last executing test programs: 1.512423807s ago: executing program 1 (id=467): ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0xb4, 0x0, &(0x7f0000000640)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f00000001c0)={@flat=@binder={0x73622a85, 0x1, 0x2}, @flat=@binder={0x73622a85, 0x1000, 0x3}, @fd}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}, @dead_binder_done, @acquire_done={0x40106309, 0x2}, @enter_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 1.455824328s ago: executing program 1 (id=468): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x6) (async) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040), 0x400000, 0x0) ioctl$ASHMEM_SET_NAME(r1, 0x41007701, &(0x7f0000000080)='/dev/ashmem\x00') (async) mmap(&(0x7f0000fec000/0x4000)=nil, 0x4000, 0x0, 0x13, r0, 0x0) 1.454778868s ago: executing program 1 (id=469): mount$binderfs(0x0, &(0x7f00000001c0)='./binderfs\x00', &(0x7f0000000280), 0x200000, &(0x7f0000000380)=ANY=[@ANYRES16=0x0]) mount$binderfs(0x0, &(0x7f00000001c0)='./binderfs\x00', &(0x7f0000000280), 0x200000, &(0x7f0000000380)=ANY=[@ANYRES16=0x0]) (async) 1.454236358s ago: executing program 1 (id=470): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180), &(0x7f0000000200)={0x0, 0xfb, 0x16, 0x3, 0x0, "347252e79e448a10ab7bee39b339d59a", '\a'}, 0x16, 0x1) recvmmsg(r0, &(0x7f0000009800)=[{{0x0, 0x0, 0x0}, 0x4}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xe}, 0x14d2}, {{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000002180)=""/4096, 0x1000}, {&(0x7f0000003180)=""/177, 0xb1}, {&(0x7f00000032c0)=""/246, 0xf6}, {&(0x7f0000000580)=""/231, 0xe7}, {&(0x7f00000034c0)=""/211, 0xd3}, {&(0x7f0000000b80)=""/76, 0x4c}, {&(0x7f0000000940)=""/231, 0xe7}, {&(0x7f0000000680)=""/148, 0x94}, {&(0x7f0000000780)=""/83, 0x53}, {&(0x7f0000000800)=""/127, 0x7f}], 0xa, 0x0, 0x2b}, 0x81}, {{0x0, 0x0, 0x0}, 0x8}], 0x4, 0x2100, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@nfs_export_on}]}) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0xc}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_GET_NESTED_STATE(r4, 0xc080aebe, &(0x7f0000000440)={{0x0, 0x0, 0x80}}) ioctl$UFFDIO_COPY(r1, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000, 0x300}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000780)={0x30, r6, 0x1, 0x80, 0x25dfdbfe, {}, [@TIPC_NLA_NET={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}, @TIPC_NLA_NET_NODEID={0xc}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x2805}, 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r7, &(0x7f00000029c0)={0x2020}, 0x2020) 1.384110099s ago: executing program 1 (id=471): mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) syz_usb_connect$hid(0x5, 0x36, &(0x7f00000006c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x46d, 0x1017, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x2, 0x40, 0x2, [{{0x9, 0x4, 0x0, 0x9, 0x1, 0x3, 0x1, 0x0, 0xf, {0x9, 0x21, 0xb9b5, 0x0, 0x1, {0x22, 0x3a4}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x84, 0x6, 0x16}}}}}]}}]}}, &(0x7f00000009c0)={0xa, &(0x7f0000000700)={0xa, 0x6, 0x250, 0x6, 0x47, 0xf, 0x40, 0x5}, 0x4b, &(0x7f0000000740)={0x5, 0xf, 0x4b, 0x5, [@ssp_cap={0xc, 0x10, 0xa, 0x9, 0x0, 0x100, 0x0, 0x2}, @ss_container_id={0x14, 0x10, 0x4, 0xa, "eaf0a7ee22e523466c3418639f276f8e"}, @ext_cap={0x7, 0x10, 0x2, 0x10, 0x5, 0xe}, @wireless={0xb, 0x10, 0x1, 0x8, 0x2, 0x6, 0xf, 0x87, 0x9}, @ss_container_id={0x14, 0x10, 0x4, 0x4, "6c3c3503f9307c90d3438ab99753331e"}]}}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$sock_int(r0, 0x1, 0x10, &(0x7f0000000080)=0x9, 0x4) recvfrom(r0, 0x0, 0x0, 0x120, 0x0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000680), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000002280)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x2000}}) statx(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x2000, 0x800, 0x0) read$FUSE(r1, &(0x7f0000006300)={0x2020, 0x0, 0x0, 0x0}, 0x2020) getsockname(r0, &(0x7f0000000200)=@tipc, &(0x7f0000000000)=0x80) quotactl_fd$Q_SETQUOTA(0xffffffffffffffff, 0xffffffff80000800, r3, 0x0) syz_fuse_handle_req(r1, 0x0, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f0000001200)={0x50, 0xfffffffffffffff5, r2, {0x7, 0x29, 0x0, 0x20100001, 0x0, 0x0, 0x0, 0x2}}, 0x50) setxattr$security_ima(0x0, 0x0, 0x0, 0x0, 0x3) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) r4 = dup(r1) ioctl$SNDRV_TIMER_IOCTL_TRIGGER(r4, 0x54a6) sendmsg$IPCTNL_MSG_CT_NEW(r4, 0x0, 0x4044001) 1.027628224s ago: executing program 0 (id=474): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x120, 0x0, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f00000007c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x200a}, @flat, @fda={0x66646185, 0x404, 0x0, 0x18}}, &(0x7f0000000500)={0x0, 0x18, 0x30}}}], 0x50, 0x0, &(0x7f0000000540)="a89aff67520a7335b849b4f88a6db06e45e3f5e648a65b8003975be8a982d5135e161a783d3d01fddcbd838bac308358a7e349f333e620505e4cf1982c991b516a9e26b6bb537c85f5ad467697f0d78b"}) 1.026928424s ago: executing program 0 (id=475): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f00000001c0)={@flat, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, &(0x7f00000002c0)}) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f0000000140)={0x933, 0xfffffffd, 0x10000, 0xfffffffd}) (async) listen(r1, 0x80000000) (async) write$khugepaged_scan(r1, &(0x7f0000000000), 0x8) 1.001980824s ago: executing program 0 (id=476): r0 = socket$inet(0x2, 0x1, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) syz_open_dev$loop(0x0, 0x7, 0x80800) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r1, 0x45809000) r2 = socket$inet(0x2, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, 0x0, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @local}, 0x10) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) sendmmsg$inet(r0, &(0x7f0000002480)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000006c0)="fac28d", 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000500)="8f71d0", 0x3}], 0x1, &(0x7f0000000b00)}}, {{0x0, 0x0, &(0x7f0000001040)=[{&(0x7f0000000c00)="654effac", 0x4}], 0x1}}, {{0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000001140)="04fce04af34a48cbb894ef350416dd134ade25ea32a8666dda7eccef2ff471debd82fccd2403c71d1ea3bf5d678ad4a92eb4edf55bb6b864340e80e8bb8c41256c359be1d978c410dc9904763ee43515e56239608da1c59f304f539ef190b0bc41be6b9887ab53198e8961e190583f1e533916d8590226bed40d051376668e63d6ef4bf2c62be7000bad551c75d36826425fee7f044be0af9437460b605cb0c14ed6488ce177f6872f21405168da2e7530163b9ac0c7f89b84af3c032feaa27420640d9e718ff033a067f8807400b9ffeb0d96ab11067fba617c5cb1e9a6ab7e1c299654b9a54ca377745f1171961de9b37c94883a14b515ffe9fb36ac4b741f210cf0856dd3e300c6ae7ded4ae5d453a36d294ae16b7ef13f1dd242220ad4e07f0ac86895995111fa6981e58e0c0c55eddfca65ce907cd385cf5d2d6135b236daadf6bd1e7034e31b92f10b477327be1d10267ab34022e5f11f313e3f3ba2351dbd784a5e5df0bf86c8cfd0f347fd00489b7560a259ea4efd8b7c6f5eec80c517857323668c41dbb0e7be98798eabf1a6e009e066aeecfc12cabe8821b32e21b9d5c52de437dc5c100767f969f79ebec884a04942879e09a0d51b86a9da6d83e4a13fea2662d300124be9dcea51ae73350d496c047192af86c6d613a4a91213a57ba16c7ed9fd1a2de6b26a550a08680409c0fefabde90dd4390412958665ec97446464a30daec37f646877a1c57a7ff70211768502839a7fa5f0cc46e9198a5104533c3528bb3b20803186d6b2f70aebb3487edfa84b27f01de7beb1ddd68e210094ebbb", 0x245}, {0x0}], 0x2, &(0x7f0000002400)}}], 0x4, 0x80) mount$binderfs(0x0, &(0x7f0000000040)='./binderfs\x00', &(0x7f0000000140), 0x4800, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00'/10]) pipe(&(0x7f0000000080)) 975.092225ms ago: executing program 0 (id=477): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0xa, 0x2}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f00000001c0)=[@transaction_sg={0x40086315, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x10}], 0x0, 0x0, 0x0}) (async, rerun: 64) r1 = socket$inet6_udp(0xa, 0x2, 0x0) (rerun: 64) getsockopt$inet6_opts(r1, 0x29, 0x39, 0x0, &(0x7f0000000000)) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5}, 0x0) (async) ioprio_set$pid(0x6, 0xffffffffffffffff, 0x4000) (async) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x8800, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) (async, rerun: 64) r4 = socket$inet6_udp(0xa, 0x2, 0x0) (rerun: 64) setsockopt$inet6_int(r4, 0x29, 0x4b, &(0x7f0000000000)=0xa5, 0x4) (async) read(r2, &(0x7f0000000080)=""/93, 0xffffff6c) 843.293607ms ago: executing program 0 (id=479): r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000240), 0x12) (async) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) (async, rerun: 32) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) (async, rerun: 32) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) (async, rerun: 64) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) (async, rerun: 64) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x202, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) (async) writev(0xffffffffffffffff, &(0x7f0000000280)=[{&(0x7f0000000340)="3f98e3", 0x3}], 0x1) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) (async, rerun: 32) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) (rerun: 32) syz_kvm_setup_cpu$x86(r7, r8, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000001200)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_VAPIC_ADDR(r8, 0x4008ae93, &(0x7f0000000640)=0x4) ioctl$KVM_SET_VCPU_EVENTS(r8, 0x4400ae8f, &(0x7f0000000140)=@x86={0xf0, 0x4, 0x1, 0x0, 0x80000000, 0x7f, 0x3, 0x3, 0x6, 0x2, 0xc, 0x40, 0x0, 0x2, 0xba, 0xd7, 0xff, 0x8, 0x8, '\x00', 0xab, 0xc0000000}) (async) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000580)={0x1ff, 0x1, 0x0, 0x1000, &(0x7f0000456000/0x1000)=nil}) (async) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000000080000024d564b000000eccd"]) (async) close_range(r2, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1, 0x22052, r1, 0xfffff000) (async) r9 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000400)={0x0, 0x0}) 737.801579ms ago: executing program 0 (id=481): r0 = socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000040)=0x4000000000000200, 0x4) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000009400)=[{{&(0x7f0000000340)={0xa, 0x4e22, 0xfffffff8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x5}, 0x1c, &(0x7f0000000680)=[{&(0x7f0000000380)="3beec2c772f2418f0a8b2ee9c43f6b48628122909caf39fd371d5522d3f477317f", 0x21}, {&(0x7f0000000440)="14f06f386e474241b214630e5308d896295b30d1a360a56c81506959678116e329643a1cced89a22e4cb171985275a88282cf8d9fdf3865f061ee92471b0f0ac62599e02925af5719f34adac48580cea7ec8d8b92d404976da27602de3d86dfcb16dd652de336c7640b765018abc3992db618dfac5133b351c6534593faae8009ae624fbda2d4e6facf5eca1a22e9282f96bc47ff4a624b259730f7421ae07139410b8d3e92e72ef86eb5cbdc1af7d79d08a538f9ce8e3d0ac9173004d89106aca9da79e0a0539c3401732b0deabf639007598f6628a4abeeb0d988cf96f29af64", 0xe1}, {&(0x7f0000000780)="f54d665b06a0860f1f0b70b1d0c4861ea3e1105888370ee5a8e4b36314d9663117a52044e29f4511aadbbd7f3b61aceec8f17806aef9f5121867263b367fefeeff26d0be021b644a8b9ae510fb27bfc63aa914139f74a111a25aad2dcca6346afb3fc1909aea528332a35c6049acaa0fe978969cafdd959e783190f98943007e29d42accc656fb2afe4c4041ae9041342080289139054da85099097bf36d91d0b3b18fd5e1ceed38e65fa4537b4a31fcf7b352181b89cad5748412d15fd50931b7d6f64cad73dd0f084d374898bb6e1f3190db", 0xd3}, {&(0x7f0000000540)="2f3ecc05312b93565d5222dd6a780ed6bc5b2dca76282661928e62e085c25272ddd9b657df1d89bc12cd9441a1903d72c645844f4c", 0x35}, {&(0x7f00000005c0)="7ff298dda3afd2ec3f91c9dae2c7376b204047473abb", 0x16}], 0x5, &(0x7f0000000880)=[@hoplimit_2292={{0x14, 0x29, 0x8, 0x6}}, @rthdrdstopts={{0x20, 0x29, 0x37, {0x16, 0x0, '\x00', [@ra={0x5, 0x2, 0x6}, @padn={0x1, 0x1, [0x0]}]}}}, @dontfrag={{0x14, 0x29, 0x3e, 0x4}}, @hopopts={{0xf8, 0x29, 0x36, {0x62, 0x1b, '\x00', [@jumbo={0xc2, 0x4, 0x401}, @generic={0x2, 0xa0, "394e6157033cb7ca516992d8530bbd0493c4eb4adc05a36b8751619485111bd243b7857151b9e418562cba49b112ece8a651c7ba54b915a3dfce40ab1c30b062ac142f6aa5e8ad100dbba30d5c501ed2cfab2131a7eb478fc3391095f3cbf25fe8d70c07ac1a4dc356ed24f14cc935122d806e909a378e3772004dd0740ea1c0e7764ae9b56f0e4d529e061b1b3037bafb06970d8c205023655d1386de422ffb"}, @hao={0xc9, 0x10, @loopback}, @padn={0x1, 0x1, [0x0]}, @hao={0xc9, 0x10, @private1}, @enc_lim={0x4, 0x1, 0x3}, @padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @enc_lim={0x4, 0x1, 0x1}]}}}], 0x148}}, {{&(0x7f0000000600)={0xa, 0x4e22, 0x6, @dev={0xfe, 0x80, '\x00', 0x3a}, 0x47}, 0x1c, &(0x7f0000001f40)=[{&(0x7f0000000a00)="fbbd292a17e64c6464b5f519996ecd58798e5b6daafbc6fc5c1680e6bb9379238480dc0e9bd7cd8f1cc514ee4e607cfeea7bf5b32c51d04ff05caca9ff311c895a5aab62c11b1061f065e84628ff244237bb10a7954433ca23c6ad0037c0d2fda8ac0acf336943a7250450cc8dfe3944a814c9b08c42c7807a3cfd91252a9165aee7b921ce4282fe61c0", 