440de5e28d69d8eb21fd2003ec44e408620de02d5d82b7edeb8010685aa6cd3834277f9e34a18cb725a08049878a7af40a64d4fc0daf0fdd34573fb85740242b113c5676ada15f6a739f240a521d423b029c091d77ba61423630df332fe12b51896a7cc5f566fbf156b3a02fbe8ee30b6d6d8f9211ba88f9daee051397030aa01be348c8648694f4eafe0b8c9b6fe796344a7c6f4452ebe5f6ec7f3387f9c5578d9505cfecf9a9a8f2c77d5c6b01350a56520ffd528f518d227a5dc6953010f6d70f7f2a8738c06ee1749dc0d0e8b99ca94aa7afe525acec708e98641f40e3995b562451f61f60d42a6e0e5e7b1fc80b403249a114febc82e588b4466e4f1420fae53762f96195d1a4b27ac8ff65e577429b34e5d14eb7906dd61de872fe9dedf3a2d62d50ba13ee394f9a3811c7aa2ab319fffcb4dce76e0d25ba945ce9058a2aecf1e46dbbb8f247b011cd28df56066c615a261f4e35794969de715721d0138ade0b71bdcd2028c4eec53a4d5b45e6fc9e2606ae9d3e1d67121e2f623d02738720e4138d74146966217c48efa70f453c1bc583227923b36a70413022fff56bb83969107c36a2555e98d7c47f7819a377681250d3f93edc1e853d43f9e03c7a4efa7b0b38e468b79516727a533577b73a688c119ca4bbf09926680709a16d50ffe4ba2b4ed40657c4e93f67c512e606a33312fa78859e164cc0fe9f2504e5f232a7848d529764a8a759b593744588014fa7fe2123cba76da568aa184fb6521b88dd5b5fb3669a9ee9721a929429557762c57ac82b2c9b404ea7e3e513162938cf6c0db3f8df18320dc0a7e196c2188220008f0288702902a2b58bc3ff60b69a045253d78ff8396766797dcab63b2a32217b0b690475ab1bb8d5572fd11a838a0e6c2c6ab82b5463bde76ba5a9dd211ce86c2ce1b28d5148b0a5e9d39903c220719282632481e397428e7a934d653af7f7b146d0daed88e8962ddc07a5aac9931de43e07b7cfea959fcea4fbd2eceb99d7de8c8cb5c1de33a59a3a198d6dd593aa7320e0a83199a6fe94b2f376f147919b7c53fe7e2ab9fd44442cc7519a7a73abb8f2ffe4222e90edba1d69a06a1f3c5442a4e71cb424972305204ac3854c5f10cec28559f42a98d233397af109430b56308d308560531b2d71e629e377c2a0dd972770d79c00b5ae5cf66f04eb21796b191d12a2b5620dbac2070630aae30377577378641e41cdb51d8e8b29d4e80935394835263798973d7461f0b944292de4f7985c131853e46b431d68e78b454693fe58e147af995199787bc88eaf675bf9da409aad7b8f9908d26302a2ef0a3e91cbc8a1b169fb2d0120ffc1c51d88b5d6033304ae0b164dd76b582952fb81b62143faec94f5ed41a7adfe0728e55072cabbe21a00ca2b445521e319b08cb311af6ff65369cbe4f4173fc4e5f37c6cffdb048cc035208008961c089c3f6b3de1ebbe09d6e922fe4d161b0e1749dcd45e26cf4dddcb756bb9ad958f83804b4c76c7ace06f2a15e4b3cf3a3a432c5e5a42f0005bdc148bb827f46cd9bb4cd98e65d3e081a00675a24d86acfc1b73eaed6410ff966fba176e196760657b4bb8bc32bb658897441b7be7365f35ce317bf070e690990b9bb0d672194816f61a0ebb9bf35fbfc388be58a28c5f38208f10c414a2a1a251b05fd1a712315a028aa731876c88ecc90ad67e224e8496527359891e90e5a34899ead151a67eebb60cff5faa20e16c377a4916cf233e8b3943d67580124daeb317f9599b391353a7e459f248dee7ada4975212ebea4ef57c2d82bd34b421d32ad54d53378281d3024b2e7464b121d557bdce1916366213be46f90e4bd619b5c1a6d3b88e0bbb06d0f43566ac3cb35c039fa9b91153e7bf0ce165dee6e9e88d8890b3bce348723db13463fff5bf440ed9f6ce78fc6c11243b45c74d2a1ed6e065c225069ff7a4069c85832741a6b5d6b323debe811e87b"}) 662.705006ms ago: executing program 4 (id=1057): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100b, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x1100, 0x0, 0x30}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 623.85364ms ago: executing program 4 (id=1058): socket$packet(0x11, 0x2, 0x300) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r2, &(0x7f00000002c0)=ANY=[@ANYBLOB="080086dd0001110004000000a60c6eec00be00442ffffe8000000000000000000000000000aaff020000000000000000000000030001"], 0x7a) 529.804187ms ago: executing program 4 (id=1059): r0 = socket(0x10, 0x80002, 0x0) sendmsg(r0, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000040)="24000000180003041dfffd946f6105000a0100000005fe060c10880008000f00fff3c00e1400", 0x26}], 0x1}, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) socket(0x10, 0x80002, 0x0) (async) sendmsg(r0, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000040)="24000000180003041dfffd946f6105000a0100000005fe060c10880008000f00fff3c00e1400", 0x26}], 0x1}, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) (async) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) (async) close_range(r1, 0xffffffffffffffff, 0x0) (async) 474.896372ms ago: executing program 4 (id=1060): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x82) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x13, r0, 0x406) 461.547633ms ago: executing program 4 (id=1061): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = syz_usb_connect(0x1, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="120100004f92b90857152077ebb7000000010902120001000000000904"], 0x0) syz_usb_connect$cdc_ecm(0x2, 0x78, &(0x7f00000008c0)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x66, 0x1, 0x1, 0x8, 0x0, 0x40, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x2, 0x6, 0x0, 0x4, {{0xa, 0x24, 0x6, 0x0, 0x0, "3bb666cbea"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x8, 0x0, 0x0, 0xf6}, [@mbim={0xc, 0x24, 0x1b, 0x7f, 0x8, 0x5, 0x50, 0x1, 0x7}, @country_functional={0x8, 0x24, 0x7, 0x20, 0x5, [0x8]}, @country_functional={0xa, 0x24, 0x7, 0x20, 0x2, [0x1, 0x8]}, @country_functional={0x8, 0x24, 0x7, 0x6, 0x5, [0x100]}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200, 0x8, 0x8, 0x6}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x9, 0x1, 0x5}}}}}]}}]}}, &(0x7f0000000bc0)={0xa, &(0x7f0000000940)={0xa, 0x6, 0x200, 0x8, 0x2, 0xe, 0x40, 0x9}, 0xfa, &(0x7f0000000980)=ANY=[@ANYBLOB="050ffa0005d3100bfb094aa01b2c974cc3523454ed210e934483c467657ccafa94fa0799c77fa47e334bc89dcfb09ad77a78bd4ba5e6fef1f63896f94122463d3c95c254a37c113140929a4f480c8f4643b5c1594cb7b9896129d253997875c0b301465ac72527f307b7c3b73c9cc13ac4ddcf353be51542176d8c59da4238c7b7cfe3a86ce0a981110f47d0c34d5dd8cbe51231402d3e6593eb5c9a8e575bda33bf3da8425a19e4113cf1640b21448148989bc90800e1895d1846dcd3340d2b31491a91c0aa65cb828a9f4cf5d5f54121ddbf1aa558fcaeacf006d6776086eb0a10030004008107cc080710020059c341071002082e05000a10"], 0x4, [{0x5d, &(0x7f0000000a80)=@string={0x5d, 0x3, "14e5d13e6a50b86722f391d802c5d8fce1f0fe855b00c46d15c8ffd959d8dbbc5c245e0ae5453522d057b2fbe6234cb1d07e9446ce80d6003107498ad3c2324ca9949d31ca5b67e5b9c3d04ba122844ccea2c36678e50e55140ae2"}}, {0x17, &(0x7f0000000b00)=@string={0x17, 0x3, "e265b57690228f6956b9d4a13a1a5be0133842cfef"}}, {0x4, &(0x7f0000000b40)=@lang_id={0x4, 0x3, 0x807}}, {0x4, &(0x7f0000000b80)=@lang_id={0x4, 0x3, 0x441}}]}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x40, 0x13, 0x6, @remote}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000240)={0x1c, &(0x7f0000000180)=ANY=[@ANYBLOB="00040300000020"], 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000140)={0x2c, &(0x7f0000000400)={0x0, 0x2, 0x2, {0x2, 0x2}}, 0x0, 0x0, 0x0, &(0x7f0000000080)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x8, 0x1, 0x30, 0x0, 0x7, 0x5}}}, 0x0) syz_usb_control_io$uac1(r0, &(0x7f00000004c0)={0x14, &(0x7f00000003c0)={0x40, 0x6, 0xa7, {0xa7, 0x3, "d4f23535a97d8da4fc5c798d7c0394e6f0f3ff9c3cc380b868c4217c65163c57bc73cc8f30d6bfc7c0fd6f1dc0bd66c2d09d78112ed6643e82ba2d1d9a4334a180654a045415e206844c0f1a4998425d014edee58bd2d700ea5de3b8e029c1dd5b1749e9e78dd426f4dcd1bc3417059ec34c68e1463e445ae552d48ae7e09155cdd42c3c412740301a5948fef789db6a1630ca3e09cfb784b62e3f35abb36b222d53f46ce2"}}, &(0x7f0000000480)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x40a}}}, &(0x7f00000007c0)={0x44, &(0x7f0000000500)={0x0, 0x0, 0xd9, "d8c0b5c293e72719ab3d1036f334a3ba4645ac679edab980da632303136cf75651fc146728dfb4f28f553b3946552bc1d7d11c3bd8db23d1734a17bc29e15d509e30209292ca464ecb8831cfbf405f6fc18799af84230daa84f7f9f16ea05efbd9d3999f7f783dc97141ed370d2348708a59ff9a2f6183d8f846d90dc32978b7dbbfed80bbcd8e69e5f75632a3004d4ca1856154aead99df5ae655706c57244b08cfc9da47ffcacd7446a7ca861dc426a238179bf49b199e5dca7a8bffb7a9f14d2e6ffae67198e31faeb6c6d16f15679854217bb7c693c274"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000680)={0x20, 0x81, 0x2, "36eb"}, &(0x7f00000006c0)={0x20, 0x82, 0x3, "5237ee"}, &(0x7f0000000700)={0x20, 0x83, 0x3, "df3dd0"}, &(0x7f0000000740)={0x20, 0x84, 0x4, "a67fc72c"}, &(0x7f0000000780)={0x20, 0x85, 0x3, "ad62c7"}}) 299.483106ms ago: executing program 2 (id=1062): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0xfffffffc, @local, 0x9}, 0x1c) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1800, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x180862) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000080)={r2, 0x0, {0x0, 0x0, 0x0, 0x6, 0x4000000000000ffd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e43ac61b7ad33", [0x2, 0x7]}}) io_setup(0x1, &(0x7f0000000200)=0x0) io_submit(r3, 0xdfb, &(0x7f0000000340)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x4, 0xffffffffffffffff, &(0x7f00000001c0)='a', 0x1, 0x5}]) 15.761009ms ago: executing program 0 (id=1063): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x82) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x13, r0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x80140, 0x0) fcntl$setlease(r1, 0x400, 0x1) close_range(r1, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r2, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f00000003c0)={0x14c, r3, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_DEBUG_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_DEBUG_MSGMASK={0x120, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10c, 0x3, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'syz_tun\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'ethtool\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'bridge0\x00'}]}, {0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1400000}, @ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, '\xbb\xbb\xbb\xbb\xbb\xbb'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2000}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, '&!}\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'syz_tun\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}]}, {0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x10}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8e77}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'ethtool\x00'}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x81}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'syz_tun\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xc}]}, {0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'bridge0\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xe}]}]}, @ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xe}]}]}]}]}, 0x14c}}, 0x0) 0s ago: executing program 0 (id=1064): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x82) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x13, r0, 0x0) (fail_nth: 7) kernel console output (not intermixed with test programs): sadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 94.667266][ T1700] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 96.138664][ T36] audit: type=1400 audit(1754896491.563:567): avc: denied { mount } for pid=1718 comm="syz.3.503" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 96.435157][ T1729] FAULT_INJECTION: forcing a failure. [ 96.435157][ T1729] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 96.448490][ T1729] CPU: 0 UID: 0 PID: 1729 Comm: syz.3.507 Not tainted 6.12.38-syzkaller-gc46482c03ae9 #0 80b02ff89b1607ee1d115e0157270f38c0251e02 [ 96.448528][ T1729] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 96.448546][ T1729] Call Trace: [ 96.448552][ T1729] [ 96.448559][ T1729] __dump_stack+0x21/0x30 [ 96.448589][ T1729] dump_stack_lvl+0x10c/0x190 [ 96.448609][ T1729] ? __cfi_dump_stack_lvl+0x10/0x10 [ 96.448631][ T1729] ? kasan_save_track+0x4f/0x80 [ 96.448645][ T1729] ? kasan_save_alloc_info+0x40/0x50 [ 96.448666][ T1729] dump_stack+0x19/0x20 [ 96.448689][ T1729] should_fail_ex+0x3d9/0x530 [ 96.448713][ T1729] should_fail_alloc_page+0xeb/0x110 [ 96.448729][ T1729] __alloc_pages_noprof+0x19b/0x7b0 [ 96.448749][ T1729] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 96.448773][ T1729] alloc_pages_bulk_noprof+0x3cb/0x880 [ 96.448796][ T1729] ? kasan_save_alloc_info+0x40/0x50 [ 96.448817][ T1729] ? __kasan_kmalloc+0x96/0xb0 [ 96.448834][ T1729] copy_splice_read+0x1ac/0xaf0 [ 96.448852][ T1729] ? __cfi_iter_file_splice_write+0x10/0x10 [ 96.448880][ T1729] ? __cfi_copy_splice_read+0x10/0x10 [ 96.448900][ T1729] ? direct_splice_actor+0x37d/0x4b0 [ 96.448918][ T1729] ? __cfi_copy_splice_read+0x10/0x10 [ 96.448935][ T1729] splice_direct_to_actor+0x404/0xbc0 [ 96.448959][ T1729] ? __cfi_direct_splice_actor+0x10/0x10 [ 96.448977][ T1729] ? __cfi_splice_direct_to_actor+0x10/0x10 [ 96.448996][ T1729] do_splice_direct+0x182/0x270 [ 96.449014][ T1729] ? __cfi_do_splice_direct+0x10/0x10 [ 96.449031][ T1729] ? __cfi_direct_file_splice_eof+0x10/0x10 [ 96.449051][ T1729] ? security_file_permission+0x2e/0xc0 [ 96.449068][ T1729] ? rw_verify_area+0xac/0x230 [ 96.449090][ T1729] do_sendfile+0x5c8/0xfb0 [ 96.449113][ T1729] ? vfs_writev+0xcf0/0xcf0 [ 96.449137][ T1729] ? __kasan_check_write+0x18/0x20 [ 96.449160][ T1729] ? ksys_write+0x1ef/0x250 [ 96.449173][ T1729] __x64_sys_sendfile64+0x193/0x1f0 [ 96.449191][ T1729] ? __cfi___x64_sys_sendfile64+0x10/0x10 [ 96.449208][ T1729] ? __kasan_check_read+0x15/0x20 [ 96.449234][ T1729] x64_sys_call+0xa26/0x2ee0 [ 96.449257][ T1729] do_syscall_64+0x58/0xf0 [ 96.449274][ T1729] ? clear_bhb_loop+0x50/0xa0 [ 96.449301][ T1729] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 96.449324][ T1729] RIP: 0033:0x7f2d9758ebe9 [ 96.449337][ T1729] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 96.449351][ T1729] RSP: 002b:00007f2d9835c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 96.449371][ T1729] RAX: ffffffffffffffda RBX: 00007f2d977b5fa0 RCX: 00007f2d9758ebe9 [ 96.449383][ T1729] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004 [ 96.449392][ T1729] RBP: 00007f2d9835c090 R08: 0000000000000000 R09: 0000000000000000 [ 96.449402][ T1729] R10: 0000000080000000 R11: 0000000000000246 R12: 0000000000000002 [ 96.449412][ T1729] R13: 00007f2d977b6038 R14: 00007f2d977b5fa0 R15: 00007ffc0e6a9178 [ 96.449426][ T1729] [ 96.773631][ T36] audit: type=1400 audit(1754896492.203:568): avc: denied { map } for pid=1733 comm="syz.3.509" path="socket:[20829]" dev="sockfs" ino=20829 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 96.798731][ T36] audit: type=1400 audit(1754896492.223:569): avc: denied { execute_no_trans } for pid=1733 comm="syz.3.509" path="/159/file0" dev="tmpfs" ino=864 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 96.839618][ T36] audit: type=1400 audit(1754896492.263:570): avc: denied { write } for pid=1735 comm="syz.3.510" name="/" dev="incremental-fs" ino=870 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 96.862381][ T36] audit: type=1400 audit(1754896492.263:571): avc: denied { add_name } for pid=1735 comm="syz.3.510" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 96.882980][ T36] audit: type=1400 audit(1754896492.263:572): avc: denied { create } for pid=1735 comm="syz.3.510" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 96.903004][ T36] audit: type=1400 audit(1754896492.263:573): avc: denied { associate } for pid=1735 comm="syz.3.510" name="file1" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 97.146463][ T370] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 97.157016][ T370] asix 3-1:0.0: probe with driver asix failed with error -71 [ 97.165807][ T370] usb 3-1: USB disconnect, device number 16 [ 97.341286][ T36] audit: type=1400 audit(1754896492.773:574): avc: denied { getopt } for pid=1738 comm="syz.1.511" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 97.341503][ T1739] 9pnet_fd: Insufficient options for proto=fd [ 97.603091][ T1754] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 97.612362][ T1754] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 97.792802][ T1770] tipc: Enabling of bearer rejected, already enabled [ 97.815757][ T1774] __vm_enough_memory: pid: 1774, comm: