last executing test programs: 25.669803371s ago: executing program 2 (id=608): r0 = socket$can_raw(0x1d, 0x3, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000000380)={0xa, 0x14e24}, 0x1c) connect$inet6(r4, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000000d80)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000940)="cedd58d33155c2282718421d8a7f2c9fc0e9f67215bc2fa3be1778c6505a45e10a0c45b5502a8eccbc26cb3fd967b930842e300eb1d7aa377188a753b91b4d497aeb4d7547a3768d45fa27", 0x4b}, {0x0}, {&(0x7f0000000c80)}], 0x3, &(0x7f0000000200)=ANY=[], 0x18}}], 0x2, 0xc8040) sendmmsg(r4, &(0x7f00000092c0), 0x4ff, 0x0) splice(r4, 0x0, r3, 0x0, 0x7ffff000, 0x6) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000006c0), 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) io_setup(0xe4, &(0x7f0000000000)=0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r9, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r9, 0x890b, &(0x7f0000000240)={@mcast2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @dev={0xfe, 0x80, '\x00', 0x36}, 0x1, 0x6, 0x0, 0x100, 0x4, 0x86020086, r10}) ioctl$sock_inet6_SIOCADDRT(r8, 0x890b, &(0x7f0000000800)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private2, @private0, 0x1, 0x6, 0x0, 0x100, 0x6, 0x180107, r10}) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x2c, 0x0, 0xb08, 0x70bd25, 0x25dfdbfb, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x100}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0xc0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f0000000440)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010028bd7000fcdbdf250a009513d0db2c000300000005002e000100000005000008003c000300000008003100e773000008003c0001000000050037000100000008000b00040000004b8b88654fae7d4311886cb6dc752e415408cefbb64f505e32a2ed746909bf82266981002439b8e8f671482c7ff6c935e4123ddf194df893a77b1ae698e01da8c9b122d2d0537b3a7eb8f27d8aa44abc2134"], 0x5c}, 0x1, 0x0, 0x0, 0x10}, 0x24000000) io_destroy(r7) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) r11 = getpid() r12 = syz_pidfd_open(r11, 0x0) setns(r12, 0x24020000) setxattr$system_posix_acl(&(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000680)={{}, {}, [], {}, [], {0x10, 0x7}, {0x20, 0x2}}, 0x1c, 0x0) getsockopt$inet6_buf(r6, 0x29, 0x21, 0x0, &(0x7f0000000000)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000000)={{0xffffffffffffffff, 0x2, 0x9, 0x3, 0x1000}}) sendmsg$DEVLINK_CMD_RATE_GET(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x14, r2, 0x6a9354ab0d020bb7, 0x0, 0x0, {0x2a}}, 0x14}}, 0x0) splice(r0, &(0x7f0000000080)=0x1d32, r1, &(0x7f00000000c0)=0x6, 0x2, 0xe) 25.646983173s ago: executing program 2 (id=610): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000006240)={0x0, 0x0, &(0x7f0000006200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001b0001e328bd7000fbdbdf25fe"], 0x14}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) r2 = dup(0xffffffffffffffff) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x4000, &(0x7f0000001200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@debug={'debug', 0x3d, 0x7}}]}}) ioctl$BLKGETZONESZ(r2, 0x80041284, &(0x7f0000000000)=0x80000001) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8, 0x4010, r3, 0xacafb000) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x0, 0x80000000003}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x16}, @ptr={0x70742a85, 0xfffffffc, &(0x7f00000029c0)=""/193, 0xc1, 0x1, 0x14}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0x1d}}, &(0x7f0000000180)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0}) 25.615349954s ago: executing program 2 (id=611): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) (async, rerun: 64) r1 = socket$inet6(0xa, 0x2, 0x0) (rerun: 64) setsockopt$inet6_mreq(r1, 0x29, 0x1d, &(0x7f0000000040)={@mcast2}, 0x14) (async) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) (async) syz_usb_connect(0x2, 0x36, &(0x7f0000000000)=ANY=[], 0x0) 25.093353719s ago: executing program 2 (id=615): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$cgroup2(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f00000004c0), 0x800010, 0x0) (async) chroot(&(0x7f0000000100)='./file0\x00') (async) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2a05004, 