last executing test programs: 1m1.5593777s ago: executing program 2 (id=51): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) 1m1.55902462s ago: executing program 2 (id=52): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000003440)={'tunl0\x00', &(0x7f00000033c0)={'sit0\x00', 0x0, 0x40, 0x8000, 0xf3, 0x3, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x66, 0x200, 0x7, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x2c}, @loopback}}}}) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x2}) r2 = socket$unix(0x1, 0x2, 0x0) bind$unix(r2, &(0x7f0000001400)=@abs={0x1, 0x0, 0x4e20}, 0x6e) ioctl$sock_SIOCINQ(r2, 0x541b, &(0x7f0000000000)) (async) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000300)={0x3}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x7000000) ioctl$TIOCSWINSZ(r3, 0x5414, &(0x7f0000000040)={0xffff, 0x6, 0x2, 0x2}) 1m1.55755128s ago: executing program 2 (id=53): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_inet_SIOCGIFNETMASK(r1, 0x891b, &(0x7f00000021c0)={'veth0_vlan\x00', {0x2, 0x0, @loopback}}) (async) ioctl$sock_inet_SIOCGIFNETMASK(r1, 0x891b, &(0x7f00000021c0)={'veth0_vlan\x00', {0x2, 0x0, @loopback}}) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r1, 0x8982, &(0x7f00000000c0)={0x6, 'pim6reg1\x00', {0x7}, 0x101}) r2 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff8) add_key(&(0x7f0000000000)='rxrpc_s\x00', 0x0, 0x0, 0x0, r2) 1m1.465677281s ago: executing program 2 (id=54): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f0000241000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) socket$inet(0x2, 0x2, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000100)='cgroup.max.descendants\x00', 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x3) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000000)=[@text16={0x10, &(0x7f0000000040)="0f01cbdfda0f20d86635200000000f22d8f30f38f63b2e0fc7b40000673e660f2c55040f20e06635000400000f22e00fc72a650fc7590766b8000800000f23c80f21f86635000060000f23f8", 0x4c}], 0x1, 0x63, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(r7, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x20, 0x1, 0x70bd26, 0x25dfdbff, {0x5}, [@typed={0x5, 0xbd, 0x0, 0x0, @str='\x00'}, @nested={0x1c, 0x11e, 0x0, 0x1, [@generic, @nested={0x4, 0xd4}, @nested={0x4, 0xc7}, @typed={0x8, 0xd4, 0x0, 0x0, @uid=r8}, @nested={0x4, 0x13b}, @nested={0x4, 0xc0}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008010}, 0x10) bind$inet6(r6, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r6, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x18115, @rand_addr, 0x983a}, 0x1c) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r6, 0x0, r9, 0x0, 0x406f413, 0x0) ioctl$EVIOCGMASK(r9, 0x80104592, &(0x7f0000000000)={0x1, 0xda, &(0x7f0000000140)="082c4d7d492cc0603f335b2699d88df960bf866b92ed69c05b27ce9f391b71dccba7a827bf75c839f59ff2857a2c7d156bcac91b7fcea859440825ef1a9fb69b7c7e5967e1bc07d60fd07b7839d03e8d8763af4af598d26c17937bf7c44a42ce053f697c3b879fb2aa9d1a82a3dd68278f15a0aec2826a4c63acae768327ebda8821d1810d3bf462ba15b21fcf3329ed63368590cf44fbb326f14f8d68cf8cf5b58a9cd0e8091d5f68cff7dd2432dbba6d7d48b66c2aeead0c1f5b09ad3a1c6abd1db60383b272642d7d1eed3a3e3c43bb254feefa2504083ce6"}) sendfile(r2, r2, 0x0, 0x93) mmap(&(0x7f0000787000/0x4000)=nil, 0x4000, 0x5a051feb1f984a1f, 0x202812, r0, 0x7dfff000) 1m1.315979633s ago: executing program 2 (id=55): r0 = signalfd(0xffffffffffffffff, &(0x7f0000000000)={[0x10]}, 0x8) write$char_usb(r0, &(0x7f0000000300)="d2e79949a772a4c6e2c77233d7f747823382e828178217b2d304921364c4bb035ee0dba05d1e10bbc7618dd2d1766560480d0edfd22ddae96ae25bdd8a31b1c5dd1e63e3a96cb32c9921a6e16d7105b8d20be8216863a28df14d6656ae0b52785909c2a3d5e3076e22da324f5deb0328762bdfa395962c8d3e508ef722555e2b8a337bcd23fd18573a6be85376ab53edd2245cd1f9e68beb35e61678d7c1750f824cbd7c8b7e3dc65cb1d62bdf5df73ce8c5142137182a0c1ad4f5092e32ede7d91e43692c02a02bcad5dc790f94b3f939bd52c6bc5b8bbc2abfb2585fa5a01ea07df310119d3ace08d153ea82ef8a909e1cce3b11ca72c64570e5285f7f", 0xfe) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0xd4, 0x0, &(0x7f00000005c0)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000540)={@ptr={0x70742a85, 0x1, &(0x7f00000004c0)=""/101, 0x65, 0x0, 0x12}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x1, 0x2, 0x14}}, &(0x7f0000000040)={0x0, 0x28, 0x40}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x0, &(0x7f0000000140)={@ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/221, 0xdd, 0x0, 0x40000000000001c}, @flat=@handle={0x73682a85, 0x14, 0x2}, @fda={0x66646185, 0x7, 0x2, 0x39}}, 0x0}}], 0xf, 0x0, 0x0}) 1m1.207459685s ago: executing program 2 (id=56): mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = dup(r1) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x6b}}) (async) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x6b}}) mkdir(&(0x7f0000000080)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='system.posix_acl_default\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="02000000010000000000f400040000000000000020"], 0x1c, 0x0) (async) lsetxattr$system_posix_acl(&(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='system.posix_acl_default\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="02000000010000000000f400040000000000000020"], 0x1c, 0x0) mkdir(&(0x7f0000000100)='./file1/file1\x00', 0x111) ioctl$BLKOPENZONE(0xffffffffffffffff, 0x40101286, &(0x7f0000000000)={0xffffffffffffee75, 0x6}) 46.150364308s ago: executing program 32 (id=56): mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = dup(r1) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x6b}}) (async) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x6b}}) mkdir(&(0x7f0000000080)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='system.posix_acl_default\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="02000000010000000000f400040000000000000020"], 0x1c, 0x0) (async) lsetxattr$system_posix_acl(&(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='system.posix_acl_default\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="02000000010000000000f400040000000000000020"], 0x1c, 0x0) mkdir(&(0x7f0000000100)='./file1/file1\x00', 0x111) ioctl$BLKOPENZONE(0xffffffffffffffff, 0x40101286, &(0x7f0000000000)={0xffffffffffffee75, 0x6}) 4.03962825s ago: executing program 4 (id=536): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) munmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000) r1 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x201, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r1, 0xa9207000) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f00000001c0)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x8000, 0x0, 0x0, 0x0, 0x33, 0x40, 0x0, 0xe4}) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) munmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffe) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) read(r0, &(0x7f0000000000)=""/175, 0xfffffe14) 3.969152242s ago: executing program 4 (id=538): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) mount(0x0, 0x0, &(0x7f0000000400)='ramfs\x00', 0x2000000, 0x0) syz_usb_connect$uac1(0x0, 0x9f, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8d, 0x3, 0x1, 0x8, 0x20, 0x3e, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x4, 0x1}, [@mixer_unit={0x6, 0x24, 0x4, 0x4, 0x7, 'A'}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0xf0, 0x4, 0x9, 0x3}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x5, 0x95, 0x9, {0x7, 0x25, 0x1, 0x2, 0x7, 0x3}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x4, 0x2, 0x85, 0x7}, @format_type_i_discrete={0x11, 0x24, 0x2, 0x1, 0x1, 0x4, 0x3, 0x81, "35319c30cb1bfcf06b"}, @as_header={0x7, 0x24, 0x1, 0x7, 0x4, 0x1001}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x50, 0xb1, 0x3, {0x7, 0x25, 0x1, 0x2, 0x3, 0x9c9}}}}}}}]}}, &(0x7f0000000340)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x110, 0x7f, 0x97, 0xff, 0x20, 0xfd}, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) mkdir(&(0x7f0000000540)='./file0\x00', 0x108) mount$cgroup(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100)={[{@subsystem='cpuset'}, {@subsystem='memory'}, {@subsystem='cpuacct'}]}) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) ioctl$BLKGETZONESZ(r0, 0x80041284, 0x0) 2.70806745s ago: executing program 0 (id=553): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) ioctl$BLKBSZSET(r0, 0x40081271, &(0x7f0000000080)=0x800) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x101, 0x3}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r5 = userfaultfd(0x801) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.swap.current\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x0) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_WRITEPROTECT(r5, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000800000/0x800000)=nil, 0x802000}, 0x2}) r7 = fcntl$dupfd(r5, 0x0, r5) ioctl$UFFDIO_CONTINUE(r7, 0xc018aa06, &(0x7f0000000100)={{&(0x7f0000800000/0x800000)=nil, 0x800000}, 0x1}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x4}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000440)={@flat=@weak_binder={0x77622a85, 0x1000, 0x2}, @flat=@binder={0x73622a85, 0xa, 0x1}, @flat=@binder={0x73622a85, 0x1000}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000680)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 2.547475533s ago: executing program 0 (id=555): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$cgroup_devices(r1, 0x0, 0x9) r2 = socket$xdp(0x2c, 0x3, 0x0) r3 = dup2(r2, r2) getsockopt$XDP_MMAP_OFFSETS(r3, 0x11b, 0x1, &(0x7f0000000080), &(0x7f0000000040)=0x80) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)={[{0x2b, 'rlimit'}, {0x2b, 'blkio'}, {0x2b, 'cpuacct'}, {0x2b, 'hugetlb'}, {0x0, 'cpu'}, {0x2d, 'rdma'}, {0x2b, 'devices'}]}, 0x35) r5 = eventfd2(0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(r4, 0x4008af21, &(0x7f0000000040)={0x1, r5}) close_range(r0, 0xffffffffffffffff, 0x0) 2.546319653s ago: executing program 0 (id=557): r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000200)=@file={0xd570d0466b6018f, './file0\x00'}, 0xa) listen(r0, 0x0) r1 = accept$unix(r0, 0x0, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) chmod(&(0x7f0000000080)='./file0\x00', 0x3a) setuid(0xffffffffffffffff) connect$unix(r2, &(0x7f0000000000)=@file={0xd1653077bafa0114, './file0\x00'}, 0xa) close(r2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f0000000280)={0x2, 0x0, @ioapic={0x1014e001, 0x59a35420, 0x20003, 0x10020f5b, 0x0, [{0x1, 0x1}, {}, {0x0, 0x0, 0x4b}, {0x0, 0x35}, {0x18, 0x6}, {0x3, 0x0, 0x6}, {0x2}, {0x2, 0x6}, {0x3}, {0x73, 0x1, 0x2, '\x00', 0x3}, {0x1, 0x0, 0x7c}, {0x0, 0x2}, {0x9, 0x3}, {0x7f, 0x4}, {0x7, 0xff, 0x0, '\x00', 0x39}, {0x0, 0x20, 0x80, '\x00', 0x6}, {0x0, 0x0, 0x0, '\x00', 0xff}, {0x0, 0x0, 0xd1}, {0x0, 0x0, 0x0, '\x00', 0xfe}, {0x0, 0x0, 0x80}, {0x6, 0xff, 0x40, '\x00', 0x1}, {0x0, 0x8, 0x0, '\x00', 0xfc}, {0x0, 0x5}, {0x2, 0xfd}]}}) connect$unix(r1, &(0x7f0000000000)=@file={0xd1653077bafa0114, './file0\x00'}, 0xa) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r5, &(0x7f0000000300)={0xa, 0x3, 0x8, @loopback, 0xfffffffe}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f0000000000)=@ccm_128={{0x304}, "e476d0501796a924", "50ac495230f834b7f7768b40b65222de", '\beKx', "009dd280960531d3"}, 0x28) r6 = socket$can_bcm(0x1d, 0x2, 0x2) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000800)={'bridge0\x00', 0x0}) connect$can_bcm(r6, &(0x7f0000000000)={0x1d, r8}, 0x10) sendmsg$inet(r5, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=[@ip_tos_int={{0x14, 0x11a, 0x1, 0x2}}], 0x18}, 0x0) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r9, &(0x7f0000000980)={0x2020}, 0x2020) 2.468364634s ago: executing program 0 (id=559): getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, 0x0, &(0x7f00000001c0)) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/custom0\x00', 0x1000, 0x0) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x88680, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0xc, &(0x7f0000000180)=0x9, 0x4) sendmsg$netlink(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000005a000d"], 0x1c}], 0x1}, 0x0) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r3, &(0x7f00000000c0)={0x1d, r4}, 0x10) sendmsg$can_bcm(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="0100000031020000071b0089085fe28d", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="00000000010000000200000002030000ae771958a0cb06cc"], 0x48}}, 0x20000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0/../file0\x00', 0x22) mount$bind(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000100)='./file0\x00', &(0x7f0000000280)='./file0/../file0\x00', 0x0, 0x1adc51, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) mount$bind(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000440)='./file0/file0\x00', 0x0, 0x12f451, 0x0) close_range(r0, r1, 0x0) 1.791573834s ago: executing program 0 (id=571): mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x800000, &(0x7f0000000080)={[{@inode64}, {@huge_advise}, {@gid={'gid', 0x3d, 0xee00}}, {@huge_never}, {@nr_inodes={'nr_inodes', 0x3d, [0x47, 0x39, 0x31, 0x6d, 0x37, 0x35, 0x31, 0x2d, 0x64, 0x2d]}}, {@grpquota_block_hardlimit={'grpquota_block_hardlimit', 0x3d, [0x32, 0x6d, 0x39, 0x41]}}, {@mpol={'mpol', 0x3d, {'local', '=static', @void}}}], [{@hash}, {@fsmagic={'fsmagic', 0x3d, 0x6}}, {@smackfsroot={'smackfsroot', 0x3d, '^'}}]}) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000b00)=ANY=[@ANYBLOB="b8000000150001ff"], 0xb8}}, 0x0) 1.749254124s ago: executing program 0 (id=573): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) (async) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000000)='selinuxfs\x00', 0x4804, 0x0) (async) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') flistxattr(r0, &(0x7f00000001c0)=""/239, 0xef) lseek(r0, 0x10001, 0x0) 1.727146785s ago: executing program 33 (id=573): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) (async) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000000)='selinuxfs\x00', 0x4804, 0x0) (async) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') flistxattr(r0, &(0x7f00000001c0)=""/239, 0xef) lseek(r0, 0x10001, 0x0) 1.114819894s ago: executing program 5 (id=579): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c000000b9686bf317bdf2f641aa7c5dc16bab2c342c3607ba3576a59b85041c3583ece55a71999f8282fb4e46fdbb2a54ea9509d93cd90b9fe27254b9", @ANYRES16=r1, @ANYBLOB="00012cbd7000fddbdf25030000000c00040003000000000000000c0006000300000000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x24000050) (async) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000000)={0x73622a85, 0x100a, 0x1}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x1}) (async, rerun: 32) mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3) (async, rerun: 32) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) (async, rerun: 64) fcntl$notify(r2, 0x402, 0x0) (rerun: 64) 1.114396764s ago: executing program 5 (id=580): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom0\x00', 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000001580), 0x0, 0x0) listen(r1, 0x9) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f0000000100)=[@register_looper], 0x4f, 0x0, &(0x7f0000000340)="a89aff67520a7335b849b4f88003975be8a982d5135e161a783d3d01fddcbd838bac308358a7e349f333e620505e4cf1982c991b006a9e26b6bb5bc602f37082218972537c8575ad467697f0d78b9a"}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x3d}]}) r3 = openat$kvm(0xffffff9c, &(0x7f0000000000), 0x800, 0x0) pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r4, &(0x7f0000002600)={0x2020}, 0x2020) write$FUSE_INIT(r5, &(0x7f0000000400)={0x6f, 0x0, 0x0, {0x7, 0x28, 0x80000001, 0x0, 0x0, 0x0, 0x2, 0x1}}, 0xfffffede) openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) fcntl$setpipe(r4, 0x407, 0xc000) r6 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) r8 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) fcntl$dupfd(r7, 0x406, r8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x60, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @fda={0x66646185, 0x8, 0x0, 0x20}, @fda={0x66646185, 0xd, 0x0, 0x200000002d}}, &(0x7f0000000280)={0x0, 0x20, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) 926.008157ms ago: executing program 1 (id=585): write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000940)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125b2ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb03bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2033aae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b85b7b26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd6929bbc2850cd4901389e6ea6e86041e0efa1111c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c669bb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b2967cbfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bcddf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d6748c2ce5bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4658098549646bd63175adf77b5cdcf102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4baea02fa76fb4830aebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f8426a9049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21abfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e0068607000000fb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9fb4000000f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002afea6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b46e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae66444a8f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a00", 0xdd52d6c}}, 0x1006) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001480)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1], 0x28}, 0x1, 0x0, 0x0, 0x4000802}, 0x4008000) 804.910849ms ago: executing program 4 (id=586): sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5}, 0x0) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000680)={{{@in=@dev={0xac, 0x14, 0x14, 0xe}, @in=@broadcast, 0x4e23, 0x591, 0x4e22, 0x2, 0xa, 0x80, 0x0, 0x5c}, {0x0, 0x1, 0x8aa0, 0x2, 0x0, 0x5, 0x1, 0x7}, {0x0, 0x3e77, 0x322, 0x4}, 0x9, 0x6e6bb1, 0x1, 0x1, 0x0, 0x1}, {{@in6=@rand_addr=' \x01\x00', 0x7f, 0x2b}, 0x2, @in6=@remote, 0x0, 0x1, 0x3, 0x1, 0x7, 0x1, 0x5}}, 0xe8) ptrace(0x10, r0) ptrace$poke(0x5, r0, &(0x7f0000000080), 0x0) sched_setattr(r0, &(0x7f0000000040)={0x38, 0x6, 0x10000008, 0x80000000, 0x2, 0x5, 0x9e1, 0x4, 0x8, 0x6}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x0, 0x0) 804.643929ms ago: executing program 1 (id=587): stat(0x0, 0x0) getpid() setns(0xffffffffffffffff, 0x24020000) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', 0x0, 0x0, 0x2125099, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0xa101, 0x0) write$binfmt_aout(r0, &(0x7f00000001c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x3, 0x0, 0x0, "0062ba7d82000000000000000000f7fffeff00"}) syz_open_pts(r0, 0x8182) read(r0, &(0x7f0000000000), 0x0) umount2(&(0x7f0000000040)='.