syz.3.524, bytes: 18014402804453376 not enough memory for the allocation [ 98.080587][ T45] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 98.080759][ T374] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 98.110593][ T370] usb 3-1: new low-speed USB device number 17 using dummy_hcd [ 98.230575][ T45] usb 4-1: Using ep0 maxpacket: 8 [ 98.236661][ T45] usb 4-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid wMaxPacketSize 0 [ 98.246537][ T45] usb 4-1: config 0 interface 0 has no altsetting 0 [ 98.253209][ T45] usb 4-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 98.253376][ T374] usb 1-1: New USB device found, idVendor=0b95, idProduct=772b, bcdDevice=a2.4c [ 98.262356][ T45] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.271942][ T374] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.287666][ T374] usb 1-1: Product: syz [ 98.287941][ T45] usb 4-1: config 0 descriptor?? [ 98.294653][ T370] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 98.307585][ T374] usb 1-1: Manufacturer: syz [ 98.312288][ T374] usb 1-1: SerialNumber: syz [ 98.316973][ T370] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.326866][ T374] usb 1-1: config 0 descriptor?? [ 98.333103][ T370] usb 3-1: config 0 descriptor?? [ 98.540250][ T1783] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 98.549383][ T1783] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 98.574610][ T45] usbhid 4-1:0.0: can't add hid device: -71 [ 98.580689][ T45] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 98.589768][ T45] usb 4-1: USB disconnect, device number 20 [ 98.733549][ T374] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 98.743730][ T374] asix 1-1:0.0: probe with driver asix failed with error -71 [ 98.752890][ T374] usb 1-1: USB disconnect, device number 24 [ 99.204297][ T1794] kvm: kvm [1793]: vcpu1, guest rIP: 0xfff0 Unhandled WRMSR(0x40000004) = 0x0 [ 99.633293][ T1818] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 112, limit: 136, size: 97) [ 99.633318][ T1818] rust_binder: Error while translating object. [ 99.643864][ T1818] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 99.650085][ T1818] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:328 [ 99.850573][ T374] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 100.010575][ T374] usb 4-1: Using ep0 maxpacket: 8 [ 100.016692][ T374] usb 4-1: config 0 has an invalid descriptor of length 225, skipping remainder of the config [ 100.027119][ T374] usb 4-1: config 0 interface 0 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 100.040087][ T374] usb 4-1: config 0 interface 0 has no altsetting 0 [ 100.046771][ T374] usb 4-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 100.056539][ T374] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.065294][ T374] usb 4-1: config 0 descriptor?? [ 100.071297][ T374] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 100.291772][ T36] kauditd_printk_skb: 6 callbacks suppressed [ 100.291790][ T36] audit: type=1400 audit(1754896495.723:581): avc: denied { read } for pid=95 comm="acpid" name="event3" dev="devtmpfs" ino=581 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 100.319834][ T36] audit: type=1400 audit(1754896495.723:582): avc: denied { open } for pid=95 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=581 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 100.342355][ T36] audit: type=1400 audit(1754896495.723:583): avc: denied { ioctl } for pid=95 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=581 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 100.571651][ T45] usb 4-1: USB disconnect, device number 21 [ 100.792009][ T370] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 100.796901][ T1832] FAULT_INJECTION: forcing a failure. [ 100.796901][ T1832] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 100.804347][ T370] asix 3-1:0.0: probe with driver asix failed with error -71 [ 100.815801][ T1832] CPU: 1 UID: 0 PID: 1832 Comm: syz.0.545 Not tainted 6.12.38-syzkaller-gc46482c03ae9 #0 80b02ff89b1607ee1d115e0157270f38c0251e02 [ 100.815840][ T1832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 100.815854][ T1832] Call Trace: [ 100.815862][ T1832] [ 100.815872][ T1832] __dump_stack+0x21/0x30 [ 100.815911][ T1832] dump_stack_lvl+0x10c/0x190 [ 100.815945][ T1832] ? __cfi_dump_stack_lvl+0x10/0x10 [ 100.815979][ T1832] ? vsnprintf+0x7b4/0x1aa0 [ 100.816006][ T1832] ? __asan_memcpy+0x5a/0x80 [ 100.816040][ T1832] dump_stack+0x19/0x20 [ 100.816072][ T1832] should_fail_ex+0x3d9/0x530 [ 100.816110][ T1832] should_fail+0xf/0x20 [ 100.816142][ T1832] should_fail_usercopy+0x1e/0x30 [ 100.816165][ T1832] _copy_from_user+0x22/0xb0 [ 100.816193][ T1832] kstrtouint_from_user+0xc2/0x150 [ 100.816229][ T1832] ? __cfi_kstrtouint_from_user+0x10/0x10 [ 100.816263][ T1832] ? selinux_file_permission+0x309/0xb30 [ 100.816303][ T1832] ? __cfi_selinux_file_permission+0x10/0x10 [ 100.816332][ T1832] proc_fail_nth_write+0x89/0x210 [ 100.816374][ T1832] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 100.816405][ T1832] ? do_splice_direct+0x199/0x270 [ 100.816436][ T1832] ? bpf_lsm_file_permission+0xd/0x20 [ 100.816469][ T1832] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 100.816502][ T1832] vfs_write+0x3c3/0xe80 [ 100.816539][ T1832] ? fput+0x1a5/0x240 [ 100.816567][ T1832] ? __cfi_vfs_write+0x10/0x10 [ 100.816603][ T1832] ? __kasan_check_write+0x18/0x20 [ 100.816640][ T1832] ? mutex_lock+0x92/0x1c0 [ 100.816673][ T1832] ? __cfi_mutex_lock+0x10/0x10 [ 100.816707][ T1832] ? __fget_files+0x2c5/0x340 [ 100.816737][ T1832] ksys_write+0x141/0x250 [ 100.816758][ T1832] ? xfd_validate_state+0x68/0x150 [ 100.816797][ T1832] ? __cfi_ksys_write+0x10/0x10 [ 100.816820][ T1832] ? __kasan_check_read+0x15/0x20 [ 100.816855][ T1832] __x64_sys_write+0x7f/0x90 [ 100.816878][ T1832] x64_sys_call+0x271c/0x2ee0 [ 100.816913][ T1832] do_syscall_64+0x58/0xf0 [ 100.816941][ T1832] ? clear_bhb_loop+0x50/0xa0 [ 100.816977][ T1832] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 100.817012][ T1832] RIP: 0033:0x7f3df658d69f [ 100.817033][ T1832] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 100.817056][ T1832] RSP: 002b:00007f3df742f030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 100.817083][ T1832] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3df658d69f [ 100.817102][ T1832] RDX: 0000000000000001 RSI: 00007f3df742f0a0 RDI: 0000000000000005 [ 100.817118][ T1832] RBP: 00007f3df742f090 R08: 0000000000000000 R09: 0000000000000000 [ 100.817134][ T1832] R10: 0000000080000000 R11: 0000000000000293 R12: 0000000000000002 [ 100.817151][ T1832] R13: 00007f3df67b6038 R14: 00007f3df67b5fa0 R15: 00007ffc9b033bd8 [ 100.817173][ T1832] [ 101.100329][ T370] usb 3-1: USB disconnect, device number 17 [ 101.118677][ T1834] __vm_enough_memory: pid: 1834, comm: syz.0.546, bytes: 18014402804453376 not enough memory for the allocation [ 101.130674][ T36] audit: type=1400 audit(1754896496.553:584): avc: denied { mount } for pid=1835 comm="syz.3.547" name="/" dev="ramfs" ino=22417 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 101.157675][ T36] audit: type=1400 audit(1754896496.553:585): avc: denied { mounton } for pid=1835 comm="syz.3.547" path="/" dev="ramfs" ino=22417 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 101.189751][ T36] audit: type=1400 audit(1754896496.613:586): avc: denied { setopt } for pid=1837 comm="syz.3.548" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 101.209600][ T36] audit: type=1400 audit(1754896496.613:587): avc: denied { create } for pid=1837 comm="syz.3.548" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 101.425753][ T36] audit: type=1400 audit(1754896496.853:588): avc: denied { listen } for pid=1843 comm="syz.2.550" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 101.446101][ T36] audit: type=1400 audit(1754896496.873:589): avc: denied { accept } for pid=1843 comm="syz.2.550" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 101.497078][ T36] audit: type=1400 audit(1754896496.923:590): avc: denied { read } for pid=1843 comm="syz.2.550" name="msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 101.685815][ T1852] rust_binder: 291: no such ref 2 [ 101.772117][ C1] af_packet: tpacket_rcv: packet too big, clamped from 88 to 4294967272. macoff=96 [ 101.969427][ T508] rust_binder: 1860: removing orphan mapping 0:24 [ 101.977982][ T508] rust_binder: 0: removing orphan mapping 24:1120 [ 102.109160][ T1876] tipc: Enabling of bearer rejected, already enabled [ 102.174264][ T1882] kvm: kvm [1881]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0xc1) = 0x1 [ 102.182957][ T1882] kvm: kvm [1881]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0xc2) = 0x1 [ 102.184353][ T370] usb 2-1: new low-speed USB device number 15 using dummy_hcd [ 102.194449][ T1882] kvm: kvm [1881]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x11e) = 0xbe702112 [ 102.216829][ T1882] kvm: kvm [1881]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x186) = 0x1 [ 102.225668][ T1882] kvm: kvm [1881]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x187) = 0x1 [ 102.236189][ T1882] kvm_intel: kvm [1881]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x1d9) = 0x1 [ 102.342596][ T370] usb 2-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 102.353228][ T370] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.362475][ T370] usb 2-1: config 0 descriptor?? [ 102.458138][ T374] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 102.467919][ T12] Bluetooth: hci0: Frame reassembly failed (-84) [ 102.475241][ T1896] Bluetooth: hci0: Frame reassembly failed (-84) [ 102.482383][ T1896] Bluetooth: hci0: Frame reassembly failed (-84) [ 102.568996][ T1866] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 102.577600][ T1866] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 102.610552][ T374] usb 4-1: Using ep0 maxpacket: 8 [ 102.616632][ T374] usb 4-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid wMaxPacketSize 0 [ 102.626431][ T374] usb 4-1: config 0 interface 0 has no altsetting 0 [ 102.633075][ T374] usb 4-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 102.642271][ T374] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.651032][ T374] usb 4-1: config 0 descriptor?? [ 103.063419][ T374] usbhid 4-1:0.0: can't add hid device: -71 [ 103.069545][ T374] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 103.078414][ T374] usb 4-1: USB disconnect, device number 22 [ 103.704596][ T1906] rust_binder: Write failure EFAULT in pid:496 [ 104.100585][ T66] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 104.260573][ T66] usb 4-1: Using ep0 maxpacket: 32 [ 104.266840][ T66] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 104.277871][ T66] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 104.287685][ T66] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 104.300585][ T66] usb 4-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 104.309638][ T66] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.318436][ T66] usb 4-1: config 0 descriptor?? [ 104.326554][ T66] usbhid 4-1:0.0: can't add hid device: -22 [ 104.333402][ T66] usbhid 4-1:0.0: probe with driver usbhid failed with error -22 [ 104.480617][ T963] Bluetooth: hci0: command 0x1003 tx timeout [ 104.480640][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 104.683849][ T1917] kvm: pic: non byte read [ 104.689236][ T1917] kvm: pic: single mode not supported [ 104.689833][ T1917] kvm: pic: level sensitive irq not supported [ 104.695950][ T1917] kvm: pic: level sensitive irq not supported [ 104.702311][ T1917] kvm: pic: single mode not supported [ 104.708411][ T1917] kvm: pic: level sensitive irq not supported [ 104.714347][ T1917] kvm: pic: single mode not supported [ 104.720929][ T1917] kvm: pic: level sensitive irq not supported [ 104.726523][ T1917] kvm: pic: level sensitive irq not supported [ 104.733257][ T1917] kvm: pic: single mode not supported [ 104.739390][ T1917] kvm: pic: level sensitive irq not supported [ 104.745205][ T1917] kvm: pic: level sensitive irq not supported [ 104.751828][ T1917] kvm: pic: single mode not supported [ 104.758013][ T1917] kvm: pic: single mode not supported [ 104.763605][ T1917] kvm: pic: single mode not supported [ 104.769099][ T1917] kvm: pic: level sensitive irq not supported [ 104.774902][ T1917] kvm: pic: single mode not supported [ 104.781037][ T1917] kvm: pic: level sensitive irq not supported [ 104.786606][ T1917] kvm: pic: single mode not supported [ 104.792735][ T1917] kvm: pic: level sensitive irq not supported [ 104.798478][ T1917] kvm: pic: single mode not supported [ 104.804686][ T370] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 104.821145][ T370] asix 2-1:0.0: probe with driver asix failed with error -71 [ 104.829863][ T370] usb 2-1: USB disconnect, device number 15 [ 104.965664][ T1924] ======================================================= [ 104.965664][ T1924] WARNING: The mand mount option has been deprecated and [ 104.965664][ T1924] and is ignored by this kernel. Remove the mand [ 104.965664][ T1924] option from the mount to silence this warning. [ 104.965664][ T1924] ======================================================= [ 105.320592][ T370] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 105.339582][ T1936] netlink: 188 bytes leftover after parsing attributes in process `syz.1.585'. [ 105.340596][ T66] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 105.410638][ T46] bridge_slave_1: left allmulticast mode [ 105.416334][ T46] bridge_slave_1: left promiscuous mode [ 105.422064][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.429761][ T46] bridge_slave_0: left allmulticast mode [ 105.435763][ T46] bridge_slave_0: left promiscuous mode [ 105.441442][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.480586][ T370] usb 3-1: Using ep0 maxpacket: 16 [ 105.486948][ T370] usb 3-1: config 8 has an invalid interface number: 97 but max is 2 [ 105.499480][ T370] usb 3-1: config 8 contains an unexpected descriptor of type 0x1, skipping [ 105.508378][ T370] usb 3-1: config 8 has an invalid interface number: 140 but max is 2 [ 105.516811][ T370] usb 3-1: config 8 has an invalid interface number: 192 but max is 2 [ 105.520601][ T66] usb 1-1: Using ep0 maxpacket: 8 [ 105.525111][ T370] usb 3-1: config 8 has an invalid interface number: 227 but max is 2 [ 105.538383][ T370] usb 3-1: config 8 has 4 interfaces, different from the descriptor's value: 3 [ 105.548623][ T66] usb 1-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid wMaxPacketSize 0 [ 105.550126][ T370] usb 3-1: config 8 has no interface number 0 [ 105.564710][ T46] tipc: Disabling bearer [ 105.568892][ T66] usb 1-1: config 0 interface 0 has no altsetting 0 [ 105.570123][ T46] tipc: Left network mode [ 105.581242][ T370] usb 3-1: config 8 has no interface number 1 [ 105.586732][ T66] usb 1-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 105.587450][ T370] usb 3-1: config 8 has no interface number 2 [ 105.604087][ T66] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.604473][ T370] usb 3-1: config 8 has no interface number 3 [ 105.619149][ T46] veth1_macvtap: left promiscuous mode [ 105.624766][ T370] usb 3-1: config 8 interface 97 altsetting 127 endpoint 0x2 has an invalid bInterval 255, changing to 7 [ 105.624991][ T36] kauditd_printk_skb: 2 callbacks suppressed [ 105.625009][ T36] audit: type=1400 audit(1754896501.043:593): avc: denied { mounton } for pid=1940 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 105.636087][ T370] usb 3-1: config 8 interface 97 altsetting 127 endpoint 0xE has invalid maxpacket 1024, setting to 64 [ 105.642454][ T66] usb 1-1: config 0 descriptor?? [ 105.664248][ T46] veth0_vlan: left promiscuous mode [ 