last executing test programs: 28.867948101s ago: executing program 0 (id=148): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2/custom1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0xffffffff, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x48, 0x18, &(0x7f00000006c0)={@flat=@weak_binder={0x77622a85, 0xa}, @flat=@binder={0x73622a85, 0x108a, 0xfffffffffffffffc}, @flat=@weak_binder={0x77622a85, 0x0, 0x2}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000002, 0x10, r0, 0x11f60000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x44, 0x0, &(0x7f0000000000)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x92000, 0x0) 28.857392802s ago: executing program 0 (id=150): r0 = socket$igmp6(0xa, 0x3, 0x3a) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x2409c8c1, &(0x7f00000009c0)={0xa, 0x4e20, 0x0, @private2}, 0x1c) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000080)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @remote, 0x4}, 0x1c) (async) setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000380)=0xffffffffffffffff, 0x4) (async) writev(r2, &(0x7f0000000180)=[{&(0x7f0000000240)="c2", 0x1200}], 0x1) (async, rerun: 32) sendmmsg$inet6(r1, &(0x7f0000000f80)=[{{&(0x7f0000000100)={0xa, 0x4e23, 0x291, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8}, 0x1c, &(0x7f00000007c0)=[{&(0x7f0000000440)="63652b4c67915a528150d5fd53225c9b9fc3394361c9908623ce5dc96a598da577ed0564e63f0b246b8a0dc89cf7a8dba90957b6cc4caee55a4ebce82e83f82c3b116766d90fef534c3a27ed13d4631909a6542cb1080626a5b8b6743ac0fe824d7343cefb19a326d0ba03ddb0b8508ee887e67b17d18ac3d364b87e3079872451223ad96c504a63a667269d3787f5c5cf2b5a35dc4f2756b7de10bf859d4db838e782b2dbfcd6a33e343ae9d658c06842e6a7e8835dd09bad3d8dbe5660bc925838b0f10ff4800cc37a8b9b269f15b54b5aed", 0xd3}, {&(0x7f0000000280)="b5", 0x1}, {&(0x7f0000000700)="4a86ce86acb808c2362195b392baf0ab56ba52202659bcc978c55326a5d9c8286a5085f5f7ea9a037f95d913a67f4abc5b4f5d0637fe6702f076cf2a4197228627c861d27f15c22f16ee7cf0604b380e9f95cb4e13f71c4aea7e96e5613c206b376dff453275676848ccb2fa39ea207c634a4e16bf257bddd993246a815fe81de09fcdad7e049d947d1fab271bd6fd0e0e4fcbc364e3787344776cc8851d758d09999d", 0xa3}, {&(0x7f0000000580)="c4ac8e3be69bd685b1604f076e8a4e64a3e15a0625ff90be7766f3cc1d8f35f9a2053f74495e11a32433a96b2a7224ef749abb4c5ee1d4057fb81445ab2d93232a34005077db8789b237739860c2f190921aa5769b847bceeec76b27e1c055ab7b661d0fc23fa28c84b38cbe2141a6aa3093b9cc92", 0x75}, {&(0x7f0000001280)="dc9a92af538b98ad6498f195e21148935721aca71c1cbcdac0d4466e85f5fba66fc7cca3aa2c201f5f50545eabf3efcde81fc70e186bc3ea7ee8fb03a07302b5585f7d09964e360748350544f86e0ef0741787c1d36815e95b7738011aa0b7fff4e84ddd11633389ac35208a52093f6c7848b3cd3b816744328808836517935c7f4de6532d8f76f6e7acf5403370613e4a15a353bd81cf2c6099", 0x9a}], 0x5, &(0x7f0000000540)=ANY=[@ANYRES32=r1], 0xa0}}, {{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000340)="bef8dbb59f040c178441aece2c7e8923903d379c8a1168d3daf8fe24cccc1302", 0x20}, {&(0x7f0000000600)="c3f5696dc6d96f33c6bbae897be8f5ec32584fcbb9b6c11235612fc030ece7445dd94bbd04beb5992ab16739ed2345ed616a2d6d5d17f64efab5b7bf8a1ac5f57e3949cae4f82bb8ec64b8ff9a55f661f4e87a9d19e9ca759b7aeabdedd88be342a3b7a8035bfd3feaa4335223cdc4c21f37fdb82a58", 0x76}, {&(0x7f00000003c0)="97", 0x1}], 0x3, &(0x7f00000010c0)=ANY=[@ANYBLOB="140000000000000029000000430000000004000000000000780000000000000029000000390000003b0c000900000000fe8000000000000000000000000000aaff020000000000000000000000000001fe800000000000000000000000000032200100000000000000000000000000022001000000000000000000000000000000000000000000000000ffff64010100140000000000000029000000340000000300000000000000140000000000000029000000080000008c00000000000000b80000000000000029000000390000000000ffff6401010000000000000000000000000000000000fc01000000000000000000000000000000000000000000000000000000000000fe80000000000000000000000000002a00000000000000000000ffffac1414aafe8000000000000000000000000000ad0b010000000000000000000000000001fe80000000003e47cc926630b93b00bbfe8000000000000000000000000000bb2c325587ea82fb649166292afec85a6be16f07ccb3248388bef88518298058deacf42d5494f41d5614299000d8"], 0x178}}, {{&(0x7f0000000840)={0xa, 0x4e20, 0x8, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xfffffff8}, 0x1c, &(0x7f0000000980)=[{&(0x7f0000000880)="99c65a0c977e4297de2a21ba57e01234c975a17d4eedd67484398b37c87184f472a3bd23715ad119e9c4579381efd493956e0fb567a1a5464e373785476dc3a2d68b5124c7e87b378fdede9516306059f34a877fd4d6cae8c4f0b42c641866504f0add62eea2ba9ec588185aaaa462c7d4fa727adf0ee4fbabece7ef8dc902786108466813689f4128e098bcadf1522d9d1621310e5bdae8c776700bd1c6de67c133d5b6191b3841436848f51809fd9757fa3e5fb032e9ffebf603f4a4458405ff00469c3a745bd16e010d41b0378cd04ed792fb13c84edebf3ade8db27b619a24fe0ef8046e", 0xe6}], 0x1, &(0x7f0000000a40)=ANY=[@ANYBLOB="28000000000000002900000037000000810100000000000005020003000100010200000000000000280000000000000000000000000000ff6c0202f200000000ff0100000000012400000000000000290000003200000020010000000000000000000000000001000000000000000000", @ANYRES32=0x0, @ANYBLOB="000000001400000000000000290000004300"/28], 0x90}}, {{&(0x7f0000000b00)={0xa, 0x4e20, 0x3, @mcast2, 0xe1e1}, 0x1c, &(0x7f0000000f00)=[{&(0x7f0000000b40)="c02d38abc4c2373516324ecc22b3131c080e", 0x12}, {&(0x7f0000000b80)="e320f3e78f6d11866291c780d495c8714103cd754806d0ba02657d621ef61ff3f6ab43f9d0e4f4b9", 0x28}, {&(0x7f0000000bc0)="61ef3aeff6d07a12e57fa0c8749fc8750156265ecc910f0556c061340752f5702356c27cb9e90a722e5c52536ff7556a128da75df019f6d4438d77779e180578974a099eaea5d8e63e0b86071d6104aded273c2e5aa173bc8edebd1daf017430c240e9006f69809a7ed5a85400045b574bf0bcdc2bba1e6fdb0889312fbb2aab1f5288451aed26aa837bb76da16fc61ad0d3c987bb7237bac6f6e7872de81fe90c31acc7eae15bb322d63aa867eb8878d14b20e86cdfb141bbd2e85ee54a403ceb2ca353bc4ea3237fa3083a7d5de4248862aa87989b36bc6fa169163da6a785bfc5320652fafd0ab83e22ee015af526358f8afc6a16", 0xf6}, {&(0x7f0000000cc0)="adcd4d3e", 0x4}, {&(0x7f0000000d00)="09b342be076f2d3a21d865fa241946cf41e86e0ec5c1b93f029aac05e1dbf0177fdeb91401862fd58e6f1b0bd96a19ca6b96d1a28b9de4b55f154c", 0x3b}, {&(0x7f0000000d40)="6fb67359f5bac6905b1eb5db492469f146a28fb87c17f9898d9f5cae1757cdfbc9c6e1c3dd554993e2b724d6d4d627ac99cb2b019f9a3259686b9081c94c9985095a58918cf651868c8c71e94a3969bc8c7982b24e9b0e68cbe5e461086ae80309ea19dfcccdf644f309363369b9e64914e9", 0x72}, {&(0x7f0000000dc0)="b20acce9fb0e910fcb5df6a1cd092d9c165b56381340558a878513c48262d344a8c6f1303f0ec049043f2c9c98772194650d22fcbcaa7d0699dcd3f7680b65b534ee70c08162426e24a4b8ea37451f8835503e141f6df59b15a7e1a177d2c5f14eca4cc4b0880475b1aa7f2c07fd799433d1fdf6d0715166ceb8f4f7f92615d6e2f8227a1664fb", 0x87}, {&(0x7f0000000e80)="6a31999f015e43e38e6a5afe65e606e282efd1d56a78e9b171d354ee99cf031044e8a791c9a872e8749b731ffd778bf79571ca1c0722aae659993977860bdc281d1cbd22ed7e58833dcc96c7e3d53943eef01ce8ffef7d10475bcf19e861e9516e3423c48c51fc40e64f09f06a68", 0x6e}], 0x8}}], 0x4, 0x0) (async, rerun: 32) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) write$cgroup_int(r4, &(0x7f0000000240)=0x4, 0x12) (async, rerun: 64) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0x22, &(0x7f0000000000)={{0xa, 0x0, 0x105, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x10000}, {0xa, 0xfffe, 0xfffffffd, @loopback, 0x4}, 0x1000, {[0x9, 0x0, 0xfffffffe, 0xfffffef9, 0x0, 0x1, 0x2]}}, 0x5c) (async, rerun: 64) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x183180, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x28) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x101fa, 0x1, 0x2000, 0x1000, &(0x7f0000fff000/0x1000)=nil}) r8 = socket$netlink(0x10, 0x3, 0xe) (async) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1000, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) (async, rerun: 64) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x202200, 0x0) (rerun: 64) close(r10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) (async) ioctl$SIOCSIFHWADDR(r10, 0x8943, &(0x7f0000002280)={'pim6reg\x00'}) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000000000/0x3000)=nil, 0x3000}) ioctl$AUTOFS_IOC_CATATONIC(r1, 0x9362, 0x0) (async) sendmsg$netlink(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f00000001c0)=ANY=[@ANYRESHEX=0x0, @ANYRES32, @ANYBLOB="57043cbf13da6a07cf0dfb6d", @ANYRES32, @ANYBLOB='\n\x00;'], 0x2c}], 0x1, 0x0, 0x0, 0x1}, 0x1) (async) close_range(r5, 0xffffffffffffffff, 0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async, rerun: 32) copy_file_range(r7, &(0x7f0000000a00)=0x2, r11, &(0x7f00000006c0)=0xb, 0xfffffffffffffffd, 0x0) (rerun: 32) 28.837418553s ago: executing program 0 (id=151): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = epoll_create1(0x80000) r3 = fcntl$dupfd(r1, 0x406, r2) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000040)={0x40000000}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000001c0)={0x10000014}) close_range(r0, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) 28.797247037s ago: executing program 0 (id=152): ftruncate(0xffffffffffffffff, 0x398a0bdb) add_key$user(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xffffffffffffffff) prctl$PR_MCE_KILL(0x23, 0x3, 0x7fffffffeffe) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='cgroup.controllers\x00', 0x26e1, 0x0) close(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) ioctl$SIOCSIFHWADDR(r0, 0x8b0f, &(0x7f0000000000)={'wg1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) r1 = add_key$keyring(0x0, &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$read(0xb, r1, 0x0, 0x0) mount(0x0, 0x0, &(0x7f0000000080)='proc\x00', 0x189, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x260) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) syz_clone(0x102311, 0x0, 0x0, 0x0, 0x0, 0x0) mount$cgroup(0x0, &(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0), 0x800006, &(0x7f0000000340)={[{@release_agent={'release_agent', 0x3d, './cgroup'}}, {@release_agent={'release_agent', 0x3d, './cgroup'}}]}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1002, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000100)=0x40000000) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = syz_clone(0x3a2400, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0xff07, 0x0) syz_usb_connect$uac1(0x3, 0x82, &(0x7f0000000240)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x70, 0x3, 0x1, 0x7f, 0x190, 0x7, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x4, 0xff}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x8, 0xf8, 0x2, {0x7, 0x25, 0x1, 0x82}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0x11, 0x24, 0x2, 0x1, 0x1, 0x3, 0xff, 0x7f, "3cd8dd7d88f95b4e2c"}]}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0xc, 0x9, 0x0, {0x7, 0x25, 0x1, 0x80, 0x6, 0x6}}}}}}}]}}, 0x0) fchdir(r4) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r5 = syz_open_procfs(r3, &(0x7f0000019c40)='environ\x00') pread64(r5, 0x0, 0x0, 0x1000000000) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x3, 0x0) 28.040024868s ago: executing program 0 (id=160): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x9}) r1 = syz_open_dev$loop(&(0x7f0000000180), 0x9, 0x800) ioctl$LOOP_SET_CAPACITY(r1, 0x4c07) r2 = socket$netlink(0x10, 0x3, 0x14) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffc, 0x2ffffdff5}, 0xc) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000840)=ANY=[@ANYBLOB="00001e002110000000000000f58f0700000005000000000700610ba9b4634d270e00000000000000"], 0x28}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x13) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$uinput_user_dev(r5, &(0x7f0000000240)={'syz0\x00', {0x508, 0x7, 0x7, 0x1}, 0x4a, [0x5f11bec3, 0x3, 0x5, 0x40, 0x0, 0x3, 0x0, 0x7d, 0x80013, 0x5, 0x0, 0x6, 0x0, 0x0, 0x4000000, 0x2, 0x1a4, 0xfffff605, 0x3, 0x0, 0x46e9, 0x7ff, 0xe2b, 0x7, 0x681c1eb5, 0x11e, 0x0, 0x2, 0x0, 0xe9, 0x0, 0xffff, 0x9, 0x4, 0x0, 0x3, 0x0, 0x0, 0x5de82a4e, 0x0, 0x0, 0x20000, 0x4, 0xfffffffe, 0x1, 0x0, 0x8000, 0x7, 0x0, 0xe0, 0x3fd, 0x5, 0xfffffff7, 0x0, 0xf685, 0x0, 0x1ab9, 0x0, 0x2, 0x0, 0xfffffffb, 0x1c15d73a, 0x2], [0x0, 0x0, 0x0, 0x0, 0x4, 0x1, 0x8, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x5, 0x0, 0x61c5fb46, 0x10000, 0x0, 0x4, 0x10001, 0x75, 0x0, 0x4, 0x0, 0xd, 0x80000000, 0x0, 0x61c2, 0x9, 0x0, 0x9, 0x2, 0xff, 0x2, 0x10001, 0x3, 0x0, 0x7, 0xfffffffb, 0xffffff00, 0x0, 0x10, 0x0, 0x0, 0x0, 0x1, 0xffff, 0x9, 0x441238ca, 0x0, 0x0, 0x0, 0xfffffff9, 0x2, 0x7fffffff, 0x6, 0x9], [0x0, 0xc50, 0x3, 0x9f5, 0x0, 0xa02, 0x1c75, 0xf51, 0x6, 0x40, 0x0, 0x20, 0x20000, 0x0, 0x6, 0x0, 0x0, 0x0, 0x205, 0x5, 0xfffffffd, 0xc, 0x0, 0x200, 0xcc0, 0x401, 0x6, 0x6, 0x0, 0x0, 0xffffff7f, 0xe, 0x921, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x15960318, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x5, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0xfffffffe, 0x4, 0x0, 0x6574, 0x7, 0x0, 0xcd55, 0xfb], [0x0, 0x6, 0x0, 0x2, 0x1, 0xffffffff, 0x5, 0x200, 0xffffffff, 0xd63, 0x6, 0x0, 0x0, 0x0, 0xfffffffa, 0xfa3, 0x3ff, 0x8, 0x4, 0x0, 0xffffffff, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x194e, 0x0, 0xe793, 0x4ad, 0x0, 0x0, 0x80000001, 0x3, 0x0, 0x0, 0x101, 0x0, 0x1, 0x0, 0x40, 0x8000010, 0x0, 0x5, 0x0, 0x0, 0x7fff, 0x6, 0x800, 0x5, 0xd, 0x0, 0x40000000, 0x0, 0x4, 0x45d, 0x4, 0x0, 0xfff, 0xb2, 0xa, 0xb]}, 0x45c) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x12, r5, 0x0) futimesat(0xffffffffffffffff, 0x0, &(0x7f0000000080)={{0x0, 0x2710}, {0x0, 0x2710}}) r6 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000900)={0x41, 0x4}, 0x10) r7 = socket$tipc(0x1e, 0x2, 0x0) keyctl$join(0x1, 0x0) setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) r8 = socket$tipc(0x1e, 0x2, 0x0) r9 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) ioctl$BLKPG(r9, 0x1269, &(0x7f00000000c0)={0x3, 0x0, 0x98, &(0x7f0000000000)={0x0, 0x8000, 0x13}}) ioctl$BLKSECTGET(r9, 0x1267, &(0x7f0000000140)) setsockopt$TIPC_GROUP_JOIN(r8, 0x10f, 0x87, &(0x7f0000000100)={0x41, 0x0, 0x2}, 0x1be) sendmsg$tipc(r8, &(0x7f0000000180)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10, 0x0}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 27.840989745s ago: executing program 0 (id=161): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setrlimit(0x7, &(0x7f0000000400)) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80000, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000380)=ANY=[@ANYBLOB="0100000000000000000600"]) statx(r2, 0x0, 0x1000, 0x100, &(0x7f0000000100)) r6 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r7 = socket$netlink(0x10, 0x3, 0x0) writev(r7, &(0x7f00000003c0)=[{&(0x7f0000000240)="390000001300034700ab65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) writev(r7, &(0x7f00000001c0)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) r8 = socket$netlink(0x10, 0x3, 0x0) writev(r8, &(0x7f00000003c0)=[{&(0x7f0000000080)="200000001300034700bb65e1c3e4ffff01000000010000005600000025000000", 0x20}], 0x1) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4c504}, 0x0) mount_setattr(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x9800, &(0x7f0000001dc0)={0x0, 0x0, 0x100000}, 0x4a) userfaultfd(0x801) close_range(r0, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x60e}) ioctl$PPPIOCGFLAGS(r2, 0x8004745a, &(0x7f0000000200)) 27.812912567s ago: executing program 32 (id=161): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setrlimit(0x7, &(0x7f0000000400)) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80000, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000380)=ANY=[@ANYBLOB="0100000000000000000600"]) statx(r2, 0x0, 0x1000, 0x100, &(0x7f0000000100)) r6 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r7 = socket$netlink(0x10, 0x3, 0x0) writev(r7, &(0x7f00000003c0)=[{&(0x7f0000000240)="390000001300034700ab65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) writev(r7, &(0x7f00000001c0)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) r8 = socket$netlink(0x10, 0x3, 0x0) writev(r8, &(0x7f00000003c0)=[{&(0x7f0000000080)="200000001300034700bb65e1c3e4ffff01000000010000005600000025000000", 0x20}], 0x1) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4c504}, 0x0) mount_setattr(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x9800, &(0x7f0000001dc0)={0x0, 0x0, 0x100000}, 0x4a) userfaultfd(0x801) close_range(r0, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x60e}) ioctl$PPPIOCGFLAGS(r2, 0x8004745a, &(0x7f0000000200)) 1.71858973s ago: executing program 2 (id=586): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = userfaultfd(0x1) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) arch_prctl$ARCH_GET_XCOMP_SUPP(0x1021, &(0x7f0000000000)) ioctl$TIOCGICOUNT(r2, 0x545d, 0x0) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='io.stat\x00', 0x275a, 0x0) pidfd_getfd(r4, r5, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x3}) syz_io_uring_setup(0x719, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x304, 0x0, r5}, &(0x7f0000c57000), 0x0) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmmsg$inet(r6, &(0x7f0000005280)=[{{&(0x7f00000011c0)={0x2, 0x4e24, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000001640)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x5}}], 0x18}}], 0x1, 0x4008000) ioctl$UFFDIO_ZEROPAGE(r1, 0xc018aa06, &(0x7f0000000380)={{&(0x7f00007db000/0x2000)=nil, 0x2000}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000000, 0x8031, 0xffffffffffffffff, 0x0) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_buf(r7, 0x29, 0x1b, &(0x7f0000000100)="8684b94757eabab5369768b6c57c8b04f3ef434b", 0x14) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x8, 