\x00', 0x2) 804.012279ms ago: executing program 4 (id=589): r0 = gettid() getpgid(0x0) clock_gettime(0x0, &(0x7f0000000100)) rt_sigtimedwait(&(0x7f00000000c0)={[0xffffffffffffffff]}, &(0x7f0000000180), 0x0, 0x8) tkill(r0, 0x11) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r1, 0x20}, {r1}, {r1, 0x448}], 0x3, 0xc) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) capset(0x0, &(0x7f0000000040)={0x1ffffd, 0x600004, 0xfffffffe, 0x0, 0x0, 0x8000}) r2 = socket$inet(0x2, 0x2, 0x0) socket(0x10, 0x803, 0x0) openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket(0x8000000010, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000280)={0x4000, 0x2}, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000001600010a00000000000000000a0000000c0000800800", @ANYRES16=r3], 0x20}, 0x1, 0x0, 0x0, 0x200c0801}, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x2c) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000440)=ANY=[@ANYBLOB="e00000027f00000106d9ae0e8c4dc1ce3dd42d91094ead2886632d9459bab8e119eaeb79d267148b1791f86d3c5e5f4805244d8b7c9178076a4435bf203a9317807562310a39e9c51f1e53aeb08a26416db11b6d84f5adff108713242c30a351b84d5518b6ce590a2d2ea63e89cf9c5124b7ba3c9edc870f441cc7bde763459c294e9eb41f3886ddfb5359a73c4a027682af5762be3ec31cd5027f83718bc935276e62aca303041cfe3b8d60f39f8aff455e633a20fe9127abda9d9dc0283bf7bd1fee1068039292097236fac9240dd90dddd02ada8f68bffd7f8eebbd0e9a8448599e8a7e6651acb9dd60065f6735e367d7b71b83d4d29af760d5a97596918f2d4a1f63e974bf1acd2530f5d81ca54adc8f6054f00fa640fc20a6c0d0d424da6ff16e550bc9aff9a5f83c021b20d17800865cd403c8a9f7bd565f9d16f5cca45fca6850d3d1895100"/339], 0x1c) r4 = socket$netlink(0x10, 0x3, 0x0) writev(r4, &(0x7f00000003c0)=[{&(0x7f0000000300)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x4c, 0x0, &(0x7f00000003c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f00000001c0)={@flat=@binder={0x73622a85, 0x1, 0x2}, @flat=@handle={0x73682a85, 0xa, 0x3}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, 0x0}) 800.864659ms ago: executing program 3 (id=590): r0 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000080)=0xc) sendmsg$netlink(r0, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f00000031c0)={0x3c, 0x2c, 0x1, 0x0, 0x0, "", [@typed={0x8, 0x2, 0x0, 0x0, @uid=r1}, @nested={0xb, 0x2, 0x0, 0x1, [@generic="976b6408686030"]}, @nested={0x18, 0x1, 0x0, 0x1, [@nested={0x14, 0xea, 0x0, 0x1, [@typed={0xd, 0xbb, 0x0, 0x0, @binary="cee05c45eb13584178"}]}]}]}, 0x3c}], 0x1}, 0xcc000) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x129000, 0x40) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000280), r5) sendmsg$IEEE802154_SET_MACPARAMS(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)={0x14, r6, 0x1, 0x70bd2b, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4048840}, 0x10) ioctl$BINDER_GET_EXTENDED_ERROR(r2, 0xc0046209, 0x0) ioctl$UFFDIO_UNREGISTER(r3, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000001000/0x4000)=nil, 0x4000}) 800.029068ms ago: executing program 3 (id=591): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0xe) r2 = socket(0x80000000000000a, 0x2, 0x0) rt_sigtimedwait(&(0x7f0000000440)={[0x40]}, 0x0, 0xfffffffffffffffe, 0x8) setsockopt$inet6_group_source_req(r2, 0x29, 0x2a, &(0x7f0000000200)={0x8, {{0xa, 0x4e21, 0x6de, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @private2}}}, 0x108) r3 = syz_open_dev$loop(&(0x7f0000000100), 0x8, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r3, 0x4c0a, &(0x7f00000002c0)={r4, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x14, "fee8a2ab78fc979fd1e00313005e7b0000009de2b7fb00ef9d3c298561edae7c01005000000000000000000000000000000000000000001700", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2]}}) get_robust_list(0x0, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 799.581399ms ago: executing program 3 (id=592): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c020000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000003000000000a0000205e000000", @ANYRES32=0x0, @ANYRES64=r0, @ANYBLOB="0000000000000000000800000000000000000000000000000700000000000000000000000000000000000000000000000300000000000000070000000000000000000000000000000400000000000000e02700000000000000000000000000002d"], 0x23c}}, 0x0) 799.322448ms ago: executing program 3 (id=593): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) (async) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) (async) mount$bind(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000100)='./file0\x00', &(0x7f0000000280)='./file0/../file0\x00', 0x0, 0x1adc51, 0x0) (async) mount$bind(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000440)='./file0/file0\x00', 0x0, 0x12f451, 0x0) (async) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000280)=0x2, 0x4) (async) recvmmsg(r0, &(0x7f0000001600)=[{{0x0, 0x0, &(0x7f0000001700)=[{&(0x7f0000004340)=""/49, 0x31}, {&(0x7f0000001680)=""/47, 0x2f}], 0x2}, 0x40}], 0x1, 0x10002, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r2, 0x2000) (async) ioctl$BLKGETZONESZ(r2, 0x80041284, 0x0) ioctl$BTRFS_IOC_DEV_INFO(r2, 0xd000941e, &(0x7f0000001740)={0x0, "90401d3c2b6d38e540d8aa481d216b89"}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r2, 0x50009418, &(0x7f0000002740)={{r0}, 0x0, 0x2, @unused=[0x8, 0xfffffffffffff86a, 0x9, 0x3ff], @devid=r3}) 781.905199ms ago: executing program 4 (id=594): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000b00)=ANY=[@ANYBLOB="b8000000150001000000000000000000e0000002000000000000040000000000000000000000000000000000000000010000000000000000"], 0xb8}}, 0x0) 747.369369ms ago: executing program 4 (id=595): r0 = syz_open_dev$usbfs(0x0, 0x204, 0x2) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0xc0042, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000340)=""/185, &(0x7f0000000140)=""/92, 0x80a0000}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) lsm_set_self_attr(0x65, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x100000000, 0x0, 0x81, 0x100000, 0x0, 0x2004c8, 0x8000000, 0xfffffffffffffffe, 0x1, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x2], 0xeeee8000, 0x42240}) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000640)={[0x8, 0x7, 0x8000, 0x7, 0x2, 0x5, 0xefffffffffffffff, 0xb, 0x0, 0x7fffffffffffffff, 0x0, 0x9, 0x3, 0x1, 0x8000000000000000, 0xff], 0x0, 0x41847}) sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)={0x1c, 0x0, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f00000000c0)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'veth0_to_hsr\x00', 0x0}) sendto$packet(r4, &(0x7f00000002c0)="0203860020fc80d53d10", 0xfdf6, 0x40004, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x5, 0x6, @local}, 0x14) ioctl$KVM_RUN(r3, 0xae80, 0x0) r6 = socket$unix(0x1, 0x2, 0x0) write(r6, 0x0, 0x0) ioctl$USBDEVFS_RESETEP(r0, 0x80045503, 0x0) r7 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) sendfile(r7, r7, 0x0, 0x7ffff000) 667.315961ms ago: executing program 3 (id=596): fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) getrusage(0xffffffffffffffff, &(0x7f0000000040)) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000b00)=ANY=[@ANYBLOB="b8000000150001ff"], 0xb8}}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000000)={@mcast1, 0x1, 0x1, 0x40b7c4d24b019400, 0x9, 0xfffc, 0x200}, 0x20) 638.691221ms ago: executing program 3 (id=597): setns(0xffffffffffffffff, 0x4000000) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r2, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) iopl(0x3) process_mrelease(0xffffffffffffffff, 0x700000000000013) write$FUSE_INIT(r2, &(0x7f0000000040)={0x50, 0x0, r3, {0x7, 0x1f, 0xffd, 0x490420, 0x1, 0x0, 0x20}}, 0x50) write$FUSE_INIT(r1, &(0x7f00000001c0)={0x50, 0x0, r3, {0x7, 0x2b, 0x8001, 0x110000, 0x8, 0x2, 0x3, 0x4, 0x0, 0x0, 0x11, 0x3}}, 0x50) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[], 0x44}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)={0x3c, r6, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0x10, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x8, 0x3, 0x0, 0x1, [{0x4}]}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x3c}}, 0x0) vmsplice(r5, &(0x7f0000000280)=[{&(0x7f0000000300)="2d2b5b728b402c88ea13cf85efc6d6a7cf6ec4922a14c6482bbf5fcdb6e0933bd6cb8bce3f734533e724d2473d07bca827e858f869270310ecf562c2621e785defb6f0b8ea978d2deb72dc6521a1669ed1eb6b66f7dcafc922a1368fd9c190f5cfbfe0fb0db2f0449449e4fb929d412cd6e1a807200b1fa4daa91a75c4daea5a0de8720c0c6b0307e7484f1656c74009a59f11c183974a26e5454f6cfcd074efd4bdf6ff3295dafe3632d83cee461981e955141ec21bef44f882c4fc47ea9901d66436b1e0aa863d4dc20f837c302a0d7b598885850e0ae276ab407b613f8d0b619c808cbe02147272e6f353d3df223667f8fe2a945eb5da8fe27baf204bc88636d681412d314902fb99473e98d16a17ade4885067b1dd70ef00fdcd709bf326afd3243160ce68891df6dcec0e7a7a91dc8b90a4eab6c03f7968f8d54015ae239eb87e816a2111a8b69eac4c9d379eb4b9457ee866e6f2640bda5a16421111e0d1cdbab531f25030dd7478927a24ad517b946595afc6bd3d8675e3208e3cdc9da15cf486758e17bafb0c1e93210420acf353cd02370d19c8cfa0239a25698e79540e074909d0e8e0c0719335a69d93a3a67d96bd1e1753e0cd44b9cac327fa74289fbaa5e4e9b89b6b50733c5037247155dacc3815d1ed3a874d93dd51e92e5ab63d648c74ce306c8c8e471937572e1d13f4c7b94e352dd22d4aecba6e1ac4562ca587e2e9b0cb01c88fb0d2bcb4d647c2329ee76561dd2959ef33a49ee558541ed97eb3b480bb5333cf690f2e2efe587545c447592cc349639166ab1187562ba9575a12309118b6987d5c98633edd2416118864f2a9dd3c73e02a974b4920cce014b80928926fdd78db5f4add18b8e04f9560e4caf73b7bef3c422f720d60831c0663a409f4f9a56158bd21274ae50486fa555eae789e04af5dcf80b299610f62e40cb799c53a043aab05443b8c076064bf75fe25b89a0b82f7016df7369363628779a4700e5be829b1404c680554d156d1a6dab1038e924585c537163a91325ac7e6d9a319d9d482d664eaa591f2d3f9c8fee823bff415b1dbfa44e9ac4602db09f3f94f293363050687da00889baeab40c449fed9f5c4838d8cf7bd56b5acabf9e37f92eb9e2aec6873b0d4c8f2d4ada65f04c1bf6231ff734bca4ebb3a60f5f6d2824a6e9e353056e5398b33bebd23a881ee71e66ba799142d7ce32cc414fb9752b5963cabd8d5bb1ec368b660cdb068651fbb06035fde76a8d0e5d13f68b474c7c1b332805872cb2850a9ec9f3c0fadab4d5bc933730d5a2dfd37d66d84bc047cbf80c02155a35caa6cb7504d1b55e0cd729e8c2946df94c247564c6cd82e1e75a6f175e87780fb897b91a5880ff8c71d286a2e4ce25e0dd1ce8944a2f52d4b571c69c9bd8a9f6319e63b36e6858627ca1ee6bde1a874a6718953340b47e2011107b90c9fb5874511a0e27d4fed8072c71111a20901a8bfd04b02fbfdc44d65e6a833b6746014f6c9dc2fe2c80b877831f9517f2525787f46c5990222a9111232d4d2f22befc0468d83217cd94e54bcb020b77740cc801c1053544f8aea63ab8a6b9e3de7343749e6e931ba738746997fb716736505c8085fbca9c10a7ea72e1b1aa0775a362f4785d7fee429b4ad78bb20ed767ce3ead8773ad80018499469bfdcde7380ccf06af2913b15fa849544686f695dfc9436cdf3f5b5d81c2d300deaf6050e69a2213edf9f600e2dbb6e8e03409d2cf1d8b4c22bfb89f129a5155b6c271d64d3ae3a1b2ff9186f4929ef83aa069508ce6de86ee4cb7f9d46486a92df63e321c21b5379eaad165b947007570037c0541722ac88b308d775e1b174fa1637206d8b33b2e80c385056cc5495f44098acc248b9e6da2edf16c11422d36e52d4132a53a7fcdc6aec578cd61c710ffb5693c708ddcaba8b772f687fb45747b6ff49ebdb46d207f611dcf0fe352b27f5884493016bc1c341a340e6671f802a1911a2b49d526e3cb934859c96b8250632dcda03a859aa7b11d39239441eab7ffb058e8cacac3acf12026e96bd3cf1155731c2491b19e11ee6d6be0029f51be8fafeab1436d24f55915cac16a5cc95962da5fc086d4718ca0fc4719f76e12f3550b6721e8563a4dd12d4e8282e3853c1a9c7f051d7e108681966cf86f3052d6c422ac7b65d71c992db9b1bcdb99b2838057def0d67a1b016c140fa8233c28f7dfdf2ada9cc981d350444ae6084d978922280666d4fe94084b6957df34bfa9fed10a9616a4ce81dffc06a16fd479b4a9d8c3991f4d2c74d6e66bd2062d4b81e8317b562337c8f22db5b6df47f5600271f59c7a252ec8305a353f80cd9b44b9b12d0283eb9f416628ba0718508f2ee98b1246a91c7da15d1b5015236a846a7cb58da05cf05f269a037fe33506c8798db5ba0b37dcf582cc84b236752f88120e77c80f56ea97d5263c80717903187708f9b9f1071111afedaaf123a1db7944dfbb1b0cd1c573f9c8e9da10ea89a54245aeb553e2cef02703b1b17ebd40071c2a1139d873b711dc84bfbfa557bca0a894a95dbab88c34a943fbd88907437fae9a9122e0b8b59af89e08fb6214f273da25192bd9b1e9e81805a48318d36d7069a34e5b93fe5391b8a046f7ecf04c71c3b7d49f4a5b12fd7345701ca40085c45b12d2900705a53102641381b7c18b5d3db0f1ebbd7097a552918d6e433e2d630cafa3d5779352d859f6c11dca34ed92e4940dbaa7cea8772dbf1916bb7329a2ac55cea853795e46fd7f13ba258df0dc4b8b7c7ae6eccd7e3bc242cae2e9ccf21dfdf915be99e58152b34bf5cff57502dac48dc04c48870153f16a56c48fef751079aa8ad42c50f63883a94e397d6b370ba532e8e8bd0c5b1ea17a0713447edb9ffa455f0e4cad89b3c404e1e8581923c62d8f8445fd1568affe631d2b855a5bf2671459486c0be959ae9d01934a619049080d6b72b14f8a0c853f05427c0c6086dd7a1482fb9a401255d6d1d19b56510595bddacaa90bc1b24f31ed64d56f8cc4aa7c074bb5c0fa1a1c6329de60dc1f76de933a6f07ec2f5c03c027915fe4c7762580d106980d512735f1c1a929367afa95d1cbebde78416c62323a75a969ad3cd3751850be6376f90dab1fb81b47a357562e823172b67acbd4558f9c2bbb3c5e33ccf7c11a1496706977f99a3adf2d048fe3859fd3c8bdc1ace87b869d90c9cc8bf1804437d7d8777cab616f250f0e6e9b8be123e0a9f25353e3ce61a401d5b3b132e335d91c22e522115d4c1a0ce85955b45096eb32305648763b5717d02b324de58eeb2094fa9eec7ee4963eadc154ec111550697dabd7049fb0b36eb3b67ff4231a4d48253952f65f4fefdc215eb63582ddf751ebb143d417558f21a2728b16cf865e81bae856720ed735118608117df836bfc7ea6a4e05e4fc2111d08aba080183e324a2d4bd650f224c93d3ceec9f416a92f0802566cbc90aa516a9901e48e165ca3f7020e1b35a2f2ab21b3d651172bf7373bbe6bc692a5f103ddf92b639e63597d6b3c8eedf561d412788e8fd501f7a6858bf67280dc7bb27c79ddbdca8656b28e2bc22b482cab2a07420756dca46994efcbf0587808366e498c7bb642d43ef6a82379771671e095c62705d51302c19c0035747f527ed0437091c1ad6526b62fa7c7c94e3923e4630cc1abaffb00e31d77231e8fbf933336475a3ce4b0f76e531b15fb63f7042c93e2ea5bf6ba2ed0bc7599343eacd0d62945ea7b1490b84912aa4ebaf8558b5ffbda84578a00aab058373ea6ae6b99f2a6c8f7d786f35c74092cbb14408db17783692b22982b773843532beaf59ec6a41ae48f45aac66b3d4662d40927b4dad9a960b77af35cc23ac1ed60132702390bef48a4eefd7e118ce65347dc5f32f9308bffc4d56715974554d74061fccbf06f76d25eeff0e8e31261275a9d69d19cf70e46e329861ae64513991342884f6cd305c1a116d58d2e2a757b263b81332904b722c3c2f0192bf756210fcf37bc6e6aa35179ede811e27fd23d499c7a16d21774f162610aac9e80b46b33a3e41dc0db4e3d185e746f1305279bf4aa965a76aa25863841269d6f0aad5dbb3a30a134eb46d3ff469709e9612e4d38c78660c2a498ca1470106fd5c2b7c5ce541e80b840d078dd377b695998636287e895755ae25591a50c264804b27aa10678848989bdae6fa59322db5c1c0cc6a7c01a5b93c4a1dcf97ba802f34ab3641ee947692933ccc387df2c5f552722dc9be57a47f0ac5d08a92605dd017c8965f9ebbdbe81bc42a9077076e82ed6779e048b374dbe1438b30f4db9e5fe8c426929b10a2562474878e0e40d153143e80b9c225dbef15e7e26747867edb82561b039920213d81b07941cef268e7d8475c25d9ebd2d1d437c1bdf09c2ea0889045e34bc1c56928593eece202b9002510edf2d5eec10c8ebe291456e3b18d8a8f5f38b4c229f90e4f4b202ee83fadc65b2d1d73251a182c9b16dd8d4599acb866263c1b71a04300615298cc2d53726046a7e8f1d8d42641c4d92248d337b4c7610868016a729a99029b0cd8abd1eb757ce909d6a7089b61c9f99cb9c4d50ab1991a6fbe56cea32bd0a8c580e0b614c05f5011f173ed3c9240d511a12dfd610ae5f618349511339967554e0301962510ba844793a796f3605266ecca09bed207229a289fa2afdf1d8f9c8f9b913242344ef16735165e5ff0ba7fff3d341cf50f230491ec32497c9e0a7231471f778799f78a98d99c5fb44641bcc698305bdd4d15bb5235a69ae9c9416db0bd0f1a6fd6ab05ffc9e8eb94ea0cb7617553a12d616eb2221b5ad58e3ceac84a71bfc69424e241c2e0d804ca34706b875f207aef23287c2a00fefc00b251a2b5ac0e53c199ec4abff3cceec1ca5f7788a966f74b7da709d22733a4e1eb25a65f198fc47817412043017701ed3cf1761f1f4272d2864b589cbcd0ca474fcf09fe063a537b2d966c96e81452f8fca871ffc697ee12303cbc3553e97f713999deb89967b386f7310e64a18bfabf58f281b6107781d15ccadafbcfec4022ce574cb01ee7bf8092d38d063a456bec293b4f344a2bc076fd6a90effbabb8e18cbcf2fdf1f3396f772cfcb2e990b144427e951491a4ff9f5020472944b5847b7860e223ce06b34944b7060415aa727c2d5482528c4b6ef333fd3da1006c4f0019719ac5b256a6b55bf2287447f739eb762f420fd0f08b48ea4ff5dae31205867aadc22a89b81843267f5e5605e3c0c038840fa351dabeec51efcf8681c936071b093c698b62772c5c6b99dfc0e83033901439fd42cb0d5ef76679d5153b60102c882195075ee0392da358cbc1c6e8e6d266ac9743afd71be143c288188867635a4f313e2d2a0a4e58d825ae0e380fb13612cc178bc11c8af7ff991fdf141693c1f3ff6a51f252f74e35d4a1a2c877a1fcc7e40684f3e27119bd334b5cf8e887ccc1f0c014f04080d64d7c8253d8d84b3251cea41bef6434557d4521580ad44abb97cc981627da0049e467eac0eba8e4cddf4dac3d8cd8ca6bdeefa5a6c5899ffbc9e41de3ce8d9342356462c75ecc3fca8970c809cf4ba5d8608414b68163d7f5f850992f4888254074d8cf7742d64bd827746a6ae5955568e1d1840c90dd9a119634ccb26c3a858767df997f7d6e1013d27aa1cd2c8fd88b0e8db53aa6766d1e586ebbbd096f324139296aad19f59480981f70c5723e1361a9dd69babdd7ab48852c4895a76170f82c03c644f75a31b2c1c7eaa5147587e552ba5cd1b319fae6ec71d5a750393", 0x1000}, {&(0x7f0000001300)="2aa86e101538538130eacc4c4d942a6d281726d1fc77106b5ea30d86f100786441b5fbfe1d5203ec1c758031280cd8282d06bc34a11e5010a580bdf766b6553e1e6bd52ba3d3d3d5ded0f97f926db24e037c7110e773c1a9f5c83ed1d7b9df8e519eb12b1a2db4afe2e39a4357afdd315500e704048fccd8762cb333ec2d2d5237da567d", 0x84}], 0x2, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r4, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001400)={0x110, r6, 0x100, 0x70bd2d, 0x25dfdbfd, {}, [@ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x23}, @ETHTOOL_A_LINKMODES_OURS={0xe4, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x9}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_VALUE={0x86, 0x4, "87e235493c350c7b2959f7b0e753aef3b434d1c40c1f38f327b3511f6aa0f10d9b4a0b4af309a45fd67d5e6f13debb6dd1a6d9d0de28cab7294586b53e22e1d9e098a07e44053da0e5ca3c7134c24517ceef162416b58e33081187b848024a1289629285a7e6b0e63b10ad3e67c213c97afdf529f476cafc693004eb30b3f2011144"}, @ETHTOOL_A_BITSET_VALUE={0x17, 0x4, "44212d39a7e74dc0b132e8a350bc87a657938e"}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x23}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x3}, @ETHTOOL_A_BITSET_BITS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, ',\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}]}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x8d}, @ETHTOOL_A_LINKMODES_DUPLEX={0x5, 0x6, 0xc}]}, 0x110}, 0x1, 0x0, 0x0, 0x40804}, 0x40840) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000004300)={0x1c, 0x801c, 0x1, 0x0, 0x2, {0x7}, [@generic="df1d5bd6c0"]}, 0x1c}, 0x1, 0x0, 0x0, 0x80000}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r4, 0x0) remap_file_pages(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x8, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0xa, 0x2}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xfffffffffffffffb, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x10}], 0x0, 0x0, 0x0}) getsockopt$EBT_SO_GET_ENTRIES(r4, 0x0, 0x81, &(0x7f0000001640)={'broute\x00', 0x0, 0x3, 0x1000, [0x89d, 0x7ff, 0x6, 0x401, 0x4, 0x7], 0x4, &(0x7f0000001540)=[{}, {}, {}, {}], &(0x7f0000004340)=""/4096}, &(0x7f0000001580)=0x78) fcntl$setpipe(r2, 0x407, 0x3) 600.775711ms ago: executing program 34 (id=597): setns(0xffffffffffffffff, 0x4000000) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r2, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) iopl(0x3) process_mrelease(0xffffffffffffffff, 0x700000000000013) write$FUSE_INIT(r2, &(0x7f0000000040)={0x50, 0x0, r3, {0x7, 0x1f, 0xffd, 0x490420, 0x1, 0x0, 0x20}}, 0x50) write$FUSE_INIT(r1, &(0x7f00000001c0)={0x50, 0x0, r3, {0x7, 0x2b, 0x8001, 0x110000, 0x8, 0x2, 0x3, 0x4, 0x0, 0x0, 0x11, 0x3}}, 0x50) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[], 0x44}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)={0x3c, r6, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0x10, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x8, 0x3, 0x0, 0x1, [{0x4}]}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x3c}}, 0x0) vmsplice(r5, &(0x7f0000000280)=[{&(0x7f0000000300)="2d2b5b728b402c88ea13cf85efc6d6a7cf6ec4922a14c6482bbf5fcdb6e0933bd6cb8bce3f734533e724d2473d07bca827e858f869270310ecf562c2621e785defb6f0b8ea978d2deb72dc6521a1669ed1eb6b66f7dcafc922a1368fd9c190f5cfbfe0fb0db2f0449449e4fb929d412cd6e1a807200b1fa4daa91a75c4daea5a0de8720c0c6b0307e7484f1656c74009a59f11c183974a26e5454f6cfcd074efd4bdf6ff3295dafe3632d83cee461981e955141ec21bef44f882c4fc47ea9901d66436b1e0aa863d4dc20f837c302a0d7b598885850e0ae276ab407b613f8d0b619c808cbe02147272e6f353d3df223667f8fe2a945eb5da8fe27baf204bc88636d681412d314902fb99473e98d16a17ade4885067b1dd70ef00fdcd709bf326afd3243160ce68891df6dcec0e7a7a91dc8b90a4eab6c03f7968f8d54015ae239eb87e816a2111a8b69eac4c9d379eb4b9457ee866e6f2640bda5a16421111e0d1cdbab531f25030dd7478927a24ad517b946595afc6bd3d8675e3208e3cdc9da15cf486758e17bafb0c1e93210420acf353cd02370d19c8cfa0239a25698e79540e074909d0e8e0c0719335a69d93a3a67d96bd1e1753e0cd44b9cac327fa74289fbaa5e4e9b89b6b50733c5037247155dacc3815d1ed3a874d93dd51e92e5ab63d648c74ce306c8c8e471937572e1d13f4c7b94e352dd22d4aecba6e1ac4562ca587e2e9b0cb01c88fb0d2bcb4d647c2329ee76561dd2959ef33a49ee558541ed97eb3b480bb5333cf690f2e2efe587545c447592cc349639166ab1187562ba9575a12309118b6987d5c98633edd2416118864f2a9dd3c73e02a974b4920cce014b80928926fdd78db5f4add18b8e04f9560e4caf73b7bef3c422f720d60831c0663a409f4f9a56158bd21274ae50486fa555eae789e04af5dcf80b299610f62e40cb799c53a043aab05443b8c076064bf75fe25b89a0b82f7016df7369363628779a4700e5be829b1404c680554d156d1a6dab1038e924585c537163a91325ac7e6d9a319d9d482d664eaa591f2d3f9c8fee823bff415b1dbfa44e9ac4602db09f3f94f293363050687da00889baeab40c449fed9f5c4838d8cf7bd56b5acabf9e37f92eb9e2aec6873b0d4c8f2d4ada65f04c1bf6231ff734bca4ebb3a60f5f6d2824a6e9e353056e5398b33bebd23a881ee71e66ba799142d7ce32cc414fb9752b5963cabd8d5bb1ec368b660cdb068651fbb06035fde76a8d0e5d13f68b474c7c1b332805872cb2850a9ec9f3c0fadab4d5bc933730d5a2dfd37d66d84bc047cbf80c02155a35caa6cb7504d1b55e0cd729e8c2946df94c247564c6cd82e1e75a6f175e87780fb897b91a5880ff8c71d286a2e4ce25e0dd1ce8944a2f52d4b571c69c9bd8a9f6319e63b36e6858627ca1ee6bde1a874a6718953340b47e2011107b90c9fb5874511a0e27d4fed8072c71111a20901a8bfd04b02fbfdc44d65e6a833b6746014f6c9dc2fe2c80b877831f9517f2525787f46c5990222a9111232d4d2f22befc0468d83217cd94e54bcb020b77740cc801c1053544f8aea63ab8a6b9e3de7343749e6e931ba738746997fb716736505c8085fbca9c10a7ea72e1b1aa0775a362f4785d7fee429b4ad78bb20ed767ce3ead8773ad80018499469bfdcde7380ccf06af2913b15fa849544686f695dfc9436cdf3f5b5d81c2d300deaf6050e69a2213edf9f600e2dbb6e8e03409d2cf1d8b4c22bfb89f129a5155b6c271d64d3ae3a1b2ff9186f4929ef83aa069508ce6de86ee4cb7f9d46486a92df63e321c21b5379eaad165b947007570037c0541722ac88b308d775e1b174fa1637206d8b33b2e80c385056cc5495f44098acc248b9e6da2edf16c11422d36e52d4132a53a7fcdc6aec578cd61c710ffb5693c708ddcaba8b772f687fb45747b6ff49ebdb46d207f611dcf0fe352b27f5884493016bc1c341a340e6671f802a1911a2b49d526e3cb934859c96b8250632dcda03a859aa7b11d39239441eab7ffb058e8cacac3acf12026e96bd3cf1155731c2491b19e11ee6d6be0029f51be8fafeab1436d24f55915cac16a5cc95962da5fc086d4718ca0fc4719f76e12f3550b6721e8563a4dd12d4e8282e3853c1a9c7f051d7e108681966cf86f3052d6c422ac7b65d71c992db9b1bcdb99b2838057def0d67a1b016c140fa8233c28f7dfdf2ada9cc981d350444ae6084d978922280666d4fe94084b6957df34bfa9fed10a9616a4ce81dffc06a16fd479b4a9d8c3991f4d2c74d6e66bd2062d4b81e8317b562337c8f22db5b6df47f5600271f59c7a252ec8305a353f80cd9b44b9b12d0283eb9f416628ba0718508f2ee98b1246a91c7da15d1b5015236a846a7cb58da05cf05f269a037fe33506c8798db5ba