last executing test programs: 9m25.692110837s ago: executing program 2 (id=174): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x402, 0x0) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x1, 0x0, 0x0) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x200000, 0x200000, 0x7}) sendmsg$unix(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)='\x00', 0x1}], 0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000300), 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000005400)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)=ANY=[@ANYBLOB], 0x18}}], 0x1, 0x11) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00'}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000200)=[@enter_looper], 0x50, 0x0, &(0x7f0000000380)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/238, 0xee, 0x2, 0x4}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x400}], 0x0, 0x0, 0x0}) vmsplice(r0, 0x0, 0x0, 0x4) 9m24.863202402s ago: executing program 2 (id=190): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140), 0x458242, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000002c0), 0x4b301, 0x0) ioctl$TCSETSF(r0, 0x5404, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) io_destroy(0x0) sendmsg$NL80211_CMD_STOP_AP(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, r2, 0x4, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x6, 0x5f}}}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) 9m24.845672203s ago: executing program 2 (id=191): r0 = creat(&(0x7f00000000c0)='./file1\x00', 0x67) close(r0) syz_io_uring_setup(0x10e, &(0x7f00000002c0)={0x0, 0x0, 0x1000, 0x3, 0xfffffffc, 0x0, r0}, 0x0, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000001200), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="7472610231f05232d3c671646e6f3d", @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB=',\x00']) r2 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r2, 0x770a, 0x0) 9m24.789330294s ago: executing program 2 (id=192): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000140)={@empty, @empty, @mcast1, 0x100001, 0x6, 0x0, 0x100, 0x10003, 0x180107, r2}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="d0010000100013070000000000000000ffffffff000000000000000000000000fe8000000000000000000000000000bb000000004e2300010000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000098001400636d61632861657329000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000006002"], 0x1d0}}, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) getpriority(0x1, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000000)={0x20, 0xffffffffffffffda, 0x0, {0x9, 0x0, 0x6, 0x4}}, 0x20) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="180000007600"], 0x1c}], 0x1, 0x0, 0x0, 0x4004000}, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r6, 0x1, 0xa, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x214a0b9, 0x0) mount$bind(&(0x7f00000001c0)='./file0/../file0\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) r7 = openat$null(0xffffffffffffff9c, &(0x7f00000001c0), 0x101401, 0x0) pwritev2(r7, &(0x7f00000014c0), 0x0, 0xff, 0x1, 0x24) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x181097, 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r4, 0xc018620c, &(0x7f0000000380)) sched_setattr(r5, &(0x7f0000000580)={0x38, 0x0, 0x30, 0x400, 0x14, 0xffffffffffff3da7, 0x1, 0x7, 0x0, 0x8}, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0xffffffffffffffff, &(0x7f0000000080)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/238, 0xee, 0x2, 0x4}, @ptr={0x70742a85, 0x0, &(0x7f0000000000)=""/122, 0x0, 0x0, 0x20}, @fda={0x66646185, 0x0, 0x0, 0x24}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x40}], 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000200)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x3, r8, 0x5bbf01f914353a98, &(0x7f0000000240)) ptrace$setregs(0xd, r8, 0x2, &(0x7f0000000600)="2b7db21e52eb4f2b52a10345da4842e264998880631efa8cbc3556f462b13e522b483deb36a2020d55cf95dd8c603a57b52acb4bcb4898d799455068d903d1625a13f02f407666f653330f182b79988a3132507f33444dc604304c454f7c7bb91b723f0bb44515428ebaff2d8608d07c4b8b2f11d83796c66d9fb504bf6d172fca4c5d9604d7692f87e17047a396554012731c76872f59a30bd9bd9b57459f5b8056a730bc804b96671ef615306aeae8b5e3bdb0c9eab759d20a0fc0ad80f0860d521152ac014278d753074ae28040339f7766395182d4cc269eb73ec143d6757009647a9cac5d202acabfaf2c0b7dfd1ef194bfa1") 9m24.788497964s ago: executing program 2 (id=193): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x2, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000001f80), 0x34, 0x181002) write$evdev(r1, &(0x7f0000002000)=[{{0x0, 0xea60}, 0x11, 0x6, 0x8}], 0x18) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) ioctl$USBDEVFS_CLEAR_HALT(r2, 0x80045515, &(0x7f0000000040)={0x1, 0x1}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x7fffffff, 0x0, 0x2}, {0xfffffffffffffffe, 0xffffffffffffffff}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x2b}, 0xa, @in6=@private1, 0x0, 0x4, 0x2, 0x0, 0x0, 0x0, 0x4000}]}]}, 0xfc}}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1000000003}) r4 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000080)={'pimreg0\x00', 0x1000}) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @rand_addr=0x64010102}, 0x3) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x3c, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_NAT_DST={0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xa8, 0x0, &(0x7f00000004c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/238, 0xee, 0x2, 0x4}, @fda={0x66646185, 0x1, 0x0, 0x8}, @fda={0x66646185, 0x4, 0x0, 0xfffffffffffffffd}}, &(0x7f0000000000)={0x0, 0x28, 0x48}}, 0x1000}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000200)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @flat=@weak_handle={0x77682a85, 0xa}}, &(0x7f0000000380)={0x0, 0x18, 0x30}}}, @release={0x40046306, 0x3}, @request_death], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x2, 0x0) (async) syz_open_dev$evdev(&(0x7f0000001f80), 0x34, 0x181002) (async) write$evdev(r1, &(0x7f0000002000)=[{{0x0, 0xea60}, 0x11, 0x6, 0x8}], 0x18) (async) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) (async) ioctl$USBDEVFS_CLEAR_HALT(r2, 0x80045515, &(0x7f0000000040)={0x1, 0x1}) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x7fffffff, 0x0, 0x2}, {0xfffffffffffffffe, 0xffffffffffffffff}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x2b}, 0xa, @in6=@private1, 0x0, 0x4, 0x2, 0x0, 0x0, 0x0, 0x4000}]}]}, 0xfc}}, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1000000003}) (async) socket$can_bcm(0x1d, 0x2, 0x2) (async) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000080)={'pimreg0\x00', 0x1000}) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @rand_addr=0x64010102}, 0x3) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) (async) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x3c, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_NAT_DST={0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xa8, 0x0, &(0x7f00000004c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/238, 0xee, 0x2, 0x4}, @fda={0x66646185, 0x1, 0x0, 0x8}, @fda={0x66646185, 0x4, 0x0, 0xfffffffffffffffd}}, &(0x7f0000000000)={0x0, 0x28, 0x48}}, 0x1000}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000200)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @flat=@weak_handle={0x77682a85, 0xa}}, &(0x7f0000000380)={0x0, 0x18, 0x30}}}, @release={0x40046306, 0x3}, @request_death], 0x0, 0x0, 0x0}) (async) 9m24.657873946s ago: executing program 2 (id=195): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0xffffc000) r1 = syz_io_uring_complete(0x0) ioctl$KIOCSOUND(r1, 0x4b2f, 0x7ff) openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0xffffc000) (async) syz_io_uring_complete(0x0) (async) ioctl$KIOCSOUND(r1, 0x4b2f, 0x7ff) (async) openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) (async) 9m24.579707358s ago: executing program 32 (id=195): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0xffffc000) r1 = syz_io_uring_complete(0x0) ioctl$KIOCSOUND(r1, 0x4b2f, 0x7ff) openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0xffffc000) (async) syz_io_uring_complete(0x0) (async) ioctl$KIOCSOUND(r1, 0x4b2f, 0x7ff) (async) openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) (async) 6m36.214946088s ago: executing program 3 (id=2675): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffff9) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x103, 0x3}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200), 0x2c, 0x0, &(0x7f0000000380)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff49a7cd528a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) pwritev(r1, &(0x7f00000001c0)=[{&(0x7f00000000c0)="7061d60da93573772e6fad735ca93f9affb077d92e217a8c", 0x18}, {&(0x7f0000000140)="22cb3a6d5b896f7b3355254dfc3c0f58375ad770c4808ed5ecced256e3ffb117a7239c766954c4d2caf89c867603cf37e8ec7abc60667c4e9cc53073953572d5", 0x40}, {&(0x7f0000000180)="5a202ec02313d5d57838acc9528a0358b44d3ded34e4237d3094b43fc142", 0x1e}, {&(0x7f0000000580)="ed6516d84c4ea8314a5063dd13ecdc1bde68685845c24e7c530e0752ea2bc18b9b90a3ef4d5f114642cc12fc222020eb23b431b131bb6bc4821b496b969e8078bedbea71e7bf189194f621d298391a1a24574f90921e5e54ca479d9b48274d8c750e2ed1951e139c44fdcc8734731243be535620523e67a2c1bb74050061d2a804b5cca756a7c01f937630bb864239b911b0e4b058aaa24ee8a5e108e51b61f6050a0abef85bfcf2f67af20ee80f03fd5e8179a30b26a003c093b6ae0018eacf0acc90a1fc279b78f0b68ec6d88430aa286e4a833ae360266bb5c36c5fadc677bca27c5f0fa3df078044c7f6ae3a8f39adeb565615693b098a99568560c60d57949738e2cee54af9593107041d568a41fbdb57b97342949196f5e952bd1f7335df5a3198e3e5cf7f7858c3229b32be9f5aced1b51c9a34f241a3afae600de1ac01b530dbb4c1bffdc454d1699b3025a7526c524cd152f0b70d9d158589e00cfbcf152c1c31dc7336477df1233f7cb71163d3bc98c7cc28995f892c80b3cc5e6674cd28b4dc1d75e5ecbd7aa67faaea944a5d75e96c891210fdc3627e227635c250612fe8f74d56f5f1ab0b34749404d1e13741aebb87aea3469095abd88f9406aa61faf4828ba2ea6f2c2439ac984baaf6467078f38cd382ce47f3087c3712491a8945582c6f56d854db6236c808ed60776d19558d301e6b49ee85e9c1e8a7eac31d6689ab3bb738469af18ddf3736d2d8226c25b1a03c2ef80b48ae28b9ccf396bfad22b110c90a94662cd13e37dbd39b5ba8ce5e145965b4eb2deab9b98cdfcd1af2e58bf1136c9f0af53ab2b8c12fe9efea15fe32f153b103151361498a120d69449e9b7a833b08717a297266fceb63376d71de8059c6444ecfdb4f010752a107c309f8d8136a6672854fa0d3b8811ba67f597048e1f80036281045ff22a87034cf5da9841ba7071e95fbb73c905a199ff1c10655a2213c8e47545cc12079e00f09d6cdce24f2a01218ca1eead3525a01814d33ea2d63a6e432259a7f405060c3edc620b3ab66f9ff027a4ab5f024f9ff3a9e02cebd3f7e36e348512afff26a812b12b0892214e63cfd6ef9c5e5066c3cc072b04c3f77cbfd48f2a6ca06409e68c3694c4d192de487d121335963f462e142e705123634bf57d28c7e05af987517bbb7713e1bd9aa7ce1db2548f239ca2371074ec6fb9d05f68f5600bf1056c622d2b8fa482c4a84b8083269eb8a86ed6422b8e12f0b1a30f1c33748e59bdb4595cf5157aeffd21e08716a0e0ea0612073bddfa32ccb550e1620e55c8280b9374c81341a2f45a54cd19fc4416aa77514c280a0af9a3c29441da41fdcc4385f7046bc239e798ce99e2eb287d013d2844d9ca8d0a3f568847ccd93cb977d50471f82b65e6aa8cf1a21208ab1cf84148aadd6ad5a5032c4a9295c7d25f18078418628e731ec59c4aeeb896b57dc56fce02aab30e69a5f2d69a57ce7d5fe8dcc9067663143fd5236aea4ef36f58af274fd870fe0b7f620cfe874d88f4d5846a27d7ea83a6f575ceb8b10218e9b946b6527058f6d48e890a965c72f65a3c4cd33b65631ac1c4305fe4138f7846f8e3791e8783247835937772555cc6730eb36df21459b87d4c8aa39a0805dc2026f24b83737ee632e65b013b4bd4cf32b239aed6e7c125849d1b6996a600350d39e1eb26aa922617f660c82f7a962e5000dcc7db4de59611b1b33d5449abe461685d8af9b97ddb89aa3f740d1386d0a0188d765748c11a5a1a8b75fcef6011c349f4fff6bed9fdb26a74ba1d0504a30d0b0f12d84bf7c3357de6bd9cbc7bf57346181da92e077eaee878e7b013d32dec719fccfdcf03482fdb5be52cd7cbe4606bfd1e02691e9b3652d2bb6dc92d614d174cb42d5c175d5006ba186c9e77753da03486b9b7db8463d3e159b69c2f369e0c5935ed0a930a21ed20aa490a2c49e5f68a9d39ff217a35c68827dc93f81e92a3995782f513c9c93d073645bac27ee9b894f2a410288838ce7fedff8f753e941071ebc2e4ff2a5d56c8189bd309e27187316d4b891ed1aa70fcd549e60ef595092af74788c7bda5cc8935606afb2944fec98526b190111424b264d06365df68ffb21b4f430672f1049a2c95ed9a9d7180f283986e74af149cd740c6ee417e779b61f0937b76fd3f655edf1eda1ef0e723b57674246401de2f11a941ee86bde34f99ae14bd99d9a896814771930efb9aedaeb811d78990425f21d43ce9b0f89dd840f19ffa947481e0dfc45d7fd1d87e3558856f0ab6ecf25332f4ab025659c445b7b8af1c464ea329602c386f32d4a4636c274897cd9163d7dff744a0c899a9cec343a3a05245aa1af9f3021b97576741dae92ff3e31f492b4a05bd9343c7546e12bcca8ea3cf8dae8d28aef1a85ee7ead6d45c1bebd3b8d6516e651ed9641ebe5a7cc2be93e0a5dac0e0e8c96e45fe7882397edabd3ff34933fb8acd317e28085ccb99806a0d6daed84c6ce64f96065b3b458ebe2949595c05c5786aaccd4fbb2fd97b5984093c2ff67de6c7134ea85976989b25918ee3a02d7e49b5087f01b3eb80c459ba85c3815c75f2edd2e82640ca835792991373e81a8e5af873af1428640600d2e1e3aaddd52eb39d0b743282c837b069e856def6aafcd95212eed38d5820d156cdfc5ad910dfb12707d9afec6350d6a68af5371c0110401b9d1f56343059e65bdfed7ccfccfccf0085390596dcc5bcb24b98988cd657cc3f8cd46eb3f6083537414325f343a6a43518716788f4cc74a61307936ef843c4ce28466b4110b3deff161db0d980aa788168bf5aa95b846bf428d9b73df2ad74d0d7f0f987c0053e82a4767d0a7f79b64d3c1b26ccfb00dbc20892cbdd8cd7dbe214e3b68846fe3a8dd886901164a1a8725d2e5481187b528a3b3e7a38f54053f5ccb857d340ce1152e3475b7cd59de944de4d6dcb490232547adeaa75f63ce968cd3be7e85c09c66e058a180e14a07be595f52006bbfc748571f670821e9c0d051b730fa4736ba3275727bc2dc5b9d6e852fa029903cc454558ac1b7c8262ce37e4eb19398a780e6080338bc85382b34f07380cf4fc42317fec124c9e93f9e68009231146986cc04126cd79785133c79e180b19c7396502fc2433a668f7feb8fa8eecc71f3193d8bae4b631039b30b2f7a2dca9c768694bac8089e590c0d55b412b027e2dfcff34ce39d2e4a12104c90c384f42d460f00921a1eda1b7102d0d0a0490894989c59f7f91964159063bd974410cce8d5c930a2651916cf18fd9c081e66becaefdeb29e67ad1094b19ee19b23bbb30da0ccfa8ce82d6808f78506b2ab30655ca86e282ac61d87d82b26313290ed397133deac7ffa75ed62dd38d1b28b2e5a05fe02756088ebe2676f005632043c3dc863d1e8144b64ac7e9ac0f7edf5754bdee19c8260fcb1c3d77e2855091201b3be3bce20aa783f41b9646be8b26fe1b50710afd15135386f021cd4796e1f43ba5e97e48d6b89805b414652a95da8cfb8871f80abbd0e88f1cb738a915b0c42ec92a70184a63b02bd24223eb4c4016f900ea215eb51b99fd49a29d9fd5e07a30a95ae3a9b17056d25fcb08fd4445e0a6f348dca6374a64d7e0e56db462157b7c197e15fe6ba28734f549accafa01caac5def313b922034126afdabf86b29314115483369df52b0321f0be88ecef1b3354300ef4b524d450fe0fff92e9da735e9c340cb62a49b4f3db60a5a8e45380cb55bde117878a08647703acf8c0f78571776c8cb32b1913708e71bb753fb3fd8ab972d545e61748c01c79d8795444d2cc52ff6e05c2ca0ee659223b4cbee1ddd07f387fd83501021ac023046c2a4211c1e221c7d7f729709d4191ebdda5ca25503e0294521703dd0543389de3c12e8d48f849c4e3d40147d03fb9f1a06e10aabdd6853a28e78caa73be435c4d72a538813fdfd2c52ce913dd69bed9c741fef039b7731c7b3fad83dd04aa0fec09b5c410a6e3caddfa25b8e1b30e8e416aee0f2329b4b01eeb95058b838907a5fb29cde6463b6488cd812ba19a33bc2f739963bbf6f024768281925a4e34000a19b0730f609b400e86d043af6b6f12d0638a237bf234d165ae236218086bc3624028634db32a8711b9eca31e348f014800de5e443b674a3f5293c623043f109d11626fb1985a3fcfd2cf45b0c813fedf2b00743728fb6d972f88e795bf84486c7f4ecf1742b2172b582f76f07c9e5bd61fb5716cc7e1233c3880145205b091420fa9076319a2d37d6762688983ddf994d1b6a3d827d9e54644d0b30aa8bee146a981115d7c11545bd260ccec2d23ae45ffe287ed894f8fa416622283df869352356142ab974f57aae6c82ddf1e4bfdb84ab1847d97c563769b09ada9ac27991f9d7731fcb5d1b634c52697c3afa6c7bc6afc985df4e95150da8621ff3bc40dba8d7b3c6d51a52abf8d88eeb857fec3d44f78bae343ed65a3832d1dc2bec24b58f1ba41e413d494b720d697b26da33873025cd3282ba73e4034bc2ec9ce0e4f87fb94f26f98be9ee8347e96e814c3c7fd8c2c96c3e1a74ef5f4a61f43c0c8a6e7b99f5f116c34b198e0e37bc3f6642d2cc0001a24d423c99eb66094eef429961bcda526e9d954944e554bf0a3c4c125d0f60d34c1d5eee7ba94af2384035c574dd8a383f5d896dfa81153b70c2de30ba02887529095fbea895cd57a8c0f3290d88811a46a0e502787cd87ff6314cb63381d5bb280ae2ca26eaec4cd7017bb2fbee7d7f97cc65ba93878e2daed639ec7072f47350782f0fa9dc1709a56060cf33a62a27ed83dc7ae7d3aee648bbe158b4eb87eb4f3e16d20696d1165f26366ebcc8a148861c60ecb60c93b0ed1d04c03b64601de6b99c3f2804d26621b3b7549339dd0431a64902f0bc25f5ec8fd8a3dc3205f4fe95fbd352069c7d9e41c15cee1adff3cf65e21b5d5c537568bb3d2980972dd1b52453d9a60bc43fc842ebac76d55234dcd4f5c35838b597ec97ef57296fa2ce962502393e7e21c6ff5e2d55e373365bfcc1b14bdb98ada60ec97013b824e4ddaabf1462d0e30f9e9769175508aeff89e9443ad2742b9d2c5f72a6a09af8ef97e6b4b328d5f08e2da0413a60e73e224becb2282a909d1164e514e105000758ab02156aca2ee092bed83ab45e5718841a4b119d64bcdfd8d5cc879b451f31cea900727cd6bc5e05c7144115168c1b0fa2a4c43391807329bf0843e601f357d0e911f272984666a77e4baf8696ba02d78fd943c4ff8b8a6e5e911c10231b330362e3803b5e00a92e35f9a8c0a44cb3e5ccca08e8a7cc3a9578030e3dfe91d5a67e280e4c4c53802e3fa144dfe2a8ac4b3c22e26daf5ba3753f56927672dcaca294c78748d9d6940b9234cd7cd7c6d2aed9b8121ee0bc866780583b8aad2ea64c929a0736a0ab160aa1d20b53ee9f522ad5e46e0a2df0df2acbcdfdbbea2108a091c72b70d4bdda24ec1b920c186d754b5e357bfe081e3abf8859fc53977048116e694b90a3d3eb8f49a51aea65e29a3f88088b73555b341c0381a66b6e50ef8dbd13aad0360a7a2781a6cfb098dd905c0549f584f54394de0c086107489851c627ad878e5a7c6cc000c08406d1e060c778b587bd062fc4944644859c0719be86280808437edba28413bef1db43d9456af0e6bffb1331af8f76e1db01859fc49f350ae0eaff4ead40f4ae397ceab7431e2c9a88eb0258e7410b5ca6051b5718ca21f5bf2195a42e1996e31de709acb9a0d43b109a4995fc99e8120d715919ccc7ad6fb3e560f75903f", 0x1000}], 0x4, 0x5, 0xb) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 6m36.212444187s ago: executing program 3 (id=2676): socket$can_raw(0x1d, 0x3, 0x1) (async) r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000000)='macvtap0\x00') r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x202400, 0x0) getsockopt$inet_int(r1, 0x0, 0x2, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000100)=0x3) (async) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000100)=0x3) sendmsg$AUDIT_MAKE_EQUIV(r1, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x28, 0x3f7, 0x300, 0x70bd2b, 0x25dfdbfb, {0x7, 0x7, './file0', './file0'}, ["", "", ""]}, 0x28}}, 0x0) (async) sendmsg$AUDIT_MAKE_EQUIV(r1, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x28, 0x3f7, 0x300, 0x70bd2b, 0x25dfdbfb, {0x7, 0x7, './file0', './file0'}, ["", "", ""]}, 0x28}}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs/custom1\x00', 0x800, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs/custom1\x00', 0x800, 0x0) r2 = pidfd_getfd(r1, r1, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000280)='/sys/power/image_size', 0xa0200, 0x0) ioctl$UI_END_FF_UPLOAD(r3, 0x406855c9, &(0x7f00000002c0)={0xb, 0x0, {0x55, 0x5b, 0x1e, {0xabf, 0xd68}, {0x2, 0x2}, @const={0x401, {0x6d, 0x8, 0x2, 0x721}}}, {0x56, 0x5, 0x36, {0x7, 0x4}, {0x4, 0x401}, @rumble={0x40, 0x3}}}) ioctl$EVIOCGSW(r3, 0x8040451b, &(0x7f0000000340)=""/62) (async) ioctl$EVIOCGSW(r3, 0x8040451b, &(0x7f0000000340)=""/62) r4 = syz_open_dev$MSR(&(0x7f0000000380), 0x1, 0x0) fcntl$dupfd(r4, 0x406, r1) (async) r5 = fcntl$dupfd(r4, 0x406, r1) getsockopt$inet_mreqsrc(r3, 0x0, 0x0, &(0x7f00000003c0)={@remote, @multicast1, @dev}, &(0x7f0000000400)=0xc) bind$vsock_stream(r1, &(0x7f0000000440)={0x28, 0x0, 0x2711, @my=0x0}, 0x10) r6 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000480), 0x1, 0x0) ioctl$UFFDIO_WRITEPROTECT(r6, 0xc018aa06, &(0x7f00000004c0)={{&(0x7f0000ff7000/0x7000)=nil, 0x7000}, 0x1}) (async) ioctl$UFFDIO_WRITEPROTECT(r6, 0xc018aa06, &(0x7f00000004c0)={{&(0x7f0000ff7000/0x7000)=nil, 0x7000}, 0x1}) epoll_wait(r6, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}], 0x7, 0x7) (async) epoll_wait(r6, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}, {}], 0x7, 0x7) sendmsg$NFT_MSG_GETOBJ_RESET(r5, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0x8c, 0x15, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x8}, [@NFTA_OBJ_USERDATA={0x76, 0x8, "73a71862be132f49f8c416acfc7887ed151a6d2b887195ccf09648a26ce56a0bc84018dc35a80fdd0bc8b7fa217a393cb2bc4090863cbda9376ba789e539e7c2028c12b112d402ae10c5116ac95f09d52df2cbad958f9b5c527825e5fe6b2755ab36444b0ad3acc9cdaabf47bfb3c91dd721"}]}, 0x8c}, 0x1, 0x0, 0x0, 0x24040000}, 0x24040000) mprotect(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x4) (async) mprotect(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x4) r7 = accept4$vsock_stream(r2, &(0x7f0000000700)={0x28, 0x0, 0xffffffff, @local}, 0x10, 0x80000) listen(r7, 0x1000) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f0000000740)) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r5, 0x6628) r8 = userfaultfd(0x80001) ioctl$UFFDIO_ZEROPAGE(r8, 0xc020aa04, &(0x7f0000000780)={{&(0x7f0000ff6000/0xa000)=nil, 0xa000}, 0x1}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r8, 0x40309410, &(0x7f00000007c0)={0x401, 0x4, 0x1, 0x100, 0x0, [0xa708, 0x1, 0x401, 0x8]}) ftruncate(r7, 0x5) openat$cgroup_ro(r1, &(0x7f0000000800)='cpuacct.usage_all\x00', 0x0, 0x0) 6m36.210933978s ago: executing program 3 (id=2677): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x189500, 0x0) mmap(&(0x7f0000fee000/0x10000)=nil, 0x10000, 0x0, 0x50, 0xffffffffffffffff, 0x702e7000) fadvise64(r0, 0x1fe, 0xffff, 0x3) 6m36.206405448s ago: executing program 3 (id=2678): r0 = getpid() syz_open_procfs$userns(r0, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x1) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000100)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000740)='bridge0\x00', 0x10) connect$inet(r1, &(0x7f0000000140)={0x2, 0xc000, @multicast1}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, 0x0, 0x0) recvmsg(r1, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x10140) r2 = syz_pidfd_open(r0, 0x0) r3 = pidfd_getfd(r2, r2, 0x0) setns(r3, 0x66020000) umount2(&(0x7f0000000040)='.\x00', 0x2) 6m36.196822988s ago: executing program 3 (id=2679): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x7) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e20, @empty}, 0x10) sendto$inet(r1, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) shutdown(r1, 0x1) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f00000002c0)={0x0, r0, 'id0\x00'}) openat$cgroup_ro(r2, &(0x7f0000000340)='io.stat\x00', 0x0, 0x0) recvfrom(r1, &(0x7f0000000000)=""/116, 0xffffffdd, 0x734, 0x0, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x4e21, @remote}}}, 0x88) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r3, &(0x7f0000006680)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x50, 0x1, 0x2, 0x101, 0x0, 0x0, {0xa, 0x0, 0x2}, [@CTA_EXPECT_MASTER={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, {0x14, 0x4, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}]}, 0x50}}, 0x0) sendfile(r0, r0, 0x0, 0x7ffff000) 6m36.08110597s ago: executing program 3 (id=2680): r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x9, 0x40) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000040)=0x1) ioctl$EVIOCGMTSLOTS(r0, 0x8040450a, &(0x7f0000000080)=""/140) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/cpu_byteorder', 0x2b00, 0x120) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f0000000280)={0x180, 0x9, 0x6, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_ETHER={0xa, 0x11, @multicast}]}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x9}, @IPSET_ATTR_DATA={0x3c, 0x7, 0x0, 0x1, [@IPSET_ATTR_MARKMASK={0x8}, @IPSET_ATTR_IP2={0x18, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}, @IPSET_ATTR_COMMENT={0x16, 0x1a, '/dev/input/event#\x00'}]}, @IPSET_ATTR_ADT={0x7c, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}}, {0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP2={0x18, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBQUEUE={0x6, 0x1d, 0x1, 0x0, 0x7}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x3}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_NAME={0x9, 0x12, 'syz0\x00'}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_PACKETS={0xc, 0x19, 0x1, 0x0, 0x14}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0xfffff801}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x4}}]}, @IPSET_ATTR_ADT={0x7c, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x2d}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e22}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e23}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBQUEUE={0x6, 0x1d, 0x1, 0x0, 0xd}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0x9}}, {0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_COMMENT={0x16, 0x1a, '/dev/input/event#\x00'}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0x2}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CIDR={0x5, 0x3, 0x5}}]}, @IPSET_ATTR_ADT={0x20, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e24}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1}}}]}]}, 0x180}, 0x1, 0x0, 0x0, 0x24040080}, 0x20000004) r4 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000480), 0x802, 0x0) write$UHID_DESTROY(r4, &(0x7f00000004c0), 0x4) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f0000000500)='&\\\x00', 0x0, r1) r5 = creat(&(0x7f0000000540)='./file0\x00', 0x80) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1000008, 0x20010, r4, 0x662ae000) getsockopt$inet_buf(r5, 0x0, 0x2e, &(0x7f0000000580)=""/74, &(0x7f0000000600)=0x4a) lstat(&(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r2, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(r6, 0x0, r7) shutdown(r5, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r1, 0x8982, &(0x7f0000000780)={0x1, 'ipvlan0\x00', {}, 0x4}) r8 = syz_io_uring_setup(0x4a28, &(0x7f00000007c0)={0x0, 0x10cf, 0x800, 0x1, 0x1da}, &(0x7f0000000840), &(0x7f0000000880)) r9 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./file0\x00', 0x80, 0x2) mount$9p_fd(0x0, &(0x7f0000000900)='./file0\x00', &(0x7f0000000940), 0x8800, &(0x7f0000000980)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {'wfdno', 0x3d, r5}, 0x2c, {[{@version_L}, {@noextend}, {@loose}, {@uname={'uname', 0x3d, '/dev/uhid\x00'}}, {@mmap}], [{@defcontext={'defcontext', 0x3d, 'unconfined_u'}}, {@smackfstransmute={'smackfstransmute', 0x3d, '&\\\x00'}}, {@context={'context', 0x3d, 'root'}}]}}) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r3, 0x942e, 0x0) ioctl$EVIOCGKEYCODE_V2(r3, 0x80284504, &(0x7f0000000a40)) dup2(r8, r8) ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000a80)=0x7) ioctl$EVIOCGREP(r5, 0x80084503, &(0x7f0000000ac0)=""/149) symlink(&(0x7f0000000b80)='./file0\x00', &(0x7f0000000bc0)='./file0\x00') openat$sysfs(0xffffffffffffff9c, &(0x7f0000000c00)='/sys/kernel/rcu_normal', 0x10000, 0x20) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000c80), r5) sendmsg$NL80211_CMD_DISCONNECT(r9, &(0x7f0000000d80)={&(0x7f0000000c40), 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x40, r10, 0x200, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0x3, 0x14}}}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x25}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x29}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x408d0) 6m21.088124221s ago: executing program 33 (id=2680): r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x9, 0x40) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000040)=0x1) ioctl$EVIOCGMTSLOTS(r0, 0x8040450a, &(0x7f0000000080)=""/140) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/cpu_byteorder', 0x2b00, 0x120) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000440)={&(0x7f0000000240), 0xc, &(0x7f0000000400)={&(0x7f0000000280)={0x180, 0x9, 0x6, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_ETHER={0xa, 0x11, @multicast}]}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x9}, @IPSET_ATTR_DATA={0x3c, 0x7, 0x0, 0x1, [@IPSET_ATTR_MARKMASK={0x8}, @IPSET_ATTR_IP2={0x18, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}, @IPSET_ATTR_COMMENT={0x16, 0x1a, '/dev/input/event#\x00'}]}, @IPSET_ATTR_ADT={0x7c, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}}, {0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP2={0x18, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBQUEUE={0x6, 0x1d, 0x1, 0x0, 0x7}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x3}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_NAME={0x9, 0x12, 'syz0\x00'}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_PACKETS={0xc, 0x19, 0x1, 0x0, 0x14}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0xfffff801}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x4}}]}, @IPSET_ATTR_ADT={0x7c, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x2d}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e22}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e23}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBQUEUE={0x6, 0x1d, 0x1, 0x0, 0xd}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0x9}}, {0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_COMMENT={0x16, 0x1a, '/dev/input/event#\x00'}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0x2}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CIDR={0x5, 0x3, 0x5}}]}, @IPSET_ATTR_ADT={0x20, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e24}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1}}}]}]}, 0x180}, 0x1, 0x0, 0x0, 0x24040080}, 0x20000004) r4 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000480), 0x802, 0x0) write$UHID_DESTROY(r4, &(0x7f00000004c0), 0x4) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f0000000500)='&\\\x00', 0x0, r1) r5 = creat(&(0x7f0000000540)='./file0\x00', 0x80) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1000008, 0x20010, r4, 0x662ae000) getsockopt$inet_buf(r5, 0x0, 0x2e, &(0x7f0000000580)=""/74, &(0x7f0000000600)=0x4a) lstat(&(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r2, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(r6, 0x0, r7) shutdown(r5, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r1, 0x8982, &(0x7f0000000780)={0x1, 'ipvlan0\x00', {}, 0x4}) r8 = syz_io_uring_setup(0x4a28, &(0x7f00000007c0)={0x0, 0x10cf, 0x800, 0x1, 0x1da}, &(0x7f0000000840), &(0x7f0000000880)) r9 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./file0\x00', 0x80, 0x2) mount$9p_fd(0x0, &(0x7f0000000900)='./file0\x00', &(0x7f0000000940), 0x8800, &(0x7f0000000980)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {'wfdno', 0x3d, r5}, 0x2c, {[{@version_L}, {@noextend}, {@loose}, {@uname={'uname', 0x3d, '/dev/uhid\x00'}}, {@mmap}], [{@defcontext={'defcontext', 0x3d, 'unconfined_u'}}, {@smackfstransmute={'smackfstransmute', 0x3d, '&\\\x00'}}, {@context={'context', 0x3d, 'root'}}]}}) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r3, 0x942e, 0x0) ioctl$EVIOCGKEYCODE_V2(r3, 0x80284504, &(0x7f0000000a40)) dup2(r8, r8) ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000a80)=0x7) ioctl$EVIOCGREP(r5, 0x80084503, &(0x7f0000000ac0)=""/149) symlink(&(0x7f0000000b80)='./file0\x00', &(0x7f0000000bc0)='./file0\x00') openat$sysfs(0xffffffffffffff9c, &(0x7f0000000c00)='/sys/kernel/rcu_normal', 0x10000, 0x20) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000c80), r5) sendmsg$NL80211_CMD_DISCONNECT(r9, &(0x7f0000000d80)={&(0x7f0000000c40), 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x40, r10, 0x200, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0x3, 0x14}}}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x25}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x29}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x408d0) 4m26.78238964s ago: executing program 0 (id=5042): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x0, 0x3}) ppoll(&(0x7f0000000080)=[{r0, 0xa000}], 0x1, &(0x7f0000000180), 0x0, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, &(0x7f0000000200)=""/127, 0x7f, 0x1, 0x39}, @flat=@weak_binder={0x77622a85, 0x100}, @fda={0x66646185, 0x6, 0x0, 0xd}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x400}], 0x0, 0x0, 0x0}) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$VT_RELDISP(r1, 0x5605) ioctl$GIO_FONTX(r1, 0x4b6b, &(0x7f0000000000)={0xcf, 0x1a, &(0x7f0000000600)}) 4m26.72930922s ago: executing program 0 (id=5043): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x40ead000) (async) madvise(&(0x7f0000130000/0xd000)=nil, 0xd000, 0x66) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19) (async) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) (async) modify_ldt$write(0x1, &(0x7f0000000900)={0x404, 0x20001000, 0x400, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, 0x10) (async) modify_ldt$write(0x1, &(0x7f0000000a40)={0x476, 0x20000800, 0x1000, 0x0, 0x1, 0x0, 0x1}, 0x10) r0 = socket$key(0xf, 0x3, 0x2) ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa07, &(0x7f0000000080)={{&(0x7f000020c000/0x4000)=nil, 0x4000}}) (async) sendmsg$key(r0, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="02037f02210000000000000000000000030006000000000002000000ac14142e000000000000000002000100000000000000fbff7fffffff030005002b00000002000000ac1414aa0000000000000000170008"], 0x108}, 0x1, 0x7}, 0x0) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', &(0x7f0000000140), 0x4800, &(0x7f0000000000)=ANY=[@ANYBLOB='fscontext?