0x7ffc0002}]}) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x2c, r10, 0x1, 0x70bd2b, 0x0, {0x22}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}]}]}, 0x2c}}, 0x0) ptrace(0x10, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x30, 0x3, 0x1, 0x201, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x10, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}]}, @CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x808}]}]}, 0x30}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r8, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000340)={&(0x7f00000003c0)={0x48, 0x2, 0x3, 0x5, 0x0, 0x0, {0x3}, [@NFQA_CFG_PARAMS={0x9, 0x2, {0xaf11, 0x1}}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x10}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x2b, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x1}}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x9}]}, 0x48}}, 0x4844) ioctl$BINDER_GET_FROZEN_INFO(r0, 0xc00c620f, 0x0) 1.172094464s ago: executing program 4 (id=596): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) (async) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) (async) renameat2(0xffffffffffffff9c, &(0x7f0000000040)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file1/file2\x00', 0x1) (async) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in=@local, @in=@rand_addr=0x64010101, 0x4e22, 0xfffe, 0x0, 0x0, 0x2, 0x20}, {0x0, 0x0, 0x1, 0x0, 0xffffffffffff235b, 0x0, 0x9, 0x1000000}, {0x2000}, 0x0, 0x0, 0x1, 0x0, 0x2}, {{@in6=@ipv4={'\x00', '\xff\xff', @private=0x7}, 0x4d5, 0x6c}, 0x2, @in6=@loopback, 0x0, 0x2, 0x0, 0x6, 0xffdffffc, 0x1000000}}, 0xe8) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) (async) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89b0, &(0x7f0000000a40)={'ip6_vti0\x00', &(0x7f00000009c0)={'syztnl2\x00', 0x0, 0x2f, 0x5, 0x4, 0x8, 0x4a, @mcast1, @empty, 0x20, 0x1, 0xdfb, 0x7}}) syz_usb_connect(0x2, 0x47, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000a3233910daa658744d2d010203010902350001080010000904df0003080662ff0b050c0220000606030905071000020104070824"], 0x0) (async) syz_usb_connect(0x5, 0x2d, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201500285d5c2086004040031960154030109021b000100031003090458080119662194090586d7"], &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) (async) syz_open_dev$evdev(&(0x7f0000000340), 0x3f, 0x40) (async) close_range(r0, 0xffffffffffffffff, 0x0) 1.171483754s ago: executing program 4 (id=597): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1000000003}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x51, 0x0, &(0x7f0000000600)="8dcdbd6d42ccdb4d556e7c2df713f0976fa3babb5f759be053e97109c9075d28dd5945ae6cb4e4d7866fe0493fb5c9157fdee7247f8cbf6c4e75526dc08c3ae8609b8760a00535639755c0fd5010ceba2e"}) r2 = socket$tipc(0x1e, 0x2, 0x0) dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/238, 0xffffffbc, 0x2, 0x4}, @fda={0x66646185, 0x1, 0x0, 0x36}, @fda={0x66646185, 0x8, 0x0, 0x24}}, &(0x7f0000000000)={0x1, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0}) 1.118175268s ago: executing program 3 (id=598): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r3 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0) ioctl$ASHMEM_SET_SIZE(r3, 0x40087703, 0x5) (async) ioctl$ASHMEM_SET_SIZE(r3, 0x40087703, 0x5) lseek(r3, 0x7a3a, 0x3) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x24) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) (async) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r7 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f0000000540)=[@code={0xa, 0x85, {"420f01cb650f01c2440f32b9800000c00f3235002000000f3067643e263e440f0de348b800800000000000000f23c00f21f83503000e000f23f8b933020000b800700000ba000000000f3066ba420066b80a0066efc7442400f2bee349c744240231c10000c7442406000000000f0114240f78ec"}}, @cpuid={0x14, 0x18, {0x9, 0xffffd569}}, @cpuid={0x14, 0x18, {0x8}}, @wrmsr={0x1e, 0x20, {0x60b, 0x2}}, @wrmsr={0x1e, 0x20, {0xa78, 0xba9c}}, @uexit={0x0, 0x18, 0x6}, @wr_crn={0x46, 0x20, {0x8, 0x7}}, @uexit={0x0, 0x18, 0x9}, @code={0xa, 0x6e, {"c481e1d92366460f388194a271a6b4e5c4418966ca66baf80cb8a8b6b082ef66bafc0c66b8ee0066efc4016958fb66b812000f00d8c4a1d971d1000f01cac744240000000100c7442402890c0000c7442406000000000f011424400f35"}}], 0x1b3}) ioctl$KVM_GET_STATS_FD_cpu(r7, 0xaece) syz_kvm_setup_cpu$x86(r4, r6, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000780)="66b9de0100000f32660f38828400589a79f507010f79f3ff664d6536643e64660f3adfab2029026766f30f090f216d0f78933c290f794673", 0x38}], 0x1, 0x7c, 0x0, 0x0) r8 = add_key$user(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)="9b", 0x1, 0xfffffffffffffffc) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) (async) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) (async) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="18000000", @ANYRES16=r10, @ANYBLOB="010b00000000010000000100000004000180"], 0x18}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICADD(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r9, 0x0) keyctl$describe(0x6, r8, &(0x7f00000010c0)=""/69, 0x45) (async) keyctl$describe(0x6, r8, &(0x7f00000010c0)=""/69, 0x45) ioctl$KVM_GET_IRQCHIP(r4, 0xc208ae62, &(0x7f0000000300)={0x1, 0x0, @ioapic={0x8083004, 0x1, 0x6, 0xefe, 0x0, [{0x5f, 0x9, 0x7d, '\x00', 0x5}, {0x56, 0xc, 0xa, '\x00', 0x9}, {0x2, 0x3, 0x88, '\x00', 0x30}, {0x84, 0xfc, 0x0, '\x00', 0x4e}, {0x40, 0x5, 0x4, '\x00', 0x1}, {0x8, 0x1, 0x4, '\x00', 0x6c}, {0xc, 0x6, 0x10, '\x00', 0x6}, {0x1, 0x80, 0x3, '\x00', 0x9}, {0xa, 0xc3, 0xe, '\x00', 0x3e}, {0x3, 0xf, 0x7d, '\x00', 0x7}, {0x4, 0x5f, 0x4, '\x00', 0x80}, {0x8, 0x68, 0x7, '\x00', 0x40}, {0x7, 0xf, 0xfd, '\x00', 0x3}, {0x2, 0x3, 0x7, '\x00', 0x9}, {0x0, 0x4, 0x7f, '\x00', 0x3}, {0x4, 0x7f, 0x6, '\x00', 0x9}, {0xb, 0x9, 0x5, '\x00', 0x5}, {0x0, 0xa, 0xe, '\x00', 0xbd}, {0x4, 0x9, 0x9, '\x00', 0x60}, {0x4, 0xc3, 0x8, '\x00', 0x3}, {0xff, 0x5, 0xfa, '\x00', 0x8}, {0x5, 0x8, 0xd, '\x00', 0x7f}, {0x3, 0xc1, 0x4, '\x00', 0x2}, {0x8, 0x5, 0xd, '\x00', 0x4}]}}) (async) ioctl$KVM_GET_IRQCHIP(r4, 0xc208ae62, &(0x7f0000000300)={0x1, 0x0, @ioapic={0x8083004, 0x1, 0x6, 0xefe, 0x0, [{0x5f, 0x9, 0x7d, '\x00', 0x5}, {0x56, 0xc, 0xa, '\x00', 0x9}, {0x2, 0x3, 0x88, '\x00', 0x30}, {0x84, 0xfc, 0x0, '\x00', 0x4e}, {0x40, 0x5, 0x4, '\x00', 0x1}, {0x8, 0x1, 0x4, '\x00', 0x6c}, {0xc, 0x6, 0x10, '\x00', 0x6}, {0x1, 0x80, 0x3, '\x00', 0x9}, {0xa, 0xc3, 0xe, '\x00', 0x3e}, {0x3, 0xf, 0x7d, '\x00', 0x7}, {0x4, 0x5f, 0x4, '\x00', 0x80}, {0x8, 0x68, 0x7, '\x00', 0x40}, {0x7, 0xf, 0xfd, '\x00', 0x3}, {0x2, 0x3, 0x7, '\x00', 0x9}, {0x0, 0x4, 0x7f, '\x00', 0x3}, {0x4, 0x7f, 0x6, '\x00', 0x9}, {0xb, 0x9, 0x5, '\x00', 0x5}, {0x0, 0xa, 0xe, '\x00', 0xbd}, {0x4, 0x9, 0x9, '\x00', 0x60}, {0x4, 0xc3, 0x8, '\x00', 0x3}, {0xff, 0x5, 0xfa, '\x00', 0x8}, {0x5, 0x8, 0xd, '\x00', 0x7f}, {0x3, 0xc1, 0x4, '\x00', 0x2}, {0x8, 0x5, 0xd, '\x00', 0x4}]}}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r6, 0x4138ae84, &(0x7f00000001c0)={{0x80a0000, 0xeeee0000, 0x8, 0x9, 0xfb, 0xd2, 0x40, 0xca, 0x0, 0x2e, 0x19}, {0x5000, 0xeeee8000, 0x3, 0x0, 0x40, 0x5, 0x7d, 0x6, 0x5, 0x3, 0x3, 0xb5}, {0xeeef0000, 0xdddd0000, 0xe, 0x5, 0x1, 0x7, 0x0, 0x9, 0x1, 0xa7, 0x5, 0x81}, {0x6000, 0x100000, 0xa, 0x6, 0x2, 0x42, 0xb, 0xf8, 0xb, 0x7, 0xe, 0xf1}, {0xeeee0000, 0xd000, 0x3, 0x3, 0x15, 0x6, 0xab, 0x7f, 0x3, 0x83, 0xf7, 0x83}, {0x1000, 0x80a0000, 0xc, 0xa0, 0xb1, 0x8, 0x1, 0xa0, 0x80, 0xf, 0x1, 0x7}, {0x3000, 0x8000000, 0x4, 0x5, 0x7, 0x5, 0x7, 0x3, 0x5, 0x81, 0x1, 0x70}, {0x100000, 0x1000, 0xe, 0x5, 0xf, 0x7, 0x1, 0x34, 0x2, 0xc, 0xb0, 0x9}, {0xeeef0000, 0x30}, {0x10000, 0x7}, 0x80000031, 0x0, 0x8000000, 0x2024, 0x3, 0x0, 0x3000, [0x6800000000000000, 0x4, 0x5e, 0xff]}) close_range(r0, 0xffffffffffffffff, 0x0) 1.043484605s ago: executing program 4 (id=599): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) fgetxattr(r2, &(0x7f00000000c0)=@random={'security.', '\x00'}, &(0x7f00000001c0)=""/113, 0x71) (async) ioctl$KDSKBSENT(r2, 0x4b49, &(0x7f0000000380)={0xba, "58bf1a2fe3824e0ea679cb149bde668c0359be56f9240884e58b346c3c864c61548564e41d9a4d37fd4656aae4a63278300fe465e6039288b13036035d22bffeb41d84592c473a8e3b85d8df29714980b4c6483888d1ef36de1db771f986d9eab0a3dd0c6ec9566c8b0a3c8a80a731497aacb4522c1d3a7e0650d9b490fa6321c23558e517b0223a39ca513ec63c58447764d2d9ecd556020a7fd1e5005adb53c4840198f4b842427777a778d78e4dcdbc1e9a7e3497908b510fe52e65191397dce7ec7594386dc8e29c1fc79782f720916b292be12c421b558cad5192f91c8059ad7816c006aa0421ddff5e634750981716d4625608b49b981a24b009e30b32e6fd285446cc4ef3ad4e2ca5322ccc2e227027595df42fc9f700ee202f98395b9d77bf0dd5839c2a6ab0719ae257ed4e5df6c6c933a9cc0d33066481dc5eb9baa5c5ec4f241838ccea1e358887337f4ae9b69cff758bb3f05603cc39e2e4b36d5122cc1b3a7a7971e341aca3134299365827a6f578df4cfef38bcfba700525fd0fcec1caa5ee5fa5d0ae980f12fc93eec853b16aa4e6c5a77706db95635b2697be2a1fd19fc621b98b0c5ccb48a903e440e06fa405f315e7d86b6bfbf32c656db64682e01578e63b537ccdfeef8be552b6dab2b57d3e35d2647f12b5621655e94869f8d187f61c94fd1cb4e1620d2ebeaee4d542e5ac3cda11299a41f8410043"}) (async) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x7101}) (async) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000001c0)={'ipvlan1\x00', 0x400}) (async) socket(0x8000000010, 0x2, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), r3) (async) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$ifreq_SIOCGIFINDEX_wireguard(r5, 0x8933, &(0x7f0000000340)={'wg0\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="78030000", @ANYRES16=r4, @ANYBLOB="37040000000000000000010000005c03088030000080060005000000000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39223400008004000980060005000080000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922f4020080cc02098034000080060001000200000008000200ac1414aa0500030003000000060001000200000008000200640101010500030000000000a0000080060001000a00000014000200000000000000000000000000000000000500030003000000060001000a00000014000200000000000000000000000000000000010500030001000000060001000200000008000200ac1414bb0500030002000000060001000200000008000200e00000010500030000000000060001000a00000014000200fe80000000000000000000000000003305000300020000001c000080060001000200000008000200ac1414bb050003000200000028000080060001000a00000014000200fc000000000000000000000000000001050003000000000034000080060001000200000008000200ac1414bb0500030003000000060001000200000008000204e0000002050003000000000088000080060001000a00000014000200ff0100000000000000000000000000010500030003000000060001000a00000014000200fe80000000000000000000000000002e0500030003000000060001000a00000014000200fe8000000000000000000000000000aa0500030001000000060001000200000008000200e00000020500030001000000f4000080060001000a00000014000200fe80000000000000000000000000002f0500030003000000060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200e00000010500030001000000060001000a00000014000200200100000000000000000000000000010500030001000000060001000200000008000200ac1414300500030000000000060001000200000008000200ac1e00010500030002000000060001000200000008000200000000000500030003000000060001000a00000014000200fc010000000000000000000000000000050003000200000024000100000000000000000000000000000000000000000000000000000000000000000008000100", @ANYRES32=r6], 0x378}}, 0x0) (async) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETQUEUE(r7, 0x400454d9, &(0x7f0000000200)={'caif0\x00', 0x400}) (async) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r8) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000000000)={'ip6erspan0\x00'}) ioctl$SIOCSIFHWADDR(r8, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) (async) setresgid(0xee00, 0xee01, 0x0) mount(&(0x7f0000000300), &(0x7f0000000080)='.\x00', &(0x7f0000000180)='tmpfs\x00', 0x2800408, 0x0) (async) r9 = syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') read$FUSE(r9, &(0x7f0000003800)={0x2020}, 0x2020) 1.041629185s ago: executing program 4 (id=601): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) (async) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) r2 = add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000100)={'fscrypt:', @desc2}, &(0x7f0000000140)={0x0, "7af9c2add30c3b0d788d9a94b0731ab8d4a8502c36822594c41a3a588f9ea10f4ea91dff6ece7b715bd30d75c5da8c5c4dada466bf73ee60295d1d133135d5c7", 0x14}, 0x48, 0xfffffffffffffffe) add_key$fscrypt_provisioning(&(0x7f0000000000), 0x0, 0x0, 0x0, r2) (async) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) r4 = socket$inet6_udp(0xa, 0x2, 0x0) r5 = fsopen(&(0x7f0000000200)='debugfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000240)='uid', &(0x7f00000008c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) (async) r6 = socket$pppl2tp(0x18, 0x1, 0x1) (async, rerun: 32) connect$inet6(r4, &(0x7f00000002c0)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) (rerun: 32) connect$pppl2tp(r6, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x6, @private0}}}, 0x3a) (async, rerun: 32) r7 = socket$pppl2tp(0x18, 0x1, 0x1) (rerun: 32) connect$pppl2tp(r7, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}, 0x1, 0x1}}, 0x2e) ioctl$KVM_X86_SET_MSR_FILTER(r3, 0x4188aec6, &(0x7f0000000a40)={0x1, [{0x6, 0x0, 0x129, 0x0}, {0x1, 0x0, 0x2, 0x0}, {0x2, 0x0, 0x800, 0x0}, {0x1, 0x0, 0x180000, 0x0}, {0x1, 0x0, 0x3cb0, 0x0}, {0x3, 0x0, 0x3fe, 0x0}, {0x1, 0x0, 0x4e00000, 0x0}, {0x2, 0x0, 0x8, 0x0}, {0x2, 0x0, 0x7ffffffe, 0x0}, {0x1, 0x0, 0x3, 0x0}, {0x2, 0x0, 0x9, 0x0}, {0x3, 0x0, 0x3, 0x0}, {0x1, 0x0, 0x200000, 0x0}, {0x1, 0x0, 0x80000002, 0x0}, {0x0, 0x0, 0x2, 0x0}, {0x1, 0x0, 0x8001, 0x0}]}) (async) close_range(r0, 0xffffffffffffffff, 0x0) 1.039048915s ago: executing program 4 (id=602): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000282000/0x400000)=nil) syz_kvm_add_vcpu$x86(r3, &(0x7f0000000140)={0x0, 0x0, 0x18}) syz_kvm_add_vcpu$x86(r3, &(0x7f0000000140)={0x0, 0x0}) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000002100), 0x280449c, &(0x7f0000002140)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}) write$FUSE_NOTIFY_DELETE(r4, &(0x7f0000000080)={0x2a, 0x6, 0x0, {0x1, 0x200000000004, 0x1, 0x2, '\x00', 0x8}}, 0x2a) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$UI_SET_KEYBIT(r5, 0x40045565, 0x1c5) close_range(r0, 0xffffffffffffffff, 0x0) 1.018712087s ago: executing program 3 (id=604): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000080)=ANY=[@ANYRESDEC=r0], 0x118) prctl$PR_SET_VMA(0x2a, 0x0, &(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r0, 0x0) mount$binderfs(0x0, &(0x7f0000000040)='./binderfs2\x00', 0x0, 0x0, &(0x7f0000000040)=ANY=[]) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) (async) write$UHID_CREATE2(r0, &(0x7f0000000080)=ANY=[@ANYRESDEC=r0], 0x118) (async) prctl$PR_SET_VMA(0x2a, 0x0, &(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r0, 0x0) (async) mount$binderfs(0x0, &(0x7f0000000040)='./binderfs2\x00', 0x0, 0x0, &(0x7f0000000040)=ANY=[]) (async) 967.077921ms ago: executing program 3 (id=606): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000440)={0x0, 0x57ee, 0x1}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000840)={r1, 0xaf0d, 0x8, 0x1}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x8, 0x0, &(0x7f0000000080)=[@acquire], 0x0, 0x0, 0x0}) 966.674231ms ago: executing program 3 (id=608): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x1}, 0x1c) (async) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) (async) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) (async) bind$inet6(r2, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) socket$unix(0x1, 0x2, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1000000003}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r3, 0x0) (async) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/238, 0xee, 0x2, 0x4}, @fda={0x66646185, 0x5, 0x0, 0x36}, @flat=@weak_handle={0x77682a85, 0x800}}, &(0x7f0000000000)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0}) 948.425723ms ago: executing program 3 (id=609): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x40a0ae49, &(0x7f0000000000)={0x0, 0xdddd0000}) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) personality(0x40000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r2, 0x45809000) syz_io_uring_setup(0x152c, &(0x7f0000002080)={0x0, 0xa0c3, 0x2, 0x2, 0x3d5}, 0x0, 0x0) syz_io_uring_setup(0xffffffff, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') ioctl$TFD_IOC_SET_TICKS(r3, 0x40085400, &(0x7f0000002100)) read$FUSE(r3, &(0x7f0000000040)={0x2020}, 0x2020) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000002140)={0x4, &(0x7f0000000000)=[{0x0, 0x0, 0x80, 0x2}, {0x28}, {0xb1, 0x0, 0x0, 0x1ff}, {0x6}]}) r4 = socket(0x10, 0x80002, 0x0) sendmsg(r4, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000040)="24000000180003041dfffd946f610500020100000005fe060c10880008000f00fff3c00e140000001a00ffffba16a0aa1c091dbfa1090000", 0x38}], 0x1}, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockname(r5, &(0x7f0000002640)=@can, &(0x7f00000026c0)=0x80) write$P9_RVERSION(r3, &(0x7f0000002180)={0x15, 0x65, 0xffff, 0x9, 0x8, '9P2000.L'}, 0x15) madvise(&(0x7f000026d000/0x2000)=nil, 0x2000, 0x16) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ioctl$F2FS_IOC_DEFRAGMENT(r2, 0xc010f508, &(0x7f0000000080)={0x4, 0xf}) 945.923543ms ago: executing program 4 (id=610): setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in=@local, @in=@rand_addr=0x64010101, 0x4e22, 0xfffe, 0x0, 0x0, 0x2, 0x20}, {0x0, 0x0, 0x2, 0x0, 0xffffffffffff235b, 0x0, 0x9, 0x1000000}, {}, 0x0, 0x0, 0x1, 0x0, 