0x8a}, {&(0x7f0000000ac0)="edd7db5543ce85caab7f464e2503453855b35729363ced89d3cfe167ae44be79f7d49ab6b70c9ccc132770399f0d28b7f879f7a32ece7b30402069d9875304818a7a1ef004d4f532f454cc7a165bab68465b3f47541f0ec96bbb821488031a1a39ae927ff3dd6905a16ee05cef352cd4fb9c94cd1af9fb6e975fcb6c76067272e709afdd1d9b93a325bd09c0927f6b41c0cf5fe6db6ee030fd6ea4d6126d6004444f8cf019c17d9ed84a94d4a01460034376fcf082589863fe3d0fe1ba368e71379d3cc9a1a2e61eb27f78cdf9948c76d9daa7986ba2cc56", 0xd8}, {&(0x7f0000000bc0)="9f13484005c14ef04f6b89f68f2af90f4ceaa34c6cfe15bfebf5e514df56240421b38a5ee92867492f00504cf9214d3f03f48518c8b4f37b47dd9530194fbd9b1892dd88b6890f976f8063f7373ae6bbca0dff0c78ceb1ea3e96864c48e944d7d3e5b43c925de02707b1ea", 0x6b}, {&(0x7f0000000c40)="903f3ca93374352975c2adb43de58b26bf472b62ed67b21560a8039e4244001534f095420872abb5703dc9f1f42b3a79af0fa144658015896aaae220b8ff178ac89686677c9e80fe085ad3437bae198168ed04c6a74a7d500b2ccba28cbe12e83c8123de5b47398d918a9463d2b578a125317cc92c774129f15f64108d25c1ff2ce71122018a41c3c298faf2", 0x8c}, {&(0x7f0000000d00)="6b16e42dc2122efa43315435f4d84dc81d5b4b8220fa04d37fe5d2702b7924ce5cb915d460d9f2ace9fdff3be0a91265afa61560cd5d8a9005b2c1a3da6212670a833ea5ec3bae17ecf72a3757842a744c1ae062c69314488887b7447a4f96607ae10bc01ada8c0ab2125aff0846138f106abe13d076d96723c28e0fc0d2b9b40a8bf20069260b620d04cb057c3907910b6c0e6c2fa826bd656c8adf408ccb17cff79c9fd900826a804f27f5d58ec13e61e9e8aeae6c1c788f810ed9b09be84038f3a11ed96cfe28fa1df95ea839ada26e4ee20360721090d9905381ebb15529ce6a510a27f97681e820107e72cdd857e7828120b2f50072debdbf7a5e0cfcbd21ca995e179574714b729fb5958670e08a74d676ad2e53eecaa31830a3d5084a36c2315eef80fe48220cd5ec32a918fc19f08eb6e9c1dd3622e5ed8293790c11a3bf87d0975ccec12d427b6345c081c5e68250373a79b188f2949096da24db8a64b8baf3ab0799d69779d623cd70dec05a892df66366468b2072fe4fe41c2669b4148b729e2e6002ce6df18e5f0cccdb024a8fe78581efc056894ca89aac53564ea785a049b75eb0ccfddc0a4238c306fe8ac1a99fe579511b6a8ebd7c22d7aa8339bcce63ebfe7959b688bfc4222475d0772f4a514ea1279ebdcaae9c8ec5d462b57a45f1c72526f18294f2c32fb16b5ebf00941399a42bf125e902729d085206f624c585320a8add889fdf325d238685b75001dab5167379a6b06da2539f65d475799d1ef8aba4faf66fbbbd61e8f187b8e510b937ba8cdaada039bfe822b9214a6c57e260020628824afe0fb93a0b3e8bd0aad2219e9184c63c6e30008decdbcab0134a6873f5b946ca846e27ecf9e5b03adaeeafda18bb6ae9029df13f3b7a705e8ecf56122f881faddff9f782d60fc97558d029bf65b49010ccf17273d65f41ef7b223498dcb781c1a42dc521a0712e0a4b345d00e7378441565ad8993ee7094adb842cf02c63756996038fb2e714414d8d453d52223ce8c548917dd62f01c27798715cb1af2b69c246e7a31fd0407121a9ed17848b937b62d47f8f478062fa5ed9959503257b191bbf9133dc693cefa5d331a2ab9a0beb624f7a1b9d5b7927d52a6dd8de10907305ee1cdee60e402a7bda102e8985344e785a6c138bb65bd9c20d0930b8a2aceb2b1207973f093ca36a1f4de2d3e1c3e7fca80a0c765bd6d7e9e8404693ea04237bd1f5a0e01861b2405e419e573e98d2776d5a777223bb160f2a5bedf8fd2491561cabb5ee582c0926474fac8c351576a241580508259597990cb49eebeda730f3568d72375959b0792af4d3bc8b7048179bc8084f86582b22b552cd3397600ea80ec73999f3c815ffae42cbb7109e62c54eb329f966fb9fb4ecbca53f208f2d7725555d59d97991aafd19601d073977115df33bfa6d78c6126b604cc851886f86a40d4295450b24a4fdbf0ee61f9009d697e268dd5fa3f9be09be301c045193ab26719f916ed3a87127790fff7ccd5a21a17ce2b349c4ba706ca135557a07c8403c891e7eea755c6dd5a6ae5baac896ed9daf0fe946006069f051586cb06a62c62f062e92fc1327d9c49e56b90d904a07ac149592288fdb505e56ec425234088e34cf4268fadba127c8621579d2abc5ca1505ce6f0fa2996108a852b3b4b75f74b2fa931146b166426b2e52306fb3e49f23561a5f132409c3c39268c976d23acd86c3b5023437930610652de5ef024a1045000774136326a3cf0554fb40304b42be453500083071f784157b0af3b1a0fa6898c934b81a690ccc31b23cd489fa1c3e2215db6c9c821246c86133ffd5c9c6e07da6817c4f56ff282aaf3a4a95f99fda26954ff1a1f0860346115258ec17dc3da448ce93314a41e3842bbf2be590a109459cb3f4bae6645e8426c0e8f6699dbfcbd19ee1e4d435026baad3d7c3e3567fd18b792536a5339b92fcf2789cccb2414aa4890c24e951479d7d6749809639248bfba4d3530bb5608de07276a0ad62fb475bf9c4d39eae30f81ab826bed6d7d2ad44d7abb30db8aeeb7b33769cb3077fbe71efe81e9a4f83b2c13c35932fb594c43733c1c665680461eaa6614849a827fd35d8bd4b46be61fe5d2b0a805967bcfbee5fa11d8a6ef27c928a10b7d38c9bc44e5b95a0ca7dac230068b223a4f787dbcf238d699393019fed3dad1ca095e447729b3497bf386514fcf9930d7dd88e1a179a49924f0542f3e2c0d9ad5b48520420fc4b9055dc42a88532e285633d319afd214724db485a43a133f8a3f7ee9544400a2bbacd51c4aa4c7749587c0eaa026016aa0589d2f51151c964e09a7a38e7aeea1c1ef4aef2cbae00430b48f224e0dc125cb59610cb569cf935a4a138b6063f44688ec3775796e35b793ee1e9ec19c6456f20417354df54c581bcab7486e1978bd70c1cfd0906572c9dd962e20ead516e030ff75eeeda6bcecd809adcca29575fc39c16c4bff1a33ddb69d77e7869662fb45f730f20777830d6cf4b6e6c8a6afe023a7e9316442f46416f2b85872fd6940cfce336acff536f1c97c2c84da23ae347962c56256a68630fe7ea26589a49a7d3c79dcf9d92faebfbde1dc3d9958f2afe6f351f0a97ee22f124ef198e8804292cbd88daf2bdb378e38280ccd5faceb53bb030a7790c8076bcf2bf3610aa1faca6adcc141a26dd4c4d121f5c8b5183dd660105b1fca54c9c5f5d7f74a1cd379f8c0ca4f8f5031e06ed5ae785966dae6f44a7f67994f615c8dfc646aa7d52b933ff4ef221fc7d57cb51e3dca1b4bdb8a72a435643deffb32b8964132b45125abcc27d3fb79006f9d0c9698ca42db2375d92ec603efb6b41b54e64b9bf68c6cd2bb2ce5277529f631add88ccd2c5d3632b03520da3083a2f9eeeada71d1cb16116b10ff22d7e9277a6e2f477ab43f81ebeb3a74c66e86d3c88024b4c568d84d5fba9acff31b71010caac598f11248e7307f31985ffcefbbd046c5445dabec7f5304888de289b9c21ffd9c4b18adedce39ac9f63a35fdf226669c887908a7a51d5c1fcf433247674a2d935c88a47d8346534365e63228171f7159cbebad77a2ebcc6fb50647a5de65254abaa6d278c1c98330e1e9e6a07a35008c50971920948ef69320ef51bd35290e6cd7b4dbeebe5ce5edcc9fb7cb49f5a023cdf187a415d462adb3164b5430c9170b23df4b13f4fd76dbb72c31823f063cdb115cb18409c5941229fc2c9598657759ef9c6fc5a70b36b97645a90e35fadd58bf72b8eb8c19d24b44c662825c00b05b9a212dfeb33c3922cd0dfc33d6bf158045d68658946722cdaa053a40543b09099d271780e5e49898c071be235b4dec3483d7077b8abd27676629a676462c94d4b7c3b16429c5f76ac61bf56ccbe3626e054a38bab470f096ac2ce634516242fd5e51c7aae28865f34b25699cb0cb5a157d83e13ec72a191be13583c422021a4f778fc44306cdea3ca5d411de9401574a39d4345a7cebf640b9bcdba454f318830d1c6d14ef4acaa6c4c7695e3eabe5012c0dc5850e6a0392bae0b9dda99543b3432a7dd827f23a63b36513f0a1cd28758b9781194a93898380af2135a146f397c396f31e3378093c09a29122ab61443da09a1ac27fda0a84ab98422665004cc035612776a4344316a288a561368889156ec567405970ffb762859e022ca6887f0ce9033890f2fa0e2ee901a582098a6ec25c8fdd4e109766ea38c35d86752b7501569ddbdeb6c17a740931e0a5e41a417bd4df62c63f76075df39988e471c656e6b08e31d8732397e213155471da648e49b5de4c80de3112f27cdd7aac7b78b4a48ea76fb1cf1d33a1e0037f82276f6f95514e8c383616721bcd70ae0093db1cfbc4b3103e16b4ed7befb9cecbba8fa0fd15c312314b6999eaf60fd1a86c3e4289d08b48cc61ae6978ec09d0fd1bee0e9ef0a120c4f462f06afb0af256c617e31b5e1043e3cec46b6d67509c6aa2d3442fddb787ac290c292b5a60c74bb9cd1cf27b88d81e64c8d72362648b1c052419b2bc053d4a06e1f72cedddd52a4d94acf5bad95b3dd04bb6e39307dd0869819adbbd6e0dfd2405230b5a7f9a0afa63790a322236e884c90dac9346f95864ceebe7b94229f5b0010541d78c8ee15640b563a9d3939fff62441559277047f9f10c2d6c092398fb41ce9c1d5369907ae301b56136c3311976f283b09f38c899b0fc8bac09322dd936845c475649ab16fc263246b6775130a1dc8e103a3c926202e166347e67812ead611a62230b300db7eef1c4c0a69a973eb4be5493c09c0381bbc56a0f5273e57d8f9ffcb12bd3176b669e6334a8eeae3107c57cda9ef4ae1050b850b98d2eda0e7e27480ba48f8225e0619cf1a6d276d0d0f195b89e7231bbf929b701964322f783b8dd400d205fb868442f942d2f856a955c40de7ea253c2204477d323efc753cb6505c9a924fc014530cfdba18607600ec69d7d2afb4f38031425f4a111f30874a5efbaabf9a425034c0f30e65e39c6a38de638c2166a6bae7bcae92c039eb6c4c9b45b5416cf78fef531a5991593096fb89ec3d6721ae8a65e453f85d3c880602a470d26aef30eb1522988e8e8ee54aa8e8d28fc2ec65877fa12a97cb7c838fed028981eae59b9e892f46557dba5c590742fb695e5949b01a4d0114084cca930319cce403b15b7264a6cd9c12291181e70a27b3453428700b8ecef6cde04214cd5352bda32cfca0c156b60f7a4e3c7896de116d75e1f2322f525af22f13b10bac70166610ab17344cab500cdf8f18b706fc1ad3d290f6e5758e65059229275d59066323444ba36dd7e54bab7f1b332c032b5a1334bf7413122e75788ca92318c692764c9e4c86b2a7f9cfd1305daca2cd7097ad6b11ebed7bf514c7bed4030f3916abc6310aa166168542627fc4f559a58d19164bd986954bb643fa2be1ab615ca3738ced0d694f3d8807c28099dd52df47040668b7cdff56b95537d98eaf495821a1b09536e7bbb21cda5497b1a0d4d58f798e018a065e7559c17fe521c7462adc899460fc9965162da944259fabe2ce0d1d596d9eb1142d2549e079a58157565c7ec274b4f68ba466e64419d80e1b05d0f71bd3c34b1314094d3e2265144e1ec91ed46e4160d15e7b5cb49b92ff0cf0e5ac103648c6d38afd90874b375812a6c21ed815594760cba8c8e3e07539a3a516a0526e2550bef2d38e2e99100315a093e5931b670d8a2ce138d29fe9a63232121c6d7fa9fc295e281334035fd5d830918179b3669860307547f7c0158d58c336fe95fb7d2ca5ad83c7815ef501abaa0217ab661bfdd9a249705c5aa1f297db24862331d08d9a818cd218d1b12127a1cae1c3a0bb0802b049b7bb1b65f8e827cbadd3273bf1df7850bf9a9e832ded601b34cafb0919e5b19fa352d915c8c2c01709f0b60f86ff597a25f680ada5be873eef8838ae79d646c5b3c87f5ef03a3028dc41beda3c663ccf0ea1b0ad57eb1d8f62e2016f61c4325a5ebae87ece2b911a226d2db8017b1e6f9f64f15635f216bdd9bfd181bb2b7a5899a2a05cc94f2cde85640c4dc942ef8aaf96d4329a06f707c4437f6ad61205a8e2f86cc588a9e3c2015b850d993cdc77d367f640f552a248882d1886ee48c4ae34f2c32c16dcd44b75540aaa4c0dfe958ada10e772d65f365a42d19eeaf49af93f36ac922114d704254c6ada2f000827b1fd057dcab92a4161147fc8933584516e02767e63fe9849785cd59c988407d511769f1e6521fed381eeddc8a20864bac33f6f83dcd37", 0x1000}, {&(0x7f0000000700)="0a4719e65abf589df44748725664393e6fe1f5ec477513ca", 0x18}, {&(0x7f0000001d00)="074f59b45483ff6add08f9bfd8d471e98585be1e96178a695ee830723966361723d7a971d647c07bdd72df3da43ecafc4e8f82aae9369b72d27a8c7a3c5049d38f40f3407374e92a5d840b439035831a41f9b9ba0fa18f2c96db9d5cec96ed24d9fe7fe23a816ba7dea2b42d7056d8113a762f2966face5eef7b8392c6f0ae55de6485e68be65df6a69466525702a2b3ebdaee3239aad420b07b6c7896b5f5a8b27fcff98c878324dddd81917c846afb7d1a8cca730b368544be1310a51e6bbaffccb46aed0ce7bf1e15da78571624c56949029b32bb37e0cc9094fdcd18c1c6", 0xe0}, {&(0x7f0000001e00)="d697d5c0a7e4f8c3c3c1224613f86d58234a79c925b40af1c41d481371c5249fc76d5c78bb9d051496a1e57c175a23fe76ee5f348095e1a475708e34ff6b01409b500ad6a860e4f32a1b219914ee258af52086d85ed7f76c156a359b56284f0021b64a2e0a67691cece2462aa5bc032eebc4fe5b868ecadf48ca852586bd43877ed5fd45569063cc8778f66c6cd5b2", 0x8f}, {&(0x7f0000001ec0)='Pw', 0x2}, {&(0x7f0000001f00)="48a0db", 0x3}], 0xa, &(0x7f0000002000)=[@dontfrag={{0x14, 0x29, 0x3e, 0x6}}], 0x18}}], 0x2, 0x4) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='ceph\x00', 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f00000003c0)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r1, @ANYBLOB="05", @ANYRES16=r1], 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x2020) setrlimit(0x1, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) copy_file_range(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfffffffffffffffe, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={'ip6erspan0\x00', {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}) 280.595445ms ago: executing program 3 (id=485): r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0x20041, 0x0) bind$vsock_stream(r0, &(0x7f0000000080)={0x28, 0x0, 0xffffffff, @hyper}, 0x10) unlinkat$binderfs_device(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00') 179.819707ms ago: executing program 3 (id=488): r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder-control\x00', 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.stat\x00', 0x275a, 0x0) write$UHID_INPUT(r1, &(0x7f0000000940)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125c7ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb32bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bd6c108fab3591bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2034fae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b8b74e26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd6929bbc2850cd4901389e6ea6e86041e0efa1158f334e7afda0e11c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c6692abb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b29674bfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bcddf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d672250658bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb15ac56438ea331820ae59c8c474e36fc73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4659698549646bd63175adf77b5cdcfe676e1b1a9af15102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4b9f6e46a8ce73eb22ebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f842629049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21bbfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e00686a3ed499cfb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9f058cc048f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002af6a6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b42e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae6644493f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a", 0x1000}}, 0x1006) (async) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) (async) r2 = socket$xdp(0x2c, 0x3, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) (async) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, 0x0, 0x0) (async) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000780), 0x0, 