}']) 4m26.690236511s ago: executing program 0 (id=5044): r0 = socket$inet6(0xa, 0x2, 0x0) (async) r1 = syz_io_uring_setup(0x1178, &(0x7f0000000280)={0x0, 0x10bf, 0x400, 0x1, 0x56}, &(0x7f0000000100), &(0x7f0000000300)) r2 = syz_io_uring_setup(0x48ce, &(0x7f0000000140)={0x0, 0x5e99, 0x3000, 0x3, 0x19a, 0x0, r1}, &(0x7f0000000040), &(0x7f0000000200)) (async) listen(0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x73220c8b}], 0x1}, 0x0) ppoll(&(0x7f00000001c0)=[{r2, 0x20}], 0x1, 0x0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x40008d0, &(0x7f0000000180)={0xa, 0x4e20, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}, 0x8}, 0x1c) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder1\x00', 0x1002, 0x0) (async) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="fc1100001200010200"/56, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000f504010007c01c00"], 0x11fc}, 0x1, 0x0, 0x0, 0x20000010}, 0x810) (async) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r6 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r6, &(0x7f00000000c0)={0x28, 0x0, 0x0, @host}, 0x10) (async) write$vga_arbiter(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB="647aa581d7826265636fd25224443b149e952348e4c03ec690915ec0f0"], 0xf) (async) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) (async) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async) close_range(r4, 0xffffffffffffffff, 0x0) 4m18.20151275s ago: executing program 0 (id=5180): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/llc/socket\x00') getgroups(0x2, &(0x7f00000000c0)=[0xee01, 0xee01]) (async) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000002c0)=0x20) openat(0xffffffffffffff9c, 0x0, 0x20842, 0x22) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) (async) rename(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)='./file1\x00') (async) setfsgid(r2) (async) setfsgid(r2) (async) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$SO_TIMESTAMP(r4, 0x1, 0x49, 0x0, &(0x7f0000000000)) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) unlinkat(r5, &(0x7f0000000400)='.\x00', 0x200) (async) mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x8) r6 = open(&(0x7f0000000200)='./bus\x00', 0x141a42, 0x0) (async) setfsgid(r2) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) (async) mmap(&(0x7f0000444000/0x3000)=nil, 0x3000, 0xd25815d2ecc8c0e, 0x2010, 0xffffffffffffffff, 0xcdc2000) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r7, 0x0) setregid(r1, r2) (async) r8 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r8, 0x0, 0x2a, &(0x7f0000001040)={0x3, {{0x2, 0x0, @multicast1}}}, 0x88) sendfile(r6, r0, 0x0, 0xffffffff) 4m18.18944032s ago: executing program 0 (id=5181): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) creat(&(0x7f0000000180)='./file0\x00', 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r4 = dup(r3) write$FUSE_BMAP(r4, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r4, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200), 0x0, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[{@cache_mmap}], [], 0x6b}}) r5 = getpid() r6 = syz_pidfd_open(r5, 0x0) setns(r6, 0x24020000) r7 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r8 = syz_pidfd_open(r7, 0x0) setns(r8, 0x24020000) mount(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000080)='proc\x00', 0x189, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) close_range(r0, 0xffffffffffffffff, 0x0) 4m18.113036611s ago: executing program 0 (id=5182): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, 0xffffffffffffffff, 0x8fe69000) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c5a726f75705f69643d4a4db923705980942b5cb0d80cd723217f3002a532630623107375", @ANYRESDEC=0x0]) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000007540), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000007600)={&(0x7f0000000080)={0x34, r1, 0x1, 0x70bd2a, 0x25dfdbfa, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}]}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x4) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r3, {0x7, 0x1f, 0x20000000, 0x4041}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) dup2(r4, r0) syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000137000/0x400000)=nil) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, 0xffffffffffffffff, 0x8fe69000) (async) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) (async) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) (async) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c5a726f75705f69643d4a4db923705980942b5cb0d80cd723217f3002a532630623107375", @ANYRESDEC=0x0]) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000007540), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000007600)={&(0x7f0000000080)={0x34, r1, 0x1, 0x70bd2a, 0x25dfdbfa, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}]}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x4) (async) read$FUSE(r0, &(0x7f0000006300)={0x2020}, 0x2020) (async) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r3, {0x7, 0x1f, 0x20000000, 0x4041}}, 0x50) (async) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) (async) dup2(r4, r0) (async) syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000137000/0x400000)=nil) (async) 4m18.079241422s ago: executing program 34 (id=5182): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, 0xffffffffffffffff, 0x8fe69000) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c5a726f75705f69643d4a4db923705980942b5cb0d80cd723217f3002a532630623107375", @ANYRESDEC=0x0]) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000007540), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000007600)={&(0x7f0000000080)={0x34, r1, 0x1, 0x70bd2a, 0x25dfdbfa, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}]}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x4) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r3, {0x7, 0x1f, 0x20000000, 0x4041}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) dup2(r4, r0) syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000137000/0x400000)=nil) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, 0xffffffffffffffff, 0x8fe69000) (async) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) (async) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) (async) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c5a726f75705f69643d4a4db923705980942b5cb0d80cd723217f3002a532630623107375", @ANYRESDEC=0x0]) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000007540), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000007600)={&(0x7f0000000080)={0x34, r1, 0x1, 0x70bd2a, 0x25dfdbfa, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}]}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x4) (async) read$FUSE(r0, &(0x7f0000006300)={0x2020}, 0x2020) (async) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r3, {0x7, 0x1f, 0x20000000, 0x4041}}, 0x50) (async) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) (async) dup2(r4, r0) (async) syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000137000/0x400000)=nil) (async) 1m14.389018919s ago: executing program 1 (id=8182): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x801, 0x0) (async) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x1e1802, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) (async) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0xf, 0x0) ioctl$EVIOCGMASK(r2, 0x80104592, &(0x7f0000000300)={0x0, 0xffffffffffffff36, &(0x7f0000000200)="952bb3e006ae9a4c3a"}) (async) ioctl$F2FS_IOC_PRECACHE_EXTENTS(r2, 0x40044583, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) (async) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'vlan0\x00', 0x0}) sendto$packet(r3, &(0x7f00000001c0)="05031600b7a89b4f551c09102c2800"/26, 0x1a, 0x4080, &(0x7f0000000140)={0x11, 0x1a, r5, 0x1, 0x0, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x42}}, 0x14) (async) r6 = pidfd_getfd(0xffffffffffffffff, r2, 0x0) r7 = openat$cgroup_ro(r6, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000080)=0x4) (async) close_range(r0, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r2, 0xb6d0d000) (async) mremap(&(0x7f0000000000/0x9000)=nil, 0x9000, 0x600000, 0x0, &(0x7f0000a00000/0x600000)=nil) (async) socket$inet(0x2, 0x2, 0x0) (async) setsockopt$inet_mreqsrc(r7, 0x0, 0x27, &(0x7f0000000440)={@multicast1, @dev={0xac, 0x14, 0x14, 0x26}, @multicast1}, 0xc) (async) r8 = socket$inet(0x2, 0x0, 0xf282) setsockopt$inet_mreqn(r8, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @empty}, 0xc) r9 = userfaultfd(0x801) ioctl$UFFDIO_API(r9, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x4}) (async) ioctl$UFFDIO_CONTINUE(r7, 0xc020aa08, 0x0) r10 = syz_open_procfs(0x0, &(0x7f0000000240)='personality\x00') preadv(r10, &(0x7f0000001b80)=[{&(0x7f0000000040)=""/118, 0x76}], 0x1, 0x3, 0xfffffffd) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_int(r11, 0x1, 0x3, 0x0, &(0x7f0000000580)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) 1m14.345248199s ago: executing program 1 (id=8183): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000000000)) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000100)={0x60, 0x0, &(0x7f00001c9000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x2000000, &(0x7f0000001fc0)=[{0xfffffffffffffffc}], 0x1, 0x9, 0x0, 0x2, 0x0, 0x2}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000180), 0x101000, 0x0) (async) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000180), 0x101000, 0x0) read$FUSE(r1, 0x0, 0x9) (async) read$FUSE(r1, 0x0, 0x9) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x64, 0x0, &(0x7f0000000380)="6cc2517326f0182dfaea8b9b0efefe72ca2b3f10c526bb82d4a3786efb2df4fda2a1e2888f71a664cc5a261719fef0ead4d24dcc14edceace088490d882b563ef630b62d95fb3e1b01b472ec8da1d1df5215b75a482436e231f28e370fafd3b4afd276d2"}) 1m14.30640992s ago: executing program 1 (id=8184): ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f00000000c0)={@flat=@binder={0x73622a85, 0x10a, 0x1}, @flat=@weak_binder={0x77622a85, 0x100a, 0x1}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x2, 0x28}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) 1m14.30469124s ago: executing program 1 (id=8185): r0 = syz_open_dev$tty1(0xc, 0x4, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000c40)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2901090, 0x0) chroot(&(0x7f0000000300)='./file0\x00') mount(0x0, &(0x7f0000000d40)='./file0/../file0/../file0\x00', &(0x7f00000000c0)='sysfs\x00', 0x2010004, 0x0) pivot_root(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f00000001c0)='.\x00') ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000040)) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x40902, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r1, 0x8fe69000) r2 = socket$nl_audit(0x10, 0x3, 0x9) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x35451d7003000c0b, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) ioctl$TUNSETGROUP(r3, 0x400454ce, 0xee01) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000180)={'rose0\x00', 0x112}) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000380)={'team_slave_0\x00', &(0x7f0000000200)=@ethtool_sset_info={0x18, 0x0, 0x101}}) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000331000/0x400000)=nil) madvise(&(0x7f00001e2000/0x400000)=nil, 0x400000, 0x17) 1m14.257354521s ago: executing program 1 (id=8186): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x40902, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) setuid(0xee00) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff}) ioctl$SIOCSIFMTU(r2, 0x8923, &(0x7f0000000140)={'vcan0\x00', 0x4e171e32}) write$UHID_INPUT(r1, &(0x7f0000010140)={0x8, {"7f9654d636ab18b7938a2804505c72e9994ca22404fc203334cc21ed3d6a776fd12d13f9602b2980f983c31a5d1e431db778099ce3af3fb20e1ee1f4fdb77cbb36154982a93c19825d6fd273ab1eb5bcd47adad50de8a6791486e482e29ecc94284921f33b941cfc1000c9781d9a828c5ec7a2c77b4e624a5aa0e9e39782bad733eda81ba47e1c6116e4170e6587dd6210a57abe91f1f80c4e31139d8b73fe35ac1f99ea82dd6aa9c9aa67de88ae3e141020e1a876bbc449d2d843aa7e6d90b948b7e28770e6ac71010c63f17e90fd20806a9f8d9f418ee3af74aac64b04a27c4f5e3626ca2da546c79d24acadd11e8d272a22fc54078fd5e64475993668980a9f95aff964ded28f79c862e674356af492b8377a759d8ccf1accb9a18ef7ad16f438dde69cd020d71552b0810688c882a26a22b23f4b35471b08b379193db1cd7934a4049ff1b00d9795cda6e73951641d5e2365c24facd5afd09ed1d096d758b4fef66fe1aa22395d67b7e1db623d4a60a7dc93893d6c4a91df79535a855868c5dc0033d5c428cd25b85c5deb6e81068553bc84cead4d1eba8aa57e2b354a6899e44acbd3834491219b3e231cd55d82f161774a689efe197cc193ac0124c67738a0a1d5f16a6768c2c2ba7386c8c95ca08c55117f344f5a2bca0d09e79ea3fc49491f2c7adc513c2779c1bf62b1a8643d23e9e8b2ae41d4a59f1b82b82e092b36eb851b8456da871b4057aec325a9d4cccafde61f2abc85e3cabeabb856f6ffbfe23d69219ec8fae6beb54abe7870dbae823d49806a967a1c7f252999804f106745f20490bb3347b59321dc69765567abcbd89de04d89622170005df5871ed0fb72345a11da074060d7d4ee2e437f71a45723fb6b02de56067e54f54c52d10f7874a13cbfb3bd65ce54f9d6719ea210e0cf79e4e2157736ec07ac5915682ab81bced665c1e72fab8d8cfe509de0f21fe374b957b379fd5918061e21c2e96985cc1354b2de859b0f1a463ab04683b1253eda671c2353b5c208aca652f5419ffc4949a7fa909b95653f42d97390c400b4a1c308b11e73e9a06d3b164d3361e75584d70e6bc61d570a7e0c7da330f643194c1893fcd6489fac605eead61b53dff18caf526ecccc9bbd9146bc3c3bb67677695e6fddaab081786e9084014e60f5c03ae5a9087726b05e17402cd2fbb80d773b8a41470b1f901a8c2b2d57450181f4fc5bc53c7cb3dc032b84567492607cb08832eca9f79da9210d197863e5db5a74a9823dc0cc8bd9f3a9b6ff5a7d15d4747a9b26e088f4fad96d81cd1214226b1c4585d418d593220fcbb9ad949266cc48163e3498b46ebcdf7b2b5ecfe67539a61ed9e39b02d5b35ac0d0e7fa830034ca2da8a7ddf04bcf2cee939994369feb77023e0e3de04b21db7a640a92c17748245005cd75a7deba4ff0e4c104a9db2d9a98ec8edb3562050a3bac5f322290e3d8b6fb21770ac436d4cb12b97fc8f76d7bb9eeed85663eb0626f1ad1719ee4b07f7de2c1d1a31c27c6879f4fa3dbdfb2bfc0898beabafbeca9f13050e6b2f6c432e423cd5cb6b8fa56fe32c3e50104e44462c0a5c69de6a7ac5ae3d9f07ceed64dbffa42e4663838bfcde92f0fcb895f3b93c59b0e48c09890dfc36436db56b708f6e7cbbd2a6305f573cee099dbcd263cb96d9fb69cbc3cb06d8f5e3789698a17e71d22b4665ff5447fcc17a31bb136c8bb4b984573bcaf1cb650198c1266e6ddfd42d44f9de02cb9d915c5334c550fac3fcee56790aeb09d81e7690a32d8b0cc477b23f15257820de227be1ffaec2f63f3266b8f5dd78947dcee355fe59bfb100e5244425532bb1d115acd211b8c16b0ec0aae00fca5d4511a05c3ff027a1cac56210a10d81c01b90e156cc7b33de0fac825dc516d398166096013e068db935483c93ba95da39b5ae4087d84479a4c4809f28f93790dc279637bd6f3dc441d315cf6bd7b0e3d92070a45baf4445ce063fd12690eb002f5ca068a256bc54100c99a02a346beca39072163c4b297d117f1ed9fef42e3dbc11d36a0a0db52e84461c6fbb4aad62cd6c8dc9ae6a3390a5e8773ac599e67436220c8d541a9039762bffaa7f490e31dddbc362fb4ff686cda905f3b02a1db76d4d570d970434921ca8a4765af6d5c8b881e1f4ffa7e2d9ef5f5511b94f88474674ec790bb5186c73446a227bf1ffd19b605733abd1bd41e421aeaf2ed4617088c7ceef85451225056435993e89e4bccd2c2e4b39af99feef11fea645eeb5cf9f77b1e19a72d3efb613100969b84302789714bca65bcbc96762b4012a5700c62aed706433b9f142b7302442b6a9958b0e28e8b1cfa9eeb4ac0d71f497b23babf9f0221dcb658d9f4db5d45bee30d2ad7c97d6a562e014a7701c15325ec5d42ab732b37714a77a95c03fb15bbfba6fade32bf50f985a1df362ca7216cc152907dd931acb58a63920f581e82b590c0d6a0033009f8e50c3263d3f58596b63d507cadbc809a6690561f74d0772bf92d04e06c47a350724b106f5e83f7e71c4b2a983bf5ad7d8684e7b8b5dc1273d0fa5879b8e61bde33d602bc8ff0913b6d32dcac366d568dc7cf82bbfc405cbe418a2644c26592b32ca1a632fc95123efb784cfb6953a94ebeccd24fba389a0e56b043df07d9a2dd38a1196e5e55576b25f85cb96f6560802a4a58b7a6857e8454faa2c880bf32d464562b2bdc5f0df22b663f2c01fc944f1cfd1908f617f8295a5440bb79ae178ea46a95baeea48322105146ac3ed2de7d3796ddddcc848a8ecf4a00dd055733b4f59211f5a40deea44e74b3bc57953b26ed61e6fd67889edfe8d0902385e37666aacec072735630ecc441c3cc6b09bb2f63aa4e332c6df728dc74078a83ce20454dfd616d116270666ddc09c5fea2e8442bc43455d0257fac92f3780061178f9420bf8e463f29896c12383dbb9a81bc5c87376e647c8a9786cb514fb9696d9c0a8d303c5c4b5b7c5f601c01fa19323e02f675c371bc44fbc1ac5704d41a89a2a4ccec6ac8440c532f07da25aa2dce6a5d2ebe694eb4017d178b221213bfe2a01d9cfe689bd190776bca6c032f446eb8862587a7826e35f3f691763212eee6af2e49bbeb0a27e07c5714b74e373798c7bebce265f7ebef3a1ea64078cf1e8a9d433af32c53090c972ffedbadafb50b9a6e540abd84f8e938583ea725954be3b236c5d8aca7d486d21902a2902f25a7c02dbe83c39bd0b81513f9ef198c49d560e930ae224ff47f92e4851e1f7ab5bb406abcf6596569261e6b0c67bb3b854e9c6de60bfb60fcf29241ff237151310ecd19f8b2cfe764c1df1a2de9d840eca47aa169ba9a415901204ec31ccdfd76e908029ae34fb12dc286758c64fd6d42bc82b14e07e421f4b42b180cd6ef40cac8062928b4a420a4577f24295f54de9048ac9d34307bf93e463cea4967cf4880166f68ed1eb965db2e4fb9f5f0b1c695d621e427ccb9a3188073ee6fde729c6698346efa1c0ba643c1efd20858965511da750060d551c44c435a5f1603fae7357e0bc78e92aad3d88790ec2aa1a42d6fe7e0ffc57f3599e406db63be7dd32692df32ce33dee0a2becdb02d6e435e09de3d356497543db23f53da25643f9c585e275297800d8beed47f0e622f86fc25d2e87036fdceebfe7257cb6de0c02412d1c0758acfcd0862e99ad17a118f46f635a87477e8b825423d94ada35bf0b5444aa7d3de4bb7eec7ae5129fcc2cba651cc972f5500fc5161149d29f452962afb102a01ae76825cb4477460be0b85d75058595c27e9b7fae3492ec3925c671bee5f4ca534d5a294f783d6cc073c992139b61d21fd98297b04c0578dafd5f7ebcaf8d4d9185aea3d76e813421f4573b38c25093c015a65e44fb297f0f6ac2d02c4237b37a3bfca2406c5c95ae5812816bacad59ba7c6f72d7c644ff25b592ed1e89b276e05866c01a4ced7fc6dd9f190c20d420d7c8a1fe908833a24c5e5bd7a95a2a6fbf147fc4b29a179718166dd0fbae2fc6b8c8aac6194fa6baf0d3edc36b2316c56c441ba53e3e7aaaf0a1405566ff584f73a637b74dde9bcb4d41da2be6c9df5d533fbac54f5fb52a8a793757cfe19aa90048c6d07e3474136ae1be2455b0d0d02eb4b5961ba883209355c0dd2af4aad98e7b971e358a7d9b55fe17cd6095f257355d9b99e5ea52848f17b35a80792d9ed0fef6fe3eef9a324902409969823be20bbe0e8dba9c747cd1a14d3642d877b86271f3f0c322a142c4ff635b37d542c3265b5fe8589a732bb1a55010b930dd0196cd43ac3634c01b4a44c517197d03a3d89c67f5c09aab409e84c0af466bfbd0c96d240101a2542c66b4b4b8ef65b41b0079995c52cc9720d2c1d7c128c6f17a65cc798c1986cfbd8888460c54438edc4f91f3580391c8b57d9aee209a59a116c1c44775437e9c30e6d87e82ce84e28532b19441e32ab9aea22177bac9daad25a6c88395e9348d6780de630cddb266c411011175bdb6255a36535180818447d43ffba3758d311539fe9f6811fa470bf3767b4c2d4cdf37854c7ee28730bb1d39d5c0dfffcdbf353cca3e13079f3ae66b839c7dd36914022a0e75bca5b622f521420b73249ef47f03c1fb03ecf7557882afcaa7cf454a68ad237d4ce860bd6b1531c1cafe2cfb76bc4188271ef6bdfb304ee0e6932463a1909f03d6e8a27b5f137d6b342841d613863dfdf37d5ec3a98d667810fb6f82d67620bdefed8b3ff98420a6c7ee577c3ba68b95a20403608a7ba6526ec9e8662c6e15ab09b1a9019d4958af04cb2e4890ee6b1077fcaa5cc0817f388461b230fe631e75f18ab392a5ca5de4a024ca16dd05fcfdf92114e43a5c4a169d462ff0dba57deeaf5eaafd892f8ccbd72ac56471162e1416bca39859b4184ba0d1b3f7ec05db4ef4cf0142867fa9be328a0be8aa74c716aad9411008607980861f4f72e9bfa60195e2f939d3f6a44a6cec07dd376d1bccaa126686f313d5f7918ecd1215026982c82ed1922ef70e36e8ed59b2d5ceab3b4aad7e53049062dd5ba0e87f7005c3f4d2b788245cdc2f35ef2572bea5ea92dfad406ade6d5ad18be8eeb4c652e5277b244645c68c0c0f5a68d42e00d59b75941917b2cdf31fdf809f2078ca97fd5beba65b34e0621138ea0e94feb87166b2dac2232ebca575e5c0a4d565d9992f733bbfbe68a63d99ee93398604065d5517c33ed0e067bdb643e73102f16137afd7d4bf21e8065ea028c392a6dcefbe642dc3fb03a239d9c8b17023eacc8e19fea11c34a10644af1b786fc0f4504038c2ee59c1b353f3d7b9313df025b4b5874ca63ec164a3fe35bf390d266f53dcda6a8e190e63a56ffdf4f7c5c02aa22d376db06d4d2b96be5b331f897d1ecfd25c13a1c194c265dd95a5724a6435bc8138224d9db28b689b9cea5132cd19601dbc4a43e70c71e27e8fd0689d09484974e8a4605f8553735fffaf5654a087e323ca14e02b681b9bbe592bd6b719ae2e86bdf918b27c79d52dd334d1aa7ebc1bff76e97572faad092010a1022f7d33089049107a89c364ae7dd022d119e8f6ab795fd71d76a90e8202339401ff9e9918ea8c8e12f7b0ba10d9ebde5d1bc5988f2d07b34579d8c282628204f2978d8b0cf95dc41f3775a4053f833267c64b42336d7c850f2918ef0dd6d62e43fcc173254eb34748efd4754609ce25ade162ba3c91bb844aaf6fd648ee5a8fc5c64346603f8258592d67b9613e8f7ac0def0958f13436581d729e0b3e062738eb06b2116abe837529690a614fc5d3f53b4d4602e57060", 0x1000}}, 0x1006) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) r3 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FILTER(r3, 0x65, 0x1, 0x0, &(0x7f0000000080)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x8fe69000) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000331000/0x400000)=nil) madvise(&(0x7f00001e2000/0x400000)=nil, 0x400000, 0x17) 1m14.145352133s ago: executing program 1 (id=8189): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') r2 = memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) mmap(&(0x7f00001d1000/0x3000)=nil, 0x3000, 0x1800006, 0x11, r2, 0xbc4cd000) read$FUSE(r1, &(0x7f0000000640)={0x2020}, 0x2020) readv(r0, &(0x7f0000000140)=[{&(0x7f0000001400)=""/4096, 0xfffffcd9}, {0x0, 0x2000}], 0x2) 1m14.130077394s ago: executing program 35 (id=8189): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') r2 = memfd_create(&(0x7f0000000140)='v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0\x00\x00\x00\x00', 0x0) mmap(&(0x7f00001d1000/0x3000)=nil, 0x3000, 0x1800006, 0x11, r2, 0xbc4cd000) read$FUSE(r1, &(0x7f0000000640)={0x2020}, 0x2020) readv(r0, &(0x7f0000000140)=[{&(0x7f0000001400)=""/4096, 0xfffffcd9}, {0x0, 0x2000}], 0x2) 2.998218274s ago: executing program 6 (id=8878): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) unshare(0x62040200) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="240000002a00010a000000000051e63490f45f0008"], 0x24}}, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x58, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = getpgid(0x0) ptrace(0x4207, r2) socket$pppl2tp(0x18, 0x1, 0x1) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000002, 0x40910, r1, 0x184eb000) 2.997880594s ago: executing program 6 (id=8879): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000a, 0x28011, r1, 0x0) pipe2$watch_queue(&(0x7f00000000c0), 0x80) ioctl$KVM_CAP_VM_DISABLE_NX_HUGE_PAGES(r1, 0x4068aea3, &(0x7f0000000040)) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r0, 0x40046210, 0x0) 2.997364454s ago: executing program 6 (id=8880): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) prctl$PR_SET_SECUREBITS(0x1c, 0x15) (async) prctl$PR_SET_SECUREBITS(0x1c, 0x15) setuid(0xee01) (async) setuid(0xee01) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0) (async) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000080)={0x2020}, 0x2020) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x800000, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r3, 0x40086602, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={@local, 0x16, r2}) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000004c40)={@private1, r2}, 0x14) read$FUSE(0xffffffffffffffff, &(0x7f0000000980)={0x2020}, 0x2074) (async) read$FUSE(0xffffffffffffffff, &(0x7f0000000980)={0x2020}, 0x2074) 2.996186134s ago: executing program 6 (id=8881): openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x0, 0x1, 0x11, 0xffffffffffffffff, 0xffffffffffffffff) r0 = syz_usb_connect$hid(0x3, 0x3f, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x44f, 0xb300, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x5, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x33, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0xc, 0x0, 0x7}}, [{{0x9, 0x5, 0x2, 0x3, 0x1f7, 0x6, 0xe8, 0x4}}]}}}]}}]}}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000680)=ANY=[@ANYBLOB="000457", @ANYRESHEX=r0], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x400, 0x10}}, 0x0, 0x0, &(0x7f00000006c0)={0x40, 0xb, 0x2, "eab8"}, 0x0, &(0x7f0000000740)={0x40, 0x13, 0x6, @random="0b31bb4f1dd8"}, &(0x7f0000000780)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0}) rt_sigaction(0x3e, 0x0, 0x0, 0x8, &(0x7f00000001c0)) syz_usb_control_io(r0, 0x0, &(0x7f0000000c40)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b00)={0x40, 0x19, 0x2, '2f'}, &(0x7f0000000600)={0x40, 0x1a, 0x2, 0x3}, 0x0, 0x0, &(0x7f0000000c00)={0x40, 0x21, 0x1, 0x1}}) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) removexattr(0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING(r2, 0x4068aea3, &(0x7f0000000000)={0xc0, 0x0, 0x1000}) ioctl$KVM_CLEAR_DIRTY_LOG(r2, 0xc018aec0, &(0x7f0000000040)={0x2, 0x180, 0xc0, 0x0}) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af60, 0x0) socket$can_raw(0x1d, 0x3, 0x1) chroot(&(0x7f0000000640)='./file0\x00') ioctl$BTRFS_IOC_TREE_SEARCH_V2(0xffffffffffffffff, 0xc0709411, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000200)={0x14, &(0x7f0000000080)={0x20, 0xe, 0xf8, {0xf8, 0xa, "01f7207a74b8378fa32b95db71b654b39c230e4bb28cd48234c65c29719f7b71a97670b2217af6de261695e6de5fd5dfa56f1db58496ef3b5d490cef65fa41421fbb54adc1256bc20b6c3b5336a9cabfc6396d4d8df2d0928079b5b6e425ee127ec75d1373234bd83b8458eff4d10362e3b1d255c398f544c431e3b755ca705a90427db390f70f0d39e705e019c9102981526740e3536bdac9580c859a79cd7946ceb14cf9a17b45b962a51251d63f367f6ba9782ffa8f5c1e60a978eb8ec2b380f8b014490732e89518c25b077b87b8fa353da877fcdb9d344e741d2f7cb194a086ea76c3e5101e8c42b022fa76a4ee682ac87bfa4b"}}, &(0x7f0000000700)={0x0, 0x3, 0x8, @string={0x8, 0x3, '\x00\x00\x00\x00\x00\x00'}}}, &(0x7f0000000580)={0x44, &(0x7f00000007c0)={0x0, 0x282544bcea54f0f0, 0xf8, "68e985582e8047f567b4bdf86d673a71aaa22484014fe898be3ded27959396bc7c7c973868f67334452b6b20843a19fd01c677b69926096f107ca2212f44e53f3654cc2ac53be623b2e44ed036469dd55cbb4a67b206e8c8d73639c2d0f318f3157667c7888428e02145af7bb9d8e48af95fc76bf3aa64c0fbd8ab628dd109312952b3af5d43458c3d0d189ab80688053cbaffff3fde798ca952285f03cc8ed334cb63395b055108c6dfac1ba6915b6cf3c3e76a7830127741c760cd0343e71d5dbc1dabf616bfc64b8a7ff89cc8dd2dfe22bd64cb0c291e23ef38327c390faa0699db294b0798bd8c511c71c4da8b0d423338a5c70333fe"}, &(0x7f0000000340)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000380)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000240)={0x20, 0x81, 0x3, "08600e"}, &(0x7f0000000440)={0x20, 0x82, 0x3, "c5ab38"}, &(0x7f00000004c0)={0x20, 0x83, 0x3, "fd4661"}, &(0x7f0000000500)={0x20, 0x84, 0x1, "93"}, &(0x7f0000000540)={0x20, 0x85, 0x3, "ce42dc"}}) 1.840083936s ago: executing program 5 (id=8902): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5ed000) r1 = userfaultfd(0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r1, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x40000100000200) r2 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) close_range(r0, r2, 0x2) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f0000000180)='\x00\x00\x00\x00\x02<|\rX\x84\x8a4\x01\x00\x01\x00\x00\x00\x00\x00\x84\x9e\xca]\xc6\xafI\xd8\x93\xa4X\xbb_d\xaeC\x9d\x99\xf4s\x9c\xd1D\xdb\xfdQ\xae\xdf\x99\x0fs\x0f\xb3M\xa9!