last executing test programs: 1m3.817333365s ago: executing program 1 (id=228): r0 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000380)={'team_slave_0\x00', &(0x7f0000000200)=@ethtool_sset_info={0x14, 0x0, 0x101}}) (async) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000380)={'team_slave_0\x00', &(0x7f0000000200)=@ethtool_sset_info={0x14, 0x0, 0x101}}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) utimes(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)={{0x77359400}, {0x77359400}}) socket$netlink(0x10, 0x3, 0x6) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) (async) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x4, &(0x7f00000002c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab602000000ee8100e2838c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") ptrace$getregset(0x4205, r2, 0x200, &(0x7f0000000080)={0x0}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000040)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, &(0x7f0000000200)=""/161, 0xa1, 0x1000000002, 0x21}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x0, 0x32}, @flat=@binder={0x73622a85, 0xb, 0x1}}, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 1m3.802010656s ago: executing program 1 (id=231): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') (async) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = socket$igmp6(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r1, 0x3a, 0x22, 0x0, 0x0) (async) r2 = socket$inet_icmp(0x2, 0x2, 0x1) bind$inet(r2, &(0x7f00000000c0)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) (async) mount(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000580)='tracefs\x00', 0x800000, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) sendfile(r3, r0, 0x0, 0x80000000) 1m3.754211911s ago: executing program 1 (id=233): mount(&(0x7f00000000c0)=@sr0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='ext3\x00', 0x200400, 0x0) ppoll(0x0, 0x0, &(0x7f0000001a00), &(0x7f0000001a40)={[0x1a1e]}, 0x8) mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000), 0x20000328) socket$nl_xfrm(0x10, 0x3, 0x6) 1m3.725082103s ago: executing program 1 (id=234): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x800, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x11) mount(0x0, &(0x7f0000000180)='./file0/../file0\x00', &(0x7f0000000000)='binfmt_misc\x00', 0xc00, 0x0) chroot(&(0x7f0000000100)='./file0\x00') (async) chroot(&(0x7f0000000100)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000003c0)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000140)='./file0/../file0\x00', &(0x7f0000000240)='./file0/../file0\x00') signalfd4(0xffffffffffffffff, &(0x7f0000001400)={[0xffffffffffffffff]}, 0x8, 0x80000) (async) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000001400)={[0xffffffffffffffff]}, 0x8, 0x80000) flock(r1, 0x8) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f00000000c0)='./file0/../file0\x00') (async) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f00000000c0)='./file0/../file0\x00') r2 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r2, 0x0, 0x4, 0x0, 0x0) setsockopt$inet_opts(r2, 0x0, 0x4, 0x0, 0x0) (async) setsockopt$inet_opts(r2, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x737f0c77864bf3b9, 0x408) (async) openat(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x737f0c77864bf3b9, 0x408) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCFLSH(r3, 0x400455c8, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x72, 0x0, 0x0) ioctl$HIDIOCGFIELDINFO(0xffffffffffffffff, 0xc038480a, &(0x7f0000000040)={0x3, 0x200, 0xb, 0xf6d5, 0x9d1, 0x6, 0x7, 0x10, 0x80000001, 0x80000000, 0xffffff5f, 0x6, 0x8, 0xfffffffc}) socket$netlink(0x10, 0x3, 0x0) (async) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000005f000100000000000000000800"], 0x1c}], 0x1, 0x0, 0x0, 0x44000}, 0x4) (async) sendmsg$netlink(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000005f000100000000000000000800"], 0x1c}], 0x1, 0x0, 0x0, 0x44000}, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 1m3.211559184s ago: executing program 1 (id=239): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="44000000140001000000000000000000020000000400000014000100ff01000600000000000000000000000115000280bf"], 0x44}}, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) socket(0x1e, 0x4, 0x0) madvise(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xb) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40080}, 0x4000) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_DEBUG_SET(r2, 0x0, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r3, &(0x7f000000c3c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000000040)={0x50, 0x0, r4, {0x7, 0x1f, 0x0, 0x10408, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) syz_fuse_handle_req(r3, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0x20, 0x0, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) dup2(r5, r3) ppoll(&(0x7f0000000100)=[{r5, 0x40}], 0x1, 0x0, 0x0, 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r6, &(0x7f00000041c0)={0x2020}, 0x2020) poll(0x0, 0x0, 0x6) close_range(r1, 0xffffffffffffffff, 0x0) 1m3.14612957s ago: executing program 1 (id=240): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder1\x00', 0x800, 0x0) (async) socket$xdp(0x2c, 0x3, 0x0) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_mreqn(r1, 0x0, 0x20, 0x0, &(0x7f0000000300)) (async) socket$xdp(0x2c, 0x3, 0x0) (async) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x2028, 0x1) (async, rerun: 32) close_range(r0, 0xffffffffffffffff, 0x0) (rerun: 32) 1m3.082547985s ago: executing program 32 (id=240): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder1\x00', 0x800, 0x0) (async) socket$xdp(0x2c, 0x3, 0x0) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_mreqn(r1, 0x0, 0x20, 0x0, &(0x7f0000000300)) (async) socket$xdp(0x2c, 0x3, 0x0) (async) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x2028, 0x1) (async, rerun: 32) close_range(r0, 0xffffffffffffffff, 0x0) (rerun: 32) 1m2.592579534s ago: executing program 4 (id=241): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000680)='./binderfs/binder0\x00', 0x802, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc73}) ioctl$KVM_CAP_X86_APIC_BUS_CYCLES_NS(r2, 0x4068aea3, &(0x7f0000000240)={0x79, 0x0, 0x3f2}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x11) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0xaaaaaaaaaaaab5d, 0xe6, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r5, 0x4080aebf, &(0x7f00000022c0)={{0x0, 0x0, 0x80, {0x0, 0x80af000}}, "cdb372b4dfe02964a59572ecc37526989e90f15cc175ae8c93ae45591f356c6884a1eb49a1ccc74c2260aded1979bfd746a27408d1220c39493a1d3b65f5306464393183b3b654e5237f83855fde05bc36e88baa2c07c6acd1e5d8c2b3736f1ec8fb98c1b5c20bae0c02c146f4182375c277e8647f577021416f8ba515ffa35cddd261d521df3e841a9179cda39879511c2e9ab06778ce9ffa6f2c9370d7af33bc74d16360a42aa2ced6433463ef4bbed671371e8eba18f2aa913f65ff1b5b35c7c67638ba4aaa64a717f556fe32f70ab1f227b75eaace9c63811a4abc99987e6c8964cfac90a0ca3384510dc63e3e3935540ce749bfa6a8785ee00fe862262ce28ff980e350a64be310b5f576ccfb5a2ba166b324b4bbe9f23030a79f16f20258d077d87f7b1e5b8ca402ce6e51b3236729fde5e6f96d7a94c8db3cc00fdab35e2544ebb424632bb9d82cbfb21146bfeb80e5f5e26ed89a6c521920b5c02cd9cf8063e1ef18919946124f64f749f5c2e3d603af2b7a2d2d24acb6ebe5f47b988dc50e690d9aea44fece3a353bae1b80dcae49c8cb6443978623b0ec80cd0feb0a134a51fdd2b1912a45c6ca41414273268c676bbef4ab3e2f7ac5e061d6dcf0041af2cc971a27b616444ae913033933ed4b1d89b96c8ee9edc86ee12d5917695796906d4822fb3a931df763e3a8e8893ae4749765bdbae4377ce47fb5e26890cb5178c03dd0df248bf35caf84f3cea3d778086065dbb0cd51ea04f28dd6ce80820fda0ffa3f33d38adb2d68d41db8ab27d4cad8b7abb026827738fb9c59d043199cd27c2bdf9711acb36926c730e216de7ad2de0326676916586ec8325f4b13735e34c4d60bd27e2fde3edc95dc59cb69c1dc25569da425488b6b6e9a63b17964ce1fa57bf2c7508ed199cf64a5cbc23b01cdf08b1ad4337f1b0aa02a6c137fb90e32fd7e204966170aa80fca868a45d496be7758c47f83760208793eb1600b6ebf4d1d2dcaa2b741f1c0b9f8844b9e68ec7f7123083c6926a1e95fe9b75f16064f213f69f8f1a97b66961279a6aa3498f146f7e517c2f5a9c0b0673b93dca4fe0c48d53c8f5f89bb7ab0476e00a13e020370077a55c28abccb585bcbdf29966a4db1c3ab0f3f58e54640032484e08072aac638b9c9dc9655a525e9016d9b24358ba477695875e3abd484ff3adb92069825841c3bd1870f708cc25288ee5cc4a6d7fab62eaa724a7acb4ee5952db977b4da11597891f5c5af6086ddf387deb19ce0995ba175f830c94b5adac04d8618a262b3059fe96d5b18690e5adf3e592ae77fed8214ef468d0cacdbbdb1712cff009e03146b57bab5b8302a5ed0f75f59c63877ad8fea5ec596c667ffc2337343e1726e79985bf7c663f8dca6ae731dd96486568d0c0e4c3a3860d7250e04373cc55018eda3ac9077cd2c5317df8992b548e34344ca97a9ed3b6f8bf1a97e060231657706c9e8ce8f03805b111d4bf1a559f4cf0822a20cd9ce06b56c5f051317e187d76a303af82d2053286d5d3cee381602170f5bb4036fb34c080992e9f7d509aa230935233dac608f533ae2a26c5e5710e6c2ed1bf61303cc3c47465791333dae385f91de77c3357fbedbbb64ae3b868ee90b98ab647fa0dcc85bfbab33058667b95106519c7ba80246f73391919fb575dedfe436fb190e828fd58ac25537a4ba5ef0a97c595ce67a740d1cfd84a05d3462d9203dd6ea94f60dc03a29c3c81aa25dce4b330fa7500234016373add8120018ea6b5fac8597fcc8404c793658db3277e2a7e042cb56420002922183f14af74d970dec12a781763c1d9d69cf664b065a9b09491b1ff043e9c9a2098975c17e82a5d06b9f1081c43a539669e95991d866f3105e0b327ab8659e23bf1b196603c7406221e47494b765a114077187295dfafc261ea9ad3064b3449c6e8ef5e2517f609995adf82710d6c23a83e06f61c8186017afa6b2de5b28082770edfc81ee72e46fd1365d0a7583e3609ce420e54cc7a2d57542b924c6c5c9c896d068912adf22a97b3547502d0181d2c69729c539921ab16c466ba6d1d518c3e787fb0e9f708c9a1bc6d428355f0a3bd574397a6f8eda6a1503854a1bd4004719db60a9b3fefe434464d9f2aaddf44ee98c503ac606b7d4d8bac4efa557a77fa5a31ed8c8b48cd1ee6e4e7731ffb273bf21838f4e0cb8eec8a2cbd8acd40c15fcc3959ec3b4ea86680fb1e65743acfc164c6ae830f81a00c83102085d6ae8c7b4424ee0e86673015d98449252de73a25bfbe1697ff06aecf299b2a0e7ce452ba6bcba6b6da2c494cf0ce51cbb555cc2a371bf5a595748486825b0798221f40d2c29396431d13a03248874b893c7880d3b87cf845858a31f68fe57b032e3e0204fd4fb23fd5b2357d8e4f6052dd058b3bf6cd913b4341446e62895d6a367e4233e25ef3aabfb7f35a7804938e3181b6f551ac4a947ff016a12dffb53e7101b6ee911fac7637b2786cf95a4611376d0ac7b1e61c763040550e0c00ddb39a11086e08941c518a5ebedcff2c9477f7be26ad4dc48d837b85d082b4a54c8ec3f1caff75f7fb8f1282df6c5b336c2e56c0f35d9c5dd38fc91001e950f5fb41b58a620a9ee5e6b001a637aad4ec9ffd09eb762fd0d1d8058ca0e544329ee8693547095264c46d9b716fe56ff991b28dc056caefb0d08c0c509ab0eafeffc280684f8654b18323eddff28b4e778a674b4d5b85df786bb12ca24e1980e56032d1d32eb472954eed24b99bbc404dc920e16d4f8e792d6fe581efa82420085955ab9716dc642b44e2a9215cdaaf3df4fa5ad66a26804ad87b7520c132fdb595ea560eb408b5d519cb31c2c6ed2a16fe971d7ca71b7530af7478f06509cc988b96b27dd3e667ce4b08ca685ae818527103addba74d71d094e7a58325658343b989a1d973fc9f1cfebe848c35279cfff728928f77af22430daee46cc9242fa4afe5197e6b42811396f9136fbd545826e020a910fa790acf9292472b7ee3b34723d6f56781d5c061be6e535e49bfcc292a1208645c730b6aadc94e56f05c6f8ca71c7fde81b687190accb75b08f131d61d6536cb3810eb2b6006336f700f1e6ea8104de9c9c6c9f4566a3783d253e3153e9550b91d547430bbe6dc23d31b930692f2a2c5b009fa44c416bfbe28e524ee6a2d0b016331037010fa882db5d35cfa359d1c7a173cf913e11b8888d0f37b75011f26ce9f97b132dd6f50cbf4bd7d1f9201c55ade10bdb4e2df4a3b35d2980bf8ee63b8091fed356f764c0bbcc95a91afeb4a2c1deb3fc0c44fa76d768fed87d737bb3380794e4b67932e7492e654cca53599a446664031ef83e6a6d5362d89eac11c767932f477201d2953b4bb6058f4a3baca2968719edbf41ca5da5be2efeb9bceb38e2f1394ff41d9e93ecc746175b8e5fa2f5bf903663cebc1266ca7a2f8c57340c1ef42e4fc8a85d76ce24237d16f1ac13d32bfd1121017e9a72ad3fb0e952a296ff9a79bdc5be6d8691696720d97daa7c27fb9489e47584c00c854779de5980490afbacad0d0774a7f13e424b0ea955a87b7e296a40eca7ab8f45ae76170da77fff6b554c50dcdc6a261e8ebb7d2f24583023d001ff218ec7844fb4640736f04e9f7d968aa74bef26f65eae961a4857a946d3b221818a798d65bf74f8c0ac1b4529e36183c49606890643573722d467f4c464e68069955e561ccfd4423c2a240cfbb96efb668844ba0a1ceb910ad4ef06cd0f13f7ffa85744bdd0dd16ca27f62179b3916868187421b6d9f9c698d6542a02d4c124373ce0f10cbbc6b9a18385d99519f06a24aa9a4f5560157880233ee8352f2e9de0ffa333bb50932587a70153a37f25263693b86dd6a61f7d1f40cac0f205b65fa2faa3098254fb084160c271addea6711ecae589870450b941db419bb27c8b597982b704ba0ea0189e7b5cd6b72e3529cd77e4a79c752f2f7af6aa43ec9eb0bbefc91a02a85871771189c1f9a0742e8e6fc2d71575e20631dee592f0ed44c9d8f6a22e7d7844445066ca5e8bb97dd5c2ca0365d7c33563ceca884e8e14ba21733c4d2415c1be9369298fbd616fd792bd767555aa2deec8f45e92e10fcc88079cf0093ca2e38adc797845548005a0660b5cbf6423d966ebdccb6ce9d5d476bfd562dff0dd1f8e576d424c0f5cbfe68a3a571e860e5665861a133bc8eb3d9838e9a88f18edb12dfec18a488ad1177ca22f6f763beee9c1e0dd61344997dbbc6de56800f15d2b04a4d83a0b79adb12c54aa7c418d8fd0c96b5797a003b8313d14093fdadd4b530233dd1176e86090e0cc5401d6f98529de8bb6094b8e2f02b53f562a4c115655dc2619811d8caade655b767a5d4fac6c10784bf5bb06e9f535fd1304f383e39bbc5ce58a5f2f9deb9af1d6df6b491fbcbb9053f9bc73da0ae2e815ae72aff41c71ab7adc71074dfa6906724f18b74a344f7911994ee8ee843fd991de053dd9fae152d02b4fe0818c6313aee7df2f32009221f6c2d0ef9b53b7c2e795d64dcae34e5fab88e6b112b935fa836c6868f72077c57a42a940d3c0a667f3d0b674a3de2aa8c3443748c3a5ac949f72ed49220a9cbf0896794f58e12b74a1d7c7bbf8bec7d8aa055855c34a6c25d6fddd22a73725ca3daf8e357b8173508be65d329a4b97820cdb1c7a98d222a839b4da2a33ac687ab4004f5e1d90be7dad53a50ab4d6bc04135e0a9f31af27dc75eae3b9e7fd7459455a4cdd7faf94c5fe701d66d2006719b9acb72db3c89ca61bddea7c0be7ec769ec1cbfae11a77f36a59966f042e5dd32ece56932b083f0cb68c92194c6a4ca0267186b5f3ebaa25f63b6a1b60a2a5c78b9b5b488962b2ce4854b51ab2bc001231b6be3fcdc5563b0950165da87745e387c1205ba818287a8cebfaae10ff461c2933d775c6cddaa936d1907e29b5b4e1ef0a000aafab5363dd692560a291a71f06552647144cac4884a8ae8f2dade616384eeafa54f84737d1613beb945faaa4a316ee2e2a3a094187b5edba42358e930c89bfeaf4620bada8aa6d6c8800d1b19548a308b8310a0b51c8ccc7db60aa2a04fd8b21769a32eded238f93f476b69a6548a8a17aee1d0c4476db41e4eba24d9351d3f98fac043f423ffead379b6cbfb05aaf705ff0dca6e5f6ba36d00d1bc98714a92c8ac1e7cbf441521c98e2b913dd7a5d8595e0479537029de96e2991652243fe3093594720a0538b1687711bf0bc46a1453ebe60c5d33bd798b66f19e69c90e55c2b68b62d1a759a3519630798dd4434fa658b013e28fe9befca82abc1f89a3b246f2fd44df84f88dab2792fc67b3ef2ef8eef84e441e2a7ff5a83e3784a5636a7d4775f5b3063d8e190bfcedcd8083d864d0cbb2fcca7af05cee2be552d89c801e760348dadf01ee4dbb9fb09d5b6c993ab9ac9ff7d5e1e104ab3a894f6cc9067ad64c5a97d3e12efd17820b3c07e4ce302a20fd4c5b5de8752bc4e609fbe9e6cebe713f309229883790ab6dffc22864f7b02fd9026a07299f8cf1e799acdd448428199165abf20eee23988cfcad773c7bc483f941f994c07f255e6cd72e7198f34bcbcbd801abb84e6e383d7bf6e217ee0281f4691beba5d17ef8bd59d7474540dda647ca3bdb8e280a2e6b7a7688bc677a25b2186b1e59e637737366733d75f02a597b7cabb18e75a1722d2327f4f2f101955ca88636ae97d5740ba61d7867c5141becd39f7fc5abb5b9614040995046c2ab369ac46c18159d5a3569df964e69e7686471ac756bf0515fee78904fe8fcec2096b5f3e", "8f9bea13d6c1793efefda669a3bfc1a1f2d2afea1c14a5b35aac4a522cce409cb88f5802ab78a0dc4ad9e13501a073e6fc60f1778eecc8a6f5299ba9f7dcdab9079dc269bb0d7bb287afa53a930cfb99ca80b3c23dd58d7a4d8ceadf2787fc4f8c638dcd55f8e962ef362db8ae2d407ea8f04c151b89947d52c901335b5ca070883017289368b02ae4676286906bf2f984ae3b2f4ce4d345ea814a725ef388f09b6b6dcc519515885e6e5062d9cd7e801d8a14b1c5b86c404a3bcfb968a48710eb7c451630b0e3895739f51e1379f25a9848fd01021cc53ab10691091090b2cad44133a51465c16c2257cdde467cdae5616e809ad2f3ca71a0b4ae46b5b62142b1d6f782c4286dbea20f02bae71821c1c956172806c55069c3e33f8811a31a44856a1d0521c3e81c12b6dcae2b0e5f006a9468614031c6ad977aa589e4076f55a5528d7b408fd429da83d78bc7dbb794b4117379334fb9167b872d0459a457ae425f768052a583f23ff60a29f11659756f40240b1939fb8b72c3fbe3963680fdcc09900ab387757c9146d223ccdfd5aa26682d39aee3e4b327748d02f82964c117fd480804952654de00db09934cd5c1786b35453f18515ec8f28ee9aee0bfd367eafdfccb54ed29fd08bbea75ed8b6a93c23cb337ae900ba89dcbb3d87191e1e56de67175572aa09f2eaa4fc1f31055b08ce99c30dadc63c743de7fc3e5e0511c98d6b37132f66f09577f6a5f9d113865830876d2f33887136d976525d195790184b7eeaf82169128911c37856b5e75db9999269b252f12d07c62236fac6835a3c13261c527d03d33df946ddfa40c85548ddb9179cf5d963246e215fa0f76472f9f24493aad8db71422f1d1c31a454980f2499294f858de9e8a4937f832b21104c843d084ba15466453f9fd830a1d7d5dbe801ef67c2d6ba52cefcaffa798dd47e9d1e94729956b62ccaf200ff3c32e41cabf86de920f74e1c9e00391909b622505388a3d297b4095f5aa3c17ef5e68c4b3ff18855fd13ff2fe3b1746155d149baaead01ce8d975730b235b1fca6a158f219d3256489d1421e9a008434ae4acc01e583a3145633bd217a6b74d4165fddc31499b6bde7341aad811e80ee6aefdb5aa993926b57d90c0098babdf172c2ec2fe85ba0b75bdc898ba9a2dc7383533b70f3eae8c5c91526a9d5aa99f4a91c9a4235b05558f9871f1e2254a2300e7bd5b4c0fa0bae78e00a53400ca2d1bd03f9d47c82a0e8a17519b53ab0274dd5fcab49ef76a567c156b947b38744657321da66d2983024a67adc00adcde04f35fc2cfeb39c0adcaa508ee7cb8b7a6b73b4deeba620538003f11f390d108c466a2058db84b122b62844f6aebf2d119ea050ba34a1152c439b4ee0491d9417398ec2b7154bdb39ffadb6385c52108f61cc0847cc8e499b3009b00ea000d1c84848c8213d82aa2c87d9c7b15fdf23454190b5c18f563985383a42c2d600155970c15cde8da2d14ef5908704966c286d59a5141bff15ed1e8b7c1252d8cbd641c70f8129ca870fa1235155cf642095b20d88de5c0a0ac6e8969c05996481d1e8e7f9cae627ad6cd374bffa2c8714c84e735384c4064c2e194f26ea16d3d99259cc394d2c4553578ad251c3fe2b88b316dd3533b644ec59390868fe5e7f79fa721ae8dd5ded8ceefaad3879b8c5577bb831079b44fab7db38f0b61d74ed192b2c61cfe6bed13049db2c6b85434e46194230ab022f7d74be00a844023b0e33cbf1d2b4d0ad3e61b950cd9801941fd8e5d4b90154ae9f173b42fcd658190758f21af8ff9086d4eb12bc3496bfecd99211c1048b3ce4dd25f0934d7f17d45f50084c4ef7c31625080a1c1cec43922d89d1945f675d980e8f2b374c198fb6e857d099c33aeececaac17ab9c12c343051e7dd2f8786883339dbc643af493745974a4da505844e0419dbddb4eca492713d006a5ff47d78dfac1642acab8caa7bda595b6b9532edf6da9ee99711822fabf8e8783dc8f156d1490f40ed6aedb4f97ce55269a2070b4aa3fc51ef22d9fa8342a03ef1b27831f83ade237f4344797eb29f9bbc6aced4005f4b379a1e0b060b4f9cbfce975b9bb2b53e1228c91753a7dfe6d67282d565c1ef42a15c1ff0d49f1128694336eaa277fd691de0748740241edb9250ab53e53523b2217fd4d554fe482c35d8ebdce8c2d053ea2b035a5e8f9ea2e683b24e418698e48b6bb8275c6938c61a6fcafb1f7c73a344db76bdc8cafb1a07000000e62e3d9b92ad50241ec0908d73255cb72ab5d144757a55c116343e6e6c61bb0999615ddca343e02a5e3438cc9f66b1619c4467b12e615918d2f27392977775c165530dc0059bb41bd6103e612ef5bcd7f2df54ab86a05836b0bb685c05e935da8dfe4144217603c6e4f703d8062af788c7acf61285baaf7c7043a0602fbe8d61daabcf07156f7ee60debca3787d1f4b60f39c341df2908bf7944a5753883626920f1e82eeb374409fa0b331053a9c6bd3ab48682d228ec04d7cb3eb94917d00bc97b46ec14f1681013969cda5ea2c95fa390b3d6422ce0ac242690fbf352d757c9fbc66d06b0e4578e43f032c5f033d54618d178ef0fabdb00108d23cae66bd4ce059709b01e5b8ffec5595865a1c77c0bd8a1f2cb5f13d2b49450b23d021f64247966fd07bee6538fb0565b7eb41489566bc066107a345d705335bc918fe2e3c4edc50872fd25933aaa908cd78eec4e414d46c035c734af8a5b8d47fe62a4a9c49da0cf6547cc8d6702a2468c8d6fbe0ec7d90888d0bf3a0c7c42507d0baf458ce087d4c7725f42edad430abf233b064186c111b4c1fc2861e74426a31d04e2ade9d7acd8f0ac376b712d1eb20175b93b6900291b5625f90276f0857af6b0d108ddb0d772f501e687196c7caafc90010403596a6b5735e28ec6363896c8719e6002dcea716038e7b773c250c98aae730a7f39d995d0c737ff6e29c7a548c69896355b73d50eff7f7a1238f66601d10e4ccc6fb5e924a59bb41da1eba811f5acb22e8bc3719f3568d0fdc0868b29df0727f5cd50290a1845e22d523cde3002560fef504bd2c9a291c7a81a4f2b5b8a015f379009e3e8baed5d35c4a03e09afd37d7fe9d86e86eb53701ae8016d5a19ce5e96e11549ba09e3c2a6700ea84796091f6ca47d4c68fb1e6f4448e1b72f6d4b8af491b635208b31356140db8134e5a1594e47c7ad68dcd2399f49731c60f5f6c101955d4c31275df3d4ce3207e8dc03b87cae229f1f1d09f0064ef7b0727f787efef0369222717129287a9b3a375e6aadd40b6fdaea3d43cd59febe098b7f80d72343bb147a20b22b5de8fbd32bf4ce64f3ad2510dad9c243327e7c706b06004d1cb82edcc113d74bb9cb820e360c9a8992b884a65234b93250f7ff8e7271983c6505cdf0524b5a8e60f8b3d86281a903ee62d3010d62a788d360182c1106486ee1673f5b7da5a2a154cbe53697305907f64140283f78b9b3b78d2a420586bbac1f72b4388258a0e7c1cc26048cbf3e47c593e9d3300e98931801efc3bdd0ed74e0d3b4f881c66b71a401d9719a1231394ffd04b35bb3c5dcc5ee18696e8327ef9f0f7d8ee218662ec6e747d5c009ba9462d0fba519be8f5f951a5bc077a6eaca928536f35e5929863357cc025fb80c5806d3b7a9f2645e1f6d3239bf763e9ff16fe6bf30d6139f2a117fa1db0d6d2c6aaecf1cacc1b28b24587c9bfd48e52f37651cc97c35d3dc3834b7f973213d0edefdf42a239da89bf1b735767f9e38119de3fd24dbdb34c38068888dc8ff11d19b1950772e283903ce51b1c13e86d58b283dc8f8a3c9456115b19a0561f3aa9c7eca553c4e5bfc20b5da4b32e607a57c2577ab2a65cedb2dd754a2363b37b138ea37e2e3546eea289da7475850e393e7331416bcf4ec75f0c6e654df1fc513e0dcc52ba57e9a128d148cf42d35fb9c7168c959e1ed6e4811fba1662c22194101a6d8787e037a35888117c854a2ef8f605076771ab5aefc8135cfa4c2a25680c6566e0fd19eee7cc86ece140efb6fab4200eabc09d834239abf5f48b46ea51797ee393693270da94c3e73859c01d1042e2eff0b1c4ed41ea560f38b8483d94b9dace687bbe8993fc4e2872b686bf299bb0dce34874d940fd2c36b5270aedd09e5e5a952d70f191e011c7e269219477fe8f5ded564f14fda6461b64d84ec32543a7ed663d8d27d8b8893942e0b7167f3f7b936f8f1fe623248d9815c5969f3a22f0fdefb527d9a870d7ece5430a9adcfee9eef05d235a0c87989965b20bad18c96d696e817c95693fec426ff81f1250e81c244058722243cb3e2df722ac46554a368a90a81206628fcc889cca832a8d4ed20188db0005b1b1c494e3dcce0622dd72ee35f4b4ac447909937bf67807344f5a629230752645aee6c70a885a80ea0e491fdef70648bfa0060ad78b122f2cc0637feb6c5754073d71326bb5a5c0b8c9890fffab1360d647d3a7b4e4bfb29c3162f311d7a1a41c3c5f739542ec723fff2c1e086dd79b1f22f3ff5a512e7ec7dfa54cc6883ae22b949139b1f029f8674ea97c5fb8125a3dafebddd524acdd1618c9f9b9fdf0ea659c4bd4b8da12cae75d1f5ae611b8fa7fd23ff0ff7dcf8a10540120d03d72db15d0775075c1c30ba7e6a07ee6633fa6fa396ca3a5799a7905db5d49e8e8ce00eb7a9af5f2c60749bc28c4b188054e21f44f28d2d1258326ae27a1b14d4704ffb93ff506bbf07e0e4e1bf2502fce11eeb83b9c491a68db0744a61ec449f5338c0b40d77ed16de2d935320bbd2cea2a164f26e7b619ddd81448009adeadfdcdead9df5a1c6da9aca64f373dfaf7cb940aac9f5eedb7a5d49eb74dc0e0819b05f328e9a4ddf3ef0a27cf01a853e02bc69970a32930c48509d726600dc7ee95e119d4cb28f87aa13b7ff846c338b5f9090586ff7bd983721d4a4b5a2e9a3e1495644483bf14861d524196f0d73265688794d6b3b4ce8b3f994c56a82a02a35aeaf9f79c08f5280a6ba0187eae965e412f14cb379869c997564b0a37349dc535882d5d4054d18bf44cbfccbdb8b377761096c974b3dde6a9dc767937bc3430a7fb614671e73ea867b4cd499f2581766510ad70811cda49b69b5afd380ae2ad43281e6640d4f20b2615f3c0b20f7d45c69a9cbbe7933776e07043b141664c059f1c6de17d44eed8b6242d6e8e8b3b86cff4306a9657e6d6f0c429f52138c6c5f7d155bc713432ca75bbf77c3a2c06e546474a7c327d10c46be64e6729643a9455420c48677a23c92f05e3e56f70100000000000000600739cd068305bb6aea50d5d1042f821e78f2942d603c46a1e4541756bac183b640935dffe8309e3e90a170ca3d126375a0177b1d94b72b622607af60a2cfb9b63464689237fcdbb752e89335aa96c615a59e39fcd89a3a39445e78fb5dd4912b16850863305496ca80974c3d39892a255f9a26b438662e6bc67e1d5115acff5bee940368df7e182ac1cc24331adb6e155ecfa1257d2f47a6b959f2bcf2dfbf86613c7761746ed85fd7e2a3c7c8602ee5143b100bd0a5026146becd255004fd8728bcfad605fad03e754ff1245e7716884e7e6898158ca4e9ba58cf09d8afe65fc18c2529b43a14e7eb7451b8072d68124be7b9133301d840191435de4704e2dda8ccfa87013f733aa10431faf7e46be7a391809af91e5e98d63c80a13c4b4fbb95b44ae5540f62f43036daef02b5dd404c0b08d46fa66fbdf0b4ed839494aa4c85194dac555e4061481c6717a3306700"}) r6 = socket$netlink(0x10, 0x3, 0x0) writev(r6, &(0x7f00000000c0)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e570028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, &(0x7f0000000100)="da0c6b660f38809d5e6e000026400f07b8010000000f01c10f01c2c442fd023e470f0177233636450f01c40faef00fc72a", 0x31}], 0x1, 0xf, 0x0, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x141e42, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r9, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="020000000000000008010040"]) ioctl$KVM_RUN(r5, 0xae80, 0x0) mmap$binder(&(0x7f0000ff8000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x7) mount(0x0, &(0x7f0000000180)='./file0/../file0\x00', &(0x7f0000000000)='binfmt_misc\x00', 0xc00, 0x0) chroot(&(0x7f0000000100)='./file0\x00') mount$bind(&(0x7f00000004c0)='.