0b37dcf582cc84b236752f88120e77c80f56ea97d5263c80717903187708f9b9f1071111afedaaf123a1db7944dfbb1b0cd1c573f9c8e9da10ea89a54245aeb553e2cef02703b1b17ebd40071c2a1139d873b711dc84bfbfa557bca0a894a95dbab88c34a943fbd88907437fae9a9122e0b8b59af89e08fb6214f273da25192bd9b1e9e81805a48318d36d7069a34e5b93fe5391b8a046f7ecf04c71c3b7d49f4a5b12fd7345701ca40085c45b12d2900705a53102641381b7c18b5d3db0f1ebbd7097a552918d6e433e2d630cafa3d5779352d859f6c11dca34ed92e4940dbaa7cea8772dbf1916bb7329a2ac55cea853795e46fd7f13ba258df0dc4b8b7c7ae6eccd7e3bc242cae2e9ccf21dfdf915be99e58152b34bf5cff57502dac48dc04c48870153f16a56c48fef751079aa8ad42c50f63883a94e397d6b370ba532e8e8bd0c5b1ea17a0713447edb9ffa455f0e4cad89b3c404e1e8581923c62d8f8445fd1568affe631d2b855a5bf2671459486c0be959ae9d01934a619049080d6b72b14f8a0c853f05427c0c6086dd7a1482fb9a401255d6d1d19b56510595bddacaa90bc1b24f31ed64d56f8cc4aa7c074bb5c0fa1a1c6329de60dc1f76de933a6f07ec2f5c03c027915fe4c7762580d106980d512735f1c1a929367afa95d1cbebde78416c62323a75a969ad3cd3751850be6376f90dab1fb81b47a357562e823172b67acbd4558f9c2bbb3c5e33ccf7c11a1496706977f99a3adf2d048fe3859fd3c8bdc1ace87b869d90c9cc8bf1804437d7d8777cab616f250f0e6e9b8be123e0a9f25353e3ce61a401d5b3b132e335d91c22e522115d4c1a0ce85955b45096eb32305648763b5717d02b324de58eeb2094fa9eec7ee4963eadc154ec111550697dabd7049fb0b36eb3b67ff4231a4d48253952f65f4fefdc215eb63582ddf751ebb143d417558f21a2728b16cf865e81bae856720ed735118608117df836bfc7ea6a4e05e4fc2111d08aba080183e324a2d4bd650f224c93d3ceec9f416a92f0802566cbc90aa516a9901e48e165ca3f7020e1b35a2f2ab21b3d651172bf7373bbe6bc692a5f103ddf92b639e63597d6b3c8eedf561d412788e8fd501f7a6858bf67280dc7bb27c79ddbdca8656b28e2bc22b482cab2a07420756dca46994efcbf0587808366e498c7bb642d43ef6a82379771671e095c62705d51302c19c0035747f527ed0437091c1ad6526b62fa7c7c94e3923e4630cc1abaffb00e31d77231e8fbf933336475a3ce4b0f76e531b15fb63f7042c93e2ea5bf6ba2ed0bc7599343eacd0d62945ea7b1490b84912aa4ebaf8558b5ffbda84578a00aab058373ea6ae6b99f2a6c8f7d786f35c74092cbb14408db17783692b22982b773843532beaf59ec6a41ae48f45aac66b3d4662d40927b4dad9a960b77af35cc23ac1ed60132702390bef48a4eefd7e118ce65347dc5f32f9308bffc4d56715974554d74061fccbf06f76d25eeff0e8e31261275a9d69d19cf70e46e329861ae64513991342884f6cd305c1a116d58d2e2a757b263b81332904b722c3c2f0192bf756210fcf37bc6e6aa35179ede811e27fd23d499c7a16d21774f162610aac9e80b46b33a3e41dc0db4e3d185e746f1305279bf4aa965a76aa25863841269d6f0aad5dbb3a30a134eb46d3ff469709e9612e4d38c78660c2a498ca1470106fd5c2b7c5ce541e80b840d078dd377b695998636287e895755ae25591a50c264804b27aa10678848989bdae6fa59322db5c1c0cc6a7c01a5b93c4a1dcf97ba802f34ab3641ee947692933ccc387df2c5f552722dc9be57a47f0ac5d08a92605dd017c8965f9ebbdbe81bc42a9077076e82ed6779e048b374dbe1438b30f4db9e5fe8c426929b10a2562474878e0e40d153143e80b9c225dbef15e7e26747867edb82561b039920213d81b07941cef268e7d8475c25d9ebd2d1d437c1bdf09c2ea0889045e34bc1c56928593eece202b9002510edf2d5eec10c8ebe291456e3b18d8a8f5f38b4c229f90e4f4b202ee83fadc65b2d1d73251a182c9b16dd8d4599acb866263c1b71a04300615298cc2d53726046a7e8f1d8d42641c4d92248d337b4c7610868016a729a99029b0cd8abd1eb757ce909d6a7089b61c9f99cb9c4d50ab1991a6fbe56cea32bd0a8c580e0b614c05f5011f173ed3c9240d511a12dfd610ae5f618349511339967554e0301962510ba844793a796f3605266ecca09bed207229a289fa2afdf1d8f9c8f9b913242344ef16735165e5ff0ba7fff3d341cf50f230491ec32497c9e0a7231471f778799f78a98d99c5fb44641bcc698305bdd4d15bb5235a69ae9c9416db0bd0f1a6fd6ab05ffc9e8eb94ea0cb7617553a12d616eb2221b5ad58e3ceac84a71bfc69424e241c2e0d804ca34706b875f207aef23287c2a00fefc00b251a2b5ac0e53c199ec4abff3cceec1ca5f7788a966f74b7da709d22733a4e1eb25a65f198fc47817412043017701ed3cf1761f1f4272d2864b589cbcd0ca474fcf09fe063a537b2d966c96e81452f8fca871ffc697ee12303cbc3553e97f713999deb89967b386f7310e64a18bfabf58f281b6107781d15ccadafbcfec4022ce574cb01ee7bf8092d38d063a456bec293b4f344a2bc076fd6a90effbabb8e18cbcf2fdf1f3396f772cfcb2e990b144427e951491a4ff9f5020472944b5847b7860e223ce06b34944b7060415aa727c2d5482528c4b6ef333fd3da1006c4f0019719ac5b256a6b55bf2287447f739eb762f420fd0f08b48ea4ff5dae31205867aadc22a89b81843267f5e5605e3c0c038840fa351dabeec51efcf8681c936071b093c698b62772c5c6b99dfc0e83033901439fd42cb0d5ef76679d5153b60102c882195075ee0392da358cbc1c6e8e6d266ac9743afd71be143c288188867635a4f313e2d2a0a4e58d825ae0e380fb13612cc178bc11c8af7ff991fdf141693c1f3ff6a51f252f74e35d4a1a2c877a1fcc7e40684f3e27119bd334b5cf8e887ccc1f0c014f04080d64d7c8253d8d84b3251cea41bef6434557d4521580ad44abb97cc981627da0049e467eac0eba8e4cddf4dac3d8cd8ca6bdeefa5a6c5899ffbc9e41de3ce8d9342356462c75ecc3fca8970c809cf4ba5d8608414b68163d7f5f850992f4888254074d8cf7742d64bd827746a6ae5955568e1d1840c90dd9a119634ccb26c3a858767df997f7d6e1013d27aa1cd2c8fd88b0e8db53aa6766d1e586ebbbd096f324139296aad19f59480981f70c5723e1361a9dd69babdd7ab48852c4895a76170f82c03c644f75a31b2c1c7eaa5147587e552ba5cd1b319fae6ec71d5a750393", 0x1000}, {&(0x7f0000001300)="2aa86e101538538130eacc4c4d942a6d281726d1fc77106b5ea30d86f100786441b5fbfe1d5203ec1c758031280cd8282d06bc34a11e5010a580bdf766b6553e1e6bd52ba3d3d3d5ded0f97f926db24e037c7110e773c1a9f5c83ed1d7b9df8e519eb12b1a2db4afe2e39a4357afdd315500e704048fccd8762cb333ec2d2d5237da567d", 0x84}], 0x2, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r4, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001400)={0x110, r6, 0x100, 0x70bd2d, 0x25dfdbfd, {}, [@ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x23}, @ETHTOOL_A_LINKMODES_OURS={0xe4, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x9}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_VALUE={0x86, 0x4, "87e235493c350c7b2959f7b0e753aef3b434d1c40c1f38f327b3511f6aa0f10d9b4a0b4af309a45fd67d5e6f13debb6dd1a6d9d0de28cab7294586b53e22e1d9e098a07e44053da0e5ca3c7134c24517ceef162416b58e33081187b848024a1289629285a7e6b0e63b10ad3e67c213c97afdf529f476cafc693004eb30b3f2011144"}, @ETHTOOL_A_BITSET_VALUE={0x17, 0x4, "44212d39a7e74dc0b132e8a350bc87a657938e"}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x23}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x3}, @ETHTOOL_A_BITSET_BITS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, ',\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}]}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x8d}, @ETHTOOL_A_LINKMODES_DUPLEX={0x5, 0x6, 0xc}]}, 0x110}, 0x1, 0x0, 0x0, 0x40804}, 0x40840) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000004300)={0x1c, 0x801c, 0x1, 0x0, 0x2, {0x7}, [@generic="df1d5bd6c0"]}, 0x1c}, 0x1, 0x0, 0x0, 0x80000}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r4, 0x0) remap_file_pages(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x8, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0xa, 0x2}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xfffffffffffffffb, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x10}], 0x0, 0x0, 0x0}) getsockopt$EBT_SO_GET_ENTRIES(r4, 0x0, 0x81, &(0x7f0000001640)={'broute\x00', 0x0, 0x3, 0x1000, [0x89d, 0x7ff, 0x6, 0x401, 0x4, 0x7], 0x4, &(0x7f0000001540)=[{}, {}, {}, {}], &(0x7f0000004340)=""/4096}, &(0x7f0000001580)=0x78) fcntl$setpipe(r2, 0x407, 0x3) 197.136958ms ago: executing program 5 (id=598): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) (async) ioctl$KVM_SET_FPU(r2, 0x41a0ae8d, &(0x7f0000000240)={'\x00', 0x4, 0x9, 0xbd, 0x0, 0x0, 0x2, 0x2, '\x00', 0x654}) getsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f0000000000)=0x6, &(0x7f0000000040)=0x2) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000640)={0x20, 0x0, &(0x7f0000000280)=[@request_death={0x400c630e, 0x0, 0xfc}, @clear_death], 0x0, 0x0, 0x0}) (async) fcntl$notify(r0, 0x402, 0x80000010) 119.450879ms ago: executing program 5 (id=599): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffe) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) (async) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040), 0x24a841, 0x0) ioctl$ASHMEM_SET_NAME(r1, 0x41007701, &(0x7f0000000000)='/m\x00') 119.095259ms ago: executing program 5 (id=600): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x101301) ioctl$USBDEVFS_CLAIM_PORT(r1, 0x80045518, &(0x7f0000000000)=0x1) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r1, 0x942e, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 105.434309ms ago: executing program 5 (id=601): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r1 = socket(0x8000000010, 0x2, 0x0) write(r1, &(0x7f0000000600)="fc0000001c000704ab5b2509b86803000aab02000000000000001193210001c0f0030584050060100000000081039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548deff", 0xfd) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000240)={0x0, 0x600, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="dc00000000010104000000000000000002000000240002801400018008000100e000000108000200e00000010c000280050001000000000008000480040003800800084000000000080008400000000734000f8008000240000000050800024000000b8608000340000047510800034000000003080001"], 0xdc}}, 0x0) r5 = dup3(r2, r0, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x4}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f00000002c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000440)={@flat, @flat=@binder={0x73622a85, 0xa, 0x1}, @flat=@handle={0x73682a85, 0x1000, 0x1}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f00000004c0)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, 0x0}) 66.791089ms ago: executing program 1 (id=602): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c020000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000003000000000a0000205e000000", @ANYRES32=0x0, @ANYRES64=r0, @ANYBLOB="0000000000000000000800000000000000000000000000000700000000000000000000000000000000000000000000000300000000000000070000000000000000000000000000000500000000000000e02700000000000000000000000000002d"], 0x23c}}, 0x0) 61.289969ms ago: executing program 6 (id=605): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) (async) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000000)={0xb, 0x0, 0x8}) (async) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[], 0x32600) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1400000024001f00bceff2c8784cc95100e01c4b00"], 0x14}], 0x1, 0x0, 0x0, 0x4004000}, 0x0) (async) ptrace$setregset(0x4205, r5, 0x202, &(0x7f00000004c0)={0x0}) (async) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000140)=[@clear_death={0x400c630f, 0x2}], 0x0, 0x0, 0x0}) 36.56901ms ago: executing program 1 (id=603): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000b00)=ANY=[@ANYBLOB="b8000000150001000000000000000000e0000002000000000000040000000000000000000000000000000000000000010000000000000000"], 0xb8}}, 0x0) 36.02839ms ago: executing program 1 (id=604): mkdir(&(0x7f00000003c0)='./file0\x00', 0x21) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214050, 0x0) mkdir(&(0x7f0000000200)='./bus\x00', 0x10) chroot(&(0x7f0000000000)='./bus\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x802, 0x0) 0s ago: executing program 1 (id=606): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) sync() sync() sync() sync() sync() sync() sync() sync() r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000300)={0x6666969}) sendto(0xffffffffffffffff, &(0x7f0000000040)="120000001200e7ef007b00000000000000a1", 0x12, 0x48000, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[], 0x44}}, 0x2400c000) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 25.178375][ T36] kauditd_printk_skb: 47 callbacks suppressed [ 25.178394][ T36] audit: type=1400 audit(1750894144.429:59): avc: denied { transition } for pid=272 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 25.219557][ T36] audit: type=1400 audit(1750894144.429:60): avc: denied { noatsecure } for pid=272 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 25.260200][ T36] audit: type=1400 audit(1750894144.429:61): avc: denied { write } for pid=272 comm="sh" path="pipe:[2347]" dev="pipefs" ino=2347 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 25.293275][ T36] audit: type=1400 audit(1750894144.429:62): avc: denied { rlimitinh } for pid=272 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 25.320953][ T36] audit: type=1400 audit(1750894144.429:63): avc: denied { siginh } for pid=272 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.155' (ED25519) to the list of known hosts. [ 33.058821][ T36] audit: type=1400 audit(1750894152.309:64): avc: denied { mounton } for pid=280 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 33.060001][ T280] cgroup: Unknown subsys name 'net' [ 33.086555][ T36] audit: type=1400 audit(1750894152.309:65): avc: denied { mount } for pid=280 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 33.123647][ T36] audit: type=1400 audit(1750894152.339:66): avc: denied { unmount } for pid=280 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 33.123812][ T280] cgroup: Unknown subsys name 'devices' [ 33.317750][ T280] cgroup: Unknown subsys name 'hugetlb' [ 33.324306][ T280] cgroup: Unknown subsys name 'rlimit' [ 33.477272][ T36] audit: type=1400 audit(1750894152.729:67): avc: denied { setattr } for pid=280 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 33.506295][ T36] audit: type=1400 audit(1750894152.729:68): avc: denied { mounton } for pid=280 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 33.534390][ T282] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 33.550379][ T36] audit: type=1400 audit(1750894152.729:69): avc: denied { mount } for pid=280 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 33.595840][ T36] audit: type=1400 audit(1750894152.819:70): avc: denied { relabelto } for pid=282 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 33.597753][ T280] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 33.633918][ T36] audit: type=1400 audit(1750894152.819:71): avc: denied { write } for pid=282 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 33.693788][ T36] audit: type=1400 audit(1750894152.849:72): avc: denied { read } for pid=280 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 33.737562][ T36] audit: type=1400 audit(1750894152.849:73): avc: denied { open } for pid=280 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 35.416081][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.425795][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.437138][ T288] bridge_slave_0: entered allmulticast mode [ 35.445018][ T288] bridge_slave_0: entered promiscuous mode [ 35.457160][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.466226][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.478642][ T288] bridge_slave_1: entered allmulticast mode [ 35.492134][ T288] bridge_slave_1: entered promiscuous mode [ 35.515324][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.525990][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.535454][ T287] bridge_slave_0: entered allmulticast mode [ 35.542831][ T287] bridge_slave_0: entered promiscuous mode [ 35.574296][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.582217][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.594130][ T287] bridge_slave_1: entered allmulticast mode [ 35.601644][ T287] bridge_slave_1: entered promiscuous mode [ 35.635976][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.648911][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.656328][ T290] bridge_slave_0: entered allmulticast mode [ 35.667823][ T290] bridge_slave_0: entered promiscuous mode [ 35.688447][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.700279][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.712530][ T290] bridge_slave_1: entered allmulticast mode [ 35.719347][ T290] bridge_slave_1: entered promiscuous mode [ 35.816619][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.825946][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.835255][ T289] bridge_slave_0: entered allmulticast mode [ 35.842312][ T289] bridge_slave_0: entered promiscuous mode [ 35.878010][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.893689][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.901995][ T289] bridge_slave_1: entered allmulticast mode [ 35.915981][ T289] bridge_slave_1: entered promiscuous mode [ 36.048615][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.056780][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.065232][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.074142][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.097456][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.106588][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.115776][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.131321][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.174458][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.182166][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.199388][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.207225][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.229862][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.239693][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.254074][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.262788][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.285886][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.294570][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.302833][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.311036][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.322152][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.329517][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.338509][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.347760][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.367695][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.378548][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.388600][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.401438][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.439386][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.447454][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.456662][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.466710][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.498305][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.506005][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.516189][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.524293][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.544837][ T288] veth0_vlan: entered promiscuous mode [ 36.565956][ T288] veth1_macvtap: entered promiscuous mode [ 36.584233][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.591959][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.603562][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.611710][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.625978][ T287] veth0_vlan: entered promiscuous mode [ 36.661221][ T287] veth1_macvtap: entered promiscuous mode [ 36.672239][ T288] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 36.674636][ T289] veth0_vlan: entered promiscuous mode [ 36.714694][ T290] veth0_vlan: entered promiscuous mode [ 36.749449][ T290] veth1_macvtap: entered promiscuous mode [ 36.758604][ T289] veth1_macvtap: entered promiscuous mode [ 36.769636][ T311] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 36.906361][ T322] binder: Bad value for 'stats' [ 36.977700][ T326] Zero length message leads to an empty skb [ 36.991385][ T328] tipc: Started in network mode [ 36.998569][ T328] tipc: Node identity 0eac6d7dc4c5, cluster identity 4711 [ 36.999614][ T330] capability: warning: `syz.2.8' uses 32-bit capabilities (legacy support in use) [ 37.007030][ T328] tipc: Enabled bearer , priority 0 [ 37.032464][ T328] tipc: Disabling bearer [ 37.048108][ T337] rust_binder: Write failure EINVAL in pid:12 [ 37.048716][ T340] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 37.199276][ T357] binder: Bad value for 'stats' [ 37.237687][ T359] netlink: 104 bytes leftover after parsing attributes in process `syz.3.15'. [ 37.256349][ T361] ======================================================= [ 37.256349][ T361] WARNING: The mand mount option has been deprecated and [ 37.256349][ T361] and is ignored by this kernel. Remove the mand [ 37.256349][ T361] option from the mount to silence this warning. [ 37.256349][ T361] ======================================================= [ 37.355762][ T45] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 37.365700][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 37.465010][ T378] rust_binder: Failed to allocate buffer. len:4216, is_oneway:false [ 37.472809][ T380] netlink: 12 bytes leftover after parsing attributes in process `syz.3.23'. [ 37.506027][ T45] usb 1-1: Using ep0 maxpacket: 16 [ 37.513203][ T45] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 37.524809][ T45] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 37.539909][ T45] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 37.546098][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 37.552359][ T45] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 37.557942][ T9] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 37.567872][ T45] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.581952][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.590253][ T45] usb 1-1: Product: syz [ 37.601972][ T9] usb 3-1: config 0 descriptor?? [ 37.603904][ T45] usb 1-1: Manufacturer: syz [ 37.621375][ T45] usb 1-1: SerialNumber: syz [ 37.723030][ T389] netlink: 104 bytes leftover after parsing attributes in process `syz.3.25'. [ 38.016789][ T9] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 38.025755][ T305] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 38.029481][ T9] asix 3-1:0.0: probe with driver asix failed with error -32 [ 38.039357][ T45] usb 1-1: 0:2 : does not exist [ 38.187192][ T305] usb 2-1: config 0 has an invalid interface number: 235 but max is 0 [ 38.197326][ T305] usb 2-1: config 0 has no interface number 0 [ 38.205147][ T305] usb 2-1: config 0 interface 235 altsetting 8 endpoint 0x2 has invalid maxpacket 1024, setting to 64 [ 38.221686][ T305] usb 2-1: config 0 interface 235 has no altsetting 0 [ 38.239491][ T305] usb 2-1: New USB device found, idVendor=0738, idProduct=4540, bcdDevice=d8.f5 [ 38.250115][ T305] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.268443][ T305] usb 2-1: Product: syz [ 38.276123][ T305] usb 2-1: Manufacturer: syz [ 38.283628][ T305] usb 2-1: SerialNumber: syz [ 38.289831][ T305] usb 2-1: config 0 descriptor?? [ 38.371305][ T9] usb 3-1: USB disconnect, device number 2 [ 38.457759][ T410] input: syz0 as /devices/virtual/input/input4 [ 38.470158][ T410] rust_binder: Error while translating object. [ 38.470194][ T410] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 38.477134][ T410] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:51 [ 38.522396][ T36] kauditd_printk_skb: 87 callbacks suppressed [ 38.522414][ T36] audit: type=1400 audit(1750894157.769:161): avc: denied { create } for pid=411 comm="syz.3.