\x1a\'\xed,L\xe1\x93\x9c\xc8Qz\xc0\x9dBxQMa}\xf7gxK\xe3\xf2\xe1+\x8d\xd3-\x84\x12\xac\xeb\xb0\x13\xbc\xba|G\xfc\xe9\x15\xd0\xccX\x11\bwZ\x92\x10\xf7\x9f(\v\x1a\xab\xd8\xc9\'\xba=\xc6\xa9\xe4K>K\x06Z\x11\xaf\xda9@\xe0\x1c\r,s\x14\x0f\xec\x85\xd7\xc2@\xf9\x82S\xca-\xd9k\xc0?\x9f\x95\x02\xa4\xae\xbf\xba\x18\xbb6\xb4\xbd\xff~\xa0J\x0e\xfb\xc7@\xc8^\x96}\xfe\x92\x0f\xdbA\xf3\xce\x10\x94(\xe5^b\xe7{oy\x82}\xe6\xd1\xb1x4G[\xda~\xe4p\xc8\xcc\x99\xf1,\xbb^\xda\xb4\x88\x1d\xfd\xfd\x91\xcf\xef\x11\x93\x13>\xb3o\xa5\xdb\x16\n') r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) openat$rnullb(0xffffffffffffff9c, 0x0, 0x20002, 0x0) ioctl$KVM_SET_CLOCK(r4, 0x4030ae7b, &(0x7f0000000180)={0x1000, 0x6, 0x7, 0x93e, 0xfff}) mmap(&(0x7f0000018000/0x4000)=nil, 0x4000, 0x0, 0x13, r0, 0x85b83000) 1.673245769s ago: executing program 4 (id=8903): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x20040, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x20) (async) ioctl$VHOST_VDPA_GET_IOVA_RANGE(r0, 0x8010af78, &(0x7f0000000000)) (async) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) (async) r2 = getpgrp(r1) kcmp(r2, r1, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) (async) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x25dfdbfe, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xaa, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) (async) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=@migrate={0x7c, 0x21, 0x1, 0x0, 0x0, {{@in=@broadcast, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4e20, 0x0, 0x0, 0x0, 0xa, 0x80}}, [@user_kmaddress={0x2c, 0x13, {@in=@multicast1, @in6=@mcast1}}]}, 0x7c}}, 0x0) (async) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="d0010000100013070000000000000000ffffffff000000000000000000000000fe8000000000000000000000000000bb000000004e2300010000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000048000200656362286369706865725f6e756c6c290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000098001400636d61632861657329000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000006002"], 0x1d0}}, 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@userxattr}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) (async) read$FUSE(r3, &(0x7f00000042c0)={0x2020}, 0x2020) 1.672754669s ago: executing program 4 (id=8904): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1000, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000040)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)={@flat=@weak_binder, @flat=@binder={0x73622a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0x100a, 0x1003}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) ioctl$UDMABUF_CREATE_LIST(0xffffffffffffffff, 0x40087543, &(0x7f0000000080)={0x1}) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x15) write$P9_RLERRORu(0xffffffffffffffff, 0x0, 0x53) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x0, 0x0) ioctl$RTC_SET_TIME(0xffffffffffffffff, 0x4024700a, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2}) ioctl$TUNSETTXFILTER(r2, 0x400454d1, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x40, 0x0, &(0x7f00000005c0)=[@clear_death={0x400c630f, 0x1}, @release={0x40046306, 0x3}, @increfs_done={0x40106308, 0x3}, @increfs_done={0x40106308, 0x2}], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1000, 0x0) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000040)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)={@flat=@weak_binder, @flat=@binder={0x73622a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0x100a, 0x1003}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) (async) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) (async) ioctl$UDMABUF_CREATE_LIST(0xffffffffffffffff, 0x40087543, &(0x7f0000000080)={0x1}) (async) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x15) (async) write$P9_RLERRORu(0xffffffffffffffff, 0x0, 0x53) (async) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x0, 0x0) (async) ioctl$RTC_SET_TIME(0xffffffffffffffff, 0x4024700a, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2}) (async) ioctl$TUNSETTXFILTER(r2, 0x400454d1, 0x0) (async) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x40, 0x0, &(0x7f00000005c0)=[@clear_death={0x400c630f, 0x1}, @release={0x40046306, 0x3}, @increfs_done={0x40106308, 0x3}, @increfs_done={0x40106308, 0x2}], 0x0, 0x0, 0x0}) (async) 1.647396449s ago: executing program 5 (id=8905): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x402, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xc6) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x200000, 0x200000, 0x7}) mount(&(0x7f0000000080)=@filename='./file0\x00', &(0x7f0000001440)='./file0\x00', &(0x7f0000000040)='erofs\x00', 0x8800, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000280)={'ip6gre0\x00', &(0x7f0000000200)={'ip6_vti0\x00', 0x0, 0x29, 0x7, 0x2, 0x9, 0x18, @local, @remote, 0x7800, 0x700, 0xf6e, 0x1}}) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x3, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) (async) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x28) (async) fsetxattr(r0, &(0x7f0000000000)=@random={'system.', '{,{[{\x04*-)..\\\'\x00'}, &(0x7f0000000040)='/dev/kvm\x00', 0x9, 0x0) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000140)={0x2, 0x0, @ioapic={0x5000, 0xffffffff, 0x4092f27e, 0x3ff, 0x0, [{0x4d, 0x4, 0x2, '\x00', 0x9}, {0x5, 0xe4, 0x5c, '\x00', 0x7}, {0x0, 0x9, 0x10, '\x00', 0xc}, {0x5, 0x7, 0xb3, '\x00', 0x1}, {0xf7, 0x8, 0x80, '\x00', 0x3}, {0xe, 0x4e, 0x2, '\x00', 0x3a}, {0xa, 0x2, 0x5, '\x00', 0x6}, {0xa, 0x7f, 0x7, '\x00', 0x1}, {0x81, 0x8, 0xe, '\x00', 0xff}, {0x0, 0x5, 0xd, '\x00', 0x25}, {0x81, 0x4, 0x0, '\x00', 0xc}, {0x4, 0x4, 0x2, '\x00', 0xfb}, {0x4, 0x0, 0x0, '\x00', 0x4}, {0x3, 0x66, 0x1, '\x00', 0x5}, {0x4, 0x0, 0xff, '\x00', 0x78}, {0x7, 0x7, 0xfa, '\x00', 0x81}, {0x81, 0x6, 0x1, '\x00', 0x7}, {0x9, 0x2, 0x8, '\x00', 0x4}, {0x81, 0x6e, 0x2, '\x00', 0x49}, {0xf8, 0x0, 0x0, '\x00', 0x5}, {0x6, 0x7f, 0x9, '\x00', 0x8}, {0x5, 0x3, 0xff, '\x00', 0x4}, {0x0, 0xb, 0x5, '\x00', 0xc}, {0x6, 0x3, 0x9, '\x00', 0x7a}]}}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000200)=[@enter_looper], 0x50, 0x0, &(0x7f0000000380)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001840), 0x0, 0x0, 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000002380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000023c0)={'veth1_to_batadv\x00', 0x0}) (async) r7 = syz_usb_connect$uac1(0x2, 0xb8, &(0x7f0000000100)=ANY=[@ANYBLOB="12010103000000106b1d01014000010203010902a600030156c0020904000000010100000a24010101bb02010211240601040507000a0008000300020005052405060f0f2406020504020002200a000a00040c24020203020250800009010d2406050203078887000a00000924030101010505"], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x2000000000000046}) syz_usb_control_io(r7, 0x0, &(0x7f00000007c0)={0x84, &(0x7f0000000980)=ANY=[@ANYBLOB="201532"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r7, 0x0, &(0x7f0000000c80)={0x84, &(0x7f00000009c0)=ANY=[@ANYBLOB="401d0702000000fa"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r7, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000580)={0x40, 0x15, 0x4, "61f3be92"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$sierra_net(r7, 0x0, &(0x7f0000000280)={0x1c, &(0x7f0000000440)=ANY=[@ANYBLOB="401206889f8ffaa31c523714d3939e470d7cdab97827e98de19401097a841284df6e28e3a90600e253d61201e1939cc47fa9815b5b7dbb62c7b37d93837b013f7100"], 0x0, 0x0}) (async) sendmsg$ETHTOOL_MSG_FEATURES_SET(r4, &(0x7f0000002580)={0x0, 0x0, &(0x7f0000002540)={&(0x7f0000000340)={0x34, r5, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_FEATURES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @ETHTOOL_A_FEATURES_WANTED={0x14, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_VALUE={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8}]}]}, 0x34}}, 0x0) (async) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) 1.478302683s ago: executing program 4 (id=8906): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_clone(0x1940380, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) ptrace(0x10, r3) ptrace$getsig(0x4202, r3, 0x4, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}}, 0x10) sendmmsg$inet(r4, &(0x7f00000027c0)=[{{&(0x7f0000000680)={0x2, 0x4e22, @multicast2}, 0x10, 0x0}}, {{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000940)="b3fe10", 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000006c0)="65582f9359", 0x5}], 0x1}}], 0x3, 0xc044) r5 = socket(0x80000000000000a, 0x2, 0x0) r6 = socket$pppl2tp(0x18, 0x1, 0x1) r7 = socket$inet6_udp(0xa, 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) connect$pppl2tp(r6, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r7, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r6) r8 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r8, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @multicast1}, 0x2}}, 0x2e) setsockopt$inet6_group_source_req(r5, 0x29, 0x2a, &(0x7f0000000200)={0x8, {{0xa, 0x4e21, 0x6de, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @empty}}}, 0x108) setsockopt$inet6_group_source_req(r5, 0x29, 0x2f, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x4, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e21, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x7fffd}}}, 0x108) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8) 1.257335247s ago: executing program 5 (id=8907): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80b00, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000580)={0x2, 0x0, @ioapic={0x4000, 0x40000b, 0xa, 0xfffffffc, 0x0, [{0xc, 0x5, 0x7, '\x00', 0xb4}, {0x83, 0x87, 0x4, '\x00', 0x4b}, {0xfe, 0xe, 0x7, '\x00', 0x40}, {0x0, 0x9, 0x40, '\x00', 0xc}, {0x8, 0x10, 0x8, '\x00', 0xa8}, {0x2, 0x2, 0x6, '\x00', 0xff}, {0x6, 0xe, 0x4b, '\x00', 0x6}, {0x5, 0x8c, 0x4, '\x00', 0xe9}, {0xe, 0x4, 0xa7, '\x00', 0x1}, {0x9, 0xdc, 0x6, '\x00', 0x4}, {0x1, 0xd, 0x15, '\x00', 0x8}, {0x8, 0x7, 0x6, '\x00', 0x7}, {0x4, 0x8a, 0x80, '\x00', 0xdf}, {0x3, 0xf1, 0x6, '\x00', 0x9}, {0x7, 0x65, 0xb, '\x00', 0xfd}, {0x6, 0x6, 0x42, '\x00', 0x64}, {0x7, 0x0, 0x4, '\x00', 0x7}, {0xef, 0x6, 0x9, '\x00', 0x4}, {0xf, 0x6, 0x6, '\x00', 0x9}, {0xc, 0x3, 0x3, '\x00', 0x14}, {0x1, 0x3, 0x7, '\x00', 0x4}, {0xd, 0x40, 0x7, '\x00', 0x6}, {0x15, 0xf9, 0x7, '\x00', 0xff}, {0x92, 0x6, 0xfa, '\x00', 0x42}]}}) ioprio_set$uid(0x3, 0x0, 0x0) sendfile(r0, r0, 0x0, 0x7ffff000) 228.770076ms ago: executing program 4 (id=8910): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x20, 0x0, 0x0, 0xffffefff}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000001900)=[{{0x0, 0x0, &(0x7f0000001680)=[{&(0x7f0000001280)="67aa02f49c67f2e81c3eb14545b8a545a73739b1d0fc2c622ce80dd13c7783e0d904660bb990a2c5939473df14b1b2f3350a9c7979e73d3b1e4281b89212181075457eb67f376b2cccb568f4ede1d5", 0x4f}, {&(0x7f0000001300)="5be693800846b019cf20a999c6539a5bec795d20c07ff0305adcb71dff657dbf4e608e8b67d75991c5fe621ca23f179a09c14f8cc204c6abe9f9784d7ef3cbc1d3928a448e0e2a5a2283657b242f686cf042f05dba706e6e4c50c3af67b80d635767ee2db27741d052729f4a6cbaed362e43b796f2adf87196d74c8c466b7c18294323c8ec8f662fc09c5f66b0e4589115576003c3fe015a22f1563863347bfd26ffbbf0d4515dd3a29801907dd0050192576ac2288681d9c760f394e88e695fd58f28535484b823dbbe63c22f34a03b6ff63286555e0b4247be2a7a8001ce72c8690198768d4404fb79f73ac060aae415e90c4fade5a2b30b9f74700ed01b", 0xff}, {&(0x7f0000001400)="0c770e33dd8ffb94a7de4d821aa4cfa079a00f1ac1058eb3890636013350109f790a9101f61f01c9f672c9951051803918257190801bdcd58d3fae6c948b50b19687f90fdab471332a56c2f12710cc4f00e8ba9e0a58031e621c8cdec9d87659f8dbace307bcb5ea7ed355604770cd1e64652dfb5ffb254cd46f4e2e7e6fd670f18492812ec2e75f19fcd91aaa6e7035a5db072c295ae00243415de14694936212a900"/186, 0xba}, {&(0x7f00000014c0)="ce7ad00449532a08f1e97bc8f6fef99835f2700a7ddc88a2dd9638d8fba0331c546fbd8b723b0e5ff75a2bf2e3d0ea27785623bcacbb8a992312cf174123b6d917b2bafb4d9b4704783a0b2d39c0767b1d231622fe602a718ed4414c4c23f4ba5456a09da6023c03cfd6cb2a0de70f059a5bca301bcf25966aff167ba865fe9fadcbf92156618fd201d36fe8a64f24b11341cfe901b4c5c443a95e14007134f082f760d0092f6bb8d978adb8299dca2eb6aeac12ca9b7c0e24b52d77f7412aa3561c4376", 0xc4}, {&(0x7f00000015c0)="f20d6e2f3a07a5449569cf75d896741520410056fcd2eb11000275bc9ebf651688a0f33c2521652ff5b72c2cbcd36d4889f7bf34e40d94158f81c1ce2ff5b99eb1990732ad7f6323b0f3113267f6f74b9b9fc836080e617a12c2791539f60c42b76379f69e88dff9c431accfc04e713d6882e8b16456184be74e78121390fe195e3cbc1460951229b86b6e1c7d23d41d20cbd82da016c829d651ac4c6a7683184d4d4c37047b81c430294b8826f304", 0xaf}], 0x5, &(0x7f0000001940)=ANY=[@ANYBLOB="40000000000000000b0100000200000091e4f6513b080fe3b596d749ce3c0343dea047e0f7776a896fda23ae129e74cfc5532ace4e47f7359154bfd7503c61838cd9c00000000000000040000000000000001501000005000000d11a3f5628b7a4cb929c10edab9f408d517c238f3569e7772bcacee3fc6ee9733ad0e51b66fdd2a64fca000000000000b800000000000000ff0000000d000000585d706f8cbf558654f42f6444a9354849b23620ff51b70f91f09cd1446b40a28555010f7eb76b98da7ac331d63fe6a2b56c4e52794e1c2e4d4d915d441ca96d25248bb28e0d762c6511a5e30091cdcc9a691bacd9b78e8c6c8241a6c750bb53707245aef19fcebd960fd7f7333b7266d04ddc0f0a47a1249e0f615fc8c2b6c946ff26f5e4852532a5af9d189fe7d6fb61026405d97681e51794372ed8f0c0091d3243373c00000090000000000000001b00000007000000e9ce81a06df3887741f04ca821a6202900249d60563de12f60c117031d27c04713b70f9bfe2f6c7509864487c961fd9c266953053f2cff471db18cca764a2d9e3ecba3bd0e244d11b50468b2986a9273f0882b1ef4b495192c237fd5c41649e839777f241e22e512f1bcffe4c5c15bd52cc8af50bc94f2ee88e1274d34000000280000000000000029000000060000007b16cb8d9053cf4bee195f4d94d201bb68d33cad2ba5ca32"], 0x1f0}}], 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe3}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmmsg$inet(r0, &(0x7f0000001100)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000600)="146f449cfcb3da783966ee9ecde817dc8ba41a658766339a708bbba692b11e41d5821f508d919010aad0a7f1e09e41c681fa9b1c73cb9ac0253eb55a444635ad6ddc0d827fd72a744d7706e19e0bb39327bf65d022b2ca53f02f5f3c546606a824a2992553ad624064bfdc83f1fa", 0x6e}], 0x1}}, {{0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000780)="040e8f45fffdf50e4c7910c171b127c3cab890c81f614f27ad683b963769ef24d84f082556fd1b43f878a65dcc23ad409d4ef51c5a36900c6a5ab314bb2a406d10a6a499793d7a2e03661510116d87dc79356005e01c7474b76cacaf8136be8cda811a39567f643c0612dc5d7cf19330c281bb05c1f040dd51aea0dc4d2afa3e4aaa6c3abce4cfaeb2ba13", 0x8b}, {&(0x7f0000000840)="57c4451b3c7c75655c57ffb8dccde119b54a69a485415fd700812b78ca50a3e54c8889a100a7f82a7f53238a20b00bd47bc39e1db1b3e2694f378c94e9184aa53cc6032a2783db559dba2208439229a2bae2e355ebfe4f7563f0579056d94e75e1c33b5b68fe4cf4a85b48558a56b4e4076d56e10087c6ec2b3c50ea02951bbb8d8b36197ed4e2fcb1cf8686dffe5f3f9a3e9f565daa2ea6c783c11ef3f63dc91a0e66add12776e48fab54a2494e4fadc2ef061f489139cd012acd", 0xbb}, {&(0x7f0000000500)="6f0070751b7d82b11bf815a5a350de1cf2af793b6fa1f5c5d603cf3fc8a89b0bebd59dc535fe23b45ea92cc77c6bd1b9e06eeb847e70cf231771050820bdc0521f72ba507ad7241fe7e91a1575c01cb37892c93cf0ea46dfb147f330534806ab5374870e0762ef26", 0x68}, {&(0x7f0000000900)="38ebeb016e356fee4cda85d0cd971519cbb747f2f5dc8aa685667417945724349c2e53956a81cc01b96257be6cf756ee9a1dbdb4805abaadcdb07fb7fda595b75050", 0x42}, {&(0x7f0000000980)="ab07cb5269eaac6a6d8297a151f6ff8a153e45bf2a870dfe905021cdda98e2d6477ec965f23931447052dc921b69a55a12335828601119c981897e5f9d23246304c348b44d28b95fe7fb2e3464e8cbca139ef88350e5009432e741b1e76efaf855d18b7583abc382ae1007611eb41150ce1a7244f400691426252a7da7033ed275dbfa75153d247ab17aed244023c89edc8dae89d2748d2a59a87e7062d3d17c7c5fe0cbf61e709d5d62181d7c8bd12d21ff6f437150ef26fc26bbab9c00f788e11201628f229c46a6ac29494bc8487e5fc89fb0cd958a91bed8f36a7a57243f1fd6c9f02f", 0xe5}, {&(0x7f0000000a80)="7827d3e65741740426d89147d59fd333d253aded53fa8a969a0f05177236c017d4a616e2c81a0e06caf88f55f46992a594ecd5ba2c71a70b5e9002e3dcdb3bf067e087ad62c4b02c7c8345cc901abc0d990e0dfe9a5efccffccd163c7e4c10683fe57ad5eff3fc73d8e5878410b52606538f56778aef3e7fae1a0c4f64506cc6815e23929bea0316b3e35cc28e017fa57e5fe08ee8feb3718f6859119a51aa97bbeea8ec9c9afa7c9c8fe96023e7649b5e412642c78972184b9e7cb5a81b05c6f85bd24c01fa3c417cedd5fc4979cf8c967207", 0xd3}, {&(0x7f0000000b80)="a7c3dc9a3bdfe46716c529cb658354380be25e7ed73661b2d6faf0d274a6b41c8128ec4b4d1e219db8a203c4e013", 0x2e}], 0x7}}, {{0x0, 0x0, &(0x7f0000001040)=[{&(0x7f0000000d80)="c8c9bb0395733c925946bc562a54294b423cabffedb1436e2eeafec0dd5c365ee1453384a53151ac4520d0219b79105da2854cf859b2c67258d1b6e49b896188564a215ed2d8e36b81b1752c752f2ac52c559f562459a8b2f1f3da79b25b40062732bca7bf5b651c411cec17ef07fab31d5762eaaea7eaf30a5f52423d6c923b2125809279561c8000dad1c6fd86f3a4439a72d085fee666a9e251a92bde44605d4bca2dcc5a9ed5b751ee3c30646752fbbc797f2b4d593ec4ca4f898eb6c60c3fac28177e744b7c319bc8", 0xcb}, {&(0x7f0000000e80)="468a14be3bb47850015f0334409e604cfb2078fb78d8bad8c1a001e300f50504de0f98f8b7226856718342633bdf4331c04412363666e6b477e0e1ee9392af4fec260d3256c960341c6c8a3b52d1bcc99e", 0x51}], 0x2}}], 0x3, 0x40) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x10008) creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000007d00)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="180000006a00"], 0x1c}], 0x1}, 0x4000080) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140), &(0x7f00000001c0)={'U-', 0xfffffffffffffff8}, 0x16, 0x1) pipe2$9p(&(0x7f0000001700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84880) r6 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) epoll_ctl$EPOLL_CTL_DEL(r6, 0x2, r5) write$P9_RVERSION(r5, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) r7 = dup(r5) write$FUSE_BMAP(r7, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r7, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080), 0x800, &(0x7f0000001200)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r4, @ANYBLOB="2c776664ee6f3d", @ANYRESHEX=r7, @ANYBLOB=',directio,\x00']) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00') pread64(r8, &(0x7f0000000200)=""/4087, 0xff7, 0xd37) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000100000500010001"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 228.411846ms ago: executing program 4 (id=8911): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cpuinfo\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) ioctl$TIOCSERGETLSR(r0, 0x5459, &(0x7f00000000c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) fstat(r2, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(r3, r3) ioprio_set$uid(0x3, r3, 0x4000) r4 = add_key$fscrypt_v1(&(0x7f00000020c0), &(0x7f0000002100)={'fscrypt:', @desc1}, &(0x7f0000002140)={0x0, "9a075c94554e9fbfb8c4b9f49d397a58e25f893447611eb9d551bac19c36c26138ee8a3cf6c921a6ce3ed1ee548201c1e635bd9c472c13aff9187ff8ddd52823", 0x2d}, 0x48, 0xffffffffffffffff) keyctl$clear(0x7, r4) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000940)={0x6, 0x0, &(0x7f0000000300)=[@request_death={0x400c630e, 0xfffffffd}], 0x0, 0x0, 0x0}) 227.355056ms ago: executing program 7 (id=8912): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') mknod$loop(&(0x7f0000000080)='./file0\x00', 0x100, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_l2cap_L2CAP_LM(r2, 0x112, 0xe, 0x0, &(0x7f0000000080)) mount$fuseblk(&(0x7f00000000c0), &(0x7f0000000000)='./file0\x00', &(0x7f00000003c0), 0x200840d, &(0x7f0000002340)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x2000}}) read$FUSE(r0, &(0x7f0000000200)={0x2020}, 0x2020) 226.937026ms ago: executing program 7 (id=8913): mmap(&(0x7f0000ff4000/0xc000)=nil, 0xc000, 0x1000003, 0x20031, 0xffffffffffffffff, 0xffffe000) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x10}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000ff2000/0xe000)=nil, 0xe000}, 0x2}) ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, &(0x7f00000000c0)={{&(0x7f0000ffd000/0x2000)=nil, 0x2000}, 0x1}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x2000)=nil, 0x2000}, 0x4}) mlock(&(0x7f0000ffd000/0x3000)=nil, 0x3000) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x9) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) dup3(r2, r1, 0x0) syz_clone3(&(0x7f0000000140)={0x4000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x2}, 0x7a) 223.972316ms ago: executing program 7 (id=8914): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'wlan1\x00', 0x0}) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000080)={[0x37c7]}, 0x8, 0x800) r2 = openat$urandom(0xffffffffffffff9c, &(0x7f00000000c0), 0x6100, 0x0) sendfile(r1, r2, &(0x7f0000000240)=0xc, 0x9c) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'ip6_vti0\x00', 0x0}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) r7 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r7, 0x8982, &(0x7f0000000000)={0x8, 'veth1\x00', {'veth1_macvtap\x00'}, 0x4}) bind$802154_raw(r7, &(0x7f0000000040)={0x24, @none={0x0, 0x1}}, 0x14) ioctl$BTRFS_IOC_SET_FEATURES(r6, 0x40309439, &(0x7f0000000040)={0x1, 0x5, 0x18}) close_range(r5, 0xffffffffffffffff, 0x0) sendto$packet(r3, &(0x7f0000000180)="10030600e0ff020004004788aa96a13bb100001100007fca1a00", 0x10608, 0x0, &(0x7f0000000140)={0x11, 0x88f7, r4}, 0x14) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_STATION(0xffffffffffffffff, &(0x7f0000001140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001100)={&(0x7f0000000340)={0x4c, r8, 0x200, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r0}, @val={0xc, 0x99, {0x8, 0x13}}}}, [@NL80211_ATTR_STA_PLINK_STATE={0x5}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_LOCAL_MESH_POWER_MODE={0x8, 0xa4, 0x1}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x92}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4014}, 0x44) 223.669406ms ago: executing program 7 (id=8915): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000340)=ANY=[@ANYRESHEX]) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x380, 0x2}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfaf, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) 223.325086ms ago: executing program 7 (id=8916): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$PPPIOCSFLAGS(r2, 0x40047459, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x4c, r5, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x38, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @broadcast}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9}]}]}, 0x4c}}, 0x4000) sendmsg$TIPC_NL_BEARER_SET(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)={0x34, r5, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x20, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x48c05}, 0x4040140) setsockopt$sock_int(r3, 0x1, 0x2e, &(0x7f0000000580)=0x100e77, 0x4) r6 = getpid() sched_setscheduler(r6, 0x3, &(0x7f0000000240)=0x1) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @tid=r6}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x20040, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) r11 = ioctl$KVM_GET_STATS_FD_cpu(r10, 0xaece) preadv(r11, &(0x7f0000000140)=[{&(0x7f0000000080)=""/3, 0x3}, {0x0}], 0x2, 0x1, 0x7fff) timer_settime(r7, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) recvmmsg(r3, &(0x7f0000000200)=[{{0x0, 0x0, 0x0}, 0x83}], 0x1, 0x10000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) r12 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/custom0\x00', 0x802, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r12, 0xc018620b, &(0x7f0000000000)) syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') 207.401727ms ago: executing program 7 (id=8917): io_setup(0x7fffffff, &(0x7f0000000100)=0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)={0xffffffffffffffff}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000300)={'syz1\x00', {0x2, 0x57e, 0x63a7, 0x1456}, 0xc, [0xbcf, 0x80, 0x7, 0x7fff, 0x4, 0x8, 0x7, 0x8, 0x3, 0x6, 0x3, 0xd, 0x401, 0x8, 0x7fff, 0x2, 0x40000, 0xff, 0xe256, 0x81, 0x0, 0xea36, 0x1000, 0x3ff, 0x8, 0x0, 0xffffffff, 0x6, 0xd23, 0x800, 0x100, 0x2, 0x7, 0x1, 0x6603, 0x5, 0x1, 0x6, 0x1, 0x5, 0x7, 0x239, 0x8, 0xfff, 0x626, 0x4, 0x1, 0x5, 0x400, 0x81, 0x8, 0x401, 0x2, 0x81, 0xb0, 0x40, 0x4, 0x81, 0xe, 0x1, 0xc6a0, 0x4, 0x401, 0x5], [0x10001, 0x7, 0x1, 0x1, 0x9, 0x0, 0xfffffffe, 0x3, 0x9, 0x7fff, 0x10, 0x1000, 0x2, 0x2, 0xfffffffa, 0xffff9b7f, 0x573, 0x0, 0x4, 0xcce, 0x1, 0x1, 0xfffffffb, 0x9, 0x9, 0xb, 0x7, 0x5, 0x4, 0x0, 0x80000001, 0x1c3a, 0x4, 0xe4, 0x1000, 0x3, 0x644200b5, 0x800, 0xf, 0x80000001, 0x1b7, 0x6d25, 0xffff8001, 0x7d, 0x9, 0x2, 0x6, 0x7, 0x0, 0xa, 0x80000001, 0xffff, 0xd947, 0x0, 0xffff, 0x5, 0xffff, 0xffffffff, 0x0, 0x1, 0x0, 0xc9, 0x200, 0x80000001], [0x8, 0x9, 0x0, 0xd, 0xffff, 0x9, 0x0, 0x0, 0x1, 0x8, 0xddf5, 0x6, 0x0, 0x1, 0x4, 0xd, 0x100, 0x3, 0x0, 0x0, 0x7, 0x2, 0x5, 0xf, 0x80, 0x8, 0x4, 0x80000001, 0x78e, 0x5, 0x10000, 0x4, 0x4, 0x3, 0x7f, 0x4, 0x8, 0x5, 0x800, 0xec, 0xfffffff6, 0x0, 0x5, 0x800, 0x7f, 0x0, 0x1, 0x40, 0xfff, 0x6, 0x7, 0x2, 0x1, 0x5, 0x2, 0x4, 0x1000, 0xfffffffe, 0x7, 0x1, 0x3, 0x9, 0x5cf, 0x1], [0xc, 0x7, 0x178, 0x5, 0x9, 0xff, 0xd, 0x10000, 0x2, 0x3, 0x3, 0x4, 0x1, 0x759, 0x8, 0x24, 0xfffffff7, 0xea0, 0x10003, 0x5, 0x8f, 0x5b7f503, 0x94, 0x2, 0x1000, 0xa5c0, 0x40b50c25, 0xfffffffe, 0x8, 0x8000, 0x8, 0xde76, 0x1, 0x1, 0x80000000, 0xe6ab, 0x0, 0x3bee5b16, 0x8, 0x81, 0xb828, 0x1dd30, 0x6, 0x6, 0x6, 0x10000, 0x7ff, 0x8000, 0x0, 0x558, 0x4b1f6667, 0x6, 0x1, 0x7, 0x0, 0x6, 0x7fffffff, 0x7, 0x101, 0x938, 0x3, 0x7, 0x5, 0x1935]}, 0x45c) syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000000904000001020d0000052406000105240000000d0b939d60a53067d50000200006241a0000000905810300020000000904010000020d00000904010102020d0000090582020002000000090b"], 0x0) splice(r2, 0x0, r1, 0x0, 0x10000008ebc, 0x0) r3 = eventfd2(0x9, 0x80000) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x1fc, 0x19, 0x1, 0x0, 0x10, {{@in6=@remote, @in6=@private1, 0x0, 0x0, 0x4e21, 0xfffc, 0xa, 0x20, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffff, 0x0, 0x0, 0xfffffffffffffffe}, {0x1, 0x0, 0x80, 0xffffffffffffffff}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, [@tmpl={0x144, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@local, 0x1, 0x3}, {{@in=@remote, 0x4d2, 0x2b}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x800}, {{@in6=@remote, 0xfffffffe, 0x32}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x800000, 0x3}, {{@in6=@empty, 0x0, 0x33}, 0x0, @in=@private=0xa010101, 0x3500, 0x3, 0x0, 0x1, 0x0, 0xabf}, {{@in=@dev={0xac, 0x14, 0x14, 0x25}, 0x0, 0xff}, 0x2, @in6=@private1, 0xfffffffc, 0x1, 0x0, 0x3, 0x1, 0x0, 0x3ff}]}]}, 0x1fc}}, 0x44) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x6) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/fscaps', 0x0, 0x0) io_submit(r0, 0x2, &(0x7f0000000480)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x8, 0xe7, r1, &(0x7f0000000340)="dd1e51394f7f9ed3fc45b254696a06420787e99100656ce98b74c42772d1387920e2c258f73ce4136175af00d22028b71091ac4a7f0f302b8bd9bf95fbc1d919e33cd86590f2a6dd21eba7a90920fee05b4803f4ec142f545a12f01b74fd5bdb5d526e19f5011797f1f3dd8ec30bf410596a5a6031", 0x75, 0x3, 0x0, 0x2, r3}, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x3, 0x777d, r4, &(0x7f00000003c0)="474c0f266a7b42b20a06cf061e2ff150805169535d5f43299f647e774ffc3fcf7efe60041cfcfa3f213a5b6c342fa1917f6c1aee", 0x34, 0x6, 0x0, 0x2, r5}]) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r6, 0x0) r7 = timerfd_create(0x0, 0x800) read(r7, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) r8 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x10) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000940)={0x98, 0x0, &(0x7f0000000280)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1009, 0x1}, @fd={0x66642a85, 0x0, r8}, @flat=@binder={0x73622a85, 0x101, 0x1}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}, 0x400}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r8}, @fda={0x66646185, 0x8, 0x2, 0x5}, @fda={0x66646185, 0x7, 0x2, 0x24}}, &(0x7f0000000080)={0x0, 0x18, 0x38}}}, @increfs={0x40046304, 0x2}], 0x0, 0x0, 0x0}) 166.781817ms ago: executing program 5 (id=8918): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000d80), r1) sendmsg$IEEE802154_DISASSOCIATE_REQ(r1, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r2, @ANYBLOB="010129bd70fb979b76e424"], 0x14}, 0x1, 0x0, 0x0, 0x20000040}, 0x4810) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000000c0)='/devFtR\xac\x13\x1e\x14e\x81h\xa3K\xd6\xd0^\xed\xd7\xb3\xac\xa0&&\xf8\x0f|\xe8\x15\xf2\x82\xb4\xa0\xc2\x01e\x1e\xf4\x19\x06\x03\xf5+\xc4\r\xa1\xb8DY-\x17\x0f\xf7\x8d\x7f\x9473\x1f\xc5!