last executing test programs: 1.952972142s ago: executing program 1 (id=31): signalfd4(0xffffffffffffffff, &(0x7f0000001400)={[0xffffffffffffffff]}, 0x8, 0x80000) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000000)=0x100000) r1 = syz_usb_connect(0x3, 0x34, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000092df5510ac05269289b201020301090222000100000000090400000103e900000907000000000000000705d77b5d"], 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000100)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xa0090199) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4050) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_int(r4, 0x29, 0xc9, 0x0, 0x0) r5 = memfd_create(&(0x7f0000000180)='\b\x9dF\xd8\b\xb3~u\xa5\"\xdc\xfdq\xf6c\r;\xfcO\x8c=\x81\xb1\x8aWpA\xd4\x98\x85K\x89>N\x8ar\x17O\x0fKR\xe2{mn\xcc\xbf2\xc0\xa7\x14\xd0\xd4\xfe/m\xdf\xb6]\xc2\xaa\x86\xec(\xf7\xcd\xa6\xd9n^.\x13*\xd4\xb8\xe8\xc4\xefb\x14Vx\xc6\xfe\x9e\xee\xe7\xd7E\xe9\t\x83\xdeNX\xec\xe66\x1b\x97$\xee\x84\x14n,B\xd5?\xe5E:+Pm\x1d\xb4\xb8\xeb\xe8Op2\x82\xc7\x0e\x97\x03\xef\x1a\xa5\x00.\x89\b!m\f\xd9\x8b$}\x9f\fX\x81\xa8\xf6\x94\xbc\xed\x80|l]\xe9\xca\xd3\xc9\xa3\x9e\x9cJI\xf1\xa2\xa0\xc4:\x00\x00\x00\x00\x00\x00\b\x00\x00', 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$binfmt_misc(r7, &(0x7f0000000b00), 0x91) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) splice(r6, 0x0, r5, &(0x7f00000002c0)=0x40000000008009, 0x4, 0x8) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000049ffe840e5130100534e0000000109021b00010000000009"], 0x0) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f00007fe000/0x800000)=nil) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000793000/0x400000)=nil) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') ioctl$KVM_DIRTY_TLB(r8, 0x4010aeaa, 0x0) r9 = memfd_create(&(0x7f0000000240)='+\x8b\x8a\xa9\x16\x11\x91J\xbc+ \x18\x17\xc2:}\xa3\x9bO\xdd\xdf\xdf\x92\xd5\xed\xb4\x17\xe5\xd6\x9a\xb2\xd8\x9ba\xde\xb2.F\xc0\x99}|\xaf\xd3\x1d\x84[*_\x9f\x9d\xb0rYP\x1b\x9f \xe0\x9cgq\x103\x89\x11\x87Rv\x169\xdf\xe3>B\x04\x00\x00\x00W\xd3\xec\xfb\xdf?\xa2\x90+\xa4!\xb2\xf2\xff\x90\a\xc3\x12\xc4;\xffh\xf1x=\xb9c\xce\x03h\xdap\x88U\x1788\x82\xd7\xfd\x83\x00Sx\x91%\x99_\xfe\xd4c\x83\x86\x0f\xa4a-\xaf\x9e\xd9\xef\xe0)]\x00F\xfa\x03\xbc4\xc4\x9a\v\x03\x8b\xa4\xf3\x8f\xf4\"\'\xd3\a9\x14H}j&~\xe9\x16\x83o\xbd\xab\xcd[\xbd\xcb\x04\xfc\xe7\xe3\x9e?\x12\xf0\xf4\x83M3\xd88\x92?@\v\xe6\xd1\xd2\xe4\xde\xdaUeJ\x9fR\xd1`\xfa\xc8\v\xed\xfd\x0e\xc8\x89W\x847\x88\x82\x94\x14\xe33\xb7H\xc8b\xd6@3F#\xb7\x04C\x8dm\t\x16a\x0fI\xf4\xfe\xf8\x06j\x19Pz&\xb8\x0f\x98`W\xdb\xc6\"81A\xa4\x8bT\xf1\xcb\xab\xa3\t\xef\xdf&\x0e\xad\x03\x123.\xc2V\xaa\xd5\xf8\xde\x8aV\xa4p{\xcez\xa2\x92\xdb8*wLO\f\x97X\x05\x9a\xc2\xe8\x85\x9d\xcb\xc8\xf0\xc4\x01\x03\xe3?\x9f1\xf4\xfb\xa5y`KB\xdf\xae#\x94C\a\x04\xea\xccG\xf2\b\x8f\xf7\xb1\xe96\x90\xf5P\xa4\'\xce\xe3\xa24\x196\xc5Q\xa1K\x95\xd6\xfal\xe9\xd1\\\r&\xb2c\xb3\x8d\xa7\xb7\xa8\x03S\xbd\xdd\b{\xae\f\x10\xc2\xbb\xd0\xdd*\xa3\xb4\fJ\x00X\xab`N; LF\xa5D\xee\xdf\x7f\x80p\xf6o\x1c\xbdXR\xf2\xa0\x81a\xa1\xe1B\x93Xn\xaf\xfc\x05?\xab\xac\x91x\xa8#\xe1\xbeQ\xd1^\x9b\xb9)\xd3\n\xf7(3!\x18\b\xc0\xaampRl\xfdQ\x03\x8c\xd5\xe4\\\xed\x9a\xd1?\xd21\xc8\x90\x1dl|\xd1\x14\xbc3\xe0\x1e\x0e\xe6\x88Y\x99K\x93\x1c@_P\x8c\xc7\x9eZ\xb74KT:\x8a\xdbJ#w\x18\x14\x00\x93\x86\xa5wo\xf6M\xe7D\xf4*\xe3X\x1d\x19\x83\xa7w\xc7+7\x89s\xed\x8a\xd7O\xdd\rhh`\xc0\xa8$\x06pu\xa0\xd0L\x0ez@I\xb8\x83\xb2f\x93j\a0I\xc8l\xe5\x9b\x06\xb5\xac`d\xa3\xcf/\x14\x10\xab\xab\t\xec\xc1c\fA\xaf\x14\xef\xbap@*7\x86\xdf\',\x03Y\xb1$\xf0\xb5}\xf0\x82%)9`\x8f\x04\x85m\x80\xd2\xcf@\x06}\xea\xe7w`\xa5\x11\x9f\x9b\x9e\x8f\xb7cb\x1a\xe1\xcf\x87\x1c\\\xf5\xc21\xf7\x82C*\xd5;\x00\x00\x00\x00\x03\xba\xe3\xdc\x92\'\x8e\xd5\x7fG\xfd.\x91\x89T\x99t\xd4d,\xd5\x92O\xf1\xafT!Y\x8e\\\xac\xf7\x11R\x05p\x1a\"\r\xe9\xe5\x8b&\x0f\x8c\xfb\xef\xf8\xd5\x18\xde\xeb\xe5\x19\xdd\xebQ8\xc5iS+\x06D\x16\xfe\xf5.\xe5\v\x89\xb0\"\xa3M\xe9\x81\x11P\xdb\xc4\xc2y\x14\x04\x06\xf6\f\xb0\xecz\x8d`\xb5\x9b\xb43\xcc1\xa7\x9e\xa8\xb5\'\xc6MAe\x0f\xd1\xfcG\xc2/\xe8\xe9t\xcaQ\xf1\fI\x1chM\xc1\x92\xe3\xc3\x01M\xc8/\xefJ\xcb\xd0]\f\xff\xf5\x92\xce\x97Z\xea\xe8\x99\xfa\x96\xce\xa7\x02\xad\xa2\xce\x955\xeaNg\x02\xcd\xfd\x1a}.\xd3\"x\x89/8H\xc2\x93B\na)\x86\xa9U\xa0\xb7\x18\xfb\xe9\xd1\x97', 0x3) fcntl$addseals(r9, 0x409, 0x8) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x10, r8, 0x75cf0000) modify_ldt$read_default(0x2, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x2001, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 1.440712182s ago: executing program 0 (id=43): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000800)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000dc0)=""/4092, 0xffc}, {&(0x7f0000000400)=""/190, 0xbe}, {&(0x7f0000000580)=""/55, 0x37}, {&(0x7f0000000600)=""/101, 0x65}, {&(0x7f0000002080)=""/4091, 0xffb}], 0x5}, 0x9}], 0x1, 0x40012002, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x3422e23b14c08f58, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000940)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40086315, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip_vs\x00') 1.434368372s ago: executing program 3 (id=44): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x138a, 0x1000000003}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x12, r1, 0x75e7f000) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x89f0, &(0x7f0000001440)={'bridge0\x00', 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f0000000180)=""/249, 0xee, 0x2, 0x4}, @fda={0x66646185, 0x1, 0x0, 0x35}, @fda={0x66646185, 0x4, 0x0, 0x25}}, &(0x7f0000000000)={0x18, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x800, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x138a, 0x1000000003}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) (async) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x12, r1, 0x75e7f000) (async) socket(0x400000000010, 0x3, 0x0) (async) ioctl$sock_SIOCETHTOOL(r2, 0x89f0, &(0x7f0000001440)={'bridge0\x00', 0x0}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f0000000180)=""/249, 0xee, 0x2, 0x4}, @fda={0x66646185, 0x1, 0x0, 0x35}, @fda={0x66646185, 0x4, 0x0, 0x25}}, &(0x7f0000000000)={0x18, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0}) (async) 1.340953334s ago: executing program 3 (id=45): fsopen(&(0x7f00000001c0)='devpts\x00', 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) (async, rerun: 64) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) (rerun: 64) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000006040), r4) sendmsg$NL80211_CMD_REQ_SET_REG(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000005c0)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) (async) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r6, 0x4008ae90, &(0x7f0000000080)=ANY=[@ANYBLOB="010000000000000021000080"]) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_FREEZE(r7, 0xc0046209, 0x0) (async) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bridge_slave_1\x00', 0x2}) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), r8) sendmsg$TIPC_CMD_ENABLE_BEARER(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) (async) close_range(r0, 0xffffffffffffffff, 