\x00', &(0x7f0000000500)='./file0/../file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000140)='./file0/../file0\x00', &(0x7f0000000240)='./file0/../file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f00000000c0)='./file0/../file0\x00') mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(0xffffffffffffffff, 0x29, 0x37, &(0x7f00000006c0)={0x0, 0x40, '\x00', [@hao={0xc9, 0x10, @mcast2}, @padn={0x1, 0x9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @ra={0x5, 0x2, 0x1}, @padn={0x1, 0x2, [0x0, 0x0]}, @ra={0x5, 0x2, 0x400}, @padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @calipso={0x7, 0x18, {0x1, 0x4, 0x9, 0x3ff, [0x1, 0x3]}}, @generic={0x1, 0xeb, "19dd11ed0e6409e4fe44efc0444b0c551bfaa53d81d1e2bff0e3cfe6caeef62230941dfa8bc1e062462d5e5379feccdab942c0fe436ab8d372496bec5d0f18e4c34b5cc301e38bc8ae5641b16e9bb0593617446b630bdbb97382e49a0e4e5f75e7e74cb180ec2b018d0c177419d20a884811771a2636f90072a5f2896aae340e717beef5bf656783e3d1de33d112bfbaa92b11bd24471868c1130fb83fecabd6083cf2ab141787cc0d288ad1c98ed67ab1e2ba67651da39a75eb92924ec1393855e5fdc3b8b70bf309b79ef938b40c519b135f8f0da672967b7510623d8fb1e1cfe7dc27c66599b8985456"}, @generic={0x4, 0xc7, "62f1187257399bb069f20a52e94cc93245409161c3be6de0850984db66093518d06e7973167fe43ec3dd5fb900650fd7004420fdf59a214ced665598b0e8fb04e9dc7710265dae6f836968469fb72fcad4d3b6a7663af08262aac9e6198142bc5fea1080eaa8bb26fdebf93edb6b84fc96308742fd036da5255b04db69dbb051b6a4368347c5786efb029e18c732eca7b6923d0dd3f6e8de3e3d86a24e1b5a391f7051100b1f0d9074f16aa2d0a12187856a1a6724a208a472fc6c150098d5236dd704749e72f3"}, @ra={0x5, 0x2, 0x4}]}, 0x210) 1m2.323950096s ago: executing program 4 (id=247): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006340)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)={0x150, 0x0, 0x0, [{{0x3, 0x0, 0x0, 0x0, 0x10000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}}, {0x0, 0x0, 0x8, 0x2, 'group_id'}}, {{0x3, 0xffffffffffffffff, 0x0, 0x0, 0x746, 0x0, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x8000}}, {0x0, 0x0, 0x8, 0x4, 'group_id'}}]}, 0x0, 0x0, 0x0}) r1 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) getdents64(r1, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x200, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r3, 0x4010ae67, &(0x7f0000000380)={0x2, 0x102000, 0x1}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r3, 0x4010ae67, &(0x7f0000000140)={0x4, 0x4000, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0xe6683000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) fstat(r5, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(0x0, r6) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r8, 0x5452, &(0x7f0000000040)=0x8001) r9 = getpgid(0x0) fcntl$setownex(r8, 0xf, &(0x7f0000000140)={0x2, r9}) sendmmsg$unix(r7, &(0x7f0000011500)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000000)="11", 0x1}], 0x1, 0x0, 0x0, 0x4004040}}], 0x1, 0x40015) 1m2.307258268s ago: executing program 4 (id=248): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x11, r0, 0x147a5000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800001000088}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @mcast1, 0x4}, 0x1c) socket(0x18, 0x2, 0x0) getsockopt$sock_buf(r3, 0x1, 0x19, &(0x7f0000002f80)=""/217, &(0x7f0000003080)=0xd9) fadvise64(r0, 0xa, 0x400, 0x5) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') setgroups(0x0, 0x0) read$FUSE(r4, &(0x7f0000003440)={0x2020}, 0x2024) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000300)={0x0, 0x16, 0x4, "94c161ee"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x1c, &(0x7f0000000140)={0x0, 0xf, 0x4, "02000000"}, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, &(0x7f00000005c0)={0x44, &(0x7f0000000480)={0x20, 0x6, 0x7, "79eac1c9695cf6"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, &(0x7f0000000180)={0x14, &(0x7f00000000c0)={0x20, 0xd, 0x5e, {0x5e, 0x23, "587513243773587b30327d6a7b6d1f0579e3e00fb966b6793307a4f1def4ff39c01583c20273679b33b89333f2d33526cde72c3efb4cdb62e3662e666c91e8177c80f38baf94f342edf453d6e226eeec5739ab203060ddbc75937340"}}, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000400)={0x1c, &(0x7f0000000300)={0x0, 0x30, 0xc9, "76d6ae97d62ba348776b8d5ad46daff255a71b315a041e79f847d63067e81b795bfd4e0c7319317ceaeaea4d53f0a1764a4875b20e3c81fb14bd201ed9b60d08df6e4966a65ba3b470bbb10c268ef9ff4914ac8aa02d71d038cbcd86612132cf6af62b0c0bf32b6998483079b508c4cdd536b32149920c73d1715b17660f366851008459f9d6e1ab4cce3f1a661867bf560e2bd1e775682f9ad1ba0e78680b5af2f337822c1e35f2f07821acb4f41935671d8c243da66971917b9349e2c6d1b32297b393fa0b3e532c"}, &(0x7f0000000240)={0x0, 0xa, 0x1}, &(0x7f0000000280)={0x0, 0x8, 0x1, 0x3}}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/kheaders.tar.xz', 0x1, 0x2b) 1m2.262848101s ago: executing program 33 (id=248): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x11, r0, 0x147a5000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800001000088}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23, 0x4, @mcast1, 0x4}, 0x1c) socket(0x18, 0x2, 0x0) getsockopt$sock_buf(r3, 0x1, 0x19, &(0x7f0000002f80)=""/217, &(0x7f0000003080)=0xd9) fadvise64(r0, 0xa, 0x400, 0x5) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') setgroups(0x0, 0x0) read$FUSE(r4, &(0x7f0000003440)={0x2020}, 0x2024) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000300)={0x0, 0x16, 0x4, "94c161ee"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x1c, &(0x7f0000000140)={0x0, 0xf, 0x4, "02000000"}, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, &(0x7f00000005c0)={0x44, &(0x7f0000000480)={0x20, 0x6, 0x7, "79eac1c9695cf6"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, &(0x7f0000000180)={0x14, &(0x7f00000000c0)={0x20, 0xd, 0x5e, {0x5e, 0x23, "587513243773587b30327d6a7b6d1f0579e3e00fb966b6793307a4f1def4ff39c01583c20273679b33b89333f2d33526cde72c3efb4cdb62e3662e666c91e8177c80f38baf94f342edf453d6e226eeec5739ab203060ddbc75937340"}}, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000400)={0x1c, &(0x7f0000000300)={0x0, 0x30, 0xc9, "76d6ae97d62ba348776b8d5ad46daff255a71b315a041e79f847d63067e81b795bfd4e0c7319317ceaeaea4d53f0a1764a4875b20e3c81fb14bd201ed9b60d08df6e4966a65ba3b470bbb10c268ef9ff4914ac8aa02d71d038cbcd86612132cf6af62b0c0bf32b6998483079b508c4cdd536b32149920c73d1715b17660f366851008459f9d6e1ab4cce3f1a661867bf560e2bd1e775682f9ad1ba0e78680b5af2f337822c1e35f2f07821acb4f41935671d8c243da66971917b9349e2c6d1b32297b393fa0b3e532c"}, &(0x7f0000000240)={0x0, 0xa, 0x1}, &(0x7f0000000280)={0x0, 0x8, 0x1, 0x3}}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/kheaders.tar.xz', 0x1, 0x2b) 6.817167418s ago: executing program 5 (id=698): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000000040)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x8}}]}}) timer_create(0x0, &(0x7f0000000040)={0x0, 0x15, 0x0, @thr={0x0, &(0x7f00000002c0)="f0b2f779e23a"}}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCSIFBR(r1, 0x890c, &(0x7f0000000000)=@generic={0x1800, 0x2}) r2 = syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') read$FUSE(r2, &(0x7f0000000980)={0x2020}, 0x2020) 6.807209049s ago: executing program 5 (id=699): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./file0\x00', 0x4) mount$incfs(&(0x7f0000000580)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f00000005c0), 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8c) r2 = openat$incfs(r1, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r2, 0x40306727, &(0x7f0000000240)) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) ioctl$F2FS_IOC_GET_COMPRESS_OPTION(r3, 0x8002f515, &(0x7f0000000040)) sendmsg$NL80211_CMD_REQ_SET_REG(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000003d00)={&(0x7f0000000180)={0x24, 0x0, 0x1, 0x70bd28, 0x25dfdbff, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1}, @NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'bb\x00'}]}, 0x24}, 0x1, 0x0, 0x0, 0x20}, 0x4000) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x200, 0x4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000001c0)={'veth0\x00', 0x0}) mkdirat(r2, &(0x7f00000000c0)='./file0\x00', 0x80) sendto$packet(r4, &(0x7f0000000180)="0b041000e0ff020002004788aa96a13bb1000000000088641100", 0x10000, 0x0, &(0x7f0000000140)={0x11, 0x0, r6}, 0x14) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x7, 0x0, &(0x7f0000000000)=[@increfs_done={0x40106308, 0x2}], 0x50, 0x0, &(0x7f0000000380)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) 6.79584071s ago: executing program 5 (id=700): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg$unix(r1, &(0x7f0000000900)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000380)=""/37, 0x25}], 0x1}}], 0x1, 0x400120a0, 0x0) getpeername$unix(r1, &(0x7f0000000000), &(0x7f0000000080)=0x6e) r2 = fcntl$dupfd(r0, 0x406, r1) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x1fd) fsconfig$FSCONFIG_SET_FD(r3, 0x5, 0x0, 0x0, 0xffffffffffffffff) fsconfig$FSCONFIG_SET_PATH_EMPTY(r2, 0x4, &(0x7f0000000100)='(\x00', &(0x7f0000000180)='./file0\x00', r3) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) close_range(r0, 0xffffffffffffffff, 0x0) 6.663902411s ago: executing program 5 (id=701): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x89a5f000) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000440)='./file0/file0\x00', &(0x7f0000000040)='./file0/../file0/file0\x00', 0x0, 0x8b101a, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f00000001c0)='./file0/../file0/file0/../file0\x00', 0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x103) ptrace(0x10, r1) wait4(r1, 0x0, 0x2, 0x0) ptrace$setregset(0x4205, r1, 0x1, &(0x7f0000000100)={&(0x7f0000000040)="dcef58b7f29c1f7c93d183044aedba283413e674c7719c33a4b17f028f68610a6c55bb2bf8282853f3e16f8394a8676ff55a3507e2ad50248c6130863b0f7433c7fbc9b978a39eae88bffd05d139cedbee444f7c98e1f92b0f64462b4b470bedced2125e0b1f38fbaa348c6d75aa1a4011e9cdae15ecb9309b0101edbf6dd6d111d6132f1821a4e4cbec8438c571a70e7ca7b0451a6cc55c", 0x98}) ioctl$KVM_SET_GUEST_DEBUG(0xffffffffffffffff, 0x4048ae9b, &(0x7f0000000000)={0x70003, 0x0, [0x8000000006, 0x8eba, 0x1, 0x3, 0xfffffffffffffeff, 0x8, 0x1, 0x4]}) ptrace$setregset(0x4205, r1, 0x1, &(0x7f00000001c0)={&(0x7f0000000000)="c945b941eb6a3f6dedf11f1508685636", 0xfffffffffffffda4}) fadvise64(0xffffffffffffffff, 0x3, 0x0, 0x4) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fd7000/0x18000)=nil, &(0x7f0000005700)=[@text32={0x20, &(0x7f0000000240)="66f08fbb1bb9710a00000f32c744240005000000c744240280190000c7442406000000000f011c24650f01cfb931080000b862940000ba000000000f30b8220000000f23c80f21f835000020000f23f8c74424000e000000c744240240930000c7442406000000000f01142466ba4300ed9a610000001300", 0x7f}], 0x1, 0x30, 0x0, 0x44) r3 = socket$netlink(0x10, 0x3, 0xf) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000480)={{0x6000, 0x6000, 0x0, 0x9, 0x1, 0x1, 0x2e, 0x7, 0xa, 0x0, 0x4, 0x7}, {0x10000, 0x4000, 0xf, 0x6, 0x6, 0x1, 0x10, 0x5, 0xdf, 0x5, 0x94, 0x80}, {0x0, 0xdddd0000, 0x8, 0x8, 0x2, 0x10, 0x9, 0x8, 0x8, 0x9, 0x0, 0x4}, {0x3000, 0x10000, 0xf, 0x80, 0x0, 0x0, 0x81, 0x7f, 0x7c, 0xa, 0x8, 0x13}, {0x6000, 0x10000, 0xf, 0x1, 0x2d, 0x7, 0x2, 0xc0, 0x1, 0x1e, 0x9, 0x4}, {0x80a0000, 0x2000, 0xc, 0x3, 0xf7, 0x4, 0x2, 0x10, 0x7, 0xdc, 0x5, 0xc}, {0x8000000, 0x2, 0xc, 0xbf, 0xa, 0x2, 0x9, 0x7, 0x4a, 0x4, 0x4, 0xcb}, {0x1d004, 0x80a0000, 0x8, 0x6, 0xff, 0x7f, 0x6c, 0x3, 0x6, 0x0, 0x6, 0x2}, {0xeeee0000, 0x95}, {0x100000, 0x4}, 0x80000019, 0x0, 0x4, 0x408, 0x9, 0x800, 0xeeee8000, [0x36, 0xffffffffffffffff, 0x0, 0x2]}) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r4 = socket$unix(0x1, 0x5, 0x0) r5 = dup2(r4, r0) close_range(r5, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) 5.835988318s ago: executing program 5 (id=704): r0 = socket(0x1e, 0x4, 0x0) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x3}, 0x6) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f0000000140)={0x1d, r1}, 0x10) (async, rerun: 64) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (rerun: 64) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_INTERRUPT(r3, 0x4004ae86, &(0x7f0000000040)=0x1) (async, rerun: 32) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x22000, 0x0) (rerun: 32) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x11, r4, 0x147a5000) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) pread64(r2, &(0x7f0000000080)=""/25, 0x19, 0x81) (async) ioctl$F2FS_IOC_PRECACHE_EXTENTS(r4, 0xf50f, 0x0) (async) ioctl$KVM_GET_DEVICE_ATTR_vcpu(r5, 0x4018aee2, &(0x7f0000000000)=@attr_pvtime_ipa={0x0, 0x1, 0x1, 0x2e6f}) 5.749480315s ago: executing program 5 (id=705): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x20002, 0x0) open(0x0, 0x15b341, 0xfe) unshare(0x68040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x6e) r2 = socket$unix(0x1, 0x2, 0x0) bind$unix(r2, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) bind$unix(r3, &(0x7f0000000380)=@abs={0x1, 0x0, 0x4e21}, 0x6e) mmap(&(0x7f00006ff000/0x4000)=nil, 0x4000, 0x1000002, 0x4010, r0, 0x45809000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) r4 = fsopen(&(0x7f00000000c0)='udf\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, 0x0, 0x0, 0x0) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x1cbd81, 0x0) ioctl$BLKRRPART(r5, 0x125f, 0x0) 5.645807933s ago: executing program 34 (id=705): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x20002, 0x0) open(0x0, 0x15b341, 0xfe) unshare(0x68040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x6e) r2 = socket$unix(0x1, 0x2, 0x0) bind$unix(r2, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) bind$unix(r3, &(0x7f0000000380)=@abs={0x1, 0x0, 0x4e21}, 0x6e) mmap(&(0x7f00006ff000/0x4000)=nil, 0x4000, 0x1000002, 0x4010, r0, 0x45809000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) r4 = fsopen(&(0x7f00000000c0)='udf\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, 0x0, 0x0, 0x0) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x1cbd81, 0x0) ioctl$BLKRRPART(r5, 0x125f, 0x0) 5.379377254s ago: executing program 3 (id=713): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x57788000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/profiling', 0xa0042, 0x0) close(r1) socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000022, 0x0, 0x0) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', 0x0, 0x2c000, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r2, &(0x7f0000000100)=ANY=[], 0xfffffe3e) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000000)=0x9, 0x4) pipe2$watch_queue(&(0x7f00000000c0), 0x80) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) write(r3, &(0x7f0000000200)="89", 0xffe3) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x2000, 0x2, &(0x7f000050b000/0x2000)=nil) 4.503924626s ago: executing program 0 (id=724): ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000000)={'syztnl2\x00', &(0x7f0000000080)={'gretap0\x00', 0x0, 0x20, 0x7, 0x6, 0xff, {{0x19, 0x4, 0x3, 0x33, 0x64, 0x65, 0x0, 0x36, 0x2f, 0x0, @local, @multicast2, {[@timestamp_prespec={0x44, 0x34, 0xfd, 0x3, 0x5, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x3}, {@remote, 0x6}, {@empty, 0x2}, {@broadcast, 0xffff8fba}, {@multicast1, 0x7}, {@rand_addr=0x64010101, 0x1}]}, @ssrr={0x89, 0xf, 0xd5, [@remote, @remote, @empty]}, @ssrr={0x89, 0xb, 0xbb, [@rand_addr=0x64010100, @loopback]}]}}}}}) sendmsg$xdp(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000140)={0x2c, 0x9, r0, 0x6}, 0x10, &(0x7f0000000600)=[{&(0x7f0000000200)="e804209f8e84235eea7c250693bd45d6617bb46da993be562c157deb8d", 0x1d}, {&(0x7f0000000240)="a20077fcb851cda9b0b635b56e1a269cc499be94c21617b3bf64a8fbc45104c6380c5056741dddaa7143ab5640307ab582fc4de30ef34afb264af9f86f250f72c4e393b622968f13268ecdcd9d910491b462d38c34b82eb99eeb5a3a92552c80c17d7730fc7de84d09d51ab06a0e03474296bc9770cddeb2118b9d9b11f7200d900a46a697699ccf551cdbc958ac975a3f2d406a7409069b32c1036484fab285eeead73ab8f179b60db4b376c900a2a97fd5a5dae08b3c252505df9d75517a46a34af2d68eee2abcca179e81d888", 0xce}, {&(0x7f0000000380)="c14baef1752c25e7d822b8bf930ea30e93ebbe535124df48d84fc6d6bd6cb888a7dbc40099efcd2c45486a41574a8888520eb9f1bc637216c0b4303d29cff69c5ef7cdc13ad68006db99c4dce0461ed48c3e6a4f00f2df500c42e58e28f860dfe41b5625aa9195cc50a0bc6aff192a75f2fc9834719f6ab2472bb0c19573e0d5a9b6943c8fb2741bf80c1a7dec6c8e9a7601540115d048cf41b1e9318989559788e849f2e1cf4eecc953007ba7695282a4f059b52f3aaa2fa68e7f4eb77c91c76a7074ac2763d40c6133be4bce0b432dd4eae385b25811ddaf89a0d9b005f0d87b6818", 0xe3}, {&(0x7f0000000480)="2b622767239c2d07a3712f094c85dfdc8dd8eef61027", 0x16}, {&(0x7f00000004c0)="4221269e658a1e479522d5f7d20d4da83f1c20ed9463420640feaa063b018cbc3d360687c382c07bf26ea25062ab9c5b51c7989c0317b73888c94fa881032439c10db08fd99cec09a966573e8b99baa5fc4a99fc80612293a77ef7fbbeb680220a6a439ca1831972028bac8d298b46e1640084aada49097b11f1563379b0d67aa6295fa62bf3c8cc803032b9ca876316e04da56fe60a38632a50ae7a35a4893127590bc36a19c88fac773d763a364fc261e8de5d66cf8b419297209431f65ceb4ecf87ff4d002a60f5299efea55e2941755a21", 0xd3}, {&(0x7f00000005c0)="3a8962da2ed04f5060bfa500611e9cb36bf6fc37e91cf60531c66d50ab6495c29b1f017cd8d232a0754a3a2dc7791a6491ed18758a080848b6b0dd", 0x3b}], 0x6, 0x0, 0x0, 0x40084}, 0x4004) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300030e000000000700000000000004000900a0000000015204f089b96478db1d8a5f756509e977fb1a030000000002000100000000000000020d1600003f030006000000000002004e21000000800000000000000000030005003200000002"], 0x70}, 0x1, 0x7}, 0x0) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r2, 0x57788000) r3 = socket(0x10, 0x80002, 0x0) sendmsg(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000040)="24000000180003041dfffd946f610500020100000005fe060c10880008000500fff3c00e1400", 0x26}], 0x1}, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) 4.503685615s ago: executing program 3 (id=725): io_setup(0x3, &(0x7f0000000200)=0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) io_submit(r0, 0x5a, &(0x7f0000000a40)=[&(0x7f0000000840)={0x0, 0x0, 0x0, 0x3, 0x1, r1, 0x0, 0x52}]) mkdir(&(0x7f0000000080)='./file1\x00', 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) close(r4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000140)={'syzkaller0\x00', @random="371692e7f7ef"}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) close(r6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random='\x00\a\x00'}) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCFLSH(r7, 0x400455c8, 0x2) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r9, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc73}) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r10, 0x4004ae99, &(0x7f0000000040)=0x2) ioctl$KVM_SET_VCPU_EVENTS(r10, 0x4040aea0, &(0x7f0000000080)=@x86={0x7f, 0x3, 0xfd, 0x0, 0x1, 0x7e, 0xcb, 0x10, 0x8, 0x5, 0xb, 0x8, 0x0, 0x10003, 0x9, 0xff, 0x4, 0x2, 0x12, '\x00', 0xb}) ioctl$TIOCVHANGUP(r7, 0x5437, 0x0) 4.425956762s ago: executing program 0 (id=726): r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000020f25c100c00000000000109022d0001000060000904008002030000000921060400012205000905810320000908070905020340"], 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) mount$bpf(0x0, 0x0, 0x0, 0x958028, &(0x7f00000001c0)) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) futex_waitv(0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_ep_read(r0, 0x2, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r3 = socket$inet6(0xa, 0x3, 0x84) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000080)={'b', ' *:* ', 'r\x00'}, 0x8) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000280)={{{@in=@local, @in=@rand_addr=0x64010102, 0x4e24, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x7, 0x0, 0xfffffffffffffffb, 0x9, 0x6, 0x0, 0x40000000000000}, {0xffffffffffffffff, 0x1000000000, 0x53e5, 0x20}, 0xfffffff7, 0x1, 0x1, 0x0, 0x3, 0x2}, {{@in=@broadcast, 0x1, 0x32}, 0xa, @in=@private=0xa010100, 0x1502, 0x4, 0x0, 0x0, 0xc36, 0xfffffffd}}, 0xe8) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x1c, 0x2, 0x3, 0x5, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_VERDICT_BATCH(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[@ANYBLOB="14000000f0a701012da0ba4e4fadadd565c7e500"/31], 0x14}}, 0x0) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="640000000206010400040000000000000100000005000500030000000900020073797a32000000000500040002000000050001000700000005000400030000000500050002000000050004000100000011000300686173683a6e65742c6e657400000000"], 0x64}}, 0x90) r6 = openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) ioctl$FS_IOC_RESVSP(r6, 0x40305828, &(0x7f0000000540)={0x0, 0x0, 0x100000001, 0x9}) r7 = syz_open_dev$usbfs(&(0x7f00000002c0), 0xfffffffffffffe00, 0x202180) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x802, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f0000b62000/0x3000)=nil, 0x3000, 0xe000, 0x3, &(0x7f0000bca000/0xe000)=nil) mremap(&(0x7f0000241000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) ioctl$USBDEVFS_RELEASEINTERFACE(r7, 0x80045510, &(0x7f0000000340)=0x4) unlinkat$binderfs_device(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00') 4.196061561s ago: executing program 3 (id=728): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001fc0)={0x54, 0x0, &(0x7f00000003c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x50, 0x18, &(0x7f00000002c0)={@fd={0x66642a85, 0x0, r0}, @flat=@handle={0x73682a85, 0x100}, @fda={0x66646185, 0x2, 0x0, 0x29}}, &(0x7f0000000100)={0x0, 0x18, 0x30}}, 0x40}, @increfs={0x40046304, 0x2}], 0x0, 0x0, 0x0}) 4.1951724s ago: executing program 3 (id=730): sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000002140)={0x18, 0x50, 0x1, 0x0, 0x800000, "", [@typed={0x7, 0x3ffd, 0x0, 0x0, @str='\x00\x00\x00'}]}, 0x18}], 0x1, 0x0, 0x0, 0x4000001}, 0x0) sendmsg$can_raw(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000880)=@canfd={{0x1, 0x1}, 0x39, 0x0, 0x0, 0x0, "3992ca995e968b0b065f7922b761528f0199602d1e09faf0c0f1c2db040f957a34b2aa413157e3ec06fdcf6128269e6763e9c19b00d4eb026a6375a22b930a64"}, 0x48}, 0x1, 0x0, 0x0, 0x8490}, 0x1) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r1, &(0x7f0000000040), 0x10) listen(r1, 0x0) r2 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r2, &(0x7f0000000080), 0x10) connect$unix(r2, &(0x7f00000002c0)=@abs={0x0, 0x0, 0x4e22}, 0x6e) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000000a00)=ANY=[@ANYBLOB="12011001070102109806826bebc30102030109021200010600b06a09043b05005639ad000038ee485af79c5d02d5551b25b39ff0894a4e8aef40e98c8aa0f842e9cbf6074555d3d3910eb2bb1c75e3dfe0a6c739e085e9d58cb0d02fdee1e241bec7d80512cd97ad3a3974f2cfa82466317c671a591801b6f7ba22ab0768cad7e7239b9e3f8c6bf11a920d29281ab3a5f2c4d89d2ab256fda4e8932e7e9e4b8f76d857861a470287f31cec7463948377dc5cf4e93ecab99b37e7e3929010c8884f84fa431cfe7c69d343b62a091ff3191d4bf9134385b3186f3a924563d65e64565f302db1d290f954c8ce7c88d010af529119865d49d843074b5cee22f2704fcb273f8cbeccbbed7890ff74d8f9d3d2bd0492c65f23fc0c2ceda698cda4ed80eff35d1196b5c61947941bf5b20ceb7616b2be5fb063bf3819631e7c6399bef48ddc839140071dc7a66ddac93e78b5744284a7faf3359bf4d9db42d379d524d8e30f82ff60439b8c9649e0f8d756b7db0a2f6098567034776b06f09f59f1f0599d7974e16d82a26aef1cd72aa45bd8260aba1bca579bf1c79aee38049225052c97e00ae0d3fecdbabd8527a80833977685aa87c48f1ad836fbaf7845fcee7a89a972d37e318f4f0548f95cb3368e1a67461ab969dc9bbd3cc0"], 