\xb2\x1bs\xfc\x91~c\xd1*en\xd1\xfc\t\x9c\xda\xfd\xde\xc0\xa2\xf4\x15\xf1\xd9\xe0\xe2\xf3^R\x8d\xae\x8d\x87Fc\a\xe6_\xd0V\'B?\x8b\xa6\x9cIT\x1f\x93\x8b\xfd\x814dX\x93\x89\x1a_45\x94y(\xb9\xaa\x91\xa5\xe8n\xe6\xb58.\xc4\ntJ\x11\f\xb8\x18\xfe\xb2\x93\x93\xe6\x82\\\xe8]fV\xc0#\x1c\xbf\xd1T\x809/\xc3\xa3\x17\xc4\x0e\xdby\xd6\xff\xfb\xbe\x83\xf7$\xf7\xc4\x16\xee\xa0Tn\t\x0f,|\r\xc3\xb39A\xc2wF\xb9l\'_\x89B\xf8z\xe6\xc13\x9d~\xd5\xc6\xae8\a\xa1\x90\f)M4J\xaf\x010;\xc7\xfd\xe7\x95\xfb\x95\xd6N\v\xf9\xe1=3\xe7\x8a\xc8\xca\xf12\x1aJ\xd6Xj4\x1a\x88\x04\xb1DJ\xce\x95\xdb\xd2\xab\xd6\xeb\xc6\xc6v\xd0#x@\x96\xbf\xa4E\x11\x9dH$+\xadS&\xa6\xcd>\xa2<\xe2\xa7\xa3\x99\n7c\xc5\xbb\xc2\xb9\xa3k\xaa\x9e\xe9\xb4\xd4\xbc\xda') 155.103367ms ago: executing program 5 (id=8919): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x11a, 0x3, 0x0, 0x0) r1 = epoll_create(0x7) r2 = epoll_create1(0x0) r3 = epoll_create(0x7) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000180)) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f00000000c0)) r4 = epoll_create1(0x0) r5 = socket(0xa, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000040)=0x9, 0x4) bind$inet6(r5, &(0x7f0000000000)={0xa, 0xe64, 0x3, @empty, 0x2}, 0x1c) r6 = syz_genetlink_get_family_id$wireguard(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r5, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r6, 0x200, 0x70bd2d, 0x25dfdbff, {}, [@WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2040805}, 0x40000) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000100)) r7 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r1, &(0x7f0000000140)={0x60000000}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r7, &(0x7f0000000080)={0x1008}) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r8, 0x0, 0x0) r9 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) ioctl$TCSETSF2(r9, 0x402c542d, &(0x7f0000000100)={0xfffffffa, 0xe7, 0x2, 0xff, 0x7, "ea71061d0000000001000200", 0x0, 0x80}) ioctl$TIOCSTI(r9, 0x5412, &(0x7f00000004c0)=0x8) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r4, &(0x7f0000000000)) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x1000) 17.41659ms ago: executing program 5 (id=8920): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = socket(0x1a, 0x3, 0x0) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) r4 = pidfd_getfd(r3, r3, 0x0) setns(r4, 0x66020000) move_mount(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x222) r5 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_group_source_req(r5, 0x0, 0x2e, &(0x7f0000000080)={0xd, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @multicast2}}}, 0x108) setsockopt$inet_MCAST_MSFILTER(0xffffffffffffffff, 0x0, 0x30, &(0x7f0000000800)=ANY=[@ANYBLOB="090000000000000002000000e000000200"/88], 0x290) write(r1, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCFLSH(r6, 0x400455c8, 0x0) syz_usb_connect(0x0, 0x4a, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 16.74061ms ago: executing program 4 (id=8921): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0xeeee0000, 0xdddd0000, 0xe, 0xf1, 0x5, 0xfd, 0xd4, 0xd4, 0x0, 0x4, 0x7, 0x7}, {0x5000, 0x1000, 0x3, 0x9, 0x8, 0x3, 0x6, 0x8, 0x8, 0xf, 0x3, 0xca}, {0xeeee0000, 0xe6e50002, 0xb, 0x0, 0xa, 0x7, 0x4, 0x1, 0xc, 0x0, 0x2, 0x5}, {0x7f778000, 0x2000, 0x8, 0xfc, 0x3, 0x46, 0x2, 0xd, 0x7f, 0x3, 0x0, 0x1}, {0x100000, 0x10000, 0x9, 0x1, 0x3, 0x9, 0x7, 0x6, 0x5, 0x4, 0x6, 0x4b}, {0x2, 0xd000, 0x0, 0x48, 0x3, 0x6e, 0x1, 0xff, 0x4, 0x80, 0x1, 0xfc}, {0x6000, 0x0, 0xf, 0x4, 0x3, 0x6, 0x0, 0xb, 0x5, 0x7, 0x0, 0xf8}, {0xffff1000, 0x8000000, 0xd, 0x5, 0x3, 0x3, 0x2, 0x9, 0x54, 0xc, 0x3, 0x7}, {0xeeef0000, 0x5}, {0x2, 0x9}, 0x40010000, 0x0, 0xf000, 0x300, 0x5, 0xe000, 0xd000, [0x3, 0x401, 0x7, 0x3]}) ioctl$F2FS_IOC_START_VOLATILE_WRITE(r0, 0xf503, 0x0) syz_usb_connect$hid(0x1, 0x3f, &(0x7f0000000300)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x10, 0x46d, 0xa87, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x3, 0x0, 0x8, [{{0x9, 0x4, 0x0, 0x3, 0x1, 0x3, 0x1, 0x0, 0x8, {0x9, 0x21, 0x7ff, 0x81, 0x1, {0x22, 0x91a}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x96, 0xff, 0x6}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x4e, 0xd4, 0x93}}]}}}]}}]}}, 0x0) r1 = accept$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000180)=0x14) ioctl$BTRFS_IOC_RM_DEV(r0, 0x5000940b, &(0x7f0000000900)={{r1}, "da7aa245583e3e2dc4cf015e6807391968fe7bac8c023170b7d1da7b63667a5619f61cd4012d41ebf23f3209cae61dd69fd18978d03e0e74db3b639fec889a34643e4fe9081488376405f98c6a7bf7e981081bbd8f7b5288c003cb59aa38eb7b99719018cc624793dbf87bb77ac6ea64172ae3533146a8555c81a387c552bc5a46811382eef08e17f7a73f3ebf8b298e9dec8034306c022db59a1e20ebba57d623205082a758cba5dcc2a33b487d9cce8bf4ec54e50f1d192fa11b6e8eb3177420098d24719027d8bf65e736c95c4e257002f346209650d981a33e5f0e8c253494c33c387323668531eeb39eabe8b23dd69a17daa3675c16ff2de7d30e16b1390e7de5fbbfd753a022686964d4baaa02db80a38244f32cd6ad8a7cbc8f633c2cd601ffeb89507ddec8fd7a9136d38386f22b50e1fee4b5c0df992d37cf8373a0873b503ec5e1890ce2f5011c0f08be0d02995b22ff9873eb50c8bf17a91f36cf6b09496b35b2d85a1c58b1b61e3439bc1a62c6e5f0b2bcbb6e216f2a9f241797e5b6584c4f6d2cd1c0cac8480cda56a8a834528dbaa8d44b06fe36be58514d3bfd36353ce615dd06f8a42765e8c4f7d4abd7b1393126b6e64a05181a5e190081032f1fe42e20785746bec0d9e17b882ce77543f5de42323f6ba4b01d0b581263f6fd8c6a68400e8405d92ad6264154c78477eebc8360a6a9a1a47282352fe616f30aa8a57e3dd5654cbd92ec6e587c2531ecbe268db39132fd0f1563b49664f520afed052c8f4a42a2885e66f335b7082ecb56cedce07d52b2ce533332bf701a173436c89fd881285f1af422417695f8986a36fbdaffcf90e1b51e049bb8bb9987a4deb4613ec537bb5127271fe3389fcde7b6d66e67228f2bf6d4151c998b53b33636c712329daffba12b3911bdfbb7696f2e288b5ee2070d2469b4d1a60fbbe7f71d5aa243e03950008ba13a4f3bce4418f3c4b7389e9d0ac4fed19ed33f91463bef7e9b79ba92dfc6bd93e1487d17abe682502bd675d5d9ea45852c9ed5cfaefbf732e56c592ae7aae36fa835e7af507732bdd66b6ec31e24f916917d1778e7d4f996144f05836c45dfbaffd1fd720adf5e8db49b560507682c21a085cd9c2ebe112fb7b58b5197e546dfc002bcd5f813f50d9b7c69cce6e1e86cf319694bcc6a04caf14366ae40666cfe1ce5fc46b42e0eda30fbee805646ee0339f2afa4757d66f5d22e9ff2f94a19f2be46bb97192b2722a78d1572c2370eb68a5b100fa1cdd23f27eb45ea8da6880be99f1f7d7e031735acc7f27d4928d9fbbd855d82f2baadf30a146ac4fd0e4079bd90b31154431a1df2162e30020f1835c1711fa6d88d8429778f93baf6bb7a1d05d89059f30c21e030583529b34ef15cb7f9e063ce0433d2bd58a836a0a133526083477e040088b2dbbab760291d693cc1f670e5e686b319d2b37167684589e1db8852c24f990e2bbdcb35508885603ed4ff5201a12ac48cae2df39dc3c7410d9c29b1b41172b4f071eaf5f7f648025138d266b2d2857d5e4ea9016fa511b70ead47e1edc2bb26872a97ed0853b2e9a12e02fbf0505dd38d1706603b3de9335c5bb517e09133a3f4a964609d010faece88223cdb47073054b2f1d0b8fa219e02eb42643edbf89baf20a53df8b9e0dabbca59ba36b1b5ccb70d2df052983e4b1a71527df5ed29b688f2daa54b7a1b12dc3279293bb633f77b5cb74eea8229373718fa10ec8e8e64f290991fbfb1cad196b6912b43902ad43313ce0830cadf880219b2b049d2fc2cbf30a060b65b095604f9703e2e75215b2bf5bbf40861b4bfa38cfcc5b4fdda4b6b5171507b2b671727b51b1998fe3f18a9a5775d1516451841865217fee8237af0632402cc88094d6eac72f860af09a59a5dcb14dca1dab7ab862081b629054254c9bc6d20939e28498cc5bfc9c2bc523bd72f1a5a4d326de8732c7506d0afeb88286d0b67a36a0ad4e22852469fa2635ba935b5f88247ee6ed044f735ee3c14cbd01cbeb699e28d911b558e30a9dfc28cf286537e5e25def6a0c7a06e65c08ffdb2fcad46998641850d20f6f372531f89b792cc9e96930dd123ee104366dd569e097229102291dfc2932809b1b960ce8bddd684ac6539d5ba36d50ea947a86080fa054b5159a4da45877734a30480f037d49b655dc49c831395ad819371903f4d4124ecf61779e98015aba39d428203c2fbe52b4737a6841d0046750da51f1f4802daa1116407a2d03b67b6e5021cf538490c5ba26ebb5baef1f3f0fc6038bb8055142b3efa0a1678a2f705683ddd1e15073a23d5661d8003d1de870e63d0e80f060c80a3dfae7042e8c62d1630943b99b51c0bcf2fe577a7fd93dd63b85393d4459f2cac408599274037f7caba6c9b6375d28b63c851f13bd8fc4351ecd067ec24df8ea73147c70df99bb8f1cc394da6031337eb30cce39c3b240187271647c8ed172fcdad446296f460c9574a96310990d92a2431c093cb05f767e4a9540fee301bce3d8c3ff4a014f00bbf5e13606dadeb57e38fa5bf4c98056c21ccba09e31179e6df79d778b68cbee837c7680b9c05900e6f1f4fb1027a2597312ca674945c1aa4dd11083c3aae2b8a0638795233160a0b6cf0ec0abc82ebb088e22fdb26d8a9c2b6acc4c0541e3021661ebb64b13c491c8cf2b9aea37567ac03428849708658b64f3c7d44361eeb77864d7b7a8d87632296e9f8f0f794ffc4163aab859fbeb7e993d87d532419f5f48d6d5deef09f5a7bcd86f8312048c2ee21cffcc0641fe2f21f02f09a7d0198c6050e3e0b3e1c3f39dcda9f303a396ea288a0b7c176140f7bdb553ba0c5c58d6aa02a8a71f1fda310b2159cb232dbeb95b8945f6102254e90c307bf52ae20932810c46ce10275849a2d636b359567b55f717fee10136a5b32f16ad02acc6d8ff8df75eb43c075dd187d7386a99ca49d014e151e07140e2fa03000ff11442a84d75191fa32526ae1c70916e7c2730fbcd5d1af98fa4d38625c6510cb329233b78fb409d266afc13d07875230d75501a0c493f65e09a6d5293f3406dc3ac34e1805ef85454b4455b2a0edf5c09b457d93f91ca66dc47d682875879e8cc82b5e4be5c7322fe4ceab195a574f332b451709f254c628de4305cb9876d89d70d3174d2a2bffed11c89f43b8583c83f36c5c88a629d6f64e124b9ce2198b4be118006684d21ddc5176921fdeabc0cde29d59a3f123f4bd5fb791294f5138aec4f36ad3b64f252fc2d7d4b1b25814f8fb2bab63e514e02c5905e1042bcb752a782f301fa62baacc941427a24762bd4d6d65f16e171ff6bdb430d8a5abc5c1d51d9dfc6ef54ce4462798ee3853d2f193ca163b926981a5a1e9626e381f53490b87d7631b7c34e50f06a7389046eb0acf18ca97a0d95c6f12b57729a81d805ecbe66414ead88cfc01fa0f36e3995f84b7deb5e9e54a3295fad9a75ef98fb1f532fb4a70079a3295f9a0db8874946573a8484b170fd3c7f60d56bd786dd0061c0f884a76396f11102ad91b8c22588a2f8740e63bc4516db3485e98215593f5d581b91257d30ff4a55184d6756e33cc117b427618c57cbf7ea27b0f2d7bb3b72814f1fb934d315e81e2aeff110df7d54a69ce0cb558f4864ce593e2bac6d0b448af76fcc37269f353ec6a75441be1056aa564b19dd3a847e36b42a924a27d9d9d5e1333f35c0e41aa68aeb2d4e858c0627308f989912789ab46494ce77efb5b924342ebaa63a22eed87a35ee6096682bf7fa0ef8cc28dfb22f62270036a81b0bc359c85598f7f4f48b2d22b554125900707678b011538edaa0416083ed7149a5f95fb093ac136dc2dc74d44892503a698b8a50a0645d949ca9046d93de4d9a531a63a7b03a6c4dd9a5cbd17fb7ff42237f4658aea3acc666f1ad1af44cc565e676a4b8eff40b3d6b2ff8cb34ac14289b671c636a651f0b56269ceecfeeaf5d158daa7a1c1fe8cafee6271262888d302ea545a090586a2f7865f25b3caa983d073ba3ce65ae083f3745dae3226721e0c373c1bd3856a9b40e9a2feb61227356c514cbe651822a6c52334e1d5c8034d3e6b7ffc6dd7e47f03ff091f40dc233a906f276772cc3fe14cb86e1e1dfd99d610548d6eee4f8f78835a478c856312d5dbac37aed10f33ee37c8b70b49124bcd3ffe299b8df370af760cfce3aad00007e66525a564f9f6621d34d19c044092a9052e29ac369ba342dc7e162abc7ca8794cb2208f0826837abf58d1377f6a83d0e4754970d11cdd0333ef4fd4e6bf180053ee1d587974c2c6c96769290792dd2cdb15451f3474497349d18ca7ebadd97338bbb1bb363e408386ae034456619350697aa026beb095c583bd4520e993f88eef12739ed0427597b322607ab2d52234b258b3a178abab4d373cd2f6d088b967f48ef14e73a7945e40916e78732446f447e893c2d72a95e124679f430f517cba75535d7b90ba084200e5ad08304dd4f984f93d341ccac0c52d324c50d8e4ce4d1ebfcb893160b982cc6fc5bcd1a14418408111e94ca5b77ad1a30b602fec90e96a9d115d8ee902b25adebbafb79329c06a5a6d1e2ef621800d637e1e84823ced3b497015579a3ed13064217511c5e22a38cc530f1ccbb37f9cb57b423beaeb348c1911ceca619b2c4be5c27a2928e5a8075b55a95a8facb071cd7e7267dea7788b70104e59f6ab25a0101fd03011b17f0cf060bcc17c18894e16f5dd823b3a38820fb41c296574725fdf7b5c1b68881bc6e377fd880b0fdb07cdf30fbf7e2c819b1ca341a0b85e820036c9854092cb421d655428f4c4974ac1aa605b775e19174c218f3484d5b745d087d8c56c97247ea4c9ad6681165dffc95f0b60d3dad0a46c3f36248efd4db43a8be07f764a03da855ada9e0e9cfcf96c6e6d7bcff8d7b0698c3f76026f4b7c9e0585e0293239ce54ea9a7e34736905b164fdfb8bdbceb92f91c1dfea6dd76d397b829b1c1e594c42c8b75f64e613c12c77f0a7d8249abed7707a241e50baeb4754c0c45487b72b32b6b49fc13a11123848c96d4b292fcc0e2c00baa351f1c9e4426a82b2fa88aca6b51d47e9fd3888a4b73bdb4dd88bfe312c8069e245f6d7e11f4e7447060b1eaecb8086380668a862afb3611c3368db09e33cf1714bd2d84371f6fba29daa0796e13cd8b5e92ca7548dddb532190603fdce208b6635481ef9c4eeb6bc0aaf8392ed474ee5199b3a0215a7c2596526149118687ea9f6ae10222adabd35f60f83fc1fe0aecf3a4a84f10c81b10730b2f76976a94d46a3fa3d8bdae7e19f15ec1e98fd4f17a198506fe43d499431a5ecaf22b1652a393cb669eb5f6d2e485fd452b36dc5dea9ab33059f85cc5a80ea6c780b0d52e9c01e69df31f134c1491d3cdb3fe85ac6c9d5cb8c8e53b4f0b0e57022c944134388c4ed6cf0f4f7800174ea99277b4a2eb0c4d1ff2d6261ef05efe8c4f517ca74e228ce69ecc52d4ca13002c3ca843c9c3496c4938c5d618a5f333a9738bf9a4ae8d433b48e242add8a01dc70375f8d96811efb43a6c1e35eda4a153578a72f96ce610fccb8735e0ec6e49912f35e8ae2087ebe9634eea171f1f7433192460971b3598bfb1a7d72c22ae280ecf70915f089b9d2b5dd163a993c6177ab9fa06180672dbc4abbba91c143d372cf5dbd9e9e12ddeebbe7eb355e40b92d39402832d3ec58dd21f7bd03b52c56249179cf18e741963c7fc9f6bf400918044192e99253dbf7606d91800542a483c5f1d3e6ac6185bc17d54e9e6c04ba20cda667"}) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x80500, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000000), 0x1ff, 0x2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = dup(r2) ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f00000008c0)={0x80, 0x6, 0xf00, 0xec, 0x0, 0x5, 0x0}) ioctl$UI_END_FF_UPLOAD(r4, 0x406855c9, &(0x7f0000000100)={0x10, 0x8, {0x56, 0x8000, 0x3, {0x4, 0x2}, {0x7, 0x6000}, @cond=[{0xe4, 0xa400, 0xa, 0x6, 0x7f, 0x7}, {0x2, 0x3, 0x7f, 0xb3, 0xfff7, 0xb80}]}, {0x57, 0x3, 0x9, {0x8, 0x6}, {0x1, 0x90}, @cond=[{0x0, 0x6, 0xa, 0x4, 0x5, 0x1}, {0x4, 0x7, 0xa, 0x0, 0x81, 0x5}]}}) 11.09321ms ago: executing program 6 (id=8922): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x400001000001fe) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f0000000380)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r3, 0x2) shutdown(r2, 0x0) connect$unix(r2, &(0x7f0000fce000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) r4 = accept(r3, 0x0, 0x0) sendto$inet6(r4, &(0x7f0000000000)='g=', 0x2, 0x400440e9, 0x0, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f00000001c0)=0xa) read(r1, &(0x7f0000001a00)=""/1, 0x1) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, 0x0) mmap(&(0x7f0000018000/0x4000)=nil, 0x4000, 0xc, 0x13, r0, 0xca639000) 0s ago: executing program 6 (id=8923): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) r1 = socket(0x10, 0x3, 0x0) sendto$inet6(r1, &(0x7f0000000100)="c10e000018001f06b9409b0dffff110d0207be040205060506100a044300120018000000fac8388827a685a168d9a44604094565360c648dcaaf6c26c291214549932fde4a460c89b6ec0cff3959547f509058ba86c902fc3a10004a320c0400160012000a00000000000000000000080756ede4ccbe5880", 0xec1, 0x0, 0x0, 0x9e5e111c47e3504f) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x0, 0x80000000003}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x16}, @ptr={0x70742a85, 0xfffffffc, &(0x7f00000029c0)=""/193, 0xc1, 0x1, 0x14}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0x1d}}, &(0x7f0000000180)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0}) 0s ago: executing program 6 (id=8924): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) r1 = socket(0xa, 0x3, 0x87) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000006c0)={'vcan0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={@private2, 0x18, r3}) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x8906, 0x0) prctl$PR_MCE_KILL(0x48, 0x0, 0x0) r4 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000040)={'veth0_to_bond\x00', &(0x7f0000000400)=@ethtool_cmd={0x4d, 0x2, 0xffbf, 0xffff, 0x7, 0x6, 0x40, 0x80, 0x5, 0xb4, 0x5, 0x81, 0xa, 0x2c, 0x40, 0x8, [0x8, 0xc]}}) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) r6 = socket(0x10, 0x3, 0x0) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r8 = getpgrp(r7) kcmp(r8, r7, 0x3, r6, r6) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0xc) prctl$PR_SET_DUMPABLE(0x4, 0x3) r9 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r10 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x12, r10, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000940), 0xffffffffffffffff) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETPERSIST(r11, 0x400454c9, 0x1) io_submit(0x0, 0x1, &(0x7f0000000180)=[&(0x7f0000000040)={0x1802, 0x0, 0x0, 0x1, 0x3, r11, 0x0}]) write$selinux_load(r9, &(0x7f0000000000)=ANY=[], 0x2000) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x22, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r5, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r5, &(0x7f0000000840)=[{{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000800)="f6", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000003c0)="b1", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000e80)="9bcebf52109383c78e5185583471dae116ffabc5ee376baa64b11e063aff388fd22427586df0ee9444537c9e03fbc5abdffdc79e28d0711e9fb1e52684d2f265b50e23dd55fe6a13fbcf5744e0d980c073061b766e11835b9bf1863390de6729ca24e82d68aa2664361a976526035a67c28a0720b260dd30f149da1c14f13703c0dd5f3bd51c09e1c67b96a3dc841370e9c84dc0cc34c743d57f0a51ae577458d057e11e290ea51aa70e9595aec853f4e873f6523d9a28be1c2ef185f43827516b39d5b87c571d2f1ed3df3f2944574afd213dadfaa0ae2374156b1674acfb6a9cdf807c52ea2e9e421a361eed755de1a2561c0c1a9753036a1fad2291e5b19abd66557c7d3c193e3196f3ae58ce6d73299eb16eb9a51ec94b74311f248a24be58933f49f5dc165c54e208ab5a8f88a7d5570c7a531760cccb4e523ca3478d69b1fd3c2b1255b8157f00c69b2eb444dbf330ff930e958de1e0491dd12f0fab63bf8af70319be9a41156d7395093de724897a49d9ab89888fe3bfe24bbaa8490f60db3cf40b00183dfa8bc0eb2f37c56811845225cd4118ad11d2b1f8aee12616e7a877357ef3d5081b26271bc106fd23c2bc6dc613d73e7db720504b9cab13fd4678826be2498bb4bb3d2f643c306320ec175dd7e62d45054c635c5052820f45b5621e19d797809cf6a21045de3dd6c816445b99209c6f260f78f1d6cb00d52558590124751871cf91b3126cdd0ffd3957703420af06a25a28e559bfcde237c3124b45e08fb7f9f7738c64d7d131e5bcd30a3a4168c73e1811e558a7a31a3c8761243ccd8d07c1553def664f3188872c670d8b3c4ffbcfa89a46a26e566289e0a9b2831026925d1c3366a1524209f1c1636b4fe63b8568fef23474ad9541cdb948b0d2b7ca991dcde35f5ee6468053280c287964c47c1eb7eee0b245be219d7a763562a8233755137d681691d12ea29a1d031fe547024e70f9a25ab8f9282fc747abe9d5713a3c74974f85774ff612d5884d9834ccc0797dfd955a4355733324fe4b5332f3f00f0b81e30738d566f3f90e0222ea4e9eda561c00f3be9c5396a720f86385a7c6b61635a50e9f9e1ef4be994fac3fbe9ed68dfd823907a5046169722d29b078cd36c02d08258203242d35e54ff93f813edb6d0ddea3d984cd9c819c53878d2b966680334704461c01fbdedd7e305665e00b2c74ea11f735e2224492bd8a0879683a003f8df5fb3cc3d6b37f5b213cb5455ca8906585c5dc67c84a55a2b445c351e1bde1fadfce3d1de8a311552b26ce2a66e91b359c022ed4ea052649548cba7c929eb8b57be0f903fc91ab75c8703db118355c9a3a46a17d926124150739a3e24364de6c3763f6e04db9419184945ff9c91f347a9b401f980673b0c441a434e4fd7409bd80897b1bdb45a8517120740b9d21dd32dbb51afb7cdaa28538a1dd23a6f67c441bb4c59a7659648dbf765de6436e3686f0aa4ab21c3a361bbb8f884a5292cb2ce6763709254d80cf040fdebed382248a597704126ae2970469d0d602dad2101d", 0x44a}], 0x1, 0x0, 0x3}}, {{&(0x7f0000000140)={0x2, 0x4e22, @broadcast}, 0x10, &(0x7f0000000780)=[{&(0x7f0000002180)="e8f71c54aecd01a7e0163a91c0ec1e082694d75667b94655ad62722377b85c8e6f030018fa6b59307655bf22716422c938274540c6b7de4e7fd5b24fd1198abf9e74bb497be27022e12a8b09999fb94e85bbf28c8847480ace18a26638afbfe3ae8a29498f1fbe331629a0242910beba777736348bb547a64579e6ea45a0428902a217e2e32b9d741dc2499c4eb0ef0f9e25348d6a2f1902cf74c4d6efd1fb93c36997a3c12deb9b1800706f4f1d259ac8f16e115b2814a852eda43e3a2e471259d12f522764540a8e97494671a4da28573cab1dbe7b56fba1a28f9c43fff7dafb2554df43e40dd77039a53948b18a3c1d350e5dddab4dc9f6e0e01fc84e02005fba212a441c864c8b4c6e5df584180cc53d2f39e8dec90e7c84a23a18b4e4910ef097a42a8347b6adabd34d4c0dc08488d555824e18d9e6ae5b4594e6d584c18f463cc1fed121cd05b937b245ca696c1434d87a89dc45cbb952503d495b9e373f6176e10c20ce3435b94686edde7416ee3eb0bba0da4c3584cfd4c694d30939acd1efc8bace2c7b05ecee2b49f0bcb7f5697cc04990075d675c25f1a01b99d59eb03d6a50c1e465949d03c3d8add7f8bd95782da6957e1e57292c5e5f2128ac4dbd1015d18305022f979225de3be452ced5e3051d13f139941232db4b9b7681974e501efa41ec25943a9e5b7cc8ac579273f7bbf50871bd3a81979548a0b06fbd9595300b85c09c4b146250ba99ae5b5d35137ba35c0ec301fefca7b7bce689d6282d520cad6bcf5161de1413e6e55fa9bc458b7eaa053def8634a32e2b601e02e140a7c809752f67b8cdca156e7c6bdd3c9d59b24a438385f70139c275ec5263318886478b8325e2f3e410296764c4cb17b8de9a52757b97a7ddbd3e4a6ce319ee57aa27f90ac38b43f2462bb69d4161f211b680991dab50b83bbf45d3b05b2bb1b3f8a3bab2e887f365bf915a691e91903cc6b298ccb37d37043c7398918582e7df074d64c99548f84e556f1ddca02484f19ccb182a4a7b1581d7c521c4e7f5e5b8c630bb870efbdeae808b3aab14a7cbdcba4e1444bc9a58118e2c775b70c02a16b9e8e0a489bdabf0e6b26d3b78602ca6f1581f2e1289f0539d7e01ab082d8c883be0f7679d5a4b446e4b92e53ec68245ebce63a80d71e0fe21140bc1e084fd9c88708c81757794bf7d55b8677d54103f1d5315d36c0f47d89518176fdc25ff66e1763896ced0f355f6bedb82b190926b71641099ffa9842efdc40ef973b563bbe361e20923276af52acaffcef4b96f71a6c301dfb81ed0d8d81caf772d889eb31087a1662265876a818aaf40c48f042b3cd4e8866c3bd731af1a2f91a980077249e681cd016dc3bdf11ae7af7fc432a37fe1999a4d641cbfe22978578871134cab6af79430366941cbc782d9ba5072a601573818ef6a20cf4f9c241049c5e5362d7c3379d8599d1cea3b037019063857bd4e67fffbb2e9095008db1a8935714177755d215ea91c1532d9635479de1192a54ed130fcaf8d268f0ac1147c8c16a13f2cbb883d470f3b7ae9c06254547cb89190e249bcf70e2a071d05272413e9404aa313b21e817298922fc773cc11397b0a3e84fc97cccd9b0db3a46558dabde5771fcfdfeb61879941e3a96da230faee3a8d6620f9a95c0e23552a1dd0d6f91639af39304671eb9bed47991a556a25f8665aca25ec1a66c12df67601a3f5178a72c7580d686020e85a177ff45dc038e50c9c5cfc65a94b81fc3b86cac96d1bddca78ec5c26915763ea99c7b9b97a83c9cd4588a3e4e87129869f77dd056b036a49bc0a219fe3d0df60a90643a1d902ace8c648e6f70f5ed98f82cc89f200e540a52217fc47f4003f796ee47b3e0d270d0d909fa89d732bf4db549d4a495f96d8c260d6df2cda5d0eb1c9b5d6bc4768d1ef5370772296599d67f24531237e6b36a072346b0768e8f5dd75597e8850badb996ad2253b0fd5101793dacfa1599a745b01a52257e2113ce69f98e32bdb1fa9b4dac8dd51cb5fa8ad4ca58af2a0cc835fc60fdc978e69d963dcbca871e11617694f82a6408e4981b305b7754055d1076e9ef198f6e06f5d7f08782891366089ee826158b7ed8e1dac6910f3aac07c1c46efa58024d09e754bfb0a7b8438dfc1a1cc58a57bf66a2f809a11f441572e93516eacaa086c52f3b335df3c6c0996403e3142765d77147ffa903aafc3a84c4b926a934a53bacc4ff476324b4e25a365223ebc656164b3e368f1c66ced525ad3780524cfde06b5f7bb5e2d579bbc059830fb79c54a4daaacaad6d9ff9ba17e954e22cd49d1c0b243d96b625e385cd628850871301ef07238feb88fe3b4f9923151f78b30cf582507ea7be854aeb3eb3fc32c32a2d1e409a046a8b4146f427c5fd56f6205246006da926eaff9de6f585e134110ccd4a6b870f76904e0bb5b2260ba7c01a128b327dcb07b7984877ad0db45f39a8965c37b7c10246ed1024f1cd8a8be624cb93e86cf0156d6b323a4aeb6a9ad109f2980dec2ca7619db527d4e1971dbfc9f166792577719b5675f674f94ee1b9398c46f2d7fe92937833284930907973faad77d5f6e967a859770fc8e59e7ef67f9f39e3cc98b7b41fbb969036dde0e9be2f6b8c89e7c2faa7fe7711c271800a809b7502f3b96333b32c39f264e543a1c19a91a2d0b55b1197bd99d4e665b9709c4582f9941c6a5f5555e1d9c7b4a9c04b9251f2feba7e234cef0db079fc2f09f28a4fb4c005c88c632b3448baea0990c5f7c2ff2ba6afc7e705cd8146cb346e7859b7efe6eccd89fd27749a5f9d048ad1734bc9c96e550e78c317537bbca8da23db0fdc43f708b4b1bdd21ef2bddeb15f16c76ff621ca90899ac21f8d0b2709bb31818e7331ca6e1c953ef270e7db88aa72d9359419f871f8bbd6895b868f3813d2d60e8455d2e8ff6bc306ebe32e0b4897934ccad886252c8b9930e828c69eff698659b0cd8a76d2f57ec19d5488d6f8bc9921487c596f6c533982ba43936b417d960e848398d24ecd716056d96c4abb1750a43e3717570a83c5adf658097b17991bd9a289b9061dd2325e8e0d1efe15c7f257f8db8f8f0447a0183bfba0602651dd90298dc6d4f22204baf80a4e7c07d2f59f2085e89df62eeb8ddbbaa1a5f56ac26dc9c9044fb1912da6e628f808fb9454dc2d7da2f36d72e4d712a014279cb08a6f59a4e75339b86c3a788b356bd7196d505aeba58dff9cec961b258108de6d57517460ad1be77dc2980ce401576c0141ff27aa1cb9fbf38ac4e3b4f8d855e4ee60450aaa367dae6dfc850356a95a9f1553c99c1d7b216718c0cb4b1cd6a194df4b1ddd2f6345418d66bb641eeb6a8351e359d63af5b90d306a3c282582c990ba754defede72484382b19c8036d5ca7e6bb85f62eef4845427aaf489295d7020a38a2d0da8f9a22dd063e7fcc04288f7f02c31a22027d1dab17ed0d038e9d5fbbbee0b09f9f4a9ad7e6f61cd55e9f81de6777ec787ec37933c73c7804df078ce5f95883c9abca301140732f6c6330871da31324ea9bfd5b76041caf99844e8e9df8f887dd08494f5cbc8bbc706fc9eea38929c7d834324778e636a78527f616de2d66136808a923e5a78024c646f0a16c730814288421a50f0963315289b113f138ebf52419e1709dda51e84fca4b91beb7de9a1923099501e9b93ddd7a845a7b694ac240cf3903760b8e99fc6bfd7904d56ce86da90e07610a61d27dda2cec11c5251434578ae80fb15207b0d005a2c65e9f3651d692fb0d83a1a900174032b67b1168ef1e5b1b4c2e5ddd53db3d6a4ec51128f5f71b3353b53f051ebb7daed92fd04d80f4f7fbdf386c75d3fc3b2670f43b3a2ffbf2842d923a997826cc359062eb00cec74c34d98aa098c2cfe6682124206feac42f8fde17987c9a740c4c50b02cdc2af87e3faa04112badbf4c30d686d47816d14ff96798a82c2c96b1a78ecd06f09cda56370260e085139cfafba5feb35eb16e3794a1b16221cabbb1c30f264c0c63ea254f5be5325b3a4e1e15f01ea68ef8819cd647a08a761fec8ad601086cb5fd52eb75df8a64eea9b493e1bac644f050405c25a991210f92dad944da793619f44526d0af7dfe7339d9eb6edb397f31de304b15ace3764ad006c4f4130b69497cdf8500f79296f8426aa6659680073ed4107563ec17796aa3f5700ca56c92409c3b48989a0f195de0794ecf8222f61b333a0238661b5091f8ad9cf5abcee4192144803aaf376a3e06d4ceb2f1266919f0170c8ebf88c3332e99c1e090c3f4faff84f6fc961c976480b2f37b5f13da4edea8161957970124aa3b0f07ffb7476417517c27e06da58d8acc28900ef6b98f7f60438a0e3ee8f5542b19e0e4fe828cfa7bae48d524d0ce94fb42cf66224b36a86135ab537884cbdf88ccac0ef8a6739731d0f982d36cfad5d9db2e5f3ad044fa2f9a545c0631fa169fcb621f10e9bd08f96431cd29b5f756937c35c7d29d6e9e15fa25da12af40fceafddc97c73e934bcfb0d8f00edbc6152ba873bbe1a5726c866496eab0c06472d6b521ced14257fe0d23fb6f6aa165c6a17e84d212450ff9aa42a9a30be197281d555094b7473a62be2211e9b81311720e5063443b0545efc44f9dce50d06a454717852e028f58284b2258bd0d56271e6bf410b5b1fcfae20ab85aa1c511a62ffe51dc9b3f515b43d6a3f541c40ce510e551800c2af1676019e599ba1af71da456f1c8f2fa078846bba52d14aec7abb54a834b05156e7d412a0b7c607da16b429147a38f82fe762f2690efaf74a4328b2bb9a332e370bd54e73b48823aff9991877159fb562b6d1f4066acc53c9b4587118b7160d27f9b2b309e15f33f5b80a308567b6c13eef148c365561b0c6de99f1af0fdfb4e562724d895f8897a74eba29001a98c18a7a2d547fc44115faf6a1906b87fe803c1a2985a32cd9c907a4430afe648fe182c3945107af217a17f1b61137c309a03e9257abdc3df056002e3283702636ebd74721564d54720555922c4fbbcae0525316368adbf1e6026680a1c9e68a97d47f299363aa34259cb13021f6ecde40f914a9495561f0a00a2560592bddb0d4ee03412bbe04494c12448fdf27309e2ef6c03f7af534a54a5e7e1f635872b141f0a005df248269188f7e2222e360c96b759d1dd1e353fe876a0995e6d8a33a95a7a57881ec10f1ba627c88a65ca277050a4e59acd62da64dbae31ff6090f2707fe35f6a06c979733ac3fdf07bf5d7bcadb74a97527e6ec8ceafd84d625bb70fe691c1ed68f5d228dbf6754ac57dbe50e45c5d91c27f9c584a5349b609e478d790c1c0da9c0c9bfff74287c0d7acd5be2b9b76ca5f4f464514c6e26bf66ef013f7c89734e52b96b3ddd126181ec0aabe55143fe0f889fbcff7f0b9dbf98a1d7b8f577d3f709c992e79119c3eab9b134abbb247ec3388d4564e4b624b1f74bf529b46cbbd42b76808c213b3d813e3112f38442623d6fb8e02f5a18e9e450a0827f57eb42c42d1ac0751fc0ef0523997e0c60bf4f268aa92d866aa9e02207012a7c618b515b3c22a81ac8395ba33cf1a3fd44be1b792046ac9369d456cd157832a6a583d3c56728fef139349e739f3ec0785ee60a0941235e9e0dc3f3081b399574f9c2d79bdf36e0e3d72d253792bfef9e3575f26c4a44e5463cb9006d246d7a9b70fb97ce2391c6194d5a8d0c79565d9aa005cec0b3a128f2f42c33ac93e2841d21a8cbf9dc495515182a07186f75ceb524dffbc1d8b24203e52ccc8b8107a36c70cb70528f4ce1d1", 0x1000}, {&(0x7f00000001c0)="2d2b20a058f50fa1589a35a35bee355dcee91e41162e7fb9cfcae8afbf7cd66c35e9bb54966847c467b16866d68c506ec0f16568fecbcc64b98ac32be584ec45399f1b80d5d36d22cca01e01c3dc9f62b8ecad30538c8953b2d0bfcfc9389acbd60ee64123910bd4a7bc2cc2b24028928781ecc5920086e9da7e6993bed8f9b37efdb4a62867e5fdc8f90c725d705998f7e6507fb01963c62e8bab3ced1c30e5d769e5a50b111794bbefddbd4b", 0xad}, {&(0x7f0000000280)="fedbcd559644aef7df7d3cfe47c2c45f5d0f9c", 0x13}, {&(0x7f00000002c0)="caa86dfccade80fc6c50971ca15e5cd097a63a574ad5d532d434f2090fad5f92cb1ef3dfc8d63f129c012dd3df7438d243b68b1efb3f016a39d924676715e8324ae8974c54d1870695d74c74b999ad7402b961215a3417846a43d89b4501facd9b24adc42f39fb2ea395d325eafbd120db9517211da644e8eed15acb9c4ab941c9dbed5946c3aaf122acdedb77d4764da7652b96320592dca08a1b6a2059eb780a4d8b401624b37f5c4cc2210410f5904ddf001d3cb9e4ee7da9d0b894e04ad463c358935e98edd7c1de041e8034fd14a9a92ae3ba81911d5f5ebc90645de070698950d7b831a796fd", 0xe9}, {&(0x7f0000000500)="936107976372d0de98f88585491050ef7eca9a54602817252acf681b199275d542431708bc8f0f95fbbb18b59be0efd5dc19bc42daa0e85eb5e8e29926dc502c9f83a6226967fd29c0acad6d38d494edc27daaadc4b000cf03417cbb6ba7fd92e20285e4ca180b28126d1fe193a250a2d1533ab243c26c02494d2944b717d7bb206222a2999400f61945512635bb0449f3a01fb01c9d6eca63208b71b57953626e09ba85b11c6a3a3a18bd219f4fd8fe7bcfca86eeffff61398df4c83a6e743aab37886b31da1874efd6a089ec92357d769b783d54b49169", 0xd8}], 0x5, &(0x7f0000000a40)=ANY=[@ANYBLOB="30000000000000000000000007000000440c9bf1ac14144200000f7f890009e888261cffe50a010100ac1e0001ac1414aaac1414bbe00000017f0000010a0101000a01010200140000000000000000000000020000000f4740f26b286a04000000000023001100000000000000040000000000000011000000000000000000000001000000a000000000000000f1267595df69363f86fbd5f5f415a2afd0620c7b4e7759febc"], 0x78}}], 0x4, 0x100000c0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0xfffffffffffffd9f, 0x0, 0x0, 0x4f, 0x0, &(0x7f0000000000)="de547e22bade76f1a03b79e9546a58de45a57545563322ee20bc43f7fe47218a02ff8ba942478a7b69462fc2d196137252587ab17948adf2dcc5a03d2f3e276400"/79}) kernel console output (not intermixed with test programs): 727] total_active_file 0 [ 873.228762][T23727] total_unevictable 