0x0) 1.248731095s ago: executing program 0 (id=46): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x6}]}, 0x10) (async) r1 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000000480), 0x2e9, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3e, 0xfe9, &(0x7f0000000200)={@fd={0x66642a85, 0x0, r2}, @flat=@weak_binder={0x77622a85, 0x1000, 0x3}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x2, 0x28}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) 1.236880136s ago: executing program 3 (id=47): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1000000003}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xa8, 0x0, &(0x7f00000004c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff67, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/238, 0xee, 0x2, 0x4}, @fda={0x66646185, 0x1, 0x0, 0x8}, @fda={0x66646185, 0x4, 0x0, 0xfffffffffffffffd}}, &(0x7f0000000000)={0x0, 0x28, 0x48}}, 0x1000}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000200)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @flat=@weak_handle={0x77682a85, 0xa}}, &(0x7f0000000380)={0x0, 0x18, 0x30}}}, @release={0x40046306, 0x3}, @request_death], 0x0, 0x0, 0x0}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040), 0x18102, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r2, &(0x7f0000000200)=0x1, 0x12) write$binfmt_format(r2, &(0x7f0000000080)='-1\x00', 0x3) 1.149505638s ago: executing program 3 (id=48): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r1, 0x29, 0xc8, 0x0, 0xc000000) setsockopt$MRT6_ADD_MFC(r1, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}}, 0x5c) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000300)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x1}, 0x5c) close_range(r0, 0xffffffffffffffff, 0x2) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) 1.104214749s ago: executing program 3 (id=49): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0) pwritev2(r0, &(0x7f0000000100)=[{&(0x7f0000001180)="b8d01bdd4872411271f5c20d52d4af11b7babc4fe7c287008e88dffdaa4069a28afcadfaa54f6f5e837e5446015f6fafe62ebd34eea241d1c334e76f5c8994d00d69d7ef360fa7c9348decf55f42ec58bb43a92fdbecf347efc55ffb76d5daeb3cf64e6f718955546888c765b06cb683875973a1eb09c0f2a54fe776b888ad3c26cd999f6a7572c7326e2d78db5e691a57582ef3fa90df531a4fbfe2a97403349fbb61258bfff8efd3915f33b3c2210f93791da1888b3fff5292364becb76ed55856c02791135c57e40c876cfccd67abdd435fc65bcfd9a8fda40a641e63002e7a2fc5f1c0a621e181a52b7193b743cf4389bbbabe42e230143cfdf6373fac0f46bde204d34b05e75dc0104cf28e499242fe8db6296c6d11e83b71ddf77ea5d92c51a18a1786726c4bfae13350376dfd2035c2aad3ae4d0ef241762e238fd7146800b7b6fbaaaae89ed42bb1a771f727036268637db99fad6d383595da2582b87f4fa33b8d88c351da95985b9fe5d213df255732578956a9e8c4fc887619ec5701b63d1970117626baa4f173a36b48c6697a82948af3e7044842143fa607fcd88863c7e3c4669209aebaab37e2c6da67c7cab4d23db3dccd3d34c793cce1e83985777e5f5896c6855420715573f4fecd05c92533011f024ae6eafdaef25c7f30e08fbb9d81ad70260961bd20c01f6e53f72fe7f361746c86253279d5b97228a6d6cf5f38527b6bb6cc4b4b1b3c213011bf5379b5dbd17ff546dbbb9337b850cacb33440d38a57b84adf0bc6c19dc1e76901785583aa94437b244436e7a3bbf682e9377c42c39a9e15f7d5334d86bc33cc294b57e88dc3ab9a40d1c24aead60aff71e40b1d5becc10a330468869893639733c9e8afd158951dab992429c09885c0f8d1ffc82c7e7d9273c0bfee8e5c9d385bfeb2bbbb2e3395aa1134dfc373b552f4169b8a432bd1c9134387381935fb71c3292a3d0b7ae82ce0db6220cbdb1175d153a255c93084456059a78ff83657093f9196a6919886bd53b9629de2131249a9e688fa974e635b81462d80c5c76d6880f83b52d61008b76c8446695c3530d0e595573f25a643f1884652c97da82bb20f371e7c4917abe49039737d3abf78867807b0ac938296401cd48b7609f632e0d2af9a0dd114d7928b755dbcf190b98a6560945fe5c8ac5dcdeb5d626be0b03f2e94d35060e69be1e5c738b74857b09f9a59989ca8dc3977ab5590fb3f83fa3ae85d5691d43d0b44c140d3d060f63638b14c7b6117082d44bbbede3790a06a991d137f3abcfd5d91a9d6b2e8dbffa31d43c75e6d5659a810e8653babff45e3fb898a4e77143e02b55c7ca1298044cdf07bf6d202c9309881766685508ded0903cb44792aeb23cf009538e1091ecdb6726d012897cdf3f4310c6af399526e89a9f1d33f38391782e77cc5309e00935fe394ff2471cbf6aae4622ff272c6f2a1ad8c22b9326cf27a274df18320e801407339f53ca7e8a17cfdeba580a2cd179fc518db37d29cb820f4efe7c3b13e0cf43bec9c87b4d4d3857dae6d816fa3d6d03c88e496bba6ae3aff856b36f494e65e1d251229fb171c536096a78b0aca4963a5d735a745b4a830973354991c704c20bd6f3930e0f99c77da50880271a2586f37a106c025f55a734188e2a671f3872343c0895632c55b134576ed1439a51fcbdc68abbfdc2101f3f8f2bab026820a3565ef8497aa53d54835b9b4f339bcf3ebf1ba54a6a35b5e4e442aaa8045e903bdf1d5cb1c959968b632d145176f65bc0602611fbcd3c5f199ae52314ab71d17b18dc08d5d82540ad0a62af40d59d40c15230cbf2c3ffca4239bbfc450ce4de86873012e888262f137ea70e5818b674f1a7004d09bce306f6ec0b74e4372c5df6149bba1c5cf10f003a23b1d7889789b65753427ef5dc4ed8af1f1f4c6dd94e4b7c5c1d013cc51eaafb345d834b4acb0a85d44339e7302c2f0e39a1a14b5ca32cfebbd97d24ac84ae84d7bbecaa302a33d035cf9370205c12f035fbe4504125bd2c4a84566b5eea1b8312ce6450262a3b641e8a3e9b729513cf90cbf945c8155bf5625f13858a85a799f4e83a5efaa8c352dc346267bd76f2a19769d95643ff32c9d3e25c5bdab78a2f9f2f8e210e6539ccb1544f5d982f6fa6009842df36f18d949d9bf8d133d6e1272138ded39fcf1134b080ef471b066b02d22dc2d8d9e91fc8119eec1e560952599f24524deab46ec23c77a5963a621f1dd2361fea0591db177812d7859c234a07b2baae7a5d14f89531cfada0ed6a3e780777bbb892cc88f0a7468a9ab547fc1ed11f4679dd0369233f88b1280bedc11edb4d8f91cb5ed23d24280db77247fb0ec992acce1dd5a07e8c6e56a7f02f94fd8353f6ff8aff6ef199fe4ae1bd59b4edd60d11de8dae2886ba93ef10d5429a13dac63dad9f8b0b0db64129f00d37cc1d39097ca5e95f50b868bdd46ed00e8f1bce3e790162bdb39a456f42710084f398aa1891f37ccaf2add940e4bcb182eca3bdca97ad5a819a76d547b87cb24963c714d2dbdc3032ae531e5898bbe152167052cc3b46f343266f2dfafa95857089c79d22615ea818a83b6e5c0921d43aed95034728b1de26948c1fee40ff2dc6c54d3124ad1545c5f1012973e013e5b5be2f2bc7651f4bd92cd59e07a7d3e19b74a128474c58f8531eb9bc9a098965f780b81b162c2a57638b99362710d7571f6c682d34654606bc06d28a2ee5f0be68340682adc9d82c14e93b38a9cb47b7f069b8ae5bdc8e894157c13317f3272f9608d40c237bea2cd92a85a3bcd0b52f803ece705d118779a911e051ef285a1c3d4605bedb54d849165e0b91e6e180f37e9266d7bae8aa2c958de969d9e062ce137428938e68d21839f73c322fac43a6cc06ff71221abdd896e5b80014e32a12c519f4920e17a4f28c2810b332de234189eb0b598d2a36eeb79502a38f61b70b771120317779a45ddbe17c1ecab7e4d95e698dc49169371618f346e06e4bd92e9d6cc6e57403e307d25a8e9d224514eac6dddf68099a05ef5c0ddd558e4ec3d94d9d47ceeb202642171b3058a8b95f93b85120dc6d6317dfc526c710dbbe4a3a773c3e9f4c1e6ad7e1d47ee561b481130870e6c0312726ed25a91b0be649b9b1f569702f6a136e5b1231fe07beb2a96f2cb4d9f4529c58ee95fc690d54e4dba2f09f191b00efdce64be736095ea79aa2174b0f976aaa72adea94ea7ae88ed1af887b16b9ceba72aa9a8726e7b4ba9ebc83004a36a46cf68141bfb1d02240828640e0e0c5aed0ba49e3a49cfa2a04f062dee353fd0eb40103434591ce87a1ae31d0a5ba49d38e8df3a251da72e501623bfe10bb39c26af56e5089bbbd03866866c60227575b3fc4b8b08ec88d99eafd2391648198c1513416b52679e736de2766003730aba3508e4916cc3ad74f23d43363143b692f49c83eea528a8c61ca8d99814d5467051e413d745245b551dbeb1100c46e624c626330c8e3fef2c6759936d2389bae265073ff1afa4822b2ba2a54269791b87bc30bc179cced98104718a1f0e5cfef207df3bb792e33911e2c3bfa0e58cc4d8146f599ec1e7264ee4e6503d61dcebd6043d6869726cd93452f46c219402a71965c44b3015cbb3edbdcea34c4570d6db18f98cfabc6636ea0d76f02c40f503dd