105.685064][ T370] usb 3-1: config 8 interface 97 altsetting 127 has a duplicate endpoint with address 0x2, skipping [ 105.696023][ T370] usb 3-1: config 8 interface 97 altsetting 127 has a duplicate endpoint with address 0xE, skipping [ 105.706967][ T370] usb 3-1: config 8 interface 97 altsetting 127 has an invalid descriptor for endpoint zero, skipping [ 105.732116][ T370] usb 3-1: config 8 interface 97 altsetting 127 has an invalid descriptor for endpoint zero, skipping [ 105.752052][ T370] usb 3-1: config 8 interface 97 altsetting 127 has an invalid descriptor for endpoint zero, skipping [ 105.763222][ T370] usb 3-1: config 8 interface 97 altsetting 127 has a duplicate endpoint with address 0x9, skipping [ 105.776416][ T370] usb 3-1: config 8 interface 97 altsetting 127 has a duplicate endpoint with address 0x9, skipping [ 105.800570][ T370] usb 3-1: config 8 interface 140 altsetting 7 endpoint 0xA has an invalid bInterval 128, changing to 7 [ 105.820566][ T370] usb 3-1: config 8 interface 140 altsetting 7 has an endpoint descriptor with address 0xDE, changing to 0x8E [ 105.848621][ T370] usb 3-1: config 8 interface 140 altsetting 7 has a duplicate endpoint with address 0x8E, skipping [ 105.859782][ T370] usb 3-1: config 8 interface 140 altsetting 7 has a duplicate endpoint with address 0xE, skipping [ 105.870782][ T370] usb 3-1: config 8 interface 140 altsetting 7 has a duplicate endpoint with address 0xF, skipping [ 105.882600][ T370] usb 3-1: config 8 interface 140 altsetting 7 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 105.895924][ T370] usb 3-1: too many endpoints for config 8 interface 192 altsetting 222: 64, using maximum allowed: 30 [ 105.907036][ T370] usb 3-1: config 8 interface 192 altsetting 222 has a duplicate endpoint with address 0x2, skipping [ 105.922573][ T370] usb 3-1: config 8 interface 192 altsetting 222 has a duplicate endpoint with address 0xA, skipping [ 105.933552][ T370] usb 3-1: config 8 interface 192 altsetting 222 has 2 endpoint descriptors, different from the interface descriptor's value: 64 [ 105.947210][ T370] usb 3-1: config 8 interface 227 altsetting 128 has a duplicate endpoint with address 0xF, skipping [ 105.947809][ T1940] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.958163][ T370] usb 3-1: config 8 interface 227 altsetting 128 has an invalid descriptor for endpoint zero, skipping [ 105.966148][ T1940] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.983333][ T370] usb 3-1: config 8 interface 227 altsetting 128 has an invalid descriptor for endpoint zero, skipping [ 105.983365][ T370] usb 3-1: config 8 interface 97 has no altsetting 0 [ 105.994590][ T1940] bridge_slave_0: entered allmulticast mode [ 106.001454][ T370] usb 3-1: config 8 interface 140 has no altsetting 0 [ 106.007990][ T1940] bridge_slave_0: entered promiscuous mode [ 106.014090][ T370] usb 3-1: config 8 interface 192 has no altsetting 0 [ 106.021023][ T1940] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.026856][ T370] usb 3-1: config 8 interface 227 has no altsetting 0 [ 106.034460][ T1940] bridge0: port 2(bridge_slave_1) entered disabled state [ 106.042161][ T370] usb 3-1: Dual-Role OTG device on HNP port [ 106.047749][ T1940] bridge_slave_1: entered allmulticast mode [ 106.057371][ T370] usb 3-1: New USB device found, idVendor=16d8, idProduct=7006, bcdDevice=1b.ad [ 106.060442][ T66] usbhid 1-1:0.0: can't add hid device: -71 [ 106.068561][ T370] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.074706][ T66] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 106.082646][ T370] usb 3-1: Product: syz [ 106.094416][ T370] usb 3-1: Manufacturer: syz [ 106.094944][ T1940] bridge_slave_1: entered promiscuous mode [ 106.099084][ T370] usb 3-1: SerialNumber: syz [ 106.112177][ T66] usb 1-1: USB disconnect, device number 25 [ 106.193020][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.200138][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.209819][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.216899][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.247348][ T1940] veth0_vlan: entered promiscuous mode [ 106.259569][ T1940] veth1_macvtap: entered promiscuous mode [ 106.281555][ T36] audit: type=1400 audit(1754896501.713:594): avc: denied { mounton } for pid=1940 comm="syz-executor" path="/root/syzkaller.fe3Jqg/syz-tmp" dev="sda1" ino=2043 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 106.307129][ T36] audit: type=1400 audit(1754896501.713:595): avc: denied { mounton } for pid=1940 comm="syz-executor" path="/root/syzkaller.fe3Jqg/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 106.334753][ T36] audit: type=1400 audit(1754896501.713:596): avc: denied { mounton } for pid=1940 comm="syz-executor" path="/root/syzkaller.fe3Jqg/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=24114 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 106.359274][ T370] usb 3-1: USB disconnect, device number 18 [ 106.363583][ T36] audit: type=1400 audit(1754896501.733:597): avc: denied { mounton } for pid=1940 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=434 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 106.398663][ T36] audit: type=1400 audit(1754896501.733:598): avc: denied { mounton } for pid=1940 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 106.424091][ T36] audit: type=1400 audit(1754896501.853:599): avc: denied { getopt } for pid=1950 comm="syz.4.588" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 106.836134][ T36] audit: type=1400 audit(1754896502.263:600): avc: denied { ioctl } for pid=1961 comm="syz.0.592" path="socket:[24148]" dev="sockfs" ino=24148 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 106.878141][ T508] usb 4-1: USB disconnect, device number 23 [ 106.902829][ T36] audit: type=1400 audit(1754896502.323:601): avc: denied { read } for pid=1966 comm="syz.0.594" name="usbmon7" dev="devtmpfs" ino=112 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 106.934302][ T36] audit: type=1400 audit(1754896502.323:602): avc: denied { open } for pid=1966 comm="syz.0.594" path="/dev/usbmon7" dev="devtmpfs" ino=112 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 107.072642][ T1979] netlink: 'syz.0.599': attribute type 1 has an invalid length. [ 107.190704][ T508] usb 4-1: new low-speed USB device number 24 using dummy_hcd [ 107.242964][ T1984] binder: Unknown parameter 'eclabel' [ 107.287557][ T1984] kvm: kvm [1983]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0xc1) = 0x1 [ 107.310772][ T1984] kvm: kvm [1983]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0xc2) = 0x1 [ 107.342711][ T1984] kvm: kvm [1983]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x11e) = 0xbe702112 [ 107.352946][ T508] usb 4-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 107.362372][ T508] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.372209][ T508] usb 4-1: config 0 descriptor?? [ 107.383445][ T1984] kvm: kvm [1983]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x186) = 0x1 [ 107.394864][ T1984] kvm: kvm [1983]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x187) = 0x1 [ 107.406835][ T1984] kvm_intel: kvm [1983]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x1d9) = 0x1 [ 107.589265][ T1967] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 107.605101][ T1987] netlink: 'syz.2.602': attribute type 28 has an invalid length. [ 107.605452][ T1967] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 107.693892][ T1994] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 107.693917][ T1994] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:326 [ 107.930580][ T788] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 107.950576][ T370] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 108.090595][ T788] usb 1-1: Using ep0 maxpacket: 8 [ 108.096679][ T788] usb 1-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid wMaxPacketSize 0 [ 108.106556][ T788] usb 1-1: config 0 interface 0 has no altsetting 0 [ 108.112047][ T370] usb 3-1: config 0 has an invalid interface number: 18 but max is 0 [ 108.113697][ T788] usb 1-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 108.121423][ T370] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 108.130773][ T788] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.140991][ T370] usb 3-1: config 0 has no interface number 0 [ 108.155049][ T370] usb 3-1: New USB device found, idVendor=050d, idProduct=011b, bcdDevice=6f.a4 [ 108.155367][ T788] usb 1-1: config 0 descriptor?? [ 108.168269][ T370] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.181690][ T370] usb 3-1: config 0 descriptor?? [ 108.187668][ T370] usb 3-1: bad CDC descriptors [ 108.402355][ T66] usb 3-1: USB disconnect, device number 19 [ 108.442377][ T788] usbhid 1-1:0.0: can't add hid device: -71 [ 108.448836][ T788] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 108.458420][ T788] usb 1-1: USB disconnect, device number 26 [ 108.961003][ T2003] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 108.961030][ T2003] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:400 [ 109.237631][ T2015] rust_binder: 2008 RLIMIT_NICE not set [ 109.541309][ T370] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 109.700598][ T370] usb 1-1: Using ep0 maxpacket: 32 [ 109.706967][ T370] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 109.715178][ T370] usb 1-1: config 0 has no interface number 0 [ 109.722746][ T370] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 109.731877][ T370] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.739978][ T370] usb 1-1: Product: syz [ 109.744283][ T370] usb 1-1: Manufacturer: syz [ 109.748917][ T370] usb 1-1: SerialNumber: syz [ 109.754329][ T370] usb 1-1: config 0 descriptor?? [ 109.760172][ T370] smsc95xx v2.0.0 [ 109.842016][ T508] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 109.852797][ T508] asix 4-1:0.0: probe with driver asix failed with error -71 [ 109.863320][ T508] usb 4-1: USB disconnect, device number 24 [ 110.111806][ T2029] netlink: 28 bytes leftover after parsing attributes in process `syz.2.618'. [ 110.164151][ T370] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 110.175086][ T370] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 110.420653][ T10] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 110.570558][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 110.576722][ T10] usb 3-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid wMaxPacketSize 0 [ 110.586608][ T10] usb 3-1: config 0 interface 0 has no altsetting 0 [ 110.593325][ T10] usb 3-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 110.602629][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 110.611878][ T10] usb 3-1: config 0 descriptor?? [ 110.820584][ T2032] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 110.829990][ T2032] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 110.840000][ T36] kauditd_printk_skb: 7 callbacks suppressed [ 110.840019][ T36] audit: type=1400 audit(1754896506.263:610): avc: denied { bind } for pid=2031 comm="syz.2.619" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 110.873151][ T36] audit: type=1400 audit(1754896506.263:611): avc: denied { name_bind } for pid=2031 comm="syz.2.619" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 110.905159][ T36] audit: type=1400 audit(1754896506.263:612): avc: denied { node_bind } for pid=2031 comm="syz.2.619" saddr=fe80::aa src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 110.931333][ T10] usbhid 3-1:0.0: can't add hid device: -71 [ 110.937478][ T10] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 110.949490][ T10] usb 3-1: USB disconnect, device number 20 [ 111.780579][ T10] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 111.931631][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 111.960561][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 111.970386][ T10] usb 3-1: New USB device found, idVendor=38de, idProduct=1142, bcdDevice= 0.00 [ 111.979530][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.988495][ T10] usb 3-1: config 0 descriptor?? [ 112.212856][ T10] usbhid 3-1:0.0: can't add hid device: -71 [ 112.229451][ T370] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 112.240352][ T10] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 112.249415][ T10] usb 3-1: USB disconnect, device number 21 [ 112.256381][ T370] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -71 [ 112.267502][ T370] usb 1-1: USB disconnect, device number 27 [ 112.290271][ T36] audit: type=1326 audit(1754896507.713:613): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2049 comm="syz.0.625" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3df658ebe9 code=0x0 [ 112.690602][ T10] usb 3-1: new full-speed USB device number 22 using dummy_hcd [ 112.841979][ T10] usb 3-1: not running at top speed; connect to a high speed hub [ 112.850746][ T10] usb 3-1: config 1 has an invalid interface number: 185 but max is 0 [ 112.858976][ T10] usb 3-1: config 1 has no interface number 0 [ 112.865312][ T10] usb 3-1: config 1 interface 185 altsetting 8 endpoint 0xA has invalid maxpacket 1023, setting to 64 [ 112.876373][ T10] usb 3-1: config 1 interface 185 has no altsetting 0 [ 112.885296][ T10] usb 3-1: New USB device found, idVendor=1f38, idProduct=0001, bcdDevice=9f.80 [ 112.894549][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.902656][ T10] usb 3-1: Product: syz [ 112.906860][ T10] usb 3-1: Manufacturer: syz [ 112.911498][ T10] usb 3-1: SerialNumber: syz [ 113.173841][ T36] audit: type=1400 audit(1754896508.603:614): avc: denied { write } for pid=2055 comm="syz.2.627" name="/" dev="configfs" ino=1324 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 113.197811][ T10] usb 3-1: unknown interface protocol 0x6c, assuming v1 [ 113.204892][ T10] usb 3-1: cannot find UAC_HEADER [ 113.212432][ T10] snd-usb-audio 3-1:1.185: probe with driver snd-usb-audio failed with error -22 [ 113.227734][ T10] usb 3-1: USB disconnect, device number 22 [ 113.237986][ T2048] udevd[2048]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.185/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 113.404396][ T2069] rust_binder: Write failure EFAULT in pid:424 [ 113.900582][ T10] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 113.940584][ T788] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 114.060580][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 114.066883][ T10] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 114.075180][ T10] usb 1-1: config 0 has no interface number 0 [ 114.081612][ T10] usb 1-1: config 0 interface 184 has no altsetting 0 [ 114.090104][ T10] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 114.099220][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.107268][ T10] usb 1-1: Product: syz [ 114.110574][ T788] usb 3-1: Using ep0 maxpacket: 8 [ 114.111458][ T10] usb 1-1: Manufacturer: syz [ 114.118084][ T788] usb 3-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid wMaxPacketSize 0 [ 114.121131][ T10] usb 1-1: SerialNumber: syz [ 114.131276][ T788] usb 3-1: config 0 interface 0 has no altsetting 0 [ 114.142368][ T788] usb 3-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 114.142668][ T10] usb 1-1: config 0 descriptor?? [ 114.151538][ T788] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.159889][ T10] smsc75xx v1.0.0 [ 114.168081][ T788] usb 3-1: config 0 descriptor?? [ 114.369942][ T36] audit: type=1400 audit(1754896509.793:615): avc: denied { setcheckreqprot } for pid=2085 comm="syz.3.639" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 114.453589][ T788] usbhid 3-1:0.0: can't add hid device: -71 [ 114.460143][ T788] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 114.469419][ T788] usb 3-1: USB