251543552 [ 873.233469][T23727] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz4,mems_allowed=0,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.7903,pid=23723,uid=0 [ 873.248447][T23727] Memory cgroup out of memory: Killed process 23723 (syz.4.7903) total-vm:90296kB, anon-rss:1296kB, file-rss:53836kB, shmem-rss:0kB, UID:0 pgtables:196kB oom_score_adj:0 [ 873.540465][T23948] /dev/loop6: Can't lookup blockdev [ 873.585770][T23931] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 873.594393][T23931] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 873.625686][T10449] usb 6-1: new full-speed USB device number 49 using dummy_hcd [ 874.205887][T23963] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 874.327784][ T36] audit: type=1400 audit(875.319:5095): avc: denied { transfer } for pid=23989 comm="syz.5.7986" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 874.695043][T10449] usb 6-1: device descriptor read/64, error -71 [ 874.697319][T18747] usb 2-1: USB disconnect, device number 127 [ 874.880149][T24037] rust_binder: 64: no such ref 0 [ 874.885204][T24037] rust_binder: 64: no such ref 1 [ 874.890351][T24037] futex_wake_op: syz.1.7992 tries to shift op by 32; fix this program [ 874.898875][T24037] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 874.906168][T24037] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 874.975010][T10449] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 875.035033][T10449] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 875.065811][T10449] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 875.083817][T10449] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 875.094005][T24048] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 875.101194][T10449] usb 6-1: SerialNumber: syz [ 875.109077][T24048] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 875.119021][T10449] usb 6-1: 0:2 : does not exist [ 875.163202][T24058] SELinux: failed to load policy [ 875.406156][ T36] audit: type=1400 audit(876.399:5096): avc: denied { mounton } for pid=24092 comm="syz.1.8009" path="/29/file0" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 875.471796][ T36] audit: type=1400 audit(876.459:5097): avc: denied { setattr } for pid=24092 comm="syz.1.8009" name="fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 875.528822][T23994] netlink: 324 bytes leftover after parsing attributes in process `syz.5.7988'. [ 875.595751][T24096] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 875.603154][T24096] rust_binder: Write failure EINVAL in pid:99 [ 875.617493][T24101] rust_binder: Write failure EFAULT in pid:103 [ 875.868579][T24112] rust_binder: validate_parent_fixup: fixup_min_offset=43, parent_offset=35 [ 875.874822][T24112] rust_binder: Error while translating object. [ 875.883675][T24112] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 875.889884][T24112] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:109 [ 876.999109][T24146] Invalid ELF header len 1 [ 877.047837][T24157] tipc: Enabling of bearer rejected, failed to enable media [ 877.066311][T24159] netlink: 12 bytes leftover after parsing attributes in process `syz.6.8032'. [ 877.221038][T24178] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8039'. [ 877.373589][ T31] usb 6-1: USB disconnect, device number 49 [ 877.388710][T24180] IPv6: NLM_F_CREATE should be specified when creating new route [ 877.777754][T24195] netlink: 188 bytes leftover after parsing attributes in process `syz.6.8047'. [ 878.005658][T24203] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 878.005695][T24203] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:289 [ 878.054179][T24205] bridge0: port 1(bridge_slave_0) entered blocking state [ 878.070656][T24205] bridge0: port 1(bridge_slave_0) entered disabled state [ 878.078367][T24205] bridge_slave_0: entered allmulticast mode [ 878.084897][T24205] bridge_slave_0: entered promiscuous mode [ 878.091730][T24205] bridge0: port 2(bridge_slave_1) entered blocking state [ 878.099068][T24205] bridge0: port 2(bridge_slave_1) entered disabled state [ 878.106332][T24205] bridge_slave_1: entered allmulticast mode [ 878.112784][T24205] bridge_slave_1: entered promiscuous mode [ 878.187652][T24205] bridge0: port 2(bridge_slave_1) entered blocking state [ 878.194747][T24205] bridge0: port 2(bridge_slave_1) entered forwarding state [ 878.202068][T24205] bridge0: port 1(bridge_slave_0) entered blocking state [ 878.209126][T24205] bridge0: port 1(bridge_slave_0) entered forwarding state [ 878.237338][T22962] bridge0: port 1(bridge_slave_0) entered disabled state [ 878.244694][T22962] bridge0: port 2(bridge_slave_1) entered disabled state [ 878.256462][T22961] bridge0: port 1(bridge_slave_0) entered blocking state [ 878.263616][T22961] bridge0: port 1(bridge_slave_0) entered forwarding state [ 878.273211][T22962] bridge0: port 2(bridge_slave_1) entered blocking state [ 878.280287][T22962] bridge0: port 2(bridge_slave_1) entered forwarding state [ 878.319557][T24205] veth0_vlan: entered promiscuous mode [ 878.331458][T24205] veth1_macvtap: entered promiscuous mode [ 878.389506][ T36] audit: type=1400 audit(879.379:5098): avc: denied { map } for pid=24219 comm="syz.4.8054" path="socket:[103885]" dev="sockfs" ino=103885 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 878.418527][T24222] rust_binder: Write failure EFAULT in pid:8 [ 878.438624][ T36] audit: type=1400 audit(879.429:5099): avc: denied { connect } for pid=24226 comm="syz.4.8056" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 878.555069][ T36] audit: type=1400 audit(879.539:5100): avc: denied { getattr } for pid=24232 comm="syz.4.8059" name="/" dev="nsfs" ino=4026533278 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 878.578225][T24231] veth1: entered allmulticast mode [ 878.590986][T24230] veth1: left allmulticast mode [ 878.633770][T24241] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 878.633792][T24241] rust_binder: Read failure Err(EFAULT) in pid:296 [ 878.668830][T24248] rust_binder: Failed to allocate buffer. len:4096, is_oneway:true [ 878.674017][T24250] netlink: 24 bytes leftover after parsing attributes in process `syz.5.8064'. [ 878.675480][T24248] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 878.685808][T24250] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 878.693585][T24248] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:20 [ 878.702029][T24250] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:299 [ 878.752934][T24255] tipc: Started in network mode [ 878.767325][T24255] tipc: Node identity 4, cluster identity 4711 [ 878.773720][T24255] tipc: Node number set to 4 [ 878.902663][T24259] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 878.926107][T24261] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 878.933475][T24261] rust_binder: BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 879.027160][T24263] binder: Bad value for 'stats' [ 879.051119][T24265] rust_binder: inc_ref_done called when no active inc_refs [ 879.383314][T24294] input: syz0 as /devices/virtual/input/input46 [ 879.436635][T24298] SELinux: security_context_str_to_sid (Eá…) failed with errno=-22 [ 879.466194][T24296] tipc: Cannot configure node identity twice [ 879.570529][T24303] rust_binder: Error while translating object. [ 879.570585][T24303] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 879.577843][T24303] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:30 [ 879.664522][T24310] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 879.682714][T24310] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 879.688447][T24313] binder: Bad value for 'stats' [ 879.695593][T24314] binder: Bad value for 'stats' [ 879.697059][T24315] overlay: filesystem on ./bus is read-only [ 879.705004][T24310] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 879.716953][T24310] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 879.721563][T24316] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 879.735820][T24316] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 879.747185][T24310] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 879.756468][T24316] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 879.765435][T24310] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 879.772112][T24316] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 879.996254][T24340] 9pnet_fd: Insufficient options for proto=fd [ 880.002832][T24340] netlink: 'syz.6.8099': attribute type 11 has an invalid length. [ 880.032234][T24344] overlayfs: failed to clone lowerpath [ 880.048726][T24346] /dev/rnullb0: Can't lookup blockdev [ 880.281689][T24367] /dev/loop0: Can't lookup blockdev [ 880.401039][ T36] audit: type=1326 audit(881.389:5101): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24382 comm="syz.6.8113" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fb820f8eec9 code=0x0 [ 880.437872][T24387] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 880.498282][T24393] rust_binder: Error in use_page_slow: ESRCH [ 880.505046][T24393] rust_binder: use_range failure ESRCH [ 880.511171][T24393] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 880.516978][T24393] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 880.525125][T24393] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:310 [ 880.637770][T24395] rust_binder: Error in use_page_slow: ESRCH [ 880.646858][T24395] rust_binder: use_range failure ESRCH [ 880.652919][T24395] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 880.658434][T24395] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 880.666473][T24395] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:312 [ 880.676240][T24396] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 880.759097][T24405] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 880.759137][T24405] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:321 [ 880.782417][T24409] cgroup: subsys name conflicts with all [ 880.798120][T24408] cgroup: subsys name conflicts with all [ 881.055020][ T414] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 881.205000][ T414] usb 6-1: Using ep0 maxpacket: 8 [ 881.211307][ T414] usb 6-1: config 0 has an invalid interface number: 49 but max is 0 [ 881.212595][T24439] netlink: 12 bytes leftover after parsing attributes in process `syz.6.8132'. [ 881.220328][T24433] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8130'. [ 881.230326][T24439] /dev/rnullb0: Can't lookup blockdev [ 881.237383][ T414] usb 6-1: config 0 has no interface number 0 [ 881.248860][ T414] usb 6-1: too many endpoints for config 0 interface 49 altsetting 56: 52, using maximum allowed: 30 [ 881.264981][ T414] usb 6-1: config 0 interface 49 altsetting 56 has 0 endpoint descriptors, different from the interface descriptor's value: 52 [ 881.283588][ T414] usb 6-1: config 0 interface 49 has no altsetting 0 [ 881.290476][ T414] usb 6-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 881.299700][ T414] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 881.308367][ T414] usb 6-1: config 0 descriptor?? [ 881.520797][ T414] usb 6-1: string descriptor 0 read error: -71 [ 881.529598][ T414] asix 6-1:0.49 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 881.539792][ T414] asix 6-1:0.49: probe with driver asix failed with error -71 [ 881.553236][ T414] usb 6-1: USB disconnect, device number 50 [ 881.560950][T24456] netlink: 36 bytes leftover after parsing attributes in process `syz.5.8137'. [ 881.570417][T24456] rust_binder: inc_ref_done called when no active inc_refs [ 881.590675][T24460] __vm_enough_memory: pid: 24460, comm: syz.5.8139, bytes: 18014402804453376 not enough memory for the allocation [ 881.610979][T24462] __vm_enough_memory: pid: 24462, comm: syz.5.8139, bytes: 18014402804453376 not enough memory for the allocation [ 881.633603][T24465] binder: Unknown parameter 'contextÌðÔð[7’' [ 881.667941][T24467] serio: Serial port ptm2 [ 882.095945][T24487] overlayfs: maximum fs stacking depth exceeded [ 882.356073][ T31] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 882.446568][T24497] tipc: Enabled bearer , priority 10 [ 882.507565][ T31] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 882.521401][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 882.530919][ T31] usb 2-1: Product: syz [ 882.536138][T24511] rust_binder: BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 882.545358][ T31] usb 2-1: Manufacturer: syz [ 882.550196][ T31] usb 2-1: SerialNumber: syz [ 882.606693][T24523] tipc: Cannot configure node identity twice [ 883.024072][T24545] rust_binder: Write failure EFAULT in pid:73 [ 883.038068][T24547] rust_binder: Failed to allocate buffer. len:4096, is_oneway:true [ 883.044204][T24547] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 883.052139][T24547] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:75 [ 883.106100][T24549] rust_binder: 77: no such ref 2 [ 883.117735][ T63] usb 2-1: USB disconnect, device number 2 [ 883.120768][T24549] rust_binder: 77: no such ref 0 [ 883.275712][ T36] audit: type=1400 audit(884.269:5102): avc: denied { setattr } for pid=24575 comm="syz.1.8178" name="zero" dev="devtmpfs" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:zero_device_t tclass=chr_file permissive=1 [ 883.312342][T24579] rust_binder: Write failure EINVAL in pid:190 [ 883.312353][T24578] rust_binder: Write failure EINVAL in pid:190 [ 883.365945][T24578] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:190 [ 883.818940][T22962] bridge_slave_1: left allmulticast mode [ 883.833985][T22962] bridge_slave_1: left promiscuous mode [ 883.839719][T22962] bridge0: port 2(bridge_slave_1) entered disabled state [ 883.847332][T22962] bridge_slave_0: left allmulticast mode [ 883.852994][T22962] bridge_slave_0: left promiscuous mode [ 883.858761][T22962] bridge0: port 1(bridge_slave_0) entered disabled state [ 883.978186][T24610] bridge0: port 1(bridge_slave_0) entered blocking state [ 883.985491][T24610] bridge0: port 1(bridge_slave_0) entered disabled state [ 883.992596][T24610] bridge_slave_0: entered allmulticast mode [ 883.998956][T24610] bridge_slave_0: entered promiscuous mode [ 884.005604][T24610] bridge0: port 2(bridge_slave_1) entered blocking state [ 884.012667][T24610] bridge0: port 2(bridge_slave_1) entered disabled state [ 884.019770][T24610] bridge_slave_1: entered allmulticast mode [ 884.026218][T24610] bridge_slave_1: entered promiscuous mode [ 884.033018][T22962] veth1_macvtap: left promiscuous mode [ 884.038643][T22962] veth0_vlan: left promiscuous mode [ 884.094023][T24612] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 884.094058][T24612] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:373 [ 884.139333][T24610] bridge0: port 2(bridge_slave_1) entered blocking state [ 884.155541][T24610] bridge0: port 2(bridge_slave_1) entered forwarding state [ 884.162795][T24610] bridge0: port 1(bridge_slave_0) entered blocking state [ 884.169842][T24610] bridge0: port 1(bridge_slave_0) entered forwarding state [ 884.190984][ T331] bridge0: port 1(bridge_slave_0) entered disabled state [ 884.198441][ T331] bridge0: port 2(bridge_slave_1) entered disabled state [ 884.207999][T22961] bridge0: port 1(bridge_slave_0) entered blocking state [ 884.215071][T22961] bridge0: port 1(bridge_slave_0) entered forwarding state [ 884.224084][ T331] bridge0: port 2(bridge_slave_1) entered blocking state [ 884.231140][ T331] bridge0: port 2(bridge_slave_1) entered forwarding state [ 884.264590][T24610] veth0_vlan: entered promiscuous mode [ 884.279510][T24610] veth1_macvtap: entered promiscuous mode [ 884.324575][T22962] Bluetooth: hci1: Frame reassembly failed (-84) [ 884.624468][T24633] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 884.646549][T24640] rust_binder: 382: no such ref 0 [ 884.659774][T24640] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 884.666901][T24640] rust_binder: 382: no such ref 2 [ 884.671958][T24640] rust_binder: Failed to allocate buffer. len:1128, is_oneway:false [ 884.684251][T24642] veth0_to_team: mtu less than device minimum [ 885.848372][T24671] /dev/rnullb0: Can't lookup blockdev [ 885.887566][T24675] netlink: 4 bytes leftover after parsing attributes in process `syz.6.8211'. [ 885.897167][T24675] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=24675 comm=syz.6.8211 [ 886.147893][T24691] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem [ 886.155986][ T36] audit: type=1400 audit(887.149:5103): avc: denied { write } for pid=24690 comm="syz.4.8218" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 886.193450][T24693] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 886.193489][T24693] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:85 [ 886.218788][T24695] exFAT-fs (rnullb0): invalid boot record signature [ 886.234684][T24695] exFAT-fs (rnullb0): failed to read boot sector [ 886.241390][T24695] exFAT-fs (rnullb0): failed to recognize exfat type [ 886.262414][T24697] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 224, size: 226) [ 886.262442][T24697] rust_binder: Error while translating object. [ 886.273247][T24697] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 886.279862][T24697] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:89 [ 886.355018][ T773] Bluetooth: hci1: command 0x1003 tx timeout [ 886.355122][ T774] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 886.385136][T24704] binder: Unknown parameter 'pcr' [ 886.405526][ T36] audit: type=1326 audit(887.399:5104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24705 comm="syz.4.8224" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5028d8eec9 code=0x0 [ 886.481297][T24708] rust_binder: Error in use_page_slow: ESRCH [ 886.481322][T24708] rust_binder: use_range failure ESRCH [ 886.508121][T24708] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 886.508157][T24708] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 886.528317][T24708] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:98 [ 887.060713][T24725] rust_binder: Error in use_page_slow: ESRCH [ 887.060745][T24725] rust_binder: use_range failure ESRCH [ 887.067112][T24725] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 887.072649][T24725] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 887.081022][T24725] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:4 [ 887.255709][T24740] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 887.295016][T24740] rust_binder: Write failure EINVAL in pid:16 [ 887.328130][ T331] Bluetooth: hci1: Frame reassembly failed (-84) [ 887.359325][T24747] sit0: entered promiscuous mode [ 887.376362][T24747] netlink: 'syz.4.8237': attribute type 1 has an invalid length. [ 887.394988][T24747] netlink: 9 bytes leftover after parsing attributes in process `syz.4.8237'. [ 887.426532][T24747] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=35 sclass=netlink_route_socket pid=24747 comm=syz.4.8237 [ 887.455321][T24747] binder: Bad value for 'stats' [ 887.497215][ T331] tipc: Subscription rejected, illegal request [ 887.680834][T24761] binder: Unknown parameter 'fscontext?}' [ 887.791722][T24772] netlink: 'syz.4.8247': attribute type 4 has an invalid length. [ 887.910057][T24776] __vm_enough_memory: pid: 24776, comm: syz.4.8248, bytes: 18014402804453376 not enough memory for the allocation [ 888.068545][T24780] rust_binder: Error while translating object. [ 888.068597][T24780] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 888.074967][T24780] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:126 [ 888.865699][T24794] netlink: 'syz.4.8254': attribute type 19 has an invalid length. [ 888.882984][T24794] netlink: 5 bytes leftover after parsing attributes in process `syz.4.8254'. [ 888.942214][T24796] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem [ 888.966418][T24798] rust_binder: validate_parent_fixup: new_min_offset=18, sg_entry.length=0 [ 888.966448][T24798] rust_binder: Error while translating object. [ 888.975321][T24798] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 888.981538][T24798] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:133 [ 889.039217][T24802] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 889.208837][T24809] rust_binder: Error in use_page_slow: ESRCH [ 889.208867][T24809] rust_binder: use_range failure ESRCH [ 889.215962][T24809] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 889.221548][T24809] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 889.230072][T24809] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:139 [ 889.394418][T24820] /dev/rnullb0: Can't lookup blockdev [ 889.405216][ T773] Bluetooth: hci1: command 0x1003 tx timeout [ 889.409045][ T774] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 889.704975][T18747] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 889.864979][T18747] usb 8-1: Using ep0 maxpacket: 8 [ 889.871552][T18747] usb 8-1: unable to get BOS descriptor or descriptor too short [ 889.880775][T18747] usb 8-1: config 6 has an invalid interface number: 232 but max is 0 [ 889.889208][T18747] usb 8-1: config 6 has no interface number 0 [ 889.895531][T18747] usb 8-1: config 6 interface 232 has no altsetting 0 [ 889.904711][T18747] usb 8-1: string descriptor 0 read error: -22 [ 889.911191][T18747] usb 8-1: New USB device found, idVendor=452e, idProduct=a3be, bcdDevice=d4.8d [ 889.920492][T18747] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 889.934458][T18747] usb-storage 8-1:6.232: USB Mass Storage device detected [ 890.264335][T24844] rust_binder: Failed to allocate buffer. len:136, is_oneway:false [ 890.264467][T24844] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 891.165666][T24862] netlink: 'syz.6.8279': attribute type 12 has an invalid length. [ 892.296810][T24869] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 224, size: 226) [ 892.296838][T24869] rust_binder: Error while translating object. [ 892.308561][T24869] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 892.314851][T24869] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:144 [ 892.430340][T24883] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 892.515419][ T63] usb 8-1: USB disconnect, device number 2 [ 892.607813][T24895] binder: Bad value for 'stats' [ 892.627168][T24897] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 892.627199][T24897] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 892.635392][T24897] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:164 [ 892.662604][T24899] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION freeze notification not active [ 892.680676][T24899] rust_binder: Write failure EINVAL in pid:166 [ 892.707947][T24901] veth1: entered allmulticast mode [ 892.834958][ T63] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 892.874243][T24904] veth1: left allmulticast mode [ 893.027172][ T63] usb 8-1: Using ep0 maxpacket: 8 [ 893.106674][ T63] usb 8-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 893.147734][ T63] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 893.188681][ T63] usb 8-1: config 0 descriptor?? [ 893.409898][ T63] asix 8-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 893.478974][T24906] bridge0: port 1(bridge_slave_0) entered blocking state [ 893.494924][T24906] bridge0: port 1(bridge_slave_0) entered disabled state [ 893.511031][T24906] bridge_slave_0: entered allmulticast mode [ 893.525585][T24906] bridge_slave_0: entered promiscuous mode [ 893.535563][T24906] bridge0: port 2(bridge_slave_1) entered blocking state [ 893.552808][T24906] bridge0: port 2(bridge_slave_1) entered disabled state [ 893.573055][T24906] bridge_slave_1: entered allmulticast mode [ 893.583573][T24906] bridge_slave_1: entered promiscuous mode [ 893.666065][T24911] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 893.666107][T24911] rust_binder: Read failure Err(EFAULT) in pid:173 [ 893.717549][T24906] bridge0: port 2(bridge_slave_1) entered blocking state [ 893.731161][T24906] bridge0: port 2(bridge_slave_1) entered forwarding state [ 893.738601][T24906] bridge0: port 1(bridge_slave_0) entered blocking state [ 893.745678][T24906] bridge0: port 1(bridge_slave_0) entered forwarding state [ 893.815206][T22962] bridge0: port 1(bridge_slave_0) entered disabled state [ 893.824807][T22962] bridge0: port 2(bridge_slave_1) entered disabled state [ 893.847570][T22961] bridge0: port 1(bridge_slave_0) entered blocking state [ 893.854707][T22961] bridge0: port 1(bridge_slave_0) entered forwarding state [ 893.877488][T22961] bridge0: port 2(bridge_slave_1) entered blocking state [ 893.884586][T22961] bridge0: port 2(bridge_slave_1) entered forwarding state [ 893.971956][T24906] veth0_vlan: entered promiscuous mode [ 893.986791][T24906] veth1_macvtap: entered promiscuous mode [ 894.160316][ T36] audit: type=1400 audit(895.149:5105): avc: denied { map } for pid=24924 comm="syz.4.8297" path="socket:[108777]" dev="sockfs" ino=108777 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 894.334434][T24941] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 894.344434][T24941] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 894.430945][T24946] fuse: Bad value for 'fd' [ 894.549888][T24949] netlink: 104 bytes leftover after parsing attributes in process `syz.4.8304'. [ 894.559535][T24949] netlink: 'syz.4.8304': attribute type 27 has an invalid length. [ 894.570611][T24949] sit0: left promiscuous mode [ 894.611915][ T63] asix 8-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 894.624993][ T45] usb 6-1: new full-speed USB device number 51 using dummy_hcd [ 894.628482][ T63] asix 8-1:0.0 (unnamed net_device) (uninitialized): Failed to write RX_CTL mode to 0x0088: ffffffb9 [ 894.644168][ T63] asix 8-1:0.0: probe with driver asix failed with error -71 [ 894.654763][ T63] usb 8-1: USB disconnect, device number 3 [ 894.655108][T24949] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 894.768850][T24952] netlink: 32 bytes leftover after parsing attributes in process `syz.4.8305'. [ 894.786244][ T45] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 894.798352][T24952] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 344, limit: 1168, size: 18446744073709551614) [ 894.798445][T24952] rust_binder: Error while translating object. [ 894.811015][T24952] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 894.811967][ T45] usb 6-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 894.817751][T24952] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:188 [ 894.826829][ T45] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 894.855243][ T45] usb 6-1: Product: syz [ 894.859453][ T45] usb 6-1: Manufacturer: syz [ 894.864073][ T45] usb 6-1: SerialNumber: syz [ 894.871066][ T45] usb 6-1: config 0 descriptor?? [ 895.126287][T22961] tipc: Disabling bearer [ 895.145096][T24958] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 895.154637][T24958] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 895.168570][T24944] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8302'. [ 895.179654][ T45] usb 6-1: bad CDC descriptors [ 895.187132][ T45] usb 6-1: unsupported MDLM descriptors [ 895.195146][ T45] usb 6-1: USB disconnect, device number 51 [ 895.210467][T22961] tipc: Left network mode [ 895.217010][T22961] veth1_macvtap: left promiscuous mode [ 895.222514][T22961] veth0_vlan: left promiscuous mode [ 895.444982][ T63] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 895.575744][T24965] EXT4-fs: dax option not supported [ 895.604993][ T63] usb 8-1: Using ep0 maxpacket: 16 [ 895.611699][ T63] usb 8-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 895.620784][ T63] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 895.629355][ T63] usb 8-1: config 0 descriptor?? [ 895.636948][ T63] ftdi_sio 8-1:0.0: FTDI USB Serial Device converter detected [ 895.662203][T24968] overlayfs: missing 'lowerdir' [ 895.835893][ T63] usb 8-1: Detected FT232A [ 895.841421][ T63] usb 8-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 895.851010][ T63] usb 8-1: USB disconnect, device number 4 [ 895.857445][ T63] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 895.867462][ T63] ftdi_sio 8-1:0.0: device disconnected [ 895.945017][ T414] usb 6-1: new full-speed USB device number 52 using dummy_hcd [ 896.096013][ T414] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 896.105759][ T414] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xB has an invalid bInterval 0, changing to 4 [ 896.118131][ T414] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 896.127223][ T414] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 896.135241][ T414] usb 6-1: Product: syz [ 896.139428][ T414] usb 6-1: Manufacturer: syz [ 896.144026][ T414] usb 6-1: SerialNumber: syz [ 896.149239][ T414] usb 6-1: config 0 descriptor?? [ 896.360170][T24973] rust_binder: Write failure EFAULT in pid:407 [ 896.398476][ T414] usb 6-1: USB disconnect, device number 52 [ 897.136345][T24984] rust_binder: Error while translating object. [ 897.136400][T24984] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 897.142588][T24984] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:6 [ 897.144960][ T414] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 897.159223][T24984] 