0x2}, {{@in6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x4d5, 0x6c}, 0x2, @in6=@loopback, 0x0, 0x2, 0x0, 0x0, 0xffdffffc, 0x1000000}}, 0xe8) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000002080)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0xf, &(0x7f0000000080)=0x4, 0x4) listen(r0, 0x3) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) syz_usb_connect(0x5, 0x2d, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201500285d5c2086004040031960154030109021b000100031003090458080119662194090586d7"], &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_open_dev$evdev(&(0x7f0000000340), 0x3f, 0x0) ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000000380)=""/235) close_range(r1, 0xffffffffffffffff, 0x0) 904.936006ms ago: executing program 2 (id=611): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x47f) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0x9, 0x1000006, 0xfffffff9}, 0x14) r2 = fsmount(r0, 0x0, 0x0) fchdir(r2) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x10) (async) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) (async) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, 0x0, 0x8, 0x0, 0x0, 0x0, {}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x88be}]}, 0x1c}}, 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./bus\x00', 0x42, 0x58) (async) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./bus\x00', r3, &(0x7f00000004c0)='./file0\x00', 0x2) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) readv(r4, &(0x7f00000003c0)=[{&(0x7f0000000040)=""/72, 0x48}, {0x0}], 0x2) 843.843201ms ago: executing program 2 (id=612): pipe(0x0) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r0, 0x0, 0x0) io_destroy(r0) io_pgetevents(r0, 0x2, 0x0, 0x0, 0x0, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167342, 0x0) readv(r1, &(0x7f0000000140)=[{&(0x7f0000001400)=""/4096, 0xfffffcd9}, {0x0, 0x2000}], 0x2) 831.207712ms ago: executing program 3 (id=613): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) ioperm(0x8, 0x1, 0x10001) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_GET_MSR_FEATURE_INDEX_LIST(r1, 0xc004ae0a, &(0x7f0000001880)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000200)=[@enter_looper], 0x50, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x60ae0}], 0x318, 0x0, 0xdb0, 0xf5ffffff}, 0x0) sendmsg$tipc(r3, &(0x7f0000000240)={0x0, 0x18, &(0x7f00000000c0), 0x31}, 0x0) sendmsg$inet(r2, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x80) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x68, 0x0, &(0x7f0000000380)=[@dead_binder_done, @exit_looper, @enter_looper, @clear_death={0x400c630f, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000500)={@ptr={0x70742a85, 0x1, &(0x7f0000000040)=""/97, 0x61, 0x0, 0x3c}, @flat=@handle={0x73682a85, 0xa, 0x3}, @fda={0x66646185, 0x1, 0x2, 0x1f}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}], 0xf7, 0x0, &(0x7f0000000400)="8b0b4c404981a6ef39f577efb9c2c64f47b576cec3dab5adbd25d802c31aa20f47283d909cfc1520a8ebb223d441539406505ea001848d180490b7a70bc561639b136ecae6c156d04957009916c1b24ba79c86ea06832ee972c31e6a0359b8b206c9498c06983956a604106001a616cb4d1c1bb6acb016cfecfc7ec3b0b2b9ad9ab9ad605bc7f30634cd84a3fa558165a23ef2774c87ec29f64cbf0b7d687933d9e1b3d23238f45fa89ff9f03aeed168cc4492998e962f5fc8d328b4204e969666ffdeb879c288373569757aa945c11bfc5a6d01cefde1031b79382c34c2da32f2058e7357c3d1fa5931bb923f0ebd396a976c32940686"}) r4 = openat(r3, &(0x7f00000001c0)='./file0\x00', 0x400000, 0x30) sendmsg$NFT_MSG_GETFLOWTABLE(r4, &(0x7f0000000680)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000340)={&(0x7f0000000600)={0x80, 0x17, 0xa, 0x102, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}]}, 0x80}, 0x1, 0x0, 0x0, 0x40011}, 0x8000) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xc) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r6, &(0x7f0000000000)={0x1f, 0x4, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0xe) r7 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') madvise(&(0x7f000007f000/0x4000)=nil, 0x4000, 0x10) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r7, @ANYBLOB=',wfdno=', @ANYRESHEX=r5]) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x54, 0x0, &(0x7f0000000840)=[@request_death, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f00000007c0)={@fd={0x66642a85, 0x0, r2}, @flat=@handle={0x73682a85, 0x10b, 0x2}, @flat=@weak_handle={0x77682a85, 0xb, 0x1}}, &(0x7f0000000740)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 816.093773ms ago: executing program 2 (id=614): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)=0x20) openat(0xffffffffffffff9c, 0x0, 0x20842, 0x22) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)='./file1\x00') mount$binderfs(0x0, &(0x7f0000000080)='./binderfs\x00', 0x0, 0x2010860, &(0x7f00000000c0)=ANY=[@ANYBLOB="636f6e74657874c0"]) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)=0x20) (async) openat(0xffffffffffffff9c, 0x0, 0x20842, 0x22) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) (async) rename(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)='./file1\x00') (async) mount$binderfs(0x0, &(0x7f0000000080)='./binderfs\x00', 0x0, 0x2010860, &(0x7f00000000c0)=ANY=[@ANYBLOB="636f6e74657874c0"]) (async) 754.177718ms ago: executing program 2 (id=615): timer_create(0xfffffffc, 0x0, &(0x7f0000000040)=0x0) timer_settime(r0, 0x1, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000540)={0x2c, &(0x7f00000002c0)={0x0, 0x24, 0x2, {0x2, 0x10}}, 0x0, 0x0, 0x0, 0x0}, 0x0) timer_gettime(r0, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x50, 0x0, &(0x7f0000000580)="c6547e22bade76f1a03b79e954ee20b943f7fe47218a02ff8ba942478a7b6946e9a6000055002cc15e854564e7d309f20d222f9220c8d9b1b0d196137252587ab1794808000000000000000e647c2e70"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000180)={@flat=@weak_binder={0x77622a85, 0x10a, 0x3}, @flat=@weak_binder={0x77622a85, 0x100a, 0x3}, @flat=@weak_binder={0x77622a85, 0x100, 0x3}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) timer_create(0xfffffffc, 0x0, &(0x7f0000000040)) (async) timer_settime(r0, 0x1, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) (async) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) (async) syz_usb_control_io(r1, 0x0, 0x0) (async) syz_usb_control_io(r1, 0x0, 0x0) (async) syz_usb_control_io(r1, 0x0, 0x0) (async) syz_usb_control_io$hid(r1, 0x0, 0x0) (async) syz_usb_control_io(r1, &(0x7f0000000540)={0x2c, &(0x7f00000002c0)={0x0, 0x24, 0x2, {0x2, 0x10}}, 0x0, 0x0, 0x0, 0x0}, 0x0) (async) timer_gettime(r0, &(0x7f0000000100)) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x50, 0x0, &(0x7f0000000580)="c6547e22bade76f1a03b79e954ee20b943f7fe47218a02ff8ba942478a7b6946e9a6000055002cc15e854564e7d309f20d222f9220c8d9b1b0d196137252587ab1794808000000000000000e647c2e70"}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000180)={@flat=@weak_binder={0x77622a85, 0x10a, 0x3}, @flat=@weak_binder={0x77622a85, 0x100a, 0x3}, @flat=@weak_binder={0x77622a85, 0x100, 0x3}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) (async) 738.294029ms ago: executing program 2 (id=616): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffa) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x1, 0x12, r0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x40543, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f00000007c0)='\x00\x00\x03\x06\x00\x00\x00\x1f\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\x87\xa3\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Hd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xd5\b^[D~\x00\x00\x00\x00\x00\x00\x00') setuid(0xee00) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000100)={0x0, {0x2, 0x4c24, @broadcast}, {0x2, 0x4e21, @empty}, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x33}}, 0x187, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd2ff, 0x45, 0xd6}) ioctl$ASHMEM_SET_NAME(r0, 0x40087707, &(0x7f0000000080)='\x00\x00\x03\x06\x00\x00\x00\x05\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83\x1b\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x1d\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xf0:\xfd$\xad\xbb\x9a|c\xfc\"\xee\xc4\x93Q\x82\x16\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbzE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\x02\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x02\x16\xf5\xe6\x7f\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Xd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\x18g8j\x0eT\xbe\xa1\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35\xef\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84x\x00\x00X\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xd5\b^[D~~\x84\\\xe4\x00\xfel\xf1\xc8\x0f8\xdb%W\x87\xd0\xbc\xbf\x97\xa9\x97\v\xbe%\x81\xbf[\x05\x9d\xed\'\"( \x15\x8bA\x19\xa8\xbcF%\x17#[\xbb\x99U\x92\'\xb6\xbe6\x8f\xc9%\xd9\xce\x91r\xfch\xf5\xf5*h\x1e\x0e\xbcD\xc4\xb9\x93e\x84\xb11\xae\xb8\x06\x81\x96g\x17h\a\x02\xfe\xa0\x1a\xfd\xb3e8\xa5\xd0\xb1\xa1\x8c\xd2\x9f\xd3\xc3?\xb6\x0e\xfe\x1f\x1bG31\xf9J\xf4\x85\xa9L\x1b\x18\x01A\x18\xae\xc9B\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfe\xb9\xc2\xdd\x9d\x8d5B\xaf\xe2\xf3\t\x97_uaJ|z\xec\x11\xb6\xd2\"U?cH[\xe5\xcf\xe0b&^\xbd\x15\xaecx@`\xe8\x1c\xfe\x9e\x17L\xa0\xe2l\xfa\xf1 \t\x0fG\xcd\xc3\xbc\x96z\x0e\xe9w\xc9y\x11\xf31\x8cc\xe2\xcd+\n\xcb\x05\x7f*2\x1c\xde\xb5\xd53x\xbd\xe5\x157l\xf1\x15y^\xbf4\x05\x94\xda\xd9\x04\x1b\x1dP\x1d\xbb1\xc8<*\xfb\v\b\xaf \xae\xea\xa4\x8b\x18\xefc\x90[\xe4\x8a\x03\xe3\x9e\xb9]\x8a~z\x9e\xc7qLY\xa0\xce\xdd0\a\x19\xe3\xd6\xeeV\x93\b~{\\\xa4\xe1\xc7d\x9c\f\xed\a&m\a\x9f7\x03]C\xed\xb4\x80>?/3\xc2\x14r}\xe0\xdd\xab\xc8\xb1\xb3\xdbu\x86\xa6Xo\xc7\xf4\xcc\xdf\xb9\x92W\x02JL=F\xd6a\xef') 625.301159ms ago: executing program 33 (id=616): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffa) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x1, 0x12, r0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x40543, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f00000007c0)='\x00\x00\x03\x06\x00\x00\x00\x1f\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\x87\xa3\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Hd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xd5\b^[D~\x00\x00\x00\x00\x00\x00\x00') setuid(0xee00) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000100)={0x0, {0x2, 0x4c24, @broadcast}, {0x2, 0x4e21, @empty}, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x33}}, 0x187, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd2ff, 0x45, 0xd6}) ioctl$ASHMEM_SET_NAME(r0, 0x40087707, &(0x7f0000000080)='\x00\x00\x03\x06\x00\x00\x00\x05\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83\x1b\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x1d\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xf0:\xfd$\xad\xbb\x9a|c\xfc\"\xee\xc4\x93Q\x82\x16\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbzE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\x02\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x02\x16\xf5\xe6\x7f\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Xd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\x18g8j\x0eT\xbe\xa1\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35\xef\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84x\x00\x00X\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xd5\b^[D~~\x84\\\xe4\x00\xfel\xf1\xc8\x0f8\xdb%W\x87\xd0\xbc\xbf\x97\xa9\x97\v\xbe%\x81\xbf[\x05\x9d\xed\'\"( \x15\x8bA\x19\xa8\xbcF%\x17#[\xbb\x99U\x92\'\xb6\xbe6\x8f\xc9%\xd9\xce\x91r\xfch\xf5\xf5*h\x1e\x0e\xbcD\xc4\xb9\x93e\x84\xb11\xae\xb8\x06\x81\x96g\x17h\a\x02\xfe\xa0\x1a\xfd\xb3e8\xa5\xd0\xb1\xa1\x8c\xd2\x9f\xd3\xc3?\xb6\x0e\xfe\x1f\x1bG31\xf9J\xf4\x85\xa9L\x1b\x18\x01A\x18\xae\xc9B\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfe\xb9\xc2\xdd\x9d\x8d5B\xaf\xe2\xf3\t\x97_uaJ|z\xec\x11\xb6\xd2\"U?cH[\xe5\xcf\xe0b&^\xbd\x15\xaecx@`\xe8\x1c\xfe\x9e\x17L\xa0\xe2l\xfa\xf1 \t\x0fG\xcd\xc3\xbc\x96z\x0e\xe9w\xc9y\x11\xf31\x8cc\xe2\xcd+\n\xcb\x05\x7f*2\x1c\xde\xb5\xd53x\xbd\xe5\x157l\xf1\x15y^\xbf4\x05\x94\xda\xd9\x04\x1b\x1dP\x1d\xbb1\xc8<*\xfb\v\b\xaf \xae\xea\xa4\x8b\x18\xefc\x90[\xe4\x8a\x03\xe3\x9e\xb9]\x8a~z\x9e\xc7qLY\xa0\xce\xdd0\a\x19\xe3\xd6\xeeV\x93\b~{\\\xa4\xe1\xc7d\x9c\f\xed\a&m\a\x9f7\x03]C\xed\xb4\x80>?/3\xc2\x14r}\xe0\xdd\xab\xc8\xb1\xb3\xdbu\x86\xa6Xo\xc7\xf4\xcc\xdf\xb9\x92W\x02JL=F\xd6a\xef') 133.614089ms ago: executing program 1 (id=621): setresgid(0xffffffffffffffff, 0xee01, 0x0) r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$netlink(r0, &(0x7f0000000bc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x400c810) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x800) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x800, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') prctl$PR_MCE_KILL(0x35, 0x1, 0x8) prctl$PR_MCE_KILL(0x35, 0x1, 0x2) read$FUSE(r1, &(0x7f00000029c0)={0x2020}, 0x2020) 111.058171ms ago: executing program 1 (id=622): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000380)=ANY=[@ANYBLOB="010000000000000073fa004000000000b7"]) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000840)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000380), 0x12) r4 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000580), 0x12) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000380)=ANY=[@ANYBLOB="0100000000000000b00000"]) listen(r0, 0x401) ioctl$BLKRAGET(r0, 0x1263, &(0x7f0000000080)) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$F2FS_IOC_COMPRESS_FILE(r7, 0xf518, 0x0) ioctl$BINDER_GET_EXTENDED_ERROR(r0, 0xc00c6211, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000004c0)={0x14, 0x0, &(0x7f0000000500)=[@increfs_done={0x40106308, 0x1}], 0x0, 0x0, 0x0}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), r1) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r8, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r9, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x1ff}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x40000) 52.044826ms ago: executing program 1 (id=623): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0xc0802, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) mkdirat(r1, &(0x7f0000000040)='./file0\x00', 0x12) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='debugfs\x00', 0x0, 0x0) r2 = inotify_init1(0x0) inotify_add_watch(r2, &(0x7f00000000c0)='./file0\x00', 0x60004ce) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x141800, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40085507, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 51.830376ms ago: executing program 1 (id=624): r0 = fsopen(&(0x7f0000000100)='vfat\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x2, &(0x7f0000000040)='utf8', &(0x7f0000000080)="a6c5", 0x2) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) fcntl$lock(r1, 0x25, &(0x7f0000000040)={0x0, 0x1, 0xf, 0xfff}) close_range(r1, 0xffffffffffffffff, 0x0) 50.952136ms ago: executing program 5 (id=617): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x4c, 0x0, &(0x7f0000000180)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x10a) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000, 0x1) sendto(r1, 0x0, 0x0, 0x800, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x44, &(0x7f0000000000)={0x0, 0x0}, 0x10) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)}) mount$incfs(&(0x7f0000000580)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f00000005c0), 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8c) r3 = openat$incfs(r2, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) getsockopt$MRT(r2, 0x0, 0xce, &(0x7f0000000400), &(0x7f0000000440)=0x4) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000780)={{{@in=@multicast2, @in=@local}}, {{@in=@multicast1}, 0x0, @in=@dev}}, &(0x7f0000000380)=0xe8) execve(&(0x7f0000000480)='./file1\x00', &(0x7f0000000600)={[&(0x7f00000004c0)='[$^\x00', &(0x7f0000000500)='incremental-fs\x00', &(0x7f0000000540)='}\xac](.:$/.{\x00']}, &(0x7f0000000700)={[&(0x7f0000000740)='\')-\x00', &(0x7f0000000680)='w\xf5Y\x14Y\xb5\xb8', &(0x7f00000006c0)='incremental-fs\x00']}) r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x24020000) ppoll(&(0x7f0000000040)=[{r0, 0xc4}, {r5, 0x8000}, {r3, 0x404}, {r0, 0x451}, {r2, 0x18}], 0x5, 0x0, 0x0, 0x0) 50.497026ms ago: executing program 1 (id=625): r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) fcntl$getflags(r0, 0xb) (async, rerun: 64) fchdir(r0) (async, rerun: 64) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') (async) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x8401, 0x0) (async, rerun: 64) r2 = syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), 0xffffffffffffffff) (rerun: 64) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r1, &(0x7f0000000440)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000400)={&(0x7f0000000240)={0x190, r2, 0x200, 0x9, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x9}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0xf7}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0xb0e0}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0xfffffff8}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x800}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x7}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0xe}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x80000000}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x10001}}]}, 0x190}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) (async) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$USBDEVFS_CLAIM_PORT(r3, 0x80045518, &(0x7f00000000c0)=0x3) mount(&(0x7f0000000000), &(0x7f0000000040)='./cgroup\x00', 0x0, 0x1001, 0x0) unshare(0x2c020400) (async) fchdir(0xffffffffffffffff) (async) syz_usb_connect(0x0, 0x56, 0x0, 0x0) (async) syz_open_dev$usbfs(&(0x7f0000000480), 0x73, 0x141641) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') read$FUSE(r4, &(0x7f00000005c0)={0x2020}, 0x2020) 3.14419ms ago: executing program 1 (id=626): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0) (async) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/profiling', 0x0, 0x0) read$FUSE(r1, &(0x7f0000001100)={0x2020}, 0x2020) (async) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x10001) (async) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000002c0)='/devFtR\xac\x13\x1e\x14e\x81h\xa3K\xd6\xd0^\xed\xd7\xb3\xac\xa0&&\xf8\x0f|\xe8\x15\xf2\x82\xb4\xa0\xc2\x01e\x1e\xf4\x19\x06\x03\xf5+\xc4\r\xa1\xb8DY-\x17\x0f\xf7\x8d\x7f\x9473\x1f\xc5!