63649645ac4f58b2284202da8e3a22e52e7fd17624ed678af08952dc4367c75317dba23808bbbb45248d075b027a349a194832e658dbbeb69462c356cc5734a7219175a9e698fdd70c3fcc33c86f78fb06643c03ec6d9abc6591fb0520b90bdd6d93f46de186fca39072f4c458446b2e2d4a7a31f6771544445a3ec030e12e6d13c355930ba32b4012b09887dc6aae2662f69368b57802138da5f6014b1a0a4482c40d00df74fd670769477f16d657dd8a20523ddaa24955270dbd0f210c23d53375cb9e2413f0f4f6966b3374df7186cec1dd66e6b04d4186f626e73bddeffe58630fb30b231b4dcfee13c2c8a70948504b757e4006379f0844b17e99d4b600a097e2dcc15d4b8527c7a5fa1dd2b512cb31c954c90cd5333bc273879b87a0cd8c595e8ac4cc8bf0681b81da9daf04a30a42755aaa6736f6ef0055376fb5d48b69716c4ee175edd2bebcc6d154c8b221b2d62fbfe3a63b9e26126daa68f840644b16a8605cf94614d758bef550c55634b63cde197b98a55cc9c432e5c00bd081cd743f82cdb2474dbadac69ee2b666e2595f5e6e8f948cc9ffe4e9bedff5f6c339a451e5c043fb6ff5f415f97445d44f5d775569c48cf9ffa45a9f78c2cd795c6a0e0ef766737855fdf0a5c1e4778c75c9574d10b27f790ea3b7a6677a5b0437ad01ce6ba6c5eca49b2a635a60e6b055059864af579d4e36f075208d3be42ec5891c63123d29974c108253bfcb98d6bddfdc5f75cffa6f3e58e7689b86d2bad98224d09b4bff4bba299bffd564776da50ae4b2c0e7adf0eee4c44d15ed34c86a7745829b166e44e4c5925c9ab84680ed74e67c18b5285feb49bee907d668a61586591bdbff3c6853e038fcfbd48bed7ed41c9ccd5dc474469e2a25026d28186e106874d6d526ddd9e9d11f355ff4a5e9da006a985e7c78ebb08e2192f6275d8873df0935077d6b9909bc18b22e48f0fd2775b84e436b006101e0f936b2701331e341d536f0b1208a72991ef7bd2dfb96a6e440056e7bc7bcb03cc0d6a302e490491eea48c3edcf8bbf3c3f82d22871673e406a73e3a8d96a5a912bae647b3b43191299342454f455a037e4476393b1a8e5db4a3dc4867ebe49cd9184cbff7e1a23ab7a8399b0ef65c4b41aed6b0869799b6f8bb74b8930d2b050733ba34465c6181aa7cdf3f2ebc0cd088705cce68d28b5fcc3d2915dfd5d397710f67f6e47318557c33d75f0bd87b2ffa8f6ea8b8b71575fade4d8c47f942653b08873855979c832a76189e9b4ec622004c2b171db12b095b31f4e0c2dccea3f088eeb34700f6b364f5c1e3c5f2798775f865ba849006ea38eecdb331b91ab676681ba6ebd3c13cfe61537997fd7b9b0d659fc08b4d97eb16b50dfa61dfa4ea58edf038dbfc91ad6670db7b5b9828776dbb38d19e54dff978d79dd40a7bf60a8eb0f88c8ebbb1b90263ac7ef08df5e609aaff448ba88ba6e7c5db11e44a8b04fa0a704dcf01bb6e4d2b0b13cdc7cbeff8f75fc4875376170cc3d0302bf831d7b2b85386f40168b69db228d383ddbfd23aae41263a97b5e8cb9ff5b4239ec35fd85c2f9ebac0635191ef0fc389a1def8d36dc8f462c171de4dd8327e52f066f1b8b3fd9a5550d9627eaf9d4248e99202639150fe13a646e8b038f0f8ac8a9b0af35e1f779ec52683320c97d92f0e36f36c9c0c57c21f4f5d75ef4747e27a8e6718f35ef01cddf597a8f7e2933970bca98534b1d97dd9158a09d33d9bbd01e01eeb343821476c531e3984077bd7ff7cb6ddaeec3b97789c9756eb58a20916a00b909c1daeaa2691d08cc84f748e9b17b895b095879b61330d3de7995c8400ab057974d10078aadda9fa57d1ee198c741cf376dc50063970ff6fa413c88f99ca97fc63288e0e8be565bc9802ac28e7ecf5d0dfdbdb9d67e56e5edbedb6692987d28c21f5f4da6b28de7b0de545fa7da141a34e956ab9491e18f56d3776ae6e3db8111f2dbfd505fc288786734174af3ba7a08f638332ef06d21ef368315074ee99351dc6975a7427f0648f781fb5b85b237b502d88492924f2c05c2177ae02a6a702d492f1cadb75cb904d4f521f5da989f7879c16a73252f076f5842a8c", 0x1000}, {&(0x7f0000000240)="b20d6d07701a5c3f012271d9ea8323e06a164b55d37275af502d65ca58a5a26d3fcc61343b8d2c008c17cf1e95839e1603f657a13eb011c9bf5a7b802da8518d21b057815b5c9d316e9060315a009cb96b19345d4d0f95f45e085133cebe76cc09e3afb74c97e6d6704a1f6e60b81137523534c7e2ee855d3c596d0d271ff27aa6c86b69974e20e8d20a59de435f0f907c8b65819d661210a4571eca8f85819c4c149b646c74b76b430180053d795d36af71e3b4124c1c08ec57b79f39a687ee60f31658859aa5a38546c7eb0f0f4629487644002e0f5df2905a449bbd78173380aaefe749ad7ab5e2cf1fab188dfb7915cbc8f5b33bba", 0xf7}], 0x2, 0x2, 0x7, 0x4) r1 = open(&(0x7f0000000100)='./file0\x00', 0x80ff, 0x36) epoll_wait(r1, &(0x7f0000000140)=[{}], 0x1, 0x0) (async, rerun: 64) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (rerun: 64) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_SET_IRQCHIP(r5, 0xae64, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000340)=ANY=[@ANYBLOB="0100000000000000590200000000000000000080000000003889020b80adb6020c78f21a1e64858e173e8a8ee91af9f5a8bce80694d88e990f094c2324548beaa1f0d45eb19823eab70962e7737f3448b9c0a1edb5f0ea52d6c2d28ad55a71e7a705ac2c1e333b1e88eda33b7ccaa12ece78668328324a74547af61e4630e82f3dc1c9ed298500c3a2d36fe3deed73be12258bcefba83ed8872b3c5007caca5b5ed06c67dedfef6489044e8cdd2b7a0f0d67764638"]) (async) r6 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r6, 0x107, 0xa, 0x0, &(0x7f00000000c0)) (async) r7 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x646401, 0x0) signalfd(r7, &(0x7f0000000040)={[0x5]}, 0x8) (async, rerun: 32) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) (async, rerun: 32) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') read$eventfd(r9, &(0x7f0000000080), 0x8) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffd, 0xe00, 0x0, 0x0, 0x6, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xffffffffffffff20}) (async) r10 = openat$cgroup_ro(r9, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000a, 0x28011, r10, 0x0) (async, rerun: 64) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r8, 0x40046210, 0x0) (rerun: 64) 1.06985043s ago: executing program 0 (id=50): r0 = gettid() ptrace$ARCH_FORCE_TAGGED_SVA(0x1e, r0, 0x0, 0x4004) prctl$PR_MCE_KILL(0x29, 0x0, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@nfs_export_on}]}) chdir(&(0x7f00000001c0)='./bus\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) 933.600892ms ago: executing program 0 (id=51): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x400001000001fe) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, 0x0) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x13, r0, 0x66053000) 932.663322ms ago: executing program 0 (id=52): process_mrelease(0xffffffffffffffff, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000380)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0x200003, 0x0, {0xa, 0x4e21, 0x3, @private2={0xfc, 0x2, '\x00', 0x2}, 0x1814b150}}}, 0x3a) getsockname(r2, 0x0, &(0x7f00000002c0)) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x40980, 0x0) socketpair(0x6, 0xa, 0x43, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) ioctl$KVM_SET_DEBUGREGS(r7, 0x4080aea2, 0x0) sendmsg$key(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)={0x2, 0xa, 0x8, 0x0, 0x22, 0x0, 0x70bd29, 0x25dfdbfd, [@sadb_sa={0x2, 0x1, 0x4d5, 0x2, 0x2, 0x9f}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6={0xa, 0x4e22, 0x8062, @mcast1, 0x4}}, @sadb_x_filter={0x5, 0x1a, @in=@remote, @in=@rand_addr=0x64010101, 0x3, 0x4, 0x4}, @sadb_x_nat_t_port={0x1, 0x0, 0x4e22}, @sadb_x_sa2={0x2, 0x13, 0x66, 0x0, 0x0, 0x70bd26, 0x3501}, @sadb_address={0x3, 0x5, 0x32, 0x40, 0x0, @in={0x2, 0x4e21, @rand_addr=0x64010101}}, @sadb_x_nat_t_type={0x1, 0x14, 0x2}, @sadb_x_sa2={0x2, 0x13, 0x0, 0x0, 0x0, 0x70bd27}, @sadb_x_policy={0x8, 0x12, 0x0, 0x2, 0x0, 0x6e6bbe, 0xd58d, {0x6, 0x32, 0x10, 0x6, 0x0, 0xffffffff, 0x0, @in=@loopback, @in=@dev={0xac, 0x14, 0x14, 0x3a}}}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e21}]}, 0x110}}, 0x20000004) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)=0x400011) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000300)=0x30) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r9, 0x13) wait4(r9, 0x0, 