0x0) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000280)={0x28, 0x0, 0x0, @local}, 0x10) (async) shutdown(0xffffffffffffffff, 0x1) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000d, 0x4008031, 0xffffffffffffffff, 0x0) (async) bind$xdp(r2, &(0x7f0000000180)={0x2c, 0x1, r3}, 0x10) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x541b, 0x0) (async) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, &(0x7f0000000f00)={'binder0\x00'}) 178.618587ms ago: executing program 3 (id=490): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r1, &(0x7f0000000000), 0x8) listen(r1, 0x1) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000140), 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f0000241000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) 178.096367ms ago: executing program 2 (id=491): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x189000, 0x0) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) (async, rerun: 64) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x44142, 0x0) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) (async, rerun: 64) r3 = socket$packet(0x11, 0x2, 0x300) (rerun: 64) bind$packet(r3, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x14) (async) sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x18, 0x0, 0x4c1dad3e3d6a7499, 0x70bd2d, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000080}, 0x2400c000) (async, rerun: 32) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0xa101, 0x0) (rerun: 32) ioctl$TCSETAF(r4, 0x5408, &(0x7f00000000c0)={0x4e00, 0x0, 0x730, 0xbdff, 0x10, "feeeff000000001b"}) (async) write$binfmt_aout(r4, &(0x7f0000000240)=ANY=[], 0xff2e) (async) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x3, 0x0, 0x0, "0062ba7d82000000000000000000f7fffeff00"}) r5 = syz_open_pts(r4, 0x8182) r6 = dup3(r5, r4, 0x0) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000000)=0x17) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000080)=0x5) (async) r7 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000140)) lseek(r7, 0x3, 0x4) (async) r8 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000e80), 0x0, 0x0) timerfd_settime(r8, 0x3, &(0x7f00000013c0)={{}, {0x0, 0x989680}}, 0x0) (async) r9 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r9, 0x29, 0xc8, 0x0, 0xc000000) r10 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r10, 0x29, 0xc8, 0x0, 0xc000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r2, 0x2000) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000008, 0x100010, r1, 0xa4bba000) sendfile(r1, r0, 0x0, 0x3895) 161.701147ms ago: executing program 3 (id=492): mkdir(&(0x7f0000000000)='./file0\x00', 0x2) mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="687567e73de164766973652c00"]) (async) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r0, &(0x7f0000000980)={0x2020}, 0x2020) 154.548117ms ago: executing program 2 (id=493): creat(0x0, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(0xffffffffffffffff, 0xc040aed5, &(0x7f00000000c0)={0x2, 0x118000}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) ioprio_set$pid(0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) ioprio_get$pid(0x2, 0x0) mmap(&(0x7f00004f7000/0x1000)=nil, 0x1000, 0x1000002, 0x8010, 0xffffffffffffffff, 0x45809000) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) ioctl$BLKRRPART(r4, 0x125f, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x1000000, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x103442, 0x58) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r5 = open(&(0x7f00000000c0)='.\x00', 0x10000, 0x0) getdents(r5, &(0x7f0000001fc0)=""/184, 0xb8) getdents(r5, &(0x7f0000001fc0)=""/184, 0xb8) 146.746298ms ago: executing program 3 (id=494): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000140)={{0x0, 0xdddd1000, 0xe, 0x9, 0x81, 0x4, 0xa, 0xf, 0x0, 0x7, 0x5, 0x1}, {0x100000, 0xffff1000, 0x3, 0x4, 0x2, 0x8, 0x8d, 0x3, 0x0, 0x81, 0x8, 0x1}, {0x5000, 0x0, 0x0, 0x7, 0x2, 0x1, 0x8, 0xf, 0x8, 0x9, 0x2}, {0xffff1000, 0xd5dd0000, 0xe, 0x2, 0x1, 0x3, 0x9, 0x0, 0x1, 0x6, 0x4, 0x9}, {0x100002, 0xeeee8000, 0x9, 0x0, 0x80, 0xee, 0x0, 0x7, 0x7c, 0x81, 0xe, 0x8}, {0x3000, 0x4, 0x8, 0x1, 0x5, 0x4, 0x1, 0x1, 0x6, 0x86, 0xb, 0x2}, {0xeeee8000, 0xeeee0000, 0xf, 0x7, 0x7, 0x3, 0x1d, 0x47, 0x30, 0x2, 0x8, 0xe1}, {0xf000, 0x2, 0xc, 0xf8, 0xfd, 0xa, 0x2, 0x4, 0x3, 0x8, 0x5, 0x4e}, {0x4000, 0x7}, {0x6000, 0x5}, 0x10, 0x0, 0x0, 0x40, 0x4, 0x1000, 0xeeef0000, [0x5, 0x8001, 0x8]}) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611) openat$ashmem(0xffffffffffffff9c, &(0x7f00000000c0), 0x88602, 0x0) 99.990728ms ago: executing program 2 (id=495): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='cgroup\x00') preadv(r2, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/205, 0xcd}], 0x1, 0x9f, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) mount$binderfs(0x0, &(0x7f0000000040)='./binderfs\x00', &(0x7f0000000000), 0x20004, &(0x7f00000000c0)=ANY=[@ANYRESHEX=r1]) 98.931078ms ago: executing program 3 (id=496): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) fadvise64(r0, 0x10000001003, 0x9, 0x5) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x246c0, 0x0) (async) timer_create(0x3, 0x0, &(0x7f0000000000)=0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) (async) timer_settime(r2, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x3938700}}, 0x0) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_PMU_CAPABILITY(r3, 0x4068aea3, &(0x7f0000000140)={0xc1, 0x0, 0x6}) mmap(&(0x7f0000787000/0x4000)=nil, 0x4000, 0x5a051feb1e984a11, 0x202812, r0, 0x7dfff000) (async) mmap(&(0x7f0000785000/0x4000)=nil, 0x4000, 0x8, 0x13, r3, 0x3d7c0000) 98.503258ms ago: executing program 2 (id=497): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffa) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x9cc6d000) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f0000000000)='\x00\x00\x03\x06\x00\x00\x00\x1f\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\x87\xa3\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Hd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\xadP\x1c2\xb8H\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&`<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6#M\"\x87\x05W\f0b(p\xb4;\x0e\x18\xf7/A\xfd8\\\x99\xc7Dp\x98\xa4o\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12KL\xf2\xd5\b^[D~\x00\x00\x00\x00\x00\x00\x00\xfe\x8c\x87\x0f\x99\xc3E\xcfc\x8cX\xa3\xf5&}\a\xbf\xf8N\"C!\x1f\x96\xd7\xe9\xa5tw\'\x8f,_\xa0\xea\x90\"\x19i\f\xd5\x02\xe2+\xc1\x8e\xfb@\xc56\xb5\xe4\x91\xbc\xbf\xf7\xea\x01]\xd8\xf8.\x99\x82\x89\x9a\x97\x8b\xdd\xcf\xe6\xb4\xad\xda\x7f\xc8\xd0(Q\x8dP\xd9\xd8(){\xca\x84\xd3(\xb6\xd5\xd4\x94\xdf\xde\x05B\"\xa3L\xc9t\xd4]\x95.\x02\x97\xb5\xc5E\xc7H\x84d\xe6I\xd8\\&\xc6\x81t\xa38u\xc0\xa3\x9b\b,4-\x8a\x9fo:\x86J?\xac\xd1\xa8\x02\xb6\xc5m\x85,\x97\xbe\xba\x0eWnW\xdd,\x1eT\x9c\xde\x9e{;\xb2X\x89\xdc\xcfO6\xba\xcbK\xb5\xfbD\xc9\xc4D\x04BT\xe1\xe9]s\x18$F\x9b\xe9<\xdb\x03\b\xfc\xe9\x19E\x8b\x83\xa6\x84Y\xab\x85\xea\x1f^K\xd6I\x10G<@n\x9e\x81\xc6\x1d\xbc\x1a\xc1G') ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0) (async) ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000040)={'\x00', 0x7, 0x8000, 0x1, 0x8, 0xfffffffffffffff9, 0x0}) syz_open_procfs(r2, &(0x7f00000000c0)='clear_refs\x00') ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0x10000003) (async) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0x10000003) mmap(&(0x7f0000fec000/0x4000)=nil, 0x4000, 0x0, 0x13, r1, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f00000003c0)) (async) ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f00000003c0)) mmap(&(0x7f0000fee000/0xf000)=nil, 0xf000, 0x0, 0x11, r1, 0x0) (async) mmap(&(0x7f0000fee000/0xf000)=nil, 0xf000, 0x0, 0x11, r1, 0x0) 95.459128ms ago: executing program 2 (id=498): r0 = socket$inet_icmp(0x2, 0x2, 0x1) sendmsg(r0, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000001480)=[{&(0x7f0000001400)="6feec01c6e419d5f", 0x8}], 0x1}, 0x15) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x0, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r3, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) (async) sendmmsg$unix(r3, &(0x7f0000000640)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000480)="82f585", 0x3}], 0x1, &(0x7f0000000140)=ANY=[@ANYBLOB="14ec63c0519465e67cf16d8ae78aaf08000100000000001700000001000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00'], 0x18, 0x8010}}], 0x1, 0x0) (async) add_key(&(0x7f0000000040)='blacklist\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) (async) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = gettid() sigaltstack(&(0x7f0000000000)={0x0, 0x180000001, 0xffffffffffffff73}, 0x0) (async) tkill(r4, 0x21) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1e, 0x3}) (async) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000040)={0x2}) (async) ioctl$VHOST_GET_VRING_BASE(0xffffffffffffffff, 0xc008af12, &(0x7f00000000c0)) 95.088698ms ago: executing program 2 (id=499): ioprio_set$uid(0x3, 0x0, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000980)='/sys/power/pm_trace', 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) (async) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1, 0x22052, r1, 0xfffff000) (async) r2 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async) r3 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) (async) syz_usb_control_io$hid(r3, &(0x7f0000001540)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00220f00000003a8407a730b93bf0280b3"], 0x0}, 0x0) (async) r4 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGFIELDINFO(r4, 0xc038480a, &(0x7f00000000c0)={0x3, 0x200, 0x0, 0x4, 0xd691, 0x6, 0x3, 0x1d7, 0x801, 0x1, 0x462e8123, 0xf, 0x4, 0x869}) (async) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r2, 0x800448d2, &(0x7f0000000400)={0x0, 0x0}) 0s ago: executing program 1 (id=500): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffe) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f0000000540)=')}%!:\xb9+\xe4\x1f2\xba\xc3\x0ed\x93Z\xbf\xa6`\xa6\x84\xef\x18\x8d\x90@\x1bb\xff\x01\x8a%\xf6vl\x15GPFo\rAmW\xd7*F\xe6\az\x852\x92\x0e\xd9\x9a\x11\xd3\xa8\x96\xad\xcc\xf9\xb0\xcb\x8f\x1ao\xfd9\xa8\x03\xe0j\x81lM}\xf0\x1e\xfb\xd2\x84\xa0\xb1\xc0\x97\xc16\xf7@l%j\xc9\x11ll|\xc6x\xcdD\xd7\x94\xe2\x1c\x96\xa3\x88a\xd8?M\x8dA5q\x11Ou\xa0 LS\xff\x92Y\xee3\x8a0\b%\xe8:}\f\x14\x03\xc2S\x8a@\xf8w\xe1Z\xb7\xf5\x9c\xbbj\xb7g\xd1\x9dH\x18\x9a\x11\xc0f\xbd0\x9cD}\xf8\xff\x9d\x8b\xb2\xb2&\xbb(\xba\xe8f\xd6Qg\x9dT\xfa\xd01\xec\x12\xf4\xfb\xd4\xf1|/\xf3]\x03-\xe0\x93=O\xb3\xdcf:R\x11\t\x15\xc2\xfaV\x17\xc9b\x9b\x95\xd4@\xdb\xf0\xb5\x02\x8a\x91\xb0?\xc6g\x88\x1b\xd7\xd4!\x99\x02\x8b\xad \x90\xbciz\x99R\xa4\xca{H&\xa9\xd4C\xfd<,pAz\xf4_\x9d\xf8\x98\x8e\xd9M \xf4\x0f)O\xbf\x8d\xf9:$\f\xc7\xeb\x96Vpg\xb0\xea@q\x03\x87LZ\'\x93\x1e\xecY\xd3Lc\xfe\xbf\xafm_\aO\x96\x00\x89\xca\xb2\x0e9\x98\x8b\xbb\x84\xe0\xd8\xb2\xa1N\xd8o\xc0K\x85\x8f)\x00Lr\x00N!A\x86\xd4\xb2\x98\x86)Cr\x0e\xe4\x86\x970f\x9e\xba\xe9\xba\xd7\xb8W\xa5\xe9\xe3\xaf\x9fj0\n|\x8e\xbd\x9f\xef\xc7iq+\x0f\xcf\xd3\xb2>[2\x98\x7f\x14\x9c\x13\x83\x80\xf3xv\xd6\xd0]\xdb\x82S@\x92\xbb\x97\x8a\x850\x84\xd9~1l\x98\x90\xfb;\xde4\xba\xdc\x8a\xb7\x1f\x8f\x19Uz\x9c\xcc\a\x1e\x85=\xb3\x18s\xe2\xcf\x92\xc4\x05\xb6V\t\x06\x96\xfe\'x\x02ryX\xe6%U\x80;g\x0f\xa11\x12\xfb\xdf\x14\xff-b\x0f;\xb6\xf1R\xea\xfc\x97\x87\xbejB`\xa1\xe6,\xaa\xc4k\x02\xd5\xcc\x1bu\x96\x80\x81?\x87{\x06\xad:\x15\x93C\xab9\xb1\xaf\xd1\xcb\x8a\xeb\xdf\x9f+^\x7f\x06C\xe8\xc3\xbew6\x8f\xe7\xf0\x05x\xb7&p\xe0d\xea\x92DQm\t\xb9\xa8\xa5\x00\x00\x00\x00\x00\x00\x00\x00\x00$\xe4l\xb2\xc1.