\xb2\x1bs\xfc\x91~c\xd1*en\xd1\xfc\t\x9c\xda\xfd\xde\xc0\xa2\xf4\x15\xf1\xd9\xe0\xe2\xf3^R\x8d\xae\x8d\x87Fc\a\xe6_\xd0V\'B?\x8b\xa6\x9cIT\x1f\x93\x8b\xfd\x814dX\x93\x89\x1a_45\x94y(\xb9\xaa\x91\xa5\xe8n\xe6\xb58.\xc4\ntJ\x11\f\xb8\x18\xfe\xb2\x93\x93\xe6\x82\\\xe8]fV\xc0#\x1c\xbf\xd1T\x809/\xc3\xa3\x17\xc4\x0e\xdby\xd6\xff\xfb\xbe\x83\xf7$\xf7\xc4\x16\xee\xa0Tn\t\x0f,|\r\xc3\xb39A\xc2wF\xb9l\'_\x89B\xf8z\xe6\xc13\x9d~\xd5\xc6\xae8\a\xa1\x90\f)M4J\xaf\x010;\xc7\xfd\xe7\x95\xfb\x95\xd6N\v\xf9\xe1=3\xe7\x8a\xc8\xca\xf12\x1aJ\xd6Xj4\x1a\x88\x04\xb1DJ\xce\x95\xdb\xd2\xab\xd6\xeb\xc6\xc6v\xd0#x@\x96\xbf\xa4E\x11\x9dH$+\xadS&\xa6\xcd>\xa2<\xe2\xa7\xa3\x99\n7c\xc5\xbb\xc2\xb9\xa3k\xaa\x9e\xe9\xb4\xd4\xbc\xda') (async) mmap(&(0x7f0000018000/0x4000)=nil, 0x4000, 0xa8ca3411d1c26001, 0x13, r0, 0xd3c59000) 0s ago: executing program 5 (id=627): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x1c, 0x2, 0x3, 0x5, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r4, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0) r5 = socket$nl_audit(0x10, 0x3, 0x9) fstat(r5, &(0x7f0000001bc0)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(r6, r6) sendmmsg$inet(r4, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000006c0)="ed", 0x1}], 0xef}}, {{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000580)="f1", 0x1}], 0x1}, 0x70040000}, {{0x0, 0x0, 0x0}}], 0x3, 0x4048841) ioctl$TIOCSIG(r3, 0x40045436, 0x41) sendmsg$NFQNL_MSG_VERDICT_BATCH(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)={0x14, 0x3, 0x3, 0x101}, 0x14}, 0x1, 0x0, 0x0, 0xc0045}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.214' (ED25519) to the list of known hosts. [ 23.817675][ T36] audit: type=1400 audit(1756505393.980:64): avc: denied { mounton } for pid=281 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.819711][ T281] cgroup: Unknown subsys name 'net' [ 23.840375][ T36] audit: type=1400 audit(1756505393.980:65): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.867819][ T36] audit: type=1400 audit(1756505394.010:66): avc: denied { unmount } for pid=281 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.867886][ T281] cgroup: Unknown subsys name 'devices' [ 24.008557][ T281] cgroup: Unknown subsys name 'hugetlb' [ 24.014203][ T281] cgroup: Unknown subsys name 'rlimit' [ 24.190017][ T36] audit: type=1400 audit(1756505394.350:67): avc: denied { setattr } for pid=281 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.213435][ T36] audit: type=1400 audit(1756505394.350:68): avc: denied { mounton } for pid=281 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 24.238436][ T36] audit: type=1400 audit(1756505394.350:69): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 24.249942][ T283] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 24.270456][ T36] audit: type=1400 audit(1756505394.430:70): avc: denied { relabelto } for pid=283 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.296102][ T36] audit: type=1400 audit(1756505394.430:71): avc: denied { write } for pid=283 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.343491][ T36] audit: type=1400 audit(1756505394.510:72): avc: denied { read } for pid=281 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.369315][ T36] audit: type=1400 audit(1756505394.510:73): avc: denied { open } for pid=281 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.369432][ T281] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.253935][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.261104][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.268633][ T289] bridge_slave_0: entered allmulticast mode [ 25.274955][ T289] bridge_slave_0: entered promiscuous mode [ 25.281716][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.288885][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.296021][ T289] bridge_slave_1: entered allmulticast mode [ 25.302265][ T289] bridge_slave_1: entered promiscuous mode [ 25.335581][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.342829][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.350121][ T288] bridge_slave_0: entered allmulticast mode [ 25.356477][ T288] bridge_slave_0: entered promiscuous mode [ 25.368912][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.376007][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.383116][ T288] bridge_slave_1: entered allmulticast mode [ 25.389612][ T288] bridge_slave_1: entered promiscuous mode [ 25.414061][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.421236][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.428465][ T290] bridge_slave_0: entered allmulticast mode [ 25.434713][ T290] bridge_slave_0: entered promiscuous mode [ 25.451553][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.458645][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.465870][ T290] bridge_slave_1: entered allmulticast mode [ 25.472195][ T290] bridge_slave_1: entered promiscuous mode [ 25.478442][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.485508][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.492875][ T291] bridge_slave_0: entered allmulticast mode [ 25.499300][ T291] bridge_slave_0: entered promiscuous mode [ 25.516394][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.523469][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.530727][ T291] bridge_slave_1: entered allmulticast mode [ 25.537124][ T291] bridge_slave_1: entered promiscuous mode [ 25.693818][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.700958][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.708326][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.715458][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.748311][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.755705][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.770427][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.777526][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.785680][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.792761][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.851626][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.858763][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.877886][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.884974][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.917191][ T289] veth0_vlan: entered promiscuous mode [ 25.928155][ T328] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.935339][ T328] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.943015][ T328] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.950084][ T328] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.975096][ T289] veth1_macvtap: entered promiscuous mode [ 25.982379][ T328] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.989480][ T328] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.001594][ T328] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.008707][ T328] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.045479][ T288] veth0_vlan: entered promiscuous mode [ 26.065063][ T290] veth0_vlan: entered promiscuous mode [ 26.077431][ T289] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 26.099967][ T288] veth1_macvtap: entered promiscuous mode [ 26.113819][ T290] veth1_macvtap: entered promiscuous mode [ 26.140185][ T291] veth0_vlan: entered promiscuous mode [ 26.187231][ T291] veth1_macvtap: entered promiscuous mode [ 26.234756][ T343] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 26.312453][ T351] rust_binder: Error while translating object. [ 26.312541][ T351] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 26.319442][ T351] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:2 [ 26.575902][ T45] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 26.595991][ T64] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.736965][ T45] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 26.745359][ T45] usb 3-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 26.754377][ T64] usb 2-1: Using ep0 maxpacket: 32 [ 26.759619][ T45] usb 3-1: config 220 has an invalid descriptor of length 9, skipping remainder of the config [ 26.770171][ T45] usb 3-1: config 220 has no interface number 2 [ 26.777094][ T45] usb 3-1: config 220 interface 1 altsetting 5 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 26.789461][ T45] usb 3-1: config 220 interface 1 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 12 [ 26.802676][ T45] usb 3-1: config 220 interface 0 has no altsetting 0 [ 26.810022][ T64] usb 2-1: config 0 has no interfaces? [ 26.815552][ T45] usb 3-1: config 220 interface 76 has no altsetting 0 [ 26.822499][ T45] usb 3-1: config 220 interface 1 has no altsetting 0 [ 26.830683][ T64] usb 2-1: New USB device found, idVendor=0cf3, idProduct=817a, bcdDevice=eb.19 [ 26.839962][ T64] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.848058][ T64] usb 2-1: Product: syz [ 26.852246][ T64] usb 2-1: Manufacturer: syz [ 26.857079][ T45] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 26.866573][ T64] usb 2-1: SerialNumber: syz [ 26.871590][ T45] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.879924][ T64] usb 2-1: config 0 descriptor?? [ 26.884983][ T45] usb 3-1: Product: syz [ 26.889281][ T45] usb 3-1: Manufacturer: syz [ 26.893996][ T45] usb 3-1: SerialNumber: syz [ 27.103911][ T45] usb 3-1: selecting invalid altsetting 0 [ 27.109894][ T45] usb 3-1: Found UVC 7.01 device syz (8086:0b07) [ 27.116506][ T45] usb 3-1: No valid video chain found. [ 27.125078][ T45] usb 3-1: USB disconnect, device number 2 [ 27.153336][ T365] rust_binder: Write failure EFAULT in pid:7 [ 27.202417][ T370] rust_binder: Write failure EFAULT in pid:11 [ 27.253998][ T64] usb 2-1: USB disconnect, device number 2 [ 27.438068][ T373] capability: warning: `syz.0.12' uses deprecated v2 capabilities in a way that may be insecure [ 27.855892][ T10] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 27.972529][ T387] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 28.005905][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 28.011867][ T393] netlink: 328 bytes leftover after parsing attributes in process `syz.1.19'. [ 28.023535][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 28.042773][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 28.058474][ T10] usb 3-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice= 0.00 [ 28.067786][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.077093][ T396] pim6reg1: entered promiscuous mode [ 28.077313][ T10] usb 3-1: config 0 descriptor?? [ 28.082430][ T396] pim6reg1: entered allmulticast mode [ 28.100165][ T401] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:29 [ 28.101337][ T401] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:29 [ 28.245914][ T330] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 28.405865][ T330] usb 1-1: Using ep0 maxpacket: 16 [ 28.411497][ T330] usb 1-1: too many configurations: 129, using maximum allowed: 8 [ 28.420738][ T330] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 28.428380][ T330] usb 1-1: can't read configurations, error -61 [ 28.491968][ T10] playstation 0003:054C:0DF2.0001: hidraw0: USB HID v0.09 Device [HID 054c:0df2] on usb-dummy_hcd.2-1/input0 [ 28.495924][ T45] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 28.556112][ T330] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 28.657334][ T45] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 28.670335][ T45] usb 4-1: New USB device found, idVendor=18b1, idProduct=0037, bcdDevice= 0.00 [ 28.679448][ T45] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.688298][ T45] usb 4-1: config 0 descriptor?? [ 28.692136][ T10] playstation 0003:054C:0DF2.0001: Invalid byte count transferred, expected 20 got 0 [ 28.703752][ T10] playstation 0003:054C:0DF2.0001: Failed to retrieve DualSense pairing info: -22 [ 28.713232][ T10] playstation 0003:054C:0DF2.0001: Failed to get MAC address from DualSense [ 28.722072][ T10] playstation 0003:054C:0DF2.0001: Failed to create dualsense. [ 28.729813][ T330] usb 1-1: Using ep0 maxpacket: 16 [ 28.735402][ T330] usb 1-1: too many configurations: 129, using maximum allowed: 8 [ 28.756232][ T10] playstation 0003:054C:0DF2.0001: probe with driver playstation failed with error -22 [ 28.768678][ T330] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 28.776723][ T330] usb 1-1: can't read configurations, error -61 [ 28.783174][ T330] usb usb1-port1: attempt power cycle [ 28.892474][ T375] binder: Unknown parameter 'smackfsfloor' [ 28.898718][ T407] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 28.907421][ T375] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.916497][ T375] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.930438][ T10] usb 3-1: USB disconnect, device number 3 [ 28.962415][ T418] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION freeze notification not active [ 28.971327][ T418] rust_binder: Write failure EINVAL in pid:11 [ 28.988149][ T36] kauditd_printk_skb: 79 callbacks suppressed [ 28.988183][ T36] audit: type=1400 audit(1756505399.150:153): avc: denied { watch watch_reads } for pid=419 comm="syz.2.27" path="/4" dev="tmpfs" ino=33 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 29.022838][ T36] audit: type=1400 audit(1756505399.150:154): avc: denied { remount } for pid=419 comm="syz.2.27" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 29.052146][ T422] fuse: Bad value for 'fd' [ 29.066991][ T407] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 29.078322][ T407] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 29.087754][ T407] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.095795][ T407] usb 2-1: Product: syz [ 29.101021][ T407] usb 2-1: Manufacturer: syz [ 29.104590][ T45] petalynx 0003:18B1:0037.0002: unknown main item tag 0x0 [ 29.105657][ T407] usb 2-1: SerialNumber: syz [ 29.107356][ T407] usb 2-1: config 0 descriptor?? [ 29.115897][ T45] petalynx 0003:18B1:0037.0002: item fetching failed at offset 3/5 [ 29.125971][ T330] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 29.130928][ T45] petalynx 0003:18B1:0037.0002: parse failed [ 29.144323][ T45] petalynx 0003:18B1:0037.0002: probe with driver petalynx failed with error -22 [ 29.157784][ T330] usb 1-1: Using ep0 maxpacket: 16 [ 29.163297][ T330] usb 1-1: too many configurations: 129, using maximum allowed: 8 [ 29.172263][ T330] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 29.180067][ T330] usb 1-1: can't read configurations, error -61 [ 29.215843][ T429] netlink: 176 bytes leftover after parsing attributes in process `syz.2.29'. [ 29.237704][ T36] audit: type=1400 audit(1756505399.400:155): avc: denied { create } for pid=426 comm="syz.2.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 29.315927][ T330] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 29.323535][ T36] audit: type=1400 audit(1756505399.480:156): avc: denied { create } for pid=405 comm="syz.3.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 29.344778][ T36] audit: type=1400 audit(1756505399.480:157): avc: denied { write } for pid=405 comm="syz.3.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 29.365901][ T330] usb 1-1: Using ep0 maxpacket: 16 [ 29.371693][ T330] usb 1-1: too many configurations: 129, using maximum allowed: 8 [ 29.380950][ T407] usb 2-1: USB disconnect, device number 3 [ 29.387252][ T330] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 29.395953][ T330] usb 1-1: can't read configurations, error -61 [ 29.402457][ T330] usb usb1-port1: unable to enumerate USB device [ 29.412277][ T353] udevd[353]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 29.853262][ T36] audit: type=1400 audit(1756505400.010:158): avc: denied { bind } for pid=436 comm="syz.1.