0x0) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000200)={0x8, 0xeeee8000, 0x2, 0xffffffffffffffff, 0xf}) r4 = socket(0x10, 0x803, 0x0) sendto(r4, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r4, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4085, 0xff5}, {&(0x7f0000000580)=""/106, 0x6a}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/141, 0x8d}, {&(0x7f00000001c0)=""/17, 0x11}], 0x8, &(0x7f0000000600)=""/191, 0xbf}, 0x5}], 0x1, 0x2000, &(0x7f0000003700)={0x77359400}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000006100)='cmdline\x00') exit(0x3) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000040)='TIPCv2\x00', &(0x7f00000000c0)='/dev/kvm\x00', 0x0) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0100000000000000000017000000540006803c00040067636d286165732900030000000000000000000000000000000000000000000014000000e3de3d7b4cd07ec3ee777de774fc7987cca41989140003"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) 1.650270837s ago: executing program 6 (id=752): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0xfffffffc, 0xfffffffffffffffd}, 0xc) r1 = socket$inet6(0xa, 0x3, 0x4) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000180)={{{@in=@broadcast, @in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x2, 0x0, 0x0, 0x0, 0x2}, {}, {0x0, 0x5}, 0x0, 0x0, 0x1}, {{@in=@private=0xa010102, 0x0, 0x32}, 0x2, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0) write$UHID_INPUT(r2, &(0x7f00000016c0)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125c7ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb32bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bd6c108fab3591bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd52a44fec4f6f1a6f65158bb6911c295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2034fae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b8b74e26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd4829bbc2850cd4901389e6ea6e86041e0efa1158f334e7afda0e11c2971f29d9364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c6692abb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b29674bfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bccdf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b42a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e807df4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d672250658bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfdb0c06c721f7c24ad8cce383623fc2dcb15ac56438ea331820ae59c8c474e36fc73f7b1b3b86df1b42490815513681a03007e871befae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4659698549646bd63175adf77b5cdcfe676e1b1a9af15102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4b9f6e46a8ce73eb22f3bb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f842629049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21bbfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e00686a3ed49dcfb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7c5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9f058cc048f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cf8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46070039116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002af6a6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b42e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae6644493f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fb930e7a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4bc700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4305531f13ecb1a775d0bd881a00", 0x1000}}, 0x1006) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0) clock_adjtime(0x0, &(0x7f00000001c0)={0x7, 0x7, 0x3, 0x6, 0x1, 0x1, 0x84fa, 0x401, 0x7ff, 0x7, 0x1002, 0x201, 0x699, 0x401, 0xffffffffffffff01, 0x81, 0x100000003, 0x174, 0xffff, 0x5, 0x7, 0x8001, 0xda, 0xa60, 0x80000000, 0x5}) getgroups(0x3, &(0x7f0000000000)=[0xee01, 0x0, 0xffffffffffffffff]) setregid(0xffffffffffffffff, r3) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x802, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r6, &(0x7f0000d84000)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_int(r6, 0x29, 0xb, &(0x7f0000000140)=0x3, 0x4) setsockopt$inet6_tcp_int(r6, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r6, &(0x7f0000000240)=':', 0x1, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty}, 0x1c) sendto$inet6(r6, &(0x7f0000003ac0)="efc177", 0x3, 0x40000, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r7 = dup3(r5, r4, 0x0) r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/pm_print_times', 0x1813dbc5d6db9452, 0x92) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000340)=[@reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000240)={@fd={0x66642a85, 0x0, r8}, @fd={0x66642a85, 0x0, r4}, @fda={0x66646185, 0x1, 0x0, 0x1d}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 1.624290279s ago: executing program 6 (id=753): r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000200), 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ac0000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c00028005000100000000000800074000000000180006801400040020010000000000000000000000000001"], 0xac}, 0x1, 0x0, 0x0, 0x20000051}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x3a00, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="ac0000000001010400000000000000000a0000003c0001802c000180140003000000000000000000000000000000000014000400ff0100000000000000000000000000010c0002800500feffff7f00003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000aa0c00028005000100000000000800074000000000180006801400040020010000000000000000000000000001"], 0xac}, 0x1, 0x0, 0x0, 0x4000}, 0x4000894) 1.620128649s ago: executing program 6 (id=754): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x10000, 0x0, 0xdddd0000, 0x1000, &(0x7f0000160000/0x1000)=nil}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r4 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x200802) ioctl$EVIOCSABS20(r4, 0x40044591, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000000)={[{0x4, 0x200, 0x6, 0x4f, 0x19, 0x7, 0x2, 0x1, 0xff, 0x5, 0xc, 0xf2, 0x9}, {0x8, 0xaef2, 0x10, 0x8, 0x4, 0xe, 0x8, 0x3, 0x4, 0x13, 0x1, 0x6, 0x10005}, {0x0, 0x7, 0x10, 0x10, 0x25, 0x9, 0x1, 0xfb, 0x6, 0x15, 0x1, 0x3, 0x80}], 0x9}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x6, 0xfffffffffffffffd, 0x0, 0x10004, 0xffffffffffffffff, 0x4002004c4, 0x1000, 0x0, 0xfff, 0x10, 0x0, 0x0, 0x0, 0x8, 0x3], 0xeeee8000, 0x2451d4}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_GUEST_DEBUG(r5, 0x4048ae9b, &(0x7f0000000300)={0xd0000, 0x0, [0x7, 0x4, 0x7ffffffffffffffd, 0x5, 0x100, 0x9, 0x2, 0x74]}) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() r7 = userfaultfd(0x801) r8 = openat$sysfs(0xffffff9c, &(0x7f00000000c0)='/sys/power/wakeup_count', 0x42, 0x0) write$cgroup_subtree(r8, &(0x7f0000000400)=ANY=[], 0x31) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x280}) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_WRITEPROTECT(r7, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000c89000/0x3000)=nil, 0x3000}, 0x1}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) r9 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r10 = eventfd2(0x6, 0x80800) ioctl$KVM_HYPERV_EVENTFD(r9, 0x4018aebd, &(0x7f00000002c0)={0x400002, r10}) 1.488682309s ago: executing program 6 (id=757): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x20002, 0x0) prctl$PR_SET_MM(0x23, 0x4, &(0x7f0000ff9000/0x4000)=nil) prctl$PR_SET_MM(0x23, 0x6, &(0x7f000060b000/0x1000)=nil) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x11, r0, 0x45809000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) syz_open_procfs(0x0, &(0x7f0000000040)='net/raw6\x00') r1 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000002200"], 0x1c}], 0x1}, 0x0) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x20081, 0x0) ioctl$BLKRRPART(r2, 0x125f, 0x0) 1.463357911s ago: executing program 0 (id=758): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@allocspi={0x114, 0x16, 0x2, 0x70bd25, 0x0, {{{@in=@empty, @in6=@mcast1, 0x0, 0x6, 0x0, 0x100, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x33}, @in=@remote, {0x0, 0x0, 0x0, 0x0, 0x1f}, {}, {0x0, 0x0, 0x9}, 0x0, 0x0, 0x2}}, [@replay_esn_val={0x1c, 0x17, {0x0, 0x70bd25, 0x70bd2a, 0x70bd2d, 0x70bd25}}]}, 0x114}}, 0x40040) sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=@allocspi={0xf8, 0x16, 0x1, 0x0, 0x0, {{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x33, 0x0, 0xffffffffffffffff}, {@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x0, 0xfffffffffffffffd}, {}, 0x0, 0x0, 0x2}}}, 0xf8}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f0000000180)=0xc) sendmsg$nl_xfrm(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000001c0)={&(0x7f0000000580)=@allocspi={0x104, 0x16, 0x100, 0x70bd26, 0x25dfdbfb, {{{@in=@rand_addr=0x64010102, @in=@multicast1, 0x4e24, 0x4e, 0x4e23, 0x0, 0xa, 0x80, 0x0, 0x87, 0x0, r2}, {@in=@empty, 0x4d6, 0x32}, @in6=@remote, {0x80000001, 0x1, 0x1, 0x9, 0x3, 0x7, 0x3, 0xffffffffffff8001}, {0x8, 0x80000, 0x80000000, 0x6}, {0xa, 0x63a3, 0x3}, 0x70bd2c, 0x0, 0xa, 0x4, 0x0, 0x30}, 0x0, 0x7}, [@policy_type={0xa, 0x10, {0x1}}]}, 0x104}, 0x1, 0x0, 0x0, 0x400c080}, 0x20000000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001440), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001500)={0x34, r4, 0x1, 0x4000, 0x0, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_COALESCE_RX_MAX_FRAMES={0x8}]}, 0x34}}, 0x0) mount$binderfs(0x0, &(0x7f0000000040)='./binderfs\x00', &(0x7f00000000c0), 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB='max=00000000000000000000001,stats=globCl,stats=global,max=00000000000000000000003,max=0000000000000000000001:,silent,rootcontext=']) 1.36000247s ago: executing program 0 (id=760): creat(&(0x7f00000001c0)='./bus\x00', 0x11f) r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x6, 0x400) openat$rnullb(0xffffffffffffff9c, &(0x7f00000001c0), 0xa8002, 0x0) inotify_init1(0x80000) (async) r1 = inotify_init1(0x80000) inotify_add_watch(r1, &(0x7f0000000240)='.\x00', 0x22000000) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1\x00', 0x101042, 0x171) dup(r2) (async) r3 = dup(r2) pipe2(&(0x7f0000000180), 0x0) (async) pipe2(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$binfmt_misc(r5, &(0x7f0000000080)="9f55", 0x2) splice(r4, 0x0, r3, 0x0, 0x8f, 0x5) (async) splice(r4, 0x0, r3, 0x0, 0x8f, 0x5) ioctl$USBDEVFS_DISCARDURB(r0, 0x550b, 0x0) fsopen(0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) r6 = syz_open_procfs(0x0, &(0x7f0000000080)='auxv\x00') pwritev(r6, 0x0, 0x0, 0x7, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) munlockall() (async) munlockall() ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, 0x0) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r7, 0x40046210, &(0x7f0000000100)) (async) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r7, 0x40046210, &(0x7f0000000100)) 1.227866161s ago: executing program 3 (id=762): mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) ioctl$TUNDETACHFILTER(0xffffffffffffffff, 0x401054d6, 0x0) mkdir(&(0x7f0000000200)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@verity_off}, {@xino_off}, {@index_off}]}) r0 = socket$nl_route(0x10, 0x3, 0x0) setreuid(0xee00, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000100), 0x6, 0x12000) read$FUSE(r1, &(0x7f0000004180)={0x2020}, 0x2020) r2 = getuid() write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000001fc0)={0x4c, 0x0, &(0x7f0000000240)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) setreuid(0x0, r2) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000000)=@generic={0x2, 0x1}) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') quotactl_fd$Q_GETFMT(r1, 0xffffffff80000401, r2, &(0x7f0000000140)) read$FUSE(r4, &(0x7f0000002140)={0x2020}, 0x2020) 1.201408723s ago: executing program 3 (id=763): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) ioprio_set$pid(0x1, 0x0, 0x0) syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_connect$uac1(0x1, 0x96, &(0x7f0000000400)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x84, 0x3, 0x1, 0x9, 0x80, 0x9, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xd0, 0xf4}, [@selector_unit={0x6, 0x24, 0x5, 0x6, 0x6, "a9"}, @mixer_unit={0x7, 0x24, 0x4, 0x5, 0x5, "d08d"}, @selector_unit={0x7, 0x24, 0x5, 0x4, 0x3, "ced3"}, @feature_unit={0x11, 0x24, 0x6, 0x1, 0x4, 0x5, [0x9, 0x9, 0x6, 0x5, 0x8], 0x3}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0xe2, 0x1, 0x5, {0x7, 0x25, 0x1, 0x81, 0xd2, 0x3ff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x458, 0x28, 0x8, 0x8, {0x7, 0x25, 0x1, 0x80, 0x40, 0xfffe}}}}}}}]}}, &(0x7f0000000980)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x63, 0x0}, {0x57, 0x0}]}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) syz_pidfd_open(0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) sendfile(r0, r0, 0x0, 0x7ffff000) 1.107904311s ago: executing program 0 (id=764): r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$USBDEVFS_GET_CAPABILITIES(r0, 0x8004551a, &(0x7f00000000c0)) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x42002, 0x180) lseek(r1, 0xca3, 0x4) sendfile(r1, r1, 0x0, 0x11ffffffffffe) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, 0xffffffffffffffff, 0x0) r2 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d6f64653d303030303030303032303030303030303002343030303006000000725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x200, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) symlink(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='./file0\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r4, 0x4010ae67, &(0x7f0000000380)={0xffff1000, 0x11a000, 0x4}) r5 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r4, 0x4010ae67, &(0x7f0000000140)={0x4, 0x4000, 0x1}) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) mount$binderfs(0x0, &(0x7f0000000000)='./binderfs2\x00', &(0x7f0000000080), 0x4, &(0x7f0000000240)=ANY=[@ANYRESOCT=r1]) 1.107572141s ago: executing program 6 (id=766): syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x8000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0xe5444000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xffffe000, 0x0, 0x4031, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80e02, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000cce000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x4d, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000200)={0x2, 0x3, 0x3000, 0x2000, &(0x7f000036f000/0x2000)=nil}) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') getdents64(r5, &(0x7f0000000340)=""/79, 0x4f) exit(0x8) getdents(r5, 0x0, 0x3b) read$FUSE(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6}]}, 0x10) bind$bt_hci(r4, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000cce000/0x18000)=nil, &(0x7f0000000180)=[@textreal={0x8, 0x0}], 0x1, 0x71, 0x0, 0x0) madvise(&(0x7f0000363000/0x4000)=nil, 0x4000, 0x17) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) clock_gettime(0x4, &(0x7f00000004c0)) socket$netlink(0x10, 0x3, 0x0) 943.110064ms ago: executing program 0 (id=770): sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000002140)={0x18, 0x50, 0x1, 0x0, 0x800000, "", [@typed={0x7, 0x3ffd, 0x0, 0x0, @str='\x00\x00\x00'}]}, 0x18}], 0x1, 0x0, 0x0, 0x4000001}, 0x0) sendmsg$can_raw(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000880)=@canfd={{0x1, 0x1}, 0x39, 0x0, 0x0, 0x0, "3992ca995e968b0b065f7922b761528f0199602d1e09faf0c0f1c2db040f957a34b2aa413157e3ec06fdcf6128269e6763e9c19b00d4eb026a6375a22b930a64"}, 0x48}, 0x1, 0x0, 0x0, 0x8490}, 0x1) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r1, &(0x7f0000000040), 0x10) listen(r1, 0x0) r2 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r2, &(0x7f0000000080), 0x10) connect$unix(r2, &(0x7f00000002c0)=@abs={0x0, 0x0, 0x4e22}, 0x6e) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000000a00)=ANY=[@ANYBLOB="12011001070102109806826bebc30102030109021200010600b06a09043b05005639ad000038ee485af79c5d02d5551b25b39ff0894a4e8aef40e98c8aa0f842e9cbf6074555d3d3910eb2bb1c75e3dfe0a6c739e085e9d58cb0d02fdee1e241bec7d80512cd97ad3a3974f2cfa82466317c671a591801b6f7ba22ab0768cad7e7239b9e3f8c6bf11a920d29281ab3a5f2c4d89d2ab256fda4e8932e7e9e4b8f76d857861a470287f31cec7463948377dc5cf4e93ecab99b37e7e3929010c8884f84fa431cfe7c69d343b62a091ff3191d4bf9134385b3186f3a924563d65e64565f302db1d290f954c8ce7c88d010af529119865d49d843074b5cee22f2704fcb273f8cbeccbbed7890ff74d8f9d3d2bd0492c65f23fc0c2ceda698cda4ed80eff35d1196b5c61947941bf5b20ceb7616b2be5fb063bf3819631e7c6399bef48ddc839140071dc7a66ddac93e78b5744284a7faf3359bf4d9db42d379d524d8e30f82ff60439b8c9649e0f8d756b7db0a2f6098567034776b06f09f59f1f0599d7974e16d82a26aef1cd72aa45bd8260aba1bca579bf1c79aee38049225052c97e00ae0d3fecdbabd8527a80833977685aa87c48f1ad836fbaf7845fcee7a89a972d37e318f4f0548f95cb3368e1a67461ab969dc9bbd3cc0"], 0x0) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000200)={0x8, 0xeeee8000, 0x2, 0xffffffffffffffff, 0xf}) r4 = socket(0x10, 0x803, 0x0) sendto(r4, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r4, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4085, 0xff5}, {&(0x7f0000000580)=""/106, 0x6a}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/141, 0x8d}, {&(0x7f00000001c0)=""/17, 0x11}], 0x8, &(0x7f0000000600)=""/191, 0xbf}, 0x5}], 0x1, 0x2000, &(0x7f0000003700)={0x77359400}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000006100)='cmdline\x00') exit(0x3) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000040)='TIPCv2\x00', &(0x7f00000000c0)='/dev/kvm\x00', 0x0) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0100000000000000000017000000540006803c00040067636d286165732900030000000000000000000000000000000000000000000014000000e3de3d7b4cd07ec3ee777de774fc7987cca41989140003"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) 831.930263ms ago: executing program 2 (id=774): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) mmap(&(0x7f0000568000/0x2000)=nil, 0x1000000, 0x0, 0x11, 0xffffffffffffffff, 0x0) munmap(&(0x7f00003f9000/0xc00000)=nil, 0xc00000) socket$unix(0x1, 0x5, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r1 = userfaultfd(0x801) r2 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000080)={0x2, 0xf, 0x4, 0x82, 0x0, 0x3, 0x0}) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) ptrace(0x4201, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x5) ioctl$KVM_REGISTER_COALESCED_MMIO(r6, 0x4010ae67, &(0x7f0000000000)={0x8080000, 0x1d000, 0x2}) ioctl$KVM_REGISTER_COALESCED_MMIO(r6, 0x4010ae67, &(0x7f0000000180)={0x8000000, 0xa000}) close_range(r4, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r7 = dup3(r3, r0, 0x0) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r8, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r8, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x4}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f0000000340)=[@register_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000440)={@fd={0x66642a85, 0x0, r2}, @flat=@handle={0x73682a85, 0x1000, 0x2}, @flat=@binder={0x73622a85, 0x1000}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f00000004c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 678.352036ms ago: executing program 2 (id=775): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000300)=[@free_buffer, @release={0x40046306, 0x1}, @register_looper, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)={@fda={0x66646185, 0x2, 0x1, 0x39}, @ptr={0x70742a85, 0x1, &(0x7f0000000040)=""/49, 0x0, 0x2, 0x19}, @fda={0x66646185, 0xa, 0x0, 0x1f}}, &(0x7f0000000180)}}], 0x1b72, 0x0, 0x0}) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000240), 0x42, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r4 = dup(r3) write$FUSE_BMAP(r4, &(0x7f0000000080)={0x18, 0x0, 0x0, {0x4}}, 0x18) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x339) write$FUSE_NOTIFY_RETRIEVE(r4, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB="613c5359ee66604030a72210f8645b009a83ccdb524638c860b02afc8bd3622b39fa216f3acbe1c844537ebde7d500ba5b6c1074bd62eb6fad4361e6c2300bb5a6028d18b106ceac46a2a6a0451b5212e399b820772eea98455b05daf8c31def28aa9c47e627979250a78162e42e56432aa26048d61eaddc1f66eaab93c19f00ca6e4272826935c58f5a24a63b41559d82e812753fb51673f23a167c70", @ANYRESHEX=r4, @ANYBLOB=',posixacl,version=9p2000.u,cache=loose,ignoreqv,k']) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') sendfile(r1, r5, 0x0, 0x80000000) socket$inet_tcp(0x2, 0x1, 0x0) dup3(r0, r0, 0x80000) 649.146188ms ago: executing program 2 (id=776): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) clock_gettime(0x2, &(0x7f0000000000)) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x130b, 0x3}) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c010000049453"], 0x13c}}, 0x0) syz_open_procfs(0x0, 0x0) request_key(0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000280)={0x3}, 0x10) r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x20582, 0x0) openat$rnullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x11, r3, 0x45809000) inotify_init1(0x80000) setsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000, 0x3}, 0x20) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000007b40)=ANY=[@ANYBLOB="200000002200010a000000000000000007000002"], 0x20}, 0x1, 0x0, 0x0, 0x4044000}, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) socket(0x10, 0x2, 0x0) vmsplice(r0, &(0x7f00000001c0), 0x0, 0xc) setsockopt$inet6_tcp_int(r2, 0x6, 0x1b, &(0x7f0000000000)=0x3, 0x4) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x7ff}) setgid(0x0) r5 = fsopen(&(0x7f0000000000)='debugfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x8, 0x0, 0x0, 0x0) munmap(&(0x7f0000002000/0x800000)=nil, 0x800000) 575.795714ms ago: executing program 2 (id=777): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs2/binder1\x00', 0x1800, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_GET_DIRTY_LOG(r2, 0x4010ae42, &(0x7f0000000500)={0x1ffff, 0x0, &(0x7f0000ff8000/0x4000)=nil}) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000480)='./file0/../file0/file0\x00', &(0x7f0000000300)='devpts\x00', 0x1a02002, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x1c0) mount$bind(&(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='./file0/file0\x00', 0x0, 0x1005407, 0x0) mount$fuse(0x0, &(0x7f00000005c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) accept4$unix(r3, &(0x7f0000000280)=@abs, &(0x7f0000000340)=0x6e, 0x800) move_mount(r3, &(0x7f00000001c0)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file0/../file0/file0\x00', 0x107) r4 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r5 = memfd_create(&(0x7f0000000540)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\xfe\xff\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\"%/u\x16\xdam\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d[\v\xfc\xad\x0f\xa8\xc5\xad\x001\x8b%\xaa?