\xecu5f\xe1\xa4\xe1\xcf/\x00\xdfx\xa5\xc0\x83\xab\x1b\r\xc4\xd2\xb5\xd9\xbbs\x9a\xd8DG\xd1*t\x03\xaa\x1c\xa0Q\xd6a\xe7\xb64\r\xd9BH/\xa1\xfa/\xaa)\xe0\xdf1D\xd1\xb2\xd2\xabR\x9c\xdcrU\xf4M\xca^') mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x2000002, 0x110, r0, 0xfffff000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.7' (ED25519) to the list of known hosts. [ 25.473371][ T36] audit: type=1400 audit(1751424646.530:64): avc: denied { mounton } for pid=281 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.474919][ T281] cgroup: Unknown subsys name 'net' [ 25.496055][ T36] audit: type=1400 audit(1751424646.530:65): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.523391][ T36] audit: type=1400 audit(1751424646.560:66): avc: denied { unmount } for pid=281 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.523816][ T281] cgroup: Unknown subsys name 'devices' [ 25.726938][ T281] cgroup: Unknown subsys name 'hugetlb' [ 25.732571][ T281] cgroup: Unknown subsys name 'rlimit' [ 25.827315][ T36] audit: type=1400 audit(1751424646.890:67): avc: denied { setattr } for pid=281 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.850527][ T36] audit: type=1400 audit(1751424646.890:68): avc: denied { mounton } for pid=281 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.875358][ T36] audit: type=1400 audit(1751424646.890:69): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 25.880505][ T283] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 25.907387][ T36] audit: type=1400 audit(1751424646.970:70): avc: denied { relabelto } for pid=283 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.932999][ T36] audit: type=1400 audit(1751424646.970:71): avc: denied { write } for pid=283 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.944253][ T281] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.958804][ T36] audit: type=1400 audit(1751424647.000:72): avc: denied { read } for pid=281 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.993091][ T36] audit: type=1400 audit(1751424647.000:73): avc: denied { open } for pid=281 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 27.200172][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.214015][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.221136][ T288] bridge_slave_0: entered allmulticast mode [ 27.227854][ T288] bridge_slave_0: entered promiscuous mode [ 27.250364][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.257525][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.264667][ T288] bridge_slave_1: entered allmulticast mode [ 27.271026][ T288] bridge_slave_1: entered promiscuous mode [ 27.400802][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.407974][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.415107][ T294] bridge_slave_0: entered allmulticast mode [ 27.421581][ T294] bridge_slave_0: entered promiscuous mode [ 27.435113][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.442278][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.449396][ T294] bridge_slave_1: entered allmulticast mode [ 27.455711][ T294] bridge_slave_1: entered promiscuous mode [ 27.478274][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.485357][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.492656][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.499711][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.518375][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.525475][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.532884][ T293] bridge_slave_0: entered allmulticast mode [ 27.539477][ T293] bridge_slave_0: entered promiscuous mode [ 27.546393][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.553444][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.560585][ T293] bridge_slave_1: entered allmulticast mode [ 27.566990][ T293] bridge_slave_1: entered promiscuous mode [ 27.573121][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.580188][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.587323][ T292] bridge_slave_0: entered allmulticast mode [ 27.593601][ T292] bridge_slave_0: entered promiscuous mode [ 27.600144][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.607203][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.614365][ T292] bridge_slave_1: entered allmulticast mode [ 27.620670][ T292] bridge_slave_1: entered promiscuous mode [ 27.757002][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.764265][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.779892][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.786978][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.794830][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.801873][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.886854][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.894204][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.902470][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.909569][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.924762][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.931818][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.945431][ T288] veth0_vlan: entered promiscuous mode [ 27.952829][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.959907][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.991203][ T288] veth1_macvtap: entered promiscuous mode [ 28.015506][ T304] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.022588][ T304] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.037320][ T293] veth0_vlan: entered promiscuous mode [ 28.049226][ T294] veth0_vlan: entered promiscuous mode [ 28.069104][ T304] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.076202][ T304] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.087219][ T288] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 28.090456][ T294] veth1_macvtap: entered promiscuous mode [ 28.117280][ T293] veth1_macvtap: entered promiscuous mode [ 28.179272][ T292] veth0_vlan: entered promiscuous mode [ 28.213994][ T292] veth1_macvtap: entered promiscuous mode [ 28.230035][ T318] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 28.248764][ T320] binder: Bad value for 'defcontext' [ 28.454133][ T309] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 28.516415][ T350] binder: Bad value for 'max' [ 28.607666][ T365] netlink: 52 bytes leftover after parsing attributes in process `syz.0.20'. [ 28.614549][ T309] usb 4-1: Using ep0 maxpacket: 16 [ 28.641303][ T309] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.651784][ T370] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 28.655678][ T309] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 28.666205][ T370] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:21 [ 28.695673][ T373] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 28.695763][ T372] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:21 [ 28.698758][ T309] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 28.730623][ T309] usb 4-1: New USB device strings: Mfr=0, Product=64, SerialNumber=164 [ 28.739835][ T309] usb 4-1: Product: syz [ 28.744232][ T309] usb 4-1: SerialNumber: syz [ 28.750296][ T309] usb 4-1: config 0 descriptor?? [ 28.760976][ T379] : renamed from bond_slave_0 [ 28.958302][ T311] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.967748][ T311] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.985137][ T311] rust_binder: Failed copying remainder into alloc: EFAULT [ 28.985163][ T311] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 28.992464][ T311] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 29.013582][ T311] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:2 [ 29.026533][ T309] usbhid 4-1:0.0: can't add hid device: -71 [ 29.049059][ T309] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 29.065430][ T309] usb 4-1: USB disconnect, device number 2 [ 29.198302][ T388] tipc: Started in network mode [ 29.203196][ T388] tipc: Node identity 72b4, cluster identity 4711 [ 29.209836][ T388] tipc: Node number set to 29364 [ 29.322013][ T402] overlayfs: missing 'workdir' [ 29.345563][ T404] overlayfs: failed to clone upperpath [ 29.628498][ T433] ======================================================= [ 29.628498][ T433] WARNING: The mand mount option has been deprecated and [ 29.628498][ T433] and is ignored by this kernel. Remove the mand [ 29.628498][ T433] option from the mount to silence this warning. [ 29.628498][ T433] ======================================================= [ 29.664497][ T309] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 29.687906][ T440] capability: warning: `syz.3.45' uses 32-bit capabilities (legacy support in use) [ 29.845986][ T309] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 29.860009][ T309] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 29.878054][ T309] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 29.894057][ T309] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 29.902192][ T309] usb 2-1: SerialNumber: syz [ 30.118447][ T309] usb 2-1: 0:2 : does not exist [ 30.126287][ T309] usb 2-1: USB disconnect, device number 2 [ 30.174080][ T31] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 30.184429][ T315] udevd[315]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 30.334020][ T31] usb 4-1: Using ep0 maxpacket: 32 [ 30.340378][ T31] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 30.348898][ T31] usb 4-1: config 0 has no interface number 0 [ 30.355237][ T31] usb 4-1: config 0 interface 184 has no altsetting 0 [ 30.363479][ T31] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 30.372599][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.380638][ T31] usb 4-1: Product: syz [ 30.384905][ T31] usb 4-1: Manufacturer: syz [ 30.389516][ T31] usb 4-1: SerialNumber: syz [ 30.395386][ T31] usb 4-1: config 0 descriptor?? [ 30.401138][ T31] smsc75xx v1.0.0 [ 30.405169][ T31] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 30.415344][ T31] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -22 [ 30.637945][ T36] kauditd_printk_skb: 104 callbacks suppressed [ 30.637965][ T36] audit: type=1400 audit(1751424651.700:178): avc: denied { write } for pid=471 comm="syz.1.52" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 30.665861][ T36] audit: type=1400 audit(1751424651.700:179): avc: denied { remove_name } for pid=471 comm="syz.1.52" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 30.689089][ T36] audit: type=1400 audit(1751424651.700:180): avc: denied { unlink } for pid=471 comm="syz.1.52" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 30.714089][ T36] audit: type=1400 audit(1751424651.750:181): avc: denied { read } for pid=94 comm="acpid" name="mouse1" dev="devtmpfs" ino=442 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 30.736118][ T36] audit: type=1400 audit(1751424651.750:182): avc: denied { open } for pid=94 comm="acpid" path="/dev/input/mouse1" dev="devtmpfs" ino=442 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 30.758950][ T36] audit: type=1400 audit(1751424651.750:183): avc: denied { ioctl } for pid=94 comm="acpid" path="/dev/input/mouse1" dev="devtmpfs" ino=442 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 30.783570][ T36] audit: type=1400 audit(1751424651.790:184): avc: denied { ioctl } for pid=479 comm="syz.1.54" path="socket:[5194]" dev="sockfs" ino=5194 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 30.796675][ T486] fuse: Bad value for 'group_id' [ 30.809779][ T36] audit: type=1400 audit(1751424651.790:185): avc: denied { read } for pid=479 comm="syz.1.54" dev="nsfs" ino=4026532297 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 30.813719][ T486] fuse: Bad value for 'group_id' [ 30.818414][ T486] overlayfs: workdir and upperdir must reside under the same mount [ 30.835172][ T36] audit: type=1400 audit(1751424651.790:186): avc: denied { open } for pid=479 comm="syz.1.54" path="net:[4026532297]" dev="nsfs" ino=4026532297 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 30.870610][ T36] audit: type=1400 audit(1751424651.820:187): avc: denied { map } for pid=481 comm="syz.1.55" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=5208 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 31.154062][ T309] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 31.304027][ T309] usb 2-1: Using ep0 maxpacket: 32 [ 31.310240][ T309] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 31.321288][ T309] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 31.331161][ T309] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 31.340233][ T309] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.348972][ T309] usb 2-1: config 0 descriptor?? [ 31.356342][ T309] hub 2-1:0.0: USB hub found [ 31.556026][ T309] hub 2-1:0.0: 1 port detected [ 32.014780][ T309] usb 2-1: USB disconnect, device number 3 [ 32.108008][ T526] overlayfs: failed to clone upperpath [ 32.196426][ T535] netlink: 'syz.2.74': attribute type 4 has an invalid length. [ 32.204200][ T535] netlink: 'syz.2.74': attribute type 5 has an invalid length. [ 32.211918][ T535] netlink: 'syz.2.74': attribute type 1 has an invalid length. [ 32.252615][ T541] netlink: 104 bytes leftover after parsing attributes in process `syz.2.76'. [ 32.283217][ T543] overlayfs: failed to clone upperpath [ 32.378065][ T553] /dev/rnullb0: Can't lookup blockdev [ 32.434055][ T309] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 32.585157][ T309] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 32.595961][ T309] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 32.605590][ T309] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 32.614706][ T309] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 32.622849][ T309] usb 2-1: SerialNumber: syz [ 32.628433][ T580] fuse: Bad value for 'group_id' [ 32.633587][ T580] fuse: Bad value for 'group_id' [ 32.714040][ T31] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 32.838993][ T309] usb 2-1: 0:2 : does not exist [ 32.849803][ T309] usb 2-1: USB disconnect, device number 4 [ 32.860291][ T315] udevd[315]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 32.876499][ T31] usb 1-1: Using ep0 maxpacket: 16 [ 32.895446][ T31] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 32.923269][ T305] usb 4-1: USB disconnect, device number 3 [ 32.936425][ T31] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 32.946390][ T589] rust_binder: Write failure EFAULT in pid:27 [ 32.957682][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.982753][ T31] usb 1-1: Product: syz [ 32.987145][ T31] usb 1-1: Manufacturer: syz [ 32.991824][ T31] usb 1-1: SerialNumber: syz [ 33.006525][ T31] cdc_ncm 1-1:1.0: skipping garbage [ 33.011814][ T31] cdc_ncm 1-1:1.0: NCM or ECM functional descriptors missing [ 33.019740][ T31] cdc_ncm 1-1:1.0: bind() failure [ 33.166069][ T598] : renamed from lo (while UP) [ 33.236792][ T10] usb 1-1: USB disconnect, device number 2 [ 33.386804][ T616] binder: Unknown parameter 'context' [ 33.476446][ T613] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 33.784047][ T31] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 33.954071][ T31] usb 4-1: Using ep0 maxpacket: 8 [ 33.965545][ T31] usb 4-1: too many configurations: 108, using maximum allowed: 8 [ 33.984416][ T31] usb 4-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 34.000970][ T31] usb 4-1: config 0 interface 0 has no altsetting 0 [ 34.013026][ T31] usb 4-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 34.037191][ T31] usb 4-1: config 0 interface 0 has no altsetting 0 [ 34.052188][ T31] usb 4-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 34.074842][ T31] usb 4-1: config 0 interface 0 has no altsetting 0 [ 34.085228][ T31] usb 4-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 34.101562][ T31] usb 4-1: config 0 interface 0 has no altsetting 0 [ 34.116446][ T31] usb 4-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 34.132765][ T31] usb 4-1: config 0 interface 0 has no altsetting 0 [ 34.134050][ T10] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 34.147780][ T31] usb 4-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 34.170883][ T31] usb 4-1: config 0 interface 0 has no altsetting 0 [ 34.183839][ T31] usb 4-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 34.206907][ T31] usb 4-1: config 0 interface 0 has no altsetting 0 [ 34.220934][ T31] usb 4-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 34.246132][ T31] usb 4-1: config 0 interface 0 has no altsetting 0 [ 34.259562][ T31] usb 4-1: New USB device found, idVendor=5543, idProduct=0042, bcdDevice= 0.00 [ 34.268792][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.279623][ T31] usb 4-1: config 0 descriptor?? [ 34.305192][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.324040][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 34.333835][ T10] usb 1-1: New USB device found, idVendor=1020, idProduct=0006, bcdDevice= 0.00 [ 34.364015][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.384339][ T10] usb 1-1: config 0 descriptor?? [ 34.694971][ T31] uclogic 0003:5543:0042.0001: unbalanced delimiter at end of report description [ 34.707636][ T31] uclogic 0003:5543:0042.0001: parse failed [ 34.713693][ T31] uclogic 0003:5543:0042.0001: probe with driver uclogic failed with error -22 [ 34.792272][ T10] belkin 0003:1020:0006.0002: unknown main item tag 0x3 [ 34.815195][ T10] belkin 0003:1020:0006.0002: hidraw0: USB HID v0.00 Device [HID 1020:0006] on usb-dummy_hcd.0-1/input0 [ 35.185503][ T650] overlayfs: failed to resolve './file1': -2 [ 35.346458][ T661] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 35.367346][ T661] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 35.384543][ T305] usb 1-1: USB disconnect, device number 3 [ 35.418070][ T666] fuse: Unknown parameter '0x0000000000000004' [ 35.425779][ T667] SELinux: security_context_str_to_sid (sytem_uGй) failed with errno=-22 [ 35.458795][ T670] /dev/loop0: Can't lookup blockdev [ 35.854070][ T305] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 36.035058][ T305] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 36.054385][ T305] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 36.074402][ T305] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 36.083625][ T305] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 36.091881][ T305] usb 1-1: SerialNumber: syz [ 36.204685][ T683] overlayfs: failed to clone upperpath [ 36.277893][ T685] syz.2.124 uses obsolete (PF_INET,SOCK_PACKET) [ 36.305637][ T305] usb 1-1: 0:2 : does not exist [ 36.316130][ T305] usb 1-1: USB disconnect, device number 4 [ 36.343026][ T315] udevd[315]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 36.345410][ T687] fuse: Unknown parameter '0x0000000000000004' [ 36.499437][ T9] usb 4-1: USB disconnect, device number 4 [ 36.774744][ T36] kauditd_printk_skb: 33 callbacks suppressed [ 36.774763][ T36] audit: type=1400 audit(2000000004.480:221): avc: denied { write } for pid=701 comm="syz.3.130" path="socket:[5114]" dev="sockfs" ino=5114 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 36.794076][ T45] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 36.864551][ T36] audit: type=1400 audit(2000000004.570:222): avc: denied { nlmsg_read } for pid=705 comm="syz.0.131" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 36.935380][ T715] fuse: Unknown parameter '0x0000000000000004' [ 36.941039][ T36] audit: type=1400 audit(2000000004.640:223): avc: denied { write } for pid=716 comm="syz.0.135" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 36.994018][ T45] usb 2-1: Using ep0 maxpacket: 16 [ 37.002327][ T45] usb 2-1: New USB device found, idVendor=0b0e, idProduct=ffff, bcdDevice= 0.40 [ 37.011747][ T45] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.019883][ T45] usb 2-1: Product: Г [ 37.024031][ T45] usb 2-1: Manufacturer: 뽺㔁뷫撨㋪鳙潳㯺妽덲玗㖤툼谧ᷧ [ 37.032814][ T45] usb 2-1: SerialNumber: syz [ 37.066125][ T726] batadv_slave_1: entered promiscuous mode [ 37.076705][ T728] batadv_slave_1: left promiscuous mode [ 37.096915][ T730] bpf: Bad value for 'mode' [ 37.102348][ T36] audit: type=1400 audit(2000000004.800:224): avc: denied { read } for pid=729 comm="syz.0.139" name="uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 37.125461][ T36] audit: type=1400 audit(2000000004.800:225): avc: denied { open } for pid=729 comm="syz.0.139" path="/dev/uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 37.149020][ T36] audit: type=1400 audit(2000000004.830:226): avc: denied { read write } for pid=729 comm="syz.0.139" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 37.177809][ T36] audit: type=1400 audit(2000000004.830:227): avc: denied { open } for pid=729 comm="syz.0.139" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 37.224021][ T305] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 37.254884][ T691] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.263422][ T36] audit: type=1400 audit(2000000004.940:228): avc: denied { write } for pid=690 comm="syz.1.127" name="ip6_tables_targets" dev="proc" ino=4026532360 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 37.288393][ T691] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.298866][ T691] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.310591][ T691] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.344466][ T36] audit: type=1400 audit(2000000005.050:229): avc: denied { block_suspend } for pid=736 comm="syz.0.142" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 37.367013][ T737] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 37.367044][ T737] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:77 [ 37.385735][ T305] usb 4-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 37.403949][ T305] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.413938][ T305] usb 4-1: config 0 descriptor?? [ 37.446416][ T740] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 37.519499][ T691] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.536858][ T691] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.548190][ T742] overlayfs: failed to clone upperpath [ 37.555496][ T691] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.574615][ T691] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.590375][ T744] fuse: Unknown parameter '0x0000000000000004' [ 37.624065][ T45] usbhid 2-1:1.0: can't add hid device: -71 [ 37.653052][ T36] audit: type=1400 audit(2000000005.350:230): avc: denied { execute } for pid=749 comm="syz.2.148" name="file1" dev="tmpfs" ino=461 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 37.734273][ T45] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 37.742752][ T305] usb 4-1: Cannot read MAC address [ 37.750221][ T45] usb 2-1: USB disconnect, device number 5 [ 37.757307][ T305] MOSCHIP usb-ethernet driver 4-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 37.771651][ T305] usb 4-1: USB disconnect, device number 5 [ 37.982867][ T773] fuse: Unknown parameter 'fd0x0000000000000004' [ 38.036101][ T777] netlink: 5 bytes leftover after parsing attributes in process `syz.0.157'. [ 39.159703][ T809] fuse: Unknown parameter 'fd0x0000000000000004' [ 39.215266][ T815] rust_binder: Failed to allocate buffer. len:4294966472, is_oneway:false [ 39.215303][ T815] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 39.223928][ T815] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:80 [ 39.444035][ T738] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 39.514075][ T305] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 39.574340][ T829] overlayfs: failed to clone upperpath [ 39.591655][ T831] fuse: Unknown parameter 'fd0x0000000000000004' [ 39.605295][ T738] usb 1-1: config 1 has an invalid descriptor of length 96, skipping remainder of the config [ 39.615583][ T738] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 39.625380][ T738] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 39.634626][ T738] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 39.642640][ T738] usb 1-1: SerialNumber: syz [ 39.648147][ T305] usb 2-1: device descriptor read/64, error -71 [ 39.664033][ T45] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 39.814015][ T45] usb 4-1: Using ep0 maxpacket: 32 [ 39.820261][ T45] usb 4-1: config 0 has an invalid interface number: 231 but max is 0 [ 39.828497][ T45] usb 4-1: config 0 has an invalid descriptor of length 80, skipping remainder of the config [ 39.838987][ T45] usb 4-1: config 0 has no interface number 0 [ 39.845202][ T45] usb 4-1: too many endpoints for config 0 interface 231 altsetting 81: 218, using maximum allowed: 30 [ 39.856346][ T45] usb 4-1: config 0 interface 231 altsetting 81 has 0 endpoint descriptors, different from the interface descriptor's value: 218 [ 39.869732][ T45] usb 4-1: config 0 interface 231 has no altsetting 0 [ 39.877564][ T738] usb 1-1: 0:2 : does not exist [ 39.884202][ T45] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 39.893258][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.902329][ T738] usb 1-1: USB disconnect, device number 5 [ 39.908526][ T305] usb 2-1: device descriptor read/64, error -71 [ 39.916067][ T45] usb 4-1: Product: syz [ 39.920443][ T45] usb 4-1: Manufacturer: syz [ 39.925602][ T45] usb 4-1: SerialNumber: syz [ 39.930996][ T45] usb 4-1: config 0 descriptor?? [ 40.143728][ T45] smsc95xx v2.0.0 [ 40.147444][ T45] smsc95xx 4-1:0.231 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 40.157859][ T45] smsc95xx 4-1:0.231: probe with driver smsc95xx failed with error -22 [ 40.166228][ T305] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 40.175674][ T45] usb 4-1: USB disconnect, device number 6 [ 40.304097][ T305] usb 2-1: device descriptor read/64, error -71 [ 40.389840][ T870] rust_binder: Write failure EINVAL in pid:104 [ 40.424558][ T874] SELinux: security_context_str_to_sid () failed with errno=-22 [ 40.544103][ T305] usb 2-1: device descriptor read/64, error -71 [ 40.654217][ T305] usb usb2-port1: attempt power cycle [ 40.734021][ T45] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 40.864088][ T45] usb 1-1: device descriptor read/64, error -71 [ 40.994094][ T305] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 41.015130][ T305] usb 2-1: device descriptor read/8, error -71 [ 41.104025][ T45] usb 1-1: device descriptor read/64, error -71 [ 41.146202][ T305] usb 2-1: device descriptor read/8, error -71 [ 41.202118][ T883] tmpfs: Bad value for 'uid' [ 41.206833][ T883] tmpfs: Bad value for 'uid' [ 41.316419][ T888] random: crng reseeded on system resumption [ 41.344158][ T45] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 41.367456][ T890] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 41.384136][ T305] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 41.405368][ T305] usb 2-1: device descriptor read/8, error -71 [ 41.474096][ T45] usb 1-1: device descriptor read/64, error -71 [ 41.535052][ T305] usb 2-1: device descriptor read/8, error -71 [ 41.644124][ T305] usb usb2-port1: unable to enumerate USB device [ 41.714037][ T45] usb 1-1: device descriptor read/64, error -71 [ 41.824125][ T45] usb usb1-port1: attempt power cycle [ 41.914033][ T309] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 42.065256][ T309] usb 4-1: config 1 has an invalid descriptor of length 96, skipping