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 29.873752][ T36] audit: type=1400 audit(1756505400.030:159): avc: denied { mounton } for pid=436 comm="syz.1.30" path="/syzcgroup/unified/syz1" dev="cgroup2" ino=29 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 29.874045][ T437] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem [ 29.921350][ T36] audit: type=1400 audit(1756505400.080:160): avc: denied { map } for pid=438 comm="syz.1.31" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 29.944427][ T36] audit: type=1400 audit(1756505400.080:161): avc: denied { execute } for pid=438 comm="syz.1.31" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 29.972741][ T36] audit: type=1400 audit(1756505400.130:162): avc: denied { read } for pid=438 comm="syz.1.31" dev="nsfs" ino=4026532300 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 29.973207][ T439] SELinux: Context system_u:object_r:fsadm_exec_t:s0 is not valid (left unmapped). [ 30.655881][ T330] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 30.805864][ T330] usb 2-1: Using ep0 maxpacket: 32 [ 30.812696][ T330] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 30.821022][ T330] usb 2-1: config 0 has no interface number 0 [ 30.827179][ T330] usb 2-1: config 0 interface 184 has no altsetting 0 [ 30.835331][ T330] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 30.844518][ T330] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.852578][ T330] usb 2-1: Product: syz [ 30.857192][ T330] usb 2-1: Manufacturer: syz [ 30.861809][ T330] usb 2-1: SerialNumber: syz [ 30.867323][ T330] usb 2-1: config 0 descriptor?? [ 30.874248][ T330] smsc75xx v1.0.0 [ 31.241923][ T488] netlink: 25 bytes leftover after parsing attributes in process `syz.2.44'. [ 31.249738][ T45] usb 4-1: USB disconnect, device number 2 [ 31.306284][ T496] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 31.314801][ T496] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 31.324206][ T497] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 31.353553][ T496] rust_binder: Error in use_page_slow: ESRCH [ 31.360107][ T496] rust_binder: use_range failure ESRCH [ 31.366228][ T496] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 31.371754][ T496] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 31.379808][ T496] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:24 [ 31.416085][ T407] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 31.576231][ T407] usb 1-1: Using ep0 maxpacket: 16 [ 31.582709][ T407] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 31.593097][ T407] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 31.602313][ T407] usb 1-1: config 1 interface 1 altsetting 4 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 31.615303][ T407] usb 1-1: config 1 interface 1 has no altsetting 0 [ 31.615900][ T45] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 31.623549][ T407] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 31.638871][ T407] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.647057][ T407] usb 1-1: Product: и [ 31.651197][ T407] usb 1-1: Manufacturer: ÐŒ [ 31.655735][ T407] usb 1-1: SerialNumber: á [ 31.755920][ T45] usb 4-1: device descriptor read/64, error -71 [ 31.873827][ T407] usb 1-1: 0:2 : does not exist [ 31.893591][ T505] capability: warning: `syz.0.49' uses 32-bit capabilities (legacy support in use) [ 31.896487][ T407] usb 1-1: USB disconnect, device number 6 [ 31.922916][ T353] udevd[353]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 31.995913][ T45] usb 4-1: device descriptor read/64, error -71 [ 32.104427][ T522] netlink: 'syz.0.55': attribute type 11 has an invalid length. [ 32.246545][ T45] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 32.376150][ T45] usb 4-1: device descriptor read/64, error -71 [ 32.615931][ T45] usb 4-1: device descriptor read/64, error -71 [ 32.725989][ T45] usb usb4-port1: attempt power cycle [ 33.002928][ T547] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 33.054387][ T548] rust_binder: 547 RLIMIT_NICE not set [ 33.065925][ T45] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 33.096967][ T45] usb 4-1: device descriptor read/8, error -71 [ 33.227028][ T45] usb 4-1: device descriptor read/8, error -71 [ 33.387758][ T330] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 33.398726][ T330] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 33.408472][ T330] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 33.418954][ T330] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -71 [ 33.430830][ T330] usb 2-1: USB disconnect, device number 4 [ 33.467315][ T45] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 33.496982][ T45] usb 4-1: device descriptor read/8, error -71 [ 33.565964][ T407] rust_binder: 546: removing orphan mapping 0:4240 [ 33.591118][ T559] binder: Unknown parameter '’´' [ 33.626996][ T45] usb 4-1: device descriptor read/8, error -71 [ 33.736132][ T45] usb usb4-port1: unable to enumerate USB device [ 33.875888][ T31] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 33.991117][ T565] netlink: 'syz.2.72': attribute type 16 has an invalid length. [ 34.027363][ T31] usb 1-1: Using ep0 maxpacket: 8 [ 34.036584][ T31] usb 1-1: unable to get BOS descriptor or descriptor too short [ 34.045210][ T31] usb 1-1: config 0 has an invalid interface number: 88 but max is 0 [ 34.051502][ T574] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 34.053701][ T31] usb 1-1: config 0 has no interface number 0 [ 34.072451][ T31] usb 1-1: config 0 interface 88 altsetting 8 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 34.074302][ T571] netlink: 8 bytes leftover after parsing attributes in process `syz.1.74'. [ 34.083792][ T31] usb 1-1: config 0 interface 88 altsetting 8 endpoint 0x86 has invalid maxpacket 1725, setting to 1024 [ 34.105075][ T31] usb 1-1: config 0 interface 88 has no altsetting 0 [ 34.114333][ T31] usb 1-1: string descriptor 0 read error: -22 [ 34.120787][ T31] usb 1-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.31 [ 34.140238][ T31] usb 1-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3 [ 34.152008][ T31] usb 1-1: config 0 descriptor?? [ 34.158314][ T561] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 34.175950][ T31] input: USB Acecad Flair Tablet 0460:0004 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.88/input/input4 [ 34.193491][ T36] kauditd_printk_skb: 38 callbacks suppressed [ 34.193510][ T36] audit: type=1400 audit(1756505404.350:201): avc: denied { read } for pid=94 comm="acpid" name="event3" dev="devtmpfs" ino=458 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 34.225256][ T36] audit: type=1400 audit(1756505404.350:202): avc: denied { open } for pid=94 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=458 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 34.255901][ T36] audit: type=1400 audit(1756505404.350:203): avc: denied { ioctl } for pid=94 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=458 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 34.373346][ T36] audit: type=1400 audit(1756505404.530:204): avc: denied { read } for pid=560 comm="syz.0.70" name="event3" dev="devtmpfs" ino=458 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 34.409666][ T36] audit: type=1400 audit(1756505404.530:205): avc: denied { open } for pid=560 comm="syz.0.70" path="/dev/input/event3" dev="devtmpfs" ino=458 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 34.435709][ T36] audit: type=1400 audit(1756505404.560:206): avc: denied { bind } for pid=560 comm="syz.0.70" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 34.457711][ T45] usb 1-1: USB disconnect, device number 8 [ 34.507025][ T588] fuse: Unknown parameter 'dont_hash' [ 34.507285][ T587] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:57 [ 34.519691][ T588] rust_binder: Write failure EINVAL in pid:35 [ 34.590327][ T36] audit: type=1400 audit(1756505404.750:207): avc: denied { bind } for pid=589 comm="syz.1.80" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 34.595697][ T334] Bluetooth: hci0: Frame reassembly failed (-84) [ 34.622047][ T334] Bluetooth: hci0: Frame reassembly failed (-84) [ 34.647789][ T36] audit: type=1400 audit(1756505404.810:208): avc: denied { read write } for pid=593 comm="syz.3.81" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 34.672426][ T36] audit: type=1400 audit(1756505404.810:209): avc: denied { open } for pid=593 comm="syz.3.81" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 34.696259][ T36] audit: type=1400 audit(1756505404.810:210): avc: denied { ioctl } for pid=593 comm="syz.3.81" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 34.760712][ T594] rust_binder: Write failure EINVAL in pid:37 [ 34.760827][ T594] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 34.797003][ T598] netlink: 5 bytes leftover after parsing attributes in process `syz.2.82'. [ 34.901612][ T603] overlayfs: failed to resolve './file1': -2 [ 34.921965][ T605] overlayfs: missing 'workdir' [ 35.061605][ T624] rust_binder: Failed to allocate buffer. len:136, is_oneway:true [ 35.153690][ T634] ======================================================= [ 35.153690][ T634] WARNING: The mand mount option has been deprecated and [ 35.153690][ T634] and is ignored by this kernel. Remove the mand [ 35.153690][ T634] option from the mount to silence this warning. [ 35.153690][ T634] ======================================================= [ 35.196858][ T634] binder: Binderfs stats mode cannot be changed during a remount [ 35.277910][ T330] rust_binder: 635: removing orphan mapping 0:4120 [ 35.575933][ T31] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 35.725878][ T31] usb 4-1: Using ep0 maxpacket: 16 [ 35.732121][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 35.742987][ T31] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 35.755879][ T31] usb 4-1: New USB device found, idVendor=057e, idProduct=2019, bcdDevice= 0.00 [ 35.764944][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.773607][ T31] usb 4-1: config 0 descriptor?? [ 35.779579][ T31] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 35.885910][ T330] usb 1-1: new full-speed USB device number 9 using dummy_hcd [ 36.015887][ T330] usb 1-1: device descriptor read/64, error -71 [ 36.255891][ T330] usb 1-1: device descriptor read/64, error -71 [ 36.495877][ T330] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 36.615889][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 36.615942][ T591] Bluetooth: hci0: command 0x1003 tx timeout [ 36.635890][ T330] usb 1-1: device descriptor read/64, error -71 [ 36.809070][ T656] __vm_enough_memory: pid: 656, comm: syz.1.104, bytes: 18014402804453376 not enough memory for the allocation [ 36.834126][ T658] Zero length message leads to an empty skb [ 36.875901][ T330] usb 1-1: device descriptor read/64, error -71 [ 36.942219][ T671] netlink: 'syz.1.109': attribute type 4 has an invalid length. [ 36.981846][ T673] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem [ 36.986067][ T330] usb usb1-port1: attempt power cycle [ 37.100353][ T678] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem [ 37.241809][ T683] rust_binder: Write failure EFAULT in pid:98 [ 37.325899][ T330] usb 1-1: new full-speed USB device number 11 using dummy_hcd [ 37.357143][ T330] usb 1-1: device descriptor read/8, error -71 [ 37.377756][ T691] binder: Unknown parameter 'mÔ2•E000' [ 37.486985][ T330] usb 1-1: device descriptor read/8, error -71 [ 37.725898][ T330] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 37.746963][ T330] usb 1-1: device descriptor read/8, error -71 [ 37.836666][ T695] 9pnet_fd: Insufficient options for proto=fd [ 37.877094][ T330] usb 1-1: device descriptor read/8, error -71 [ 37.986011][ T330] usb usb1-port1: unable to enumerate USB device [ 38.145642][ T711] 9pnet_fd: Insufficient options for proto=fd [ 38.223719][ T722] process 'syz.1.127' launched './file1' with NULL argv: empty string added [ 38.299892][ T31] usb 4-1: USB disconnect, device number 7 [ 38.455547][ T742] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 38.597491][ T761] tmpfs: Too few inodes for current use [ 38.608545][ T761] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 38.608585][ T761] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:81 [ 38.735912][ T31] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 38.863105][ T788] cgroup: release_agent respecified [ 38.915890][ T31] usb 2-1: Using ep0 maxpacket: 32 [ 38.926966][ T31] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 38.945795][ T31] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 38.954617][ T31] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 38.965880][ T330] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 38.984253][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 39.004235][ T31] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 39.015876][ T31] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 39.035918][ T31] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 39.045128][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.054298][ T31] usb 2-1: config 0 descriptor?? [ 39.150839][ T330] usb 4-1: Using ep0 maxpacket: 16 [ 39.157260][ T330] usb 4-1: config 0 interface 0 altsetting 7 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 39.185877][ T330] usb 4-1: config 0 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 39.205861][ T330] usb 4-1: config 0 interface 0 has no altsetting 0 [ 39.222843][ T330] usb 4-1: New USB device found, idVendor=0458, idProduct=0138, bcdDevice= 0.00 [ 39.243066][ T330] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.256732][ T330] usb 4-1: config 0 descriptor?? [ 39.268612][ T31] usblp 2-1:0.0: usblp0: USB Bidirectional printer dev 5 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 39.434283][ T36] kauditd_printk_skb: 39 callbacks suppressed [ 39.434303][ T36] audit: type=1400 audit(1756505409.590:250): avc: denied { getopt } for pid=803 comm="syz.2.157" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 39.465769][ T9] usb 2-1: USB disconnect, device number 5 [ 39.473909][ T9] usblp0: removed [ 39.497532][ T36] audit: type=1326 audit(1756505409.660:251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=807 comm="syz.2.159" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc4ed38ebe9 code=0x0 [ 39.604876][ T809] SELinux: Context system_u:object_r:checkpolicy_exec_t:s0 is not valid (left unmapped). [ 39.615526][ T36] audit: type=1400 audit(1756505409.770:252): avc: denied { relabelto } for pid=807 comm="syz.2.159" name=6D656D66643A2F2E2F2F5C2602272A2A dev="tmpfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="system_u:object_r:checkpolicy_exec_t:s0" [ 39.644986][ T36] audit: type=1400 audit(1756505409.770:253): avc: denied { associate } for pid=807 comm="syz.2.159" name=6D656D66643A2F2E2F2F5C2602272A2A dev="tmpfs" ino=8 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:checkpolicy_exec_t:s0" [ 39.682291][ T330] kye 0003:0458:0138.0003: unknown main item tag 0x0 [ 39.689357][ T330] kye 0003:0458:0138.0003: unknown main item tag 0x0 [ 39.696416][ T330] kye 0003:0458:0138.0003: unknown main item tag 0x0 [ 39.704734][ T330] kye 0003:0458:0138.0003: hidraw0: USB HID v0.08 Device [HID 0458:0138] on usb-dummy_hcd.3-1/input0 [ 39.867170][ T36] audit: type=1400 audit(1756505410.030:254): avc: denied { mounton } for pid=813 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 39.922739][ T813] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.929954][ T813] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.937351][ T813] bridge_slave_0: entered allmulticast mode [ 39.943918][ T813] bridge_slave_0: entered promiscuous mode [ 39.957234][ T813] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.965136][ T813] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.976787][ T813] bridge_slave_1: entered allmulticast mode [ 39.983108][ T813] bridge_slave_1: entered promiscuous mode [ 39.990441][ T407] usb 4-1: USB disconnect, device number 8 [ 40.046406][ T36] audit: type=1400 audit(1756505410.210:255): avc: denied { execute_no_trans } for pid=819 comm="syz.1.164" path="/50/file0" dev="tmpfs" ino=286 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 40.094954][ T813] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.102143][ T813] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.109501][ T813] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.116567][ T813] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.140959][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.149192][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.161748][ T334] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.168957][ T334] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.179472][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.186581][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.198631][ T36] audit: type=1400 audit(1756505410.360:256): avc: denied { open } for pid=829 comm="syz.1.165" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=6953 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 40.235283][ T813] veth0_vlan: entered promiscuous mode [ 40.241555][ T36] audit: type=1400 audit(1756505410.400:257): avc: denied { getopt } for pid=829 comm="syz.1.165" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 40.258794][ T813] veth1_macvtap: entered promiscuous mode [ 40.300285][ T36] audit: type=1400 audit(1756505410.460:258): avc: denied { mounton } for pid=813 comm="syz-executor" path="/root/syzkaller.YgUAHm/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 40.342825][ T36] audit: type=1400 audit(1756505410.500:259): avc: denied { bind } for pid=834 comm="syz.4.162" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 40.343778][ T835] rust_binder: 2: no such ref 3 [ 40.388969][ T840] random: crng reseeded on system resumption [ 40.429914][ T842] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:9 [ 40.613114][ T846] rust_binder: Error in use_page_slow: ESRCH [ 40.623022][ T846] rust_binder: use_range failure ESRCH [ 40.629188][ T846] rust_binder: Failed to allocate buffer. len:4160, is_oneway:false [ 40.634678][ T846] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 40.642719][ T846] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:11 [ 40.691828][ T848] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 40.701417][ T848] rust_binder: Read