\x00\x00\x00\x00\x00\x00\x00\nj\x8c\xc3\xdc\v\xa4\xe8W6\xb2p\xea\x93\xca=~\xd3\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1', 0x6) ftruncate(r5, 0xffff) r6 = ioctl$UDMABUF_CREATE(r4, 0x40187542, &(0x7f0000000000)={r5, 0x0, 0x0, 0x8000}) lseek(r6, 0xfffffffeffffffff, 0x4) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000380)) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0xffffffc0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="1500000065bfcd50f4000008003910323030302e75"], 0x15) r9 = dup(r8) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000100)={0x18, 0xffffffffffffffda}, 0x18) write$FUSE_INIT(r9, &(0x7f0000001740)={0x50, 0x0, 0x0, {0x7, 0x21, 0x0, 0x0, 0xf4}}, 0x50) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000004380), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="7472bd0100000000000000646e6f3dda26f19d0a1340bc711ddcfd3f69595865da7ea5c77dce1068226942", @ANYRESHEX=r7, @ANYBLOB=',wfdno=', @ANYRESHEX=r9, @ANYBLOB=',access=client,k']) close_range(r0, 0xffffffffffffffff, 0x0) 526.158538ms ago: executing program 2 (id=778): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x60a00, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x22) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0xa, &(0x7f0000000300)=0x80, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x57788000) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r4, &(0x7f0000000040)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13) r5 = dup(r4) write$FUSE_BMAP(r5, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_INIT(r5, &(0x7f0000001740)={0x50, 0x0, 0x0, {0x7, 0x21, 0x0, 0x0, 0xf4}}, 0x50) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000004380), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r5}, 0x2c, {[], [], 0x6b}}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r6, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r6, 0x40045402, &(0x7f0000000000)) 504.942799ms ago: executing program 2 (id=779): mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) ioctl$TUNDETACHFILTER(0xffffffffffffffff, 0x401054d6, 0x0) (async) ioctl$TUNDETACHFILTER(0xffffffffffffffff, 0x401054d6, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000200)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000500)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@xino_auto}]}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000000000)="2ef36644f7e62e3e672e450f078f29d095abaa960000b890a4f084ef66bafc0c6d8f297812cf66ba410066ef48b800100000000000000f23d00f21f835100000080f23f866baf80cb88ef01480ef66bafc0c66b80c0066efc7442402d8650000c7442406000000000f011c2466ba4200ec2e64f30f5a8e6c000000", 0x7b}], 0x1, 0x52, &(0x7f0000000200)=[@vmwrite={0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x85200000c}], 0x1) (async) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000000000)="2ef36644f7e62e3e672e450f078f29d095abaa960000b890a4f084ef66bafc0c6d8f297812cf66ba410066ef48b800100000000000000f23d00f21f835100000080f23f866baf80cb88ef01480ef66bafc0c66b80c0066efc7442402d8650000c7442406000000000f011c2466ba4200ec2e64f30f5a8e6c000000", 0x7b}], 0x1, 0x52, &(0x7f0000000200)=[@vmwrite={0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x85200000c}], 0x1) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000240)={[0x3, 0xec, 0x401, 0x3, 0x7, 0x4, 0x8000000000000001, 0x80000001, 0x1, 0x200, 0x4, 0x6, 0x9, 0x10000000003a, 0x9, 0x9], 0x0, 0x2a80}) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, 0x0}], 0x1, 0x65, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000000c0)=@x86={0xc, 0x6, 0x0, 0x0, 0xfb, 0x5d, 0x0, 0x4, 0x0, 0x0, 0x2, 0x7b, 0x0, 0x0, 0x3, 0x3, 0x0, 0x2, 0x9d, '\x00', 0xa, 0x2000000000000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000001c0)=0x14) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r3, &(0x7f0000002140)={0x2020}, 0x2020) (async) read$FUSE(r3, &(0x7f0000002140)={0x2020}, 0x2020) ioctl$BTRFS_IOC_TREE_SEARCH(r3, 0xd0009411, &(0x7f0000000540)={{0x0, 0x3, 0x4d3, 0x9d7, 0xbb79, 0x10001, 0x8, 0x49, 0x9, 0x5c4ff2f0, 0x4, 0x7fffffff, 0x6, 0x9, 0x3}}) (async) ioctl$BTRFS_IOC_TREE_SEARCH(r3, 0xd0009411, &(0x7f0000000540)={{0x0, 0x3, 0x4d3, 0x9d7, 0xbb79, 0x10001, 0x8, 0x49, 0x9, 0x5c4ff2f0, 0x4, 0x7fffffff, 0x6, 0x9, 0x3}}) 0s ago: executing program 6 (id=780): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0x1e) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') r3 = epoll_create(0x10000e9) epoll_pwait2(r3, &(0x7f00000000c0)=[{}], 0x1, &(0x7f0000000200), 0x0, 0x0) r4 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) (async) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='batadv_slave_0\x00', 0x10) (async) connect$inet(r4, &(0x7f00000000c0)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f0000000140), 0x4) (async) sendfile(r4, r2, 0x0, 0x80000001) kernel console output (not intermixed with test programs): int 0x81 has invalid maxpacket 1023, setting to 64 [ 26.474961][ T373] usb 3-1: config 1 interface 0 altsetting 183 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 26.486525][ T373] usb 3-1: config 1 interface 0 has no altsetting 0 [ 26.509008][ T373] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 26.518513][ T373] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.527294][ T373] usb 3-1: Product: ࠊ [ 26.531759][ T373] usb 3-1: Manufacturer: Ѓ [ 26.542053][ T373] usb 3-1: SerialNumber: Ъ [ 26.548840][ T384] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 26.556199][ T384] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 26.816296][ T417] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 26.851762][ T422] cgroup: Unknown subsys name 'measure' [ 26.920603][ T430] kvm: kvm [427]: vcpu0, guest rIP: 0xfff0 Unhandled RDMSR(0x40000006) [ 26.970384][ T373] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -71 [ 26.993530][ T373] usb 3-1: USB disconnect, device number 2 [ 27.054956][ T65] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 27.187609][ T443] netlink: 4 bytes leftover after parsing attributes in process `syz.3.41'. [ 27.214943][ T65] usb 1-1: Using ep0 maxpacket: 32 [ 27.221387][ T65] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.236564][ T65] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.246808][ T65] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 27.257009][ T65] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.287681][ T65] usb 1-1: config 0 descriptor?? [ 27.301332][ T65] hub 1-1:0.0: USB hub found [ 27.454944][ T447] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 27.464956][ T45] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 27.476915][ T447] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 27.496144][ T65] hub 1-1:0.0: 1 port detected [ 27.750764][ T462] rust_binder: Read failure Err(EAGAIN) in pid:31 [ 27.750867][ T462] rust_binder: got new transaction with bad transaction stack [ 27.757912][ T462] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:31 [ 27.767349][ T463] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 27.818320][ T467] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 32 [ 27.832961][ T467] rust_binder: Write failure EINVAL in pid:36 [ 27.887200][ T471] binder: Unknown parameter 'y.a;:ɷn05P}%C/y:FoE>O\bN mRXh5Џw]TiEbjD/)p?X' [ 28.031154][ T373] rust_binder: 442: removing orphan mapping 0:24 [ 28.094983][ T478] rust_binder: Failed to allocate buffer. len:4144, is_oneway:false [ 28.095014][ T478] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 28.103901][ T478] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:32 [ 28.124984][ T65] hub 1-1:0.0: activate --> -90 [ 28.203439][ T492] netlink: 'syz.3.55': attribute type 1 has an invalid length. [ 28.220347][ T492] syzkaller0: entered promiscuous mode [ 28.225971][ T492] syzkaller0: entered allmulticast mode [ 28.293359][ T495] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.325921][ T495] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.343174][ T502] ======================================================= [ 28.343174][ T502] WARNING: The mand mount option has been deprecated and [ 28.343174][ T502] and is ignored by this kernel. Remove the mand [ 28.343174][ T502] option from the mount to silence this warning. [ 28.343174][ T502] ======================================================= [ 28.344937][ T36] kauditd_printk_skb: 120 callbacks suppressed [ 28.344951][ T36] audit: type=1400 audit(1754947208.549:194): avc: denied { mounton } for pid=500 comm="syz.3.58" path="/proc/39/cgroup" dev="proc" ino=4996 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=file permissive=1 [ 28.426426][ T36] audit: type=1400 audit(1754947208.549:195): avc: denied { mounton } for pid=500 comm="syz.3.58" path="/proc/39/cgroup" dev="nsfs" ino=4026532299 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 28.450707][ T36] audit: type=1400 audit(1754947208.659:196): avc: denied { read append } for pid=505 comm="syz.3.59" name="snapshot" dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 28.474596][ T36] audit: type=1400 audit(1754947208.659:197): avc: denied { open } for pid=505 comm="syz.3.59" path="/dev/snapshot" dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 28.539859][ T36] audit: type=1400 audit(1754947208.749:198): avc: denied { write } for pid=414 comm="syz.0.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 28.545305][ T65] usb 1-1-port1: cannot disable (err = -71) [ 28.561940][ T512] rust_binder: 49: no such ref 0 [ 28.573956][ T512] netlink: 44 bytes leftover after parsing attributes in process `syz.3.60'. [ 28.574990][ T445] usb 3-1: new low-speed USB device number 3 using dummy_hcd [ 28.583171][ T512] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 28.597957][ T512] rust_binder: 49: no such ref 0 [ 28.605240][ T509] usb 1-1: USB disconnect, device number 2 [ 28.745084][ T445] usb 3-1: device descriptor read/64, error -71 [ 28.761749][ T36] audit: type=1400 audit(1754947208.969:199): avc: denied { mount } for pid=527 comm="syz.3.66" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 28.762312][ T528] overlayfs: failed to resolve './file2': -2 [ 28.795319][ T36] audit: type=1400 audit(1754947208.999:200): avc: denied { bind } for pid=527 comm="syz.3.66" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 28.830262][ T36] audit: type=1400 audit(1754947209.039:201): avc: denied { unmount } for pid=291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 28.875247][ T36] audit: type=1400 audit(1754947209.089:202): avc: denied { ioctl } for pid=531 comm="syz.3.67" path="socket:[3862]" dev="sockfs" ino=3862 ioctlcmd=0x6612 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 28.997817][ T445] usb 3-1: device descriptor read/64, error -71 [ 29.008822][ T36] audit: type=1400 audit(1754947209.219:203): avc: denied { mount } for pid=533 comm="syz.3.68" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 29.274971][ T445] usb 3-1: new low-speed USB device number 4 using dummy_hcd [ 29.405051][ T445] usb 3-1: device descriptor read/64, error -71 [ 29.469990][ T552] syz.0.74 uses obsolete (PF_INET,SOCK_PACKET) [ 29.644968][ T445] usb 3-1: device descriptor read/64, error -71 [ 29.765105][ T445] usb usb3-port1: attempt power cycle [ 29.994624][ T581] netlink: 312 bytes leftover after parsing attributes in process `syz.0.84'. [ 30.102534][ T589] overlayfs: missing 'lowerdir' [ 30.114992][ T445] usb 3-1: new low-speed USB device number 5 using dummy_hcd [ 30.146240][ T445] usb 3-1: device descriptor read/8, error -71 [ 30.285941][ T445] usb 3-1: device descriptor read/8, error -71 [ 30.377448][ T596] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 30.386707][ T596] overlayfs: missing 'lowerdir' [ 30.534961][ T445] usb 3-1: new low-speed USB device number 6 using dummy_hcd [ 30.577042][ T445] usb 3-1: device descriptor read/8, error -71 [ 30.600407][ T614] SELinux: security_context_str_to_sid (sytem_uGй) failed with errno=-22 [ 30.635081][ T617] rust_binder: 35: no such ref 3 [ 30.640104][ T617] rust_binder: inc_ref_done called when no active inc_refs [ 30.656327][ T328] Bluetooth: hci0: Frame reassembly failed (-84) [ 30.705953][ T445] usb 3-1: device descriptor read/8, error -71 [ 30.827196][ T445] usb usb3-port1: unable to enumerate USB device [ 31.238898][ T445] rust_binder: 637: removing orphan mapping 0:24 [ 31.256439][ T445] rust_binder: 0: removing orphan mapping 24:1024 [ 31.326445][ T642] rust_binder: Failed to allocate buffer. len:24, is_oneway:false [ 31.326573][ T642] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:110 [ 31.465095][ T646] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 31.474361][ T646] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:63 [ 31.490031][ T646] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 31.499588][ T646] rust_binder: Read failure Err(EFAULT) in pid:63 [ 31.595080][ T650] overlayfs: missing 'lowerdir' [ 31.734942][ T445] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 31.885013][ T445] usb 1-1: Using ep0 maxpacket: 16 [ 31.890589][ T445] usb 1-1: too many configurations: 10, using maximum allowed: 8 [ 31.899618][ T445] usb 1-1: config index 0 descriptor too short (expected 65535, got 45) [ 31.908116][ T445] usb 1-1: config 255 has too many interfaces: 255, using maximum allowed: 32 [ 31.917016][ T445] usb 1-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 31.927720][ T445] usb 1-1: config 255 has 0 interfaces, different from the descriptor's value: 255 [ 31.937859][ T445] usb 1-1: config index 1 descriptor too short (expected 65535, got 45) [ 31.946252][ T445] usb 1-1: config 255 has too many interfaces: 255, using maximum allowed: 32 [ 31.955127][ T445] usb 1-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 31.965398][ T445] usb 1-1: config 255 has 0 interfaces, different from the descriptor's value: 255 [ 31.976154][ T445] usb 1-1: config index 2 descriptor too short (expected 65535, got 45) [ 31.984515][ T445] usb 1-1: config 255 has too many interfaces: 255, using maximum allowed: 32 [ 31.993405][ T445] usb 1-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 32.004140][ T445] usb 1-1: config 255 has 0 interfaces, different from the descriptor's value: 255 [ 32.014358][ T445] usb 1-1: config index 3 descriptor too short (expected 65535, got 45) [ 32.023027][ T445] usb 1-1: config 255 has too many interfaces: 255, using maximum allowed: 32 [ 32.031938][ T445] usb 1-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 32.042224][ T445] usb 1-1: config 255 has 0 interfaces, different from the descriptor's value: 255 [ 32.052271][ T445] usb 1-1: config index 4 descriptor too short (expected 65535, got 45) [ 32.060663][ T445] usb 1-1: config 255 has too many interfaces: 255, using maximum allowed: 32 [ 32.069543][ T445] usb 1-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 32.079825][ T445] usb 1-1: config 255 has 0 interfaces, different from the descriptor's value: 255 [ 32.090023][ T445] usb 1-1: config index 5 descriptor too short (expected 65535, got 45) [ 32.098454][ T445] usb 1-1: config 255 has too many interfaces: 255, using maximum allowed: 32 [ 32.112250][ T445] usb 1-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 32.124094][ T445] usb 1-1: config 255 has 0 interfaces, different from the descriptor's value: 255 [ 32.134194][ T445] usb 1-1: config index 6 descriptor too short (expected 65535, got 45) [ 32.142585][ T445] usb 1-1: config 255 has too many interfaces: 255, using maximum allowed: 32 [ 32.151570][ T445] usb 1-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 32.161838][ T445] usb 1-1: config 255 has 0 interfaces, different from the descriptor's value: 255 [ 32.171893][ T445] usb 1-1: config index 7 descriptor too short (expected 65535, got 45) [ 32.180292][ T445] usb 1-1: config 255 has too many interfaces: 255, using maximum allowed: 32 [ 32.180498][ T662] netlink: 'syz.3.110': attribute type 4 has an invalid length. [ 32.189178][ T445] usb 1-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 32.189202][ T445] usb 1-1: config 255 has 0 interfaces, different from the descriptor's value: 255 [ 32.197209][ T662] netlink: 3657 bytes leftover after parsing attributes in process `syz.3.110'. [ 32.207209][ T445] usb 1-1: New USB device found, idVendor=046d, idProduct=c513, bcdDevice= 0.00 [ 32.234685][ T445] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.450272][ T648] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 32.458865][ T648] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 32.471077][ T45] usb 1-1: USB disconnect, device number 3 [ 32.725029][ T622] Bluetooth: hci0: command 0x1003 tx timeout [ 32.725029][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 33.063654][ T674] Zero length message leads to an empty skb [ 33.156338][ T683] rust_binder: Failed to allocate buffer. len:24, is_oneway:false [ 33.156438][ T683] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:99 [ 33.171545][ T684] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 33.197006][ T687] rust_binder: Write failure EFAULT in pid:104 [ 33.416685][ T445] rust_binder: 696: removing orphan mapping 0:1048 [ 33.435683][ T36] kauditd_printk_skb: 29 callbacks suppressed [ 33.435698][ T36] audit: type=1400 audit(1754947213.649:233): avc: denied { getopt } for pid=700 comm="syz.1.125" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 33.461302][ T45] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 33.471506][ T705] 9pnet_fd: Insufficient options for proto=fd [ 33.478540][ T705] 9pnet_fd: Insufficient options for proto=fd [ 33.510624][ T36] audit: type=1400 audit(1754947213.719:234): avc: denied { write } for pid=710 comm="syz.1.129" name="001" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 33.555108][ T36] audit: type=1400 audit(1754947213.769:235): avc: denied { ioctl } for pid=713 comm="syz.1.130" path="socket:[6909]" dev="sockfs" ino=6909 ioctlcmd=0xae52 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 33.580389][ T36] audit: type=1400 audit(1754947213.769:236): avc: denied { setopt } for pid=713 comm="syz.1.130" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 33.624987][ T45] usb 1-1: Using ep0 maxpacket: 16 [ 33.631285][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 33.642547][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 33.652382][ T45] usb 1-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 33.661457][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.675615][ T45] usb 1-1: config 0 descriptor?? [ 33.924942][ T445] usb 2-1: new low-speed USB device number 3 using dummy_hcd [ 34.076005][ T445] usb 2-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 34.085192][ T445] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.094185][ T445] usb 2-1: config 0 descriptor?? [ 34.100581][ T689] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 34.109708][ T724] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 34.120797][ T45] hid-multitouch 0003:1FD2:6007.0001: unknown main item tag 0x4 [ 34.129224][ T45] hid-multitouch 0003:1FD2:6007.0001: hidraw0: USB HID v0.00 Device [HID 1fd2:6007] on usb-dummy_hcd.0-1/input0 [ 34.386406][ T45] usb 1-1: USB disconnect, device number 4 [ 34.959666][ T742] rust_binder: Error in use_page_slow: ESRCH [ 34.959689][ T742] rust_binder: use_range failure ESRCH [ 34.966026][ T742] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 34.971525][ T742] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 34.981517][ T742] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:110 [ 35.270897][ T36] audit: type=1400 audit(1754947215.479:237): avc: denied { listen } for pid=759 comm="syz.3.143" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 35.343643][ T767] rust_binder: Error while translating object. [ 35.343675][ T767] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 35.350087][ T767] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:156 [ 35.360181][ T767] rust_binder: Error while translating object. [ 35.369344][ T767] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 35.375700][ T767] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:156 [ 35.395400][ T769] netlink: 20 bytes leftover after parsing attributes in process `syz.3.146'. [ 35.708577][ T36] audit: type=1400 audit(1754947215.919:238): avc: denied { create } for pid=721 comm="syz.1.132" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 35.708996][ T445] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 35.738199][ T445] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 35.748479][ T445] asix 2-1:0.0: probe with driver asix failed with error -71 [ 35.757863][ T445] usb 2-1: USB disconnect, device number 3 [ 35.814969][ T45] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 35.966090][ T45] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 35.977154][ T45] usb 1-1: config 0 interface 0 has no altsetting 0 [ 35.984014][ T45] usb 1-1: New USB device found, idVendor=046d, idProduct=c262, bcdDevice= 0.00 [ 35.993093][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.001605][ T45] usb 1-1: config 0 descriptor?? [ 36.246147][ T36] audit: type=1400 audit(1754947216.459:239): avc: denied { create } for pid=774 comm="syz.1.148" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 36.266782][ T36] audit: type=1400 audit(1754947216.479:240): avc: denied { map } for pid=774 comm="syz.1.148" path="socket:[7081]" dev="sockfs" ino=7081 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 36.295175][ T36] audit: type=1400 audit(1754947216.479:241): avc: denied { read } for pid=774 comm="syz.1.148" path="socket:[7081]" dev="sockfs" ino=7081 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 36.318480][ T36] audit: type=1400 audit(1754947216.509:242): avc: denied { connect } for pid=774 comm="syz.1.148" lport=60 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 36.353508][ T780] netlink: 12 bytes leftover after parsing attributes in process `syz.3.150'. [ 36.412528][ T45] logitech-hidpp-device 0003:046D:C262.0002: item fetching failed at offset 5/7 [ 36.421969][ T45] logitech-hidpp-device 0003:046D:C262.0002: hidpp_probe:parse failed [ 36.430576][ T45] logitech-hidpp-device 0003:046D:C262.0002: probe with driver logitech-hidpp-device failed with error -22 [ 36.624973][ T10] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 36.644982][ T445] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 36.718080][ T794] netlink: 20 bytes leftover after parsing attributes in process `syz.0.147'. [ 36.776053][ T10] usb 4-1: config index 0 descriptor too short (expected 40740, got 36) [ 36.784534][ T10] usb 4-1: New USB device found, idVendor=1e7d, idProduct=3232, bcdDevice= 0.00 [ 36.793713][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.802478][ T10] usb 4-1: config 0 descriptor?? [ 36.804941][ T445] usb 2-1: Using ep0 maxpacket: 32 [ 36.814279][ T445] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.825276][ T445] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.835234][ T445] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 36.844467][ T445] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.853147][ T445] usb 2-1: config 0 descriptor?? [ 36.859088][ T445] hub 2-1:0.0: USB hub found [ 37.013572][ T10] usbhid 4-1:0.0: can't add hid device: -71 [ 37.020255][ T10] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 37.028930][ T10] usb 4-1: USB disconnect, device number 2 [ 37.044967][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 37.059194][ T445] hub 2-1:0.0: 1 port detected [ 37.064986][ T445] hub 2-1:0.0: hub_hub_status failed (err = -71) [ 37.071784][ T445] hub 2-1:0.0: config failed, can't get hub status (err -71) [ 37.081276][ T445] usbhid 2-1:0.0: can't add hid device: -71 [ 37.084084][ T798] tipc: Started in network mode [ 37.087759][ T445] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 