disconnect, device number 23 [ 115.566974][ T10] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000040: -71 [ 115.578005][ T10] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Error writing E2P_CMD [ 115.587418][ T10] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 115.598302][ T10] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 115.607988][ T10] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 115.618408][ T10] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 115.627917][ T10] smsc75xx 1-1:0.184: probe with driver smsc75xx failed with error -71 [ 115.645801][ T10] usb 1-1: USB disconnect, device number 28 [ 115.681628][ T2107] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 115.690754][ T2107] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 115.910608][ T2115] GUP no longer grows the stack in syz.3.649 (2115): 200000005000-200000008000 (200000004000) [ 115.921175][ T2115] CPU: 0 UID: 0 PID: 2115 Comm: syz.3.649 Not tainted 6.12.38-syzkaller-gc46482c03ae9 #0 80b02ff89b1607ee1d115e0157270f38c0251e02 [ 115.921224][ T2115] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 115.921246][ T2115] Call Trace: [ 115.921256][ T2115] [ 115.921269][ T2115] __dump_stack+0x21/0x30 [ 115.921317][ T2115] dump_stack_lvl+0x10c/0x190 [ 115.921353][ T2115] ? __cfi_dump_stack_lvl+0x10/0x10 [ 115.921389][ T2115] ? futex_lock_pi_atomic+0xdd/0xc70 [ 115.921424][ T2115] dump_stack+0x19/0x20 [ 115.921464][ T2115] fixup_user_fault+0x63d/0x6d0 [ 115.921504][ T2115] fault_in_user_writeable+0x76/0xe0 [ 115.921537][ T2115] futex_lock_pi+0x258/0xa10 [ 115.921573][ T2115] ? futex_unqueue+0x136/0x160 [ 115.921607][ T2115] ? __cfi_futex_lock_pi+0x10/0x10 [ 115.921645][ T2115] ? __cfi_futex_wake_mark+0x10/0x10 [ 115.921692][ T2115] ? futex_setup_timer+0xb4/0xd0 [ 115.921760][ T2115] ? __cfi_futex_wake_mark+0x10/0x10 [ 115.921803][ T2115] ? mas_find+0x358/0x5f0 [ 115.921851][ T2115] ? __kasan_check_write+0x18/0x20 [ 115.921898][ T2115] do_futex+0x25c/0x500 [ 115.921931][ T2115] ? __cfi_do_futex+0x10/0x10 [ 115.921965][ T2115] __se_sys_futex+0x28f/0x300 [ 115.921998][ T2115] ? __x64_sys_futex+0x110/0x110 [ 115.922031][ T2115] ? __kasan_check_write+0x18/0x20 [ 115.922077][ T2115] __x64_sys_futex+0xe9/0x110 [ 115.922109][ T2115] x64_sys_call+0x227f/0x2ee0 [ 115.922156][ T2115] do_syscall_64+0x58/0xf0 [ 115.922190][ T2115] ? clear_bhb_loop+0x50/0xa0 [ 115.922238][ T2115] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 115.922283][ T2115] RIP: 0033:0x7f2d9758ebe9 [ 115.922308][ T2115] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 115.922337][ T2115] RSP: 002b:00007f2d9835c038 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 115.922372][ T2115] RAX: ffffffffffffffda RBX: 00007f2d977b5fa0 RCX: 00007f2d9758ebe9 [ 115.922398][ T2115] RDX: 00000000fffffffd RSI: 000000000000008d RDI: 0000200000004000 [ 115.922420][ T2115] RBP: 00007f2d97611e19 R08: 0000000000000000 R09: 0000000000000000 [ 115.922438][ T2115] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 115.922456][ T2115] R13: 00007f2d977b6038 R14: 00007f2d977b5fa0 R15: 00007ffc0e6a9178 [ 115.922480][ T2115] [ 116.333213][ T2119] netlink: 'syz.0.650': attribute type 64 has an invalid length. [ 116.350629][ T2119] netlink: 5 bytes leftover after parsing attributes in process `syz.0.650'. [ 116.372124][ T36] audit: type=1400 audit(1754896511.803:616): avc: denied { bind } for pid=2118 comm="syz.0.650" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 117.020667][ T370] usb 1-1: new low-speed USB device number 29 using dummy_hcd [ 117.037391][ T36] audit: type=1400 audit(1754896512.463:617): avc: denied { block_suspend } for pid=2137 comm="syz.3.657" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 117.171661][ T370] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 117.180802][ T370] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.189454][ T370] usb 1-1: config 0 descriptor?? [ 117.290595][ T788] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 117.398486][ T2130] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 117.407086][ T2130] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 117.441810][ T788] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 117.451725][ T788] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 117.464724][ T788] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 117.473919][ T788] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.482799][ T788] usb 4-1: config 0 descriptor?? [ 117.890936][ T788] kovaplus 0003:1E7D:2D50.0006: hidraw0: USB HID v0.00 Device [HID 1e7d:2d50] on usb-dummy_hcd.3-1/input0 [ 118.431251][ T2145] binder: Bad value for 'max' [ 118.690681][ T2138] capability: warning: `syz.3.657' uses 32-bit capabilities (legacy support in use) [ 118.703535][ T788] kovaplus 0003:1E7D:2D50.0006: couldn't init struct kovaplus_device [ 118.714959][ T788] kovaplus 0003:1E7D:2D50.0006: couldn't install mouse [ 118.724235][ T788] kovaplus 0003:1E7D:2D50.0006: probe with driver kovaplus failed with error -71 [ 118.738663][ T788] usb 4-1: USB disconnect, device number 25 [ 119.470562][ T10] usb 4-1: new full-speed USB device number 26 using dummy_hcd [ 119.621611][ T10] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 119.633271][ T370] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 119.643307][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 119.659294][ T370] asix 1-1:0.0: probe with driver asix failed with error -71 [ 119.666770][ T10] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 119.676538][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 119.684929][ T370] usb 1-1: USB disconnect, device number 29 [ 119.693189][ T10] usb 4-1: config 0 descriptor?? [ 119.698489][ T2169] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 119.706891][ T10] hub 4-1:0.0: USB hub found [ 119.916350][ T10] hub 4-1:0.0: config failed, can't read hub descriptor (err -22) [ 119.928310][ T10] usbhid 4-1:0.0: can't add hid device: -71 [ 119.934341][ T10] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 119.960870][ T10] usb 4-1: USB disconnect, device number 26 [ 120.114611][ T2177] netlink: 'syz.3.670': attribute type 1 has an invalid length. [ 120.123271][ T36] audit: type=1400 audit(1754896515.553:618): avc: denied { append } for pid=2176 comm="syz.3.670" name="file0" dev="tmpfs" ino=1085 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 120.218221][ T36] audit: type=1400 audit(1754896515.643:619): avc: denied { setattr } for pid=2187 comm="syz.3.675" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 120.300234][ T36] audit: type=1400 audit(1754896515.723:620): avc: denied { getopt } for pid=2192 comm="syz.0.676" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 120.319861][ T36] audit: type=1400 audit(1754896515.723:621): avc: denied { accept } for pid=2192 comm="syz.0.676" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 120.443391][ T2205] sock: sock_set_timeout: `syz.0.678' (pid 2205) tries to set negative timeout [ 120.670562][ T788] usb 4-1: new low-speed USB device number 27 using dummy_hcd [ 120.821668][ T788] usb 4-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 120.830865][ T788] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 120.839435][ T788] usb 4-1: config 0 descriptor?? [ 121.045686][ T2204] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 121.054299][ T2204] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 121.199977][ T2210] netlink: 'syz.0.683': attribute type 58 has an invalid length. [ 121.208884][ T2209] netlink: 'syz.0.683': attribute type 58 has an invalid length. [ 121.450570][ T10] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 121.601742][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 121.608481][ T10] usb 1-1: New USB device found, idVendor=0c12, idProduct=0005, bcdDevice= 0.00 [ 121.617738][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.626559][ T10] usb 1-1: config 0 descriptor?? [ 122.032627][ T2216] mmap: syz.2.685 (2216) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 122.045889][ T10] zeroplus 0003:0C12:0005.0007: unknown main item tag 0x0 [ 122.053366][ T10] zeroplus 0003:0C12:0005.0007: unknown main item tag 0x0 [ 122.060637][ T10] zeroplus 0003:0C12:0005.0007: unknown main item tag 0x0 [ 122.070887][ T10] zeroplus 0003:0C12:0005.0007: hidraw0: USB HID v1.01 Device [HID 0c12:0005] on usb-dummy_hcd.0-1/input0 [ 122.092538][ T10] zeroplus 0003:0C12:0005.0007: no inputs found [ 122.223294][ T2225] kvm: kvm [2224]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0xc1) = 0x1 [ 122.231793][ T2225] kvm: kvm [2224]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0xc2) = 0x1 [ 122.242756][ T2225] kvm: kvm [2224]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x11e) = 0xbe702112 [ 122.254625][ T2225] kvm: kvm [2224]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x186) = 0x1 [ 122.263277][ T2225] kvm: kvm [2224]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x187) = 0x1 [ 122.273849][ T2225] kvm_intel: kvm [2224]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x1d9) = 0x1 [ 123.281951][ T788] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 123.293151][ T788] asix 4-1:0.0: probe with driver asix failed with error -71 [ 123.301652][ T788] usb 4-1: USB disconnect, device number 27 [ 123.803540][ T36] audit: type=1400 audit(1754896519.233:622): avc: denied { setattr } for pid=2245 comm="syz.3.695" name="001" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 123.841713][ T2251] rust_binder: Failed to allocate buffer. len:24, is_oneway:false [ 124.075580][ T2260] rust_binder: Error while translating object. [ 124.083534][ T2260] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 124.089719][ T2260] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:577 [ 124.200017][ T10] usb 1-1: USB disconnect, device number 30 [ 124.390638][ T62] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 124.540581][ T62] usb 4-1: Using ep0 maxpacket: 32 [ 124.547205][ T62] usb 4-1: unable to get BOS descriptor or descriptor too short [ 124.555634][ T62] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 124.564481][ T62] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 124.573220][ T62] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 124.583429][ T62] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 124.592424][ T62] usb 4-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 124.602939][ T62] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 124.612047][ T62] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.620066][ T62] usb 4-1: Product: syz [ 124.624262][ T62] usb 4-1: Manufacturer: syz [ 124.628878][ T62] usb 4-1: SerialNumber: syz [ 124.630580][ T788] usb 1-1: new low-speed USB device number 31 using dummy_hcd [ 124.791729][ T788] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 124.801100][ T788] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 124.809920][ T788] usb 1-1: config 0 descriptor?? [ 124.861668][ T62] usb 4-1: USB disconnect, device number 28 [ 124.872924][ T2048] udevd[2048]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 125.018930][ T2270] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 125.027649][ T2270] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 125.591075][ T36] audit: type=1400 audit(1754896521.023:623): avc: denied { ioctl } for pid=2281 comm="syz.2.709" path="socket:[27889]" dev="sockfs" ino=27889 ioctlcmd=0x9439 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 125.761947][ T2292] kvm: kvm [2291]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0xc1) = 0x1 [ 125.770791][ T2292] kvm: kvm [2291]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0xc2) = 0x1 [ 125.783175][ T2292] kvm: kvm [2291]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x11e) = 0xbe702112 [ 125.796205][ T2292] kvm: kvm [2291]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x186) = 0x1 [ 125.805094][ T2292] kvm: kvm [2291]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x187) = 0x1 [ 125.816067][ T2292] kvm_intel: kvm [2291]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x1d9) = 0x1 [ 125.920604][ T62] usb 4-1: new low-speed USB device number 29 using dummy_hcd [ 126.050605][ T62] usb 4-1: device descriptor read/64, error -71 [ 126.290622][ T62] usb 4-1: device descriptor read/64, error -71 [ 126.530592][ T62] usb 4-1: new low-speed USB device number 30 using dummy_hcd [ 126.660598][ T62] usb 4-1: device descriptor read/64, error -71 [ 126.902088][ T62] usb 4-1: device descriptor read/64, error -71 [ 127.010708][ T62] usb usb4-port1: attempt power cycle [ 127.241692][ T788] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 127.253345][ T788] asix 1-1:0.0: probe with driver asix failed with error -71 [ 127.261752][ T788] usb 1-1: USB disconnect, device number 31 [ 127.350562][ T62] usb 4-1: new low-speed USB device number 31 using dummy_hcd [ 127.371613][ T62] usb 4-1: device descriptor read/8, error -71 [ 127.501603][ T62] usb 4-1: device descriptor read/8, error -71 [ 127.740585][ T62] usb 4-1: new low-speed USB device number 32 using dummy_hcd [ 127.762059][ T62] usb 4-1: device descriptor read/8, error -71 [ 127.768646][ T13] Bluetooth: hci0: Frame reassembly failed (-84) [ 127.891532][ T62] usb 4-1: device descriptor read/8, error -71 [ 128.010727][ T62] usb usb4-port1: unable to enumerate USB device [ 128.759783][ T36] audit: type=1400 audit(1754896524.183:624): avc: denied { remount } for pid=2311 comm="syz.3.720" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 128.839928][ T2314] netlink: 4 bytes leftover after parsing attributes in process `syz.3.720'. [ 129.058684][ T36] audit: type=1400 audit(1754896524.483:625): avc: denied { ioctl } for pid=2328 comm="syz.2.725" path="/158/file2" dev="tmpfs" ino=868 ioctlcmd=0x4c03 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 129.083376][ T36] audit: type=1400 audit(1754896524.493:626): avc: denied { remount } for pid=2328 comm="syz.2.725" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 129.103612][ T36] audit: type=1400 audit(1754896524.523:627): avc: denied { read write } for pid=2324 comm="syz.3.723" name="file0" dev="fuse" ino=18446744073709551615 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 129.128169][ T36] audit: type=1400 audit(1754896524.523:628): avc: denied { open } for pid=2324 comm="syz.3.723" path="/221/file0/file0" dev="fuse" ino=18446744073709551615 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 129.186915][ T2335] loop7: detected capacity change from 0 to 7 [ 129.197083][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 129.206291][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 129.214342][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 129.223520][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 129.231473][ T2335] loop7: unable to read partition table [ 129.237943][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 129.238978][ T2335] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 129.247129][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 129.268510][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 129.277718][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 129.285837][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 129.295526][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 129.304697][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 129.313863][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 129.323049][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 129.331071][ T2335] sock: sock_set_timeout: `syz.3.727' (pid 2335) tries to set negative timeout [ 129.340177][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 129.349385][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 