9pnet_fd: Insufficient options for proto=fd [ 897.188126][T24986] netlink: 100 bytes leftover after parsing attributes in process `syz.6.8318'. [ 897.242253][T24991] rust_binder: validate_parent_fixup: new_min_offset=21, sg_entry.length=0 [ 897.242273][T24991] rust_binder: Error while translating object. [ 897.251017][T24991] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 897.257232][T24991] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:37 [ 897.307156][T24996] rust_binder: Error while translating object. [ 897.310353][ T414] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 897.316364][T24996] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 897.332826][T24996] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:16 [ 897.335855][ T414] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 897.365563][ T414] usb 6-1: New USB device found, idVendor=044f, idProduct=b300, bcdDevice= 0.00 [ 897.374154][T25000] rust_binder: Failed copying remainder into alloc: EFAULT [ 897.374854][T25000] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 897.376572][ T414] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 897.383070][T25000] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 897.395585][ T414] usb 6-1: config 0 descriptor?? [ 897.399180][T25000] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:18 [ 897.415277][T25001] __vm_enough_memory: pid: 25001, comm: syz.7.8323, bytes: 18014402804453376 not enough memory for the allocation [ 897.704961][ T63] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 897.855987][ T63] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 897.868930][ T63] usb 8-1: New USB device found, idVendor=0458, idProduct=5014, bcdDevice= 0.00 [ 897.878009][ T63] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 897.886687][ T63] usb 8-1: config 0 descriptor?? [ 897.980455][T25009] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 897.980487][T25009] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 897.998600][T25012] __vm_enough_memory: pid: 25012, comm: syz.6.8327, bytes: 18014402804453376 not enough memory for the allocation [ 898.048788][ T414] usbhid 6-1:0.0: can't add hid device: -71 [ 898.054858][ T414] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 898.064832][ T414] usb 6-1: USB disconnect, device number 53 [ 898.083951][T25015] SELinux: security_context_str_to_sid () failed with errno=-22 [ 898.118887][T25020] netlink: 'syz.6.8330': attribute type 1 has an invalid length. [ 898.138872][T25025] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 898.138901][T25025] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 898.145388][T25025] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 898.151841][T25025] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 898.158505][T25025] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 898.165013][T25025] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 898.171454][T25025] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 898.177897][T25025] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 898.184327][T25025] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 898.576660][T25039] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 898.583456][T25038] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 898.590201][T25039] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 898.590201][T25038] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 898.639835][T25038] rust_binder: Error in use_page_slow: ESRCH [ 898.639858][T25038] rust_binder: use_range failure ESRCH [ 898.645894][T25038] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 898.651380][T25038] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 898.659401][T25038] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:412 [ 898.923248][T25046] rust_binder: Write failure EFAULT in pid:207 [ 898.923779][T25055] rust_binder: Write failure EFAULT in pid:207 [ 899.686342][T25068] __vm_enough_memory: pid: 25068, comm: syz.4.8344, bytes: 18014402804453376 not enough memory for the allocation [ 899.760790][T25074] fuse: Unknown parameter 'gro}p_id' [ 899.768027][T25074] fuse: Bad value for 'fd' [ 899.785558][T25076] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 900.471218][ T63] usbhid 8-1:0.0: can't add hid device: -71 [ 900.483841][ T63] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 900.495547][ T63] usb 8-1: USB disconnect, device number 5 [ 900.507808][T25081] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 900.507844][T25081] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:48 [ 900.533746][ T331] Bluetooth: hci0: Frame reassembly failed (-84) [ 900.564391][T25090] rust_binder: validate_parent_fixup: new_min_offset=18, sg_entry.length=0 [ 900.564418][T25090] rust_binder: Error while translating object. [ 900.573298][T25090] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 900.579590][T25090] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:55 [ 900.645310][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.654450][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.660746][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.666990][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.673295][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.680644][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.686935][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.693163][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.699802][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.706048][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.712370][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.718582][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.724798][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.731052][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.737254][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.743425][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.749622][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.755831][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.762017][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.768217][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.774396][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.780601][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.786826][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.793021][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.799389][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.805637][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.811889][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.818119][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.824353][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.830661][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.836898][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.843068][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.849323][T25097] rust_binder: Write failure EFAULT in pid:221 [ 900.992722][T25106] binder: Unknown parameter 'ÿ' [ 901.344932][T18747] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 901.474947][T18747] usb 8-1: device descriptor read/64, error -71 [ 901.714974][T18747] usb 8-1: device descriptor read/64, error -71 [ 901.955045][T18747] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 902.084976][T18747] usb 8-1: device descriptor read/64, error -71 [ 902.136710][T25119] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 902.144080][T25119] rust_binder: Write failure EINVAL in pid:54 [ 902.324951][T18747] usb 8-1: device descriptor read/64, error -71 [ 902.445409][T18747] usb usb8-port1: attempt power cycle [ 902.447954][T25132] SELinux: security_context_str_to_sid (nWý) failed with errno=-22 [ 902.595455][ T773] Bluetooth: hci0: command 0x1003 tx timeout [ 902.595649][ T774] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 902.694666][T25140] rust_binder: Failed to allocate buffer. len:4096, is_oneway:true [ 902.694692][T25140] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 902.702702][T25140] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:442 [ 902.743242][T25146] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 902.752599][T25146] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:448 [ 902.785015][T18747] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 902.815985][T18747] usb 8-1: device descriptor read/8, error -71 [ 902.946116][T18747] usb 8-1: device descriptor read/8, error -71 [ 903.184927][T18747] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 903.205948][T18747] usb 8-1: device descriptor read/8, error -71 [ 903.325916][T25148] binder: Unknown parameter '/dev/kvm' [ 903.335935][T18747] usb 8-1: device descriptor read/8, error -71 [ 903.368829][T25158] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 903.368873][T25158] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:460 [ 903.405973][T25160] kvm: vcpu 0: requested 128 ns lapic timer period limited to 200000 ns [ 903.423569][T25160] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 903.445012][T18747] usb usb8-port1: unable to enumerate USB device [ 903.674282][T25169] rust_binder: Write failure EFAULT in pid:227 [ 903.777497][T25169] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8378'. [ 904.324157][T25172] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 904.324183][T25172] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 904.332398][T25172] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:466 [ 904.400614][T25181] rust_binder: Write failure EFAULT in pid:469 [ 904.447291][T25189] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 904.462089][T25189] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 904.578485][T25201] rust_binder: 230: no such ref 3 [ 904.583639][T25201] rust_binder: 230: no such ref 3 [ 904.589338][T25201] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:230 [ 904.612205][T25206] binder: Unknown parameter '' [ 904.640383][T25208] batadv_slave_0: mtu less than device minimum [ 904.758021][T25234] __vm_enough_memory: pid: 25234, comm: syz.7.8397, bytes: 18014402804453376 not enough memory for the allocation [ 904.882551][T25243] rust_binder: 93: no such ref 0 [ 905.057884][T25252] bridge0: port 3(veth0_to_team) entered blocking state [ 905.064909][T25252] bridge0: port 3(veth0_to_team) entered disabled state [ 905.071949][T25252] veth0_to_team: entered allmulticast mode [ 905.078298][T25252] veth0_to_team: entered promiscuous mode [ 905.163710][T25265] rust_binder: Write failure EINVAL in pid:100 [ 905.185767][T25269] rust_binder: Write failure EFAULT in pid:500 [ 905.202375][T25271] 9pnet_fd: Insufficient options for proto=fd [ 905.209335][T25273] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 224, size: 226) [ 905.214758][T25273] rust_binder: Error while translating object. [ 905.225369][T25273] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 905.230410][T25275] netlink: 20 bytes leftover after parsing attributes in process `syz.6.8413'. [ 905.231563][T25273] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:502 [ 905.243267][T25275] netlink: 'syz.6.8413': attribute type 46 has an invalid length. [ 905.267502][T25275] rust_binder: Failed to allocate buffer. len:4240, is_oneway:false [ 905.268119][T25275] netlink: 20 bytes leftover after parsing attributes in process `syz.6.8413'. [ 905.432184][T25284] rust_binder: BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 905.440887][T25284] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 905.461306][T25287] rust_binder: Error while translating object. [ 905.461330][T25287] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 905.467583][T25287] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:509 [ 905.483768][T25289] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 905.493907][T25289] rust_binder: Failed to allocate buffer. len:1160, is_oneway:false [ 905.503729][ T36] audit: type=1400 audit(906.489:5106): avc: denied { write } for pid=25290 comm="syz.5.8419" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 905.532216][T25293] rust_binder: Write failure EFAULT in pid:102 [ 905.545932][T25297] random: crng reseeded on system resumption [ 905.579446][T25303] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 905.579516][T25303] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 905.625507][T25315] usb usb9: usbfs: process 25315 (syz.7.8427) did not claim interface 0 before use [ 905.709951][T25320] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 905.723301][T25320] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 905.742803][T25323] rust_binder: validate_parent_fixup: fixup_min_offset=46, parent_offset=39 [ 905.742822][T25323] rust_binder: Error while translating object. [ 905.751636][T25323] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 905.757872][T25323] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:120 [ 905.778436][T25327] rust_binder: Write failure EINVAL in pid:123 [ 905.806223][T25330] input: syz0 as /devices/virtual/input/input48 [ 905.953182][T25337] input: syz0 as /devices/virtual/input/input49 [ 905.968940][T25336] rust_binder: Error while translating object. [ 905.968974][T25336] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 905.975357][T25336] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:113 [ 906.037206][T25340] netlink: 12 bytes leftover after parsing attributes in process `syz.6.8434'. [ 906.916271][T25345] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 906.916300][T25345] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:119 [ 906.926176][T25345] netlink: 140 bytes leftover after parsing attributes in process `syz.6.8436'. [ 907.033673][T25351] veth1: entered allmulticast mode [ 907.105762][T25351] veth1: left allmulticast mode [ 907.183083][T25356] 9pnet_fd: Insufficient options for proto=fd [ 907.222696][T25358] input: syz0 as /devices/virtual/input/input50 [ 907.264941][ T63] usb 6-1: new full-speed USB device number 55 using dummy_hcd [ 907.275815][T25360] netlink: 1347 bytes leftover after parsing attributes in process `syz.6.8442'. [ 907.336991][ T36] audit: type=1107 audit(908.329:5107): pid=25361 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 907.378922][T25366] sit0: entered promiscuous mode [ 907.416126][ T63] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 907.472055][T25366] netlink: 'syz.6.8445': attribute type 1 has an invalid length. [ 907.475875][ T63] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 907.486288][T25366] netlink: 1 bytes leftover after parsing attributes in process `syz.6.8445'. [ 907.494458][ T63] usb 6-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00 [ 907.511325][T25366] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 907.515411][ T63] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 907.524456][T25366] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:138 [ 907.538105][ T63] usb 6-1: config 0 descriptor?? [ 907.556534][T25347] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 907.561046][T25369] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 [ 907.565949][ T63] usbhid 6-1:0.0: can't add hid device: -22 [ 907.576847][ T63] usbhid 6-1:0.0: probe with driver usbhid failed with error -22 [ 907.694274][T25382] input: syz0 as /devices/virtual/input/input52 [ 907.705980][T25382] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 907.724964][T25386] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8451'. [ 907.740331][T25386] bridge_slave_1: left allmulticast mode [ 907.746153][T25386] bridge_slave_1: left promiscuous mode [ 907.751785][T25386] bridge0: port 2(bridge_slave_1) entered disabled state [ 907.760027][T25386] bridge_slave_0: left allmulticast mode [ 907.765972][T25386] bridge_slave_0: left promiscuous mode [ 907.766138][ T63] usb 6-1: USB disconnect, device number 55 [ 907.771723][T25386] bridge0: port 1(bridge_slave_0) entered disabled state [ 907.781719][T25388] syz.4.8451(25388): Attempt to set a LOCK_MAND lock via flock(2). This support has been removed and the request ignored. [ 908.428777][T25398] rust_binder: BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 908.479126][T25405] rust_binder: Write failure EINVAL in pid:254 [ 908.479183][T25404] rust_binder: Write failure EINVAL in pid:254 [ 908.624962][T18747] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 908.784947][T18747] usb 6-1: Using ep0 maxpacket: 32 [ 908.791277][T18747] usb 6-1: config 0 has no interfaces? [ 908.796819][T18747] usb 6-1: New USB device found, idVendor=1038, idProduct=1411, bcdDevice= 0.00 [ 908.805946][T18747] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 908.814475][T18747] usb 6-1: config 0 descriptor?? [ 908.883600][T25414] rust_binder: Write failure EFAULT in pid:134 [ 908.903232][T25418] netlink: 12 bytes leftover after parsing attributes in process `syz.7.8461'. [ 908.928621][T25423] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 152, size: 238) [ 908.928641][T25423] rust_binder: Error while translating object. [ 908.939296][T25423] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 908.945516][T25423] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:143 [ 908.965299][T25426] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION freeze notification not active [ 908.983318][T25426] rust_binder: Write failure EINVAL in pid:146 [ 909.046935][T25434] netlink: 124 bytes leftover after parsing attributes in process `syz.7.8466'. [ 909.119246][T25439] netlink: 76 bytes leftover after parsing attributes in process `syz.7.8467'. [ 910.244906][T18747] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 910.395318][T18747] usb 8-1: too many configurations: 65, using maximum allowed: 8 [ 910.403887][T18747] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 910.414098][T18747] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 910.423687][T18747] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 910.433856][T18747] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 910.444078][T18747] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 910.454262][T18747] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 910.463832][T18747] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 910.473957][T18747] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 910.483486][T18747] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 910.493590][T18747] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 910.503132][T18747] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 910.513239][T18747] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 910.522811][T18747] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 910.533028][T18747] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 910.542614][T18747] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 910.552742][T18747] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 910.562313][T18747] usb 8-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 910.571381][T18747] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 910.579395][T18747] usb 8-1: SerialNumber: syz [ 910.734761][T25451] 9pnet_fd: Insufficient options for proto=fd [ 910.755737][T25453] rust_binder: BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 910.786972][T25449] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 910.795759][T25449] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 910.895954][T25455] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 911.418278][ T551] usb 6-1: USB disconnect, device number 56 [ 911.571125][T25473] netlink: 'syz.6.8476': attribute type 28 has an invalid length. [ 911.579485][T25471] __vm_enough_memory: pid: 25471, comm: syz.6.8476, bytes: 18014402804453376 not enough memory for the allocation [ 911.599373][T25466] __vm_enough_memory: pid: 25466, comm: syz.5.8475, bytes: 18014402804453376 not enough memory for the allocation [ 911.693942][T25481] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 911.703855][T25481] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 911.712396][T25481] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 911.732626][T25481] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 911.759911][T25493] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 911.759942][T25493] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 911.775062][T25493] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 911.787325][T25497] rust_binder: Error while translating object. [ 911.788375][T25493] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 911.793963][T25497] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 911.807165][T25497] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:270 [ 911.813152][T25493] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 911.840733][T25493] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 911.856307][T25499] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 911.884102][T25503] rust_binder: Error while translating object. [ 911.884153][T25503] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 911.890450][T25503] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:556 [ 911.923980][T25509] tipc: Enabled bearer , priority 0 [ 911.945674][T25509] tipc: Disabling bearer [ 912.046060][T25511] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:560 [ 912.089210][T25520] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 912.098511][T25520] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:569 [ 912.129066][T25525] 8021q: VLANs not supported on ip_vti0 [ 912.162612][T25529] __vm_enough_memory: pid: 25529, comm: syz.5.8494, bytes: 18014402804453376 not enough memory for the allocation [ 912.746093][T25544] rust_binder: 589: no such ref 3 [ 912.751296][T25544] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 912.758916][T25544] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 912.766263][T25544] rust_binder: Write failure EFAULT in pid:589 [ 913.135631][T18747] usb 8-1: cannot find UAC_HEADER [ 913.158122][T25556] rust_binder: Write failure EINVAL in pid:172 [ 913.164696][T18747] snd-usb-audio 8-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 913.187920][ T36] audit: type=1400 audit(914.179:5108): avc: denied { append } for pid=25557 comm="syz.7.8503" name="uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 913.193464][T25560] rust_binder: Write failure EFAULT in pid:601 [ 913.212142][T18747] usb 8-1: USB disconnect, device number 10 [ 913.235096][T22482] udevd[22482]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 913.251456][ T36] audit: type=1400 audit(914.179:5109): avc: denied { ioctl } for pid=25557 comm="syz.7.8503" path="/dev/uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 913.314796][ T36] audit: type=1400 audit(914.209:5110): avc: denied { map } for pid=25557 comm="syz.7.8503" path="/dev/uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 913.495526][T25573] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:179 [ 913.538676][T25587] SELinux: security_context_str_to_sid (sytem_uÝGй ‰:ÿß) failed with errno=-22 [ 913.566539][T25589] block device autoloading is deprecated and will be removed. [ 913.843175][ T10] rust_binder: 25598: removing orphan mapping 0:4096 [ 913.854931][T18747] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 913.857131][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 913.863039][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 913.869744][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 913.876120][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 913.882646][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 913.889433][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 913.895661][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 913.902176][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 913.908913][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 913.918871][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 913.921761][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 913.928509][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 913.934772][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 913.948059][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 913.948087][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 913.954531][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 913.968104][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 913.974815][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 913.974873][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 913.981893][T25602] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 914.036216][T18747] usb 6-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 914.047195][T18747] usb 6-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 914.056971][T18747] usb 6-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 914.069800][T18747] usb 6-1: config 0 interface 0 has no altsetting 0 [ 914.076466][T18747] usb 6-1: New USB device found, idVendor=256c, idProduct=006e, bcdDevice= 0.00 [ 914.085528][T18747] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 914.094087][T18747] usb 6-1: config 0 descriptor?? [ 914.254959][ T551] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 914.256469][T25612] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 [ 914.404872][ T551] usb 8-1: Using ep0 maxpacket: 16 [ 914.411756][ T551] usb 8-1: config 1 interface 0 altsetting 7 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 914.424732][ T551] usb 8-1: config 1 interface 0 has no altsetting 0 [ 914.432881][ T551] usb 8-1: New USB device found, idVendor=1b96, idProduct=0003, bcdDevice= 0.40 [ 914.442029][ T551] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 914.450166][ T551] usb 8-1: Product: syz [ 914.454429][ T551] usb 8-1: Manufacturer: syz [ 914.459074][ T551] usb 8-1: SerialNumber: syz [ 914.675546][ T551] usbhid 8-1:1.0: can't add hid device: -71 [ 914.681837][ T551] usbhid 8-1:1.0: probe with driver usbhid failed with error -71 [ 914.693275][ T551] usb 8-1: USB disconnect, device number 11 [ 914.708111][T25591] rust_binder: Error in use_page_slow: ESRCH [ 914.708135][T25591] rust_binder: use_range failure ESRCH [ 914.726831][T25618] rust_binder: Error in use_page_slow: ESRCH [ 914.733039][T25591] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 914.734038][T25618] rust_binder: use_range failure ESRCH [ 914.739387][T25591] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 914.748496][T25618] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 914.752887][T25591] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:610 [ 914.778008][T25618] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 914.800429][T25618] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:210 [ 914.805058][T18747] usb 6-1: string descriptor 0 read error: -71 [ 914.852825][T18747] uclogic 0003:256C:006E.001A: failed retrieving string descriptor #200: -71 [ 914.882540][T18747] uclogic 0003:256C:006E.001A: failed retrieving pen parameters: -71 [ 914.899578][T18747] uclogic 0003:256C:006E.001A: failed probing pen v2 parameters: -71 [ 914.907757][T18747] uclogic 0003:256C:006E.001A: failed probing parameters: -71 [ 914.915705][T18747] uclogic 0003:256C:006E.001A: probe with driver uclogic failed with error -71 [ 914.930594][T18747] usb 6-1: USB disconnect, device number 57 [ 914.966069][T25640] rust_binder: 184: no such ref 1 [ 914.973103][T25640] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:184 [ 914.983767][T25639] incfs_lookup_dentry err:-13 [ 915.053786][ T36] audit: type=1400 audit(916.039:5111): avc: denied { lock } for pid=25644 comm="syz.4.8531" path="socket:[112627]" dev="sockfs" ino=112627 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 915.238326][T25663] random: crng reseeded on system resumption [ 915.294690][T25663] netlink: 92 bytes leftover after parsing attributes in process `syz.4.8536'. [ 915.304482][T25663] rust_binder: Write failure EINVAL in pid:314 [ 915.347063][T25665] rust_binder: Error while translating object. [ 915.353646][T25665] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 915.360341][T25665] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:316 [ 915.379680][T25665] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 915.455025][T25672] netlink: 'syz.5.8539': attribute type 32 has an invalid length. [ 915.861731][T25679] veth0_to_team: entered promiscuous mode [ 915.872763][T25679] veth0_to_team: entered allmulticast mode [ 915.991263][T25691] netlink: 'syz.5.8545': attribute type 27 has an invalid length. [ 916.026652][T25691] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 916.374140][T25708] SELinux: security_context_str_to_sid (sytem_uÝGй ‰:ÿß) failed with errno=-22 [ 917.071675][T10449] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 917.185109][T25720] netlink: 8 bytes leftover after parsing attributes in process `syz.7.8553'. [ 917.224924][T10449] usb 6-1: Using ep0 maxpacket: 8 [ 917.245627][T10449] usb 6-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 917.254701][T10449] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 917.274247][T25722] rust_binder: Failed to allocate