0xa, &(0x7f00000000c0)) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r8, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r8, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000300)={0x44, 0x12, 0x9, 0x0, 0x0, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0x0, 0x0, 0x0, @u64}]}, @typed={0x24, 0xe, 0x0, 0x0, @binary="d84da481ad8c72442d706fc0502872331ce7ae3d9e046f6667439902c95ce99a"}]}, 0x44}], 0x1}, 0x0) mremap(&(0x7f000000d000/0x2000)=nil, 0xfffffffffffffe74, 0x1000, 0x3, &(0x7f0000007000/0x1000)=nil) 824.075044ms ago: executing program 2 (id=53): syz_open_procfs(0x0, &(0x7f0000001580)='setgroups\x00') r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x9af00, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x5e, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x8, 0x7, 0x4000000000000e51, 0x101, 0x5479, 0x103d, 0x200000000006, 0x0, 0x32a, 0x1, 0x1, 0x1, 0x40000000009, 0x8000000000005, 0x800000068], 0x8080000, 0xdd1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000d80), 0x20000) ioctl$SNDRV_TIMER_IOCTL_TREAD64(r3, 0x400454a4, 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='exfat\x00', 0x200000, 0x0) 673.673097ms ago: executing program 2 (id=54): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)={0x14, r1, 0x701, 0x70bd2b, 0x0, {0x5}}, 0x14}, 0x1, 0x100000000000000, 0x0, 0x20004074}, 0x8010) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='ext3\x00', 0x2208008, 0x0) 617.285158ms ago: executing program 0 (id=55): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) prlimit64(0x0, 0x5, &(0x7f0000000140)={0x401, 0x201}, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000100000500010001"], 0x24}}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000010401010000000000000000000004000500010001"], 0x1c}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r4, 0x29, 0x4a, 0x0, &(0x7f0000000180)) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=ANY=[@ANYBLOB="300000001c0021002dbd7000000000000700000005000000000002000a0002"], 0x30}, 0x1, 0x0, 0x0, 0x4014}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) sendmsg$netlink(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000007d00)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="180000006a00"], 0x1c}], 0x1}, 0x4000080) recvmmsg(r5, &(0x7f0000009100)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000340)=""/158, 0x9e}, {&(0x7f0000000440)=""/198, 0xc6}, {&(0x7f0000000540)=""/192, 0xc0}, {&(0x7f0000000600)=""/201, 0xc9}, {&(0x7f0000001180)=""/4096, 0x1000}, {&(0x7f0000000700)=""/157, 0x9d}, {&(0x7f00000094c0)=""/4098, 0x1002}, {&(0x7f0000000240)=""/24, 0x18}, {&(0x7f00000007c0)=""/78, 0x4e}, {&(0x7f0000000280)=""/37, 0x25}], 0xa, &(0x7f0000000900)=""/5, 0x5}, 0x6}, {{&(0x7f0000000940)=@xdp, 0x80, &(0x7f0000000a80)=[{&(0x7f0000000a00)=""/83, 0x53}, {&(0x7f0000003180)=""/4096, 0x1000}, {&(0x7f0000002180)=""/204, 0xcc}, {&(0x7f0000000c80)=""/85, 0x55}], 0x4, &(0x7f0000000d00)=""/38, 0x26}, 0x7002}, {{&(0x7f0000000d40), 0x80, &(0x7f0000006440)=[{&(0x7f0000000dc0)=""/158, 0x9e}, {&(0x7f0000000e80)=""/163, 0xa3}, {&(0x7f0000000f40)=""/211, 0xd3}, {&(0x7f0000004180)=""/4096, 0x1000}, {&(0x7f0000001040)=""/246, 0xf6}, {&(0x7f0000005180)=""/75, 0x4b}, {&(0x7f0000005200)=""/24, 0x18}, {&(0x7f0000005240)=""/4096, 0x1000}, {&(0x7f0000009280)=""/264, 0x108}, {&(0x7f0000006340)=""/200, 0xc8}], 0xa, &(0x7f0000006500)=""/4096, 0x1000}, 0xd814}, {{&(0x7f0000006280)=@pptp={0x18, 0x2, {0x0, @private}}, 0x80, &(0x7f0000007800)=[{&(0x7f0000007580)=""/127, 0x7f}, {&(0x7f0000007600)=""/74, 0x4a}, {&(0x7f0000007680)=""/34, 0x22}, {&(0x7f00000076c0)=""/133, 0x85}, {&(0x7f0000007780)=""/127, 0x7f}], 0x5, &(0x7f0000006300)=""/8, 0x8}, 0x8}, {{&(0x7f0000000c00)=@in6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f0000007ac0)=[{&(0x7f0000007940)=""/115, 0x73}, {&(0x7f00000079c0)=""/214, 0xd6}], 0x2, &(0x7f0000007b00)=""/33, 0x21}, 0x1}, {{&(0x7f0000007b40)=@in, 0x80, &(0x7f0000009000)=[{&(0x7f0000007bc0)=""/4096, 0x1000}, {&(0x7f0000008bc0)=""/185, 0xb9}, {&(0x7f0000000b40)=""/150, 0x96}, {&(0x7f0000008d40)=""/240, 0xf0}, {&(0x7f0000008e40)=""/43, 0x2b}, {&(0x7f0000008e80)=""/250, 0xfa}, {&(0x7f0000008f80)=""/97, 0x61}], 0x7, &(0x7f0000009080)=""/116, 0x74}, 0x4}], 0x6, 0x40000000, 0x0) ioctl$sock_SIOCGPGRP(r5, 0x8904, &(0x7f0000006240)) sendmsg$IPSET_CMD_TEST(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000ac0)=ANY=[@ANYRES64=r3], 0x14}, 0x1, 0x0, 0x0, 0x20008490}, 0x404000c) r7 = accept4$unix(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000180)=0x6e, 0x0) close_range(r1, r7, 0x2) close_range(r0, r2, 0x2) setrlimit(0x1, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = syz_create_resource$binfmt(&(0x7f0000000000)='./file1\x00') r9 = openat$binfmt(0xffffffffffffff9c, r8, 0x42, 0x1ff) write$binfmt_script(r9, &(0x7f0000000080)={'#! ', './file1'}, 0xb) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x9) r10 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r10, 0x89f0, &(0x7f0000000140)={'sit0\x00', &(0x7f00000002c0)=@ethtool_pauseparam={0x13, 0x9, 0x7f, 0x1}}) ioprio_set$uid(0x3, 0x0, 0x0) sendfile(r0, r0, 0x0, 0x7ffff000) 615.238018ms ago: executing program 2 (id=56): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000440)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, &(0x7f0000000200)=""/183, 0xb7, 0x2, 0x16}, @flat=@weak_handle={0x77682a85, 0x100}, @flat=@weak_handle={0x77682a85, 0x5}}, &(0x7f0000000080)={0x0, 0x28, 0x40}}}], 0x50, 0x0, &(0x7f00000000c0)="70d07134252032b13c6f6f6f7aaa12b1c0578b26dfe3b2b741205dad1d02a2a4524d5b0d2b225871a4b865d995f95d6aa99c4901dbf986b562794f45f28d37773ab5417f6282e980021d25789ea8edc9"}) 589.106659ms ago: executing program 2 (id=57): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x8000000000000000) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/meminfo\x00', 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 515.53373ms ago: executing program 1 (id=58): r0 = socket(0xa, 0x3, 0xff) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x47df, @local, 0x2}, 0x1c) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) r3 = pidfd_getfd(r2, r2, 0x0) setns(r3, 0x66020000) (async) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) (async, rerun: 32) r4 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x80001) (rerun: 32) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file7\x00', 0x16c) (async, rerun: 32) renameat2(0xffffffffffffff9c, &(0x7f0000000440)='./file7\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x0) (async, rerun: 32) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) (async) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) (async) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000800), 0x161200, 0x0) ioctl$int_in(r5, 0x5452, &(0x7f0000000040)=0x7fffffffffffffff) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0xc001, 0x0) (async) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 441.573312ms ago: executing program 1 (id=59): mount$binderfs(0x0, &(0x7f0000000000)='./binderfs2\x00', 0x0, 0x10864, &(0x7f00000000c0)=ANY=[@ANYRES64=0x0, @ANYRES64=0x0]) (async) mount$binderfs(0x0, &(0x7f0000000000)='./binderfs2\x00', 0x0, 0x10864, &(0x7f00000000c0)=ANY=[@ANYRES64=0x0, @ANYRES64=0x0]) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0x770a, 