remainder of the config [ 42.075535][ T309] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 42.085154][ T309] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 42.094264][ T309] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 42.102262][ T309] usb 4-1: SerialNumber: syz [ 42.174078][ T45] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 42.195151][ T45] usb 1-1: device descriptor read/8, error -71 [ 42.308454][ T905] Zero length message leads to an empty skb [ 42.311859][ T309] usb 4-1: 0:2 : does not exist [ 42.320092][ T36] kauditd_printk_skb: 26 callbacks suppressed [ 42.320109][ T36] audit: type=1400 audit(2000000010.020:257): avc: denied { create } for pid=904 comm="syz.1.205" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 42.322462][ T309] usb 4-1: USB disconnect, device number 7 [ 42.337039][ T45] usb 1-1: device descriptor read/8, error -71 [ 42.362212][ T315] udevd[315]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 42.410265][ T36] audit: type=1326 audit(2000000010.110:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=907 comm="syz.1.206" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f8414b8e929 code=0x0 [ 42.600714][ T36] audit: type=1326 audit(2000000010.300:259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=916 comm="syz.2.209" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fee28d8e929 code=0x0 [ 42.623499][ T45] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 42.644975][ T45] usb 1-1: device descriptor read/8, error -71 [ 42.775079][ T45] usb 1-1: device descriptor read/8, error -71 [ 42.884105][ T45] usb usb1-port1: unable to enumerate USB device [ 42.927777][ T921] process 'syz.3.210' launched '/dev/fd/7' with NULL argv: empty string added [ 42.937094][ T36] audit: type=1400 audit(2000000010.640:260): avc: denied { execute_no_trans } for pid=919 comm="syz.3.210" path=2F6D656D66643A5B0BDB58AE5B1AA9FDFAADD16D64C8854858A9250C1A65E0202864656C6574656429 dev="tmpfs" ino=1029 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 42.980939][ T36] audit: type=1326 audit(2000000010.680:261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=922 comm="syz.3.211" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f4193d8e929 code=0x0 [ 43.098972][ T929] kvm: kvm [927]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0x40000051) = 0x0 [ 43.268341][ T36] audit: type=1400 audit(2000000010.970:262): avc: denied { ioctl } for pid=933 comm="syz.1.214" path="/dev/input/event2" dev="devtmpfs" ino=208 ioctlcmd=0x4591 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 43.294561][ T934] netlink: 'syz.1.214': attribute type 4 has an invalid length. [ 43.337281][ T936] capability: warning: `syz.1.215' uses deprecated v2 capabilities in a way that may be insecure [ 43.348849][ T936] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 43.358255][ T936] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 43.405429][ T36] audit: type=1400 audit(2000000011.110:263): avc: denied { name_bind } for pid=937 comm="syz.1.216" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 43.529624][ T946] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 43.529652][ T946] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:112 [ 43.539902][ T946] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 43.549057][ T946] rust_binder: Read failure Err(EFAULT) in pid:112 [ 43.904033][ T309] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 44.050176][ T36] audit: type=1400 audit(2000000011.750:264): avc: denied { execute } for pid=957 comm="syz.3.222" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 44.074826][ T309] usb 1-1: config 1 has an invalid descriptor of length 96, skipping remainder of the config [ 44.085128][ T309] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 44.100353][ T309] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 44.109558][ T36] audit: type=1400 audit(2000000011.800:265): avc: denied { write } for pid=959 comm="syz.3.223" name="event2" dev="devtmpfs" ino=208 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 44.132563][ T309] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 44.140688][ T309] usb 1-1: SerialNumber: syz [ 44.315743][ T976] 9pnet_virtio: no channels available for device syz [ 44.349241][ T309] usb 1-1: 0:2 : does not exist [ 44.358929][ T309] usb 1-1: USB disconnect, device number 10 [ 44.373899][ T315] udevd[315]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 44.424021][ T305] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 44.574018][ T305] usb 4-1: Using ep0 maxpacket: 16 [ 44.580584][ T305] usb 4-1: unable to get BOS descriptor or descriptor too short [ 44.588991][ T305] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 44.599120][ T305] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 44.608120][ T305] usb 4-1: too many endpoints for config 1 interface 1 altsetting 71: 240, using maximum allowed: 30 [ 44.619057][ T305] usb 4-1: config 1 interface 1 altsetting 71 has 0 endpoint descriptors, different from the interface descriptor's value: 240 [ 44.632228][ T305] usb 4-1: config 1 interface 1 has no altsetting 0 [ 44.640909][ T305] usb 4-1: string descriptor 0 read error: -22 [ 44.647233][ T305] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 44.656310][ T305] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.666510][ T305] usb 4-1: 0:2 : does not exist [ 44.681506][ T305] hub 4-1:1.1: Invalid hub with more than one config or interface [ 44.689489][ T305] hub 4-1:1.1: probe with driver hub failed with error -22 [ 44.871007][ T36] audit: type=1400 audit(2000000012.570:266): avc: denied { create } for pid=969 comm="syz.3.226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 44.895129][ T9] usb 4-1: USB disconnect, device number 8 [ 44.960883][ T993] binder: Bad value for 'max' [ 44.988547][ T997] fuseblk: Bad value for 'blksize' [ 45.414647][ T1003] netlink: 4 bytes leftover after parsing attributes in process `syz.3.237'. [ 45.694025][ T45] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 45.836806][ T1009] fuseblk: Unknown parameter 'fowner<00000000000000000000' [ 45.855121][ T45] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 45.866135][ T45] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 45.875957][ T45] usb 4-1: New USB device found, idVendor=0419, idProduct=0600, bcdDevice= 0.00 [ 45.885114][ T45] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 45.901848][ T45] usb 4-1: config 0 descriptor?? [ 46.312045][ T45] samsung 0003:0419:0600.0003: hidraw0: USB HID v0.00 Device [HID 0419:0600] on usb-dummy_hcd.3-1/input0 [ 46.511641][ T1007] netlink: 12 bytes leftover after parsing attributes in process `syz.3.239'. [ 46.522257][ T45] usb 4-1: USB disconnect, device number 9 [ 46.707379][ T1034] fuse: Unknown parameter '' [ 46.795771][ T304] tipc: Subscription rejected, illegal request [ 46.854068][ T9] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 46.903696][ T1042] rust_binder: Error while translating object. [ 46.903728][ T1042] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 46.909996][ T1042] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:140 [ 46.920066][ T1042] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.994579][ T1046] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 47.008284][ T1046] rust_binder: Write failure EINVAL in pid:145 [ 47.015124][ T9] usb 2-1: config 0 descriptor has 1 excess byte, ignoring [ 47.028737][ T9] usb 2-1: New USB device found, idVendor=03da, idProduct=2820, bcdDevice=52.3c [ 47.038450][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.047480][ T9] usb 2-1: config 0 descriptor?? [ 47.054432][ T9] rndis_host 2-1:0.0: skipping garbage [ 47.060852][ T9] usb 2-1: bad CDC descriptors [ 47.258869][ T305] usb 2-1: USB disconnect, device number 10 [ 47.272240][ T1066] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 47.284032][ T738] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 47.435023][ T738] usb 1-1: config 160 has an invalid interface number: 200 but max is 0 [ 47.443406][ T738] usb 1-1: config 160 has no interface number 0 [ 47.449761][ T738] usb 1-1: config 160 interface 200 has no altsetting 0 [ 47.458164][ T738] usb 1-1: New USB device found, idVendor=21bb, idProduct=2070, bcdDevice=87.0b [ 47.467276][ T738] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.475311][ T738] usb 1-1: Product: syz [ 47.479489][ T738] usb 1-1: Manufacturer: syz [ 47.484134][ T738] usb 1-1: SerialNumber: syz [ 47.854676][ T1048] rust_binder: Write failure EFAULT in pid:147 [ 47.861182][ T738] usb 1-1: MIDIStreaming interface descriptor not found [ 47.886535][ T738] usb 1-1: USB disconnect, device number 11 [ 47.909083][ T36] kauditd_printk_skb: 9 callbacks suppressed [ 47.909184][ T36] audit: type=1400 audit(2000000016.613:276): avc: denied { ioctl } for pid=1079 comm="syz.1.266" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 ioctlcmd=0xaf60 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 47.944030][ T306] udevd[306]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:160.200/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 47.975664][ T36] audit: type=1400 audit(2000000016.683:277): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 48.154073][ T305] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 48.305101][ T305] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 48.316138][ T305] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 48.325997][ T305] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 48.338846][ T305] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 8.00 [ 48.347926][ T305] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 48.357018][ T305] usb 4-1: config 0 descriptor?? [ 48.377628][ T1098] rust_binder: 1098: no such ref 0 [ 48.382929][ T1098] rust_binder: Write failure EINVAL in pid:151 [ 48.571549][ T305] usbhid 4-1:0.0: can't add hid device: -71 [ 48.584904][ T305] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 48.593934][ T305] usb 4-1: USB disconnect, device number 10 [ 48.666971][ T36] audit: type=1400 audit(2000000017.373:278): avc: denied { accept } for pid=1112 comm="syz.3.276" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 48.818416][ T36] audit: type=1400 audit(2000000017.523:279): avc: denied { setopt } for pid=1125 comm="syz.0.280" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 48.854080][ T36] audit: type=1400 audit(2000000017.563:280): avc: denied { getopt } for pid=1127 comm="syz.0.281" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 48.941941][ T36] audit: type=1400 audit(2000000017.643:281): avc: denied { watch watch_reads } for pid=1140 comm="syz.2.286" path="/112/file0" dev="tmpfs" ino=664 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 49.098688][ T36] audit: type=1400 audit(2000000017.803:282): avc: denied { connect } for pid=1148 comm="syz.1.289" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 49.174020][ T45] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 49.325558][ T45] usb 1-1: not running at top speed; connect to a high speed hub [ 49.334185][ T45] usb 1-1: config 1 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 49.347407][ T45] usb 1-1: config 1 interface 0 has no altsetting 0 [ 49.355648][ T45] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 49.364765][ T45] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.372753][ T45] usb 1-1: Product: ࠉ [ 49.376945][ T45] usb 1-1: Manufacturer: 薍ς誶煠挧֞遯㵮办 [ 49.383740][ T45] usb 1-1: SerialNumber: а [ 49.466990][ T1174] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:187 [ 49.481631][ T36] audit: type=1400 audit(2000000018.183:283): avc: denied { create } for pid=1175 comm="syz.3.298" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 49.511510][ T36] audit: type=1400 audit(2000000018.193:284): avc: denied { getopt } for pid=1175 comm="syz.3.298" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 49.537280][ T36] audit: type=1400 audit(2000000018.193:285): avc: denied { mounton } for pid=1175 comm="syz.3.298" path="/62/file0" dev="tmpfs" ino=393 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 49.596532][ T45] usb 1-1: USB disconnect, device number 12 [ 49.664028][ T1181] rust_binder: Write failure EFAULT in pid:194 [ 49.766261][ T1191] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:197 [ 50.086040][ T1216] kvm: user requested TSC rate below hardware speed [ 50.194090][ T309] usb 4-1: new full-speed USB device number 11 using dummy_hcd [ 50.266063][ T1229] binder: Bad value for 'max' [ 50.271283][ T1229] netlink: 5308 bytes leftover after parsing attributes in process `syz.0.315'. [ 50.380586][ T1227] netlink: 'syz.1.314': attribute type 12 has an invalid length. [ 50.384819][ T309] usb 4-1: not running at top speed; connect to a high speed hub [ 50.396890][ T309] usb 4-1: config 95 has an invalid interface number: 1 but max is 0 [ 50.405082][ T309] usb 4-1: config 95 has no interface number 