buffer. len:224, is_oneway:false [ 917.275642][T10449] usb 6-1: config 0 descriptor?? [ 917.421677][T25729] netlink: 4 bytes leftover after parsing attributes in process `syz.7.8556'. [ 917.468463][ T36] audit: type=1400 audit(918.459:5112): avc: denied { map } for pid=25728 comm="syz.7.8556" path="/81/file0" dev="tmpfs" ino=458 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 917.505896][T10449] asix 6-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 917.637961][T25742] rust_binder: Failed to allocate buffer. len:136, is_oneway:false [ 917.784993][T25752] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 917.800186][T25752] rust_binder: inc_ref_done called when no active inc_refs [ 917.851476][T25753] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 917.859009][T25753] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 918.834590][T25767] SELinux: Context #! ./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 918.842055][ T36] audit: type=1400 audit(919.829:5113): avc: denied { create } for pid=25766 comm="syz.4.8569" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon=2321202E2F6367726F75702F66696C65306161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616 [ 918.852938][T25767] overlayfs: failed to resolve './file1': -2 [ 918.933731][ T36] audit: type=1400 audit(919.829:5114): avc: denied { associate } for pid=25766 comm="syz.4.8569" name="file0" scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon=2321202E2F6367726F75702F66696C6530616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161 [ 919.026221][T25768] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 919.031106][T25710] rust_binder: Error while translating object. [ 919.122527][ T36] audit: type=1400 audit(919.839:5115): avc: denied { mounton } for pid=25766 comm="syz.4.8569" path="/116/bus" dev="tmpfs" ino=633 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon=2321202E2F6367726F75702F66696C65306161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616 [ 919.131484][T25768] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:322 [ 919.138519][T25710] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 919.238599][T25710] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:636 [ 919.257710][T10449] asix 6-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 919.263531][ T36] audit: type=1400 audit(920.249:5116): avc: denied { rmdir } for pid=24205 comm="syz-executor" name="bus" dev="tmpfs" ino=633 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon=2321202E2F6367726F75702F66696C6530616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161 [ 919.267363][T10449] asix 6-1:0.0 (unnamed net_device) (uninitialized): Failed to write Medium Mode mode to 0x0306: ffffffb9 [ 919.369459][T25775] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 919.387499][T25775] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 919.387710][T10449] asix 6-1:0.0: probe with driver asix failed with error -71 [ 919.398209][T25775] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 919.405357][T10449] usb 6-1: USB disconnect, device number 58 [ 919.414336][T25775] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 919.452865][T25770] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 919.504519][T25780] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 919.511259][T25780] rust_binder: Write failure EINVAL in pid:196 [ 920.034905][ T10] usb 6-1: new full-speed USB device number 59 using dummy_hcd [ 920.196361][ T10] usb 6-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 920.207627][ T10] usb 6-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 920.220559][ T10] usb 6-1: config 0 interface 0 has no altsetting 0 [ 920.227212][ T10] usb 6-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 920.236409][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 920.245708][ T10] usb 6-1: config 0 descriptor?? [ 920.360702][T25793] rust_binder: 293: no such ref 1 [ 920.365929][T25793] rust_binder: 293: no such ref 0 [ 920.371023][T25793] rust_binder: Read failure Err(EAGAIN) in pid:293 [ 920.451296][T25799] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 920.465014][T25799] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 920.658977][ T10] acrux 0003:1A34:0802.001B: invalid report_count -1057747719 [ 920.666555][ T10] acrux 0003:1A34:0802.001B: item 0 4 1 9 parsing failed [ 920.673844][ T10] acrux 0003:1A34:0802.001B: parse failed [ 920.679630][ T10] acrux 0003:1A34:0802.001B: probe with driver acrux failed with error -22 [ 920.868884][ T10] usb 6-1: USB disconnect, device number 59 [ 921.263048][T22963] tipc: Subscription rejected, illegal request [ 921.525091][T25820] rust_binder: Failed to allocate buffer. len:4264, is_oneway:false [ 921.525122][T25820] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 921.533191][T25820] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:652 [ 921.553913][T25823] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 921.563117][T25823] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:654 [ 921.713541][T25834] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 921.864932][T25843] input: syz1 as /devices/virtual/input/input53 [ 922.021695][T25845] rust_binder: Write failure EINVAL in pid:672 [ 922.022033][T25846] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 922.256361][T25855] __vm_enough_memory: pid: 25855, comm: syz.6.8598, bytes: 18014402804453376 not enough memory for the allocation [ 922.286663][ T36] audit: type=1400 audit(923.279:5117): avc: denied { write } for pid=25856 comm="syz.6.8599" name="urandom" dev="devtmpfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 922.435767][ T414] usb 6-1: new full-speed USB device number 60 using dummy_hcd [ 922.585919][ T414] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 922.596881][ T414] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 922.609720][ T414] usb 6-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00 [ 922.618783][ T414] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 922.627480][ T414] usb 6-1: config 0 descriptor?? [ 922.632732][T25853] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 922.640746][ T414] usbhid 6-1:0.0: can't add hid device: -22 [ 922.646721][ T414] usbhid 6-1:0.0: probe with driver usbhid failed with error -22 [ 922.841397][T25853] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 922.850493][T25853] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 922.864771][T25853] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 922.873299][T25853] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 922.927994][ T551] usb 6-1: USB disconnect, device number 60 [ 923.440344][T25872] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 923.450744][T25874] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:685 [ 923.467264][T25876] binder: Bad value for 'stats' [ 923.639928][T25886] rust_binder: Write failure EFAULT in pid:697 [ 923.765707][T25895] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=23 sclass=netlink_route_socket pid=25895 comm=syz.5.8614 [ 923.787074][T25895] netlink: 'syz.5.8614': attribute type 27 has an invalid length. [ 923.801377][T25895] veth0_to_team: left promiscuous mode [ 923.806885][T25895] veth0_to_team: left allmulticast mode [ 924.947381][T25922] 9pnet: p9_errstr2errno: server reported unknown error 18446744 [ 924.966643][T25925] netlink: 'syz.5.8625': attribute type 5 has an invalid length. [ 924.974443][T25925] netlink: 'syz.5.8625': attribute type 5 has an invalid length. [ 924.982292][T25925] netlink: 3657 bytes leftover after parsing attributes in process `syz.5.8625'. [ 924.991682][T25926] rust_binder: Write failure EFAULT in pid:330 [ 925.075712][T25925] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 [ 925.348244][T25936] netlink: 16 bytes leftover after parsing attributes in process `syz.6.8628'. [ 925.603109][T25938] rust_binder: Error while translating object. [ 925.603159][T25938] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 925.609503][T25938] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:212 [ 925.712906][ T36] audit: type=1326 audit(926.699:5118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=25913 comm="syz.7.8622" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0bae98eec9 code=0x7fc00000 [ 925.754385][T25955] overlay: ./file0 is not a directory [ 925.761705][ T36] audit: type=1326 audit(926.739:5119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=25952 comm="syz.6.8635" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7eff69b8eec9 code=0x0 [ 925.785415][ T36] audit: type=1326 audit(926.779:5120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=25954 comm="syz.7.8636" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0bae98eec9 code=0x0 [ 925.831540][T25959] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 925.907433][T25969] rust_binder: Error in use_page_slow: ESRCH [ 925.914001][T25969] rust_binder: use_range failure ESRCH [ 925.920208][T25969] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 925.925724][T25969] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 925.933796][T25969] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:732 [ 926.204851][ T551] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 926.365903][ T551] usb 6-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 926.374695][ T551] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 926.384957][ T551] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 926.393922][ T551] usb 6-1: config 1 has no interface number 1 [ 926.400022][ T551] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 926.414329][ T551] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 926.423431][ T551] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 926.431636][ T551] usb 6-1: Product: syz [ 926.435864][ T551] usb 6-1: Manufacturer: syz [ 926.440477][ T551] usb 6-1: SerialNumber: syz [ 926.810165][ T551] usb 6-1: MIDIStreaming interface descriptor not found [ 926.819832][ T551] usb 6-1: USB disconnect, device number 61 [ 926.835158][ T31] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 926.985932][ T31] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 926.995736][ T31] usb 8-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 927.008898][ T31] usb 8-1: New USB device found, idVendor=044f, idProduct=b300, bcdDevice= 0.00 [ 927.017970][ T31] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 927.026559][ T31] usb 8-1: config 0 descriptor?? [ 927.234352][ T31] thrustmaster 0003:044F:B300.001C: unknown main item tag 0x0 [ 927.242084][ T31] thrustmaster 0003:044F:B300.001C: unknown main item tag 0x0 [ 927.249750][ T31] thrustmaster 0003:044F:B300.001C: unknown main item tag 0x0 [ 927.257504][ T31] thrustmaster 0003:044F:B300.001C: unknown main item tag 0x0 [ 927.265232][ T31] thrustmaster 0003:044F:B300.001C: unknown main item tag 0x0 [ 927.274113][ T31] thrustmaster 0003:044F:B300.001C: hidraw0: USB HID v0.00 Device [HID 044f:b300] on usb-dummy_hcd.7-1/input0 [ 927.287258][ T31] thrustmaster 0003:044F:B300.001C: no inputs found [ 927.302591][ T31] usb 8-1: USB disconnect, device number 12 [ 927.414884][ T414] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 927.564861][ T414] usb 6-1: Using ep0 maxpacket: 8 [ 927.571000][ T414] usb 6-1: config 162 has an invalid interface number: 35 but max is 3 [ 927.579351][ T414] usb 6-1: config 162 has an invalid interface number: 93 but max is 3 [ 927.587636][ T414] usb 6-1: config 162 has an invalid interface descriptor of length 5, skipping [ 927.596719][ T414] usb 6-1: config 162 has an invalid descriptor of length 0, skipping remainder of the config [ 927.606990][ T414] usb 6-1: config 162 has 2 interfaces, different from the descriptor's value: 4 [ 927.616140][ T414] usb 6-1: config 162 has no interface number 0 [ 927.622491][ T414] usb 6-1: config 162 has no interface number 1 [ 927.628780][ T414] usb 6-1: config 162 interface 35 altsetting 64 has an invalid descriptor for endpoint zero, skipping [ 927.639986][ T414] usb 6-1: config 162 interface 35 altsetting 64 has an invalid descriptor for endpoint zero, skipping [ 927.651181][ T414] usb 6-1: config 162 interface 35 altsetting 64 endpoint 0x4 has invalid maxpacket 512, setting to 64 [ 927.662293][ T414] usb 6-1: config 162 interface 35 altsetting 64 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 927.673488][ T414] usb 6-1: config 162 interface 35 altsetting 64 endpoint 0x9 has invalid maxpacket 25044, setting to 1024 [ 927.684918][ T414] usb 6-1: config 162 interface 35 altsetting 64 bulk endpoint 0x9 has invalid maxpacket 1024 [ 927.695204][ T414] usb 6-1: config 162 interface 35 altsetting 64 bulk endpoint 0xC has invalid maxpacket 1024 [ 927.705490][ T414] usb 6-1: config 162 interface 35 altsetting 64 has a duplicate endpoint with address 0xB, skipping [ 927.716410][ T414] usb 6-1: config 162 interface 35 altsetting 64 has 12 endpoint descriptors, different from the interface descriptor's value: 13 [ 927.729919][ T414] usb 6-1: config 162 interface 93 altsetting 190 has 0 endpoint descriptors, different from the interface descriptor's value: 7 [ 927.743229][ T414] usb 6-1: config 162 interface 35 has no altsetting 0 [ 927.750207][ T414] usb 6-1: config 162 interface 93 has no altsetting 0 [ 927.758492][ T414] usb 6-1: New USB device found, idVendor=1e0e, idProduct=9200, bcdDevice= 8.27 [ 927.767603][ T414] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 927.775627][ T414] usb 6-1: Product: syz [ 927.779802][ T414] usb 6-1: Manufacturer: syz [ 927.784391][ T414] usb 6-1: SerialNumber: syz [ 927.790101][T25985] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 927.999583][T25985] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=39 sclass=netlink_route_socket pid=25985 comm=syz.5.8646 [ 928.012207][T25985] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=53 sclass=netlink_route_socket pid=25985 comm=syz.5.8646 [ 928.030546][ T414] usb 6-1: USB disconnect, device number 62 [ 928.540441][T26002] rust_binder: validate_parent_fixup: fixup_min_offset=46, parent_offset=35 [ 928.540462][T26002] rust_binder: Error while translating object. [ 928.549232][T26002] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 928.555437][T26002] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:742 [ 928.814862][ T414] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 928.975313][ T414] usb 6-1: no configurations [ 928.979990][ T414] usb 6-1: can't read configurations, error -22 [ 928.996236][T26010] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:359 [ 929.062367][T26013] SELinux: security_context_str_to_sid (sytem_uÝGй) failed with errno=-22 [ 929.114909][ T414] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 929.267164][ T414] usb 6-1: no configurations [ 929.271905][ T414] usb 6-1: can't read configurations, error -22 [ 929.279965][ T414] usb usb6-port1: attempt power cycle [ 929.418482][T26019] __vm_enough_memory: pid: 26019, comm: syz.4.8655, bytes: 18014402804453376 not enough memory for the allocation [ 929.624858][ T414] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 929.645578][ T414] usb 6-1: no configurations [ 929.650198][ T414] usb 6-1: can't read configurations, error -22 [ 929.686967][T26025] binder: Bad value for 'defcontext' [ 929.795494][ T414] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 929.818218][ T414] usb 6-1: no configurations [ 929.822883][ T414] usb 6-1: can't read configurations, error -22 [ 929.829433][ T414] usb usb6-port1: unable to enumerate USB device [ 929.856356][T26036] rust_binder: BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch [ 930.016910][T26049] rust_binder: 238: no such ref 1 [ 930.039069][T26051] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=256 sclass=netlink_route_socket pid=26051 comm=syz.6.8667 [ 930.795466][ T414] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 930.844221][T26070] rust_binder: validate_parent_fixup: new_min_offset=18, sg_entry.length=0 [ 930.844242][T26070] rust_binder: Error while translating object. [ 930.852996][T26070] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 930.859239][T26070] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:395 [ 930.890599][T26077] netlink: 'syz.4.8675': attribute type 1 has an invalid length. [ 930.907557][T26077] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8675'. [ 930.966005][ T414] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 930.975929][ T414] usb 8-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 930.989210][ T414] usb 8-1: New USB device found, idVendor=044f, idProduct=b300, bcdDevice= 0.00 [ 930.998435][ T414] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 931.010620][ T414] usb 8-1: config 0 descriptor?? [ 931.062952][T26088] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 931.062983][T26088] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:413 [ 931.224740][T26095] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 931.234015][T26095] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:420 [ 931.417954][ T414] thrustmaster 0003:044F:B300.001D: unknown main item tag 0x0 [ 931.434601][ T414] thrustmaster 0003:044F:B300.001D: unknown main item tag 0x0 [ 931.442119][ T414] thrustmaster 0003:044F:B300.001D: unknown main item tag 0x0 [ 931.449727][ T414] thrustmaster 0003:044F:B300.001D: unknown main item tag 0x0 [ 931.457319][ T414] thrustmaster 0003:044F:B300.001D: unknown main item tag 0x0 [ 931.466207][ T414] thrustmaster 0003:044F:B300.001D: hidraw0: USB HID v0.00 Device [HID 044f:b300] on usb-dummy_hcd.7-1/input0 [ 931.471006][T26103] tipc: Enabled bearer , priority 10 [ 931.478118][ T414] thrustmaster 0003:044F:B300.001D: no inputs found [ 932.114906][ T774] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 932.114919][ T773] Bluetooth: hci0: command 0x1003 tx timeout [ 932.167171][T26111] __vm_enough_memory: pid: 26111, comm: syz.6.8685, bytes: 18014402804453376 not enough memory for the allocation [ 932.197379][ T36] audit: type=1400 audit(933.189:5121): avc: denied { map } for pid=26117 comm="syz.4.8684" path="socket:[116731]" dev="sockfs" ino=116731 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 932.248248][T26116] SELinux: policydb magic number 0x5ff8c does not match expected magic number 0xf97cff8c [ 932.258259][T26116] SELinux: failed to load policy [ 932.274502][T26129] SELinux: failed to load policy [ 932.279154][T26131] overlayfs: conflicting options: nfs_export=on,index=off [ 932.280047][T26129] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:751 [ 932.302417][T26135] rust_binder: Error while translating object. [ 932.311710][T26135] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 932.318096][T26135] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:753 [ 932.328588][T26137] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:254 [ 932.347372][T26140] rust_binder: Write failure EFAULT in pid:755 [ 932.636501][T26166] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:272 [ 932.689856][T26173] netlink: 'syz.6.8707': attribute type 46 has an invalid length. [ 932.708296][ T36] audit: type=1400 audit(933.699:5122): avc: denied { setattr } for pid=26172 comm="syz.6.8707" path="socket:[116878]" dev="sockfs" ino=116878 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 932.715729][T26173] SELinux: Context system_u:object_r:wireless_device_t:s0 is not valid (left unmapped). [ 932.731729][ T36] audit: type=1400 audit(933.709:5123): avc: denied { relabelfrom } for pid=26172 comm="syz.6.8707" name="NFC_RAW" dev="sockfs" ino=116877 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 932.764201][ T36] audit: type=1400 audit(933.739:5124): avc: denied { relabelto } for pid=26172 comm="syz.6.8707" name="NFC_RAW" dev="sockfs" ino=116877 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=nfc_socket permissive=1 trawcon="system_u:object_r:wireless_device_t:s0" [ 932.947609][T26190] fuseblk: Bad value for 'fd' [ 932.963377][T26194] binder: Binderfs stats mode cannot be changed during a remount [ 933.123842][T26201] rust_binder: 768: no such ref 3 [ 933.128925][T26201] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 933.135989][T26201] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 933.143051][T26201] rust_binder: Write failure EFAULT in pid:768 [ 933.544370][ T10] usb 8-1: USB disconnect, device number 13 [ 933.557852][T26207] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 933.565090][T26207] rust_binder: 360: no such ref 2 [ 933.570236][T26207] rust_binder: Failed to allocate buffer. len:120, is_oneway:false [ 933.570290][T26207] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 933.585509][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.585552][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.592121][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.598746][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.605418][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.612017][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.618643][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.625262][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.631802][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.638632][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.645188][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.651710][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.658266][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.664862][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.671369][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.677948][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.684479][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.691029][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.697583][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.704103][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.710658][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.717213][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.723725][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.730271][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.736810][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.743320][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.749865][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.756400][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.762906][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.769465][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.776047][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 933.782552][T26207] rust_binder: Read failure Err(EAGAIN) in pid:360 [ 934.193538][T26217] syzkaller0: entered promiscuous mode [ 934.205630][T26217] syzkaller0: entered allmulticast mode [ 934.214185][T26217] netlink: 12 bytes leftover after parsing attributes in process `syz.7.8721'. [ 934.956208][T26224] netlink: 'syz.7.8723': attribute type 32 has an invalid length. [ 934.964716][T26224] fuse: Bad value for 'rootmode' [ 935.404816][ T31] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 935.555946][ T31] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 935.565766][ T31] usb 8-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 935.578735][ T31] usb 8-1: New USB device found, idVendor=044f, idProduct=b300, bcdDevice= 0.00 [ 935.587811][ T31] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 935.596764][ T31] usb 8-1: config 0 descriptor?? [ 936.076767][ T31] usbhid 8-1:0.0: can't add hid device: -71 [ 936.082882][ T31] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 936.091711][ T31] usb 8-1: USB disconnect, device number 14 [ 936.268497][T26249] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:779 [ 936.823510][T26274] veth1: entered allmulticast mode [ 936.829690][T26274] veth1: left allmulticast mode [ 936.845853][T26274] veth1: entered allmulticast mode [ 936.854945][ T31] usb 6-1: new high-speed USB device number 67 using dummy_hcd [ 936.909537][T26274] veth1: left allmulticast mode [ 937.006561][ T31] usb 6-1: config 14 has an invalid interface number: 21 but max is 0 [ 937.014805][ T31] usb 6-1: config 14 has no interface number 0 [ 937.020986][ T31] usb 6-1: config 14 interface 21 altsetting 251 bulk endpoint 0xA has invalid maxpacket 32 [ 937.031089][ T31] usb 6-1: config 14 interface 21 has no altsetting 0 [ 937.039892][ T31] usb 6-1: string descriptor 0 read error: -22 [ 937.046216][ T31] usb 6-1: New USB device found, idVendor=c880, idProduct=760e, bcdDevice=35.fc [ 937.055271][ T31] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 937.064144][T26263] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 937.072460][ T31] usb 6-1: MIDIStreaming interface descriptor not found [ 937.204827][ T332] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 937.272862][ T414] usb 6-1: USB disconnect, device number 67 [ 937.354846][ T332] usb 8-1: Using ep0 maxpacket: 32 [ 937.361389][ T332] usb 8-1: config 0 has an invalid interface number: 184 but max is 0 [ 937.369594][ T332] usb 8-1: config 0 has no interface number 0 [ 937.375759][ T332] usb 8-1: config 0 interface 184 has no altsetting 0 [ 937.383800][ T332] usb 8-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 937.392903][ T332] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 937.400927][ T332] usb 8-1: Product: syz [ 937.405115][ T332] usb 8-1: Manufacturer: syz [ 937.409721][ T332] usb 8-1: SerialNumber: syz [ 937.415047][ T332] usb 8-1: config 0 descriptor?? [ 937.420883][ T332] smsc75xx v1.0.0 [ 937.814849][T26282] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8743'. [ 938.024287][ T332] smsc75xx 8-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 938.036447][ T332] smsc75xx 8-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 938.138667][T26296] __vm_enough_memory: pid: 26296, comm: syz.5.8746, bytes: 18014402804453376 not enough memory for the allocation [ 938.151084][T26298] __vm_enough_memory: pid: 26298, comm: syz.5.8746, bytes: 18014402804453376 not enough memory for the allocation [ 938.349277][ T36] audit: type=1400 audit(939.339:5125): avc: denied { connect } for pid=26299 comm="syz.4.8747" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 938.447564][T26279] netlink: 8 bytes leftover after parsing attributes in process `syz.7.8742'. [ 938.461127][ T36] audit: type=1400 audit(939.449:5126): avc: denied { connect } for pid=26301 comm="syz.4.8748" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 938.480459][T26302] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 938.488058][T26302] rust_binder: Write failure EINVAL in pid:446 [ 938.537667][T26304] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 939.014351][T26316] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:817 [ 939.026862][T26321] rust_binder: Write failure EFAULT in pid:819 [ 939.152399][T26327] rust_binder: Error while translating object. [ 939.158798][T26327] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 939.165264][T26327] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:309 [ 939.175993][T26325] __vm_enough_memory: pid: 26325, comm: syz.5.8757, bytes: 18014402804453376 not enough memory for the allocation [ 939.189836][T26330] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:311 [ 939.200249][T26330] rust_binder: Failed to allocate buffer. len:4256, is_oneway:false [ 940.234889][ T551] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 940.404799][ T551] usb 6-1: Using ep0 maxpacket: 8 [ 940.411421][ T551] usb 6-1: unable to get BOS descriptor or descriptor too short [ 940.421450][ T551] usb 6-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 0.01 [ 940.427982][T26351] .N: renamed from veth0_to_bond (while UP) [ 940.430628][ T551] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 940.444834][ T551] usb 6-1: Product: syz [ 940.449007][ T551] usb 6-1: Manufacturer: syz [ 940.453607][ T551] usb 6-1: SerialNumber: syz [ 940.468684][ T332] smsc75xx 8-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000010: -71 [ 940.480804][ T332] smsc75xx 8-1:0.184 (unnamed net_device) (uninitialized): Failed to write HW_CFG: -71 [ 940.490545][ T332] smsc75xx 8-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 940.500217][ T332] smsc75xx 8-1:0.184: probe with driver smsc75xx failed with error -71 [ 940.510203][ T332] usb 8-1: USB disconnect, device number 15 [ 940.611038][T26356] rust_binder: Error while translating object. [ 940.611094][T26356] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 940.617357][T26356] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:335 [ 940.698259][T26365] SELinux: failed to load policy [ 940.839385][T26375] rust_binder: 353: no such ref 3 [ 940.844460][T26375] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 940.851572][T26375] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 940.858633][T26375] rust_binder: Write failure EFAULT in pid:353 [ 940.862220][T26375] netlink: 'syz.6.8773': attribute type 13 has an invalid length. [ 940.985670][T22960] Bluetooth: hci0: Frame reassembly failed (-84) [ 941.609361][T26395] SELinux: ebitmap: truncated map [ 941.622606][T26395] SELinux: failed to load policy [ 942.558772][ T36] audit: type=1326 audit(943.549:5127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=26397 comm="syz.4.8780" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5028d8eec9 code=0x0 [ 942.660442][T26399] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 [ 942.994813][ T773] Bluetooth: hci0: command 0x1003 tx timeout [ 942.994822][ T774] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 943.068571][ T551] usb 6-1: USB disconnect, device number 68 [ 943.100739][T26405] overlay: Unknown parameter '/' [ 943.173334][T26411] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 943.173362][T26411] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:839 [ 943.553008][T26425] rust_binder: 413: no such ref 1 [ 943.567540][T26425] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:413 [ 943.654872][ T10] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 943.697931][T26431] overlayfs: workdir and upperdir must be separate subtrees [ 943.815949][ T10] usb 6-1: config 0 has an invalid descriptor of length 1, skipping remainder of the config [ 943.826116][ T10] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 943.835106][ T10] usb 6-1: New USB device found, idVendor=09da, idProduct=000a, bcdDevice= 0.00 [ 943.844185][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 943.853631][ T10] usb 6-1: config 0 descriptor?? [ 943.878863][T26431] rust_binder: Error in use_page_slow: ESRCH [ 943.878881][T26431] rust_binder: use_range failure ESRCH [ 943.884995][T26431] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 943.890539][T26431] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 943.898604][T26431] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:418 [ 944.618815][T26442] binder: Unknown parameter 'fscontext?