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 38.581285][ T305] usb 2-1: USB disconnect, device number 2 [ 38.595086][ T36] audit: type=1400 audit(1750894157.799:162): avc: denied { mount } for pid=396 comm="syz.1.28" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 38.635322][ T36] audit: type=1400 audit(1750894157.799:163): avc: denied { create } for pid=396 comm="syz.1.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 38.666512][ T36] audit: type=1400 audit(1750894157.799:164): avc: denied { setopt } for pid=396 comm="syz.1.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 38.694622][ T36] audit: type=1400 audit(1750894157.829:165): avc: denied { setopt } for pid=411 comm="syz.3.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 38.722308][ T36] audit: type=1400 audit(1750894157.889:166): avc: denied { write } for pid=414 comm="syz.3.34" name="001" dev="devtmpfs" ino=108 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 38.758829][ T9] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 38.879055][ T45] usb 1-1: 1:0: failed to get current value for ch 0 (-22) [ 38.902083][ T45] usb 1-1: USB disconnect, device number 2 [ 38.914673][ T36] audit: type=1400 audit(1750894158.159:167): avc: denied { create } for pid=418 comm="syz.3.35" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 38.928866][ T307] udevd[307]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 38.952977][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 38.979878][ T9] usb 3-1: New USB device found, idVendor=056e, idProduct=00ff, bcdDevice= 0.00 [ 38.994376][ T36] audit: type=1400 audit(1750894158.239:168): avc: denied { connect } for pid=418 comm="syz.3.35" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 39.028742][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.041812][ T9] usb 3-1: config 0 descriptor?? [ 39.051042][ T36] audit: type=1400 audit(1750894158.299:169): avc: denied { ioctl } for pid=418 comm="syz.3.35" path="socket:[3840]" dev="sockfs" ino=3840 ioctlcmd=0x7437 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 39.232250][ T36] audit: type=1400 audit(1750894158.479:170): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 39.297316][ T9] elecom 0003:056E:00FF.0001: hidraw0: USB HID v0.00 Device [HID 056e:00ff] on usb-dummy_hcd.2-1/input0 [ 39.345081][ T9] usb 3-1: USB disconnect, device number 3 [ 39.395703][ T304] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 39.512980][ T445] netlink: 4 bytes leftover after parsing attributes in process `syz.2.43'. [ 39.528464][ T445] rust_binder: Write failure EFAULT in pid:33 [ 39.561622][ T304] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 39.583806][ T304] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 39.603582][ T304] usb 4-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 39.614861][ T304] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.636829][ T304] usb 4-1: config 0 descriptor?? [ 39.753873][ T461] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 39.811171][ T465] netlink: 12 bytes leftover after parsing attributes in process `syz.2.48'. [ 39.851548][ T465] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:41 [ 39.892574][ T470] binder: Unknown parameter 'context' [ 40.049782][ T422] can0: slcan on ptm1. [ 40.073306][ T422] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.103636][ T422] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.189124][ T421] can0 (unregistered): slcan off ptm1. [ 40.199613][ T304] usbhid 4-1:0.0: can't add hid device: -71 [ 40.217835][ T304] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 40.241365][ T304] usb 4-1: USB disconnect, device number 2 [ 40.249411][ T490] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:58 [ 40.249462][ T490] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 40.263940][ T490] rust_binder: Read failure Err(EFAULT) in pid:58 [ 40.381317][ T509] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 40.403928][ T509] rust_binder: Write failure EINVAL in pid:30 [ 40.411275][ T509] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 40.717432][ T530] rust_binder: Error in use_page_slow: ESRCH [ 40.717455][ T530] rust_binder: use_range failure ESRCH [ 40.724531][ T530] rust_binder: Failed to allocate buffer. len:88, is_oneway:false [ 40.730820][ T530] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 40.740802][ T530] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:22 [ 40.826679][ T543] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 40.840359][ T543] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:44 [ 40.948871][ T553] IPv6: syztnl0: Disabled Multicast RS [ 40.965341][ T303] Bluetooth: hci0: Frame reassembly failed (-84) [ 40.966141][ T553] binder: Unknown parameter '00000000000000000003' [ 40.975692][ T303] Bluetooth: hci0: Frame reassembly failed (-84) [ 41.045712][ T304] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 41.056227][ T558] netlink: 36 bytes leftover after parsing attributes in process `syz.0.71'. [ 41.205721][ T304] usb 4-1: Using ep0 maxpacket: 16 [ 41.213092][ T304] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 41.232800][ T304] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 41.246272][ T304] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 41.266946][ T304] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 41.282216][ T304] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.291663][ T304] usb 4-1: Product: syz [ 41.301993][ T304] usb 4-1: Manufacturer: syz [ 41.310081][ T304] usb 4-1: SerialNumber: syz [ 41.728609][ T304] usb 4-1: 0:2 : does not exist [ 41.886032][ T45] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 42.030455][ T45] usb 1-1: device descriptor read/64, error -71 [ 42.275837][ T45] usb 1-1: device descriptor read/64, error -71 [ 42.345417][ T304] usb 4-1: 1:0: failed to get current value for ch 0 (-22) [ 42.366162][ T304] usb 4-1: USB disconnect, device number 3 [ 42.525743][ T45] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 42.665791][ T45] usb 1-1: device descriptor read/64, error -71 [ 42.905753][ T45] usb 1-1: device descriptor read/64, error -71 [ 42.956190][ T574] input: syz1 as /devices/virtual/input/input6 [ 43.002270][ T578] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 43.002300][ T578] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:74 [ 43.006315][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 43.021285][ T45] usb usb1-port1: attempt power cycle [ 43.087106][ T585] SELinux: security_context_str_to_sid (sytem_uGй) failed with errno=-22 [ 43.128855][ T590] netlink: 24 bytes leftover after parsing attributes in process `syz.3.82'. [ 43.187103][ T594] tmpfs: Unknown parameter '' [ 43.261990][ T605] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 43.262021][ T605] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:63 [ 43.385776][ T45] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 43.417093][ T45] usb 1-1: device descriptor read/8, error -71 [ 43.465821][ T31] usb 4-1: new low-speed USB device number 4 using dummy_hcd [ 43.535753][ T9] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 43.547453][ T45] usb 1-1: device descriptor read/8, error -71 [ 43.615731][ T31] usb 4-1: Invalid ep0 maxpacket: 64 [ 43.685754][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 43.691686][ T9] usb 2-1: too many configurations: 89, using maximum allowed: 8 [ 43.702058][ T9] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 43.710792][ T9] usb 2-1: can't read configurations, error -61 [ 43.745757][ T31] usb 4-1: new low-speed USB device number 5 using dummy_hcd [ 43.785746][ T45] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 43.816890][ T45] usb 1-1: device descriptor read/8, error -71 [ 43.845776][ T9] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 43.895788][ T31] usb 4-1: Invalid ep0 maxpacket: 64 [ 43.905694][ T31] usb usb4-port1: attempt power cycle [ 43.947114][ T45] usb 1-1: device descriptor read/8, error -71 [ 44.005932][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 44.012090][ T9] usb 2-1: too many configurations: 89, using maximum allowed: 8 [ 44.024565][ T9] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 44.035226][ T9] usb 2-1: can't read configurations, error -61 [ 44.041907][ T9] usb usb2-port1: attempt power cycle [ 44.056481][ T45] usb usb1-port1: unable to enumerate USB device [ 44.245777][ T31] usb 4-1: new low-speed USB device number 6 using dummy_hcd [ 44.266131][ T31] usb 4-1: Invalid ep0 maxpacket: 64 [ 44.385851][ T9] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 44.395743][ T31] usb 4-1: new low-speed USB device number 7 using dummy_hcd [ 44.406197][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 44.414198][ T9] usb 2-1: too many configurations: 89, using maximum allowed: 8 [ 44.426990][ T31] usb 4-1: Invalid ep0 maxpacket: 64 [ 44.426990][ T9] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 44.427017][ T9] usb 2-1: can't read configurations, error -61 [ 44.433763][ T31] usb usb4-port1: unable to enumerate USB device [ 44.565758][ T9] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 44.586172][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 44.592764][ T9] usb 2-1: too many configurations: 89, using maximum allowed: 8 [ 44.602943][ T9] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 44.613746][ T9] usb 2-1: can't read configurations, error -61 [ 44.623766][ T9] usb usb2-port1: unable to enumerate USB device [ 44.921262][ T36] kauditd_printk_skb: 50 callbacks suppressed [ 44.921281][ T36] audit: type=1400 audit(1750894164.169:221): avc: denied { create } for pid=614 comm="syz.0.93" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 44.924023][ T303] tipc: Subscription rejected, illegal request [ 44.929700][ T36] audit: type=1400 audit(1750894164.169:222): avc: denied { connect } for pid=614 comm="syz.0.93" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 44.981717][ T36] audit: type=1400 audit(1750894164.169:223): avc: denied { write } for pid=614 comm="syz.0.93" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 45.004741][ T36] audit: type=1400 audit(1750894164.209:224): avc: denied { read } for pid=614 comm="syz.0.93" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 45.024313][ T619] netlink: 388 bytes leftover after parsing attributes in process `syz.0.95'. [ 45.029221][ T36] audit: type=1400 audit(1750894164.239:225): avc: denied { bind } for pid=616 comm="syz.0.94" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 45.073252][ T36] audit: type=1400 audit(1750894164.319:226): avc: denied { read } for pid=620 comm="syz.0.96" name="ppp" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 45.075964][ T621] rust_binder: Error while translating object. [ 45.100452][ T36] audit: type=1400 audit(1750894164.319:227): avc: denied { open } for pid=620 comm="syz.0.96" path="/dev/ppp" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 45.100484][ T36] audit: type=1400 audit(1750894164.319:228): avc: denied { ioctl } for pid=620 comm="syz.0.96" path="/dev/ppp" dev="devtmpfs" ino=86 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 45.170231][ T621] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 45.170269][ T621] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:58 [ 45.238017][ T624] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=61 sclass=netlink_route_socket pid=624 comm=syz.0.97 [ 45.269755][ T624] netlink: 64 bytes leftover after parsing attributes in process `syz.0.97'. [ 45.281303][ T624] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1539 sclass=netlink_route_socket pid=624 comm=syz.0.97 [ 45.304846][ T624] rust_binder: Error while translating object. [ 45.304876][ T624] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 45.312254][ T624] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:60 [ 45.354632][ T626] SELinux: security_context_str_to_sid () failed with errno=-22 [ 45.894196][ T36] audit: type=1326 audit(1750894165.139:229): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=628 comm="syz.0.99" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f63f118e929 code=0x0 [ 46.237712][ T36] audit: type=1400 audit(1750894165.489:230): avc: denied { append } for pid=631 comm="syz.3.100" name="001" dev="devtmpfs" ino=96 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 46.625815][ T568] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 46.785702][ T568] usb 4-1: Using ep0 maxpacket: 16 [ 46.798368][ T568] usb 4-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 46.812026][ T568] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 46.822762][ T568] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 46.838106][ T568] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 46.853725][ T568] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 46.853999][ T647] netlink: 56 bytes leftover after parsing attributes in process `syz.0.104'. [ 46.873694][ T568] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 46.893709][ T568] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 46.903068][ T568] usb 4-1: SerialNumber: syz [ 46.909478][ T632] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 46.919886][ T568] cdc_acm 4-1:1.0: Control and data interfaces are not separated! [ 46.930348][ T568] cdc_acm 4-1:1.0: probe with driver cdc_acm failed with error -12 [ 47.119724][ T632] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 47.121330][ T31] usb 4-1: USB disconnect, device number 8 [ 47.185740][ T9] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 47.211753][ T650] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:70 [ 47.335777][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 47.355308][ T9] usb 1-1: config index 0 descriptor too short (expected 9, got 0) [ 47.367092][ T9] usb 1-1: can't read configurations, error -22 [ 47.505977][ T9] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 47.655731][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 47.664319][ T9] usb 1-1: config index 0 descriptor too short (expected 9, got 0) [ 47.673151][ T9] usb 1-1: can't read configurations, error -22 [ 47.680414][ T9] usb usb1-port1: attempt power cycle [ 48.025868][ T9] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 48.046184][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 48.055268][ T9] usb 1-1: config index 0 descriptor too short (expected 9, got 0) [ 48.063838][ T9] usb 1-1: can't read configurations, error -22 [ 48.195756][ T9] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 48.212086][ T665] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 48.212102][ T665] rust_binder: Read failure Err(EFAULT) in pid:85 [ 48.223877][ T665] rust_binder: Write failure EINVAL in pid:85 [ 48.224508][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 48.255219][ T9] usb 1-1: config index 0 descriptor too short (expected 9, got 0) [ 48.264000][ T9] usb 1-1: can't read configurations, error -22 [ 48.272638][ T9] usb usb1-port1: unable to enumerate USB device [ 48.308285][ T669] SELinux: Context system_u:object_r:run_init_exec_t:s0 is not valid (left unmapped). [ 48.788268][ T696] SELinux: security_context_str_to_sid () failed with errno=-22 [ 48.837746][ T699] netlink: 388 bytes leftover after parsing attributes in process `syz.3.123'. [ 49.145719][ T9] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 49.145993][ T709] FAULT_INJECTION: forcing a failure. [ 49.145993][ T709] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 49.168496][ T709] CPU: 0 UID: 0 PID: 709 Comm: syz.1.126 Not tainted 6.12.30-syzkaller-g22d634eb24e3 #0 5aa5a802a358a0169efaadab5c3b9a05fad29399 [ 49.168529][ T709] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 49.168547][ T709] Call Trace: [ 49.168552][ T709] [ 49.168557][ T709] __dump_stack+0x21/0x30 [ 49.168576][ T709] dump_stack_lvl+0x10c/0x190 [ 49.168587][ T709] ? __cfi_dump_stack_lvl+0x10/0x10 [ 49.168598][ T709] ? kasan_save_track+0x4f/0x80 [ 49.168612][ T709] dump_stack+0x19/0x20 [ 49.168622][ T709] should_fail_ex+0x3d9/0x530 [ 49.168634][ T709] should_fail_alloc_page+0xeb/0x110 [ 49.168648][ T709] __alloc_pages_noprof+0x19d/0x6c0 [ 49.168659][ T709] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 49.168670][ T709] ? mas_walk+0x3f7/0x650 [ 49.168682][ T709] pte_alloc_one+0x97/0x520 [ 49.168695][ T709] ? __cfi_pte_alloc_one+0x10/0x10 [ 49.168707][ T709] ? rwsem_read_trylock+0x2b1/0x660 [ 49.168719][ T709] ? downgrade_write+0x440/0x440 [ 49.168729][ T709] __pte_alloc+0x79/0x420 [ 49.168741][ T709] ? down_read+0x79/0xe0 [ 49.168752][ T709] ? __cfi___pte_alloc+0x10/0x10 [ 49.168763][ T709] ? pmd_trans_huge_lock+0xad/0xf0 [ 49.168775][ T709] move_pages+0xe47/0x1020 [ 49.168787][ T709] userfaultfd_ioctl+0x37d8/0x4750 [ 49.168801][ T709] ? do_vfs_ioctl+0xeda/0x1e30 [ 49.168814][ T709] ? __ia32_compat_sys_ioctl+0x850/0x850 [ 49.168828][ T709] ? __cfi_userfaultfd_ioctl+0x10/0x10 [ 49.168840][ T709] ? _parse_integer+0x2e/0x40 [ 49.168852][ T709] ? ioctl_has_perm+0x384/0x4d0 [ 49.168867][ T709] ? has_cap_mac_admin+0xd0/0xd0 [ 49.168881][ T709] ? proc_fail_nth_write+0x17e/0x210 [ 49.168891][ T709] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 49.168901][ T709] ? selinux_file_ioctl+0x6e0/0x1360 [ 49.168915][ T709] ? vfs_write+0x8ba/0xe80 [ 49.168927][ T709] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 49.168941][ T709] ? __cfi_vfs_write+0x10/0x10 [ 49.168952][ T709] ? __kasan_check_write+0x18/0x20 [ 49.168963][ T709] ? mutex_unlock+0x8b/0x240 [ 49.168974][ T709] ? __cfi_mutex_unlock+0x10/0x10 [ 49.168984][ T709] ? __fget_files+0x2c5/0x340 [ 49.169010][ T709] ? __fget_files+0x2c5/0x340 [ 49.169023][ T709] ? bpf_lsm_file_ioctl+0xd/0x20 [ 49.169034][ T709] ? security_file_ioctl+0x34/0xd0 [ 49.169048][ T709] ? __cfi_userfaultfd_ioctl+0x10/0x10 [ 49.169085][ T709] __se_sys_ioctl+0x132/0x1b0 [ 49.169099][ T709] __x64_sys_ioctl+0x7f/0xa0 [ 49.169113][ T709] x64_sys_call+0x1878/0x2ee0 [ 49.169128][ T709] do_syscall_64+0x58/0xf0 [ 49.169136][ T709] ? clear_bhb_loop+0x50/0xa0 [ 49.169148][ T709] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 49.169158][ T709] RIP: 0033:0x7fbe4c18e929 [ 49.169172][ T709] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 49.169181][ T709] RSP: 002b:00007fbe4cf73038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 49.169198][ T709] RAX: ffffffffffffffda RBX: 00007fbe4c3b5fa0 RCX: 00007fbe4c18e929 [ 49.169205][ T709] RDX: 0000200000000040 RSI: 00000000c028aa05 RDI: 0000000000000003 [ 49.169212][ T709] RBP: 00007fbe4cf73090 R08: 0000000000000000 R09: 0000000000000000 [ 49.169219][ T709] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 49.169225][ T709] R13: 0000000000000000 R14: 00007fbe4c3b5fa0 R15: 00007ffddfb6a938 [ 49.169233][ T709] [ 49.675745][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 49.682924][ T9] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 49.692534][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 49.704553][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 