0 [ 50.411644][ T309] usb 4-1: config 95 interface 1 has no altsetting 0 [ 50.422759][ T309] usb 4-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice=ad.3f [ 50.524989][ T309] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 50.533115][ T309] usb 4-1: Product: syz [ 50.537459][ T309] usb 4-1: Manufacturer: syz [ 50.542142][ T309] usb 4-1: SerialNumber: syz [ 50.652910][ T1248] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000000 not found [ 50.661182][ T1248] rust_binder: Write failure EINVAL in pid:199 [ 50.701421][ T1256] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem [ 50.770141][ T1262] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 50.793868][ T309] usb 4-1: USB disconnect, device number 11 [ 50.830686][ T315] udevd[315]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:95.1/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 50.915546][ T1281] ./cgroup: Can't lookup blockdev [ 50.921943][ T1283] ./cgroup: Can't lookup blockdev [ 51.174028][ T10] usb 2-1: new low-speed USB device number 11 using dummy_hcd [ 51.198567][ T1298] overlay: ./file0 is not a directory [ 51.332036][ T1313] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 51.335120][ T10] usb 2-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 51.364401][ T10] usb 2-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 51.375634][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 51.382381][ T10] usb 2-1: New USB device found, idVendor=056a, idProduct=0319, bcdDevice= 0.00 [ 51.391618][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.404682][ T10] usb 2-1: config 0 descriptor?? [ 51.410003][ T1285] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 51.574037][ T305] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 51.724018][ T305] usb 4-1: Using ep0 maxpacket: 32 [ 51.730295][ T305] usb 4-1: config 0 has an invalid interface number: 196 but max is 0 [ 51.738534][ T305] usb 4-1: config 0 has no interface number 0 [ 51.744685][ T305] usb 4-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 51.754737][ T305] usb 4-1: config 0 interface 196 has no altsetting 0 [ 51.762997][ T305] usb 4-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 51.772111][ T305] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 51.780151][ T305] usb 4-1: Product: syz [ 51.784482][ T305] usb 4-1: Manufacturer: syz [ 51.789105][ T305] usb 4-1: SerialNumber: syz [ 51.794538][ T305] usb 4-1: config 0 descriptor?? [ 51.799849][ T1313] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 51.820127][ T10] wacom 0003:056A:0319.0004: unknown main item tag 0x0 [ 51.827098][ T10] wacom 0003:056A:0319.0004: unknown main item tag 0x0 [ 51.834335][ T10] wacom 0003:056A:0319.0004: unknown main item tag 0x0 [ 51.841318][ T10] wacom 0003:056A:0319.0004: unknown main item tag 0x0 [ 51.848381][ T10] wacom 0003:056A:0319.0004: unknown main item tag 0x0 [ 51.855538][ T10] wacom 0003:056A:0319.0004: unknown main item tag 0x0 [ 51.862458][ T10] wacom 0003:056A:0319.0004: unknown main item tag 0x0 [ 51.869407][ T10] wacom 0003:056A:0319.0004: unknown main item tag 0x0 [ 51.953655][ T1325] binder: Unknown parameter 'defcontext01777777777777777777777' [ 51.961762][ T1325] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 52.021843][ T1285] 9pnet: Could not find request transport: furdno=0x0000000000000003 [ 52.031573][ T10] usb 2-1: USB disconnect, device number 11 [ 52.274039][ T309] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 52.425977][ T309] usb 1-1: config 1 has an invalid interface number: 5 but max is 2 [ 52.434142][ T309] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 52.444292][ T309] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 52.453265][ T309] usb 1-1: config 1 has no interface number 1 [ 52.459410][ T309] usb 1-1: too many endpoints for config 1 interface 5 altsetting 0: 156, using maximum allowed: 30 [ 52.470288][ T309] usb 1-1: config 1 interface 5 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 156 [ 52.484875][ T309] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 52.493999][ T309] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 52.502026][ T309] usb 1-1: Product: э [ 52.506188][ T309] usb 1-1: Manufacturer: 䀁 [ 52.510811][ T309] usb 1-1: SerialNumber: syz [ 52.691884][ T1371] overlayfs: workdir and upperdir must be separate subtrees [ 52.714158][ T305] ipheth 4-1:0.196: ipheth_enable_ncm: usb_control_msg: -110 [ 52.723936][ T305] ipheth 4-1:0.196: Apple iPhone USB Ethernet device attached [ 52.728414][ T309] usb 1-1: 0:2 : does not exist [ 52.745551][ T309] usb 1-1: USB disconnect, device number 13 [ 52.759801][ T306] udevd[306]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 52.762065][ T1377] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:222 [ 52.891666][ C1] ipheth 4-1:0.196: ipheth_rcvbulk_callback: urb status: -75 [ 53.093328][ T309] usb 4-1: USB disconnect, device number 12 [ 53.153285][ T309] ipheth 4-1:0.196: Apple iPhone USB Ethernet now disconnected [ 53.376810][ T36] kauditd_printk_skb: 26 callbacks suppressed [ 53.376829][ T36] audit: type=1400 audit(2000000022.083:312): avc: denied { execmod } for pid=1411 comm="syz.2.365" path="/dev/rnullb0" dev="tmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 53.472961][ T36] audit: type=1400 audit(2000000022.173:313): avc: denied { wake_alarm } for pid=1407 comm="syz.0.364" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 53.614465][ T1430] No source specified [ 53.797110][ T36] audit: type=1400 audit(2000000022.503:314): avc: denied { mount } for pid=1458 comm="syz.2.382" name="/" dev="ramfs" ino=10453 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 54.035383][ T1467] netlink: 4 bytes leftover after parsing attributes in process `syz.0.384'. [ 54.044375][ T1467] bridge_slave_1: left allmulticast mode [ 54.051785][ T1467] bridge_slave_1: left promiscuous mode [ 54.059413][ T1467] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.067471][ T1467] bridge_slave_0: left allmulticast mode [ 54.074613][ T1467] bridge_slave_0: left promiscuous mode [ 54.080527][ T1467] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.091510][ T1472] fuse: Bad value for 'fd' [ 54.096195][ T1473] fuse: Bad value for 'fd' [ 54.101518][ T1472] fuseblk: Unknown parameter '' [ 54.106880][ T1473] fuseblk: Unknown parameter '' [ 54.112154][ T36] audit: type=1400 audit(2000000022.813:315): avc: denied { remount } for pid=1466 comm="syz.0.384" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 54.289843][ T1480] overlayfs: maximum fs stacking depth exceeded [ 54.289843][ T36] audit: type=1400 audit(2000000022.993:316): avc: denied { getattr } for pid=1479 comm="syz.1.388" name="/" dev="incremental-fs" ino=482 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 54.654034][ T305] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 54.753999][ T309] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 54.805254][ T36] audit: type=1326 audit(2000000023.513:317): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1502 comm="syz.2.396" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fee28d8e929 code=0x0 [ 54.814035][ T305] usb 2-1: Using ep0 maxpacket: 16 [ 54.834160][ T305] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 54.842873][ T305] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 54.852973][ T305] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 54.861976][ T305] usb 2-1: config 1 has no interface number 1 [ 54.868100][ T305] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 54.880989][ T305] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 54.892228][ T305] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 54.901337][ T305] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.909362][ T305] usb 2-1: Product: syz [ 54.913561][ T305] usb 2-1: Manufacturer: syz [ 54.918221][ T305] usb 2-1: SerialNumber: syz [ 54.936570][ T309] usb 1-1: unable to get BOS descriptor or descriptor too short [ 54.944990][ T309] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 54.952587][ T309] usb 1-1: can't read configurations, error -71 [ 55.125305][ T1507] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.133914][ T1507] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.151618][ T305] usb 2-1: USB disconnect, device number 12 [ 55.162802][ T315] udevd[315]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 55.199312][ T1509] netlink: 4 bytes leftover after parsing attributes in process `syz.3.397'. [ 55.345680][ T1518] binder: Bad value for 'max' [ 55.507553][ T1534] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 4200, limit: 4216, size: 18446744073709550742) [ 55.507576][ T1534] rust_binder: Error while translating object. [ 55.519987][ T1534] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 55.526709][ T1534] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:251 [ 55.857521][ T1568] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.866112][ T1568] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.879778][ T1568] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.888430][ T1568] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.994049][ T309] usb 1-1: new full-speed USB device number 16 using dummy_hcd [ 56.094028][ T305] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 56.145369][ T309] usb 1-1: unable to get BOS descriptor or descriptor too short [ 56.153464][ T309] usb 1-1: not running at top speed; connect to a high speed hub [ 56.162044][ T309] usb 1-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 56.173805][ T309] usb 1-1: New USB device found, idVendor=3980, idProduct=0003, bcdDevice=dc.62 [ 56.183041][ T309] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 56.191136][ T309] usb 1-1: Product: syz [ 56.195348][ T309] usb 1-1: Manufacturer: syz [ 56.199970][ T309] usb 1-1: SerialNumber: syz [ 56.224040][ T305] usb 2-1: device descriptor read/64, error -71 [ 56.277762][ T36] audit: type=1400 audit(2000000024.983:318): avc: denied { ioctl } for pid=1576 comm="syz.2.420" path="socket:[10928]" dev="sockfs" ino=10928 ioctlcmd=0x89a0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 56.302328][ T36] audit: type=1400 audit(2000000024.983:319): avc: denied { accept } for pid=1576 comm="syz.2.420" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 56.340383][ T1581] netlink: 'syz.2.421': attribute type 4 has an invalid length. [ 56.348175][ T1581] netlink: 3657 bytes leftover after parsing attributes in process `syz.2.421'. [ 56.410704][ T36] audit: type=1400 audit(2000000025.113:320): avc: denied { ioctl } for pid=1537 comm="syz.0.406" path="/dev/fuse" dev="devtmpfs" ino=23 ioctlcmd=0xe500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 56.456301][ T309] rtl8150 1-1:14.0: couldn't find required endpoints [ 56.463135][ T309] rtl8150 1-1:14.0: probe with driver rtl8150 failed with error -5 [ 56.472258][ T309] usb 1-1: USB disconnect, device number 16 [ 56.494014][ T305] usb 2-1: device descriptor read/64, error -71 [ 56.734021][ T305] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 56.864028][ T305] usb 2-1: device descriptor read/64, error -71 [ 56.901521][ T36] audit: type=1326 audit(2000000025.603:321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1593 comm="syz.2.425" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fee28d8e929 code=0x0 [ 56.932422][ T1599] overlayfs: failed to clone upperpath [ 57.104014][ T305] usb 2-1: device descriptor read/64, error -71 [ 57.216027][ T305] usb usb2-port1: attempt power cycle [ 57.564030][ T305] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 57.595936][ T305] usb 2-1: device descriptor read/8, error -71 [ 57.684063][ T469] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 57.734987][ T305] usb 2-1: device descriptor read/8, error -71 [ 57.844003][ T469] usb 1-1: Using ep0 maxpacket: 16 [ 57.851463][ T469] usb 1-1: config 0 has an invalid interface number: 35 but max is 0 [ 57.859921][ T469] usb 1-1: config 0 has no interface number 0 [ 57.869569][ T469] usb 1-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice=a3.85 [ 57.883984][ T469] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 57.894429][ T469] usb 1-1: config 0 descriptor?? [ 57.974580][ T305] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 58.015031][ T305] usb 2-1: device descriptor read/8, error -71 [ 58.104928][ T469] usb 1-1: USB disconnect, device number 17 [ 58.156188][ T305] usb 2-1: device descriptor read/8, error -71 [ 58.266136][ T305] usb usb2-port1: unable to enumerate USB device [ 58.364020][ T309] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 58.515103][ T309] usb 4-1: config 1 has an invalid descriptor of length 96, skipping remainder of the config [ 58.525415][ T309] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 58.535072][ T309] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 58.544223][ T309] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 58.552246][ T309] usb 4-1: SerialNumber: syz [ 58.594122][ T36] kauditd_printk_skb: 4 callbacks suppressed [ 58.594141][ T36] audit: type=1400 audit(2000000027.303:326): avc: denied { mount } for pid=1683 comm="syz.2.456" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 58.643768][ T36] audit: type=1400 audit(2000000027.343:327): avc: denied { mount } for pid=1685 comm="syz.0.457" name="/" dev="configfs" ino=2628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 58.672687][ T36] audit: type=1400 audit(2000000027.373:328): avc: denied { search } for pid=1685 comm="syz.0.457" name="/" dev="configfs" ino=2628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 58.723774][ T1701] netlink: 'syz.2.462': attribute type 9 has an invalid length. [ 58.741404][ T36] audit: type=1400 audit(2000000027.443:329): avc: denied { execute } for pid=1685 comm="syz.0.457" path="/selinux/policy" dev="selinuxfs" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=file permissive=1 [ 58.767719][ T309] usb 4-1: 0:2 : does not exist [ 58.775547][ T309] usb 4-1: USB disconnect, device number 13 [ 58.789752][ T315] udevd[315]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 59.028305][ T1714] netlink: 16 bytes leftover after parsing attributes in process `syz.1.466'. [ 59.092038][ T1725] tipc: Started in network mode [ 59.096996][ T1725] tipc: Node identity 000000000000000009, cluster identity 4711 [ 59.297532][ T36] audit: type=1400 audit(2000000028.003:330): avc: denied { map } for pid=1729 comm="syz.3.472" path="/dev/loop6" dev="devtmpfs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 59.414025][ T469] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 59.601085][ T469] usb 2-1: config 1 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 132, changing to 11 [ 59.612751][ T469] usb 2-1: config 1 interface 0 has no altsetting 0 [ 59.620989][ T469] usb 2-1: New USB device found, idVendor=046d, idProduct=1017, bcdDevice= 0.40 [ 59.630297][ T1745] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000000 not found [ 59.638742][ T469] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 59.646831][ T469] usb 2-1: Product: syz [ 59.651272][ T1745] rust_binder: Write failure EINVAL in pid:288 [ 59.653316][ T469] usb 2-1: Manufacturer: syz [ 59.669981][ T469] usb 2-1: SerialNumber: syz [ 59.723818][ T1752] 9pnet_fd: Insufficient options for proto=fd [ 59.890814][ T36] audit: type=1400 audit(2000000028.593:331): avc: denied { read } for pid=1727 comm="syz.1.471" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 59.998016][ T469] usbhid 2-1:1.0: can't add hid device: -71 [ 60.004101][ T469] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 60.014369][ T469] usb 2-1: USB disconnect, device number 17 [ 60.064043][ T309] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 60.219489][ T309] usb 1-1: config 1 has an invalid descriptor of length 96, skipping remainder of the config [ 60.229991][ T309] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 60.242540][ T36] audit: type=1404 audit(2000000028.943:332): enforcing=1 old_enforcing=0 auid=4294967295 ses=4294967295 enabled=1 old-enabled=1 lsm=selinux res=1 [ 60.264240][ T309] usb 1-1: string descriptor 0 read error: -71 [ 60.272201][ T36] audit: type=1400 audit(2000000028.943:333): avc: denied { ioctl } for pid=1758 comm="syz.0.481" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=0 [ 60.297800][ T309] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 60.307034][ T309] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 60.315563][ T36] audit: type=1400 audit(2000000028.943:334): avc: denied { sys_module } for pid=1758 comm="syz.0.481" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=0 [ 60.337228][ T309] usb 1-1: can't set config #1, error -71 [ 60.343657][ T309] usb 1-1: USB disconnect, device number 18 [ 60.350182][ T36] audit: type=1400 audit(2000000028.963:335): avc: denied { create } for pid=1763 comm="syz.3.483" anonclass=[userfaultfd] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=0 [ 60.567999][ T469] ================================================================== [ 60.576133][ T469] BUG: KASAN: null-ptr-deref in _raw_spin_lock+0x7f/0x120 [ 60.583310][ T469] Write of size 4 at addr 0000000000000080 by task kworker/1:3/469 [ 60.591240][ T469] [ 60.593606][ T469] CPU: 1 UID: 0 PID: 469 Comm: kworker/1:3 Not tainted 6.12.30-syzkaller-g648383294760 #0 93f95243d2c671158253b6b51cea62df3148036e [ 60.593641][ T469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 60.593657][ T469] Workqueue: events _RNvXs6_NtCs43vyB533jt3_6kernel9workqueueINtNtNtB7_4sync3arc3ArcNtNtCshgDM7dBCdno_11rust_binder7process7ProcessEINtB5_15WorkItemPointerKy0_E3runB13_ [ 60.593739][ T469] Call Trace: [ 60.593747][ T469] [ 60.593757][ T469] __dump_stack+0x21/0x30 [ 60.593795][ T469] dump_stack_lvl+0x10c/0x190 [ 60.593821][ T469] ? __cfi_dump_stack_lvl+0x10/0x10 [ 60.593851][ T469] print_report+0x3d/0x70 [ 60.593871][ T469] kasan_report+0x163/0x1a0 [ 60.593906][ T469] ? _raw_spin_lock+0x7f/0x120 [ 60.593941][ T469] ? __cfi__raw_spin_lock+0x10/0x10 [ 60.593972][ T469] ? _raw_spin_lock+0x7f/0x120 [ 60.594003][ T469] kasan_check_range+0x299/0x2a0 [ 60.594038][ T469] __kasan_check_write+0x18/0x20 [ 60.594064][ T469] _raw_spin_lock+0x7f/0x120 [ 60.594098][ T469] ? __cfi__raw_spin_lock+0x10/0x10 [ 60.594132][ T469] ? dput+0x42f/0x510 [ 60.594157][ T469] d_delete+0x4a/0x120 [ 60.594185][ T469] rust_binderfs_remove_file+0xec/0x110 [ 60.594213][ T469] _RNvXs2_NtCshgDM7dBCdno_11rust_binder7processNtB5_7ProcessNtNtCs43vyB533jt3_6kernel9workqueue8WorkItem3run+0x9d4/0x2860 [ 60.594257][ T469] ? preempt_schedule+0xb0/0xd0 [ 60.594282][ T469] ? __kasan_check_write+0x18/0x20 [ 60.594309][ T469] ? __cfi___update_load_avg_cfs_rq+0x10/0x10 [ 60.594348][ T469] ? preempt_schedule_thunk+0x1a/0x40 [ 60.594383][ T469] ? __cfi__RNvXs2_NtCshgDM7dBCdno_11rust_binder7processNtB5_7ProcessNtNtCs43vyB533jt3_6kernel9workqueue8WorkItem3run+0x10/0x10 [ 60.594425][ T469] ? update_load_avg+0x506/0x19a0 [ 60.594449][ T469] ? detach_entity_load_avg+0x7b0/0x7b0 [ 60.594483][ T469] ? dequeue_entity+0xa9c/0x1750 [ 60.594509][ T469] ? __kasan_check_write+0x18/0x20 [ 60.594537][ T469] ? tg_unthrottle_up+0x980/0x980 [ 60.594564][ T469] ? kvm_sched_clock_read+0x15/0x30 [ 60.594592][ T469] ? sched_clock_noinstr+0xd/0x30 [ 60.594619][ T469] ? sched_clock+0x44/0x60 [ 60.594652][ T469] ? sched_clock_cpu+0x75/0x400 [ 60.594682][ T469] ? sched_balance_newidle+0x845/0xe00 [ 60.594708][ T469] ? __cfi_sched_clock_cpu+0x10/0x10 [ 60.594732][ T469] ? __kasan_check_write+0x18/0x20 [ 60.594753][ T469] ? __switch_to+0xc7b/0x1310 [ 60.594776][ T469] ? psi_group_change+0xb44/0x1130 [ 60.594802][ T469] ? __cfi___switch_to+0x10/0x10 [ 60.594830][ T469] ? _raw_spin_unlock+0x45/0x60 [ 60.594850][ T469] ? __switch_to_asm+0x3d/0x70 [ 60.594880][ T469] ? __schedule+0x1463/0x1f10 [ 60.594904][ T469] ? kick_pool+0xb9/0x550 [ 60.594926][ T469] process_scheduled_works+0x7d2/0x1020 [ 60.594962][ T469] worker_thread+0xc58/0x1250 [ 60.594997][ T469] kthread+0x2ca/0x370 [ 60.595030][ T469] ? __cfi_worker_thread+0x10/0x10 [ 60.595062][ T469] ? __cfi_kthread+0x10/0x10 [ 60.595094][ T469] ret_from_fork+0x64/0xa0 [ 60.595121][ T469] ? __cfi_kthread+0x10/0x10 [ 60.595155][ T469] ret_from_fork_asm+0x1a/0x30 [ 60.595187][ T469] [ 60.595196][ T469] ================================================================== [ 60.903582][ T469] Disabling lock debugging due to kernel taint [ 60.910120][ T469] BUG: kernel NULL pointer dereference, address: 0000000000000080 [ 60.917926][ T469] #PF: supervisor write access in kernel mode [ 60.923986][ T469] #PF: error_code(0x0002) - not-present page [ 60.929981][ T469] PGD 8000000138dc2067 P4D 8000000138dc2067 PUD 0 [ 60.936491][ T469] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 60.942571][ T469] CPU: 1 UID: 0 PID: 469 Comm: kworker/1:3 Tainted: G B 6.12.30-syzkaller-g648383294760 #0 93f95243d2c671158253b6b51cea62df3148036e [ 60.957509][ T469] Tainted: [B]=BAD_PAGE [ 60.961692][ T469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 60.971756][ T469] Workqueue: events _RNvXs6_NtCs43vyB533jt3_6kernel9workqueueINtNtNtB7_4sync3arc3ArcNtNtCshgDM7dBCdno_11rust_binder7process7ProcessEINtB5_15WorkItemPointerKy0_E3runB13_ [ 60.988550][ T469] RIP: 0010:_raw_spin_lock+0x95/0x120 [ 60.993946][ T469] Code: 7d 7a c7 44 24 20 00 00 00 00 be 04 00 00 00 e8 11 fe 53 fc 4c 89 f7 be 04 00 00 00 e8 04 fe 53 fc 8b 44 24 20 b9 01 00 00 00 0f b1 0b 75 32 48 c7 04 24 0e 36 e0 45 4b c7 04 3c 00 00 00 00 [ 61.013590][ T469] RSP: 0018:ffffc9000ce4f4e0 EFLAGS: 00010297 [ 61.019673][ T469] RAX: 0000000000000000 RBX: 0000000000000080 RCX: 0000000000000001 [ 61.027649][ T469] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc9000ce4f500 [ 61.035624][ T469] RBP: ffffc9000ce4f560 R08: 0000000000000003 R09: 0000000000000004 [ 61.043596][ T469] R10: dffffc0000000000 R11: fffff520019c9ea0 R12: 1ffff920019c9e9c [ 61.051613][ T469] R13: dffffc0000000000 R14: ffffc9000ce4f500 R15: dffffc0000000000 [ 61.059674][ T469] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 61.068606][ T469] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 61.075192][ T469] CR2: 0000000000000080 CR3: 0000000116412000 CR4: 00000000003526b0 [ 61.083183][ T469] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 61.091194][ T469] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 61.099192][ T469] Call Trace: [ 61.102490][ T469] [ 61.105445][ T469] ? __cfi__raw_spin_lock+0x10/0x10 [ 61.110689][ T469] ? dput+0x42f/0x510 [ 61.114706][ T469] d_delete+0x4a/0x120 [ 61.118820][ T469] rust_binderfs_remove_file+0xec/0x110 [ 61.124405][ T469] _RNvXs2_NtCshgDM7dBCdno_11rust_binder7processNtB5_7ProcessNtNtCs43vyB533jt3_6kernel9workqueue8WorkItem3run+0x9d4/0x2860 [ 61.137219][ T469] ? preempt_schedule+0xb0/0xd0 [ 61.142111][ T469] ? __kasan_check_write+0x18/0x20 [ 61.147270][ T469] ? __cfi___update_load_avg_cfs_rq+0x10/0x10 [ 61.153378][ T469] ? preempt_schedule_thunk+0x1a/0x40 [ 61.158789][ T469] ? __cfi__RNvXs2_NtCshgDM7dBCdno_11rust_binder7processNtB5_7ProcessNtNtCs43vyB533jt3_6kernel9workqueue8WorkItem3run+0x10/0x10 [ 61.172007][ T469] ? update_load_avg+0x506/0x19a0 [ 61.177060][ T469] ? detach_entity_load_avg+0x7b0/0x7b0 [ 61.182627][ T469] ? dequeue_entity+0xa9c/0x1750 [ 61.187574][ T469] ? __kasan_check_write+0x18/0x20 [ 61.192700][ T469] ? tg_unthrottle_up+0x980/0x980 [ 61.197733][ T469] ? kvm_sched_clock_read+0x15/0x30 [ 61.202942][ T469] ? sched_clock_noinstr+0xd/0x30 [ 61.207974][ T469] ? sched_clock+0x44/0x60 [ 61.212399][ T469] ? sched_clock_cpu+0x75/0x400 [ 61.217260][ T469] ? sched_balance_newidle+0x845/0xe00 [ 61.222732][ T469] ? __cfi_sched_clock_cpu+0x10/0x10 [ 61.228028][ T469] ? __kasan_check_write+0x18/0x20 [ 61.233146][ T469] ? __switch_to+0xc7b/0x1310 [ 61.237832][ T469] ? psi_group_change+0xb44/0x1130 [ 61.242952][ T469] ? __cfi___switch_to+0x10/0x10 [ 61.247899][ T469] ? _raw_spin_unlock+0x45/0x60 [ 61.252757][ T469] ? __switch_to_asm+0x3d/0x70 [ 61.257529][ T469] ? __schedule+0x1463/0x1f10 [ 61.262215][ T469] ? kick_pool+0xb9/0x550 [ 61.266551][ T469] process_scheduled_works+0x7d2/0x1020 [ 61.272130][ T469] worker_thread+0xc58/0x1250 [ 61.276825][ T469] kthread+0x2ca/0x370 [ 61.280913][ T469] ? __cfi_worker_thread+0x10/0x10 [ 61.286040][ T469] ? __cfi_kthread+0x10/0x10 [ 61.290652][ T469] ret_from_fork+0x64/0xa0 [ 61.295077][ T469] ? __cfi_kthread+0x10/0x10 [ 61.299681][ T469] ret_from_fork_asm+0x1a/0x30 [ 61.304461][ T469] [ 61.307482][ T469] Modules linked in: [ 61.311407][ T469] CR2: 0000000000000080 [ 61.315585][ T469] ---[ end trace 0000000000000000 ]--- [ 61.321055][ T469] RIP: 0010:_raw_spin_lock+0x95/0x120 [ 61.326449][ T469] Code: 7d 7a c7 44 24 20 00 00 00 00 be 04 00 00 00 e8 11 fe 53 fc 4c 89 f7 be 04 00 00 00 e8 04 fe 53 fc 8b 44 24 20 b9 01 00 00 00 0f b1 0b 75 32 48 c7 04 24 0e 36 e0 45 4b c7 04 3c 00 00 00 00 [ 61.346059][ T469] RSP: 0018:ffffc9000ce4f4e0 EFLAGS: 00010297 [ 61.352167][ T469] RAX: 0000000000000000 RBX: 0000000000000080 RCX: 0000000000000001 [ 61.360143][ T469] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc9000ce4f500 [ 61.368123][ T469] RBP: ffffc9000ce4f560 R08: 0000000000000003 R09: 0000000000000004 [ 61.376101][ T469] R10: dffffc0000000000 R11: fffff520019c9ea0 R12: 1ffff920019c9e9c [ 61.384080][ T469] R13: dffffc0000000000 R14: ffffc9000ce4f500 R15: dffffc0000000000 [ 61.392061][ T469] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 61.400996][ T469] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 61.407600][ T469] CR2: 0000000000000080 CR3: 0000000116412000 CR4: 00000000003526b0 [ 61.415685][ T469] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 61.423669][ T469] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 61.431648][ T469] Kernel panic - not syncing: Fatal exception [ 61.438078][ T469] Kernel Offset: disabled [ 61.442400][ T469] Rebooting in 86400 seconds..