0x2) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000040)={0x2, 0x3}) 441.303622ms ago: executing program 1 (id=60): r0 = syz_open_procfs(0xffffffffffffffff, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0xffffc000) socket$nl_sock_diag(0x10, 0x3, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x7, &(0x7f0000000140)=0x8, 0x4) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$MRT_ASSERT(r0, 0x0, 0xcf, &(0x7f0000000040), 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000100)={0x1c, 0x2, 0x3, 0x101, 0x0, 0x0, {0x4, 0x0, 0x4a}, [@NFQA_CFG_CMD={0x8, 0x1, {0x2, 0x0, 0x2a}}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4048841}, 0x400) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c0000000203030100000000000000000400000a"], 0x1c}, 0x1, 0x0, 0x0, 0x40841}, 0x2000c010) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000000203810100000000edffffff0200000a0800010002000008"], 0x1c}, 0x1, 0x0, 0x0, 0x20080041}, 0x20008090) ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000000)=""/23) connect$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) read$FUSE(r0, 0x0, 0x0) 439.468362ms ago: executing program 2 (id=61): r0 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) pread64(r0, &(0x7f0000000100)=""/174, 0xae, 0x553) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167342, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r2 = open(&(0x7f00000000c0)='.\x00', 0x10000, 0x0) getdents(r2, &(0x7f0000001fc0)=""/184, 0xb8) readahead(r1, 0x4, 0x4058) 420.765662ms ago: executing program 1 (id=62): r0 = socket$inet(0x2, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000003e40), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x34, r2, 0x1, 0x70bd2e, 0x25dfdbfe, {}, [@ETHTOOL_A_CHANNELS_TX_COUNT={0x8}, @ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bond\x00'}]}]}, 0x34}}, 0x400c810) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) sendmmsg$inet(r0, &(0x7f0000000bc0)=[{{&(0x7f0000000180)={0x2, 0x4e23, @empty}, 0x10, 0x0}}], 0x1, 0x20004840) sendto(r0, &(0x7f0000000200)='3x', 0x2, 0x20008895, 0x0, 0x0) shutdown(r0, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r0, 0x0, r3, 0x0, 0x7ffff000, 0x0) r4 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x101400, 0x0) ioctl$ASHMEM_SET_SIZE(r4, 0x40087703, 0xfffffffa) mmap(&(0x7f0000701000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) r5 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040), 0x103081, 0x0) ioctl$ASHMEM_SET_NAME(r5, 0x41007701, &(0x7f00000000c0)='DE\b\x93>\xe4\xc0CR\xb2\xf0V\x9e`k\xb4\x1e\xd1/Xf\xbf\xf6%\xb8m}v\x82B\xbc\xca]\x05\x9cW\x81\xba\xdfm`\x0e\nA\xe3\xd7;\xcc\xed\xa3#\x8a\x93X]\xa67\xcd\xa3=1\xc3\x0f\x87r)tz\"n\xad\x1cP\x81\xdd\x1ei+\xec\xac\a\xed(\xfb\xc7\xb9\x9b\xf7\xd6\xe5pV\xaf\xec$(I+C\x80\xb9R\xae\x81\x13(\xa4\xfe^\xb8S\x87\x1c)\xdc\x95#\xd5G\xd2\xa3\x01\x92`\xb5N\xf9\xa9F>\xbc,\x19GxF\xe1j\xf8\xb3\x97#?\x91\x04\x87\xd5\xd4\xdezw\xdc\xe3\xe9\t\x92\xc0\x1fz\x02\x9a\xe6\x05\xb1\x14\x9f\xad\xfb\x81') 382.464013ms ago: executing program 1 (id=63): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='smaps_rollup\x00') (async) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='smaps_rollup\x00') lseek(r0, 0x38, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) (async) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000080)=0x11) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000080)=0x11) statx(r0, &(0x7f0000000680)='./file0\x00', 0x800, 0x8, &(0x7f00000006c0)) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'macvlan0\x00', 0x84aebfbd6349b7f2}) ioctl$TUNSETIFINDEX(r3, 0x400454da, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000100)=ANY=[@ANYRESHEX=r2], 0x0) dup3(r0, r1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x402, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) tee(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x8000000, 0x19) (async) madvise(&(0x7f0000000000/0x2000)=nil, 0x8000000, 0x19) r5 = userfaultfd(0x80001) sendmsg$AUDIT_ADD_RULE(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000240)={0x430, 0x3f3, 0x400, 0x70bd2b, 0x25dfdbfb, {0x0, 0x2, 0x13, [0x1, 0x6, 0x8, 0x5560, 0x2, 0x6000000, 0x7215, 0x0, 0x6, 0x83400000, 0x1, 0x1, 0x3, 0x6, 0x5, 0x4, 0x3, 0x1000, 0x3, 0xff, 0x1, 0x8a, 0x5, 0x9, 0x4, 0xb377, 0x800, 0x7, 0x0, 0x10000, 0xfffffffd, 0x1, 0x1, 0x15, 0x2, 0x4, 0x1, 0x1, 0x200, 0x2, 0x45, 0x6, 0x3, 0x2, 0x0, 0x3, 0x2, 0x0, 0x80000000, 0x80000000, 0x84, 0x8, 0x9, 0x400, 0x8, 0x1, 0x4, 0x6, 0xffff, 0x1000, 0x10, 0x10000, 0x2, 0xff], [0x8b, 0x1, 0x1000, 0x38f3, 0x3, 0xffffffff, 0x7fff, 0x2, 0x7, 0x8001, 0x7, 0x10000, 0x4, 0x121, 0x9, 0x74f, 0x9, 0x8, 0x80000000, 0x5, 0x8, 0x800, 0x9, 0x3, 0x10000, 0x7fff, 0x100, 0x594, 0x5, 0x1, 0x5, 0x10000, 0x6, 0x5, 0x8, 0x1, 0x800, 0x2, 0x5, 0x8001, 0xcf1, 0x5, 0xfffffffb, 0x4, 0x65, 0x9, 0x7fff, 0x0, 0x0, 0xb43, 0x316, 0x5, 0xfffffffb, 0x5, 0x2, 0x3, 0x94f6, 0x4, 0x7fffffff, 0x1, 0xfffffff9, 0x9, 0x48, 0x4b], [0x10, 0x10000, 0x3, 0x10, 0x8, 0x7, 0x7, 0xd596, 0x82, 0xe0f, 0x8, 0x9, 0x3, 0x10000, 0x81, 0x9, 0x1, 0x5, 0x4, 0x0, 0x7, 0x9d43, 0x496, 0x394, 0x101, 0x5, 0x2da, 0xfff, 0x3e21, 0x8f0, 0xe2, 0x0, 0x8000, 0x17b1, 0x8, 0xfff, 0x5, 0x537, 0x1e982d79, 0x9, 0x80, 0x8000, 0x2, 0x7fff, 0x7, 0x4, 0x6, 0x3, 0x2, 0x400, 0xfa, 0x3, 0x80000001, 0x7ff, 0x10001, 0x9, 0xf5c, 0x6, 0x400, 0x0, 0x5, 0xfffffffb, 0x10000, 0x3], [0x7, 0x7, 0x32c9, 0x3, 0x4, 0x1, 0x1, 0x9, 0x1ff, 0x10, 0x80000001, 0x5, 0xd5f6, 0x5, 0x7, 0x8, 0x9, 0xe53d, 0x200, 0x5, 0x8, 0x1, 0xf02b, 0x9, 0xfffffff7, 0x5, 0x7d5d, 0x53, 0x6, 0x3, 0x100, 0x6, 0x1, 0x6, 0x4, 0xfffff7be, 0x1, 0x2, 0x100, 0x0, 0x1, 0x6, 0x8, 0x80000001, 0x10001, 0x80000001, 0x4, 0x99, 0x0, 0x6, 0x2, 0x5, 0x2, 0x1, 0x4ae, 0x4, 0x10000, 0x8, 0x3, 0x3, 0x99d, 0x5, 0x0, 0xfffffffc], 0xd, [',\x00', '.+}*+,!.){\x00']}, ["", "", "", ""]}, 0x430}, 0x1, 0x0, 0x0, 0x4000800}, 0x4008040) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x72c}) (async) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x72c}) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) mremap(&(0x7f0000000000/0x9000)=nil, 0x600600, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) dup3(r4, r5, 0x80000) close_range(r1, 0xffffffffffffffff, 0x0) (async) close_range(r1, 0xffffffffffffffff, 0x0) 289.503415ms ago: executing program 2 (id=64): write$selinux_create(0xffffffffffffffff, &(0x7f0000000040)=@access={'system_u:object_r:gpg_helper_exec_t:s0', 0x20, '/usr/sbin/cupsd', 0x20, 0x0, 0x25}, 0x4c) r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x2a, &(0x7f0000000000)=0xb6, 0x4) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) setsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f0000000140)='yw', 0x2) recvfrom(r1, 0x0, 0x0, 0x32, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f00000000c0)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f00005e9000/0x3000)=nil, 0x3000, 0x3}) r2 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r2, 0x40087703, 0xfffffff3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1, 0x12, r2, 0x0) read(r2, &(0x7f0000000340)=""/116, 0x74) 0s ago: executing program 3 (id=65): r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r1, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000001280), 0xffffffffffffffff) (async) sendmsg$IEEE802154_SCAN_REQ(0xffffffffffffffff, &(0x7f0000001ac0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x0) (async, rerun: 64) write$selinux_load(r0, &(0x7f0000000000)=ANY=[], 0x603f) (rerun: 64) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r2, 0xc400941d, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.124' (ED25519) to the list of known hosts. [ 24.671083][ T36] audit: type=1400 audit(1759590621.750:64): avc: denied { mounton } for pid=282 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.672517][ T282] cgroup: Unknown subsys name 'net' [ 24.693842][ T36] audit: type=1400 audit(1759590621.750:65): avc: denied { mount } for pid=282 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.721229][ T36] audit: type=1400 audit(1759590621.780:66): avc: denied { unmount } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.721441][ T282] cgroup: Unknown subsys name 'devices' [ 24.830240][ T282] cgroup: Unknown subsys name 'hugetlb' [ 24.835886][ T282] cgroup: Unknown subsys name 'rlimit' [ 24.991128][ T36] audit: type=1400 audit(1759590622.070:67): avc: denied { setattr } for pid=282 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.014345][ T36] audit: type=1400 audit(1759590622.070:68): avc: denied { mounton } for pid=282 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.039164][ T36] audit: type=1400 audit(1759590622.070:69): avc: denied { mount } for pid=282 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 25.050389][ T284] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 25.071094][ T36] audit: type=1400 audit(1759590622.150:70): avc: denied { relabelto } for pid=284 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.096652][ T36] audit: type=1400 audit(1759590622.150:71): avc: denied { write } for pid=284 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.140710][ T36] audit: type=1400 audit(1759590622.220:72): avc: denied { read } for pid=282 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.166356][ T36] audit: type=1400 audit(1759590622.220:73): avc: denied { open } for pid=282 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.166677][ T282] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.418210][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.425293][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.433700][ T289] bridge_slave_0: entered allmulticast mode [ 26.440344][ T289] bridge_slave_0: entered promiscuous mode [ 26.446891][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.454151][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.461279][ T289] bridge_slave_1: entered allmulticast mode [ 26.467593][ T289] bridge_slave_1: entered promiscuous mode [ 26.619017][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.626100][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.633576][ T294] bridge_slave_0: entered allmulticast mode [ 26.639911][ T294] bridge_slave_0: entered promiscuous mode [ 26.649747][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.656804][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.663962][ T295] bridge_slave_0: entered allmulticast mode [ 26.670480][ T295] bridge_slave_0: entered promiscuous mode [ 26.679155][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.686216][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.693432][ T294] bridge_slave_1: entered allmulticast mode [ 26.699940][ T294] bridge_slave_1: entered promiscuous mode [ 26.706031][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.713179][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.720384][ T295] bridge_slave_1: entered allmulticast mode [ 26.726648][ T295] bridge_slave_1: entered promiscuous mode [ 26.748060][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.755131][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.762483][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.769579][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.780579][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.787710][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.794786][ T296] bridge_slave_0: entered allmulticast mode [ 26.801324][ T296] bridge_slave_0: entered promiscuous mode [ 26.820453][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.827789][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.834860][ T296] bridge_slave_1: entered allmulticast mode [ 26.841451][ T296] bridge_slave_1: entered promiscuous mode [ 27.035895][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.042999][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.073210][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.080310][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.088115][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.095194][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.120757][ T289] veth0_vlan: entered promiscuous mode [ 27.132013][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.139091][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.162574][ T289] veth1_macvtap: entered promiscuous mode [ 27.171213][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.178293][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.186118][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.193207][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.209612][ T294] veth0_vlan: entered promiscuous mode [ 27.242407][ T295] veth0_vlan: entered promiscuous mode [ 27.250860][ T289] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 27.256256][ T294] veth1_macvtap: entered promiscuous mode [ 27.286307][ T295] veth1_macvtap: entered promiscuous mode [ 27.312397][ T296] veth0_vlan: entered promiscuous mode [ 27.363197][ T296] veth1_macvtap: entered promiscuous mode [ 27.404622][ T341] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 27.434301][ T344] ip6gretap0: mtu less than device minimum [ 27.442578][ T344] rust_binder: 2: no such ref 1 [ 27.447470][ T344] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 27.454836][ T344] rust_binder: 2: no such ref 2 [ 27.460729][ T344] rust_binder: 2: no such ref 1 [ 27.465738][ T344] rust_binder: Write failure EINVAL in pid:2 [ 27.483619][ T347] rust_binder: validate_parent_fixup: new_min_offset=21, sg_entry.length=0 [ 27.490333][ T347] rust_binder: Error while translating object. [ 27.499139][ T347] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 27.505387][ T347] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:4 [ 27.597771][ T45] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 27.629407][ T353] ======================================================= [ 27.629407][ T353] WARNING: The mand mount option has been deprecated and [ 27.629407][ T353] and is ignored by this kernel. Remove the mand [ 27.629407][ T353] option from the mount to silence this warning. [ 27.629407][ T353] ======================================================= [ 27.665210][ T353] SELinux: security_context_str_to_sid (sysadm_u) failed with errno=-22 [ 27.737662][ T45] usb 2-1: device descriptor read/64, error -71 [ 27.822831][ T360] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 