129.357557][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 129.367033][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 129.480568][ T66] usb 3-1: new low-speed USB device number 25 using dummy_hcd [ 129.631664][ T66] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 129.640823][ T66] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.649420][ T66] usb 3-1: config 0 descriptor?? [ 129.840589][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 129.857912][ T2337] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 129.876100][ T2337] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 130.048934][ T2358] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 130.048964][ T2358] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:481 [ 130.107855][ T2367] netlink: 'syz.0.740': attribute type 12 has an invalid length. [ 130.280551][ T788] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 130.430554][ T788] usb 4-1: Using ep0 maxpacket: 8 [ 130.436905][ T788] usb 4-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid wMaxPacketSize 0 [ 130.446952][ T788] usb 4-1: config 0 interface 0 has no altsetting 0 [ 130.453701][ T788] usb 4-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 130.462949][ T788] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.471634][ T788] usb 4-1: config 0 descriptor?? [ 130.679199][ T2359] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 130.687764][ T2359] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 130.711571][ T2359] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1789845661 (229100244608 ns) > initial count (31289630848 ns). Using initial count to start timer. [ 130.773601][ T788] usbhid 4-1:0.0: can't add hid device: -71 [ 130.779596][ T788] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 130.789241][ T788] usb 4-1: USB disconnect, device number 33 [ 131.254926][ T2385] loop7: detected capacity change from 0 to 7 [ 131.261567][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 131.270748][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 131.280770][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 131.288655][ T2385] loop7: unable to read partition table [ 131.302376][ T2385] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 131.326100][ T2385] sock: sock_set_timeout: `syz.0.745' (pid 2385) tries to set negative timeout [ 131.568738][ T2407] binder: Unknown parameter 'defcontext01777777777777777777777' [ 131.568738][ T36] audit: type=1400 audit(1754896526.993:629): avc: denied { remount } for pid=2403 comm="syz.0.752" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 131.653392][ T36] audit: type=1400 audit(1754896527.083:630): avc: denied { read } for pid=2413 comm="syz.0.755" dev="sockfs" ino=29498 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 131.690579][ T62] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 131.840576][ T62] usb 4-1: Using ep0 maxpacket: 8 [ 131.846760][ T62] usb 4-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid wMaxPacketSize 0 [ 131.856669][ T62] usb 4-1: config 0 interface 0 has no altsetting 0 [ 131.863392][ T62] usb 4-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 131.872515][ T62] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 131.881347][ T62] usb 4-1: config 0 descriptor?? [ 132.101805][ T66] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 132.113502][ T66] asix 3-1:0.0: probe with driver asix failed with error -71 [ 132.124425][ T66] usb 3-1: USB disconnect, device number 25 [ 132.152333][ T62] usbhid 4-1:0.0: can't add hid device: -71 [ 132.158932][ T62] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 132.168133][ T62] usb 4-1: USB disconnect, device number 34 [ 132.675707][ T2426] loop7: detected capacity change from 0 to 7 [ 132.692159][ T2426] loop7: unable to read partition table [ 132.716079][ T2426] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 132.764183][ T2426] sock: sock_set_timeout: `syz.2.758' (pid 2426) tries to set negative timeout [ 132.790937][ T2439] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 132.790967][ T2439] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:537 [ 133.300595][ T374] usb 1-1: new low-speed USB device number 32 using dummy_hcd [ 133.461648][ T374] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 133.470825][ T374] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.479515][ T374] usb 1-1: config 0 descriptor?? [ 133.687883][ T2453] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 133.696568][ T2453] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 134.640577][ T66] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 134.790581][ T66] usb 3-1: Using ep0 maxpacket: 8 [ 134.796951][ T66] usb 3-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid wMaxPacketSize 0 [ 134.807081][ T66] usb 3-1: config 0 interface 0 has no altsetting 0 [ 134.814007][ T66] usb 3-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 134.823220][ T66] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 134.831998][ T66] usb 3-1: config 0 descriptor?? [ 135.040931][ T36] audit: type=1326 audit(1754896530.473:631): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2459 comm="syz.2.770" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fadc6b8ebe9 code=0x0 [ 135.836445][ T2467] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 135.844502][ T2467] rust_binder: 641: no such ref 3 [ 135.849579][ T2467] rust_binder: inc_ref_done called when no active inc_refs [ 135.912593][ T374] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 135.931192][ T374] asix 1-1:0.0: probe with driver asix failed with error -71 [ 135.939576][ T374] usb 1-1: USB disconnect, device number 32 [ 136.660690][ T31] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 136.821609][ T31] usb 1-1: config 1 has an invalid descriptor of length 68, skipping remainder of the config [ 136.840561][ T31] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 136.849504][ T31] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 136.864379][ T31] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 136.873892][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.882404][ T31] usb 1-1: Product: syz [ 136.886702][ T31] usb 1-1: Manufacturer: syz [ 136.891615][ T31] usb 1-1: SerialNumber: syz [ 137.450591][ T31] cdc_ncm 1-1:1.0: CDC Union missing and no IAD found [ 137.457466][ T31] cdc_ncm 1-1:1.0: bind() failure [ 137.464990][ T66] usbhid 3-1:0.0: can't add hid device: -71 [ 137.472075][ T31] usb 1-1: USB disconnect, device number 33 [ 137.485340][ T66] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 137.497000][ T66] usb 3-1: USB disconnect, device number 26 [ 137.541100][ T36] audit: type=1400 audit(1754896532.973:632): avc: denied { create } for pid=2479 comm="syz.2.776" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 137.624515][ T374] rust_binder: 2479: removing orphan mapping 0:24 [ 137.631825][ T374] rust_binder: 0: removing orphan mapping 24:1120 [ 137.692841][ T2492] loop7: detected capacity change from 0 to 7 [ 137.699598][ C0] blk_print_req_error: 17 callbacks suppressed [ 137.699611][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 137.714965][ C0] buffer_io_error: 14 callbacks suppressed [ 137.714984][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 137.728770][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 137.737960][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 137.745929][ T2048] loop7: unable to read partition table [ 137.751720][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 137.760908][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 137.769270][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 137.778447][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 137.786987][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 137.796158][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 137.804229][ T2492] loop7: unable to read partition table [ 137.804326][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 137.810310][ T2492] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 137.819061][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 137.848175][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 137.857405][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 137.865567][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 137.875651][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 137.884861][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 137.892998][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 137.902184][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 137.910279][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 138.100592][ T66] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 138.250559][ T66] usb 3-1: Using ep0 maxpacket: 8 [ 138.255788][ T788] usb 1-1: new low-speed USB device number 34 using dummy_hcd [ 138.264446][ T66] usb 3-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid wMaxPacketSize 0 [ 138.274282][ T66] usb 3-1: config 0 interface 0 has no altsetting 0 [ 138.280967][ T66] usb 3-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 138.290023][ T66] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.298823][ T66] usb 3-1: config 0 descriptor?? [ 138.411689][ T788] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 138.420911][ T788] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.429718][ T788] usb 1-1: config 0 descriptor?? [ 138.554287][ T36] audit: type=1400 audit(1754896533.983:633): avc: denied { map } for pid=2502 comm="syz.3.785" path="/dev/usbmon0" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 138.594931][ T66] usbhid 3-1:0.0: can't add hid device: -71 [ 138.602770][ T66] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 138.612065][ T66] usb 3-1: USB disconnect, device number 27 [ 138.618878][ T2506] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 138.635888][ T2499] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 138.659104][ T2499] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 138.669055][ T36] audit: type=1400 audit(1754896534.093:634): avc: denied { create } for pid=2512 comm="syz.3.788" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 138.741536][ T2515] kvm: kvm [2514]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0xc1) = 0x1 [ 138.750117][ T2515] kvm: kvm [2514]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0xc2) = 0x1 [ 138.761121][ T2515] kvm: kvm [2514]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x11e) = 0xbe702112 [ 138.773117][ T2515] kvm: kvm [2514]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x186) = 0x1 [ 138.781705][ T2515] kvm: kvm [2514]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x187) = 0x1 [ 138.792588][ T2515] kvm_intel: kvm [2514]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x1d9) = 0x1 [ 139.014501][ T2525] loop7: detected capacity change from 0 to 7 [ 139.133529][ T36] audit: type=1400 audit(1754896534.563:635): avc: denied { bpf } for pid=2527 comm="syz.4.793" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 139.157544][ T2530] netlink: 12 bytes leftover after parsing attributes in process `syz.2.794'. [ 139.211181][ T2534] sock: sock_set_timeout: `syz.4.793' (pid 2534) tries to set negative timeout [ 139.460599][ T374] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 139.600584][ T374] usb 3-1: device descriptor read/64, error -71 [ 139.640707][ T36] audit: type=1400 audit(1754896535.073:636): avc: denied { read write } for pid=2545 comm="syz.3.800" name="rtc0" dev="devtmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 139.653728][ T2546] netlink: 'syz.3.800': attribute type 12 has an invalid length. [ 139.664218][ T36] audit: type=1400 audit(1754896535.073:637): avc: denied { open } for pid=2545 comm="syz.3.800" path="/dev/rtc0" dev="devtmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 139.698785][ T36] audit: type=1400 audit(1754896535.073:638): avc: denied { ioctl } for pid=2545 comm="syz.3.800" path="/dev/rtc0" dev="devtmpfs" ino=195 ioctlcmd=0x7013 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 139.850597][ T374] usb 3-1: device descriptor read/64, error -71 [ 140.090569][ T374] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 140.220581][ T374] usb 3-1: device descriptor read/64, error -71 [ 140.460563][ T374] usb 3-1: device descriptor read/64, error -71 [ 140.570654][ T374] usb usb3-port1: attempt power cycle [ 140.882055][ T788] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 140.892456][ T788] asix 1-1:0.0: probe with driver asix failed with error -71 [ 140.901104][ T788] usb 1-1: USB disconnect, device number 34 [ 140.920583][ T374] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 140.945967][ T374] usb 3-1: device descriptor read/8, error -71 [ 140.966387][ T2563] loop7: detected capacity change from 0 to 7 [ 141.091556][ T374] usb 3-1: device descriptor read/8, error -71 [ 141.154101][ T2566] netlink: 32 bytes leftover after parsing attributes in process `syz.4.806'. [ 141.163214][ T2566] tipc: Invalid UDP bearer configuration [ 141.163240][ T2566] tipc: Enabling of bearer rejected, failed to enable media [ 141.340617][ T374] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 141.361572][ T374] usb 3-1: device descriptor read/8, error -71 [ 141.474313][ T2573] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 141.483108][ T2573] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 141.501064][ T374] usb 3-1: device descriptor read/8, error -71 [ 141.610681][ T374] usb usb3-port1: unable to enumerate USB device [ 141.642705][ T2575] overlayfs: failed to resolve '': -2 [ 141.904162][ T2590] loop7: detected capacity change from 0 to 7 [ 142.120567][ T66] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 142.270735][ T66] usb 1-1: Using ep0 maxpacket: 8 [ 142.277700][ T66] usb 1-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid wMaxPacketSize 0 [ 142.287611][ T66] usb 1-1: config 0 interface 0 has no altsetting 0 [ 142.294443][ T66] usb 1-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 142.303602][ T66] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.312294][ T66] usb 1-1: config 0 descriptor?? [ 142.620601][ T788] usb 3-1: new low-speed USB device number 32 using dummy_hcd [ 142.632525][ T66] usbhid 1-1:0.0: can't add hid device: -71 [ 142.639127][ T66] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 142.648062][ T66] usb 1-1: USB disconnect, device number 35 [ 142.714523][ T2601] rust_binder: Failed to allocate buffer. len:1160, is_oneway:true [ 142.721305][ T2601] rust_binder: Read failure Err(EFAULT) in pid:698 [ 142.742989][ T2603] vcan0: entered allmulticast mode [ 142.755083][ T2603] vcan0: left allmulticast mode [ 142.781897][ T788] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 142.791443][ T788] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.800126][ T788] usb 3-1: config 0 descriptor?? [ 143.006296][ T2597] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 143.015013][ T2597] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 143.191850][ T2621] loop7: detected capacity change from 0 to 7 [ 143.202493][ C1] blk_print_req_error: 4 callbacks suppressed [ 143.202516][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 143.217798][ C1] buffer_io_error: 3 callbacks suppressed [ 143.217832][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 143.233124][ T2623] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 143.238888][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 143.254600][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 143.262475][ T2621] loop7: unable to read partition table [ 143.263206][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 143.272237][ T2621] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 143.277338][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 143.298909][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 143.308157][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 143.322027][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 143.331255][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 143.339373][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 143.348613][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 143.356897][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 143.366104][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 143.374473][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 143.383674][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 143.632533][ T2636] kvm: kvm [2635]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0xc1) = 0x1 [ 143.641104][ T2636] kvm: kvm [2635]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0xc2) = 0x1 [ 143.652061][ T2636] kvm: kvm [2635]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x11e) = 0xbe702112 [ 143.664051][ T2636] kvm: kvm [2635]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x186) = 0x1 [ 143.672767][ T2636] kvm: kvm [2635]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x187) = 0x1 [ 143.683539][ T2636] kvm_intel: kvm [2635]: vcpu0, guest rIP: 0x9131 Unhandled WRMSR(0x1d9) = 0x1 [ 143.909876][ T2641] rust_binder: Got transaction with invalid offset. [ 143.909942][ T2641] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 143.916834][ T2641] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:726 [ 143.940156][ T2644] tipc: Enabling of bearer rejected, already enabled [ 144.463923][ T2675] loop7: detected capacity change from 0 to 7 [ 144.470424][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 144.479632][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 144.487645][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 144.496840][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 144.504759][ T2675] loop7: unable to read partition table [ 144.511867][ T2675] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 145.282009][ T788] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 145.295453][ T788] asix 3-1:0.0: probe with driver asix failed with error -71 [ 145.304245][ T788] usb 3-1: USB disconnect, device number 32 [ 145.854970][ T2685] tipc: Enabling of bearer rejected, already enabled [ 145.875662][ T2687] fuse: Unknown parameter 'r)upid' [ 145.882227][ T2687] syzkaller0: entered allmulticast mode [ 145.959824][ T36] audit: type=1400 audit(1754896541.383:639): avc: denied { map } for pid=2688 comm="syz.2.850" path="socket:[31610]" dev="sockfs" ino=31610 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 146.099788][ T2694] netlink: 8 bytes leftover after parsing attributes in process `syz.2.852'. [ 146.108988][ T2694] netlink: 20 bytes leftover after parsing attributes in process `syz.2.852'. [ 146.216739][ T2702] loop7: detected capacity change from 0 to 7 [ 146.223680][ T2702] loop7: unable to read partition table [ 146.229468][ T2702] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 146.297066][ T2701] netlink: 'syz.0.855': attribute type 28 has an invalid length. [ 146.306990][ T36] audit: type=1400 audit(1754896541.733:640): avc: denied { listen } for pid=2700 comm="syz.0.855" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 146.420629][ T636] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 146.570564][ T636] usb 3-1: Using ep0 maxpacket: 16 [ 146.575797][ T788] usb 1-1: new low-speed USB device number 36 using dummy_hcd [ 146.584282][ T636] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 146.594429][ T636] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 146.604756][ T636] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 146.613863][ T636] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 146.621929][ T636] usb 3-1: Product: syz [ 146.626100][ T636] usb 3-1: Manufacturer: syz [ 146.630740][ T636] usb 3-1: SerialNumber: syz [ 146.731582][ T788] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 146.740739][ T788] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 146.749445][ T788] usb 1-1: config 0 descriptor?? [ 146.862085][ T2699] netlink: 68 bytes leftover after parsing attributes in process `syz.2.854'. [ 146.871752][ T36] audit: type=1400 audit(1754896542.303:641): avc: denied { name_bind } for pid=2698 comm="syz.2.854" src=65530 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=rawip_socket permissive=1 [ 146.953650][ T636] usb 3-1: unknown interface protocol 0x3, assuming v1 [ 146.958256][ T2706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 146.961092][ T636] usb 3-1: cannot find UAC_HEADER [ 146.969777][ T2706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 146.977991][ T636] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 146.994065][ T636] usb 3-1: USB disconnect, device number 33 [ 147.012071][ T2048] udevd[2048]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 147.095717][ T2710] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 147.096606][ T2710] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 147.191262][ T36] audit: type=1400 audit(1754896542.623:642): avc: denied { read } for pid=2713 comm="syz.3.860" path="socket:[30639]" dev="sockfs" ino=30639 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 147.228074][ T2716] tipc: Enabling of bearer rejected, already enabled [ 147.490581][ T10] usb 4-1: new full-speed USB device number 35 using dummy_hcd [ 147.538036][ T2726] loop7: detected capacity change from 0 to 7 [ 147.544671][ T2726] loop7: unable to read partition table [ 147.550403][ T2726] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 147.642315][ T10] usb 4-1: not running at top speed; connect to a high speed hub [ 147.650935][ T10] usb 4-1: config 1 has an invalid interface descriptor of length 2, skipping [ 147.659851][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 147.670115][ T10] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 147.680399][ T10] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 147.689527][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 147.697665][ T10] usb 4-1: Product: ည [ 147.701873][ T10] usb 4-1: SerialNumber: Щ [ 147.913036][ T10] usb 4-1: 0:2 : does not exist [ 147.920236][ T10] usb 4-1: USB disconnect, device number 35 [ 147.931005][ T2048] udevd[2048]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 148.531950][ T2737] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 148.533060][ T2737] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 148.655650][ T2743] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 148.662975][ T2743] rust_binder: Read failure Err(EAGAIN) in pid:772 [ 148.669727][ T2743] rust_binder: got new transaction with bad transaction stack [ 148.676547][ T2743] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:772 [ 148.706942][ T2745] tipc: Enabling of bearer rejected, already enabled [ 148.791429][ T36] audit: type=1400 audit(1754896544.223:643): avc: denied { lock } for pid=2748 comm="syz.3.874" path="socket:[31832]" dev="sockfs" ino=31832 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 148.909392][ T2752] loop7: detected capacity change from 0 to 7 [ 148.920932][ C1] blk_print_req_error: 23 callbacks suppressed [ 148.920951][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 148.936384][ C1] buffer_io_error: 22 callbacks suppressed [ 148.936405][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 148.950789][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 148.960029][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 148.967954][ T2752] loop7: unable to read partition table [ 148.980718][ T2752] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 148.994353][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 149.003713][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 149.022615][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 149.031862][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 149.045637][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 149.056692][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 149.065924][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 149.074955][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 149.084161][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 149.092356][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 149.101554][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 149.119546][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 149.128754][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 149.241772][ T788] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 149.255771][ T788] asix 1-1:0.0: probe with driver asix failed with error -71 [ 149.267851][ T788] usb 1-1: USB disconnect, device number 36 [ 149.427591][ T36] audit: type=1400 audit(1754896544.853:644): avc: denied { connect } for pid=2754 comm="syz.2.876" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 149.456253][ T36] audit: type=1400 audit(1754896544.883:645): avc: denied { map } for pid=2754 comm="syz.2.876" path="socket:[32844]" dev="sockfs" ino=32844 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 149.480631][ T36] audit: type=1400 audit(1754896544.883:646): avc: denied { read } for pid=2754 comm="syz.2.876" path="socket:[32844]" dev="sockfs" ino=32844 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 149.542085][ T2760] netlink: 72 bytes leftover after parsing attributes in process `syz.2.878'. [ 149.856067][ T2775] tipc: Enabling of bearer rejected, already enabled [ 150.034777][ T2788] loop7: detected capacity change from 0 to 7 [ 150.041350][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 150.050537][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 150.070580][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 150.078721][ T2788] loop7: unable to read partition table [ 150.090287][ T2788] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 150.340572][ T10] usb 3-1: new low-speed USB device number 34 using dummy_hcd [ 150.456753][ T2813] rust_binder: Failed copying remainder into alloc: EFAULT [ 150.456774][ T2813] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 150.464128][ T2813] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 150.472473][ T2813] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:128 [ 150.491729][ T10] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 150.510265][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 150.519198][ T10] usb 3-1: config 0 descriptor?? [ 150.580554][ T636] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 150.725681][ T2790] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 150.730607][ T636] usb 1-1: Using ep0 maxpacket: 32 [ 150.737506][ T2790] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 150.750607][ T636] usb 1-1: config 5 has an invalid interface number: 222 but max is 1 [ 150.758821][ T636] usb 1-1: config 5 has no interface number 1 [ 150.771447][ T636] usb 1-1: config 5 interface 222 altsetting 11 endpoint 0xB has invalid maxpacket 1023, setting to 64 [ 150.782978][ T636] usb 1-1: config 5 interface 222 altsetting 11 endpoint 0x9 has an invalid bInterval 100, changing to 10 [ 150.794857][ T636] usb 1-1: config 5 interface 222 has no altsetting 0 [ 150.801850][ T636] usb 1-1: config 5 interface 0 has no altsetting 0 [ 150.811996][ T636] usb 1-1: New USB device found, idVendor=07b8, idProduct=401a, bcdDevice=f1.81 [ 150.822097][ T636] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.830187][ T110] loop7: unable to read partition table [ 150.835903][ T636] usb 1-1: Product: syz [ 150.840095][ T636] usb 1-1: Manufacturer: syz [ 150.850226][ T636] usb 1-1: SerialNumber: syz [ 151.063090][ T636] rtl8150 1-1:5.222: couldn't find required endpoints [ 151.071512][ T636] rtl8150 1-1:5.222: probe with driver rtl8150 failed with error -5 [ 151.081458][ T636] rtl8150 1-1:5.0: couldn't find required endpoints [ 151.088201][ T636] rtl8150 1-1:5.0: probe with driver rtl8150 failed with error -5 [ 151.098435][ T636] usb 1-1: USB disconnect, device number 37 [ 151.161241][ T10] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 151.180589][ T10] asix 3-1:0.0: probe with driver asix failed with error -32 [ 151.240690][ T788] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 151.390682][ T788] usb 4-1: Using ep0 maxpacket: 16 [ 151.396904][ T788] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 151.408510][ T788] usb 4-1: New USB device found, idVendor=045e, idProduct=0721, bcdDevice=9c.25 [ 151.417635][ T788] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.425669][ T788] usb 4-1: Product: syz [ 151.429857][ T788] usb 4-1: Manufacturer: syz [ 151.434502][ T788] usb 4-1: SerialNumber: syz [ 151.439980][ T788] usb 4-1: config 0 descriptor?? [ 151.698595][ T2829] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 1152, size: 4096) [ 151.698625][ T2829] rust_binder: Error while translating object. [ 151.710639][ T2829] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 151.717012][ T2829] rust_binder: Failure BR_FAILED_REPLY { source: EINVAL } during reply - delivering BR_FAILED_REPLY to sender. [ 151.726636][ T2829] rust_binder: Transaction failed: BR_TRANSACTION_COMPLETE my_pid:796 [ 151.739432][ T788] usb 4-1: USB disconnect, device number 36 [ 151.844678][ T636] rust_binder: 2835: removing orphan mapping 0:4120 [ 152.260374][ T10] rust_binder: 2828: removing orphan mapping 0:8 [ 152.518407][ T36] audit: type=1400 audit(1754896547.943:647): avc: denied { lock } for pid=2859 comm="syz.4.914" path="/dev/fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 152.752902][ T36] audit: type=1400 audit(1754896548.183:648): avc: denied { shutdown } for pid=2868 comm="syz.4.917" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 153.093963][ T374] usb 3-1: USB disconnect, device number 34 [ 153.430597][ T374] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 153.494835][ T2888] tmpfs: Cannot retroactively limit inodes [ 153.580541][ T374] usb 3-1: Using ep0 maxpacket: 32 [ 153.591278][ T374] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 153.601572][ T374] usb 3-1: New USB device found, idVendor=05ac, idProduct=0265, bcdDevice= 0.00 [ 153.611908][ T374] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 153.621234][ T374] usb 3-1: config 0 descriptor?? [ 154.030079][ T2873] rust_binder: Error while translating object. [ 154.030143][ T2873] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 154.036633][ T2873] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:525 [ 154.047874][ T374] usbhid 3-1:0.0: can't add hid device: -71 [ 154.063370][ T374] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 154.072270][ T374] usb 3-1: USB disconnect, device number 35 [ 154.190564][ T10] usb 4-1: new low-speed USB device number 37 using dummy_hcd [ 154.341610][ T10] usb 4-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 154.350783][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 154.359497][ T10] usb 4-1: config 0 descriptor?? [ 154.569684][ T2891] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 154.578361][ T2891] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 154.612068][ T2902] fuse: Unknown parameter '077 [ 154.612068][ T2902] 0x0000000000000006' [ 154.631556][ T2906] tipc: Enabled bearer , priority 0 [ 154.987867][ T10] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 154.997961][ T10] asix 4-1:0.0: probe with driver asix failed with error -32 [ 155.463070][ T36] audit: type=1326 audit(1754896550.893:649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2920 comm="syz.4.937" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe58078ebe9 