49.721549][ T9] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 49.732928][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.746383][ T9] usb 4-1: Product: syz [ 49.752498][ T9] usb 4-1: Manufacturer: syz [ 49.760934][ T9] usb 4-1: SerialNumber: syz [ 49.828215][ T714] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 49.844600][ T714] rust_binder: Write failure EINVAL in pid:80 [ 49.844780][ T714] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:80 [ 49.887320][ T719] netlink: 'syz.0.130': attribute type 4 has an invalid length. [ 49.906787][ T719] netlink: 17 bytes leftover after parsing attributes in process `syz.0.130'. [ 49.988925][ T723] fuse: Unknown parameter 'usr_id' [ 50.001856][ T723] tipc: Started in network mode [ 50.011236][ T723] tipc: Node identity 4, cluster identity 4711 [ 50.018926][ T723] tipc: Node number set to 4 [ 50.024541][ T36] kauditd_printk_skb: 21 callbacks suppressed [ 50.024558][ T36] audit: type=1400 audit(1750894169.279:252): avc: denied { shutdown } for pid=722 comm="syz.0.131" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 50.106474][ T725] netlink: 388 bytes leftover after parsing attributes in process `syz.1.132'. [ 50.137292][ T727] netlink: 'syz.1.133': attribute type 4 has an invalid length. [ 50.139568][ T36] audit: type=1400 audit(1750894169.379:253): avc: denied { create } for pid=726 comm="syz.1.133" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 50.171395][ T36] audit: type=1400 audit(1750894169.379:254): avc: denied { create } for pid=726 comm="syz.1.133" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 50.195111][ T36] audit: type=1400 audit(1750894169.399:255): avc: denied { read write } for pid=726 comm="syz.1.133" name="uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 50.197220][ T9] usb 4-1: 0:2 : does not exist [ 50.223451][ T36] audit: type=1400 audit(1750894169.399:256): avc: denied { open } for pid=726 comm="syz.1.133" path="/dev/uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 50.308454][ T36] audit: type=1400 audit(1750894169.559:257): avc: denied { execstack } for pid=733 comm="syz.1.136" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 50.411398][ T36] audit: type=1400 audit(1750894169.659:258): avc: denied { map } for pid=741 comm="syz.0.138" path="socket:[6528]" dev="sockfs" ino=6528 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 50.637439][ T9] usb 4-1: 1:0: cannot get min/max values for control 4 (id 1) [ 50.651247][ T752] netlink: 388 bytes leftover after parsing attributes in process `syz.1.142'. [ 50.661625][ T9] usb 4-1: USB disconnect, device number 9 [ 50.677246][ T307] udevd[307]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 50.737338][ T757] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 50.945762][ T568] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 51.075750][ T9] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 51.085723][ T568] usb 2-1: device descriptor read/64, error -71 [ 51.237032][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 51.249145][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 51.261340][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 51.277171][ T9] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 51.289326][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.300419][ T9] usb 1-1: config 0 descriptor?? [ 51.335803][ T568] usb 2-1: device descriptor read/64, error -71 [ 51.393589][ T36] audit: type=1400 audit(1750894170.639:259): avc: denied { mounton } for pid=760 comm="syz.3.146" path="/syzcgroup/unified/syz3" dev="cgroup2" ino=110 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 51.481157][ T36] audit: type=1400 audit(1750894170.729:260): avc: denied { write } for pid=768 comm="syz.3.149" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 51.518115][ T36] audit: type=1400 audit(1750894170.769:261): avc: denied { setopt } for pid=797 comm="syz.3.150" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 51.546110][ T800] capability: warning: `syz.3.150' uses deprecated v2 capabilities in a way that may be insecure [ 51.595783][ T568] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 51.660002][ T804] rust_binder: validate_parent_fixup: new_min_offset=56, sg_entry.length=0 [ 51.660021][ T804] rust_binder: Error while translating object. [ 51.674647][ T804] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 51.681705][ T804] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:121 [ 51.735731][ T568] usb 2-1: device descriptor read/64, error -71 [ 51.910792][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 51.917399][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 51.929431][ T9] usb 1-1: USB disconnect, device number 11 [ 52.005724][ T568] usb 2-1: device descriptor read/64, error -71 [ 52.115817][ T568] usb usb2-port1: attempt power cycle [ 52.455754][ T568] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 52.476944][ T568] usb 2-1: device descriptor read/8, error -71 [ 52.593720][ T814] input: syz1 as /devices/virtual/input/input8 [ 52.606935][ T568] usb 2-1: device descriptor read/8, error -71 [ 52.622416][ T816] input: syz1 as /devices/virtual/input/input9 [ 52.845757][ T568] usb 2-1: new full-speed USB device number 10 using dummy_hcd [ 52.857226][ T818] rust_binder: Error in use_page_slow: ESRCH [ 52.857239][ T818] rust_binder: use_range failure ESRCH [ 52.864496][ T818] rust_binder: Failed to allocate buffer. len:112, is_oneway:false [ 52.870474][ T818] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 52.878085][ T568] usb 2-1: device descriptor read/8, error -71 [ 52.881071][ T818] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:117 [ 53.017038][ T568] usb 2-1: device descriptor read/8, error -71 [ 53.135913][ T568] usb usb2-port1: unable to enumerate USB device [ 53.412822][ T832] SELinux: Context system_u:object_r:public_content_t:s0 is not valid (left unmapped). [ 53.436600][ T568] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 53.480143][ T840] netlink: 12 bytes leftover after parsing attributes in process `syz.0.165'. [ 53.508224][ T843] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:132 [ 53.519596][ T845] loop0: detected capacity change from 0 to 8388608 [ 53.552955][ T850] netlink: 340 bytes leftover after parsing attributes in process `syz.0.168'. [ 53.574670][ T850] netlink: 340 bytes leftover after parsing attributes in process `syz.0.168'. [ 53.618541][ T568] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 53.630699][ T568] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 53.643346][ T568] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 53.657736][ T568] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 53.668147][ T568] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 53.682807][ T568] usb 4-1: config 0 descriptor?? [ 53.722643][ T857] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 53.722844][ T857] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:139 [ 53.764263][ T861] netlink: 388 bytes leftover after parsing attributes in process `syz.0.171'. [ 53.806977][ T863] rust_binder: Error while translating object. [ 53.807020][ T863] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 53.814675][ T863] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:148 [ 53.827346][ T866] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 53.845282][ T865] rust_binder: Error while translating object. [ 53.845326][ T865] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 53.852127][ T865] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:148 [ 54.301727][ T568] usbhid 4-1:0.0: can't add hid device: -71 [ 54.319433][ T568] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 54.329167][ T568] usb 4-1: USB disconnect, device number 10 [ 54.602843][ T874] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 54.602866][ T874] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:145 [ 54.622118][ T877] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 54.632542][ T877] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:149 [ 55.005372][ T907] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.072044][ T36] kauditd_printk_skb: 16 callbacks suppressed [ 55.072063][ T36] audit: type=1400 audit(1750894174.319:278): avc: denied { remount } for pid=906 comm="syz.3.189" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 55.235712][ T568] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 55.355785][ T45] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 55.407093][ T568] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 55.419308][ T568] usb 2-1: config 0 has no interface number 0 [ 55.426192][ T568] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 55.441119][ T568] usb 2-1: config 0 interface 8 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 55.453111][ T36] audit: type=1400 audit(1750894174.699:279): avc: denied { mounton } for pid=917 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 55.462480][ T568] usb 2-1: New USB device found, idVendor=0582, idProduct=b9d5, bcdDevice=73.f7 [ 55.495958][ T568] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 55.511880][ T568] usb 2-1: config 0 descriptor?? [ 55.527408][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 55.541718][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 55.556008][ T307] udevd[307]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.8/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 55.557166][ T45] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 55.593837][ T45] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 55.608965][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 55.619388][ T45] usb 1-1: config 0 descriptor?? [ 55.622427][ T917] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.634186][ T917] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.643736][ T917] bridge_slave_0: entered allmulticast mode [ 55.650891][ T917] bridge_slave_0: entered promiscuous mode [ 55.660058][ T917] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.668070][ T917] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.676398][ T917] bridge_slave_1: entered allmulticast mode [ 55.683588][ T917] bridge_slave_1: entered promiscuous mode [ 55.751535][ T903] kvm: user requested TSC rate below hardware speed [ 55.764138][ T903] overlayfs: workdir and upperdir must be separate subtrees [ 55.777502][ T903] input: syz1 as /devices/virtual/input/input10 [ 55.820192][ T303] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.828047][ T303] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.840899][ T303] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.848821][ T303] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.869921][ T568] usb 2-1: USB disconnect, device number 11 [ 55.898845][ T917] veth0_vlan: entered promiscuous mode [ 55.912815][ T917] veth1_macvtap: entered promiscuous mode [ 55.949763][ T36] audit: type=1400 audit(1750894175.199:280): avc: denied { mount } for pid=917 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 55.982358][ T36] audit: type=1400 audit(1750894175.199:281): avc: denied { mounton } for pid=917 comm="syz-executor" path="/root/syzkaller.2aZd20/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 56.029416][ T36] audit: type=1400 audit(1750894175.279:282): avc: denied { accept } for pid=923 comm="syz.4.192" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 56.053121][ T36] audit: type=1400 audit(1750894175.279:283): avc: denied { append } for pid=925 comm="syz.4.194" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 56.114192][ T936] binder: Binderfs stats mode cannot be changed during a remount [ 56.148218][ T9] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 56.276176][ T945] rust_binder: Write failure EFAULT in pid:23 [ 56.281596][ T45] usbhid 1-1:0.0: can't add hid device: -71 [ 56.302086][ T45] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 56.315974][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 56.317439][ T45] usb 1-1: USB disconnect, device number 12 [ 56.325454][ T9] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 56.346545][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 56.360699][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 56.372498][ T9] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 56.386027][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 56.401549][ T9] usb 4-1: Product: syz [ 56.406907][ T9] usb 4-1: Manufacturer: syz [ 56.412239][ T9] usb 4-1: SerialNumber: syz [ 56.431466][ T953] kvm: vcpu 0: requested 128 ns lapic timer period limited to 200000 ns [ 56.441616][ T953] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 56.656153][ T959] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 56.664542][ T959] rust_binder: Write failure EINVAL in pid:169 [ 56.666177][ T959] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:169 [ 56.675501][ T959] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 56.695808][ T959] rust_binder: Write failure EINVAL in pid:169 [ 56.739600][ T36] audit: type=1400 audit(1750894175.989:284): avc: denied { wake_alarm } for pid=964 comm="syz.1.205" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 56.845695][ T36] audit: type=1400 audit(1750894176.089:285): avc: denied { append } for pid=972 comm="syz.0.208" name="vsock" dev="devtmpfs" ino=208 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 56.884859][ T707] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 56.896260][ T975] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 56.896297][ T975] rust_binder: Read failure Err(EFAULT) in pid:174 [ 56.896809][ T36] audit: type=1400 audit(1750894176.149:286): avc: denied { map } for pid=974 comm="syz.0.209" path="/dev/uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 56.937489][ T707] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 56.958350][ T36] audit: type=1400 audit(1750894176.149:287): avc: denied { create } for pid=974 comm="syz.0.209" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 56.984641][ T9] usb 4-1: 0:2 : does not exist [ 57.007815][ T976] fido_id[976]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 57.018997][ T9] usb 4-1: 1:0: cannot get min/max values for control 4 (id 1) [ 57.052001][ T9] usb 4-1: USB disconnect, device number 11 [ 57.072255][ T307] udevd[307]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 57.335732][ T306] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 57.497088][ T306] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 57.510286][ T306] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 57.522958][ T306] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 57.538484][ T306] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 57.550218][ T306] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 57.562914][ T306] usb 1-1: config 0 descriptor?? [ 57.972338][ T306] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 57.980551][ T306] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 57.989046][ T306] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 57.999747][ T306] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 58.009147][ T306] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 58.017909][ T306] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 58.029164][ T306] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 58.041237][ T306] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 58.050582][ T306] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 58.059811][ T306] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 58.068851][ T306] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 58.078221][ T306] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 58.086759][ T306] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 58.095196][ T306] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 58.103961][ T306] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 58.112069][ T306] plantronics 0003:047F:FFFF.0003: No inputs registered, leaving [ 58.121921][ T306] plantronics 0003:047F:FFFF.0003: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 58.174205][ T304] usb 1-1: USB disconnect, device number 13 [ 73.534728][ T36] audit: type=1400 audit(1750894192.779:288): avc: denied { bind } for pid=998 comm="syz.4.218" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 73.577641][ T1002] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 73.596289][ T36] audit: type=1326 audit(1750894192.839:289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1006 comm="syz.1.221" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbe4c18e929 code=0x0 [ 73.895763][ T304] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 73.906144][ T9] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 74.047383][ T304] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 74.058439][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 74.063922][ T304] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 74.074408][ T304] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 74.088319][ T304] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 74.098089][ T304] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 74.106936][ T9] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 74.116451][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 74.127198][ T304] usb 4-1: config 0 descriptor?? [ 74.132425][ T9] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 74.143468][ T9] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 74.153285][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 74.161822][ T9] usb 1-1: Product: syz [ 74.166345][ T9] usb 1-1: Manufacturer: syz [ 74.171152][ T9] usb 1-1: SerialNumber: syz [ 74.456687][ T1029] exFAT-fs (rnullb0): invalid boot record signature [ 74.467744][ T1029] exFAT-fs (rnullb0): failed to read boot sector [ 74.480228][ T1029] exFAT-fs (rnullb0): failed to recognize exfat type [ 74.544471][ T304] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 74.552436][ T304] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 74.560944][ T304] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 74.568971][ T304] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 74.577499][ T304] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 74.585814][ T304] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 74.594853][ T304] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 74.603060][ T304] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 74.611579][ T304] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 74.619589][ T304] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 74.627885][ T304] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 74.636597][ T304] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 74.647421][ T304] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 74.658157][ T304] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 74.666504][ T304] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 74.675188][ T9] usb 1-1: 0:2 : does not exist [ 74.681835][ T304] plantronics 0003:047F:FFFF.0004: No inputs registered, leaving [ 74.692141][ T9] usb 1-1: 1:0: cannot get min/max values for control 4 (id 1) [ 74.701842][ T304] plantronics 0003:047F:FFFF.0004: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 74.719428][ T9] usb 1-1: USB disconnect, device number 14 [ 74.748694][ T304] usb 4-1: USB disconnect, device number 12 [ 75.257430][ T1041] tun0: tun_chr_ioctl cmd 1074025675 [ 75.263647][ T1041] tun0: persist disabled [ 75.269726][ T36] audit: type=1400 audit(1750894194.519:290): avc: denied { create } for pid=1040 comm="syz.0.230" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 75.270551][ T1041] tun0: tun_chr_ioctl cmd 1074812117 [ 75.291946][ T36] audit: type=1326 audit(1750894194.549:291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1028 comm="syz.1.227" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbe4c18e929 code=0x7fc00000 [ 75.325706][ T1043] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:154 [ 75.325993][ T36] audit: type=1400 audit(1750894194.579:292): avc: denied { getopt } for pid=1042 comm="syz.3.231" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 75.371239][ T36] audit: type=1400 audit(1750894194.619:293): avc: denied { create } for pid=1044 comm="syz.1.232" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 75.392124][ T1045] 9pnet_fd: Insufficient options for proto=fd [ 75.393719][ T36] audit: type=1400 audit(1750894194.629:294): avc: denied { create } for pid=1046 comm="syz.3.233" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 75.436136][ T1051] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=126 sclass=netlink_route_socket pid=1051 comm=syz.0.235 [ 75.493737][ T36] audit: type=1400 audit(1750894194.739:295): avc: denied { relabelfrom } for pid=1053 comm="syz.4.236" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 75.520538][ T36] audit: type=1400 audit(1750894194.739:296): avc: denied { relabelto } for pid=1053 comm="syz.4.236" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 75.537358][ T1057] batadv_slave_1: entered promiscuous mode [ 75.558658][ T1055] batadv_slave_1: left promiscuous mode [ 75.597026][ T36] audit: type=1400 audit(1750894194.839:297): avc: denied { create } for pid=1065 comm="syz.0.240" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 75.665344][ T1049] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 75.815772][ T9] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 75.855808][ T304] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 75.976916][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 75.988763][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 76.000028][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 76.014516][ T9] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 76.024414][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 76.033623][ T9] usb 2-1: config 0 descriptor?? [ 76.039250][ T304] usb 1-1: unable to get BOS descriptor or descriptor too short [ 76.049096][ T304] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 76.056787][ T304] usb 1-1: can't read configurations, error -71 [ 76.442139][ T9] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 76.450136][ T9] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 76.459231][ T9] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 76.467755][ T9] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 76.476175][ T9] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 76.486753][ T9] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 76.495204][ T9] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 76.505155][ T9] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 76.514040][ T9] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 76.522376][ T9] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 76.530540][ T9] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 76.539009][ T9] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 76.548175][ T9] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 76.556100][ T9] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 76.565691][ T399] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 76.573703][ T9] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 76.583243][ T9] plantronics 0003:047F:FFFF.0005: No inputs registered, leaving [ 76.594359][ T9] plantronics 0003:047F:FFFF.0005: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 76.647646][ T45] usb 2-1: USB disconnect, device number 12 [ 76.727080][ T399] usb 4-1: config 0 has an invalid interface number: 168 but max is 0 [ 76.736747][ T399] usb 4-1: config 0 has no interface number 0 [ 76.743307][ T399] usb 4-1: config 0 interface 168 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 76.755350][ T399] usb 4-1: config 0 interface 168 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 76.766201][ T399] usb 4-1: config 0 interface 168 has no altsetting 0 [ 76.773270][ T399] usb 4-1: New USB device found, idVendor=046d, idProduct=c70e, bcdDevice= 0.00 [ 76.782785][ T399] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 76.793060][ T399] usb 4-1: config 0 descriptor?? [ 76.937474][ T1094] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 76.937497][ T1094] rust_binder: Read failure Err(EFAULT) in pid:218 [ 77.170228][ T1098] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=43 sclass=netlink_route_socket pid=1098 comm=syz.1.251 [ 77.209296][ T399] logitech-djreceiver 0003:046D:C70E.0006: hidraw0: USB HID v0.00 Device [HID 046d:c70e] on usb-dummy_hcd.3-1/input168 [ 77.235965][ T45] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 77.257787][ T1113] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 77.258195][ T1113] cgroup: subsys name conflicts with all [ 77.299946][ T1117] rust_binder: Error while translating object. [ 77.299972][ T1117] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 77.306735][ T1117] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:228 [ 77.365029][ T1119] SELinux: Context system_u:object_r:checkpolicy_exec_t:s0 is not valid (left unmapped). [ 77.395763][ T46] Bluetooth: hci0: Frame reassembly failed (-84) [ 77.402398][ T1121] Bluetooth: hci0: Frame reassembly failed (-84) [ 77.404640][ T568] usb 4-1: USB disconnect, device number 13 [ 77.415492][ T1121] netlink: 8 bytes leftover after parsing attributes in process `syz.1.259'. [ 77.416482][ T45] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 77.439231][ T45] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 77.448903][ T45] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 77.457809][ T45] usb 1-1: Product: syz [ 77.462495][ T45] usb 1-1: Manufacturer: syz [ 77.467120][ T45] usb 1-1: SerialNumber: syz [ 78.481252][ T1096] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 78.491897][ T1096] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 78.503749][ T45] cdc_ncm 1-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 78.513596][ T45] cdc_ncm 1-1:1.0: dwNtbInMaxSize=17 is too small. Using 2048 [ 78.523303][ T45] cdc_ncm 1-1:1.0: setting rx_max = 2048 [ 78.705156][ T45] cdc_ncm 1-1:1.0: setting tx_max = 88 [ 78.712887][ T45] cdc_ncm 1-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.0-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 78.728355][ T45] usb 1-1: USB disconnect, device number 17 [ 78.736879][ T45] cdc_ncm 1-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.0-1, CDC NCM (NO ZLP) [ 78.748157][ T1127] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 78.748441][ T1127] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 144, size: 255) [ 78.757859][ T1127] rust_binder: Error while translating object. [ 78.769797][ T1127] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 78.779458][ T1127] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:51 [ 78.826609][ T36] kauditd_printk_skb: 11 callbacks suppressed [ 78.826626][ T36] audit: type=1400 audit(1750894198.079:309): avc: denied { listen } for pid=1136 comm="syz.4.262" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 78.867741][ T36] audit: type=1400 audit(1750894198.099:310): avc: denied { accept } for pid=1136 comm="syz.4.262" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 79.064132][ T36] audit: type=1400 audit(1750894198.309:311): avc: denied { read } for pid=1165 comm="syz.3.265" name="snapshot" dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 79.089974][ T36] audit: type=1400 audit(1750894198.309:312): avc: denied { open } for pid=1165 comm="syz.3.265" path="/dev/snapshot" dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 79.221327][ T1171] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 79.222105][ T1171] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 79.229381][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.236654][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.243697][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.250479][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.257547][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.264618][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.271329][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.278298][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.285992][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.292696][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.299960][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.307812][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.314414][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.321907][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.329528][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.337031][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.345817][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.352628][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.369942][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.378132][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.385234][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.399921][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.402958][ T36] audit: type=1400 audit(1750894198.649:313): avc: denied { create } for pid=1179 comm="syz.4.270" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 79.411685][ T554] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 79.419793][ T53] Bluetooth: hci0: command 0x1003 tx timeout [ 79.445818][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.453781][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.461469][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.470449][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.482138][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.489131][ T1183] netlink: 104 bytes leftover after parsing attributes in process `syz.4.272'. [ 79.515872][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.515902][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.524853][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.552363][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.559883][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.567015][ T1172] rust_binder: Write failure EINVAL in pid:179 [ 79.573709][ T1190] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 79.579238][ T36] audit: type=1400 audit(1750894198.829:314): avc: denied { map } for pid=1188 comm="syz.0.275" path="/dev/ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 79.581528][ T1190] rust_binder: Read failure Err(EFAULT) in pid:62 [ 79.608399][ T36] audit: type=1400 audit(1750894198.859:315): avc: denied { bind } for pid=1193 comm="syz.3.276" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 79.647051][ T1194] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:183 [ 79.653356][ T36] audit: type=1400 audit(1750894198.859:316): avc: denied { name_bind } for pid=1193 comm="syz.3.276" src=19997 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 79.676883][ T1194] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 79.696664][ T1194] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:183 [ 79.708344][ T1199] syzkaller0: entered promiscuous mode [ 79.716669][ T36] audit: type=1400 audit(1750894198.859:317): avc: denied { node_bind } for pid=1193 comm="syz.3.276" saddr=172.20.20.187 src=19997 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 79.720827][ T1199] syzkaller0: entered allmulticast mode [ 79.811368][ T36] audit: type=1400 audit(1750894199.059:318): avc: denied { getopt } for pid=1197 comm="syz.4.278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 79.869815][ T1212] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 79.877946][ T1212] rust_binder: Write failure EINVAL in pid:69 [ 79.907062][ T1221] netlink: 104 bytes leftover after parsing attributes in process `syz.0.285'. [ 79.914962][ T1219] rust_binder: Write failure EFAULT in pid:71 [ 79.969583][ T1231] batadv_slave_1: entered promiscuous mode [ 80.039324][ T1232] batadv_slave_1: left promiscuous mode [ 80.235757][ T399] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 80.387046][ T399] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 80.397854][ T399] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 80.409178][ T399] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 80.420314][ T399] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 80.429004][ T399] usb 4-1: SerialNumber: syz [ 80.436004][ T306] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 80.597342][ T306] usb 1-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 80.607881][ T306] usb 1-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 80.622402][ T306] usb 1-1: config 0 interface 0 has no altsetting 0 [ 80.629632][ T306] usb 1-1: New USB device found, idVendor=17ef, idProduct=6085, bcdDevice= 0.00 [ 80.639977][ T306] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 80.648949][ T306] usb 1-1: config 0 descriptor?? [ 80.693833][ T399] usb 4-1: 0:2 : does not exist [ 80.705214][ T399] usb 4-1: USB disconnect, device number 14 [ 80.717753][ T1038] udevd[1038]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 81.066140][ T306] hid-rmi 0003:17EF:6085.0007: unknown main item tag 0x0 [ 81.073626][ T306] hid-rmi 0003:17EF:6085.0007: unknown main item tag 0x0 [ 81.081214][ T306] hid-rmi 0003:17EF:6085.0007: unknown main item tag 0x0 [ 81.088672][ T306] hid-rmi 0003:17EF:6085.0007: unknown main item tag 0x0 [ 81.095875][ T399] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 81.096213][ T306] hid-rmi 0003:17EF:6085.0007: unknown main item tag 0x0 [ 81.111034][ T306] hid-rmi 0003:17EF:6085.0007: unknown main item tag 0x0 [ 81.118931][ T306] hid-rmi 0003:17EF:6085.0007: unknown main item tag 0x0 [ 81.126319][ T306] hid-rmi 0003:17EF:6085.0007: unknown main item tag 0x0 [ 81.133618][ T306] hid-rmi 0003:17EF:6085.0007: item fetching failed at offset 10/11 [ 81.141999][ T306] hid-rmi 0003:17EF:6085.0007: parse failed [ 81.148592][ T306] hid-rmi 0003:17EF:6085.0007: probe with driver hid-rmi failed with error -22 [ 81.245698][ T399] usb 4-1: Using ep0 maxpacket: 16 [ 81.252281][ T399] usb 4-1: config 0 has an invalid interface number: 105 but max is 0 [ 81.260726][ T399] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 81.275322][ T399] usb 4-1: config 0 has no interface number 0 [ 81.276514][ T306] usb 1-1: USB disconnect, device number 18 [ 81.287661][ T399] usb 4-1: New USB device found, idVendor=046d, idProduct=000d, bcdDevice= 0.00 [ 81.298663][ T399] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.306966][ T399] usb 4-1: Product: syz [ 81.311686][ T399] usb 4-1: Manufacturer: syz [ 81.316471][ T399] usb 4-1: SerialNumber: syz [ 81.324223][ T399] usb 4-1: config 0 descriptor?? [ 81.659522][ T399] usb 4-1: Found UVC 0.00 device syz (046d:000d) [ 81.666462][ T399] usb 4-1: No valid video chain found. [ 81.674726][ T399] usb 4-1: USB disconnect, device number 15 [ 81.824265][ T1272] rust_binder: Write failure EINVAL in pid:268 [ 82.191214][ T1282] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 82.246334][ T1282] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 82.253222][ T1282] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:206 [ 82.650683][ T1289] netlink: 104 bytes leftover after parsing attributes in process `syz.0.307'. [ 83.435705][ T9] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 83.575692][ T9] usb 4-1: device descriptor read/64, error -71 [ 83.726856][ T1313] netlink: 104 bytes leftover after parsing attributes in process `syz.0.316'. [ 83.825694][ T9] usb 4-1: device descriptor read/64, error -71 [ 83.828200][ T1323] input: syz0 as /devices/virtual/input/input11 [ 83.931706][ T1333] rust_binder: Error while translating object. [ 83.931743][ T1333] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 83.939306][ T1333] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:257 [ 84.075783][ T9] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 84.176993][ T1352] rust_binder: Error while translating object. [ 84.177015][ T1352] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 84.183726][ T1352] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:86 [ 84.195726][ T305] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 84.215880][ T9] usb 4-1: device descriptor read/64, error -71 [ 84.226068][ T306] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 84.375743][ T305] usb 2-1: Using ep0 maxpacket: 8 [ 84.382262][ T306] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 84.393782][ T306] usb 1-1: config 27 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 84.405954][ T306] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 84.418570][ T306] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 84.428580][ T306] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 84.438196][ T305] usb 2-1: config 1 has an invalid interface number: 4 but max is 2 [ 84.446702][ T305] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 84.457016][ T306] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 84.465684][ T305] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 84.465725][ T9] usb 4-1: device descriptor read/64, error -71 [ 84.474941][ T305] usb 2-1: config 1 has no interface number 1 [ 84.474979][ T305] usb 2-1: too many endpoints for config 1 interface 4 altsetting 38: 238, using maximum allowed: 30 [ 84.500183][ T305] usb 2-1: config 1 interface 4 altsetting 38 has 0 endpoint descriptors, different from the interface descriptor's value: 238 [ 84.513826][ T305] usb 2-1: config 1 interface 4 has no altsetting 0 [ 84.521724][ T306] usb 1-1: invalid MIDI out EP 0 [ 84.528422][ T305] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 84.538381][ T305] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 84.547035][ T305] usb 2-1: Product: ఁ [ 84.552172][ T306] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 84.562717][ T305] usb 2-1: Manufacturer: 춧ꩍ쑯ꌠ榑ᱞ鄎맷㶋ᨲᝅ琰✫ⴻ첗剉坙蹠⧲㼲㱭躘矸朌躄ᶁ薕쩸䄇⻡쵏ῒᲄ屰俶躄͞愹뻃뭚쬰㠕ꙇ撮珠࿕ꌽ捎伿琭ﷇ閭ᱫ赪迎ﺬ员﵀첪裗䮸瓝䁦蓑廯ᣇ䬸⟁흘終ﯼ᧌韱똔翃豻ګ⒄漼쎔껰䄂毖㵲憭郸习 镑㢀 [ 84.593098][ T305] usb 2-1: SerialNumber: Ћ [ 84.595802][ T9] usb usb4-port1: attempt power cycle [ 84.724561][ T36] kauditd_printk_skb: 9 callbacks suppressed [ 84.724585][ T36] audit: type=1400 audit(1750894203.969:328): avc: denied { remount } for pid=1342 comm="syz.0.326" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 84.731079][ T1343] rust_binder: Write failure EINVAL in pid:313 [ 84.756098][ T306] usb 1-1: USB disconnect, device number 19 [ 84.813671][ T305] usb 2-1: 0:2 : does not exist [ 84.816078][ T36] audit: type=1400 audit(1750894204.069:329): avc: denied { accept } for pid=1371 comm="syz.1.336" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 84.823527][ T1372] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 84.839265][ T1372] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:264 [ 84.842785][ T305] usb 2-1: USB disconnect, device number 13 [ 84.887859][ T1374] binder: Unknown parameter 'uid' [ 84.945710][ T9] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 84.966748][ T9] usb 4-1: device descriptor read/8, error -71 [ 85.021025][ T36] audit: type=1400 audit(1750894204.269:330): avc: denied { read } for pid=1376 comm="syz.1.338" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 85.044500][ T36] audit: type=1400 audit(1750894204.269:331): avc: denied { open } for pid=1376 comm="syz.1.338" path="/97/file0/.pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 85.069049][ T36] audit: type=1400 audit(1750894204.269:332): avc: denied { ioctl } for pid=1376 comm="syz.1.338" path="/97/file0/.pending_reads" dev="incremental-fs" ino=2 ioctlcmd=0x671e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 85.106843][ T9] usb 4-1: device descriptor read/8, error -71 [ 85.333413][ T36] audit: type=1400 audit(1750894204.579:333): avc: denied { sqpoll } for pid=1410 comm="syz.4.350" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 85.339308][ T1411] rust_binder: Error while translating object. [ 85.352527][ T36] audit: type=1400 audit(1750894204.579:334): avc: denied { map } for pid=1410 comm="syz.4.350" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=11844 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 85.366047][ T1411] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 85.383388][ T9] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 85.400534][ T1411] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:120 [ 85.401459][ T36] audit: type=1400 audit(1750894204.579:335): avc: denied { read write } for pid=1410 comm="syz.4.350" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=11844 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 85.435510][ T36] audit: type=1400 audit(1750894204.669:336): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 85.459078][ T1414] kvm: kvm [1413]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010015) = 0x882 [ 85.460348][ T9] usb 4-1: device descriptor read/8, error -71 [ 85.479945][ T1416] TCP: TCP_TX_DELAY enabled [ 85.484538][ T36] audit: type=1400 audit(1750894204.729:337): avc: denied { setopt } for pid=1413 comm="syz.4.352" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 85.506169][ T1416] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5482 sclass=netlink_route_socket pid=1416 comm=syz.0.351 [ 85.520221][ T1416] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 85.520254][ T1416] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:315 [ 85.545695][ T305] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 85.563319][ T1423] rust_binder: Failed to allocate buffer. len:112, is_oneway:false [ 85.606352][ T9] usb 4-1: device descriptor read/8, error -71 [ 85.612431][ T1431] rust_binder: Error while translating object. [ 85.620518][ T1431] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 85.626906][ T1431] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:326 [ 85.686214][ T1438] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=1438 comm=syz.0.359 [ 85.715841][ T9] usb usb4-port1: unable to enumerate USB device [ 85.725702][ T305] usb 2-1: Using ep0 maxpacket: 16 [ 85.735289][ T305] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 85.744163][ T305] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 85.755164][ T305] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 85.766274][ T305] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 85.775365][ T305] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.783445][ T305] usb 2-1: Product: syz [ 85.788817][ T305] usb 2-1: Manufacturer: syz [ 85.793663][ T305] usb 2-1: SerialNumber: syz [ 86.104040][ T1464] /dev/rnullb0: Can't open blockdev [ 86.129747][ T1466] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 86.129797][ T1466] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:153 [ 86.201018][ T305] usb 2-1: 0:2 : does not exist [ 86.205504][ T1468] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:213 [ 86.293866][ T1476] 9pnet_virtio: no channels available for device 127.0.0.1 [ 86.387981][ T1484] rust_binder: Write failure EFAULT in pid:164 [ 86.418650][ T1489] rust_binder: Write failure EINVAL in pid:169 [ 86.474094][ T1476] binder: Unknown parameter 'fscontext?