37.092230][ T798] tipc: Node identity be886dd9fd63, cluster identity 4711 [ 37.107156][ T798] tipc: Enabled bearer , priority 0 [ 37.118291][ T797] tipc: Disabling bearer [ 37.125668][ T445] usb 2-1: USB disconnect, device number 4 [ 37.159099][ T804] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 37.219211][ T808] netlink: 4 bytes leftover after parsing attributes in process `syz.1.158'. [ 37.393122][ T810] rust_binder: Error while translating object. [ 37.393151][ T810] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 37.399428][ T810] rust_binder: Failure BR_FAILED_REPLY { source: EINVAL } during reply - delivering BR_FAILED_REPLY to sender. [ 37.408937][ T810] rust_binder: Transaction failed: BR_TRANSACTION_COMPLETE my_pid:92 [ 37.424268][ T9] rust_binder: 809: removing orphan mapping 0:24 [ 37.456292][ T817] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:97 [ 37.581399][ T831] tipc: Started in network mode [ 37.595666][ T831] tipc: Node identity 9a8a8c881df5, cluster identity 4711 [ 37.603024][ T831] tipc: Enabled bearer , priority 0 [ 37.611840][ T831] tipc: Disabling bearer [ 37.950897][ T842] rust_binder: Failed to allocate buffer. len:1048, is_oneway:true [ 38.581548][ T851] rust_binder: validate_parent_fixup: fixup_min_offset=38, parent_offset=36 [ 38.581629][ T852] rust_binder: 114: no such ref 3 [ 38.590397][ T851] rust_binder: Error while translating object. [ 38.599151][ T852] rust_binder: inc_ref_done called when no active inc_refs [ 38.611045][ T851] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 38.616550][ T509] usb 1-1: USB disconnect, device number 5 [ 38.618742][ T851] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:114 [ 38.644698][ T854] /dev/rnullb0: Can't open blockdev [ 38.754966][ T445] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 38.884984][ T445] usb 3-1: device descriptor read/64, error -71 [ 38.965092][ T509] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 38.974954][ T9] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 39.116110][ T509] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 39.127147][ T445] usb 3-1: device descriptor read/64, error -71 [ 39.133431][ T509] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 39.134954][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 39.143491][ T509] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 39.149543][ T9] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 39.161175][ T509] usb 1-1: New USB device found, idVendor=11c2, idProduct=2208, bcdDevice= 0.00 [ 39.169752][ T9] usb 4-1: config 179 has no interface number 0 [ 39.178522][ T509] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.185128][ T9] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 39.193522][ T509] usb 1-1: config 0 descriptor?? [ 39.204597][ T9] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 39.220421][ T9] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 39.231845][ T9] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 39.243357][ T9] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 39.256668][ T9] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 39.265738][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.274797][ T859] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 39.368405][ T445] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 39.414723][ T509] betop 0003:11C2:2208.0003: nested delimiters [ 39.421110][ T509] betop 0003:11C2:2208.0003: item 0 1 2 10 parsing failed [ 39.437330][ T509] betop 0003:11C2:2208.0003: parse failed [ 39.444049][ T509] betop 0003:11C2:2208.0003: probe with driver betop failed with error -22 [ 39.459586][ T509] usb 1-1: USB disconnect, device number 6 [ 39.504950][ T445] usb 3-1: device descriptor read/64, error -71 [ 39.603591][ T872] rust_binder: Write failure EFAULT in pid:123 [ 39.622509][ T877] rust_binder: Write failure EFAULT in pid:128 [ 39.694593][ T45] usb 4-1: USB disconnect, device number 3 [ 39.694687][ C0] xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 39.715790][ C0] dummy_hcd dummy_hcd.3: timer fired with no URBs pending? [ 39.733058][ T881] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:132 [ 39.733161][ T881] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:132 [ 39.744955][ T445] usb 3-1: device descriptor read/64, error -71 [ 39.777255][ T36] kauditd_printk_skb: 14 callbacks suppressed [ 39.777271][ T36] audit: type=1400 audit(1754947219.989:257): avc: denied { ioctl } for pid=886 comm="syz.1.183" path="socket:[7597]" dev="sockfs" ino=7597 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 39.865074][ T445] usb usb3-port1: attempt power cycle [ 39.881924][ T36] audit: type=1400 audit(1754947220.089:258): avc: denied { create } for pid=886 comm="syz.1.183" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 40.114970][ T9] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 40.204978][ T445] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 40.226701][ T445] usb 3-1: device descriptor read/8, error -71 [ 40.244966][ T9] usb 2-1: device descriptor read/64, error -71 [ 40.311368][ T899] x_tables: duplicate underflow at hook 1 [ 40.355960][ T445] usb 3-1: device descriptor read/8, error -71 [ 40.484954][ T9] usb 2-1: device descriptor read/64, error -71 [ 40.595864][ T445] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 40.625926][ T445] usb 3-1: device descriptor read/8, error -71 [ 40.734938][ T9] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 40.755909][ T445] usb 3-1: device descriptor read/8, error -71 [ 40.865012][ T445] usb usb3-port1: unable to enumerate USB device [ 40.894945][ T9] usb 2-1: device descriptor read/64, error -71 [ 41.134962][ T9] usb 2-1: device descriptor read/64, error -71 [ 41.255033][ T9] usb usb2-port1: attempt power cycle [ 41.270837][ T36] audit: type=1400 audit(1754947221.479:259): avc: denied { append } for pid=905 comm="syz.3.188" name="001" dev="devtmpfs" ino=96 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 41.293752][ T906] rust_binder: 201: no such ref 0 [ 41.405867][ T36] audit: type=1400 audit(1754947221.619:260): avc: denied { map } for pid=911 comm="syz.3.190" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=111 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 41.495428][ T914] netlink: 7 bytes leftover after parsing attributes in process `syz.3.191'. [ 41.504634][ T36] audit: type=1400 audit(1754947221.709:261): avc: denied { watch watch_reads } for pid=913 comm="syz.3.191" path="/71" dev="tmpfs" ino=390 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 41.594955][ T9] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 41.615996][ T9] usb 2-1: device descriptor read/8, error -71 [ 41.756110][ T9] usb 2-1: device descriptor read/8, error -71 [ 41.954977][ T901] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 41.994954][ T9] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 42.016227][ T9] usb 2-1: device descriptor read/8, error -71 [ 42.106120][ T901] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 42.119910][ T901] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 42.129122][ T901] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 42.137229][ T901] usb 3-1: SerialNumber: syz [ 42.143105][ T901] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22 [ 42.155948][ T9] usb 2-1: device descriptor read/8, error -71 [ 42.265039][ T9] usb usb2-port1: unable to enumerate USB device [ 42.452539][ T938] TCP: TCP_TX_DELAY enabled [ 42.472608][ T36] audit: type=1400 audit(1754947222.679:262): avc: denied { create } for pid=940 comm="syz.0.200" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 42.675152][ T36] audit: type=1400 audit(1754947222.889:263): avc: denied { create } for pid=944 comm="syz.0.201" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 42.695758][ T36] audit: type=1400 audit(1754947222.889:264): avc: denied { write } for pid=944 comm="syz.0.201" name="file0" dev="tmpfs" ino=265 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 42.718142][ T36] audit: type=1400 audit(1754947222.889:265): avc: denied { open } for pid=944 comm="syz.0.201" path="/45/file0" dev="tmpfs" ino=265 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 42.740766][ T36] audit: type=1400 audit(1754947222.889:266): avc: denied { ioctl } for pid=944 comm="syz.0.201" path="/45/file0" dev="tmpfs" ino=265 ioctlcmd=0x301 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 42.793092][ T950] 9pnet_fd: Insufficient options for proto=fd [ 42.814964][ T9] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 42.904515][ T948] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.913108][ T948] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.928151][ T955] rust_binder: Error while translating object. [ 42.928179][ T955] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 42.934352][ T955] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:147 [ 42.966354][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 42.986553][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 42.999537][ T9] usb 4-1: New USB device found, idVendor=1294, idProduct=1320, bcdDevice= 0.00 [ 43.009005][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.018282][ T9] usb 4-1: config 0 descriptor?? [ 43.435918][ T9] hid-led 0003:1294:1320.0004: hidraw0: USB HID vff.fe Device [HID 1294:1320] on usb-dummy_hcd.3-1/input0 [ 43.456295][ T9] hid-led 0003:1294:1320.0004: Riso Kagaku Webmail Notifier initialized [ 43.628731][ T45] usb 4-1: USB disconnect, device number 4 [ 43.639527][ T445] leds riso_kagaku0:blue: Setting an LED's brightness failed (-38) [ 43.649114][ T445] leds riso_kagaku0:green: Setting an LED's brightness failed (-38) [ 43.658640][ T445] leds riso_kagaku0:red: Setting an LED's brightness failed (-38) [ 44.206926][ T988] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 44.215295][ T988] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 44.358512][ T993] /dev/rnullb0: Can't open blockdev [ 44.363855][ T992] /dev/rnullb0: Can't open blockdev [ 44.711252][ T445] usb 3-1: USB disconnect, device number 11 [ 44.895446][ T1008] netlink: 12 bytes leftover after parsing attributes in process `syz.1.220'. [ 45.048595][ T36] kauditd_printk_skb: 6 callbacks suppressed [ 45.048610][ T36] audit: type=1400 audit(1754947225.259:273): avc: denied { name_bind } for pid=1011 comm="syz.1.221" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 45.075397][ T36] audit: type=1400 audit(1754947225.259:274): avc: denied { node_bind } for pid=1011 comm="syz.1.221" saddr=fe80::aa src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 45.084281][ T1016] SELinux: Context system_u:object_r:hald_exec_t:s0 is not valid (left unmapped). [ 45.097457][ T36] audit: type=1400 audit(1754947225.279:275): avc: denied { remount } for pid=1013 comm="syz.1.222" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 45.126494][ T36] audit: type=1400 audit(1754947225.319:276): avc: denied { relabelto } for pid=1015 comm="syz.1.223" name="file0" dev="tmpfs" ino=356 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:hald_exec_t:s0" [ 45.153113][ T36] audit: type=1400 audit(1754947225.319:277): avc: denied { associate } for pid=1015 comm="syz.1.223" name="file0" dev="tmpfs" ino=356 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:hald_exec_t:s0" [ 45.180168][ T36] audit: type=1400 audit(1754947225.359:278): avc: denied { read } for pid=1022 comm="syz.1.225" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 45.684690][ T36] audit: type=1400 audit(1754947225.889:279): avc: denied { unlink } for pid=289 comm="syz-executor" name="file0" dev="tmpfs" ino=265 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 52.061179][ T36] audit: type=1400 audit(1754947232.269:280): avc: denied { mounton } for pid=1040 comm="syz.1.231" path="/65/file0" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 52.083836][ T36] audit: type=1400 audit(1754947232.289:281): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 52.109291][ T1051] /dev/sr0: Can't lookup blockdev [ 52.148020][ T36] audit: type=1400 audit(1754947232.359:282): avc: denied { connect } for pid=1056 comm="syz.0.235" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 52.220734][ T1071] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 52.229138][ T1071] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 52.633059][ T36] audit: type=1400 audit(1754947232.839:283): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 52.698899][ T12] bridge_slave_1: left allmulticast mode [ 52.704643][ T12] bridge_slave_1: left promiscuous mode [ 52.710375][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.718723][ T12] bridge_slave_0: left allmulticast mode [ 52.724394][ T12] bridge_slave_0: left promiscuous mode [ 52.731041][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.810468][ T36] audit: type=1400 audit(1754947233.019:284): avc: denied { mounton } for pid=1075 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 52.837091][ T12] tipc: Left network mode [ 52.842589][ T12] veth1_macvtap: left promiscuous mode [ 52.848154][ T12] veth0_vlan: left promiscuous mode [ 52.905247][ T1075] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.912578][ T1075] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.919728][ T1075] bridge_slave_0: entered allmulticast mode [ 52.926106][ T1075] bridge_slave_0: entered promiscuous mode [ 52.933387][ T1075] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.936172][ T1087] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 52.940449][ T1087] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:120 [ 52.940522][ T1075] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.944850][ T1089] SELinux: security_context_str_to_sid (--^$-) failed with errno=-22 [ 52.950031][ T1075] bridge_slave_1: entered allmulticast mode [ 52.967393][ T1075] bridge_slave_1: entered promiscuous mode [ 52.986004][ T1087] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 52.986023][ T1087] rust_binder: Read failure Err(EFAULT) in pid:120 [ 53.017184][ T36] audit: type=1400 audit(1754947233.229:285): avc: denied { append } for pid=1090 comm="syz.2.246" name="binder1" dev="binder" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 53.080974][ T1075] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.088162][ T1075] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.095690][ T1075] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.102736][ T1075] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.123241][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.131350][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.140759][ T328] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.147860][ T328] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.160768][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.167871][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.193350][ T1075] veth0_vlan: entered promiscuous mode [ 53.203366][ T1075] veth1_macvtap: entered promiscuous mode [ 53.221475][ T36] audit: type=1400 audit(1754947233.429:286): avc: denied { mounton } for pid=1075 comm="syz-executor" path="/root/syzkaller.pYfMxX/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 53.286114][ T1103] netlink: 64 bytes leftover after parsing attributes in process `syz.4.241'. [ 53.541997][ T12] bridge_slave_1: left allmulticast mode [ 53.547805][ T12] bridge_slave_1: left promiscuous mode [ 53.553610][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.562124][ T12] bridge_slave_0: left allmulticast mode [ 53.568390][ T12] bridge_slave_0: left promiscuous mode [ 53.574209][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.667317][ T1106] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.674397][ T1106] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.681650][ T1106] bridge_slave_0: entered allmulticast mode [ 53.688955][ T1106] bridge_slave_0: entered promiscuous mode [ 53.696600][ T12] veth1_macvtap: left promiscuous mode [ 53.702199][ T12] veth0_vlan: left promiscuous mode [ 53.734066][ T1106] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.741228][ T1106] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.748377][ T1106] bridge_slave_1: entered allmulticast mode [ 53.754564][ T1106] bridge_slave_1: entered promiscuous mode [ 53.819405][ T328] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.826512][ T328] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.836451][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.843534][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.879862][ T1106] veth0_vlan: entered promiscuous mode [ 53.890339][ T1106] veth1_macvtap: entered promiscuous mode [ 53.960614][ T36] audit: type=1400 audit(1754947234.169:287): avc: denied { map } for pid=1118 comm="syz.3.251" path="/dev/loop7" dev="devtmpfs" ino=56 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 53.985871][ T36] audit: type=1400 audit(1754947234.169:288): avc: denied { execute } for pid=1118 comm="syz.3.251" path="/dev/loop7" dev="devtmpfs" ino=56 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 54.010400][ T36] audit: type=1400 audit(1754947234.219:289): avc: denied { mounton } for pid=1127 comm="syz.3.253" path="/86/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 54.096345][ T1132] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 54.104729][ T1132] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 55.104979][ T9] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 55.134487][ T1183] SELinux: policydb magic number 0x18 does not match expected magic number 0xf97cff8c [ 55.144289][ T1183] SELinux: failed to load policy [ 55.149641][ T1183] rust_binder: 157: no such ref 4294967294 [ 55.265945][ T9] usb 4-1: config 0 has too many interfaces: 255, using maximum allowed: 32 [ 55.274661][ T9] usb 4-1: config 0 has an invalid interface descriptor of length 8, skipping [ 55.288946][ T1189] binder: Unknown parameter 'binder' [ 55.304957][ T9] usb 4-1: config 0 has an invalid descriptor of length 102, skipping remainder of the config [ 55.321857][ T9] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 255 [ 55.336130][ T9] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 55.345248][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 55.354691][ T9] usb 4-1: Product: syz [ 55.364158][ T9] usb 4-1: Manufacturer: syz [ 55.370357][ T9] usb 4-1: SerialNumber: syz [ 55.376963][ T9] usb 4-1: config 0 descriptor?? [ 55.585912][ T1155] tmpfs: Unknown parameter '00000000000000000000003' [ 55.603719][ T45] usb 4-1: USB disconnect, device number 5 [ 55.925470][ T9] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 56.076254][ T9] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 56.091026][ T9] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 56.100149][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 56.108309][ T9] usb 6-1: Product: syz [ 56.112483][ T9] usb 6-1: Manufacturer: syz [ 56.117257][ T9] usb 6-1: SerialNumber: syz [ 56.295035][ T445] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 56.326122][ T9] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 56.446360][ T445] usb 3-1: unable to get BOS descriptor or descriptor too short [ 56.454429][ T445] usb 3-1: not running at top speed; connect to a high speed hub [ 56.466154][ T445] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 56.475403][ T445] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 56.483381][ T445] usb 3-1: Product: Η阀㬆癹蹾豼帮彚욮◷鿘ꦎ쭽霓慏뉖깺鮱ꖳ芤ᘭ纁઴쳅懒造㐑ꊳ䙖窾麛鲐ⱨө泤⾁᠐쯌쥖䓾∀㕾 [ 56.498941][ T445] usb 3-1: SerialNumber: syz [ 56.830813][ T1254] rust_binder: Write failure EINVAL in pid:269 [ 57.058535][ T1258] fuse: Bad value for 'group_id' [ 57.069729][ T36] kauditd_printk_skb: 19 callbacks suppressed [ 57.069745][ T36] audit: type=1400 audit(1754947237.269:309): avc: denied { mounton } for pid=1257 comm="syz.3.296" path="/93/file0" dev="tmpfs" ino=517 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 57.098742][ T1258] fuse: Bad value for 'group_id' [ 57.105235][ T1258] binder: Unknown parameter 'mAx' [ 57.437300][ T1260] rust_binder: Write failure EFAULT in pid:194 [ 57.463341][ T1264] rust_binder: 198: no such ref 2 [ 58.174964][ T45] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 58.319694][ T36] audit: type=1400 audit(1754947238.529:310): avc: denied { getopt } for pid=1288 comm="syz.0.308" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 58.339243][ T45] usb 4-1: Using ep0 maxpacket: 16 [ 58.345731][ T45] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 58.355926][ T45] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 58.366275][ T45] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 58.374996][ T1294] rust_binder: Error while translating object. [ 58.375350][ T1294] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 58.377067][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 58.381767][ T1294] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:208 [ 58.391989][ T45] usb 4-1: Product: syz [ 58.412457][ T45] usb 4-1: Manufacturer: syz [ 58.417098][ T45] usb 4-1: SerialNumber: syz [ 58.627768][ T45] usb 4-1: 0:2 : does not exist [ 58.634513][ T45] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 58.646162][ T45] usb 4-1: USB disconnect, device number 6 [ 58.656728][ T1297] udevd[1297]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 59.131150][ T445] cdc_ncm 3-1:1.0: bind() failure [ 59.143190][ T36] audit: type=1400 audit(1754947239.349:311): avc: denied { mounton } for pid=1298 comm="syz.2.311" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 59.146695][ T445] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 59.194755][ T445] cdc_ncm 3-1:1.1: bind() failure [ 59.202770][ T445] usb 3-1: USB disconnect, device number 12 [ 59.249906][ T1318] input: syz1 as /devices/virtual/input/input6 [ 59.514957][ T509] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 59.664944][ T509] usb 4-1: Using ep0 maxpacket: 32 [ 59.671359][ T509] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 59.682350][ T509] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 59.692325][ T509] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 59.701518][ T509] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 59.710118][ T509] usb 4-1: config 0 descriptor?? [ 59.716145][ T509] hub 4-1:0.0: USB hub found [ 59.920494][ T509] hub 4-1:0.0: 1 port detected [ 60.141796][ T36] audit: type=1400 audit(1754947240.349:312): avc: denied { wake_alarm } for pid=1334 comm="syz.2.325" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 60.278289][ T1341] rust_binder: Write failure EINVAL in pid:199 [ 60.522484][ T509] hub 4-1:0.0: activate --> -90 [ 60.923307][ T445] usb 4-1: USB disconnect, device number 7 [ 61.128660][ T1346] rust_binder: 204: no such ref 2 [ 61.133743][ T1346] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 4294967295 [ 61.142209][ T1346] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:204 [ 61.169388][ T751] Bluetooth: hci0: Frame reassembly failed (-84) [ 61.447768][ T36] audit: type=1400 audit(1754947241.659:313): avc: denied { ioctl } for pid=1358 comm="syz.3.333" path="socket:[12496]" dev="sockfs" ino=12496 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 61.474959][ T9] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 61.501093][ T1366] netlink: 'syz.0.335': attribute type 29 has an invalid length. [ 61.509054][ T1366] netlink: 8 bytes leftover after parsing attributes in process `syz.0.335'. [ 61.538004][ T1375] rust_binder: Write failure EFAULT in pid:217 [ 61.539344][ T1370] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 61.560308][ T36] audit: type=1400 audit(1754947241.769:314): avc: denied { write } for pid=1377 comm="syz.0.339" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 61.636138][ T9] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 61.644946][ T9] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 61.655281][ T9] usb 3-1: config 220 has no interface number 2 [ 61.661668][ T9] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 61.674837][ T9] usb 3-1: config 220 interface 0 has no altsetting 0 [ 61.685181][ T9] usb 3-1: config 220 interface 76 has no altsetting 0 [ 61.692087][ T9] usb 3-1: config 220 interface 1 has no altsetting 0 [ 61.700456][ T9] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 61.710122][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 61.718238][ T9] usb 3-1: Product: syz [ 61.722494][ T9] usb 3-1: Manufacturer: syz [ 61.727116][ T9] usb 3-1: SerialNumber: syz [ 62.509358][ T1383] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1383 comm=syz.3.340 [ 62.509357][ T1384] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1384 comm=syz.3.340 [ 62.565860][ T1385] can0: slcan on ptm2. [ 62.579427][ T36] audit: type=1400 audit(1754947242.789:315): avc: denied { read } for pid=148 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 62.608325][ T36] audit: type=1400 audit(1754947242.819:316): avc: denied { search } for pid=148 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 62.634844][ T36] audit: type=1400 audit(1754947242.819:317): avc: denied { read } for pid=148 comm="dhcpcd" name="n15" dev="tmpfs" ino=2057 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 62.660170][ T36] audit: type=1400 audit(1754947242.819:318): avc: denied { open } for pid=148 comm="dhcpcd" path="/run/udev/data/n15" dev="tmpfs" ino=2057 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 62.683793][ T1397] rust_binder: Write failure EFAULT in pid:227 [ 62.691706][ T36] audit: type=1400 audit(1754947242.819:319): avc: denied { getattr } for pid=148 comm="dhcpcd" path="/run/udev/data/n15" dev="tmpfs" ino=2057 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 62.721089][ T36] audit: type=1400 audit(1754947242.869:320): avc: denied { read } for pid=1395 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 62.746755][ T36] audit: type=1400 audit(1754947242.869:321): avc: denied { open } for pid=1395 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 62.755735][ T1382] can0 (unregistered): slcan off ptm2. [ 62.771760][ T36] audit: type=1400 audit(1754947242.869:322): avc: denied { getattr } for pid=1395 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 62.820757][ T36] audit: type=1400 audit(1754947243.029:323): avc: denied { write } for pid=1394 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=425 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 62.844348][ T36] audit: type=1400 audit(1754947243.029:324): avc: denied { add_name } for pid=1394 comm="dhcpcd-run-hook" name="resolv.conf.can0.