0x0) (async) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000240)='./file0/../file0\x00') (async) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x0, @any, 0x0, 0x2}, 0xe) (async) setsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000040)=0x6, 0x2) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000300)={@flat=@weak_handle={0x77682a85, 0x0, 0x3}, @flat=@weak_binder={0x77622a85, 0x100a, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/12, 0xc, 0x1, 0x36}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) 25.021921864s ago: executing program 2 (id=617): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0xc00, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x138a, 0x1000000003}) (async) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x2, 0x1, 0x0, &(0x7f0000000180)=""/38, 0x0, 0x6000}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x0, 0x0, &(0x7f0000000300)=""/75, 0x0, 0xeeef0000}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000001980)={0x2, 0x0, [{0xffff1000, 0x38, &(0x7f0000000440)=""/56}, {0x2, 0x1000, &(0x7f0000000580)=""/4096}]}) (async) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0xfffffffe) (async) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af04, &(0x7f0000000400)) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, 0x0}) 24.820929787s ago: executing program 2 (id=622): splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x10500, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000280)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000040)='net/igmp\x00') r2 = userfaultfd(0x801) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000019800)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYRES32=r2], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r7, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r10, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r9, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) fcntl$dupfd(r2, 0x0, r2) ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f00000001c0)={0xcb80000000000000, 0xdddd1000, 0x6, 0x0, 0x7}) getdents64(r1, 0x0, 0x0) unshare(0x64000400) r11 = syz_open_procfs(0x0, &(0x7f0000000180)='smaps\x00') epoll_ctl$EPOLL_CTL_MOD(r11, 0x3, r1, &(0x7f000000af40)={0xa000000a}) ioctl$SIOCGSTAMP(r8, 0x8906, &(0x7f00000000c0)) r12 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r12, 0x0, 0x0) sendmsg$can_bcm(r12, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x881}, 0x5e34c3cf0595153b) socket$inet_icmp(0x2, 0x2, 0x1) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 24.7701202s ago: executing program 32 (id=622): splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x10500, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000280)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000040)='net/igmp\x00') r2 = userfaultfd(0x801) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000019800)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYRES32=r2], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r7, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r10, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r9, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) fcntl$dupfd(r2, 0x0, r2) ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f00000001c0)={0xcb80000000000000, 0xdddd1000, 0x6, 0x0, 0x7}) getdents64(r1, 0x0, 0x0) unshare(0x64000400) r11 = syz_open_procfs(0x0, &(0x7f0000000180)='smaps\x00') epoll_ctl$EPOLL_CTL_MOD(r11, 0x3, r1, &(0x7f000000af40)={0xa000000a}) ioctl$SIOCGSTAMP(r8, 0x8906, &(0x7f00000000c0)) r12 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r12, 0x0, 0x0) sendmsg$can_bcm(r12, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x881}, 0x5e34c3cf0595153b) socket$inet_icmp(0x2, 0x2, 0x1) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 10.287269063s ago: executing program 4 (id=623): r0 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{}, {0x0, 0x989680}}, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x101842, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000140)=0x4) ioctl$PPPIOCSNPMODE(r5, 0x4008744b, &(0x7f0000001600)={0x29, 0x1}) close(r3) r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x3, 0x3, 0x3, 0x1, {0xa, 0x4e24, 0x40, @private0, 0x3a70}}}, 0x32) ioctl$PPPIOCGCHAN(r6, 0x80047437, &(0x7f0000000040)) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f0000000300)=@gcm_128={{0x303}, "fc674d000000f8f7", "c5991ee20139b401046a89606ffcf92e", "2c5be7c6", "a0ca05c0707e52f4"}, 