27.978082][ T45] usb 2-1: device descriptor read/64, error -71 [ 28.217587][ T45] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 28.347571][ T45] usb 2-1: device descriptor read/64, error -71 [ 28.587904][ T45] usb 2-1: device descriptor read/64, error -71 [ 28.697794][ T45] usb usb2-port1: attempt power cycle [ 28.826794][ T388] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 28.826822][ T388] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:27 [ 28.851290][ T65] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 28.987625][ T31] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 29.017619][ T65] usb 4-1: Using ep0 maxpacket: 16 [ 29.023954][ T65] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 29.034179][ T65] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 29.044632][ T65] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 29.053738][ T65] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.057592][ T45] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 29.061830][ T65] usb 4-1: Product: syz [ 29.073503][ T65] usb 4-1: Manufacturer: syz [ 29.078159][ T65] usb 4-1: SerialNumber: syz [ 29.089160][ T45] usb 2-1: device descriptor read/8, error -71 [ 29.147594][ T31] usb 1-1: Using ep0 maxpacket: 16 [ 29.154176][ T31] usb 1-1: unable to get BOS descriptor or descriptor too short [ 29.162758][ T31] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 29.173438][ T31] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 29.182558][ T31] usb 1-1: config 1 has no interface number 1 [ 29.188858][ T31] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 29.201223][ T31] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 29.210510][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.218744][ T31] usb 1-1: Product: syz [ 29.223228][ T31] usb 1-1: Manufacturer: syz [ 29.227915][ T31] usb 1-1: SerialNumber: syz [ 29.233638][ T45] usb 2-1: device descriptor read/8, error -71 [ 29.335952][ T65] usb 4-1: 0:2 : does not exist [ 29.345991][ T65] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 29.357974][ T65] usb 4-1: USB disconnect, device number 2 [ 29.370131][ T331] udevd[331]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 29.440780][ T374] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.449420][ T374] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.460837][ T31] usb 1-1: 2:1 : no or invalid class specific endpoint descriptor [ 29.472738][ T31] usb 1-1: USB disconnect, device number 2 [ 29.478739][ T45] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 29.497067][ T391] udevd[391]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 29.518603][ T45] usb 2-1: device descriptor read/8, error -71 [ 29.659114][ T45] usb 2-1: device descriptor read/8, error -71 [ 29.689793][ T395] rust_binder: Error while translating object. [ 29.689834][ T395] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 29.696061][ T395] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:33 [ 29.718030][ T397] rust_binder: Write failure EFAULT in pid:35 [ 29.767730][ T45] usb usb2-port1: unable to enumerate USB device [ 29.977593][ T36] kauditd_printk_skb: 88 callbacks suppressed [ 29.977614][ T36] audit: type=1400 audit(1759590627.050:162): avc: denied { create } for pid=405 comm="syz.0.24" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 30.006925][ T36] audit: type=1400 audit(1759590627.050:163): avc: denied { write } for pid=405 comm="syz.0.24" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 30.029063][ T36] audit: type=1400 audit(1759590627.050:164): avc: denied { getopt } for pid=405 comm="syz.0.24" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 30.049442][ T36] audit: type=1400 audit(1759590627.060:165): avc: denied { checkpoint_restore } for pid=405 comm="syz.0.24" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 30.087624][ T65] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 30.181326][ T36] audit: type=1400 audit(1759590627.260:166): avc: denied { create } for pid=407 comm="syz.0.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 30.182145][ T409] rust_binder: 15: no such ref 3 [ 30.201423][ T36] audit: type=1400 audit(1759590627.260:167): avc: denied { write } for pid=407 comm="syz.0.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 30.206529][ T409] rust_binder: 15: no such ref 3 [ 30.231093][ T409] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:15 [ 30.237571][ T65] usb 3-1: Using ep0 maxpacket: 16 [ 30.276085][ T65] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.294523][ T65] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.304813][ T65] usb 3-1: New USB device found, idVendor=0458, idProduct=5012, bcdDevice= 0.00 [ 30.314261][ T65] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.326060][ T65] usb 3-1: config 0 descriptor?? [ 30.356120][ T36] audit: type=1400 audit(1759590627.430:168): avc: denied { write } for pid=427 comm="syz.3.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 30.477058][ T36] audit: type=1400 audit(1759590627.550:169): avc: denied { setopt } for pid=446 comm="syz.0.35" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 30.549152][ T36] audit: type=1400 audit(1759590627.630:170): avc: denied { mounton } for pid=446 comm="syz.0.35" path="/syzcgroup/unified/syz0" dev="cgroup2" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 30.599087][ T455] capability: warning: `syz.0.37' uses deprecated v2 capabilities in a way that may be insecure [ 30.610281][ T36] audit: type=1400 audit(1759590627.690:171): avc: denied { execute } for pid=454 comm="syz.0.37" path="/9/hugetlb.1GB.usage_in_bytes" dev="tmpfs" ino=65 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 30.665121][ T461] 9pnet: p9_errstr2errno: server reported unknown error [ 30.752460][ T65] input: HID 0458:5012 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5012.0001/input/input4 [ 30.770555][ T9] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 30.790736][ T65] input: HID 0458:5012 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5012.0001/input/input5 [ 30.808465][ T65] kye 0003:0458:5012.0001: input,hiddev96,hidraw0: USB HID v0.09 Device [HID 0458:5012] on usb-dummy_hcd.2-1/input0 [ 30.928043][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 30.934441][ T9] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 30.957549][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 30.970489][ T9] usb 2-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 30.971386][ T378] usb 3-1: USB disconnect, device number 2 [ 30.987716][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.005468][ T9] usb 2-1: Product: syz [ 31.010078][ T9] usb 2-1: Manufacturer: syz [ 31.016379][ T9] usb 2-1: SerialNumber: syz [ 31.033490][ T9] usb 2-1: config 0 descriptor?? [ 31.088164][ T492] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 31.088204][ T492] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:67 [ 31.158627][ T496] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 31.181876][ T496] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:36 [ 31.244747][ T433] futex_wake_op: syz.1.31 tries to shift op by 144; fix this program [ 31.289000][ T9] usb 2-1: USB disconnect, device