failure Err(EAGAIN) in pid:88 [ 40.763645][ T853] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 40.770499][ T854] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 40.770645][ T853] netlink: 'syz.3.170': attribute type 16 has an invalid length. [ 40.792560][ T853] netlink: 'syz.3.170': attribute type 3 has an invalid length. [ 40.800580][ T853] netlink: 'syz.3.170': attribute type 1 has an invalid length. [ 40.808953][ T853] netlink: 64030 bytes leftover after parsing attributes in process `syz.3.170'. [ 40.836265][ T857] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 40.837303][ T857] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:97 [ 41.016734][ T871] rust_binder: Error while translating object. [ 41.025945][ T871] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 41.037004][ T871] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:157 [ 41.046276][ T874] 9pnet: p9_errstr2errno: server reported unknown error 184467 [ 41.167481][ T881] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 41.168023][ T881] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 41.174682][ T881] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 41.183169][ T881] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:106 [ 41.221333][ T886] rust_binder: Error while translating object. [ 41.230682][ T886] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 41.236919][ T886] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:163 [ 41.264677][ T889] SELinux: security_context_str_to_sid (sytem_uÝGй) failed with errno=-22 [ 41.490222][ T903] rust_binder: Error while translating object. [ 41.490264][ T903] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 41.500715][ T903] rust_binder: Failure BR_FAILED_REPLY { source: EINVAL } during reply - delivering BR_FAILED_REPLY to sender. [ 41.521447][ T903] rust_binder: Transaction failed: BR_TRANSACTION_COMPLETE my_pid:173 [ 41.548427][ T64] rust_binder: 902: removing orphan mapping 0:24 [ 41.675924][ T407] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 41.854135][ T407] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 41.875885][ T407] usb 5-1: config 1 has no interface number 1 [ 41.889329][ T407] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 41.928423][ T407] usb 5-1: New USB device found, idVendor=1d6b, idProduct=6c01, bcdDevice= 0.ed [ 41.940005][ T407] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.965861][ T64] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 41.975920][ T407] usb 5-1: Product: syz [ 41.980169][ T407] usb 5-1: Manufacturer: syz [ 41.984842][ T407] usb 5-1: SerialNumber: syz [ 42.064581][ T959] /dev/rnullb0: Can't open blockdev [ 42.125859][ T64] usb 2-1: Using ep0 maxpacket: 8 [ 42.137057][ T64] usb 2-1: unable to get BOS descriptor or descriptor too short [ 42.145615][ T64] usb 2-1: config 1 has an invalid descriptor of length 186, skipping remainder of the config [ 42.158508][ T64] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 42.183595][ T64] usb 2-1: string descriptor 0 read error: -22 [ 42.191241][ T64] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 42.201047][ T64] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 42.211074][ T64] usb 2-1: bad CDC descriptors [ 42.224658][ T970] overlayfs: failed to clone upperpath [ 42.319083][ T974] rust_binder: validate_parent_fixup: new_min_offset=42, sg_entry.length=0 [ 42.319112][ T974] rust_binder: Error while translating object. [ 42.328200][ T974] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 42.334676][ T974] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:115 [ 42.417680][ T937] can0: slcan on ttyS3. [ 42.499367][ T937] can0 (unregistered): slcan off ttyS3. [ 42.507396][ T998] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=998 comm=syz.3.219 [ 42.567213][ T1005] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2541091674 (162629867136 ns) > initial count (104792502336 ns). Using initial count to start timer. [ 42.616688][ T1005] /dev/rnullb0: Can't open blockdev [ 42.680910][ T31] usb 2-1: USB disconnect, device number 6 [ 43.371800][ T1063] SELinux: security_context_str_to_sid (--^$-) failed with errno=-22 [ 43.515885][ T31] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 43.665928][ T549] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 43.674626][ T31] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 43.685934][ T31] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 43.697241][ T31] usb 4-1: too many endpoints for config 1 interface 1 altsetting 175: 100, using maximum allowed: 30 [ 43.708542][ T31] usb 4-1: config 1 interface 1 altsetting 175 has 0 endpoint descriptors, different from the interface descriptor's value: 100 [ 43.722123][ T31] usb 4-1: config 1 interface 1 has no altsetting 0 [ 43.730499][ T31] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 43.740240][ T31] usb 4-1: New USB device strings: Mfr=199, Product=2, SerialNumber=3 [ 43.748708][ T31] usb 4-1: Product: syz [ 43.752995][ T31] usb 4-1: Manufacturer: syz [ 43.757743][ T31] usb 4-1: SerialNumber: syz [ 43.764281][ T31] cdc_ncm 4-1:1.0: skipping garbage [ 43.769626][ T31] cdc_ncm 4-1:1.0: NCM or ECM functional descriptors missing [ 43.777082][ T31] cdc_ncm 4-1:1.0: bind() failure [ 43.817142][ T549] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 43.827459][ T549] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 43.838912][ T549] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 43.848794][ T549] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 43.861724][ T549] usb 2-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 43.870972][ T549] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.879828][ T549] usb 2-1: config 0 descriptor?? [ 43.886429][ T549] usb 2-1: MIDIStreaming interface descriptor not found [ 43.965439][ T1055] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 43.967858][ T1055] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 43.983704][ T1055] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 44.087516][ T330] usb 2-1: USB disconnect, device number 7 [ 44.461130][ T407] usb 5-1: skipping empty audio interface (v1) [ 44.473107][ T407] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 44.485197][ T407] usb 5-1: USB disconnect, device number 2 [ 44.496537][ T344] udevd[344]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 44.691088][ T36] kauditd_printk_skb: 102 callbacks suppressed [ 44.691109][ T36] audit: type=1400 audit(1756505414.850:362): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 44.728895][ T1107] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 44.807996][ T1112] rust_binder: 1107 RLIMIT_NICE not set [ 45.316363][ T407] rust_binder: 1106: removing orphan mapping 0:4240 [ 45.326909][ T1132] netlink: 16 bytes leftover after parsing attributes in process `syz.1.256'. [ 45.391463][ T1132] rust_binder: Error while translating object. [ 45.391504][ T1132] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 45.397915][ T1132] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:204 [ 45.419588][ T36] audit: type=1400 audit(1756505415.580:363): avc: denied { ioctl } for pid=1134 comm="syz.1.257" path="socket:[8763]" dev="sockfs" ino=8763 ioctlcmd=0x7202 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 45.524168][ T36] audit: type=1400 audit(1756505415.680:364): avc: denied { create } for pid=1136 comm="syz.4.258" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 45.704150][ T1145] cgroup: fork rejected by pids controller in /syz4 [ 45.780423][ T1179] netlink: 188 bytes leftover after parsing attributes in process `syz.2.262'. [ 46.279468][ T407] usb 4-1: USB disconnect, device number 9 [ 46.308145][ T1184] x_tables: duplicate underflow at hook 1 [ 46.324034][ T1184] option changes via remount are deprecated (pid=1183 comm=syz.3.264) [ 46.324843][ T36] audit: type=1400 audit(1756505416.480:365): avc: denied { remount } for pid=1183 comm="syz.3.264" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 46.333752][ T1184] fuseblk: Bad value for 'fd' [ 46.395432][ T1205] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.398855][ T1205] rust_binder: Failed to allocate buffer. len:10771147061988852024, is_oneway:false [ 46.405688][ T1205] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 46.418005][ T1205] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:146 [ 46.429808][ T1208] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.505973][ T1211] binder: Bad value for 'defcontext' [ 46.517876][ T36] audit: type=1400 audit(1756505416.660:366): avc: denied { create } for pid=1210 comm="syz.4.270" name="file2" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 46.554575][ T36] audit: type=1400 audit(1756505416.670:367): avc: denied { write } for pid=1210 comm="syz.4.270" name="file2" dev="tmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 46.586575][ T36] audit: type=1400 audit(1756505416.670:368): avc: denied { open } for pid=1210 comm="syz.4.270" path="/12/file2" dev="tmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 46.620413][ T36] audit: type=1400 audit(1756505416.700:369): avc: denied { ioctl } for pid=1210 comm="syz.4.270" path="/12/file2" dev="tmpfs" ino=87 ioctlcmd=0x127c scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 46.665944][ T36] audit: type=1400 audit(1756505416.810:370): avc: denied { unlink } for pid=813 comm="syz-executor" name="file2" dev="tmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 46.811594][ T10] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 46.824901][ T10] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.00 Device [syz1] on syz0 [ 46.975507][ T1229] ªªªªª$: renamed from bridge_slave_0 (while UP) [ 47.003587][ T36] audit: type=1400 audit(1756505417.160:371): avc: denied { load_policy } for pid=1228 comm="syz.4.276" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 47.023902][ T1229] SELinux: policydb version -1062669571 does not match my version range 15-33 [ 47.043058][ T1229] SELinux: failed to load policy [ 47.053599][ T1232] SELinux: policydb version -1062669571 does not match my version range 15-33 [ 47.072690][ T1232] SELinux: failed to load policy [ 47.217903][ T1239] overlayfs: failed to resolve './file1': -2 [ 48.001217][ T1277] tmpfs: Too few inodes for current use [ 48.016172][ T1278] tmpfs: Too few inodes for current use [ 48.353915][ T1302] rust_binder: 97: no such ref 3 [ 48.375914][ T1302] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 160, size: 97) [ 48.375944][ T1302] rust_binder: Error while translating object. [ 48.395956][ T1302] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 48.402187][ T1302] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:97 [ 48.426422][ T1304] rust_binder: Write failure EINVAL in pid:97 [ 48.748349][ T1309] /dev/rnullb0: Can't open blockdev [ 49.284005][ T1333] rust_binder: Error while translating object. [ 49.284010][ T1334] rust_binder: Error while translating object. [ 49.284036][ T1333] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 49.290514][ T1334] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 49.300588][ T1333] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:183 [ 49.314656][ T1334] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:183 [ 49.389004][ T1340] binder: Unknown parameter '0x000000000000000301777777777777777777777' [ 49.422228][ T1342] mmap: syz.3.307 (1342) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 49.435440][ T1342] 9pnet_fd: Insufficient options for proto=fd [ 49.457052][ T1344] tmpfs: Unknown parameter 'h' [ 49.565913][ T330] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 49.717042][ T330] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 49.728625][ T330] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 49.740162][ T330] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 49.750954][ T330] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 49.763946][ T330] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 49.773305][ T330] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.783683][ T330] usb 5-1: config 0 descriptor?? [ 49.802467][ T36] kauditd_printk_skb: 9 callbacks suppressed [ 49.802485][ T36] audit: type=1400 audit(1773282864.962:381): avc: denied { create } for pid=1373 comm="syz.2.317" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 49.840089][ T36] audit: type=1400 audit(1773282865.002:382): avc: denied { checkpoint_restore } for pid=1378 comm="syz.2.318" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 49.877417][ T36] audit: type=1400 audit(1773282865.042:383): avc: denied { create } for pid=1380 comm="syz.2.319" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 49.955893][ T64] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 50.105917][ T64] usb 2-1: Using ep0 maxpacket: 8 [ 50.112155][ T64] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 255, changing to 11 [ 50.123331][ T64] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 59391, setting to 1024 [ 50.135972][ T64] usb 2-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=ec.b7 [ 50.145137][ T64] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 50.153332][ T64] usb 2-1: Product: syz [ 50.157561][ T64] usb 2-1: Manufacturer: syz [ 50.162213][ T64] usb 2-1: SerialNumber: syz [ 50.167886][ T64] usb 2-1: config 0 descriptor?? [ 50.173267][ T1367] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 50.181987][ T64] usb 2-1: invalid MIDI in EP 0 [ 50.190065][ T64] snd-usb-audio 2-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 50.200673][ T330] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 50.209074][ T330] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 50.216713][ T330] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 50.224199][ T330] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 50.231646][ T330] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 50.239337][ T330] plantronics 0003:047F:FFFF.0005: No inputs registered, leaving [ 50.244333][ T353] udevd[353]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 50.255958][ T330] plantronics 0003:047F:FFFF.0005: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 50.492114][ T330] usb 5-1: USB disconnect, device number 3 [ 50.884871][ T330] usb 2-1: USB disconnect, device number 8 [ 50.992214][ T1398] overlayfs: failed to clone upperpath [ 51.015875][ T36] audit: type=1400 audit(1773282866.172:384): avc: denied { create } for pid=1399 comm="syz.4.326" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 51.055625][ T36] audit: type=1400 audit(1773282866.192:385): avc: denied { connect } for pid=1402 comm="syz.1.327" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 51.079082][ T1410] netlink: 'syz.2.329': attribute type 4 has an invalid length. [ 51.090250][ T1410] netlink: 'syz.2.329': attribute type 4 has an invalid length. [ 51.140004][ T1416] netlink: 128 bytes leftover after parsing attributes in process `syz.2.332'. [ 51.211441][ T1425] overlayfs: failed to clone upperpath [ 51.247843][ T36] audit: type=1400 audit(1773282866.412:386): avc: denied { mount } for pid=1429 comm="syz.2.338" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 51.375878][ T64] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 51.527660][ T64] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 51.545949][ T64] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 51.562820][ T64] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.572356][ T64] usb 5-1: config 0 descriptor?? [ 51.577982][ T1414] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 52.000181][ T46] bridge_slave_1: left allmulticast mode [ 52.005985][ T46] bridge_slave_1: left promiscuous mode [ 52.011648][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.019689][ T46] bridge_slave_0: left allmulticast mode [ 52.025363][ T46] bridge_slave_0: left promiscuous mode [ 52.028711][ T64] pyra 0003:1E7D:2CF6.0006: unknown main item tag 0x0 [ 52.031647][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.038362][ T64] pyra 0003:1E7D:2CF6.0006: unknown main item tag 0x0 [ 52.051805][ T64] pyra 0003:1E7D:2CF6.0006: item fetching failed at offset 3/5 [ 52.061434][ T64] pyra 0003:1E7D:2CF6.0006: parse failed [ 52.067254][ T64] pyra 0003:1E7D:2CF6.0006: probe with driver pyra failed with error -22 [ 52.232147][ T36] audit: type=1400 audit(1773282867.392:387): avc: denied { mount } for pid=1413 comm="syz.4.331" name="/" dev="ramfs" ino=9958 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 52.235976][ T46] veth1_macvtap: left promiscuous mode [ 52.277549][ T46] veth0_vlan: left promiscuous mode [ 52.348925][ T407] usb 5-1: USB disconnect, device number 4 [ 52.384839][ T1443] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.392191][ T1443] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.399413][ T1443] bridge_slave_0: entered allmulticast mode [ 52.405884][ T1443] bridge_slave_0: entered promiscuous mode [ 52.412412][ T1443] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.419665][ T1443] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.426884][ T1443] bridge_slave_1: entered allmulticast mode [ 52.433818][ T1443] bridge_slave_1: entered promiscuous mode [ 52.490128][ T1443] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.497319][ T1443] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.504675][ T1443] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.511757][ T1443] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.538252][ T334] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.546383][ T334] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.556939][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.564036][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.573536][ T334] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.580650][ T334] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.623802][ T1443] veth0_vlan: entered promiscuous mode [ 52.638628][ T1443] veth1_macvtap: entered promiscuous mode [ 52.703012][ T1459] netlink: 'syz.1.345': attribute type 21 has an invalid length. [ 52.710947][ T1459] netlink: 388 bytes leftover after parsing attributes in process `syz.1.345'. [ 52.865273][ T36] audit: type=1400 audit(1773282868.022:388): avc: denied { unmount } for pid=813 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 52.969567][ T1476] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem [ 53.024054][ T36] audit: type=1400 audit(1773282868.182:389): avc: denied { bind } for pid=1465 comm="syz.1.349" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 53.025931][ T64] usb 4-1: new full-speed USB device number 10 using dummy_hcd [ 53.067685][ T1486] netlink: 32 bytes leftover after parsing attributes in process `syz.1.355'. [ 53.150198][ T1498] tipc: Started in network mode [ 53.155095][ T1498] tipc: Node identity , cluster identity 4711 [ 53.165964][ T1498] tipc: Failed to set node id, please configure manually [ 53.173843][ T1498] tipc: Enabling of bearer rejected, failed to enable media [ 53.182669][ T1499] tipc: Started in network mode [ 53.188285][ T1499] tipc: Node identity , cluster identity 4711 [ 53.194376][ T1499] tipc: Failed to set node id, please configure manually [ 53.201695][ T1499] tipc: Enabling of bearer rejected, failed to enable media [ 53.202897][ T64] usb 4-1: unable to get BOS descriptor or descriptor too short [ 53.209813][ T36] audit: type=1400 audit(1773282868.362:390): avc: denied { mounton } for pid=1497 comm="syz.1.359" path="/6/file0" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 53.218716][ T64] usb 4-1: not running at top speed; connect to a high speed hub [ 53.248463][ T64] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 147, changing to 4 [ 53.267092][ T64] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 53.284002][ T64] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.293675][ T64] usb 4-1: Product: syz [ 53.302147][ T64] usb 4-1: Manufacturer: syz [ 53.308820][ T64] usb 4-1: SerialNumber: syz [ 53.316193][ T1505] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2058 sclass=netlink_route_socket pid=1505 comm=syz.1.362 [ 53.320867][ T1510] netlink: 16 bytes leftover after parsing attributes in process `syz.4.363'. [ 53.343769][ T1509] netlink: 24 bytes leftover after parsing attributes in process `syz.4.363'. [ 53.400053][ T1523] netlink: 196 bytes leftover after parsing attributes in process `syz.4.367'. [ 53.415078][ T1524] netlink: 192 bytes leftover after parsing attributes in process `syz.4.367'. [ 53.425173][ T1524] tc_dump_action: action bad kind [ 53.430804][ T1523] netlink: 192 bytes leftover after parsing attributes in process `syz.4.367'. [ 53.440417][ T1523] tc_dump_action: action bad kind [ 53.538434][ T1461] rust_binder: Write failure EFAULT in pid:203 [ 53.541052][ T64] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 53.560243][ T64] usb 4-1: USB disconnect, device number 10 [ 53.572782][ T344] udevd[344]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 54.237863][ T1562] netlink: 16 bytes leftover after parsing attributes in process `syz.4.381'. [ 54.247343][ T1562] random: crng reseeded on system resumption [ 54.283737][ T1564] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 54.291914][ T1564] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 54.303461][ T1564] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 54.311793][ T1564] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 54.375888][ T10] usb 4-1: new full-speed USB device number 11 using dummy_hcd [ 54.422099][ T1582] netlink: 8 bytes leftover after parsing attributes in process `syz.1.387'. [ 54.527879][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 54.539123][ T10] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 54.548297][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 54.557062][ T10] usb 4-1: config 0 descriptor?? [ 54.562408][ T1550] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 54.635956][ T31] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 54.671063][ T1590] overlayfs: failed to resolve './file0': -2 [ 54.725890][ T407] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 54.786108][ T31] usb 5-1: Using ep0 maxpacket: 16 [ 54.794801][ T31] usb 5-1: config 1 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 54.807869][ T31] usb 5-1: config 1 interface 0 has no altsetting 0 [ 54.816189][ T31] usb 5-1: New USB device found, idVendor=0c70, idProduct=f011, bcdDevice= 0.40 [ 54.825369][ T31] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.833850][ T31] usb 5-1: Product: syz [ 54.838149][ T31] usb 5-1: Manufacturer: syz [ 54.842789][ T31] usb 5-1: SerialNumber: syz [ 54.866739][ T36] kauditd_printk_skb: 7 callbacks suppressed [ 54.866757][ T36] audit: type=1400 audit(1773282870.032:398): avc: denied { getopt } for pid=1606 comm="syz.2.398" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 54.905914][ T407] usb 2-1: Using ep0 maxpacket: 8 [ 54.913493][ T407] usb 2-1: unable to get BOS descriptor or descriptor too short [ 54.924427][ T407] usb 2-1: config 12 interface 0 altsetting 7 endpoint 0x3 has invalid wMaxPacketSize 0 [ 54.934378][ T407] usb 2-1: config 12 interface 0 altsetting 7 bulk endpoint 0x3 has invalid maxpacket 0 [ 54.945150][ T407] usb 2-1: config 12 interface 0 has no altsetting 0 [ 54.955920][ T407] usb 2-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 54.965038][ T407] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.973426][ T407] usb 2-1: Product: syz [ 54.984963][ T407] usb 2-1: Manufacturer: syz [ 54.989870][ T407] usb 2-1: SerialNumber: syz [ 55.000384][ T10] pyra 0003:1E7D:2CF6.0007: unknown main item tag 0x0 [ 55.007441][ T10] pyra 0003:1E7D:2CF6.0007: unknown main item tag 0x0 [ 55.014622][ T10] pyra 0003:1E7D:2CF6.0007: item fetching failed at offset 3/5 [ 55.022743][ T10] pyra 0003:1E7D:2CF6.0007: parse failed [ 55.028728][ T10] pyra 0003:1E7D:2CF6.0007: probe with driver pyra failed with error -22 [ 55.053574][ T1575] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.063624][ T1575] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.073317][ T1575] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.082816][ T1575] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.204445][ T407] usb 2-1: selecting invalid altsetting 0 [ 55.209293][ T1630] vcan0: entered allmulticast mode [ 55.228022][ T407] snd-usb-audio 2-1:12.0: probe with driver snd-usb-audio failed with error -12 [ 55.247319][ T407] usb 2-1: USB disconnect, device number 9 [ 55.268605][ T10] usb 4-1: USB disconnect, device number 11 [ 55.320783][ T367] udevd[367]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:12.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 55.755222][ T1643] fuse: Bad value for 'fd' [ 55.872702][ T1658] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.872786][ T1659] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.984281][ T1659] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 55.984302][ T1662] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 55.984322][ T1662] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 55.984344][ T1662] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:220 [ 55.991097][ T1659] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 56.036595][ T1659] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:220 [ 56.526162][ T1669] /dev/loop0: Can't lookup blockdev [ 56.787034][ T1673] SELinux: security_context_str_to_sid (--^$-) failed with errno=-22 [ 56.796247][ T1674] netlink: 'syz.3.422': attribute type 16 has an invalid length. [ 56.804030][ T1674] __nla_validate_parse: 2 callbacks suppressed [ 56.804058][ T1674] netlink: 64138 bytes leftover after parsing attributes in process `syz.3.422'. [ 56.855722][ T1679] netlink: 32 bytes leftover after parsing attributes in process `syz.1.425'. [ 56.868782][ T1679] tipc: Invalid UDP bearer configuration [ 56.868808][ T1679] tipc: Enabling of bearer rejected, failed to enable media [ 57.083132][ T36] audit: type=1400 audit(1773282872.242:399): avc: denied { ioctl } for pid=1685 comm="syz.2.427" path="socket:[11204]" dev="sockfs" ino=11204 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 57.135848][ T36] audit: type=1400 audit(1773282872.292:400): avc: denied { read } for pid=1685 comm="syz.2.427" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 57.402779][ T31] usbhid 5-1:1.0: can't add hid device: -71 [ 57.410103][ T31] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 57.419452][ T31] usb 5-1: USB disconnect, device number 5 [ 57.445570][ T36] audit: type=1400 audit(1773282872.602:401): avc: denied { bpf } for pid=1688 comm="syz.4.428" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 57.471472][ T1689] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=1689 comm=syz.4.428 [ 57.485975][ T1691] rust_binder: validate_parent_fixup: new_min_offset=42, sg_entry.length=0 [ 57.485999][ T1691] rust_binder: Error while translating object. [ 57.494807][ T1691] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 57.503214][ T1691] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:227 [ 57.513562][ T1692] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 57.610315][ T1717] fuse: Unknown parameter '' [ 57.615866][ T36] audit: type=1400 audit(1773282872.772:402): avc: denied { ioctl } for pid=1716 comm="syz.4.435" path="/dev/fuse" dev="devtmpfs" ino=23 ioctlcmd=0x5462 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 57.786304][ T1736] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem [ 57.880440][ T1759] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 57.932386][ T1751] rust_binder: Write failure EFAULT in pid:251 [ 57.934899][ T36] audit: type=1400 audit(1773282873.092:403): avc: denied { ioctl } for pid=1750 comm="syz.3.447" path="socket:[11856]" dev="sockfs" ino=11856 ioctlcmd=0x8955 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 58.037288][ T1775] rust_binder: Error in use_page_slow: ESRCH [ 58.043372][ T1775] rust_binder: use_range failure ESRCH [ 58.043395][ T1775] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 58.049498][ T1775] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 58.070716][ T1775] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:203 [ 58.090013][ T36] audit: type=1400 audit(1773282873.252:404): avc: denied { getopt } for pid=1778 comm="syz.4.456" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 58.119100][ T1779] rust_binder: Write failure EINVAL in pid:206 [ 58.139534][ T1789] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 58.155967][ T1789] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 58.345553][ T36] audit: type=1326 audit(1773282873.502:405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1794 comm="syz.2.462" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc4ed38ebe9 code=0x0 [ 58.377020][ T31] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 58.526914][ T31] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 58.537952][ T31] usb 5-1: config 0 has no interfaces? [ 58.543455][ T31] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 58.552553][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 58.561233][ T31] usb 5-1: config 0 descriptor?? [ 58.646462][ T1798] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=54 sclass=netlink_route_socket pid=1798 comm=syz.1.463 [ 58.658996][ T1798] netlink: 12 bytes leftover after parsing attributes in process `syz.1.463'. [ 58.668839][ T31] rust_binder: 1750: removing orphan mapping 0:112 [ 58.735664][ T1811] __vm_enough_memory: pid: 1811, comm: syz.3.464, bytes: 18014402804453376 not enough memory for the allocation [ 58.767902][ T31] usb 5-1: USB disconnect, device number 6 [ 58.931001][ T1836] 9pnet_fd: Insufficient options for proto=fd [ 59.187649][ T1841] tmpfs: Unknown parameter 'fowner>00000000000000000000' [ 59.195427][ T36] audit: type=1400 audit(1773282874.352:406): avc: denied { bind } for pid=1840 comm="syz.2.478" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 59.214863][ T36] audit: type=1400 audit(1773282874.352:407): avc: denied { name_bind } for pid=1840 comm="syz.2.478" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 59.693889][ T1876] rust_binder: Write failure EINVAL in pid:233 [ 59.767789][ T1878] SELinux: security_context_str_to_sid (--^$-) failed with errno=-22 [ 59.835894][ T45] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 59.987126][ T45] usb 4-1: config 1 interface 0 altsetting 252 bulk endpoint 0x1 has invalid maxpacket 32 [ 59.997164][ T45] usb 4-1: config 1 interface 0 has no altsetting 0 [ 60.005238][ T45] usb 4-1: New USB device found, idVendor=03f0, idProduct=0004, bcdDevice= 0.40 [ 60.014356][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 60.022419][ T45] usb 4-1: Product: syz [ 60.026614][ T45] usb 4-1: Manufacturer: syz [ 60.031247][ T45] usb 4-1: SerialNumber: syz [ 60.036928][ T1873] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 60.100163][ T1902] veth1_macvtap: left promiscuous mode [ 60.105859][ T1902] macsec0: entered promiscuous mode [ 60.155578][ T36] kauditd_printk_skb: 3 callbacks suppressed [ 60.155597][ T36] audit: type=1400 audit(1773282875.312:411): avc: denied { relabelto } for pid=1908 comm="syz.1.503" name=6D656D66643A2F2E2F2F5C2602272A2A dev="tmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="system_u:object_r:checkpolicy_exec_t:s0" [ 60.246026][ T36] audit: type=1400 audit(1773282875.412:412): avc: denied { getopt } for pid=1871 comm="syz.3.490" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 60.267925][ T45] usb 4-1: USB disconnect, device number 12 [ 60.551942][ T1921] 9pnet_fd: Insufficient options for proto=fd [ 60.723406][ T407] rust_binder: 1923: removing orphan mapping 0:24 [ 60.730089][ T407] rust_binder: 1923: removing orphan mapping 24:96 [ 60.745217][ T1938] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 60.807060][ T1945] rust_binder: 264: no such ref 3 [ 60.812173][ T1945] rust_binder: Read failure Err(EAGAIN) in pid:264 [ 60.813269][ T36] audit: type=1400 audit(1773282875.972:413): avc: denied { mount } for pid=1944 comm="syz.3.514" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 60.813360][ T1948] 9p: Unknown access argument : -22 [ 60.851728][ T36] audit: type=1400 audit(1773282876.012:414): avc: denied { mounton } for pid=1944 comm="syz.3.514" path="/85/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 60.866082][ T1951] 9pnet_fd: Insufficient options for proto=fd [ 61.050252][ T36] audit: type=1400 audit(1773282876.212:415): avc: denied { map } for pid=1969 comm="syz.1.520" path="socket:[12996]" dev="sockfs" ino=12996 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 61.145078][ T36] audit: type=1326 audit(1773282876.302:416): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1973 comm="syz.2.521" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc4ed38ebe9 code=0x0 [ 61.609562][ T36] audit: type=1400 audit(1773282876.772:417): avc: denied { unmount } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 61.690633][ T1994] 9pnet_fd: Insufficient options for proto=fd [ 61.998121][ T407] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 62.081642][ T2018] ./cgroup: Can't lookup blockdev [ 62.166905][ T407] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 62.179006][ T407] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 62.196977][ T407] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 62.208465][ T407] usb 4-1: config 0 descriptor?? [ 62.215242][ T2001] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 62.595520][ T2036] fuseblk: Bad value for 'blksize' [ 62.602751][ T36] audit: type=1400 audit(1773282877.762:418): avc: denied { write } for pid=2035 comm="syz.4.540" name="protocols" dev="proc" ino=4026532832 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 62.646113][ T36] audit: type=1400 audit(1773282877.792:419): avc: denied { setattr } for pid=2035 comm="syz.4.540" name="tun" dev="devtmpfs" ino=85 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tun_tap_device_t tclass=chr_file permissive=1 [ 62.692811][ T36] audit: type=1400 audit(1773282877.842:420): avc: denied { write } for pid=2039 comm="syz.4.542" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 62.730887][ T2045] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 4256, size: 18446744073709551438) [ 62.730915][ T2045] rust_binder: Error while translating object. [ 62.745270][ T407] usbhid 4-1:0.0: can't add hid device: -71 [ 62.747437][ T2045] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 62.757635][ T2045] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:297 [ 62.765944][ T407] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 62.790443][ T407] usb 4-1: USB disconnect, device number 13 [ 62.876578][ T2047] rust_binder: inc_ref_done called when no active inc_refs [ 63.067399][ T2054] mmap: syz.4.547 (2054): VmData 17453056 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 63.106953][ T2057] netlink: 64 bytes leftover after parsing attributes in process `syz.4.548'. [ 63.289364][ T2065] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 63.289725][ T2065] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:283 [ 63.355888][ T407] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 63.525828][ T407] usb 5-1: Using ep0 maxpacket: 16 [ 63.536535][ T407] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 63.544750][ T407] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 63.576037][ T407] usb 5-1: config 0 has no interface number 0 [ 63.582279][ T407] usb 5-1: config 0 interface 41 has no altsetting 0 [ 63.607241][ T407] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 63.625839][ T407] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 63.633897][ T407] usb 5-1: Product: syz [ 63.645931][ T407] usb 5-1: Manufacturer: syz [ 63.650894][ T407] usb 5-1: SerialNumber: syz [ 63.666486][ T407] usb 5-1: config 0 descriptor?? [ 63.675604][ T407] CoreChips 5-1:0.41: probe with driver CoreChips failed with error -22 [ 64.005845][ T407] usb 4-1: new full-speed USB device number 14 using dummy_hcd [ 64.197110][ T407] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 64.215033][ T407] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 64.223793][ T2095] overlayfs: failed to clone upperpath [ 64.234403][ T407] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 64.253402][ T407] usb 4-1: config 0 descriptor?? [ 64.266157][ T2086] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 64.719771][ T407] usbhid 4-1:0.0: can't add hid device: -71 [ 64.725781][ T407] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 64.752620][ T2102] cgroup: Name too long [ 64.757101][ T407] usb 4-1: USB disconnect, device number 14 [ 64.808494][ T2103] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=2103 comm=syz.1.563 [ 64.933893][ T2112] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 64.942958][ T2112] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 65.237611][ T2120] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:307 [ 65.515902][ T31] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 65.675865][ T31] usb 4-1: Using ep0 maxpacket: 8 [ 65.682585][ T31] usb 4-1: unable to get BOS descriptor or descriptor too short [ 65.691156][ T31] usb 4-1: config 0 has an invalid interface number: 88 but max is 0 [ 65.699459][ T31] usb 4-1: config 0 has no interface number 0 [ 65.707815][ T31] usb 4-1: config 0 interface 88 altsetting 8 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 65.719039][ T31] usb 4-1: config 0 interface 88 has no altsetting 0 [ 65.728062][ T31] usb 4-1: string descriptor 0 read error: -22 [ 65.734484][ T31] usb 4-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.31 [ 65.743993][ T31] usb 4-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3 [ 65.753378][ T31] usb 4-1: config 0 descriptor?? [ 65.767536][ T31] input: USB Acecad Flair Tablet 0460:0004 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.88/input/input6 [ 65.810473][ T36] kauditd_printk_skb: 5 callbacks suppressed [ 65.810499][ T36] audit: type=1400 audit(1773282880.972:426): avc: denied { connect } for pid=2157 comm="syz.1.584" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 65.836533][ T36] audit: type=1400 audit(1773282880.982:427): avc: denied { map } for pid=2157 comm="syz.1.584" path="socket:[14399]" dev="sockfs" ino=14399 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 65.873316][ T36] audit: type=1400 audit(1773282880.982:428): avc: denied { read } for pid=2157 comm="syz.1.584" path="socket:[14399]" dev="sockfs" ino=14399 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 65.883964][ T2167] overlayfs: failed to clone upperpath [ 65.930940][ T2173] netlink: 68 bytes leftover after parsing attributes in process `syz.1.589'. [ 65.966466][ T64] usb 4-1: USB disconnect, device number 15 [ 66.148060][ T407] usb 5-1: USB disconnect, device number 7 [ 66.164114][ T2183] rust_binder: Error while translating object. [ 66.164172][ T2183] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 66.170615][ T2183] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:314 [ 66.358245][ T2188] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found [ 66.375763][ T2188] rust_binder: Write failure EINVAL in pid:319 [ 66.476530][ T2199] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 66.482840][ T2199] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:329 [ 66.632508][ T2230] rust_binder: Write failure EINVAL in pid:322 [ 66.654756][ T2235] rust_binder: Failed to allocate buffer. len:4240, is_oneway:false [ 66.848056][ T2256] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 66.886578][ T46] bridge_slave_1: left allmulticast mode [ 66.892290][ T46] bridge_slave_1: left promiscuous mode [ 66.899978][ T36] audit: type=1400 audit(1773282882.062:429): avc: denied { connect } for pid=2249 comm="syz.3.613" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 66.906028][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.921571][ T2251] rust_binder: Write failure EFAULT in pid:330 [ 66.928664][ T36] audit: type=1400 audit(1773282882.082:430): avc: denied { mounton } for pid=2249 comm="syz.3.613" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 66.959666][ T46] bridge_slave_0: left allmulticast mode [ 66.965472][ T46] bridge_slave_0: left promiscuous mode [ 66.971550][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.015858][ T407] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 67.100719][ T2258] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.107934][ T2258] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.115082][ T2258] bridge_slave_0: entered allmulticast mode [ 67.121590][ T2258] bridge_slave_0: entered promiscuous mode [ 67.128123][ T2258] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.135356][ T2258] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.142583][ T2258] bridge_slave_1: entered allmulticast mode [ 67.149285][ T2258] bridge_slave_1: entered promiscuous mode [ 67.165921][ T407] usb 5-1: Using ep0 maxpacket: 8 [ 67.176615][ T407] usb 5-1: unable to get BOS descriptor or descriptor too short [ 67.191685][ T407] usb 5-1: config 0 has an invalid interface number: 88 but max is 0 [ 67.200983][ T46] veth1_macvtap: left promiscuous mode [ 67.206606][ T46] veth0_vlan: left promiscuous mode [ 67.212076][ T407] usb 5-1: config 0 has no interface number 0 [ 67.218327][ T407] usb 5-1: config 0 interface 88 altsetting 8 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 67.229409][ T407] usb 5-1: config 0 interface 88 has no altsetting 0 [ 67.238706][ T407] usb 5-1: string descriptor 0 read error: -22 [ 67.245119][ T407] usb 5-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.31 [ 67.254401][ T407] usb 5-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3 [ 67.265913][ T407] usb 5-1: config 0 descriptor?? [ 67.275598][ T407] input: USB Acecad Flair Tablet 0460:0004 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.88/input/input8 [ 67.313371][ T46] vcan0 (unregistering): left allmulticast mode [ 67.349333][ T2258] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.356491][ T2258] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.363882][ T2258] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.371068][ T2258] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.399240][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.410210][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.422324][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.429453][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.440375][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.447486][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.458615][ T2273] netlink: 168 bytes leftover after parsing attributes in process `syz.1.620'. [ 67.478022][ T31] usb 5-1: USB disconnect, device number 8 [ 67.500774][ T2258] veth0_vlan: entered promiscuous mode [ 67.514817][ T2258] veth1_macvtap: entered promiscuous mode [ 67.562129][ T2283] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:2 [ 67.564530][ T36] audit: type=1400 audit(1773282882.722:431): avc: denied { create } for pid=2282 comm="syz.5.617" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 67.616823][ T2258] ------------[ cut here ]------------ [ 67.622421][ T2258] WARNING: CPU: 1 PID: 2258 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 67.631917][ T2258] Modules linked in: [ 67.635901][ T2258] CPU: 1 UID: 0 PID: 2258 Comm: syz-executor Not tainted syzkaller #0 487852573998b859d95f7a0f07f96e56ce6678e4 [ 67.647702][ T2258] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 67.654848][ T36] audit: type=1400 audit(1773282882.762:432): avc: denied { read } for pid=2282 comm="syz.5.617" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 67.657868][ T2258] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 67.657914][ T2258] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 ee 55 99 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 cc 92 4b 03 cc e8 a6 2b 43 ff <0f> 0b e9 3e ff ff ff e8 9a 2b 43 ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 67.689859][ T10] rust_binder: 2249: removing orphan mapping 0:112 [ 67.706830][ T2258] RSP: 0018:ffffc9000dee7b68 EFLAGS: 00010293 [ 67.706858][ T2258] RAX: ffffffff8242b89a RBX: 0000000000000000 RCX: ffff88811f4fb900 [ 67.706877][ T2258] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 67.706892][ T2258] RBP: ffffc9000dee7b90 R08: ffff88812f4012df R09: 1ffff11025e8025b [ 67.730364][ T2295] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=2295 comm=syz.1.629 [ 67.736091][ T2258] R10: dffffc0000000000 R11: ffffed1025e8025c R12: 0000000000000000 [ 67.764407][ T2258] R13: dffffc0000000000 R14: ffff88812f401240 R15: ffff88812f405aa0 [ 67.772462][ T2258] FS: 0000555584d43500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 67.781498][ T2258] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 67.788256][ T2258] CR2: 0000555584d664e8 CR3: 000000011624c000 CR4: 00000000003526b0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 67.795934][ T36] audit: type=1400 audit(1773282882.772:433): avc: denied { open } for pid=2282 comm="syz.5.617" path="/0/bus/file0/.pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 67.796286][ T2258] Call Trace: [ 67.824609][ T2258] [ 67.827650][ T2258] ovl_do_remove+0x7b8/0xcf0 [ 67.832308][ T2258] ? ovl_set_redirect+0x780/0x780 [ 67.837508][ T2258] ? down_write+0xe9/0x2a0 [ 67.841973][ T2258] ? __cfi_down_write+0x10/0x10 [ 67.846910][ T2258] ovl_rmdir+0x1e/0x30 [ 67.851029][ T2258] vfs_rmdir+0x3dd/0x560 [ 67.855323][ T2258] incfs_kill_sb+0x109/0x230 [ 67.860223][ T2258] deactivate_locked_super+0xd8/0x2a0 [ 67.865691][ T2258] deactivate_super+0xb8/0xe0 [ 67.870535][ T2258] cleanup_mnt+0x3f1/0x480 [ 67.875001][ T2258] __cleanup_mnt+0x1d/0x40 [ 67.879540][ T2258] task_work_run+0x1e3/0x250 [ 67.884186][ T2258] ? __cfi_task_work_run+0x10/0x10 [ 67.889386][ T2258] ? __x64_sys_umount+0x126/0x170 [ 67.894799][ T2258] ? __cfi___x64_sys_umount+0x10/0x10 [ 67.900311][ T2258] ? __kasan_check_read+0x15/0x20 [ 67.904192][ T36] audit: type=1400 audit(1773282882.872:434): avc: denied { write } for pid=281 comm="syz-executor" path="pipe:[2939]" dev="pipefs" ino=2939 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 67.905383][ T2258] resume_user_mode_work+0x36/0x50 [ 67.933588][ T2258] syscall_exit_to_user_mode+0x64/0xb0 [ 67.939231][ T2258] do_syscall_64+0x64/0xf0 [ 67.943721][ T2258] ? clear_bhb_loop+0x50/0xa0 [ 67.948500][ T2258] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 67.954602][ T2258] RIP: 0033:0x7f84fc78ff17 [ 67.959112][ T2258] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 67.978807][ T2258] RSP: 002b:00007fffb2bb6ea8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 67.987317][ T2258] RAX: 0000000000000000 RBX: 00007f84fc811c05 RCX: 00007f84fc78ff17 [ 67.995319][ T2258] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffb2bb6f60 [ 68.003344][ T2258] RBP: 00007fffb2bb6f60 R08: 0000000000000000 R09: 0000000000000000 [ 68.011417][ T2258] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fffb2bb8050 [ 68.019476][ T2258] R13: 00007f84fc811c05 R14: 00000000000107d7 R15: 00007fffb2bb9120 [ 68.027528][ T2258] [ 68.030592][ T2258] ---[ end trace 0000000000000000 ]--- [ 68.070657][ T2258] ------------[ cut here ]------------ [ 68.076274][ T2258] WARNING: CPU: 0 PID: 2258 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 68.085892][ T2258] Modules linked in: [ 68.089829][ T2258] CPU: 0 UID: 0 PID: 2258 Comm: syz-executor Tainted: G W syzkaller #0 487852573998b859d95f7a0f07f96e56ce6678e4 [ 68.103092][ T2258] Tainted: [W]=WARN [ 68.106952][ T2258] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 68.117144][ T2258] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 68.122852][ T2258] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 ee 55 99 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 cc 92 4b 03 cc e8 a6 2b 43 ff <0f> 0b e9 3e ff ff ff e8 9a 2b 43 ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 68.142894][ T2258] RSP: 0018:ffffc9000dee7b68 EFLAGS: 00010293 [ 68.149253][ T2258] RAX: ffffffff8242b89a RBX: 0000000000000000 RCX: ffff88811f4fb900 [ 68.157294][ T2258] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 68.165305][ T2258] RBP: ffffc9000dee7b90 R08: ffff88812f4012df R09: 1ffff11025e8025b [ 68.173467][ T2258] R10: dffffc0000000000 R11: ffffed1025e8025c R12: 0000000000000000 [ 68.181600][ T2258] R13: dffffc0000000000 R14: ffff88812f401240 R15: ffff88812f405aa0 [ 68.189739][ T2258] FS: 0000555584d43500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 68.199014][ T2258] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 68.205625][ T2258] CR2: 00007fffb7953f2c CR3: 000000011624c000 CR4: 00000000003526b0 [ 68.213682][ T2258] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000089af [ 68.221781][ T2258] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 68.229813][ T2258] Call Trace: [ 68.233110][ T2258] [ 68.236089][ T2258] ovl_do_remove+0x7b8/0xcf0 [ 68.240870][ T2258] ? ovl_set_redirect+0x780/0x780 [ 68.245988][ T2258] ? down_write+0xe9/0x2a0 [ 68.250469][ T2258] ? __cfi_down_write+0x10/0x10 [ 68.255362][ T2258] ovl_rmdir+0x1e/0x30 [ 68.259492][ T2258] vfs_rmdir+0x3dd/0x560 [ 68.263884][ T2258] incfs_kill_sb+0x1a0/0x230 [ 68.268574][ T2258] deactivate_locked_super+0xd8/0x2a0 [ 68.274072][ T2258] deactivate_super+0xb8/0xe0 [ 68.278821][ T2258] cleanup_mnt+0x3f1/0x480 [ 68.283265][ T2258] __cleanup_mnt+0x1d/0x40 [ 68.287733][ T2258] task_work_run+0x1e3/0x250 [ 68.292360][ T2258] ? __cfi_task_work_run+0x10/0x10 [ 68.297569][ T2258] ? __x64_sys_umount+0x126/0x170 [ 68.302658][ T2258] ? __cfi___x64_sys_umount+0x10/0x10 [ 68.308100][ T2258] ? __kasan_check_read+0x15/0x20 [ 68.313160][ T2258] resume_user_mode_work+0x36/0x50 [ 68.318323][ T2258] syscall_exit_to_user_mode+0x64/0xb0 [ 68.323821][ T2258] do_syscall_64+0x64/0xf0 [ 68.328345][ T2258] ? clear_bhb_loop+0x50/0xa0 [ 68.333052][ T2258] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 68.338998][ T2258] RIP: 0033:0x7f84fc78ff17 [ 68.343453][ T2258] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 68.363132][ T2258] RSP: 002b:00007fffb2bb6ea8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 68.371611][ T2258] RAX: 0000000000000000 RBX: 00007f84fc811c05 RCX: 00007f84fc78ff17 [ 68.379713][ T2258] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffb2bb6f60 [ 68.387801][ T2258] RBP: 00007fffb2bb6f60 R08: 0000000000000000 R09: 0000000000000000 [ 68.395853][ T2258] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fffb2bb8050 [ 68.403845][ T2258] R13: 00007f84fc811c05 R14: 00000000000107d7 R15: 00007fffb2bb9120 [ 68.411870][ T2258] [ 68.414904][ T2258] ---[ end trace 0000000000000000 ]--- [ 68.535014][ T46] bridge_slave_1: left allmulticast mode [ 68.540862][ T46] bridge_slave_1: left promiscuous mode [ 68.546596][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.554524][ T46] ªªªªª$: left allmulticast mode [ 68.559728][ T46] ªªªªª$: left promiscuous mode [ 68.564731][ T46] bridge0: port 1(ªªªªª$) entered disabled state [ 68.709655][ T46] veth1_macvtap: left promiscuous mode [ 68.715193][ T46] veth0_vlan: left promiscuous mode [ 69.039005][ T46] bridge_slave_1: left allmulticast mode [ 69.044689][ T46] bridge_slave_1: left promiscuous mode [ 69.050385][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.058025][ T46] bridge_slave_0: left allmulticast mode [ 69.063689][ T46] bridge_slave_0: left promiscuous mode [ 69.069467][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.077454][ T46] bridge_slave_1: left allmulticast mode [ 69.083130][ T46] bridge_slave_1: left promiscuous mode [ 69.088899][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.096651][ T46] bridge_slave_0: left allmulticast mode [ 69.102307][ T46] bridge_slave_0: left promiscuous mode [ 69.108173][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.116305][ T46] bridge_slave_1: left allmulticast mode [ 69.121963][ T46] bridge_slave_1: left promiscuous mode [ 69.127621][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.135432][ T46] bridge_slave_0: left allmulticast mode [ 69.141481][ T46] bridge_slave_0: left promiscuous mode [ 69.147243][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.400804][ T46] veth0_vlan: left promiscuous mode [ 69.406387][ T46] veth1_macvtap: left promiscuous mode [ 69.411898][ T46] veth0_vlan: left promiscuous mode [ 69.417600][ T46] veth1_macvtap: left promiscuous mode [ 69.423140][ T46] veth0_vlan: left promiscuous mode