code=0x0 [ 155.516124][ T36] audit: type=1326 audit(1754896550.943:650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2920 comm="syz.4.937" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe58078ebe9 code=0x0 [ 156.779012][ T2962] rust_binder: 2961 RLIMIT_NICE not set [ 156.785391][ T36] audit: type=1400 audit(1754896552.213:651): avc: denied { setopt } for pid=2960 comm="syz.4.949" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 156.963253][ T788] usb 4-1: USB disconnect, device number 37 [ 157.068539][ T36] audit: type=1400 audit(1754896552.493:652): avc: denied { accept } for pid=2981 comm="syz.3.957" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 157.148719][ T36] audit: type=1400 audit(1754896552.573:653): avc: denied { read } for pid=149 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 157.151608][ T2987] can0: slcan on ttyS3. [ 157.190556][ T36] audit: type=1400 audit(1754896552.613:654): avc: denied { search } for pid=149 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 157.230826][ T36] audit: type=1400 audit(1754896552.613:655): avc: denied { read } for pid=149 comm="dhcpcd" name="n15" dev="tmpfs" ino=6409 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 157.269254][ T36] audit: type=1400 audit(1754896552.613:656): avc: denied { open } for pid=149 comm="dhcpcd" path="/run/udev/data/n15" dev="tmpfs" ino=6409 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 157.323089][ T2986] can0 (unregistered): slcan off ttyS3. [ 158.090559][ T10] usb 1-1: new low-speed USB device number 38 using dummy_hcd [ 158.251356][ T10] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 158.260564][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 158.269581][ T10] usb 1-1: config 0 descriptor?? [ 158.476712][ T3026] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 158.485344][ T3026] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 158.894649][ T10] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 158.904771][ T10] asix 1-1:0.0: probe with driver asix failed with error -32 [ 159.291113][ T36] kauditd_printk_skb: 11 callbacks suppressed [ 159.291132][ T36] audit: type=1400 audit(1754896554.723:668): avc: denied { remove_name } for pid=3070 comm="syz.3.978" name="binder0" dev="binder" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 159.320285][ T36] audit: type=1400 audit(1754896554.723:669): avc: denied { unlink } for pid=3070 comm="syz.3.978" name="binder0" dev="binder" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 159.392974][ T3077] rust_binder: Failed to allocate buffer. len:4144, is_oneway:false [ 159.393005][ T3077] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 159.401208][ T3077] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:862 [ 160.295395][ T36] audit: type=1400 audit(1754896555.723:670): avc: denied { getopt } for pid=3094 comm="syz.4.986" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 160.466735][ T3108] overlayfs: failed to resolve '/now': -2 [ 160.617237][ T3120] /dev/rnullb0: Can't open blockdev [ 160.862032][ T636] usb 1-1: USB disconnect, device number 38 [ 160.877876][ T3130] Dead loop on virtual device ip6_vti0, fix it urgently! [ 160.887959][ T3130] rust_binder: Got transaction with invalid offset. [ 160.888035][ T3130] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 160.895028][ T3130] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:217 [ 160.918614][ T3137] FAULT_INJECTION: forcing a failure. [ 160.918614][ T3137] name failslab, interval 1, probability 0, space 0, times 0 [ 160.920420][ T3138] binder: Unknown parameter 'context' [ 160.927898][ T3137] CPU: 0 UID: 0 PID: 3137 Comm: syz.0.1000 Not tainted 6.12.38-syzkaller-gc46482c03ae9 #0 80b02ff89b1607ee1d115e0157270f38c0251e02 [ 160.927937][ T3137] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 160.927966][ T3137] Call Trace: [ 160.927976][ T3137] [ 160.927987][ T3137] __dump_stack+0x21/0x30 [ 160.928025][ T3137] dump_stack_lvl+0x10c/0x190 [ 160.928075][ T3137] ? __cfi_dump_stack_lvl+0x10/0x10 [ 160.928109][ T3137] ? proc_pident_instantiate+0x6d/0x2c0 [ 160.928137][ T3137] ? proc_tid_base_lookup+0x2f/0x40 [ 160.928169][ T3137] ? path_openat+0x12fe/0x34b0 [ 160.928198][ T3137] ? do_filp_open+0x1c6/0x3e0 [ 160.928234][ T3137] ? __x64_sys_openat+0x13a/0x170 [ 160.928267][ T3137] ? x64_sys_call+0xe69/0x2ee0 [ 160.928303][ T3137] dump_stack+0x19/0x20 [ 160.928335][ T3137] should_fail_ex+0x3d9/0x530 [ 160.928372][ T3137] should_failslab+0xac/0x100 [ 160.928398][ T3137] kmem_cache_alloc_noprof+0x42/0x3a0 [ 160.928435][ T3137] ? vm_area_dup+0x42/0x570 [ 160.928461][ T3137] vm_area_dup+0x42/0x570 [ 160.928484][ T3137] __split_vma+0x1bd/0xa80 [ 160.928508][ T3137] ? vms_gather_munmap_vmas+0xdd0/0xdd0 [ 160.928534][ T3137] ? mas_find+0x3f1/0x5f0 [ 160.928572][ T3137] vms_gather_munmap_vmas+0x428/0xdd0 [ 160.928599][ T3137] mmap_region+0x598/0x1bc0 [ 160.928648][ T3137] ? __cfi_mmap_region+0x10/0x10 [ 160.928684][ T3137] ? __kasan_check_read+0x15/0x20 [ 160.928716][ T3137] ? arch_get_unmapped_area_topdown+0x232/0x8d0 [ 160.928760][ T3137] ? file_mmap_ok+0x147/0x1a0 [ 160.928793][ T3137] do_mmap+0xb6d/0x13c0 [ 160.928826][ T3137] ? __cfi_do_mmap+0x10/0x10 [ 160.928857][ T3137] ? down_write_killable+0xe9/0x2d0 [ 160.928879][ T3137] ? __cfi_down_write_killable+0x10/0x10 [ 160.928907][ T3137] vm_mmap_pgoff+0x38f/0x4e0 [ 160.928941][ T3137] ? __cfi_vm_mmap_pgoff+0x10/0x10 [ 160.928973][ T3137] ? __fget_files+0x2c5/0x340 [ 160.928999][ T3137] ksys_mmap_pgoff+0x166/0x1e0 [ 160.929034][ T3137] __x64_sys_mmap+0x121/0x140 [ 160.929068][ T3137] x64_sys_call+0x13bf/0x2ee0 [ 160.929101][ T3137] do_syscall_64+0x58/0xf0 [ 160.929126][ T3137] ? clear_bhb_loop+0x50/0xa0 [ 160.929180][ T3137] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 160.929221][ T3137] RIP: 0033:0x7f3df658ebe9 [ 160.929241][ T3137] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 160.929264][ T3137] RSP: 002b:00007f3df742f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 160.929291][ T3137] RAX: ffffffffffffffda RBX: 00007f3df67b5fa0 RCX: 00007f3df658ebe9 [ 160.929312][ T3137] RDX: 0000000001000002 RSI: 0000000000400000 RDI: 0000200000000000 [ 160.929331][ T3137] RBP: 00007f3df742f090 R08: 0000000000000003 R09: 0000000000000000 [ 160.929350][ T3137] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 160.929367][ T3137] R13: 00007f3df67b6038 R14: 00007f3df67b5fa0 R15: 00007ffc9b033bd8 [ 160.929391][ T3137] [ 161.282776][ T36] audit: type=1400 audit(1754896556.713:671): avc: denied { mount } for pid=3147 comm="syz.0.1006" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 161.305220][ T36] audit: type=1400 audit(1754896556.713:672): avc: denied { mounton } for pid=3147 comm="syz.0.1006" path="/248/file0" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 161.560556][ T636] usb 1-1: new low-speed USB device number 39 using dummy_hcd [ 161.663190][ T3158] FAULT_INJECTION: forcing a failure. [ 161.663190][ T3158] name failslab, interval 1, probability 0, space 0, times 0 [ 161.675867][ T3158] CPU: 1 UID: 0 PID: 3158 Comm: syz.3.1010 Not tainted 6.12.38-syzkaller-gc46482c03ae9 #0 80b02ff89b1607ee1d115e0157270f38c0251e02 [ 161.675917][ T3158] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 161.675931][ T3158] Call Trace: [ 161.675938][ T3158] [ 161.675947][ T3158] __dump_stack+0x21/0x30 [ 161.675979][ T3158] dump_stack_lvl+0x10c/0x190 [ 161.676004][ T3158] ? __cfi_dump_stack_lvl+0x10/0x10 [ 161.676031][ T3158] ? kasan_save_track+0x4f/0x80 [ 161.676052][ T3158] dump_stack+0x19/0x20 [ 161.676076][ T3158] should_fail_ex+0x3d9/0x530 [ 161.676106][ T3158] should_failslab+0xac/0x100 [ 161.676126][ T3158] kmem_cache_alloc_noprof+0x42/0x3a0 [ 161.676155][ T3158] ? mas_alloc_nodes+0x254/0x9e0 [ 161.676175][ T3158] mas_alloc_nodes+0x254/0x9e0 [ 161.676194][ T3158] mas_preallocate+0x762/0xc60 [ 161.676231][ T3158] ? __cfi_mas_preallocate+0x10/0x10 [ 161.676261][ T3158] ? __kasan_check_read+0x15/0x20 [ 161.676288][ T3158] ? anon_vma_name+0x7e/0xd0 [ 161.676314][ T3158] ? vm_area_dup+0x41c/0x570 [ 161.676334][ T3158] __split_vma+0x412/0xa80 [ 161.676353][ T3158] ? vms_gather_munmap_vmas+0xdd0/0xdd0 [ 161.676374][ T3158] ? mas_find+0x3f1/0x5f0 [ 161.676403][ T3158] vms_gather_munmap_vmas+0x428/0xdd0 [ 161.676425][ T3158] mmap_region+0x598/0x1bc0 [ 161.676455][ T3158] ? __cfi_mmap_region+0x10/0x10 [ 161.676489][ T3158] ? __kasan_check_read+0x15/0x20 [ 161.676516][ T3158] ? arch_get_unmapped_area_topdown+0x232/0x8d0 [ 161.676554][ T3158] ? file_mmap_ok+0x147/0x1a0 [ 161.676581][ T3158] do_mmap+0xb6d/0x13c0 [ 161.676609][ T3158] ? __cfi_do_mmap+0x10/0x10 [ 161.676636][ T3158] ? down_write_killable+0xe9/0x2d0 [ 161.676655][ T3158] ? __cfi_down_write_killable+0x10/0x10 [ 161.676676][ T3158] vm_mmap_pgoff+0x38f/0x4e0 [ 161.676706][ T3158] ? __cfi_vm_mmap_pgoff+0x10/0x10 [ 161.676734][ T3158] ? __fget_files+0x2c5/0x340 [ 161.676757][ T3158] ksys_mmap_pgoff+0x166/0x1e0 [ 161.676786][ T3158] __x64_sys_mmap+0x121/0x140 [ 161.676815][ T3158] x64_sys_call+0x13bf/0x2ee0 [ 161.676844][ T3158] do_syscall_64+0x58/0xf0 [ 161.676865][ T3158] ? clear_bhb_loop+0x50/0xa0 [ 161.676895][ T3158] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 161.676922][ T3158] RIP: 0033:0x7f2d9758ebe9 [ 161.676939][ T3158] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 161.676957][ T3158] RSP: 002b:00007f2d9835c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 161.676980][ T3158] RAX: ffffffffffffffda RBX: 00007f2d977b5fa0 RCX: 00007f2d9758ebe9 [ 161.676995][ T3158] RDX: 0000000001000002 RSI: 0000000000400000 RDI: 0000200000000000 [ 161.677009][ T3158] RBP: 00007f2d9835c090 R08: 0000000000000003 R09: 0000000000000000 [ 161.677023][ T3158] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 161.677047][ T3158] R13: 00007f2d977b6038 R14: 00007f2d977b5fa0 R15: 00007ffc0e6a9178 [ 161.677063][ T3158] [ 161.965960][ T636] usb 1-1: device descriptor read/64, error -71 [ 162.060987][ T3164] 9pnet: p9_errstr2errno: server reported unknown error 1844674 [ 162.121405][ T3164] @: renamed from vlan0 (while UP) [ 162.210554][ T636] usb 1-1: device descriptor read/64, error -71 [ 162.230563][ T62] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 162.380552][ T62] usb 4-1: Using ep0 maxpacket: 32 [ 162.386791][ T62] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 162.394933][ T62] usb 4-1: config 0 has no interface number 0 [ 162.402409][ T62] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 162.411577][ T62] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.419586][ T62] usb 4-1: Product: syz [ 162.423803][ T62] usb 4-1: Manufacturer: syz [ 162.428414][ T62] usb 4-1: SerialNumber: syz [ 162.433728][ T62] usb 4-1: config 0 descriptor?? [ 162.439491][ T62] smsc95xx v2.0.0 [ 162.450547][ T636] usb 1-1: new low-speed USB device number 40 using dummy_hcd [ 162.580553][ T636] usb 1-1: device descriptor read/64, error -71 [ 162.713723][ T3167] rust_binder: Failed copying remainder into alloc: EFAULT [ 162.713756][ T3167] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 162.722628][ T3167] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 162.731029][ T3167] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:572 [ 162.820578][ T636] usb 1-1: device descriptor read/64, error -71 [ 162.950672][ T636] usb usb1-port1: attempt power cycle [ 163.290568][ T636] usb 1-1: new low-speed USB device number 41 using dummy_hcd [ 163.311688][ T636] usb 1-1: device descriptor read/8, error -71 [ 163.443682][ T636] usb 1-1: device descriptor read/8, error -71 [ 163.451135][ T62] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 163.461962][ T62] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 163.471243][ T62] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 163.482107][ T62] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -71 [ 163.491400][ T62] usb 4-1: USB disconnect, device number 38 [ 163.680706][ T636] usb 1-1: new low-speed USB device number 42 using dummy_hcd [ 163.701735][ T636] usb 1-1: device descriptor read/8, error -71 [ 163.831695][ T636] usb 1-1: device descriptor read/8, error -71 [ 163.940642][ T636] usb usb1-port1: unable to enumerate USB device [ 164.322247][ T36] audit: type=1400 audit(1754896559.753:673): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 165.180884][ T3206] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 165.393030][ T3217] FAULT_INJECTION: forcing a failure. [ 165.393030][ T3217] name failslab, interval 1, probability 0, space 0, times 0 [ 165.412195][ T3217] CPU: 0 UID: 0 PID: 3217 Comm: syz.4.1031 Not tainted 6.12.38-syzkaller-gc46482c03ae9 #0 80b02ff89b1607ee1d115e0157270f38c0251e02 [ 165.412231][ T3217] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 165.412248][ T3217] Call Trace: [ 165.412254][ T3217] [ 165.412261][ T3217] __dump_stack+0x21/0x30 [ 165.412286][ T3217] dump_stack_lvl+0x10c/0x190 [ 165.412307][ T3217] ? __cfi_dump_stack_lvl+0x10/0x10 [ 165.412330][ T3217] dump_stack+0x19/0x20 [ 165.412351][ T3217] should_fail_ex+0x3d9/0x530 [ 165.412376][ T3217] should_failslab+0xac/0x100 [ 165.412394][ T3217] kmem_cache_alloc_noprof+0x42/0x3a0 [ 165.412417][ T3217] ? vm_area_alloc+0x3f/0x1a0 [ 165.412434][ T3217] vm_area_alloc+0x3f/0x1a0 [ 165.412450][ T3217] mmap_region+0xb89/0x1bc0 [ 165.412475][ T3217] ? __cfi_mmap_region+0x10/0x10 [ 165.412500][ T3217] ? __kasan_check_read+0x15/0x20 [ 165.412523][ T3217] ? arch_get_unmapped_area_topdown+0x232/0x8d0 [ 165.412555][ T3217] ? file_mmap_ok+0x147/0x1a0 [ 165.412588][ T3217] do_mmap+0xb6d/0x13c0 [ 165.412614][ T3217] ? __cfi_do_mmap+0x10/0x10 [ 165.412635][ T3217] ? down_write_killable+0xe9/0x2d0 [ 165.412651][ T3217] ? __cfi_down_write_killable+0x10/0x10 [ 165.412667][ T3217] vm_mmap_pgoff+0x38f/0x4e0 [ 165.412692][ T3217] ? __cfi_vm_mmap_pgoff+0x10/0x10 [ 165.412715][ T3217] ? __fget_files+0x2c5/0x340 [ 165.412733][ T3217] ksys_mmap_pgoff+0x166/0x1e0 [ 165.412756][ T3217] __x64_sys_mmap+0x121/0x140 [ 165.412780][ T3217] x64_sys_call+0x13bf/0x2ee0 [ 165.412804][ T3217] do_syscall_64+0x58/0xf0 [ 165.412823][ T3217] ? clear_bhb_loop+0x50/0xa0 [ 165.412848][ T3217] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 165.412871][ T3217] RIP: 0033:0x7fe58078ebe9 [ 165.412885][ T3217] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 165.412898][ T3217] RSP: 002b:00007fe58160d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 165.412916][ T3217] RAX: ffffffffffffffda RBX: 00007fe5809b5fa0 RCX: 00007fe58078ebe9 [ 165.412929][ T3217] RDX: 0000000001000002 RSI: 0000000000400000 RDI: 0000200000000000 [ 165.412940][ T3217] RBP: 00007fe58160d090 R08: 0000000000000003 R09: 0000000000000000 [ 165.412951][ T3217] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 165.412961][ T3217] R13: 00007fe5809b6038 R14: 00007fe5809b5fa0 R15: 00007ffc8ad43a18 [ 165.412975][ T3217] [ 165.420574][ T636] usb 1-1: new full-speed USB device number 43 using dummy_hcd [ 165.811544][ T636] usb 1-1: config 0 has no interfaces? [ 165.818311][ T636] usb 1-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 165.827454][ T636] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 165.835514][ T636] usb 1-1: Product: syz [ 165.839700][ T636] usb 1-1: Manufacturer: syz [ 165.844340][ T636] usb 1-1: SerialNumber: syz [ 165.849587][ T636] usb 1-1: config 0 descriptor?? [ 166.056692][ T36] audit: type=1400 audit(1754896561.483:674): avc: denied { lock } for pid=3204 comm="syz.0.1026" path="/dev/binderfs/binder1" dev="binder" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 166.080908][ T3205] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 166.080962][ T3205] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:673 [ 166.081060][ T3206] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 