number 6 [ 31.442734][ T509] syz.0.52 (509): attempted to duplicate a private mapping with mremap. This is not supported. [ 31.532193][ T513] exFAT-fs (rnullb0): invalid boot record signature [ 31.539015][ T513] exFAT-fs (rnullb0): failed to read boot sector [ 31.545454][ T513] exFAT-fs (rnullb0): failed to recognize exfat type [ 31.674475][ T518] netlink: 8 bytes leftover after parsing attributes in process `syz.0.55'. [ 31.683490][ T518] erspan0: entered promiscuous mode [ 31.695252][ T518] Zero length message leads to an empty skb [ 31.701518][ T520] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:49 [ 31.736181][ T522] tipc: Started in network mode [ 31.751501][ T522] tipc: Node identity 8e1467b7e48c, cluster identity 4711 [ 31.759187][ T522] tipc: Enabled bearer , priority 0 [ 31.768663][ T522] tipc: Disabling bearer [ 31.941650][ T539] can0: slcan on ptm1. [ 32.187663][ T65] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 32.317580][ T65] usb 2-1: device descriptor read/64, error -71 [ 32.326092][ T561] SELinux: ebitmap: high bit 1152 is not equal to the expected value 384 [ 32.336015][ T561] SELinux: failed to load policy [ 32.342459][ T561] SELinux: ebitmap: high bit 1152 is not equal to the expected value 384 [ 32.352431][ T561] SELinux: failed to load policy [ 32.358975][ T561] SELinux: ebitmap: high bit 1152 is not equal to the expected value 384 [ 32.369054][ T561] SELinux: failed to load policy [ 32.375637][ T561] SELinux: ebitmap: high bit 1152 is not equal to the expected value 384 [ 32.385467][ T561] SELinux: failed to load policy [ 32.390822][ T561] ------------[ cut here ]------------ [ 32.396298][ T561] WARNING: CPU: 0 PID: 561 at mm/page_alloc.c:5228 __alloc_pages_noprof+0xe8/0x7b0 [ 32.405742][ T561] Modules linked in: [ 32.409707][ T561] CPU: 0 UID: 0 PID: 561 Comm: syz.3.65 Not tainted syzkaller #0 68071847e78a8b5e73ab1b858b320f4e6b4f981b [ 32.421062][ T561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 32.431287][ T561] RIP: 0010:__alloc_pages_noprof+0xe8/0x7b0 [ 32.437203][ T561] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d 22 1f ee 05 00 0f 85 be 00 00 00 c6 05 15 1f ee 05 01 <0f> 0b 31 c0 e9 b0 00 00 00 83 fb 0a 0f 87 a5 00 00 00 44 8b 64 24 [ 32.456882][ T561] RSP: 0018:ffffc9000d8bf580 EFLAGS: 00010246 [ 32.463044][ T561] RAX: 0000000000000000 RBX: 0000000000000016 RCX: 0000000000000000 [ 32.471079][ T561] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000d8bf638 [ 32.479154][ T561] RBP: ffffc9000d8bf6c0 R08: ffffc9000d8bf637 R09: 0000000000000000 [ 32.487170][ T561] R10: ffffc9000d8bf620 R11: fffff52001b17ec7 R12: ffffc9000d8bf5c0 [ 32.495206][ T561] R13: dffffc0000000000 R14: 1ffff92001b17eb4 R15: 0000000000000000 [ 32.503255][ T561] FS: 00007f2f875a16c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 32.512317][ T561] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.518971][ T561] CR2: 0000200000006000 CR3: 00000001349f4000 CR4: 00000000003526b0 [ 32.526980][ T561] Call Trace: [ 32.530421][ T561] [ 32.533386][ T561] ? vfs_write+0x3bd/0xf30 [ 32.537901][ T561] ? ksys_write+0x141/0x250 [ 32.542438][ T561] ? x64_sys_call+0x271c/0x2ee0 [ 32.547331][ T561] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 32.553116][ T561] ? hashtab_init+0xdb/0x1f0 [ 32.557766][ T561] ___kmalloc_large_node+0x81/0x220 [ 32.562987][ T561] ? hashtab_init+0xdb/0x1f0 [ 32.567664][ T561] __kmalloc_large_node_noprof+0x1e/0xe0 [ 32.573329][ T561] ? hashtab_init+0xdb/0x1f0 [ 32.577975][ T561] __kmalloc_noprof+0x26d/0x450 [ 32.582854][ T561] hashtab_init+0xdb/0x1f0 [ 32.587286][ T561] ? common_read+0x16d/0x480 [ 32.591962][ T561] symtab_init+0x44/0x70 [ 32.596277][ T561] common_read+0x1de/0x480 [ 32.600751][ T561] ? __cfi_common_read+0x10/0x10 [ 32.605724][ T561] ? hashtab_init+0x105/0x1f0 [ 32.610781][ T561] policydb_read+0xaa8/0x28c0 [ 32.615488][ T561] ? kasan_save_alloc_info+0x40/0x50 [ 32.621116][ T561] ? __cfi_policydb_read+0x10/0x10 [ 32.626252][ T561] ? security_load_policy+0x128/0x12f0 [ 32.631754][ T561] security_load_policy+0x162/0x12f0 [ 32.637076][ T561] ? avc_has_perm_noaudit+0x286/0x360 [ 32.642525][ T561] ? _raw_spin_unlock+0x45/0x60 [ 32.647415][ T561] ? __check_object_size+0x50a/0x810 [ 32.652767][ T561] ? __cfi_security_load_policy+0x10/0x10 [ 32.658542][ T561] ? __kasan_check_write+0x18/0x20 [ 32.663716][ T561] sel_write_load+0x298/0x5e0 [ 32.668659][ T561] ? handle_mm_fault+0x169b/0x1b90 [ 32.673935][ T561] ? __cfi_sel_write_load+0x10/0x10 [ 32.679251][ T561] ? bpf_lsm_file_permission+0xd/0x20 [ 32.684664][ T561] ? __cfi_sel_write_load+0x10/0x10 [ 32.690059][ T561] vfs_write+0x3bd/0xf30 [ 32.694343][ T561] ? __cfi_vfs_write+0x10/0x10 [ 32.699190][ T561] ? __kasan_check_write+0x18/0x20 [ 32.704355][ T561] ? mutex_lock+0x92/0x1c0 [ 32.708835][ T561] ? __cfi_mutex_lock+0x10/0x10 [ 32.713725][ T561] ? __fget_files+0x2c5/0x340 [ 32.718456][ T561] ksys_write+0x141/0x250 [ 32.722823][ T561] ? __cfi_ksys_write+0x10/0x10 [ 32.727749][ T561] ? __kasan_check_write+0x18/0x20 [ 32.732941][ T561] ? fpregs_restore_userregs+0x11d/0x260 [ 32.738629][ T561] __x64_sys_write+0x7f/0x90 [ 32.743261][ T561] x64_sys_call+0x271c/0x2ee0 [ 32.748008][ T561] do_syscall_64+0x58/0xf0 [ 32.752458][ T561] ? clear_bhb_loop+0x50/0xa0 [ 32.757148][ T561] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.763168][ T561] RIP: 0033:0x7f2f88b8eec9 [ 32.767947][ T561] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 32.787810][ T561] RSP: 002b:00007f2f875a1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 32.796279][ T561] RAX: ffffffffffffffda RBX: 00007f2f88de6180 RCX: 00007f2f88b8eec9 [ 32.804324][ T561] RDX: 000000000000603f RSI: 0000200000000000 RDI: 0000000000000003 [ 32.812408][ T561] RBP: 00007f2f88c11f91 R08: 0000000000000000 R09: 0000000000000000 [ 32.820444][ T561] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 32.828479][ T561] R13: 00007f2f88de6218 R14: 00007f2f88de6180 R15: 00007ffc88f10958 [ 32.836498][ T561] [ 32.839601][ T561] ---[ end trace 0000000000000000 ]--- [ 32.845208][ T561] SELinux: failed to load policy [ 32.851206][ T561] SELinux: failed to load policy [ 32.856504][ T561] SELinux: failed to load policy [ 32.861989][ T561] SELinux: failed to load policy [ 32.867202][ T561] SELinux: failed to load policy [ 32.872520][ T561] SELinux: failed to load policy [ 32.967616][ T65] usb 2-1: device descriptor read/64, error -71 [ 33.207618][ T65] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 33.337581][ T65] usb 2-1: device descriptor read/64, error -71 [ 33.577574][ T65] usb 2-1: device descriptor read/64, error -71 [ 33.687829][ T65] usb usb2-port1: attempt power cycle [ 34.027635][ T65] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 34.048681][ T65] usb 2-1: device descriptor read/8, error -71 [ 34.178631][ T65] usb 2-1: device descriptor read/8, error -71 [ 34.417683][ T65] usb 2-1: new full-speed USB device number 10 using dummy_hcd [ 34.438745][ T65] usb 2-1: device descriptor read/8, error -71 [ 34.568716][ T65] usb 2-1: device descriptor read/8, error -71 [ 34.677670][ T65] usb usb2-port1: unable to enumerate USB device [ 35.019023][ T539] can0 (unregistered): slcan off ptm1.