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 63.139948][ T1381] usb 6-1: USB disconnect, device number 2 [ 63.147450][ T1381] usblp0: removed [ 63.204961][ T622] Bluetooth: hci0: command 0x1003 tx timeout [ 63.211022][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 63.227324][ T9] usb 3-1: selecting invalid altsetting 0 [ 63.233187][ T9] usb 3-1: Found UVC 7.01 device syz (8086:0b07) [ 63.241386][ T9] usb 3-1: No valid video chain found. [ 63.252005][ T9] usb 3-1: USB disconnect, device number 13 [ 63.378562][ T1450] overlayfs: missing 'workdir' [ 63.395521][ T1452] capability: warning: `syz.5.353' uses 32-bit capabilities (legacy support in use) [ 63.405099][ T10] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 63.476979][ T1462] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 4256, size: 18446744073709551500) [ 63.477002][ T1462] rust_binder: Error while translating object. [ 63.489276][ T1462] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 63.495555][ T1462] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:55 [ 63.556139][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 63.580588][ T10] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 63.591550][ T10] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 63.602756][ T10] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 63.611948][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 63.620148][ T10] usb 4-1: Product: syz [ 63.624318][ T10] usb 4-1: Manufacturer: syz [ 63.629016][ T10] usb 4-1: SerialNumber: syz [ 63.635922][ T10] usb 4-1: bad CDC descriptors [ 63.666241][ T1475] rust_binder: Write failure EFAULT in pid:246 [ 63.837133][ T1434] rust_binder: Error while translating object. [ 63.843483][ T1434] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 63.850772][ T1434] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:340 [ 63.880768][ T1434] rust_binder: Error while translating object. [ 63.890036][ T1434] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 63.896510][ T1434] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:340 [ 63.950755][ T445] usb 4-1: USB disconnect, device number 8 [ 64.143690][ T1487] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 64.143718][ T1487] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 64.504978][ T445] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 64.597224][ T1504] overlay: ./bus is not a directory [ 64.602846][ T1504] rust_binder: Write failure EFAULT in pid:349 [ 64.612943][ T1506] 9pnet_fd: Insufficient options for proto=fd [ 64.627241][ T328] Bluetooth: hci0: Frame reassembly failed (-84) [ 64.665031][ T445] usb 6-1: Using ep0 maxpacket: 16 [ 64.671407][ T445] usb 6-1: config 6 has an invalid interface number: 59 but max is 0 [ 64.679626][ T445] usb 6-1: config 6 has no interface number 0 [ 64.685771][ T445] usb 6-1: config 6 interface 59 has no altsetting 0 [ 64.694176][ T445] usb 6-1: New USB device found, idVendor=0698, idProduct=6b82, bcdDevice=c3.eb [ 64.703540][ T445] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 64.711565][ T445] usb 6-1: Product: syz [ 64.715741][ T445] usb 6-1: Manufacturer: syz [ 64.720330][ T445] usb 6-1: SerialNumber: syz [ 66.645015][ T622] Bluetooth: hci0: command 0x1003 tx timeout [ 66.645023][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 66.717530][ T1511] rust_binder: 354: no such ref 3 [ 67.288590][ T9] usb 6-1: USB disconnect, device number 3 [ 67.454058][ T751] Bluetooth: hci0: Frame reassembly failed (-84) [ 67.512348][ T1549] SELinux: Context ϧ-):E2٭ؾ)đJu36ޢ{@m[ is not valid (left unmapped). [ 67.563907][ T1550] rust_binder: 1548 RLIMIT_NICE not set [ 67.584264][ T1554] /dev/nullb0: Can't lookup blockdev [ 67.664959][ T9] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 67.690169][ T1560] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:230 [ 67.816023][ T9] usb 6-1: config 0 has an invalid interface number: 28 but max is 0 [ 67.833341][ T9] usb 6-1: config 0 has no interface number 0 [ 67.839479][ T9] usb 6-1: config 0 interface 28 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 67.850590][ T9] usb 6-1: config 0 interface 28 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 67.860433][ T9] usb 6-1: New USB device found, idVendor=046d, idProduct=c534, bcdDevice= 0.00 [ 67.869523][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 67.878194][ T9] usb 6-1: config 0 descriptor?? [ 68.089258][ T9] usbhid 6-1:0.28: can't add hid device: -71 [ 68.096359][ T9] usbhid 6-1:0.28: probe with driver usbhid failed with error -71 [ 68.107388][ T9] usb 6-1: USB disconnect, device number 4 [ 68.444971][ T9] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 68.541082][ T1568] /dev/rnullb0: Can't open blockdev [ 68.594952][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 68.602239][ T9] usb 6-1: config 6 has an invalid interface number: 59 but max is 0 [ 68.607511][ T36] kauditd_printk_skb: 15 callbacks suppressed [ 68.607528][ T36] audit: type=1400 audit(1754947248.809:340): avc: denied { connect } for pid=1579 comm="syz.2.399" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 68.610780][ T9] usb 6-1: config 6 has no interface number 0 [ 68.643198][ T9] usb 6-1: config 6 interface 59 has no altsetting 0 [ 68.651230][ T9] usb 6-1: New USB device found, idVendor=0698, idProduct=6b82, bcdDevice=c3.eb [ 68.660431][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 68.668694][ T9] usb 6-1: Product: syz [ 68.671688][ T1580] netlink: 8 bytes leftover after parsing attributes in process `syz.2.399'. [ 68.672903][ T9] usb 6-1: Manufacturer: syz [ 68.672922][ T9] usb 6-1: SerialNumber: syz [ 68.684458][ T1580] /dev/rnullb0: Can't open blockdev [ 68.795001][ T1381] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 68.934994][ T1381] usb 4-1: device descriptor read/64, error -71 [ 69.085987][ T1604] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:267 [ 69.086561][ T1604] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 69.174970][ T1381] usb 4-1: device descriptor read/64, error -71 [ 69.425007][ T1381] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 69.524986][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 69.524997][ T622] Bluetooth: hci0: command 0x1003 tx timeout [ 69.555015][ T1381] usb 4-1: device descriptor read/64, error -71 [ 69.794983][ T1381] usb 4-1: device descriptor read/64, error -71 [ 69.905037][ T1381] usb usb4-port1: attempt power cycle [ 70.104786][ T1613] netlink: 8 bytes leftover after parsing attributes in process `syz.0.409'. [ 70.114714][ T1613] /dev/rnullb0: Can't open blockdev [ 70.184861][ T1631] SELinux: security_context_str_to_sid () failed with errno=-22 [ 70.245051][ T1381] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 70.266553][ T1381] usb 4-1: device descriptor read/8, error -71 [ 70.395890][ T1381] usb 4-1: device descriptor read/8, error -71 [ 70.427863][ T1646] netlink: 'syz.2.420': attribute type 5 has an invalid length. [ 70.435989][ T36] audit: type=1400 audit(1754947252.651:341): avc: denied { bind } for pid=1644 comm="syz.2.420" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 70.634969][ T1381] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 70.655966][ T1381] usb 4-1: device descriptor read/8, error -71 [ 70.786051][ T1381] usb 4-1: device descriptor read/8, error -71 [ 70.895046][ T1381] usb usb4-port1: unable to enumerate USB device [ 71.082961][ T1649] netlink: 12 bytes leftover after parsing attributes in process `syz.0.421'. [ 71.118339][ T45] usb 6-1: USB disconnect, device number 5 [ 71.197598][ T36] audit: type=1400 audit(1754947253.411:342): avc: denied { write } for pid=1659 comm="syz.0.425" name="ip6_flowlabel" dev="proc" ino=4026532483 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 71.227723][ T1657] netlink: 8 bytes leftover after parsing attributes in process `syz.5.424'. [ 71.241465][ T1657] /dev/rnullb0: Can't open blockdev [ 71.554974][ T45] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 71.589219][ T1678] netlink: 12 bytes leftover after parsing attributes in process `syz.3.431'. [ 71.705004][ T45] usb 6-1: Using ep0 maxpacket: 8 [ 71.712228][ T45] usb 6-1: unable to get BOS descriptor or descriptor too short [ 71.720760][ T45] usb 6-1: config 4 has an invalid interface number: 147 but max is 0 [ 71.728993][ T45] usb 6-1: config 4 contains an unexpected descriptor of type 0x2, skipping [ 71.737768][ T45] usb 6-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 71.747913][ T45] usb 6-1: config 4 has no interface number 0 [ 71.755330][ T45] usb 6-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 71.764385][ T45] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.772508][ T45] usb 6-1: Product: syz [ 71.776750][ T45] usb 6-1: Manufacturer: syz [ 71.781342][ T45] usb 6-1: SerialNumber: syz [ 71.964971][ T1381] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 71.996043][ T45] usb 6-1: Found UVC 0.02 device syz (04f2:b746) [ 72.002440][ T45] usb 6-1: No valid video chain found. [ 72.008837][ T45] usb 6-1: USB disconnect, device number 6 [ 72.115250][ T1381] usb 4-1: Using ep0 maxpacket: 8 [ 72.122300][ T1381] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 72.132552][ T1381] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 72.141732][ T1381] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 72.150828][ T1381] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 72.162241][ T1381] hub 4-1:1.0: bad descriptor, ignoring hub [ 72.168261][ T1381] hub 4-1:1.0: probe with driver hub failed with error -5 [ 72.361340][ T1685] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 72.369911][ T1685] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 72.485067][ T1381] usb 4-1: USB disconnect, device number 13 [ 72.503786][ T1692] /dev/rnullb0: Can't open blockdev [ 72.581977][ T36] audit: type=1400 audit(1754947255.787:343): avc: denied { read } for pid=1697 comm="syz.5.438" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 72.605537][ T36] audit: type=1400 audit(1754947255.787:344): avc: denied { ioctl } for pid=1697 comm="syz.5.438" path="/25/file0/.pending_reads" dev="incremental-fs" ino=2 ioctlcmd=0x671e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 72.676587][ T36] audit: type=1400 audit(1754947255.887:345): avc: denied { create } for pid=1701 comm="syz.5.439" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 72.754557][ T1708] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000000 not found [ 72.762877][ T1708] rust_binder: Write failure EINVAL in pid:89 [ 72.762890][ T1707] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000000 not found [ 72.762912][ T1707] rust_binder: Write failure EINVAL in pid:89 [ 72.928543][ T36] audit: type=1400 audit(1754947256.137:346): avc: denied { create } for pid=1713 comm="syz.3.443" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=key permissive=1 [ 72.949742][ T1716] tipc: Enabled bearer , priority 0 [ 72.960833][ T36] audit: type=1400 audit(1754947256.137:347): avc: denied { write } for pid=1713 comm="syz.3.443" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=key permissive=1 [ 72.980761][ T1716] tipc: Disabling bearer [ 73.023617][ T36] audit: type=1400 audit(1754947256.227:348): avc: denied { name_bind } for pid=1719 comm="syz.3.446" src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 73.334975][ T45] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 73.485958][ T45] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 73.494284][ T45] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 73.504589][ T45] usb 4-1: config 220 has no interface number 2 [ 73.510914][ T45] usb 4-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 73.524041][ T45] usb 4-1: config 220 interface 0 has no altsetting 0 [ 73.530915][ T45] usb 4-1: config 220 interface 76 has no altsetting 0 [ 73.537822][ T45] usb 4-1: config 220 interface 1 has no altsetting 0 [ 73.551821][ T45] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 73.561064][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 73.569241][ T45] usb 4-1: Product: syz [ 73.573415][ T45] usb 4-1: Manufacturer: syz [ 73.578192][ T45] usb 4-1: SerialNumber: syz [ 73.686545][ T1727] netlink: 'syz.5.448': attribute type 5 has an invalid length. [ 74.065029][ T1381] usb 6-1: new full-speed USB device number 7 using dummy_hcd [ 74.216159][ T1381] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 74.227123][ T1381] usb 6-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 74.236209][ T1381] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 74.244849][ T1381] usb 6-1: config 0 descriptor?? [ 74.252303][ T1734] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 74.380287][ T36] audit: type=1326 audit(1754947257.587:349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1735 comm="syz.2.451" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f9357f8ebe9 code=0x0 [ 74.871040][ T1734] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 74.879719][ T1734] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 74.891556][ T1381] usbhid 6-1:0.0: can't add hid device: -71 [ 74.897667][ T1381] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 74.908074][ T1381] usb 6-1: USB disconnect, device number 7 [ 75.125005][ T622] Bluetooth: hci0: command 0x1003 tx timeout [ 75.131260][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 75.141436][ T45] usb 4-1: selecting invalid altsetting 0 [ 75.147325][ T45] usb 4-1: Found UVC 7.01 device syz (8086:0b07) [ 75.151756][ T1741] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 75.153673][ T45] usb 4-1: No valid video chain found. [ 75.156329][ T45] usb 4-1: USB disconnect, device number 14 [ 75.223625][ T1381] rust_binder: 1739: removing orphan mapping 0:112 [ 75.233385][ T1381] rust_binder: 0: removing orphan mapping 112:1048 [ 75.274445][ T1381] rust_binder: 1742: removing orphan mapping 0:24 [ 75.293391][ T1750] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1750 comm=syz.2.456 [ 75.351639][ T1752] batadv0: tun_chr_ioctl cmd 2147767519 [ 75.357549][ T1752] batadv0: tun_chr_ioctl cmd 1074025672 [ 75.363230][ T1752] batadv0: ignored: set checksum enabled [ 75.370315][ T1752] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 75.370338][ T1752] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:308 [ 75.698108][ T36] audit: type=1400 audit(1754947258.907:350): avc: denied { read append } for pid=1762 comm="syz.3.460" name="loop-control" dev="devtmpfs" ino=48 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 75.757646][ T1765] rust_binder: validate_parent_fixup: new_min_offset=8796093022254, sg_entry.length=248 [ 75.757673][ T1765] rust_binder: Error while translating object. [ 75.789609][ T1765] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 75.806984][ T1765] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:327 [ 75.819247][ T36] audit: type=1400 audit(1754947258.907:351): avc: denied { open } for pid=1762 comm="syz.3.460" path="/dev/loop-control" dev="devtmpfs" ino=48 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 75.957202][ T36] audit: type=1400 audit(1754947258.957:352): avc: denied { map } for pid=1764 comm="syz.0.461" path="socket:[15677]" dev="sockfs" ino=15677 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 75.985850][ T36] audit: type=1400 audit(1754947258.977:353): avc: denied { read } for pid=1762 comm="syz.3.460" name="msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 76.039518][ T1775] netlink: 'syz.3.463': attribute type 16 has an invalid length. [ 76.047479][ T36] audit: type=1400 audit(1754947258.977:354): avc: denied { open } for pid=1762 comm="syz.3.460" path="/dev/cpu/0/msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 76.072505][ T1775] SELinux: security_context_str_to_sid () failed with errno=-22 [ 76.279374][ T1784] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:405 [ 76.334413][ T36] audit: type=1400 audit(1754947259.537:355): avc: denied { create } for pid=1792 comm="syz.5.471" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 76.334653][ T1793] rust_binder: Failed copying remainder into alloc: EFAULT [ 76.363340][ T1793] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 76.370854][ T1793] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 76.379142][ T1793] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:120 [ 76.399141][ T36] audit: type=1400 audit(1754947259.607:356): avc: denied { execute } for pid=1797 comm="syz.5.472" path="/dev/ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 76.434318][ T36] audit: type=1400 audit(1754947259.627:357): avc: denied { watch } for pid=1800 comm="syz.5.473" path="/39/file0" dev="tmpfs" ino=239 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 76.527290][ T1805] rust_binder: Failed to allocate buffer. len:1160, is_oneway:true [ 76.532185][ T1805] rust_binder: Read failure Err(EFAULT) in pid:132 [ 76.554980][ T45] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 76.716376][ T45] usb 4-1: unable to get BOS descriptor or descriptor too short [ 76.724542][ T45] usb 4-1: not running at top speed; connect to a high speed hub [ 76.733254][ T45] usb 4-1: config 129 has an invalid interface number: 135 but max is 0 [ 76.741695][ T45] usb 4-1: config 129 has an invalid interface number: 5 but max is 0 [ 76.749984][ T45] usb 4-1: config 129 has 2 interfaces, different from the descriptor's value: 1 [ 76.759153][ T45] usb 4-1: config 129 has no interface number 0 [ 76.765428][ T45] usb 4-1: config 129 has no interface number 1 [ 76.771680][ T45] usb 4-1: config 129 interface 135 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 76.785018][ T445] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 76.792521][ T45] usb 4-1: too many endpoints for config 129 interface 5 altsetting 7: 37, using maximum allowed: 30 [ 76.803469][ T45] usb 4-1: config 129 interface 5 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 37 [ 76.817009][ T45] usb 4-1: config 129 interface 135 has no altsetting 0 [ 76.823971][ T45] usb 4-1: config 129 interface 5 has no altsetting 0 [ 76.833106][ T45] usb 4-1: string descriptor 0 read error: -22 [ 76.839386][ T45] usb 4-1: New USB device found, idVendor=2040, idProduct=721f, bcdDevice=f2.00 [ 76.848512][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 76.859052][ T45] usb 4-1: MIDIStreaming interface descriptor not found [ 76.889364][ T1810] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 76.889397][ T1810] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:337 [ 76.964984][ T445] usb 6-1: Using ep0 maxpacket: 32 [ 76.980519][ T445] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 76.991523][ T445] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 77.001296][ T445] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 77.010381][ T445] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 77.018859][ T445] usb 6-1: config 0 descriptor?? [ 77.024622][ T445] hub 6-1:0.0: USB hub found [ 77.060239][ T1784] rust_binder: Write failure EINVAL in pid:405 [ 77.060600][ T1381] usb 4-1: USB disconnect, device number 15 [ 77.224704][ T445] hub 6-1:0.0: 1 port detected [ 77.628235][ T1812] devpts: called with bogus options [ 77.650019][ T36] audit: type=1400 audit(1754947260.857:358): avc: denied { getattr } for pid=1816 comm="syz.3.479" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 77.826787][ T445] hub 6-1:0.0: activate --> -90 [ 78.055385][ T1839] rust_binder: Write failure EINVAL in pid:433 [ 78.232602][ T45] usb 6-1: USB disconnect, device number 8 [ 78.390773][ T1853] SELinux: security_context_str_to_sid (sytem_uGй :) failed with errno=-22 [ 78.593380][ T1857] rust_binder: validate_parent_fixup: new_min_offset=8229, sg_entry.length=201 [ 78.593399][ T1857] rust_binder: Error while translating object. [ 78.602470][ T1857] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 78.608705][ T1857] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:316 [ 78.618891][ T1857] rust_binder: Error while translating object. [ 78.628127][ T1857] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 78.634304][ T1857] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:316 [ 78.643723][ T1381] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 78.687135][ T1864] /dev/rnullb0: Can't open blockdev [ 78.765315][ T1870] SELinux: failed to load policy [ 78.779578][ T1873] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 78.804944][ T1381] usb 4-1: Using ep0 maxpacket: 32 [ 78.811636][ T1381] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 219 [ 78.823276][ T1381] usb 4-1: New USB device found, idVendor=0499, idProduct=1010, bcdDevice= 5.f5 [ 78.832574][ T1381] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 78.840738][ T1381] usb 4-1: Product: syz [ 78.845136][ T1381] usb 4-1: Manufacturer: syz [ 78.849801][ T1381] usb 4-1: SerialNumber: syz [ 78.854980][ T1381] usb 4-1: config 0 descriptor?? [ 78.860211][ T1853] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 78.945014][ T65] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 79.034977][ T10] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 79.094982][ T65] usb 3-1: Using ep0 maxpacket: 32 [ 79.101390][ T65] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 79.109672][ T65] usb 3-1: config 0 has no interface number 0 [ 79.119634][ T65] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 79.122686][ T1881] netlink: 12 bytes leftover after parsing attributes in process `syz.3.502'. [ 79.128962][ T65] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 79.139532][ T1381] usb 4-1: USB disconnect, device number 16 [ 79.154985][ T65] usb 3-1: Product: syz [ 79.167988][ T65] usb 3-1: Manufacturer: syz [ 79.178130][ T65] usb 3-1: SerialNumber: syz [ 79.184953][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 79.185071][ T65] usb 3-1: config 0 descriptor?? [ 79.196066][ T10] usb 6-1: config 6 has an invalid interface number: 59 but max is 0 [ 79.196238][ T65] smsc95xx v2.0.0 [ 79.214656][ T10] usb 6-1: config 6 has no interface number 0 [ 79.221058][ T10] usb 6-1: config 6 interface 59 has no altsetting 0 [ 79.229904][ T10] usb 6-1: New USB device found, idVendor=0698, idProduct=6b82, bcdDevice=c3.eb [ 79.241064][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 79.249307][ T10] usb 6-1: Product: syz [ 79.253539][ T10] usb 6-1: Manufacturer: syz [ 79.258397][ T10] usb 6-1: SerialNumber: syz [ 79.351130][ T1888] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 3 [ 79.404961][ T65] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 79.418719][ T65] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 79.449385][ T65] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 79.460833][ T65] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -71 [ 79.482108][ T65] usb 3-1: USB disconnect, device number 14 [ 79.511601][ T36] kauditd_printk_skb: 6 callbacks suppressed [ 79.511621][ T36] audit: type=1400 audit(1754947262.717:365): avc: granted { setsecparam } for pid=1898 comm="syz.2.508" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 79.545255][ T1902] rust_binder: Error while translating object. [ 79.545300][ T1902] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 79.551611][ T1902] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:336 [ 79.914937][ T10] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 80.086035][ T10] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 80.094173][ T10] usb 4-1: config 0 has no interface number 0 [ 80.100568][ T10] usb 4-1: config 0 interface 1 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 80.112342][ T10] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 80.123789][ T10] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 80.133787][ T10] usb 4-1: config 0 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 80.148485][ T10] usb 4-1: New USB device found, idVendor=28bd, idProduct=0042, bcdDevice= 0.00 [ 80.157770][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 80.167934][ T10] usb 4-1: config 0 descriptor?? [ 80.574502][ T10] hid (null): report_id 35660 is invalid [ 80.774989][ T1913] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 80.846551][ T1913] rust_binder: Error in use_page_slow: ESRCH [ 80.846573][ T1913] rust_binder: use_range failure ESRCH [ 80.852983][ T1914] rust_binder: Error in use_page_slow: ESRCH [ 80.858846][ T1913] rust_binder: Failed to allocate buffer. len:24, is_oneway:false [ 80.864878][ T1914] rust_binder: use_range failure ESRCH [ 80.872955][ T1913] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 80.878668][ T1914] rust_binder: Failed to allocate buffer. len:24, is_oneway:false [ 80.888593][ T1913] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:466 [ 80.896731][ T1914] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 80.906141][ T1913] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:466 [ 80.915871][ T1914] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:466 [ 81.235877][ T1916] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 81.265005][ T1917] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 81.423882][ T1927] netlink: 20 bytes leftover after parsing attributes in process `syz.0.517'. [ 81.439807][ T36] audit: type=1400 audit(1754947264.647:366): avc: denied { execute } for pid=1926 comm="syz.0.517" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 81.633860][ T1935] netlink: 12 bytes leftover after parsing attributes in process `syz.0.520'. [ 81.812422][ T445] usb 6-1: USB disconnect, device number 9 [ 82.106899][ T1948] rust_binder: Write failure EFAULT in pid:153 [ 82.159251][ T1953] Dead loop on virtual device ip6_vti0, fix it urgently! [ 82.173382][ T1953] Dead loop on virtual device ip6_vti0, fix it urgently! [ 82.180888][ T1953] Dead loop on virtual device ip6_vti0, fix it urgently! [ 82.188232][ T1953] Dead loop on virtual device ip6_vti0, fix it urgently! [ 82.195700][ T1953] Dead loop on virtual device ip6_vti0, fix it urgently! [ 82.203005][ T1953] Dead loop on virtual device ip6_vti0, fix it urgently! [ 82.683619][ T10] uclogic 0003:28BD:0042.0005: failed retrieving string descriptor #100: -71 [ 82.698203][ T10] uclogic 0003:28BD:0042.0005: failed retrieving pen parameters: -71 [ 82.714970][ T10] uclogic 0003:28BD:0042.0005: pen probing failed: -71 [ 82.722077][ T10] uclogic 0003:28BD:0042.0005: failed probing parameters: -71 [ 82.731070][ T10] uclogic 0003:28BD:0042.0005: probe with driver uclogic failed with error -71 [ 82.746103][ T10] usb 4-1: USB disconnect, device number 17 [ 82.774918][ T1966] tmpfs: Unknown parameter 'r ' [ 82.781206][ T36] audit: type=1400 audit(1754947265.987:367): avc: denied { map } for pid=1965 comm="syz.2.529" path="socket:[16839]" dev="sockfs" ino=16839 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 82.805613][ T36] audit: type=1400 audit(1754947265.987:368): avc: denied { read } for pid=1965 comm="syz.2.529" path="socket:[16839]" dev="sockfs" ino=16839 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 82.862579][ T751] Bluetooth: hci0: Frame reassembly failed (-84) [ 83.032496][ T36] audit: type=1400 audit(1754947266.237:369): avc: denied { setopt } for pid=1976 comm="syz.5.533" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 83.036215][ T1977] 9pnet_fd: Insufficient options for proto=fd [ 83.071596][ T1979] binder: Unknown parameter 'context' [ 83.074969][ T9] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 83.099076][ T1981] rust_binder: 170: no such ref 0 [ 83.193452][ T1987] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 83.203014][ T1989] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 83.245034][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 83.251771][ T9] usb 3-1: config 6 has an invalid interface number: 59 but max is 0 [ 83.259997][ T9] usb 3-1: config 6 has no interface number 0 [ 83.266183][ T9] usb 3-1: config 6 interface 59 has no altsetting 0 [ 83.274355][ T9] usb 3-1: New USB device found, idVendor=0698, idProduct=6b82, bcdDevice=c3.eb [ 83.283857][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 83.292082][ T9] usb 3-1: Product: syz [ 83.296318][ T9] usb 3-1: Manufacturer: syz [ 83.301210][ T9] usb 3-1: SerialNumber: syz [ 83.311165][ T1991] input: syz1 as /devices/virtual/input/input11 [ 83.334877][ T1994] 9pnet_fd: Insufficient options for proto=fd [ 84.746851][ T36] audit: type=1400 audit(1754947267.957:370): avc: denied { write } for pid=2013 comm="syz.0.546" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 84.884996][ T622] Bluetooth: hci0: command 0x1003 tx timeout [ 84.884993][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 84.974194][ T36] audit: type=1400 audit(1754947268.177:371): avc: denied { listen } for pid=2024 comm="syz.5.549" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 85.407715][ T2029] rust_binder: 482: no such ref 0 [ 85.413240][ T36] audit: type=1400 audit(1754947268.617:372): avc: denied { write } for pid=2028 comm="syz.3.551" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 85.413411][ T2029] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 85.443191][ T36] audit: type=1400 audit(1754947268.647:373): avc: denied { accept } for pid=2028 comm="syz.3.551" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 85.463816][ T2029] netlink: 4 bytes leftover after parsing attributes in process `syz.3.551'. [ 85.481455][ T2031] netlink: 12 bytes leftover after parsing attributes in process `syz.3.552'. [ 85.491746][ T2031] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 85.491774][ T2031] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:484 [ 85.512555][ T2034] rust_binder: Write failure EFAULT in pid:487 [ 85.538038][ T2038] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 85.555394][ T36] audit: type=1400 audit(1754947268.767:374): avc: denied { mounton } for pid=2037 comm="syz.3.555" path="/file0" dev="ramfs" ino=17039 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 85.629932][ T2046] netlink: 'syz.0.558': attribute type 1 has an invalid length. [ 85.637651][ T2046] netlink: 'syz.0.558': attribute type 2 has an invalid length. [ 85.834979][ T65] usb 4-1: new full-speed USB device number 18 using dummy_hcd [ 85.847740][ T10] usb 3-1: USB disconnect, device number 15 [ 85.917132][ T2052] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 85.920099][ T2052] rust_binder: Failed to allocate buffer. len:4232, is_oneway:false [ 85.938537][ T2056] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:349 [ 85.951575][ T2059] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 85.961218][ T2059] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 85.967882][ T2059] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:392 [ 85.996470][ T65] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 86.023368][ T65] usb 4-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 86.032747][ T65] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.040885][ T65] usb 4-1: Product: syz [ 86.047891][ T65] usb 4-1: Manufacturer: syz [ 86.052516][ T65] usb 4-1: SerialNumber: syz [ 86.058016][ T65] usb 4-1: config 0 descriptor?? [ 86.274999][ T10] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 86.425018][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 86.431870][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 86.443126][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 86.455997][ T10] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 86.465062][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 86.473657][ T10] usb 3-1: config 0 descriptor?? [ 86.770678][ T65] usb 4-1: bad CDC descriptors [ 86.775719][ T65] usb 4-1: unsupported MDLM descriptors [ 86.782426][ T65] usb 4-1: USB disconnect, device number 18 [ 86.881294][ T10] HID 045e:07da: Invalid code 65791 type 1 [ 86.896509][ T10] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:045E:07DA.0006/input/input12 [ 86.909356][ T10] microsoft 0003:045E:07DA.0006: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 87.044962][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 87.051118][ T622] Bluetooth: hci0: command 0x1003 tx timeout [ 87.110026][ T36] audit: type=1400 audit(1754947270.317:375): avc: denied { shutdown } for pid=2092 comm="syz.3.575" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 87.605035][ T65] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 87.756163][ T65] usb 4-1: New USB device found, idVendor=0403, idProduct=6010, bcdDevice=c6.98 [ 87.765336][ T65] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.774068][ T65] usb 4-1: config 0 descriptor?? [ 87.779988][ T65] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 87.788001][ T65] ftdi_sio ttyUSB0: unknown device type: 0xc698 [ 87.806970][ T2110] rust_binder: Write failure EFAULT in pid:210 [ 87.923127][ T2122] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 87.977515][ T45] rust_binder: 2120: removing orphan mapping 0:112 [ 87.984706][ T45] rust_binder: 0: removing orphan mapping 112:1048 [ 87.988289][ T36] audit: type=1400 audit(1754947271.187:376): avc: denied { map } for pid=2106 comm="syz.3.580" path="/181" dev="tmpfs" ino=990 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 88.012900][ T2107] rust_binder: Failed to allocate buffer. len:4144, is_oneway:false [ 88.017725][ T45] usb 4-1: USB disconnect, device number 19 [ 88.032271][ T45] ftdi_sio 4-1:0.0: device disconnected [ 88.354967][ T65] usb 6-1: new full-speed USB device number 11 using dummy_hcd [ 88.484978][ T65] usb 6-1: device descriptor read/64, error -71 [ 88.652134][ T2131] netlink: 'syz.3.589': attribute type 1 has an invalid length. [ 88.659864][ T2131] netlink: 'syz.3.589': attribute type 2 has an invalid length. [ 88.734999][ T65] usb 6-1: device descriptor read/64, error -71 [ 88.964990][ T10] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 88.975004][ T65] usb 6-1: new full-speed USB device number 12 using dummy_hcd [ 88.978754][ T9] usb 3-1: USB disconnect, device number 16 [ 89.115011][ T65] usb 6-1: device descriptor read/64, error -71 [ 89.134988][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 89.145984][ T10] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 89.165174][ T10] usb 4-1: config 179 has no interface number 0 [ 89.171477][ T10] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 89.182926][ T10] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 89.204387][ T10] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 89.215931][ T10] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 89.228625][ T10] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 89.242114][ T10] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 89.252326][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 89.265297][ T2134] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 89.354977][ T65] usb 6-1: device descriptor read/64, error -71 [ 89.407834][ T2144] rust_binder: Write failure EFAULT in pid:362 [ 89.456950][ T2147] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 89.463483][ T2148] netlink: 8 bytes leftover after parsing attributes in process `syz.2.595'. [ 89.477541][ T2147] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 89.486478][ T65] usb usb6-port1: attempt power cycle [ 89.519395][ T2150] rust_binder: Error while translating object. [ 89.519427][ T2150] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 89.525722][ T2150] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:368 [ 89.768422][ C0] xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 89.769614][ T2162] rust_binder: Write failure EFAULT in pid:378 [ 89.777531][ C0] xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 89.777612][ T10] usb 4-1: USB disconnect, device number 20 [ 89.786582][ T2161] rust_binder: Write failure EFAULT in pid:378 [ 89.845329][ T65] usb 6-1: new full-speed USB device number 13 using dummy_hcd [ 89.876338][ T65] usb 6-1: device descriptor read/8, error -71 [ 89.930582][ T2171] rust_binder: Failed copying remainder into alloc: EFAULT [ 89.930601][ T2171] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 89.938363][ T2171] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 89.947358][ T2171] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:417 [ 90.006138][ T65] usb 6-1: device descriptor read/8, error -71 [ 90.100833][ T36] audit: type=1400 audit(1754947273.307:377): avc: denied { bind } for pid=2179 comm="syz.0.604" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 90.121543][ T36] audit: type=1400 audit(1754947273.327:378): avc: denied { write } for pid=2179 comm="syz.0.604" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 90.274978][ T65] usb 6-1: new full-speed USB device number 14 using dummy_hcd [ 90.286743][ T36] audit: type=1400 audit(1754947273.497:379): avc: denied { append } for pid=2186 comm="syz.3.608" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 90.302588][ T2187] 9p: Unknown Cache mode or invalid value OZreadaheb귦kb Pؑ$F"B [ 90.320282][ T36] audit: type=1400 audit(1754947273.527:380): avc: denied { read } for pid=2189 comm="syz.0.607" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 90.339871][ T65] usb 6-1: device descriptor read/8, error -71 [ 90.476167][ T65] usb 6-1: device descriptor read/8, error -71 [ 90.585201][ T65] usb usb6-port1: unable to enumerate USB device [ 90.614968][ T9] usb 4-1: new full-speed USB device number 21 using dummy_hcd [ 90.641729][ T2200] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION freeze notification not active [ 90.650668][ T2200] rust_binder: Write failure EINVAL in pid:387 [ 90.766212][ T9] usb 4-1: config 0 has an invalid interface number: 200 but max is 0 [ 90.780692][ T9] usb 4-1: config 0 has no interface number 0 [ 90.786935][ T9] usb 4-1: config 0 interface 200 altsetting 2 has an endpoint descriptor with address 0xFB, changing to 0x8B [ 90.798889][ T9] usb 4-1: config 0 interface 200 altsetting 2 endpoint 0x8B has invalid wMaxPacketSize 0 [ 90.809102][ T9] usb 4-1: config 0 interface 200 has no altsetting 0 [ 90.817360][ T9] usb 4-1: New USB device found, idVendor=0b57, idProduct=8520, bcdDevice=6d.39 [ 90.826467][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 90.834442][ T9] usb 4-1: Product: syz [ 90.838883][ T9] usb 4-1: Manufacturer: syz [ 90.843501][ T9] usb 4-1: SerialNumber: syz [ 90.848792][ T9] usb 4-1: config 0 descriptor?? [ 90.894962][ T10] usb 3-1: new full-speed USB device number 17 using dummy_hcd [ 91.024983][ T10] usb 3-1: device descriptor read/64, error -71 [ 91.059565][ T9] usbhid 4-1:0.200: couldn't find an input interrupt endpoint [ 91.067973][ T9] usb 4-1: USB disconnect, device number 21 [ 91.265187][ T10] usb 3-1: device descriptor read/64, error -71 [ 91.505011][ T10] usb 3-1: new full-speed USB device number 18 using dummy_hcd [ 91.635031][ T10] usb 3-1: device descriptor read/64, error -71 [ 91.825000][ T65] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 91.875001][ T10] usb 3-1: device descriptor read/64, error -71 [ 91.985074][ T10] usb usb3-port1: attempt power cycle [ 92.214038][ T2226] netlink: 8 bytes leftover after parsing attributes in process `syz.5.621'. [ 92.234019][ T2229] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 92.243834][ T2229] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 92.257320][ T2229] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 92.265855][ T2229] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 92.274466][ T36] audit: type=1400 audit(1754947275.477:381): avc: denied { bind } for pid=2227 comm="syz.5.622" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 92.355109][ T10] usb 3-1: new full-speed USB device number 19 using dummy_hcd [ 92.375984][ T10] usb 3-1: device descriptor read/8, error -71 [ 92.506012][ T10] usb 3-1: device descriptor read/8, error -71 [ 92.535002][ T445] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 92.664946][ T445] usb 6-1: device descriptor read/64, error -71 [ 92.745056][ T10] usb 3-1: new full-speed USB device number 20 using dummy_hcd [ 92.766079][ T10] usb 3-1: device descriptor read/8, error -71 [ 92.896021][ T10] usb 3-1: device descriptor read/8, error -71 [ 92.914944][ T445] usb 6-1: device descriptor read/64, error -71 [ 93.005093][ T10] usb usb3-port1: unable to enumerate USB device [ 93.164960][ T445] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 93.294963][ T445] usb 6-1: device descriptor read/64, error -71 [ 93.330950][ T2234] binder: Unknown parameter 'fscontext?}' [ 93.330984][ T2233] binder: Unknown parameter 'fscontext?