}l@' [ 86.604681][ T1504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 86.629980][ T1515] 9pnet_fd: Insufficient options for proto=fd [ 86.767687][ T1528] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:346 [ 86.829914][ T305] usb 2-1: 1:0: failed to get current value for ch 0 (-22) [ 86.854451][ T305] usb 2-1: USB disconnect, device number 14 [ 86.999366][ T1535] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 86.999458][ T1535] rust_binder: inc_ref_done called when no active inc_refs [ 87.845728][ T45] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 87.885727][ T568] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 88.007061][ T45] usb 2-1: config 0 interface 0 altsetting 238 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 88.018478][ T45] usb 2-1: config 0 interface 0 altsetting 238 endpoint 0x81 has invalid wMaxPacketSize 0 [ 88.029763][ T45] usb 2-1: config 0 interface 0 has no altsetting 0 [ 88.037287][ T45] usb 2-1: New USB device found, idVendor=1a34, idProduct=f705, bcdDevice= 0.00 [ 88.048926][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 88.057920][ T568] usb 1-1: Using ep0 maxpacket: 8 [ 88.064836][ T45] usb 2-1: config 0 descriptor?? [ 88.071915][ T568] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 88.081639][ T568] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 88.090219][ T1553] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 88.092771][ T1553] rust_binder: Read failure Err(EFAULT) in pid:227 [ 88.093480][ T568] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 88.106644][ T1553] rust_binder: Write failure EINVAL in pid:227 [ 88.112670][ T568] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 88.141207][ T568] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.151036][ T568] usb 1-1: Product: ਡࡾ岜ᴑ攸゘䛔멗먢黸悆ቨ꒗탮ö珲ʭ沼쯖巟鸛勂꒫養犦㑤๒亾 륩앚뗰宄Ĺꏧ䦏峾鎜鰚 [ 88.168778][ T568] usb 1-1: SerialNumber: ᠍삩뇷陳˅鵉놅艡㢼㲀ࢤ첈﹄ꥥ黵㾲掄㽷ᾪ諅闯ᷝᷡ෭乎㸂펨䧻斴㜄捉걑䉺텣䤃奝糩ᑘ磩揗ﭫ⏷譥ວि您꥗ꉠ˸ﹼ縠㘧 [ 88.240201][ T1556] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 88.240326][ T1556] rust_binder: inc_ref_done called when no active inc_refs [ 88.277869][ T45] usbhid 2-1:0.0: can't add hid device: -71 [ 88.292072][ T45] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 88.301751][ T45] usb 2-1: USB disconnect, device number 15 [ 88.314617][ T1568] tmpfs: Bad value for 'uid' [ 88.319496][ T1568] tmpfs: Bad value for 'uid' [ 88.396561][ T568] usb 1-1: 0:2 : does not exist [ 88.406270][ T568] usb 1-1: USB disconnect, device number 20 [ 88.437836][ T1575] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 88.437862][ T1575] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:358 [ 88.496822][ T1578] rust_binder: Failed to allocate buffer. len:128, is_oneway:false [ 88.507370][ T1579] rust_binder: Failed to allocate buffer. len:8, is_oneway:true [ 88.675752][ T45] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 88.835724][ T45] usb 2-1: Using ep0 maxpacket: 16 [ 88.842325][ T45] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 88.851839][ T45] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 88.862649][ T45] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 88.873845][ T45] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 88.883635][ T45] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.892517][ T45] usb 2-1: Product: syz [ 88.897286][ T45] usb 2-1: Manufacturer: syz [ 88.902225][ T45] usb 2-1: SerialNumber: syz [ 89.139708][ T1583] SELinux: ebitmap: truncated map [ 89.146468][ T1583] SELinux: failed to load policy [ 89.310265][ T45] usb 2-1: 0:2 : does not exist [ 89.444256][ T1593] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 89.901195][ T1612] rust_binder: Write failure EINVAL in pid:377 [ 89.933076][ T45] usb 2-1: 1:0: failed to get current value for ch 0 (-22) [ 89.954086][ T45] usb 2-1: USB disconnect, device number 16 [ 89.970870][ T1615] process 'syz.0.421' launched './file0' with NULL argv: empty string added [ 89.979852][ T36] kauditd_printk_skb: 15 callbacks suppressed [ 89.979867][ T36] audit: type=1400 audit(1750894209.229:353): avc: denied { execute_no_trans } for pid=1613 comm="syz.0.421" path="/127/file0" dev="tmpfs" ino=693 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 90.281460][ T1621] netlink: 104 bytes leftover after parsing attributes in process `syz.4.423'. [ 90.816644][ T1644] netlink: 236 bytes leftover after parsing attributes in process `syz.1.432'. [ 90.831974][ T36] audit: type=1400 audit(1750894210.079:354): avc: denied { mount } for pid=1634 comm="syz.0.429" name="/" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 90.880177][ T36] audit: type=1400 audit(1750894210.129:355): avc: denied { mounton } for pid=1643 comm="syz.1.432" path=2F3131332FE91F7189591E9233614B dev="tmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=sock_file permissive=1 [ 90.998768][ T1655] tmpfs: Unknown parameter '00000000000000000000' [ 91.330394][ T1666] FAT-fs (rnullb0): bogus number of reserved sectors [ 91.337554][ T1666] FAT-fs (rnullb0): Can't find a valid FAT filesystem [ 91.469038][ T36] audit: type=1400 audit(1750894210.719:356): avc: denied { setopt } for pid=1673 comm="syz.4.441" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 91.524318][ T1679] input: syz0 as /devices/virtual/input/input14 [ 91.561719][ T36] audit: type=1400 audit(1750894210.809:357): avc: denied { bind } for pid=1682 comm="syz.3.444" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 91.585741][ T36] audit: type=1400 audit(1750894210.819:358): avc: denied { setopt } for pid=1682 comm="syz.3.444" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 91.871479][ T1713] binder: Unknown parameter 'defcontext01777777777777777777777' [ 92.266184][ T1674] incfs_lookup_dentry err:-107 [ 92.274159][ T1674] incfs: Can't find or create .index dir in ./file0 [ 92.283427][ T1674] incfs: mount failed -107 [ 92.405421][ T1748] rust_binder: Error in use_page_slow: ESRCH [ 92.405438][ T1748] rust_binder: use_range failure ESRCH [ 92.411933][ T1748] rust_binder: Failed to allocate buffer. len:128, is_oneway:false [ 92.417576][ T1748] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 92.426220][ T1748] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:354 [ 92.504328][ T1757] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 92.505103][ T1757] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 92.512191][ T1757] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:270 [ 92.534202][ T1761] netlink: 'syz.3.468': attribute type 4 has an invalid length. [ 92.575082][ T1768] netlink: 20 bytes leftover after parsing attributes in process `syz.3.470'. [ 92.580011][ T36] audit: type=1400 audit(1750894211.829:359): avc: denied { write } for pid=1765 comm="syz.1.469" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 92.585397][ T1768] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 92.618987][ T1772] rust_binder: Error while translating object. [ 92.626508][ T1772] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 92.633319][ T1772] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:368 [ 92.652492][ T1774] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:370 [ 92.665359][ T1774] rust_binder: Write failure EINVAL in pid:370 [ 93.025731][ T10] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 93.043967][ T36] audit: type=1400 audit(1750894212.299:360): avc: denied { accept } for pid=1780 comm="syz.4.475" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 93.060026][ T1781] syzkaller0: entered promiscuous mode [ 93.196064][ T10] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 93.214520][ T10] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 93.224050][ T36] audit: type=1400 audit(1750894212.459:361): avc: denied { mount } for pid=1788 comm="syz.0.479" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 93.246573][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.264394][ T10] usb 2-1: Product: syz [ 93.272850][ T10] usb 2-1: Manufacturer: syz [ 93.277764][ T36] audit: type=1400 audit(1750894212.509:362): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 93.297751][ T10] usb 2-1: SerialNumber: syz [ 93.311172][ T1798] rust_binder: Write failure EINVAL in pid:433 [ 93.311266][ T1798] rust_binder: Read failure Err(EAGAIN) in pid:433 [ 93.358708][ T1806] 9pnet_fd: Insufficient options for proto=fd [ 93.427786][ T46] Bluetooth: hci0: Frame reassembly failed (-84) [ 93.538907][ T1826] netlink: 104 bytes leftover after parsing attributes in process `syz.4.492'. [ 93.628014][ T1830] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 93.646458][ T1833] netlink: 'syz.4.495': attribute type 11 has an invalid length. [ 93.654327][ T1833] netlink: 3657 bytes leftover after parsing attributes in process `syz.4.495'. [ 93.891260][ T1846] rust_binder: Error in use_page_slow: ESRCH [ 93.891279][ T1846] rust_binder: use_range failure ESRCH [ 93.897714][ T1846] rust_binder: Failed to allocate buffer. len:16, is_oneway:false [ 93.903445][ T1846] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 93.911611][ T1846] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:256 [ 93.934934][ T1848] rust_binder: Error while translating object. [ 93.944442][ T1848] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 93.950794][ T1848] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:258 [ 93.981591][ T1852] netlink: 104 bytes leftover after parsing attributes in process `syz.4.503'. [ 94.312642][ T10] cdc_ncm 2-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 94.319809][ T10] cdc_ncm 2-1:1.0: dwNtbInMaxSize=16 is too small. Using 2048 [ 94.327704][ T10] cdc_ncm 2-1:1.0: setting rx_max = 2048 [ 94.334337][ T10] cdc_ncm 2-1:1.0: setting tx_max = 88 [ 94.342051][ T10] cdc_ncm 2-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.1-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 94.357807][ T10] usb 2-1: USB disconnect, device number 17 [ 94.364771][ T1870] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:454 [ 94.365126][ T10] cdc_ncm 2-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.1-1, CDC NCM (NO ZLP) [ 95.167447][ T1901] binder: Bad value for 'max' [ 95.425742][ T568] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 95.485711][ T53] Bluetooth: hci0: command 0x1003 tx timeout [ 95.485703][ T554] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 95.577654][ T568] usb 1-1: config 1 interface 0 altsetting 6 bulk endpoint 0x3 has invalid maxpacket 8 [ 95.587788][ T568] usb 1-1: config 1 interface 0 altsetting 6 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 95.601900][ T568] usb 1-1: config 1 interface 0 has no altsetting 0 [ 95.611482][ T568] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 95.621411][ T568] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.630490][ T568] usb 1-1: Product: syz [ 95.634902][ T568] usb 1-1: Manufacturer: syz [ 95.640652][ T568] usb 1-1: SerialNumber: syz [ 95.645952][ T1908] binder: Unknown parameter 'use;30wb' [ 95.654569][ T1903] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 95.924017][ T568] cdc_ether 1-1:1.0: probe with driver cdc_ether failed with error -71 [ 95.934534][ T568] usb 1-1: USB disconnect, device number 21 [ 96.165727][ T399] usb 2-1: new full-speed USB device number 18 using dummy_hcd [ 96.316772][ T399] usb 2-1: config 1 interface 0 has no altsetting 0 [ 96.324732][ T399] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 96.333951][ T399] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.341989][ T399] usb 2-1: Product: syz [ 96.346174][ T399] usb 2-1: Manufacturer: syz [ 96.350864][ T399] usb 2-1: SerialNumber: syz [ 96.474267][ T36] kauditd_printk_skb: 10 callbacks suppressed [ 96.474285][ T36] audit: type=1400 audit(1750894215.719:373): avc: denied { mount } for pid=1929 comm="syz.0.523" name="/" dev="configfs" ino=1737 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 96.503922][ T36] audit: type=1400 audit(1750894215.739:374): avc: denied { search } for pid=1929 comm="syz.0.523" name="/" dev="configfs" ino=1737 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 96.959979][ T399] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 18 if 0 alt 253 proto 1 vid 0x0525 pid 0xA4A8 [ 97.031704][ T36] audit: type=1400 audit(1750894216.279:375): avc: denied { write } for pid=1933 comm="syz.4.525" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 97.035561][ T1934] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 112, limit: 128, size: 89) [ 97.050807][ T1934] rust_binder: Error while translating object. [ 97.061330][ T1934] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 97.067604][ T1934] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:268 [ 97.312872][ T36] audit: type=1400 audit(1750894216.559:376): avc: denied { read write } for pid=1924 comm="syz.1.521" name="lp0" dev="devtmpfs" ino=587 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 97.346682][ T36] audit: type=1400 audit(1750894216.559:377): avc: denied { open } for pid=1924 comm="syz.1.521" path="/dev/usb/lp0" dev="devtmpfs" ino=587 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 97.459860][ T36] audit: type=1400 audit(1750894216.709:378): avc: denied { execmem } for pid=1958 comm="syz.3.534" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 97.494873][ T36] audit: type=1400 audit(1750894216.739:379): avc: denied { map } for pid=1962 comm="syz.4.536" path="/dev/bus/usb/003/001" dev="devtmpfs" ino=102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 97.662615][ T36] audit: type=1400 audit(1750894216.909:380): avc: denied { mounton } for pid=1977 comm="syz.3.542" path="/111/file0" dev="tmpfs" ino=616 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 97.687108][ T36] audit: type=1400 audit(1750894216.909:381): avc: denied { setattr } for pid=1977 comm="syz.3.542" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 97.796671][ T36] audit: type=1400 audit(1750894217.049:382): avc: denied { compute_member } for pid=1983 comm="syz.3.544" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 98.055776][ T568] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 98.207224][ T568] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 98.219927][ T568] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 98.231021][ T568] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 98.245206][ T568] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 98.255152][ T568] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.264837][ T568] usb 4-1: config 0 descriptor?? [ 98.691995][ T2000] netlink: 8 bytes leftover after parsing attributes in process `syz.0.550'. [ 98.704477][ T568] usbhid 4-1:0.0: can't add hid device: -71 [ 98.711851][ T568] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 98.723774][ T568] usb 4-1: USB disconnect, device number 21 [ 98.728401][ T2003] binder: Unknown parameter 'defcontext01777777777777777777777' [ 98.771056][ T2003] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 98.787239][ T2003] binder: Unknown parameter 'smackfstransmute' [ 98.872605][ T45] usb 2-1: USB disconnect, device number 18 [ 98.882550][ T45] usblp0: removed [ 98.893743][ T2007] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 98.893833][ T2007] rust_binder: Write failure EINVAL in pid:494 [ 98.902826][ T2007] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:494 [ 98.910093][ T2007] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:494 [ 99.117215][ T2022] netlink: 8 bytes leftover after parsing attributes in process `syz.0.559'. [ 99.180458][ T2025] netlink: 388 bytes leftover after parsing attributes in process `syz.1.560'. [ 99.238360][ T2031] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 99.238399][ T2031] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:316 [ 99.253983][ T2031] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 99.264790][ T2031] rust_binder: Read failure Err(EFAULT) in pid:316 [ 99.287122][ T2036] cgroup: subsys name conflicts with all [ 99.322008][ T2045] overlayfs: conflicting options: nfs_export=on,metacopy=on [ 99.347662][ T2048] FAULT_INJECTION: forcing a failure. [ 99.347662][ T2048] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 99.363722][ T2048] CPU: 1 UID: 0 PID: 2048 Comm: syz.1.568 Not tainted 6.12.30-syzkaller-g22d634eb24e3 #0 5aa5a802a358a0169efaadab5c3b9a05fad29399 [ 99.363755][ T2048] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 99.363766][ T2048] Call Trace: [ 99.363772][ T2048] [ 99.363779][ T2048] __dump_stack+0x21/0x30 [ 99.363804][ T2048] dump_stack_lvl+0x10c/0x190 [ 99.363823][ T2048] ? __cfi_dump_stack_lvl+0x10/0x10 [ 99.363845][ T2048] dump_stack+0x19/0x20 [ 99.363864][ T2048] should_fail_ex+0x3d9/0x530 [ 99.363886][ T2048] should_fail+0xf/0x20 [ 99.363904][ T2048] should_fail_usercopy+0x1e/0x30 [ 99.363924][ T2048] _copy_to_user+0x24/0xa0 [ 99.363948][ T2048] simple_read_from_buffer+0xed/0x160 [ 99.363967][ T2048] proc_fail_nth_read+0x19e/0x210 [ 99.363986][ T2048] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 99.364004][ T2048] ? __cfi_keyring_search_iterator+0x10/0x10 [ 99.364030][ T2048] ? bpf_lsm_file_permission+0xd/0x20 [ 99.364140][ T2048] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 99.364160][ T2048] vfs_read+0x278/0xb60 [ 99.364179][ T2048] ? keyctl_set_timeout+0xef/0x140 [ 99.364201][ T2048] ? __cfi_vfs_read+0x10/0x10 [ 99.364221][ T2048] ? __kasan_check_write+0x18/0x20 [ 99.364242][ T2048] ? mutex_lock+0x92/0x1c0 [ 99.364264][ T2048] ? __cfi_mutex_lock+0x10/0x10 [ 99.364285][ T2048] ? __fget_files+0x2c5/0x340 [ 99.364311][ T2048] ksys_read+0x141/0x250 [ 99.364332][ T2048] ? __cfi_ksys_read+0x10/0x10 [ 99.364350][ T2048] ? __kasan_check_read+0x15/0x20 [ 99.364367][ T2048] __x64_sys_read+0x7f/0x90 [ 99.364387][ T2048] x64_sys_call+0x2638/0x2ee0 [ 99.364410][ T2048] do_syscall_64+0x58/0xf0 [ 99.364427][ T2048] ? clear_bhb_loop+0x50/0xa0 [ 99.364448][ T2048] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 99.364469][ T2048] RIP: 0033:0x7fbe4c18d33c [ 99.364486][ T2048] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 99.364502][ T2048] RSP: 002b:00007fbe4cf73030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 99.364523][ T2048] RAX: ffffffffffffffda RBX: 00007fbe4c3b5fa0 RCX: 00007fbe4c18d33c [ 99.364538][ T2048] RDX: 000000000000000f RSI: 00007fbe4cf730a0 RDI: 0000000000000003 [ 99.364551][ T2048] RBP: 00007fbe4cf73090 R08: 0000000000000000 R09: 0000000000000000 [ 99.364564][ T2048] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 99.364576][ T2048] R13: 0000000000000000 R14: 00007fbe4c3b5fa0 R15: 00007ffddfb6a938 [ 99.364592][ T2048] [ 99.675820][ T2053] netlink: 104 bytes leftover after parsing attributes in process `syz.1.570'. [ 99.882729][ T2058] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.890320][ T2058] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.900531][ T2058] bridge_slave_0: entered allmulticast mode [ 99.907864][ T2058] bridge_slave_0: entered promiscuous mode [ 99.914929][ T2058] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.922766][ T2058] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.930632][ T2058] bridge_slave_1: entered allmulticast mode [ 99.941082][ T2058] bridge_slave_1: entered promiscuous mode [ 99.955722][ T31] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 99.965332][ T568] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 100.008919][ T2058] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.016605][ T2058] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.024993][ T2058] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.032317][ T2058] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.053353][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.060745][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.070789][ T303] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.079126][ T303] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.088760][ T303] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.097332][ T303] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.124471][ T2058] veth0_vlan: entered promiscuous mode [ 100.125803][ T31] usb 2-1: Using ep0 maxpacket: 32 [ 100.140376][ T2058] veth1_macvtap: entered promiscuous mode [ 100.140994][ T568] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 100.161680][ T568] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 100.174558][ T568] usb 4-1: New USB device found, idVendor=056a, idProduct=00ec, bcdDevice= 0.00 [ 100.185147][ T568] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.195198][ T31] usb 2-1: too many endpoints for config 0 interface 0 altsetting 32: 253, using maximum allowed: 30 [ 100.210354][ T31] usb 2-1: config 0 interface 0 altsetting 32 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 100.223763][ T568] usb 4-1: config 0 descriptor?? [ 100.231471][ T31] usb 2-1: config 0 interface 0 altsetting 32 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 100.235578][ T2063] netlink: 104 bytes leftover after parsing attributes in process `syz.5.581'. [ 100.246630][ T31] usb 2-1: config 0 interface 0 has no altsetting 0 [ 100.265450][ T31] usb 2-1: New USB device found, idVendor=0c12, idProduct=0030, bcdDevice= 0.00 [ 100.276779][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.279251][ T2065] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 100.288368][ T31] usb 2-1: config 0 descriptor?? [ 100.394579][ T2079] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 100.394607][ T2079] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 100.466538][ T2051] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 100.484532][ T2051] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 100.505335][ T31] zeroplus 0003:0C12:0030.0008: item fetching failed at offset 3/7 [ 100.517274][ T31] zeroplus 0003:0C12:0030.0008: parse failed [ 100.523750][ T31] zeroplus 0003:0C12:0030.0008: probe with driver zeroplus failed with error -22 [ 100.526854][ T2093] netlink: 104 bytes leftover after parsing attributes in process `syz.1.583'. [ 100.536820][ T31] usb 2-1: USB disconnect, device number 19 [ 100.560224][ T568] usbhid 4-1:0.0: can't add hid device: -71 [ 100.571912][ T568] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 100.587694][ T568] usb 4-1: USB disconnect, device number 22 [ 100.661315][ T2116] netlink: 388 bytes leftover after parsing attributes in process `syz.3.592'. [ 100.701096][ T2110] netlink: 'syz.4.589': attribute type 4 has an invalid length. [ 100.716973][ T2110] rust_binder: Error while translating object. [ 100.716999][ T2110] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 100.724296][ T2110] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:288 [ 100.748241][ T2124] netlink: 104 bytes leftover after parsing attributes in process `syz.4.594'. [ 101.055737][ T2129] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.063862][ T2129] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.071427][ T2129] bridge_slave_0: entered allmulticast mode [ 101.080016][ T2129] bridge_slave_0: entered promiscuous mode [ 101.088505][ T2129] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.097343][ T2129] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.105426][ T2129] bridge_slave_1: entered allmulticast mode [ 101.112178][ T2129] bridge_slave_1: entered promiscuous mode [ 101.190281][ T2129] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.197432][ T2129] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.205337][ T2129] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.212691][ T2129] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.244203][ T303] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.254012][ T303] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.277099][ T303] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.285681][ T303] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.297741][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.305940][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.363693][ T2129] veth0_vlan: entered promiscuous mode [ 101.379597][ T2129] veth1_macvtap: entered promiscuous mode [ 101.435286][ T2144] netlink: 'syz.5.601': attribute type 12 has an invalid length. [ 101.449414][ T2144] netlink: 88 bytes leftover after parsing attributes in process `syz.5.601'. [ 101.469655][ T2144] netlink: 8 bytes leftover after parsing attributes in process `syz.5.601'. [ 101.499847][ T2144] rust_kernel: panicked at drivers/android/binder/node.rs:893:13: [ 101.499847][ T2144] attempt to subtract with overflow [ 101.513208][ T2153] rust_binder: Write failure EFAULT in pid:2 [ 101.513597][ T2144] ------------[ cut here ]------------ [ 101.525450][ T2144] kernel BUG at rust/helpers/bug.c:7! [ 101.525738][ T36] kauditd_printk_skb: 12 callbacks suppressed [ 101.525751][ T36] audit: type=1400 audit(1750894220.769:395): avc: denied { read } for pid=90 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 101.531781][ T2144] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI [ 101.545687][ T36] audit: type=1400 audit(1750894220.769:396): avc: denied { search } for pid=90 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.559114][ T2144] CPU: 0 UID: 0 PID: 2144 Comm: syz.5.601 Not tainted 6.12.30-syzkaller-g22d634eb24e3 #0 5aa5a802a358a0169efaadab5c3b9a05fad29399 [ 101.559144][ T2144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 101.559156][ T2144] RIP: 0010:rust_helper_BUG+0x8/0x10 [ 101.592507][ T36] audit: type=1400 audit(1750894220.769:397): avc: denied { write } for pid=90 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.601351][ T2144] Code: cc cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b8 c6 0a f7 4a 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 48 89 e5 <0f> 0b 66 0f 1f 44 00 00 b8 8c ce be c6 90 90 90 90 90 90 90 90 90 [ 101.601379][ T2144] RSP: 0018:ffffc90011c2da90 EFLAGS: 00010246 [ 101.601396][ T2144] RAX: 0000000000000061 RBX: 1ffff92002385b54 RCX: bc66036b096cd100 [ 101.601411][ T2144] RDX: ffffc90001631000 RSI: 00000000000038c8 RDI: 00000000000038c9 [ 101.631807][ T36] audit: type=1400 audit(1750894220.769:398): avc: denied { add_name } for pid=90 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 101.638255][ T2144] RBP: ffffc90011c2da90 R08: ffffc90011c2d787 R09: 1ffff92002385af0 [ 101.638274][ T2144] R10: dffffc0000000000 R11: fffff52002385af1 R12: 0000000000000000 [ 101.638288][ T2144] R13: dffffc0000000000 R14: ffffc90011c2dac0 R15: ffffc90011c2daf0 [ 101.638301][ T2144] FS: 00007f1c6b3526c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 101.638317][ T2144] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 101.638331][ T2144] CR2: 000000110c2990c4 CR3: 000000012b660000 CR4: 00000000003526b0 [ 101.638347][ T2144] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 101.685696][ T36] audit: type=1400 audit(1750894220.769:399): avc: denied { create } for pid=90 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 101.701494][ T2144] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 101.701519][ T2144] Call Trace: [ 101.701525][ T2144] [ 101.701535][ T2144] _RNvCscSpY9Juk0HT_7___rustc17rust_begin_unwind+0x15b/0x160 [ 101.701567][ T2144] ? __cfi__RNvCscSpY9Juk0HT_7___rustc17rust_begin_unwind+0x10/0x10 [ 101.701590][ T2144] ? __cfi__RNvXs1b_NtCs9jEwPDbx20M_4core3fmtRNtNtNtB8_5panic10panic_info9PanicInfoNtB6_7Display3fmtCs43vyB533jt3_6kernel+0x10/0x10 [ 101.701626][ T2144] ? __kasan_check_write+0x18/0x20 [ 101.701645][ T2144] ? _RINvNtCs9jEwPDbx20M_4core3ptr13drop_in_placeINtNtNtCs43vyB533jt3_6kernel4sync3arc3ArcNtNtCshgDM7dBCdno_11rust_binder7process7ProcessEEB1p_+0xbb/0xf0 [ 101.701679][ T2144] ? _RNvMNtCshgDM7dBCdno_11rust_binder11transactionNtB2_11Transaction6submit+0x1c45/0x2010 [ 101.744459][ T36] audit: type=1400 audit(1750894220.769:400): avc: denied { append open } for pid=90 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 101.749519][ T2144] _RNvNtCs9jEwPDbx20M_4core9panicking9panic_fmt+0x84/0x90 [ 101.749556][ T2144] ? __cfi__RNvNtCs9jEwPDbx20M_4core9panicking9panic_fmt+0x10/0x10 [ 101.749582][ T2144] ? __cfi__RNvMNtCshgDM7dBCdno_11rust_binder11transactionNtB2_11Transaction6submit+0x10/0x10 [ 101.749614][ T2144] _RNvNtNtCs9jEwPDbx20M_4core9panicking11panic_const24panic_const_sub_overflow+0xb2/0xc0 [ 101.749639][ T2144] ? __cfi__RNvNtNtCs9jEwPDbx20M_4core9panicking11panic_const24panic_const_sub_overflow+0x10/0x10 [ 101.749663][ T2144] _RNvMs3_NtCshgDM7dBCdno_11rust_binder7processNtB5_7Process10update_ref+0x17e5/0x1860 [ 101.749688][ T2144] ? rust_helper_refcount_dec_and_test+0x57/0x80 [ 101.749708][ T2144] ? _RINvNtCs9jEwPDbx20M_4core3ptr13drop_in_placeINtNtNtCs43vyB533jt3_6kernel4sync3arc3ArcINtCshgDM7dBCdno_11rust_binder7DTRWrapNtB1o_11DeliverCodeEEEB1o_+0xb3/0xf0 [ 101.749740][ T2144] ? __cfi__RNvMs3_NtCshgDM7dBCdno_11rust_binder7processNtB5_7Process10update_ref+0x10/0x10 [ 101.749765][ T2144] ? _RINvMs2_NtCshgDM7dBCdno_11rust_binder6threadNtB6_6Thread11transactionNvB2_24oneway_transaction_innerEB8_+0x8de/0xa30 [ 101.765694][ T36] audit: type=1400 audit(1750894220.769:401): avc: denied { getattr } for pid=90 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 101.778309][ T2144] ? __cfi__RINvMs2_NtCshgDM7dBCdno_11rust_binder6threadNtB6_6Thread11transactionNvB2_24oneway_transaction_innerEB8_+0x10/0x10 [ 101.778356][ T2144] ? put_dec+0xd7/0xf0 [ 102.024855][ T2144] ? __asan_memset+0x39/0x50 [ 102.030839][ T2144] ? __kasan_check_write+0x18/0x20 [ 102.036705][ T2144] ? _raw_spin_lock+0x8c/0x120 [ 102.042153][ T2144] ? __cfi__raw_spin_lock+0x10/0x10 [ 102.047533][ T2144] ? __kasan_check_write+0x18/0x20 [ 102.052979][ T2144] _RNvMs2_NtCshgDM7dBCdno_11rust_binder6threadNtB5_6Thread10write_read+0x278d/0x9d20 [ 102.062575][ T2144] ? __kasan_check_write+0x18/0x20 [ 102.067715][ T2144] ? desc_read+0x1ab/0x3e0 [ 102.072171][ T2144] ? prb_first_seq+0xfe/0x1b0 [ 102.076889][ T2144] ? __kasan_check_write+0x18/0x20 [ 102.082025][ T2144] ? desc_read+0x1ab/0x3e0 [ 102.086464][ T2144] ? __kasan_check_read+0x15/0x20 [ 102.091614][ T2144] ? this_cpu_in_panic+0x56/0x90 [ 102.096579][ T2144] ? _prb_read_valid+0xa08/0xa90 [ 102.101639][ T2144] ? prb_read_valid+0x80/0x80 [ 102.106518][ T2144] ? __kasan_check_write+0x18/0x20 [ 102.111743][ T2144] ? _raw_spin_lock_irqsave+0xaf/0x150 [ 102.117232][ T2144] ? desc_read+0x202/0x3e0 [ 102.121936][ T2144] ? __cfi__RNvMs2_NtCshgDM7dBCdno_11rust_binder6threadNtB5_6Thread10write_read+0x10/0x10 [ 102.132474][ T2144] ? __kasan_check_write+0x18/0x20 [ 102.137710][ T2144] ? desc_read+0x1ab/0x3e0 [ 102.142195][ T2144] ? prb_first_seq+0xfe/0x1b0 [ 102.147076][ T2144] ? __cfi_prb_first_seq+0x10/0x10 [ 102.152754][ T2144] ? __kasan_check_write+0x18/0x20 [ 102.158439][ T2144] ? desc_read+0x1ab/0x3e0 [ 102.164443][ T2144] ? __kasan_check_read+0x15/0x20 [ 102.169782][ T2144] ? this_cpu_in_panic+0x56/0x90 [ 102.175104][ T2144] ? _prb_read_valid+0xa08/0xa90 [ 102.180169][ T2144] ? prb_read_valid+0x80/0x80 [ 102.185177][ T2144] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 102.191277][ T2144] ? up+0xf4/0x190 [ 102.195300][ T2144] ? __cfi_up+0x10/0x10 [ 102.200793][ T2144] ? __kasan_check_write+0x18/0x20 [ 102.206547][ T2144] ? cgroup_rstat_updated+0x132/0x7f0 [ 102.212131][ T2144] ? __cfi_llist_add_batch+0x10/0x10 [ 102.218091][ T2144] ? __cfi_cgroup_rstat_updated+0x10/0x10 [ 102.224580][ T2144] ? __cfi_console_unlock+0x10/0x10 [ 102.230863][ T2144] ? arch_scale_cpu_capacity+0x1c/0xb0 [ 102.236443][ T2144] ? update_curr_dl_se+0x10c/0xb20 [ 102.241819][ T2144] ? __cfi___update_load_avg_cfs_rq+0x10/0x10 [ 102.248627][ T2144] ? __kasan_check_write+0x18/0x20 [ 102.254045][ T2144] ? __switch_to+0xc7b/0x1310 [ 102.259201][ T2144] ? cgroup_rstat_updated+0x132/0x7f0 [ 102.265044][ T2144] ? __cfi_cgroup_rstat_updated+0x10/0x10 [ 102.271329][ T2144] ? arch_scale_cpu_capacity+0x1c/0xb0 [ 102.277520][ T2144] ? update_cfs_group+0x260/0x260 [ 102.282793][ T2144] ? __cfi___update_load_avg_cfs_rq+0x10/0x10 [ 102.289158][ T2144] ? update_curr+0x949/0xc60 [ 102.293969][ T2144] ? __kasan_check_write+0x18/0x20 [ 102.299463][ T2144] ? __switch_to+0xc7b/0x1310 [ 102.304257][ T2144] ? __cfi___switch_to+0x10/0x10 [ 102.309662][ T2144] ? __kasan_check_write+0x18/0x20 [ 102.315337][ T2144] ? dequeue_pushable_task+0x1b9/0x2e0 [ 102.321785][ T2144] ? __kasan_check_write+0x18/0x20 [ 102.327199][ T2144] ? finish_task_switch+0x1de/0x780 [ 102.332519][ T2144] ? __switch_to_asm+0x3d/0x70 [ 102.337669][ T2144] ? __schedule+0x1463/0x1f10 [ 102.342487][ T2144] ? __sched_text_start+0x10/0x10 [ 102.347646][ T2144] ? swake_up_one_online_ipi+0x30/0x30 [ 102.353405][ T2144] ? is_bpf_text_address+0x17b/0x1a0 [ 102.358728][ T2144] ? kernel_text_address+0xa9/0xe0 [ 102.363873][ T2144] ? __kernel_text_address+0x11/0x40 [ 102.369536][ T2144] ? unwind_get_return_address+0x51/0x90 [ 102.375552][ T2144] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 102.382240][ T2144] ? arch_stack_walk+0x10b/0x170 [ 102.387394][ T2144] ? stack_depot_save_flags+0x38/0x800 [ 102.393057][ T2144] ? unwind_get_return_address+0x51/0x90 [ 102.398815][ T2144] ? kasan_save_track+0x4f/0x80 [ 102.403873][ T2144] ? kasan_save_track+0x3e/0x80 [ 102.408941][ T2144] ? kasan_save_alloc_info+0x40/0x50 [ 102.415083][ T2144] ? __kasan_kmalloc+0x96/0xb0 [ 102.420333][ T2144] ? __kmalloc_node_track_caller_noprof+0x1ad/0x440 [ 102.427813][ T2144] ? krealloc_noprof+0x8d/0x130 [ 102.432809][ T2144] ? rust_helper_krealloc+0x33/0xd0 [ 102.438297][ T2144] ? _RNvMNtNtCs43vyB533jt3_6kernel5alloc9allocatorNtB2_11ReallocFunc4call+0xb1/0x100 [ 102.448145][ T2144] ? _RNvMs3_NtCshgDM7dBCdno_11rust_binder7processNtB5_7Process8get_node+0x8b1/0x12e0 [ 102.458589][ T2144] ? _RNvMs3_NtCshgDM7dBCdno_11rust_binder7processNtB5_7Process14set_as_manager+0x1c2/0xa60 [ 102.470029][ T2144] ? _RNvMs5_NtCshgDM7dBCdno_11rust_binder7processNtB5_7Process5ioctl+0x134e/0x2cd0 [ 102.479979][ T2144] ? _RNvCshgDM7dBCdno_11rust_binder26rust_binder_unlocked_ioctl+0xa0/0x100 [ 102.489243][ T2144] ? __se_sys_ioctl+0x132/0x1b0 [ 102.494828][ T2144] ? __x64_sys_ioctl+0x7f/0xa0 [ 102.499629][ T2144] ? x64_sys_call+0x1878/0x2ee0 [ 102.504692][ T2144] ? do_syscall_64+0x58/0xf0 [ 102.509416][ T2144] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 102.515861][ T2144] ? __kasan_check_write+0x18/0x20 [ 102.521065][ T2144] ? rust_helper_refcount_inc+0x55/0x80 [ 102.527344][ T2144] ? _RNvMs0_NtCshgDM7dBCdno_11rust_binder4nodeNtB5_4Node28incr_refcount_allow_zero2one+0x55c/0xe30 [ 102.538861][ T2144] ? __kasan_check_write+0x18/0x20 [ 102.544370][ T2144] ? _raw_spin_lock+0x8c/0x120 [ 102.549776][ T2144] ? __cfi__raw_spin_lock+0x10/0x10 [ 102.555278][ T2144] ? _RNvMs6_NtCs43vyB533jt3_6kernel4listINtB5_4ListINtCshgDM7dBCdno_11rust_binder7DTRWrapDNtBL_13DeliverToReadEL_EE12insert_innerBL_+0x3c7/0x4d0 [ 102.571085][ T2144] ? _raw_spin_unlock+0x45/0x60 [ 102.576006][ T2144] ? rust_helper_spin_unlock+0x19/0x30 [ 102.581580][ T2144] ? _RNvMs_NtCshgDM7dBCdno_11rust_binder7processNtB4_12ProcessInner24new_node_ref_with_thread+0x568/0x7d0 [ 102.594216][ T2144] ? __cfi___update_load_avg_cfs_rq+0x10/0x10 [ 102.600667][ T2144] ? __dequeue_entity+0x59/0xd00 [ 102.606081][ T2144] ? __kasan_check_write+0x18/0x20 [ 102.611837][ T2144] ? _raw_spin_lock+0x8c/0x120 [ 102.616660][ T2144] ? __cfi__raw_spin_lock+0x10/0x10 [ 102.621905][ T2144] ? _raw_spin_unlock+0x45/0x60 [ 102.626973][ T2144] ? rust_helper_spin_unlock+0x19/0x30 [ 102.632633][ T2144] ? _RNvMs3_NtCshgDM7dBCdno_11rust_binder7processNtB5_7Process18get_current_thread+0x934/0x1440 [ 102.643255][ T2144] ? tg_unthrottle_up+0x980/0x980 [ 102.648482][ T2144] ? __cfi__RNvMs3_NtCshgDM7dBCdno_11rust_binder7processNtB5_7Process18get_current_thread+0x10/0x10 [ 102.659456][ T2144] ? xfd_validate_state+0x68/0x150 [ 102.664875][ T2144] ? save_fpregs_to_fpstate+0x196/0x230 [ 102.670854][ T2144] ? __kasan_check_write+0x18/0x20 [ 102.676106][ T2144] ? __switch_to+0xc7b/0x1310 [ 102.680812][ T2144] ? pick_next_task_fair+0x870/0x900 [ 102.686569][ T2144] ? _raw_spin_lock+0x8c/0x120 [ 102.691546][ T2144] ? _raw_spin_unlock+0x45/0x60 [ 102.696562][ T2144] ? finish_task_switch+0x13a/0x780 [ 102.701878][ T2144] _RNvMs5_NtCshgDM7dBCdno_11rust_binder7processNtB5_7Process5ioctl+0x409/0x2cd0 [ 102.711556][ T2144] ? avc_has_extended_perms+0x7c7/0xdd0 [ 102.717189][ T2144] ? __asan_memcpy+0x5a/0x80 [ 102.721818][ T2144] ? avc_has_extended_perms+0x921/0xdd0 [ 102.727666][ T2144] ? __cfi__RNvMs5_NtCshgDM7dBCdno_11rust_binder7processNtB5_7Process5ioctl+0x10/0x10 [ 102.739261][ T2144] ? do_vfs_ioctl+0xeda/0x1e30 [ 102.744243][ T2144] ? preempt_schedule_common+0x2d/0x60 [ 102.750365][ T2144] ? __ia32_compat_sys_ioctl+0x850/0x850 [ 102.756491][ T2144] ? __cfi_preempt_schedule+0x10/0x10 [ 102.762333][ T2144] ? __cfi_check_preempt_wakeup_fair+0x10/0x10 [ 102.769153][ T2144] ? preempt_schedule_thunk+0x1a/0x40 [ 102.775207][ T2144] ? try_to_wake_up+0xe17/0x1aa0 [ 102.780567][ T2144] ? ioctl_has_perm+0x384/0x4d0 [ 102.785724][ T2144] ? has_cap_mac_admin+0xd0/0xd0 [ 102.791150][ T2144] ? futex_wake+0x63a/0x900 [ 102.795786][ T2144] ? __cfi_futex_wake+0x10/0x10 [ 102.800660][ T2144] ? userfaultfd_unmap_complete+0x279/0x2d0 [ 102.806753][ T2144] ? selinux_file_ioctl+0x6e0/0x1360 [ 102.812159][ T2144] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 102.817824][ T2144] ? __cfi_do_mmap+0x10/0x10 [ 102.822451][ T2144] ? down_write_killable+0xe9/0x2d0 [ 102.827941][ T2144] ? do_futex+0x356/0x500 [ 102.832304][ T2144] ? __cfi_do_futex+0x10/0x10 [ 102.837626][ T2144] ? vm_mmap_pgoff+0x145/0x4e0 [ 102.842592][ T2144] ? __fget_files+0x2c5/0x340 [ 102.847997][ T2144] _RNvCshgDM7dBCdno_11rust_binder26rust_binder_unlocked_ioctl+0xa0/0x100 [ 102.857490][ T2144] ? __se_sys_ioctl+0x114/0x1b0 [ 102.862632][ T2144] ? __cfi__RNvCshgDM7dBCdno_11rust_binder26rust_binder_unlocked_ioctl+0x10/0x10 [ 102.872122][ T2144] __se_sys_ioctl+0x132/0x1b0 [ 102.877008][ T2144] __x64_sys_ioctl+0x7f/0xa0 [ 102.881636][ T2144] x64_sys_call+0x1878/0x2ee0 [ 102.886440][ T2144] do_syscall_64+0x58/0xf0 [ 102.891485][ T2144] ? clear_bhb_loop+0x50/0xa0 [ 102.896191][ T2144] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 102.903009][ T2144] RIP: 0033:0x7f1c6a58e929 [ 102.907538][ T2144] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 102.927694][ T2144] RSP: 002b:00007f1c6b352038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 102.936830][ T2144] RAX: ffffffffffffffda RBX: 00007f1c6a7b5fa0 RCX: 00007f1c6a58e929 [ 102.945003][ T2144] RDX: 0000200000000680 RSI: 00000000c0306201 RDI: 0000000000000008 [ 102.953258][ T2144] RBP: 00007f1c6a610b39 R08: 0000000000000000 R09: 0000000000000000 [ 102.961777][ T2144] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.969854][ T2144] R13: 0000000000000000 R14: 00007f1c6a7b5fa0 R15: 00007ffd87a44788 [ 102.978914][ T2144] [ 102.981958][ T2144] Modules linked in: [ 102.987822][ T2144] ---[ end trace 0000000000000000 ]--- SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 103.001857][ T2144] RIP: 0010:rust_helper_BUG+0x8/0x10 [ 103.007986][ T36] audit: type=1400 audit(1750894222.239:402): avc: denied { write } for pid=280 comm="syz-executor" path="pipe:[3074]" dev="pipefs" ino=3074 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 103.046063][ T2144] Code: cc cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b8 c6 0a f7 4a 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 48 89 e5 <0f> 0b 66 0f 1f 44 00 00 b8 8c ce be c6 90 90 90 90 90 90 90 90 90 [ 103.117168][ T2144] RSP: 0018:ffffc90011c2da90 EFLAGS: 00010246 [ 103.123934][ T2144] RAX: 0000000000000061 RBX: 1ffff92002385b54 RCX: bc66036b096cd100 [ 103.156075][ T2144] RDX: ffffc90001631000 RSI: 00000000000038c8 RDI: 00000000000038c9 [ 103.164569][ T2144] RBP: ffffc90011c2da90 R08: ffffc90011c2d787 R09: 1ffff92002385af0 [ 103.195676][ T2144] R10: dffffc0000000000 R11: fffff52002385af1 R12: 0000000000000000 [ 103.204934][ T2144] R13: dffffc0000000000 R14: ffffc90011c2dac0 R15: ffffc90011c2daf0 [ 103.225679][ T2144] FS: 00007f1c6b3526c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 103.235467][ T2144] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.269759][ T2144] CR2: 000055eb4a095b98 CR3: 000000012b660000 CR4: 00000000003526b0 [ 103.295677][ T2144] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 103.303886][ T2144] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 103.320261][ T2144] Kernel panic - not syncing: Fatal exception [ 103.326650][ T2144] Kernel Offset: disabled [ 103.330965][ T2144] Rebooting in 86400 seconds..