}' [ 944.764870][T26443] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found [ 944.773128][T26443] rust_binder: Write failure EINVAL in pid:847 [ 945.165365][T26453] binder: Unknown parameter '0x0000000000000000' [ 945.190228][T26455] rust_binder: Error while translating object. [ 945.190273][T26455] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 945.196529][T26455] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:436 [ 946.425583][ T63] usb 6-1: USB disconnect, device number 69 [ 946.685535][T22957] Bluetooth: hci0: Frame reassembly failed (-84) [ 946.864783][ T63] usb 6-1: new full-speed USB device number 70 using dummy_hcd [ 947.015923][ T63] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 947.026880][ T63] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 947.039733][ T63] usb 6-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00 [ 947.048812][ T63] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 947.057470][ T63] usb 6-1: config 0 descriptor?? [ 947.062712][T26480] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 947.070830][ T63] usbhid 6-1:0.0: can't add hid device: -22 [ 947.077013][ T63] usbhid 6-1:0.0: probe with driver usbhid failed with error -22 [ 947.272019][ T10] usb 6-1: USB disconnect, device number 70 [ 947.900784][T26517] netlink: 4 bytes leftover after parsing attributes in process `syz.7.8820'. [ 947.909766][T26517] bridge_slave_1: left allmulticast mode [ 947.915486][T26517] bridge_slave_1: left promiscuous mode [ 947.921210][T26517] bridge0: port 2(bridge_slave_1) entered disabled state [ 947.965035][T26517] bridge_slave_0: left allmulticast mode [ 947.970740][T26517] bridge_slave_0: left promiscuous mode [ 947.976423][T26517] bridge0: port 1(bridge_slave_0) entered disabled state [ 948.084782][ T63] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 948.234795][ T63] usb 6-1: Using ep0 maxpacket: 16 [ 948.241019][ T63] usb 6-1: config 0 has an invalid interface number: 105 but max is 0 [ 948.249391][ T63] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 948.259514][ T63] usb 6-1: config 0 has no interface number 0 [ 948.266990][ T63] usb 6-1: New USB device found, idVendor=046d, idProduct=08d3, bcdDevice= b.28 [ 948.276233][ T63] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 948.284238][ T63] usb 6-1: Product: syz [ 948.288418][ T63] usb 6-1: Manufacturer: syz [ 948.293029][ T63] usb 6-1: SerialNumber: syz [ 948.298304][ T63] usb 6-1: config 0 descriptor?? [ 948.304169][ T63] usb 6-1: Found UVC 0.00 device syz (046d:08d3) [ 948.310610][ T63] usb 6-1: No valid video chain found. [ 948.679339][T26524] 9pnet_fd: Insufficient options for proto=fd [ 948.754790][ T774] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 948.856690][T26551] SELinux: policydb magic number 0x4c7cff8c does not match expected magic number 0xf97cff8c [ 948.867111][T26551] SELinux: failed to load policy [ 949.280310][ T63] rust_binder: 26488: removing orphan mapping 0:4096 [ 949.289818][T26567] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 949.321969][T26569] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8837'. [ 949.387028][ T36] audit: type=1400 audit(950.379:5128): avc: denied { read write } for pid=24205 comm="syz-executor" name="loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 949.396424][T26574] 9pnet_fd: Insufficient options for proto=fd [ 949.411199][ T36] audit: type=1400 audit(950.379:5129): avc: denied { open } for pid=24205 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 949.451692][ T36] audit: type=1400 audit(950.379:5130): avc: denied { ioctl } for pid=24205 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 949.476845][ T36] audit: type=1400 audit(950.379:5131): avc: denied { write } for pid=26573 comm="syz.4.8839" name="random" dev="devtmpfs" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 949.556821][T26579] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8840'. [ 949.917281][T26584] binder: Unknown parameter 'fefcontext' [ 950.610204][T26596] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 950.610255][T26596] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 950.618330][T26596] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:491 [ 950.812755][T26604] netlink: 4 bytes leftover after parsing attributes in process `syz.7.8850'. [ 950.876472][T10449] usb 6-1: USB disconnect, device number 71 [ 950.927418][T26607] tipc: Cannot configure node identity twice [ 951.313249][T26609] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:496 [ 951.508190][ T36] audit: type=1400 audit(952.489:5132): avc: denied { relabelfrom } for pid=26628 comm="syz.5.8854" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 951.626948][ T36] audit: type=1400 audit(952.489:5133): avc: denied { relabelto } for pid=26628 comm="syz.5.8854" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 952.203950][T26659] can0: slcan on ptm1. [ 952.287157][ T36] audit: type=1400 audit(953.279:5134): avc: denied { execmod } for pid=26658 comm="syz.5.8862" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 952.533893][T26617] syz.7.8853 invoked oom-killer: gfp_mask=0x100cc2(GFP_HIGHUSER), order=0, oom_score_adj=0 [ 952.559567][T26617] CPU: 1 UID: 0 PID: 26617 Comm: syz.7.8853 Not tainted syzkaller #0 658fd523d4664e50339751640158cdc1077a64d7 [ 952.559601][T26617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 952.559614][T26617] Call Trace: [ 952.559621][T26617] [ 952.559629][T26617] __dump_stack+0x21/0x30 [ 952.559662][T26617] dump_stack_lvl+0x10c/0x190 [ 952.559689][T26617] ? __cfi_dump_stack_lvl+0x10/0x10 [ 952.559714][T26617] ? ___ratelimit+0x3f7/0x5a0 [ 952.559761][T26617] dump_stack+0x19/0x20 [ 952.559786][T26617] dump_header+0xd7/0x490 [ 952.559805][T26617] ? __cfi_mem_cgroup_get_max+0x10/0x10 [ 952.559833][T26617] oom_kill_process+0x35d/0x640 [ 952.559858][T26617] ? sched_clock_cpu+0x75/0x400 [ 952.559896][T26617] out_of_memory+0x659/0xa80 [ 952.559922][T26617] ? __cfi_out_of_memory+0x10/0x10 [ 952.559948][T26617] ? mutex_lock_killable+0x92/0x1c0 [ 952.559981][T26617] ? __cfi_mutex_lock_killable+0x10/0x10 [ 952.560015][T26617] mem_cgroup_out_of_memory+0x279/0x350 [ 952.560038][T26617] ? drain_obj_stock+0xed0/0xed0 [ 952.560060][T26617] ? memcg1_oom_prepare+0x2c6/0x3a0 [ 952.560082][T26617] try_charge_memcg+0x8f7/0xde0 [ 952.560111][T26617] ? gfp_to_alloc_flags_cma+0x90/0x1c0 [ 952.560134][T26617] ? __cfi_try_charge_memcg+0x10/0x10 [ 952.560171][T26617] ? __alloc_pages_noprof+0x31f/0x7b0 [ 952.560203][T26617] __mem_cgroup_charge+0xf6/0x410 [ 952.560234][T26617] ? filemap_get_entry+0x3fb/0x460 [ 952.560263][T26617] ? __cfi___mem_cgroup_charge+0x10/0x10 [ 952.560296][T26617] filemap_add_folio+0x57/0x2d0 [ 952.560328][T26617] __filemap_get_folio+0x5cb/0xaa0 [ 952.560357][T26617] ? __vfs_getxattr+0xaf/0x450 [ 952.560387][T26617] ? __cfi___filemap_get_folio+0x10/0x10 [ 952.560415][T26617] ? __kasan_check_write+0x18/0x20 [ 952.560448][T26617] ? noop_dirty_folio+0x81/0xa0 [ 952.560468][T26617] ? inode_to_bdi+0x6d/0x100 [ 952.560500][T26617] simple_write_begin+0x60/0x390 [ 952.560526][T26617] generic_perform_write+0x32d/0x960 [ 952.560561][T26617] ? __cfi_generic_perform_write+0x10/0x10 [ 952.560593][T26617] ? generic_write_checks_count+0x429/0x540 [ 952.560620][T26617] ? file_update_time+0xa3/0x220 [ 952.560649][T26617] __generic_file_write_iter+0xcf/0x180 [ 952.560681][T26617] generic_file_write_iter+0x110/0x430 [ 952.560714][T26617] ? __cfi_generic_file_write_iter+0x10/0x10 [ 952.560746][T26617] ? gup_must_unshare+0x1e0/0x1e0 [ 952.560775][T26617] ? vma_is_secretmem+0x11/0x50 [ 952.560805][T26617] ? __get_user_pages+0x2034/0x22d0 [ 952.560833][T26617] ? __kasan_check_write+0x18/0x20 [ 952.560875][T26617] ? __cfi_generic_file_write_iter+0x10/0x10 [ 952.560907][T26617] __kernel_write_iter+0x41d/0x8e0 [ 952.560928][T26617] ? __cfi_generic_file_write_iter+0x10/0x10 [ 952.560960][T26617] ? __cfi___kernel_write_iter+0x10/0x10 [ 952.560980][T26617] ? get_dump_page+0x160/0x220 [ 952.561008][T26617] ? __asan_memset+0x39/0x50 [ 952.561040][T26617] ? iov_iter_bvec+0xc0/0x180 [ 952.561067][T26617] dump_user_range+0xb06/0xdf0 [ 952.561089][T26617] ? __cfi_dump_emit+0x10/0x10 [ 952.561141][T26617] ? __cfi_dump_user_range+0x10/0x10 [ 952.561163][T26617] ? elf_coredump_extra_notes_write+0x42f/0x4c0 [ 952.561198][T26617] ? __cfi_elf_coredump_extra_notes_write+0x10/0x10 [ 952.561235][T26617] elf_core_dump+0x2ccc/0x3800 [ 952.561266][T26617] ? __cfi_elf_core_dump+0x10/0x10 [ 952.561307][T26617] ? dump_interrupted+0xf0/0xf0 [ 952.561341][T26617] ? filp_open+0x182/0x1d0 [ 952.561370][T26617] ? 0xffffffffff600000 [ 952.561388][T26617] ? freezing_slow_path+0x12b/0x170 [ 952.561422][T26617] do_coredump+0x1bf7/0x2bd0 [ 952.561459][T26617] ? __cfi_do_coredump+0x10/0x10 [ 952.561493][T26617] ? asm_exc_page_fault+0x2b/0x30 [ 952.561524][T26617] ? __kasan_slab_free+0x6a/0x80 [ 952.561550][T26617] ? kmem_cache_free+0x1c1/0x510 [ 952.561573][T26617] ? get_signal+0xa75/0x14f0 [ 952.561604][T26617] get_signal+0x11fd/0x14f0 [ 952.561637][T26617] arch_do_signal_or_restart+0x96/0x720 [ 952.561673][T26617] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 952.561713][T26617] irqentry_exit_to_user_mode+0x4e/0xb0 [ 952.561737][T26617] irqentry_exit+0x16/0x60 [ 952.561759][T26617] exc_page_fault+0x66/0xc0 [ 952.561780][T26617] asm_exc_page_fault+0x2b/0x30 [ 952.561802][T26617] RIP: 0033:0x7f0bae84f987 [ 952.561820][T26617] Code: 88 15 72 5d ec 00 88 05 6f 5d ec 00 c3 50 48 8d 35 19 26 1c 00 48 8d 3d 1f 26 1c 00 31 c0 e8 20 f7 ff ff 53 89 fb 48 83 ec 10 <64> 8b 04 25 94 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8 [ 952.561842][T26617] RSP: 002b:00007f0baf7f2120 EFLAGS: 00010202 [ 952.561870][T26617] RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007f0bae98eec9 [ 952.561887][T26617] RDX: 00007f0baf7f2140 RSI: 00007f0baf7f2270 RDI: 000000000000000b [ 952.561903][T26617] RBP: 00007f0baea11f91 R08: 0000000000000000 R09: 0000000000000000 [ 952.561920][T26617] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 952.561936][T26617] R13: 00007f0baebe6128 R14: 00007f0baebe6090 R15: 00007fffa2f085a8 [ 952.561957][T26617] [ 952.562014][T26617] memory: usage 307200kB, limit 307200kB, failcnt 495 [ 953.044170][T26617] memory+swap: usage 308532kB, limit 9007199254740988kB, failcnt 0 [ 953.052229][T26617] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 953.059149][T26617] Memory cgroup stats for /syz7: [ 953.059293][T26617] cache 314564608 [ 953.068179][T26617] rss 4096 [ 953.071276][T26617] rss_huge 0 [ 953.076580][T26617] shmem 0 [ 953.079546][T26617] mapped_file 0 [ 953.083021][T26617] dirty 0 [ 953.086014][T26617] writeback 0 [ 953.087702][T26688] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 953.089311][T26617] workingset_refault_anon 8 [ 953.089326][T26617] workingset_refault_file 0 [ 953.089336][T26617] swap 1363968 [ 953.108478][T26617] swapcached 8192 [ 953.112118][T26617] pgpgin 157100 [ 953.116125][T26617] pgpgout 80811 [ 953.119692][T26617] pgfault 74029 [ 953.123193][T26617] pgmajfault 1659 [ 953.127066][T26617] inactive_anon 8192 [ 953.130991][T26617] active_anon 0 [ 953.134457][T26617] inactive_file 0 [ 953.138360][T26617] active_file 0 [ 953.141828][T26617] unevictable 314564608 [ 953.146197][T26617] hierarchical_memory_limit 314572800 [ 953.151705][T26617] hierarchical_memsw_limit 9223372036854771712 [ 953.158599][T26617] total_cache 314564608 [ 953.162775][T26617] total_rss 4096 [ 953.167429][T26617] total_rss_huge 0 [ 953.171175][T26617] total_shmem 0 [ 953.174647][T26617] total_mapped_file 0 [ 953.179704][T26617] total_dirty 0 [ 953.183177][T26617] total_writeback 0 [ 953.187152][T26617] total_workingset_refault_anon 8 [ 953.192192][T26617] total_workingset_refault_file 0 [ 953.197422][T26617] total_swap 1363968 [ 953.201376][T26617] total_swapcached 8192 [ 953.205740][T26617] total_pgpgin 157100 [ 953.210159][T26617] total_pgpgout 80811 [ 953.214909][T26617] total_pgfault 74029 [ 953.218912][T26617] total_pgmajfault 1659 [ 953.223078][T26617] total_inactive_anon 8192 [ 953.229270][T26617] total_active_anon 0 [ 953.234880][T26617] total_inactive_file 0 [ 953.239053][T26617] total_active_file 0 [ 953.243043][T26617] total_unevictable 314564608 [ 953.248104][T26617] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz7,mems_allowed=0,oom_memcg=/syz7,task_memcg=/syz7,task=syz.7.8853,pid=26623,uid=0 [ 953.263372][T26617] Memory cgroup out of memory: Killed process 26623 (syz.7.8853) total-vm:90164kB, anon-rss:1272kB, file-rss:57676kB, shmem-rss:0kB, UID:0 pgtables:188kB oom_score_adj:0 [ 953.380953][T26622] syz.7.8853 invoked oom-killer: gfp_mask=0x100cc2(GFP_HIGHUSER), order=0, oom_score_adj=0 [ 953.404778][T26622] CPU: 1 UID: 0 PID: 26622 Comm: syz.7.8853 Not tainted syzkaller #0 658fd523d4664e50339751640158cdc1077a64d7 [ 953.404817][T26622] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 953.404832][T26622] Call Trace: [ 953.404841][T26622] [ 953.404851][T26622] __dump_stack+0x21/0x30 [ 953.404888][T26622] dump_stack_lvl+0x10c/0x190 [ 953.404920][T26622] ? __cfi_dump_stack_lvl+0x10/0x10 [ 953.404952][T26622] ? ___ratelimit+0x3f7/0x5a0 [ 953.404986][T26622] dump_stack+0x19/0x20 [ 953.405015][T26622] dump_header+0xd7/0x490 [ 953.405038][T26622] ? __cfi_mem_cgroup_get_max+0x10/0x10 [ 953.405068][T26622] oom_kill_process+0x35d/0x640 [ 953.405096][T26622] ? sched_clock_cpu+0x75/0x400 [ 953.405129][T26622] out_of_memory+0x659/0xa80 [ 953.405158][T26622] ? __cfi_out_of_memory+0x10/0x10 [ 953.405186][T26622] ? mutex_lock_killable+0x92/0x1c0 [ 953.405221][T26622] ? __cfi_mutex_lock_killable+0x10/0x10 [ 953.405256][T26622] mem_cgroup_out_of_memory+0x279/0x350 [ 953.405280][T26622] ? drain_obj_stock+0xed0/0xed0 [ 953.405304][T26622] ? memcg1_oom_prepare+0x2c6/0x3a0 [ 953.405326][T26622] try_charge_memcg+0x8f7/0xde0 [ 953.405358][T26622] ? gfp_to_alloc_flags_cma+0x90/0x1c0 [ 953.405383][T26622] ? __cfi_try_charge_memcg+0x10/0x10 [ 953.405416][T26622] ? __alloc_pages_noprof+0x31f/0x7b0 [ 953.405450][T26622] __mem_cgroup_charge+0xf6/0x410 [ 953.405485][T26622] ? filemap_get_entry+0x3fb/0x460 [ 953.405515][T26622] ? __cfi___mem_cgroup_charge+0x10/0x10 [ 953.405551][T26622] filemap_add_folio+0x57/0x2d0 [ 953.405579][T26622] __filemap_get_folio+0x5cb/0xaa0 [ 953.405610][T26622] ? __vfs_getxattr+0xaf/0x450 [ 953.405642][T26622] ? __cfi___filemap_get_folio+0x10/0x10 [ 953.405672][T26622] ? __kasan_check_write+0x18/0x20 [ 953.405708][T26622] ? noop_dirty_folio+0x81/0xa0 [ 953.405730][T26622] ? inode_to_bdi+0x6d/0x100 [ 953.405764][T26622] simple_write_begin+0x60/0x390 [ 953.405801][T26622] generic_perform_write+0x32d/0x960 [ 953.405839][T26622] ? __cfi_generic_perform_write+0x10/0x10 [ 953.405874][T26622] ? generic_write_checks_count+0x429/0x540 [ 953.405914][T26622] ? file_update_time+0xa3/0x220 [ 953.405944][T26622] __generic_file_write_iter+0xcf/0x180 [ 953.405977][T26622] generic_file_write_iter+0x110/0x430 [ 953.406011][T26622] ? __cfi_generic_file_write_iter+0x10/0x10 [ 953.406045][T26622] ? gup_must_unshare+0x1e0/0x1e0 [ 953.406075][T26622] ? __schedule+0x132a/0x1df0 [ 953.406104][T26622] ? vma_is_secretmem+0x11/0x50 [ 953.406135][T26622] ? __get_user_pages+0x2034/0x22d0 [ 953.406163][T26622] ? __kasan_check_write+0x18/0x20 [ 953.406200][T26622] ? __cfi_generic_file_write_iter+0x10/0x10 [ 953.406232][T26622] __kernel_write_iter+0x41d/0x8e0 [ 953.406254][T26622] ? __cfi_generic_file_write_iter+0x10/0x10 [ 953.406288][T26622] ? __cfi___kernel_write_iter+0x10/0x10 [ 953.406310][T26622] ? get_dump_page+0x160/0x220 [ 953.406339][T26622] ? __asan_memset+0x39/0x50 [ 953.406372][T26622] ? iov_iter_bvec+0xc0/0x180 [ 953.406400][T26622] dump_user_range+0xb06/0xdf0 [ 953.406423][T26622] ? __cfi_dump_emit+0x10/0x10 [ 953.406458][T26622] ? __cfi_dump_user_range+0x10/0x10 [ 953.406479][T26622] ? elf_coredump_extra_notes_write+0x42f/0x4c0 [ 953.406514][T26622] ? __cfi_elf_coredump_extra_notes_write+0x10/0x10 [ 953.406550][T26622] elf_core_dump+0x2ccc/0x3800 [ 953.406580][T26622] ? __cfi_elf_core_dump+0x10/0x10 [ 953.406615][T26622] ? dump_interrupted+0xf0/0xf0 [ 953.406649][T26622] ? filp_open+0x182/0x1d0 [ 953.406677][T26622] ? 0xffffffffff600000 [ 953.406693][T26622] ? freezing_slow_path+0x12b/0x170 [ 953.406725][T26622] do_coredump+0x1bf7/0x2bd0 [ 953.406762][T26622] ? __cfi_do_coredump+0x10/0x10 [ 953.406803][T26622] ? asm_exc_page_fault+0x2b/0x30 [ 953.406833][T26622] ? __kasan_slab_free+0x6a/0x80 [ 953.406859][T26622] ? kmem_cache_free+0x1c1/0x510 [ 953.406881][T26622] ? get_signal+0xa75/0x14f0 [ 953.406911][T26622] get_signal+0x11fd/0x14f0 [ 953.406942][T26622] arch_do_signal_or_restart+0x96/0x720 [ 953.406977][T26622] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 953.407015][T26622] irqentry_exit_to_user_mode+0x4e/0xb0 [ 953.407039][T26622] irqentry_exit+0x16/0x60 [ 953.407059][T26622] exc_page_fault+0x66/0xc0 [ 953.407080][T26622] asm_exc_page_fault+0x2b/0x30 [ 953.407101][T26622] RIP: 0033:0x7f0bae84f987 [ 953.407120][T26622] Code: 88 15 72 5d ec 00 88 05 6f 5d ec 00 c3 50 48 8d 35 19 26 1c 00 48 8d 3d 1f 26 1c 00 31 c0 e8 20 f7 ff ff 53 89 fb 48 83 ec 10 <64> 8b 04 25 94 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8 [ 953.407143][T26622] RSP: 002b:00007f0baf7f2120 EFLAGS: 00010202 [ 953.407164][T26622] RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007f0bae98eec9 [ 953.407181][T26622] RDX: 00007f0baf7f2140 RSI: 00007f0baf7f2270 RDI: 000000000000000b [ 953.407198][T26622] RBP: 00007f0baea11f91 R08: 0000000000000000 R09: 0000000000000000 [ 953.407213][T26622] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 953.407228][T26622] R13: 00007f0baebe6128 R14: 00007f0baebe6090 R15: 00007fffa2f085a8 [ 953.407249][T26622] [ 953.897179][T26622] memory: usage 303728kB, limit 307200kB, failcnt 2030 [ 953.904052][T26622] memory+swap: usage 303444kB, limit 9007199254740988kB, failcnt 0 [ 953.912277][T26622] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 953.919308][T26622] Memory cgroup stats for /syz7: [ 953.919459][T26622] cache 306446336 [ 953.928263][T26622] rss 0 [ 953.931039][T26622] rss_huge 0 [ 953.934250][T26622] shmem 0 [ 953.937448][T26622] mapped_file 0 [ 953.940927][T26622] dirty 0 [ 953.943879][T26622] writeback 0 [ 953.947429][T26622] workingset_refault_anon 8 [ 953.951952][T26622] workingset_refault_file 0 [ 953.956659][T26622] swap 1359872 [ 953.960042][T26622] swapcached 0 [ 953.963425][T26622] pgpgin 157102 [ 953.967166][T26622] pgpgout 82766 [ 953.970653][T26622] pgfault 74029 [ 953.974127][T26622] pgmajfault 1659 [ 953.978024][T26622] inactive_anon 0 [ 953.981675][T26622] active_anon 0 [ 953.985354][T26622] inactive_file 0 [ 953.989004][T26622] active_file 0 [ 953.992474][T26622] unevictable 306573312 [ 953.996923][T26622] hierarchical_memory_limit 314572800 [ 954.002303][T26622] hierarchical_memsw_limit 9223372036854771712 [ 954.008686][T26622] total_cache 306446336 [ 954.012877][T26622] total_rss 0 [ 954.016379][T26622] total_rss_huge 0 [ 954.020216][T26622] total_shmem 0 [ 954.023701][T26622] total_mapped_file 0 [ 954.028320][T26622] total_dirty 0 [ 954.031802][T26622] total_writeback 0 [ 954.035879][T26622] total_workingset_refault_anon 8 [ 954.040921][T26622] total_workingset_refault_file 0 [ 954.046137][T26622] total_swap 1359872 [ 954.050044][T26622] total_swapcached 0 [ 954.053955][T26622] total_pgpgin 157102 [ 954.058224][T26622] total_pgpgout 82766 [ 954.062220][T26622] total_pgfault 74029 [ 954.066425][T26622] total_pgmajfault 1659 [ 954.070606][T26622] total_inactive_anon 0 [ 954.074963][T26622] total_active_anon 0 [ 954.078962][T26622] total_inactive_file 0 [ 954.083126][T26622] total_active_file 0 [ 954.087385][T26622] total_unevictable 306573312 [ 954.092082][T26622] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz7,mems_allowed=0,oom_memcg=/syz7,task_memcg=/syz7,task=syz.7.8853,pid=26622,uid=0 [ 954.107250][T26622] Memory cgroup out of memory: Killed process 26622 (syz.7.8853) total-vm:90164kB, anon-rss:1272kB, file-rss:57676kB, shmem-rss:0kB, UID:0 pgtables:188kB oom_score_adj:0 [ 954.373278][T26699] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=258 sclass=netlink_route_socket pid=26699 comm=syz.4.8870 [ 954.386927][T26699] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=27 sclass=netlink_route_socket pid=26699 comm=syz.4.8870 [ 954.400026][T26699] rust_binder: Error while translating object. [ 954.400073][T26699] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 954.409628][T26699] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:511 [ 954.777116][T26717] rust_binder: Write failure EINVAL in pid:391 [ 954.810350][T26719] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:393 [ 954.930284][T26738] 9pnet_fd: Insufficient options for proto=fd [ 954.955931][T26743] overlayfs: failed to clone upperpath [ 955.262842][ T36] audit: type=1326 audit(956.249:5135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=26791 comm="syz.7.8890" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0bae98eec9 code=0x6fff0000 [ 955.872116][T26813] FAT-fs (rnullb0): bogus number of reserved sectors [ 955.878948][T26813] FAT-fs (rnullb0): Can't find a valid FAT filesystem [ 955.885981][T26816] FAT-fs (rnullb0): bogus number of reserved sectors [ 955.892683][T26816] FAT-fs (rnullb0): Can't find a valid FAT filesystem [ 956.012964][ T36] audit: type=1400 audit(956.999:5136): avc: denied { accept } for pid=26821 comm="syz.4.8901" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 956.068039][T26822] rust_binder: Error in use_page_slow: ESRCH [ 956.068058][T26822] rust_binder: use_range failure ESRCH [ 956.074293][T26822] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 956.080122][T26822] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 956.088176][T26822] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:538 [ 956.215941][T26832] rust_binder: BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 956.233920][T26833] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 956.502162][ T36] audit: type=1326 audit(957.489:5137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=26841 comm="syz.4.8906" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5028d8eec9 code=0x0 [ 956.716368][T26850] fuse: Bad value for 'group_id' [ 956.721563][T26850] fuse: Bad value for 'group_id' [ 956.804070][T26855] overlayfs: failed to clone upperpath [ 957.296351][T26859] 9pnet_fd: Insufficient options for proto=fd [ 957.385138][T26863] /dev/loop0: Can't lookup blockdev [ 957.919672][T26886] netlink: 3657 bytes leftover after parsing attributes in process `syz.6.8923'. [ 957.951519][T26888] ------------[ cut here ]------------ [ 957.957034][T26888] WARNING: CPU: 1 PID: 26888 at mm/page_alloc.c:5228 __alloc_pages_noprof+0xe8/0x7b0 [ 957.966586][T26888] Modules linked in: [ 957.970503][T26888] CPU: 1 UID: 0 PID: 26888 Comm: syz.6.8924 Not tainted syzkaller #0 658fd523d4664e50339751640158cdc1077a64d7 [ 957.982386][T26888] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 957.992603][T26888] RIP: 0010:__alloc_pages_noprof+0xe8/0x7b0 [ 957.998556][T26888] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d 22 1f ee 05 00 0f 85 be 00 00 00 c6 05 15 1f ee 05 01 <0f> 0b 31 c0 e9 b0 00 00 00 83 fb 0a 0f 87 a5 00 00 00 44 8b 64 24 [ 958.018242][T26888] RSP: 0018:ffffc9000446f560 EFLAGS: 00010246 [ 958.024371][T26888] RAX: 0000000000000000 RBX: 0000000000000016 RCX: 0000000000000000 [ 958.032400][T26888] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000446f618 [ 958.040435][T26888] RBP: ffffc9000446f6a0 R08: ffffc9000446f617 R09: 0000000000000000 [ 958.048501][T26888] R10: ffffc9000446f600 R11: fffff5200088dec3 R12: ffffc9000446f5a0 [ 958.049234][T26890] rust_binder: Write failure EFAULT in pid:406 [ 958.056539][T26888] R13: dffffc0000000000 R14: 1ffff9200088deb0 R15: 0000000000000000 [ 958.056568][T26888] FS: 00007eff6aa4b6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 958.079695][T26888] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 958.086322][T26888] CR2: 0000200000001000 CR3: 000000013dad2000 CR4: 00000000003526b0 [ 958.094327][T26888] Call Trace: [ 958.097666][T26888] [ 958.100612][T26888] ? vfs_write+0x3bd/0xf30 [ 958.105122][T26888] ? ksys_write+0x141/0x250 [ 958.109652][T26888] ? x64_sys_call+0x271c/0x2ee0 [ 958.114598][T26888] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 958.120393][T26888] ? hashtab_init+0xdb/0x1f0 [ 958.125064][T26888] ___kmalloc_large_node+0x81/0x220 [ 958.130285][T26888] ? hashtab_init+0xdb/0x1f0 [ 958.134916][T26888] __kmalloc_large_node_noprof+0x1e/0xe0 [ 958.140579][T26888] ? hashtab_init+0xdb/0x1f0 [ 958.145211][T26888] __kmalloc_noprof+0x26d/0x450 [ 958.150113][T26888] hashtab_init+0xdb/0x1f0 [ 958.154550][T26888] ? class_read+0x162/0x8a0 [ 958.159115][T26888] symtab_init+0x44/0x70 [ 958.163378][T26888] class_read+0x1df/0x8a0 [ 958.167762][T26888] ? __cfi_class_read+0x10/0x10 [ 958.172673][T26888] ? hashtab_init+0x105/0x1f0 [ 958.177396][T26888] policydb_read+0xaa8/0x28c0 [ 958.182126][T26888] ? kasan_save_alloc_info+0x40/0x50 [ 958.187544][T26888] ? __cfi_policydb_read+0x10/0x10 [ 958.192700][T26888] ? security_load_policy+0x128/0x12f0 [ 958.198204][T26888] security_load_policy+0x162/0x12f0 [ 958.203525][T26888] ? irqentry_exit+0x4a/0x60 [ 958.208165][T26888] ? exc_page_fault+0x66/0xc0 [ 958.212868][T26888] ? asm_exc_page_fault+0x2b/0x30 [ 958.217925][T26888] ? __cfi_security_load_policy+0x10/0x10 [ 958.223667][T26888] ? rep_movs_alternative+0x4a/0xa0 [ 958.228893][T26888] sel_write_load+0x298/0x5e0 [ 958.233593][T26888] ? futex_wait+0x29a/0x7a0 [ 958.238175][T26888] ? __cfi_sel_write_load+0x10/0x10 [ 958.243405][T26888] ? __cfi_futex_wait+0x10/0x10 [ 958.248309][T26888] ? bpf_lsm_file_permission+0xd/0x20 [ 958.253745][T26888] ? __cfi_sel_write_load+0x10/0x10 [ 958.259001][T26888] vfs_write+0x3bd/0xf30 [ 958.263285][T26888] ? __cfi_vfs_write+0x10/0x10 [ 958.268191][T26888] ? __kasan_check_write+0x18/0x20 [ 958.273342][T26888] ? mutex_lock+0x92/0x1c0 [ 958.278019][T26888] ? __cfi_mutex_lock+0x10/0x10 [ 958.282938][T26888] ? __fget_files+0x2c5/0x340 [ 958.287667][T26888] ksys_write+0x141/0x250 [ 958.292025][T26888] ? __cfi_ksys_write+0x10/0x10 [ 958.296968][T26888] ? __kasan_check_write+0x18/0x20 [ 958.302114][T26888] ? fpregs_restore_userregs+0x11d/0x260 [ 958.307781][T26888] __x64_sys_write+0x7f/0x90 [ 958.312397][T26888] x64_sys_call+0x271c/0x2ee0 [ 958.317123][T26888] do_syscall_64+0x58/0xf0 [ 958.321563][T26888] ? clear_bhb_loop+0x50/0xa0 [ 958.326293][T26888] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 958.332226][T26888] RIP: 0033:0x7eff69b8eec9 [ 958.336664][T26888] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 958.356356][T26888] RSP: 002b:00007eff6aa4b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 958.365056][T26888] RAX: ffffffffffffffda RBX: 00007eff69de5fa0 RCX: 00007eff69b8eec9 [ 958.373152][T26888] RDX: 0000000000002000 RSI: 0000200000000000 RDI: 0000000000000009 [ 958.381179][T26888] RBP: 00007eff69c11f91 R08: 0000000000000000 R09: 0000000000000000 [ 958.389281][T26888] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 958.397460][T26888] R13: 00007eff69de6038 R14: 00007eff69de5fa0 R15: 00007fff742567b8 [ 958.405478][T26888] [ 958.408528][T26888] ---[ end trace 0000000000000000 ]--- [ 958.423758][T26888] SELinux: failed to load policy