}' [ 93.534936][ T445] usb 6-1: device descriptor read/64, error -71 [ 93.655051][ T445] usb usb6-port1: attempt power cycle [ 94.004959][ T445] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 94.026040][ T445] usb 6-1: device descriptor read/8, error -71 [ 94.156107][ T445] usb 6-1: device descriptor read/8, error -71 [ 94.173924][ T2249] netlink: 8 bytes leftover after parsing attributes in process `syz.0.630'. [ 94.194948][ T9] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 94.243081][ T36] audit: type=1400 audit(1754947277.447:382): avc: denied { lock } for pid=2254 comm="syz.0.632" path="socket:[20704]" dev="sockfs" ino=20704 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 94.266941][ T36] audit: type=1400 audit(1754947277.447:383): avc: denied { getopt } for pid=2254 comm="syz.0.632" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 94.345168][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 94.351588][ T9] usb 3-1: config 0 has no interfaces? [ 94.357892][ T9] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 94.367052][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 94.375259][ T9] usb 3-1: SerialNumber: syz [ 94.380565][ T9] usb 3-1: config 0 descriptor?? [ 94.414989][ T445] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 94.435925][ T445] usb 6-1: device descriptor read/8, error -71 [ 94.566171][ T445] usb 6-1: device descriptor read/8, error -71 [ 94.632485][ T45] usb 3-1: USB disconnect, device number 21 [ 94.675096][ T445] usb usb6-port1: unable to enumerate USB device [ 94.696332][ T2263] rust_binder: Failed to allocate buffer. len:1048, is_oneway:true [ 94.792978][ T2275] netlink: 8 bytes leftover after parsing attributes in process `syz.3.639'. [ 95.054996][ T9] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 95.140224][ T36] audit: type=1326 audit(1754947278.347:384): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2256 comm="syz.0.633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f111618ebe9 code=0x7fc00000 [ 95.206391][ T9] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 95.218104][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 95.229269][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 95.243786][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 95.259932][ T9] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 95.269062][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.282513][ T9] usb 4-1: config 0 descriptor?? [ 95.288999][ T2277] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 95.524971][ T1444] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 95.674938][ T1444] usb 3-1: Using ep0 maxpacket: 32 [ 95.681190][ T1444] usb 3-1: config index 0 descriptor too short (expected 6180, got 36) [ 95.689647][ T1444] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 95.700572][ T1444] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 95.711199][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 95.718653][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 95.726171][ T1444] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 95.735306][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 95.742716][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 95.750218][ T1444] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.758528][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 95.766165][ T1444] usb 3-1: config 0 descriptor?? [ 95.771181][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 95.778620][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 95.786499][ T1444] hub 3-1:0.0: USB hub found [ 95.791211][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 95.798664][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 95.806087][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 95.813579][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 95.820989][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 95.828573][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 95.835991][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 95.843391][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 95.851051][ T9] plantronics 0003:047F:FFFF.0007: No inputs registered, leaving [ 95.860123][ T9] plantronics 0003:047F:FFFF.0007: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 95.986497][ T1444] hub 3-1:0.0: 1 port detected [ 96.119442][ T1381] usb 4-1: USB disconnect, device number 23 [ 96.389099][ T1444] usb 3-1: USB disconnect, device number 22 [ 96.396872][ T9] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 96.554999][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 96.561416][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 96.572820][ T9] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 96.585913][ T9] usb 6-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice= 0.00 [ 96.594986][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.603855][ T9] usb 6-1: config 0 descriptor?? [ 96.660157][ T2300] netlink: 8 bytes leftover after parsing attributes in process `syz.3.649'. [ 96.907508][ T2304] overlayfs: missing 'lowerdir' [ 96.915012][ T1444] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 97.075897][ T1444] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 97.086913][ T1444] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 97.096764][ T1444] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 97.109717][ T1444] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 97.118910][ T1444] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 97.127592][ T1444] usb 4-1: config 0 descriptor?? [ 97.166180][ T2311] SELinux: security_context_str_to_sid (sysadm_u) failed with errno=-22 [ 97.504984][ T10] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 97.535402][ T1444] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 97.542841][ T1444] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 97.551029][ T1444] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 97.558510][ T1444] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 97.566041][ T1444] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 97.573496][ T1444] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 97.581031][ T1444] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 97.588796][ T1444] plantronics 0003:047F:FFFF.0008: No inputs registered, leaving [ 97.597689][ T1444] plantronics 0003:047F:FFFF.0008: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 97.666493][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 97.675397][ T10] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 97.683002][ T10] usb 3-1: can't read configurations, error -61 [ 97.795803][ T36] audit: type=1400 audit(1754947281.007:385): avc: denied { nlmsg_read } for pid=2301 comm="syz.3.650" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 97.795810][ T2302] netlink: 2 bytes leftover after parsing attributes in process `syz.3.650'. [ 97.824994][ T10] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 97.827081][ T36] audit: type=1400 audit(1754947281.037:386): avc: denied { read } for pid=2301 comm="syz.3.650" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 97.853391][ T45] usb 4-1: USB disconnect, device number 24 [ 97.977224][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 97.986025][ T10] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 97.993666][ T10] usb 3-1: can't read configurations, error -61 [ 98.000148][ T10] usb usb3-port1: attempt power cycle [ 98.086946][ T9] usbhid 6-1:0.0: can't add hid device: -71 [ 98.093057][ T9] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 98.101844][ T9] usb 6-1: USB disconnect, device number 19 [ 98.201406][ T36] audit: type=1400 audit(1754947281.407:387): avc: denied { connect } for pid=2325 comm="syz.0.658" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 98.344998][ T10] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 98.366589][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 98.375330][ T10] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 98.382918][ T10] usb 3-1: can't read configurations, error -61 [ 98.402839][ T2328] netlink: 8 bytes leftover after parsing attributes in process `syz.3.659'. [ 98.429269][ T2332] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:577 [ 98.516977][ T10] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 98.547085][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 98.555956][ T10] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 98.563541][ T10] usb 3-1: can't read configurations, error -61 [ 98.569979][ T10] usb usb3-port1: unable to enumerate USB device [ 105.455832][ T36] audit: type=1400 audit(1754947288.667:388): avc: denied { name_bind } for pid=2349 comm="syz.5.668" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 105.527788][ T2364] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 105.527812][ T2364] rust_binder: Read failure Err(EFAULT) in pid:463 [ 105.575957][ T36] audit: type=1400 audit(1754947288.787:389): avc: denied { create } for pid=2374 comm="syz.2.675" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 105.835040][ T1381] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 105.925059][ T65] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 105.985002][ T1381] usb 3-1: Using ep0 maxpacket: 32 [ 105.991434][ T1381] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 105.999674][ T1381] usb 3-1: config 0 has no interface number 0 [ 106.005830][ T1381] usb 3-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 106.015859][ T1381] usb 3-1: config 0 interface 196 has no altsetting 0 [ 106.024014][ T1381] usb 3-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 106.033103][ T1381] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.041207][ T1381] usb 3-1: Product: syz [ 106.045382][ T1381] usb 3-1: Manufacturer: syz [ 106.049972][ T1381] usb 3-1: SerialNumber: syz [ 106.055226][ T1381] usb 3-1: config 0 descriptor?? [ 106.060478][ T2375] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 106.075008][ T65] usb 6-1: Using ep0 maxpacket: 32 [ 106.081352][ T65] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 106.089878][ T65] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 106.098659][ T65] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 106.108805][ T65] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 106.117789][ T65] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 106.130816][ T65] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 106.140066][ T65] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.148789][ T65] usb 6-1: config 0 descriptor?? [ 106.269848][ T2375] tipc: Enabling of bearer rejected, media not registered [ 106.351004][ T36] audit: type=1400 audit(1754947289.557:390): avc: denied { write } for pid=10 comm="kworker/0:1" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=21615 scontext=system_u:system_r:kernel_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 106.370874][ T2382] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 106.785118][ T1381] ipheth 3-1:0.196: Unable to find endpoints [ 106.805543][ T1381] usb 3-1: USB disconnect, device number 27 [ 107.184974][ T1381] usb 3-1: new low-speed USB device number 28 using dummy_hcd [ 107.198871][ T2397] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 107.198899][ T2397] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 107.206933][ T2397] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:602 [ 107.224332][ T36] audit: type=1400 audit(1754947290.427:391): avc: denied { map } for pid=2398 comm="syz.3.683" path="/dev/zero" dev="devtmpfs" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:zero_device_t tclass=chr_file permissive=1 [ 107.251876][ T2406] /dev/nullb0: Can't lookup blockdev [ 107.256437][ T36] audit: type=1400 audit(1754947290.427:392): avc: denied { connect } for pid=2398 comm="syz.3.683" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 107.271981][ T2406] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2874 sclass=netlink_route_socket pid=2406 comm=syz.3.685 [ 107.281296][ T36] audit: type=1400 audit(1754947290.467:393): avc: denied { create } for pid=2405 comm="syz.3.685" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 107.296714][ T2406] netlink: 4 bytes leftover after parsing attributes in process `syz.3.685'. [ 107.344958][ T1381] usb 3-1: device descriptor read/64, error -71 [ 107.585055][ T1381] usb 3-1: device descriptor read/64, error -71 [ 107.664953][ T45] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 107.814364][ T45] usb 4-1: Using ep0 maxpacket: 32 [ 107.820579][ T45] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 107.828925][ T45] usb 4-1: config 0 has no interface number 0 [ 107.833753][ T1381] usb 3-1: new low-speed USB device number 29 using dummy_hcd [ 107.836417][ T45] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 107.851541][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.859551][ T45] usb 4-1: Product: syz [ 107.863740][ T45] usb 4-1: Manufacturer: syz [ 107.868319][ T45] usb 4-1: SerialNumber: syz [ 107.873532][ T45] usb 4-1: config 0 descriptor?? [ 107.879143][ T45] smsc95xx v2.0.0 [ 107.960100][ T1381] usb 3-1: device descriptor read/64, error -71 [ 108.192771][ T1381] usb 3-1: device descriptor read/64, error -71 [ 108.267645][ T45] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 108.278460][ T45] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 108.299348][ T1381] usb usb3-port1: attempt power cycle [ 108.482115][ T45] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 108.493016][ T45] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -61 [ 108.573172][ T36] audit: type=1400 audit(1754947291.801:394): avc: denied { read } for pid=2407 comm="syz.0.686" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 108.605801][ T45] usb 6-1: USB disconnect, device number 20 [ 108.622664][ T2411] rust_binder: 2408 RLIMIT_NICE not set [ 108.622759][ T2411] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:468 [ 108.632022][ T1381] usb 3-1: new low-speed USB device number 30 using dummy_hcd [ 108.651546][ T10] rust_binder: 0: removing orphan mapping 0:4120 [ 108.678509][ T1381] usb 3-1: device descriptor read/8, error -71 [ 108.705111][ T36] audit: type=1400 audit(1754947291.935:395): avc: denied { mount } for pid=2422 comm="syz.0.691" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 108.708314][ T2423] bridge0: port 3(erspan0) entered blocking state [ 108.737727][ T2423] bridge0: port 3(erspan0) entered disabled state [ 108.740764][ T36] audit: type=1400 audit(1754947291.977:396): avc: denied { create } for pid=2424 comm="syz.5.692" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 108.744404][ T2423] erspan0: entered allmulticast mode [ 108.771281][ T2423] erspan0: entered promiscuous mode [ 108.777389][ T2423] bridge0: port 3(erspan0) entered blocking state [ 108.783837][ T2423] bridge0: port 3(erspan0) entered forwarding state [ 108.793756][ T36] audit: type=1400 audit(1754947292.028:397): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 108.816384][ T1381] usb 3-1: device descriptor read/8, error -71 [ 109.040638][ T2448] rust_binder: Write failure EFAULT in pid:295 [ 109.046481][ T1381] usb 3-1: new low-speed USB device number 31 using dummy_hcd [ 109.076511][ T1381] usb 3-1: device descriptor read/8, error -71 [ 109.202852][ T1381] usb 3-1: device descriptor read/8, error -71 [ 109.235190][ T328] Bluetooth: hci0: Frame reassembly failed (-84) [ 109.309240][ T1381] usb usb3-port1: unable to enumerate USB device [ 110.084210][ T751] bridge_slave_1: left allmulticast mode [ 110.098575][ T751] bridge_slave_1: left promiscuous mode [ 110.104246][ T751] bridge0: port 2(bridge_slave_1) entered disabled state [ 110.127090][ T751] bridge_slave_0: left allmulticast mode [ 110.139283][ T751] bridge_slave_0: left promiscuous mode [ 110.150400][ T751] bridge0: port 1(bridge_slave_0) entered disabled state [ 110.199935][ T1381] usb 4-1: USB disconnect, device number 25 [ 110.276463][ T2468] tmpfs: Bad value for 'nr_blocks' [ 110.315364][ T2471] ./cgroup: Can't lookup blockdev [ 110.330295][ T751] veth1_macvtap: left promiscuous mode [ 110.339521][ T751] veth0_vlan: left promiscuous mode [ 110.461471][ T2469] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.474712][ T2469] bridge0: port 1(bridge_slave_0) entered disabled state [ 110.482422][ T2469] bridge_slave_0: entered allmulticast mode [ 110.496754][ T2469] bridge_slave_0: entered promiscuous mode [ 110.509334][ T2469] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.522070][ T2469] bridge0: port 2(bridge_slave_1) entered disabled state [ 110.533416][ T2469] bridge_slave_1: entered allmulticast mode [ 110.539871][ T2469] bridge_slave_1: entered promiscuous mode [ 110.627395][ T2469] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.634587][ T2469] bridge0: port 2(bridge_slave_1) entered forwarding state [ 110.641915][ T2469] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.649059][ T2469] bridge0: port 1(bridge_slave_0) entered forwarding state [ 110.673434][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 110.681101][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 110.700317][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.707521][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 110.719291][ T328] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.726384][ T328] bridge0: port 2(bridge_slave_1) entered forwarding state [ 110.743522][ T2496] netlink: 12 bytes leftover after parsing attributes in process `syz.2.715'. [ 110.767479][ T2469] veth0_vlan: entered promiscuous mode [ 110.782186][ T2469] veth1_macvtap: entered promiscuous mode [ 110.807287][ T2502] 9pnet_fd: Insufficient options for proto=fd [ 111.060470][ T45] usb 3-1: new full-speed USB device number 32 using dummy_hcd [ 111.196987][ T622] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 111.203219][ T53] Bluetooth: hci0: command 0x1003 tx timeout [ 111.236963][ T45] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 111.248018][ T45] usb 3-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 111.257494][ T45] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.266726][ T45] usb 3-1: config 0 descriptor?? [ 111.277164][ T2502] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 111.378826][ T2533] syzkaller0: entered allmulticast mode [ 111.602998][ T2540] rust_binder: Error while translating object. [ 111.603038][ T2540] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 111.609555][ T2540] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:634 [ 111.648371][ T2550] netlink: 104 bytes leftover after parsing attributes in process `syz.6.731'. [ 111.765437][ T36] kauditd_printk_skb: 4 callbacks suppressed [ 111.765454][ T36] audit: type=1400 audit(1754947295.090:402): avc: denied { create } for pid=2558 comm="syz.6.734" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 111.869865][ T516] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 111.898324][ T45] usbhid 3-1:0.0: can't add hid device: -71 [ 111.904374][ T45] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 111.913035][ T45] usb 3-1: USB disconnect, device number 32 [ 112.026147][ T516] usb 4-1: Using ep0 maxpacket: 16 [ 112.032384][ T516] usb 4-1: config 6 has an invalid interface number: 59 but max is 0 [ 112.040662][ T516] usb 4-1: config 6 has no interface number 0 [ 112.046819][ T516] usb 4-1: config 6 interface 59 has no altsetting 0 [ 112.054976][ T516] usb 4-1: New USB device found, idVendor=0698, idProduct=6b82, bcdDevice=c3.eb [ 112.064122][ T516] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.072138][ T516] usb 4-1: Product: syz [ 112.076335][ T516] usb 4-1: Manufacturer: syz [ 112.080933][ T516] usb 4-1: SerialNumber: syz [ 112.538867][ T2563] netlink: 'syz.6.735': attribute type 3 has an invalid length. [ 112.572348][ T2568] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:45 [ 112.768992][ T2568] fuseblk: Bad value for 'user_id' [ 112.783235][ T2568] fuseblk: Bad value for 'user_id' [ 112.788903][ T2569] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:45 [ 113.517492][ T2587] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 113.762935][ T2594] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.762965][ T2594] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.818051][ T2601] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 4256, size: 18446744073709551500) [ 113.824543][ T2601] rust_binder: Error while translating object. [ 113.836788][ T2601] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 113.842981][ T2601] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:68 [ 113.867976][ T2604] rust_binder: 70: no such ref 0 [ 114.149811][ T36] audit: type=1400 audit(1754947297.524:403): avc: denied { create } for pid=2610 comm="syz.6.750" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 114.195140][ T36] audit: type=1400 audit(1754947297.565:404): avc: denied { bind } for pid=2619 comm="syz.6.752" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 114.293736][ T2627] input: syz0 as /devices/virtual/input/input14 [ 114.393048][ T36] audit: type=1400 audit(1754947297.780:405): avc: denied { getopt } for pid=2635 comm="syz.0.758" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 114.420764][ T2636] SELinux: security_context_str_to_sid () failed with errno=-22 [ 114.431516][ T2638] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 114.431543][ T2638] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 114.441639][ T2638] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:463 [ 114.451953][ T2638] rust_binder: got new transaction with bad transaction stack [ 114.452806][ T2641] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 114.461102][ T2638] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:463 [ 114.576581][ T10] usb 4-1: USB disconnect, device number 26 [ 114.618068][ T2652] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 114.627013][ T2652] overlayfs: missing 'lowerdir' [ 114.822775][ T2667] rust_binder: validate_parent_fixup: fixup_min_offset=46, parent_offset=36 [ 114.822799][ T2667] rust_binder: Error while translating object. [ 114.831807][ T2667] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 114.838183][ T2667] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:476 [ 114.941012][ T2684] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 32 [ 114.958239][ T2684] rust_binder: Write failure EINVAL in pid:490 [ 115.019909][ T10] usb 4-1: new low-speed USB device number 27 using dummy_hcd [ 115.168286][ T2689] rust_binder: Write failure EFAULT in pid:495 [ 115.169427][ T2689] 9pnet_fd: Insufficient options for proto=fd [ 115.198554][ T2691] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=37892 sclass=netlink_xfrm_socket pid=2691 comm=syz.2.776 [ 115.849072][ T2699] ------------[ cut here ]------------ [ 115.854693][ T2699] WARNING: CPU: 0 PID: 2699 at arch/x86/kvm/x86.c:11569 kvm_arch_vcpu_ioctl_run+0x12af/0x1aa0 [ 115.865028][ T2699] Modules linked in: [ 115.868980][ T2699] CPU: 0 UID: 0 PID: 2699 Comm: syz.2.779 Not tainted 6.12.38-syzkaller-gb632dc2e1d79 #0 9921eaa9ec7b66c9f160f95d92f0c8099666722b [ 115.882412][ T2699] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 115.892901][ T2699] RIP: 0010:kvm_arch_vcpu_ioctl_run+0x12af/0x1aa0 [ 115.899421][ T2699] Code: 7e 3b e8 34 05 6a 00 49 bd 00 00 00 00 00 fc ff df 4c 8b 7c 24 20 4c 8b 64 24 40 48 8b 5c 24 28 e9 26 fd ff ff e8 11 05 6a 00 <0f> 0b e9 e4 fc ff ff e8 05 05 6a 00 0f 0b e9 0e fd ff ff e8 f9 04 [ 115.919126][ T2699] RSP: 0018:ffffc9000e4879c0 EFLAGS: 00010293 [ 115.925348][ T2699] RAX: ffffffff811bd81f RBX: ffff88811fdc8000 RCX: ffff888113aea600 [ 115.933410][ T2699] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 115.941431][ T2699] RBP: ffffc9000e487c70 R08: ffff888113aea607 R09: 1ffff1102275d4c0 [ 115.949512][ T2699] R10: dffffc0000000000 R11: ffffed102275d4c1 R12: ffff88813f8c6000 [ 115.957558][ T2699] R13: dffffc0000000000 R14: 0000000000000001 R15: ffff88811fdc8078 [ 115.966021][ T2699] FS: 00007f9358ec86c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 115.975224][ T2699] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 115.981868][ T2699] CR2: 000000005200000c CR3: 0000000131a74000 CR4: 00000000003526b0 [ 115.989892][ T2699] DR0: 0080000000000006 DR1: 0000000000000800 DR2: 0000000000000401 [ 115.997937][ T2699] DR3: 0000000000000006 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 116.006004][ T2699] Call Trace: [ 116.009311][ T2699] [ 116.012302][ T2699] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 116.018328][ T2699] ? try_to_wake_up+0xe40/0x1b00 [ 116.023328][ T2699] ? plist_del+0x3e3/0x400 [ 116.027796][ T2699] ? __cfi_wait_rcu_exp_gp+0x10/0x10 [ 116.033173][ T2699] ? ioctl_has_perm+0x1aa/0x4d0 [ 116.038065][ T2699] ? __cfi_autoremove_wake_function+0x10/0x10 [ 116.044463][ T2699] ? ioctl_has_perm+0x3e0/0x4d0 [ 116.049465][ T2699] ? has_cap_mac_admin+0xd0/0xd0 [ 116.054489][ T2699] ? synchronize_rcu+0x77/0x2e0 [ 116.059475][ T2699] ? __cfi_synchronize_rcu+0x10/0x10 [ 116.065003][ T2699] ? __kasan_check_write+0x18/0x20 [ 116.070174][ T2699] kvm_vcpu_ioctl+0x96f/0xee0 [ 116.074905][ T2699] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 116.080182][ T2699] ? do_futex+0x356/0x500 [ 116.084564][ T2699] ? __cfi_do_futex+0x10/0x10 [ 116.089367][ T2699] ? __fget_files+0x2c5/0x340 [ 116.094086][ T2699] ? bpf_lsm_file_ioctl+0xd/0x20 [ 116.099092][ T2699] ? security_file_ioctl+0x34/0xd0 [ 116.104244][ T2699] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 116.109543][ T2699] __se_sys_ioctl+0x132/0x1b0 [ 116.114266][ T2699] __x64_sys_ioctl+0x7f/0xa0 [ 116.119008][ T2699] x64_sys_call+0x1878/0x2ee0 [ 116.123898][ T2699] do_syscall_64+0x58/0xf0 [ 116.128481][ T2699] ? clear_bhb_loop+0x50/0xa0 [ 116.133208][ T2699] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 116.139175][ T2699] RIP: 0033:0x7f9357f8ebe9 [ 116.143636][ T2699] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 116.163417][ T2699] RSP: 002b:00007f9358ec8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 116.171894][ T2699] RAX: ffffffffffffffda RBX: 00007f93581b5fa0 RCX: 00007f9357f8ebe9 [ 116.179922][ T2699] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 116.188025][ T2699] RBP: 00007f9358011e19 R08: 0000000000000000 R09: 0000000000000000 [ 116.196032][ T2699] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 116.204158][ T2699] R13: 00007f93581b6038 R14: 00007f93581b5fa0 R15: 00007fffdeb177a8 [ 116.212353][ T2699] [ 116.215415][ T2699] ---[ end trace 0000000000000000 ]---