166.099567][ T3206] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:673 [ 166.109275][ T636] usb 1-1: USB disconnect, device number 43 [ 166.638053][ T3222] pim6reg1: entered promiscuous mode [ 166.643490][ T3222] pim6reg1: entered allmulticast mode [ 166.789915][ T3226] loop7: detected capacity change from 0 to 7 [ 166.796592][ C0] blk_print_req_error: 9 callbacks suppressed [ 166.796611][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 166.811902][ C0] buffer_io_error: 7 callbacks suppressed [ 166.811919][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 166.830441][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 166.839662][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 166.847550][ T3226] loop7: unable to read partition table [ 166.855621][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 166.855700][ T3226] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 166.879081][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 166.888274][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 166.897046][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 166.906255][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 166.914608][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 166.924012][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 166.932183][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 166.941451][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 166.949534][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 166.958695][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 167.040657][ T3240] FAULT_INJECTION: forcing a failure. [ 167.040657][ T3240] name failslab, interval 1, probability 0, space 0, times 0 [ 167.043513][ T36] audit: type=1400 audit(1754896562.473:675): avc: denied { read write } for pid=3239 comm="syz.0.1042" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 167.077930][ T3240] CPU: 1 UID: 0 PID: 3240 Comm: syz.3.1041 Not tainted 6.12.38-syzkaller-gc46482c03ae9 #0 80b02ff89b1607ee1d115e0157270f38c0251e02 [ 167.077963][ T3240] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 167.077978][ T3240] Call Trace: [ 167.077983][ T3240] [ 167.077989][ T3240] __dump_stack+0x21/0x30 [ 167.078012][ T3240] dump_stack_lvl+0x10c/0x190 [ 167.078031][ T3240] ? __cfi_dump_stack_lvl+0x10/0x10 [ 167.078051][ T3240] ? mas_wr_store_type+0x8eb/0x1ad0 [ 167.078074][ T3240] dump_stack+0x19/0x20 [ 167.078092][ T3240] should_fail_ex+0x3d9/0x530 [ 167.078114][ T3240] should_failslab+0xac/0x100 [ 167.078129][ T3240] __kmalloc_cache_noprof+0x41/0x3c0 [ 167.078150][ T3240] ? usbdev_mmap+0x1fa/0x8b0 [ 167.078170][ T3240] usbdev_mmap+0x1fa/0x8b0 [ 167.078188][ T3240] ? kasan_save_alloc_info+0x40/0x50 [ 167.078208][ T3240] ? __cfi_usbdev_mmap+0x10/0x10 [ 167.078227][ T3240] ? __asan_memset+0x39/0x50 [ 167.078247][ T3240] mmap_region+0x136e/0x1bc0 [ 167.078269][ T3240] ? __cfi_mmap_region+0x10/0x10 [ 167.078291][ T3240] ? __kasan_check_read+0x15/0x20 [ 167.078310][ T3240] ? arch_get_unmapped_area_topdown+0x232/0x8d0 [ 167.078337][ T3240] ? file_mmap_ok+0x147/0x1a0 [ 167.078357][ T3240] do_mmap+0xb6d/0x13c0 [ 167.078378][ T3240] ? __cfi_do_mmap+0x10/0x10 [ 167.078397][ T3240] ? down_write_killable+0xe9/0x2d0 [ 167.078410][ T3240] ? __cfi_down_write_killable+0x10/0x10 [ 167.078425][ T3240] vm_mmap_pgoff+0x38f/0x4e0 [ 167.078446][ T3240] ? __cfi_vm_mmap_pgoff+0x10/0x10 [ 167.078466][ T3240] ? __fget_files+0x2c5/0x340 [ 167.078482][ T3240] ksys_mmap_pgoff+0x166/0x1e0 [ 167.078503][ T3240] __x64_sys_mmap+0x121/0x140 [ 167.078524][ T3240] x64_sys_call+0x13bf/0x2ee0 [ 167.078544][ T3240] do_syscall_64+0x58/0xf0 [ 167.078560][ T3240] ? clear_bhb_loop+0x50/0xa0 [ 167.078580][ T3240] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 167.078600][ T3240] RIP: 0033:0x7f2d9758ebe9 [ 167.078612][ T3240] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 167.078624][ T3240] RSP: 002b:00007f2d9835c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 167.078640][ T3240] RAX: ffffffffffffffda RBX: 00007f2d977b5fa0 RCX: 00007f2d9758ebe9 [ 167.078660][ T3240] RDX: 0000000001000002 RSI: 0000000000400000 RDI: 0000200000000000 [ 167.078670][ T3240] RBP: 00007f2d9835c090 R08: 0000000000000003 R09: 0000000000000000 [ 167.078679][ T3240] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 167.078688][ T3240] R13: 00007f2d977b6038 R14: 00007f2d977b5fa0 R15: 00007ffc0e6a9178 [ 167.078701][ T3240] [ 167.078846][ T36] audit: type=1400 audit(1754896562.473:676): avc: denied { open } for pid=3239 comm="syz.0.1042" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 167.434064][ T3250] overlayfs: conflicting lowerdir path [ 167.440477][ T3250] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 167.490551][ T788] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 167.640542][ T788] usb 3-1: Using ep0 maxpacket: 32 [ 167.646943][ T788] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 167.655095][ T788] usb 3-1: config 0 has no interface number 0 [ 167.662661][ T788] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 167.671849][ T788] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 167.679859][ T788] usb 3-1: Product: syz [ 167.684064][ T788] usb 3-1: Manufacturer: syz [ 167.688850][ T788] usb 3-1: SerialNumber: syz [ 167.694151][ T788] usb 3-1: config 0 descriptor?? [ 167.700372][ T788] smsc95xx v2.0.0 [ 167.899807][ T3263] loop7: detected capacity change from 0 to 7 [ 167.906787][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 167.915984][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 167.924063][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 167.933256][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 167.941316][ T332] loop7: unable to read partition table [ 167.948242][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 167.956683][ T3263] loop7: unable to read partition table [ 167.962688][ T3263] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 168.280560][ T66] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 168.311371][ T3237] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 168.318590][ T3237] rust_binder: Write failure EINVAL in pid:599 [ 168.381636][ T788] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000030: -71 [ 168.399006][ T788] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error writing E2P_CMD [ 168.408693][ T788] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 168.419642][ T788] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -71 [ 168.428836][ T788] usb 3-1: USB disconnect, device number 36 [ 168.441604][ T66] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 168.457846][ T66] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 168.468486][ T66] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 168.478077][ T66] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 168.492418][ T66] usb 1-1: SerialNumber: syz [ 168.576552][ T3278] rust_binder: Error while translating object. [ 168.576600][ T3278] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 168.582864][ T3278] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:262 [ 168.665545][ T3282] tipc: Started in network mode [ 168.679638][ T3282] tipc: Node identity d229e9edd005, cluster identity 4711 [ 168.686946][ T3282] tipc: Enabled bearer , priority 0 [ 168.694448][ T3282] tipc: Disabling bearer [ 168.708943][ T66] usb 1-1: 0:2 : does not exist [ 168.714273][ T66] usb 1-1: unit 5: unexpected type 0x0a [ 168.722245][ T66] usb 1-1: USB disconnect, device number 44 [ 168.732107][ T2048] udevd[2048]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 168.948518][ T3292] loop7: detected capacity change from 0 to 7 [ 168.955414][ T2048] loop7: unable to read partition table [ 168.962080][ T3292] loop7: unable to read partition table [ 168.967865][ T3292] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 169.236383][ T3296] FAULT_INJECTION: forcing a failure. [ 169.236383][ T3296] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 169.249705][ T3296] CPU: 1 UID: 0 PID: 3296 Comm: syz.0.1064 Not tainted 6.12.38-syzkaller-gc46482c03ae9 #0 80b02ff89b1607ee1d115e0157270f38c0251e02 [ 169.249732][ T3296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 169.249742][ T3296] Call Trace: [ 169.249748][ T3296] [ 169.249756][ T3296] __dump_stack+0x21/0x30 [ 169.249781][ T3296] dump_stack_lvl+0x10c/0x190 [ 169.249801][ T3296] ? __cfi_dump_stack_lvl+0x10/0x10 [ 169.249823][ T3296] dump_stack+0x19/0x20 [ 169.249851][ T3296] should_fail_ex+0x3d9/0x530 [ 169.249886][ T3296] should_fail_alloc_page+0xeb/0x110 [ 169.249909][ T3296] __alloc_pages_noprof+0x19b/0x7b0 [ 169.249929][ T3296] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 169.249949][ T3296] ? __kasan_check_write+0x18/0x20 [ 169.249972][ T3296] ? prep_new_page+0x1c/0x120 [ 169.249989][ T3296] ? get_page_from_freelist+0x48ce/0x4960 [ 169.250010][ T3296] ? arch_stack_walk+0x10b/0x170 [ 169.250034][ T3296] pte_alloc_one+0x97/0x520 [ 169.250048][ T3296] ? __cfi_pte_alloc_one+0x10/0x10 [ 169.250063][ T3296] ? pagerange_is_ram_callback+0xf4/0x150 [ 169.250079][ T3296] __pte_alloc+0x79/0x420 [ 169.250101][ T3296] ? __cfi___pte_alloc+0x10/0x10 [ 169.250129][ T3296] ? pat_pagerange_is_ram+0xf4/0x140 [ 169.250173][ T3296] ? cattr_name+0xc0/0xc0 [ 169.250197][ T3296] remap_pfn_range_notrack+0x8d0/0xb00 [ 169.250215][ T3296] ? __cfi_remap_pfn_range_notrack+0x10/0x10 [ 169.250230][ T3296] ? __vma_start_write+0x93/0x110 [ 169.250246][ T3296] ? track_pfn_remap+0x2b9/0x340 [ 169.250261][ T3296] remap_pfn_range+0xf1/0x170 [ 169.250276][ T3296] ? __cfi_remap_pfn_range+0x10/0x10 [ 169.250291][ T3296] usbdev_mmap+0x47e/0x8b0 [ 169.250316][ T3296] ? __cfi_usbdev_mmap+0x10/0x10 [ 169.250338][ T3296] ? __asan_memset+0x39/0x50 [ 169.250362][ T3296] mmap_region+0x136e/0x1bc0 [ 169.250405][ T3296] ? __cfi_mmap_region+0x10/0x10 [ 169.250432][ T3296] ? __kasan_check_read+0x15/0x20 [ 169.250454][ T3296] ? arch_get_unmapped_area_topdown+0x232/0x8d0 [ 169.250484][ T3296] ? file_mmap_ok+0x147/0x1a0 [ 169.250510][ T3296] do_mmap+0xb6d/0x13c0 [ 169.250533][ T3296] ? __cfi_do_mmap+0x10/0x10 [ 169.250555][ T3296] ? down_write_killable+0xe9/0x2d0 [ 169.250570][ T3296] ? __cfi_down_write_killable+0x10/0x10 [ 169.250586][ T3296] vm_mmap_pgoff+0x38f/0x4e0 [ 169.250610][ T3296] ? __cfi_vm_mmap_pgoff+0x10/0x10 [ 169.250633][ T3296] ? __fget_files+0x2c5/0x340 [ 169.250651][ T3296] ksys_mmap_pgoff+0x166/0x1e0 [ 169.250674][ T3296] __x64_sys_mmap+0x121/0x140 [ 169.250697][ T3296] x64_sys_call+0x13bf/0x2ee0 [ 169.250720][ T3296] do_syscall_64+0x58/0xf0 [ 169.250738][ T3296] ? clear_bhb_loop+0x50/0xa0 [ 169.250762][ T3296] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 169.250785][ T3296] RIP: 0033:0x7f3df658ebe9 [ 169.250799][ T3296] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 169.250812][ T3296] RSP: 002b:00007f3df742f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 169.250830][ T3296] RAX: ffffffffffffffda RBX: 00007f3df67b5fa0 RCX: 00007f3df658ebe9 [ 169.250842][ T3296] RDX: 0000000001000002 RSI: 0000000000400000 RDI: 0000200000000000 [ 169.250854][ T3296] RBP: 00007f3df742f090 R08: 0000000000000003 R09: 0000000000000000 [ 169.250865][ T3296] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 169.250875][ T3296] R13: 00007f3df67b6038 R14: 00007f3df67b5fa0 R15: 00007ffc9b033bd8 [ 169.250889][ T3296] [ 169.583963][ T3296] ------------[ cut here ]------------ [ 169.589489][ T3296] WARNING: CPU: 1 PID: 3296 at arch/x86/mm/pat/memtype.c:983 untrack_pfn+0x450/0x540 [ 169.599020][ T3296] Modules linked in: [ 169.602970][ T3296] CPU: 1 UID: 0 PID: 3296 Comm: syz.0.1064 Not tainted 6.12.38-syzkaller-gc46482c03ae9 #0 80b02ff89b1607ee1d115e0157270f38c0251e02 [ 169.616534][ T3296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 169.626660][ T3296] RIP: 0010:untrack_pfn+0x450/0x540 [ 169.631917][ T3296] Code: 00 00 fc ff df 0f 84 a8 00 00 00 e8 aa 7e 3f 00 4c 8b 74 24 10 4d 85 f6 0f 85 bf fe ff ff e8 97 7e 3f 00 eb 47 e8 90 7e 3f 00 <0f> 0b 49 bd 00 00 00 00 00 fc ff df eb 34 e8 7d 7e 3f 00 4c 8b 7c [ 169.651594][ T3296] RSP: 0018:ffffc90000fcf2e0 EFLAGS: 00010293 [ 169.657678][ T3296] RAX: ffffffff81465ea0 RBX: 1ffff920001f9e60 RCX: ffff88811ae00000 [ 169.665780][ T3296] RDX: 0000000000000000 RSI: 0000000000000028 RDI: 0000000000000020 [ 169.673801][ T3296] RBP: ffffc90000fcf3f0 R08: ffffc90000fcf377 R09: 0000000000000000 [ 169.681922][ T3296] R10: ffffc90000fcf350 R11: fffff520001f9e6f R12: ffffc90000fcf340 [ 169.689920][ T3296] R13: 1ffff11024c4e968 R14: 0000000000000028 R15: 0000000000000000 [ 169.698393][ T3296] FS: 00007f3df742f6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 169.707378][ T3296] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 169.714115][ T3296] CR2: 00007f3df67b7dac CR3: 000000010d33a000 CR4: 00000000003526b0 [ 169.722189][ T3296] DR0: fffffffffffffff8 DR1: 0000000000000006 DR2: 0200000000000000 [ 169.730195][ T3296] DR3: 0000000000000005 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 169.738224][ T3296] Call Trace: [ 169.741543][ T3296] [ 169.744493][ T3296] ? __cfi_untrack_pfn+0x10/0x10 [ 169.749454][ T3296] ? lru_add_drain_cpu+0x2f7/0x430 [ 169.754606][ T3296] ? uprobe_munmap+0x181/0x490 [ 169.759398][ T3296] ? tlb_gather_mmu+0x236/0x300 [ 169.764434][ T3296] zap_page_range_single+0x462/0x470 [ 169.769745][ T3296] ? __cfi_zap_page_range_single+0x10/0x10 [ 169.775671][ T3296] ? pagerange_is_ram_callback+0xf4/0x150 [ 169.781446][ T3296] ? __cfi___pte_alloc+0x10/0x10 [ 169.786423][ T3296] ? pat_pagerange_is_ram+0xf4/0x140 [ 169.791798][ T3296] ? cattr_name+0xc0/0xc0 [ 169.796185][ T3296] remap_pfn_range_notrack+0x9be/0xb00 [ 169.801723][ T3296] ? __cfi_remap_pfn_range_notrack+0x10/0x10 [ 169.807724][ T3296] ? __vma_start_write+0x93/0x110 [ 169.812807][ T3296] ? track_pfn_remap+0x2b9/0x340 [ 169.817774][ T3296] remap_pfn_range+0xf1/0x170 [ 169.822504][ T3296] ? __cfi_remap_pfn_range+0x10/0x10 [ 169.827809][ T3296] usbdev_mmap+0x47e/0x8b0 [ 169.832281][ T3296] ? __cfi_usbdev_mmap+0x10/0x10 [ 169.837251][ T3296] ? __asan_memset+0x39/0x50 [ 169.841920][ T3296] mmap_region+0x136e/0x1bc0 [ 169.846545][ T3296] ? __cfi_mmap_region+0x10/0x10 [ 169.851525][ T3296] ? __kasan_check_read+0x15/0x20 [ 169.856575][ T3296] ? arch_get_unmapped_area_topdown+0x232/0x8d0 [ 169.862896][ T3296] ? file_mmap_ok+0x147/0x1a0 [ 169.867623][ T3296] do_mmap+0xb6d/0x13c0 [ 169.871824][ T3296] ? __cfi_do_mmap+0x10/0x10 [ 169.876441][ T3296] ? down_write_killable+0xe9/0x2d0 [ 169.881672][ T3296] ? __cfi_down_write_killable+0x10/0x10 [ 169.887321][ T3296] vm_mmap_pgoff+0x38f/0x4e0 [ 169.891966][ T3296] ? __cfi_vm_mmap_pgoff+0x10/0x10 [ 169.897108][ T3296] ? __fget_files+0x2c5/0x340 [ 169.901821][ T3296] ksys_mmap_pgoff+0x166/0x1e0 [ 169.906619][ T3296] __x64_sys_mmap+0x121/0x140 [ 169.911341][ T3296] x64_sys_call+0x13bf/0x2ee0 [ 169.916046][ T3296] do_syscall_64+0x58/0xf0 [ 169.920464][ T3296] ? clear_bhb_loop+0x50/0xa0 [ 169.925215][ T3296] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 169.931150][ T3296] RIP: 0033:0x7f3df658ebe9 [ 169.935607][ T3296] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 169.955264][ T3296] RSP: 002b:00007f3df742f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 169.963723][ T3296] RAX: ffffffffffffffda RBX: 00007f3df67b5fa0 RCX: 00007f3df658ebe9 [ 169.971749][ T3296] RDX: 0000000001000002 RSI: 0000000000400000 RDI: 0000200000000000 [ 169.979740][ T3296] RBP: 00007f3df742f090 R08: 0000000000000003 R09: 0000000000000000 [ 169.987744][ T3296] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 169.995760][ T3296] R13: 00007f3df67b6038 R14: 00007f3df67b5fa0 R15: 00007ffc9b033bd8 [ 170.003806][ T3296] [ 170.006832][ T3296] ---[ end trace 0000000000000000 ]---