0x28) recvfrom$inet6(r2, &(0x7f00000000c0)=""/3, 0x3, 0x0, 0x0, 0x0) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)=0x0) timer_settime(r8, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) splice(r2, 0x0, r1, 0x0, 0x10000008ebc, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r9 = syz_open_procfs(0x0, &(0x7f0000000080)='mounts\x00') ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) mount$binderfs(0x0, 0x0, 0x0, 0x11084, &(0x7f0000000100)=ANY=[]) ioctl$SIOCGETSGCNT(r9, 0x89e1, &(0x7f00000000c0)={@private=0xa010101, @loopback}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000200)='affs\x00', 0x1004, &(0x7f0000000240)='\xcc\x00\x00\x00\x00\x00\x00\x81C\xd4\xb8\x89l}\xe3\xa1l;\xba\xb4\x02w\xe8>\xe2a_P<\xf4\x9d\xad_\xa3\x0f\xd5\xad\x1b') 8.35647475s ago: executing program 4 (id=623): r0 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{}, {0x0, 0x989680}}, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x101842, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000140)=0x4) ioctl$PPPIOCSNPMODE(r5, 0x4008744b, &(0x7f0000001600)={0x29, 0x1}) close(r3) r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x3, 0x3, 0x3, 0x1, {0xa, 0x4e24, 0x40, @private0, 0x3a70}}}, 0x32) ioctl$PPPIOCGCHAN(r6, 0x80047437, &(0x7f0000000040)) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f0000000300)=@gcm_128={{0x303}, "fc674d000000f8f7", "c5991ee20139b401046a89606ffcf92e", "2c5be7c6", "a0ca05c0707e52f4"}, 0x28) recvfrom$inet6(r2, &(0x7f00000000c0)=""/3, 0x3, 0x0, 0x0, 0x0) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)=0x0) timer_settime(r8, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) splice(r2, 0x0, r1, 0x0, 0x10000008ebc, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r9 = syz_open_procfs(0x0, &(0x7f0000000080)='mounts\x00') ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) mount$binderfs(0x0, 0x0, 0x0, 0x11084, &(0x7f0000000100)=ANY=[]) ioctl$SIOCGETSGCNT(r9, 0x89e1, &(0x7f00000000c0)={@private=0xa010101, @loopback}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000200)='affs\x00', 0x1004, &(0x7f0000000240)='\xcc\x00\x00\x00\x00\x00\x00\x81C\xd4\xb8\x89l}\xe3\xa1l;\xba\xb4\x02w\xe8>\xe2a_P<\xf4\x9d\xad_\xa3\x0f\xd5\xad\x1b') 6.491440733s ago: executing program 1 (id=716): socket$key(0xf, 0x3, 0x2) r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f00002e3000/0x2000)=nil, 0x2000, 0x0, 0x11012, r0, 0x10c000) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070296d1ca000905060200020d0006090582220002000110"], 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000900)={0x84, &(0x7f00000003c0)={0x0, 0x17, 0x4, "abe763a8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000740)={0x44, &(0x7f0000000180)=ANY=[@ANYBLOB="60100400"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_int(r2, 0x1, 0x2b, 0x0, &(0x7f0000000580)) syz_usb_control_io$sierra_net(r1, &(0x7f0000000040)={0x14, &(0x7f0000000280)={0x20, 0x21, 0x97, {0x97, 0x5, "732c1e7cb03d8a866ead0c1c16f32d93d57176f6c1ecfcca36418d88abaf7c6ae7f580ac59ab1cd8ceecb68bf967eaa652c1d7bbea80315f035e9430890625e37fd1f4907b893b57960c7cdee57f5be2c92fb2c759adc576d7a8ec63764e5b5f56693dad786e1698dda33ab05195a31084e5e5dea059c287173472d7a2e43348d0e9709d23b2dd5e4c4a97bf7f4a0769d5c35f8e66"}}, &(0x7f0000000000)={0x0, 0x3, 0x18, @string={0x18, 0x3, "d7eaea393e64129ea0bb672f77aa07522272d2176fb8"}}}, &(0x7f0000000880)={0x1c, &(0x7f0000000340)={0x20, 0x6, 0x9e, "7ace35ac59f685de6dbb1b889af621341581ca0f2eb8b165d53ec207b4c7fccee42270ee9387411961747e8295196d128044eae12a3e9dd45b6c0c5b3381c6b41fc6544d68083f7dcb5dde3b309029e83cd6af8a5a1cd26f2be47cf0c52ee837fd17e12c8dc797e288e2fadd5316db9d0d9ccb4920e7891e2d452aa25047bae30cd1a07dc12e2a960e19a65f54d6cb740c9b7e4a9c64d5dc19dead74255d"}, &(0x7f0000000400)={0xa1, 0x1, 0x400, "05f41f7c7a5578c65cf940930098d01de474533699bf8280cc2022304680715d9609ccb05729a821c0630de2daeaf8cb15719fc642a8dbf1854c4940162e44853e7da3dd23d33617f39815e9df10777a37c340152328effb8eef0d2afd041f5f4cfbd3647b55ca253073ea91630c725e5e5662c484b1a86dc37d240f148d93fcdbd3b5f1f7e9cb0ea44a0abd314c62f65a5f04c369bbd2da88f5aed056cc89c1d1e696c533f53fb73b113558f8ce8e2981b2b2c73c063c6d1ecca42b09b7439a5cfdc9a6f78ceb4f718d063ca03793bed2838edb21ebfd0fe1d017cd50d1a4fe69805eda98574b205999167d6636944a5c27ec6e3a46ad02473a35c64cc135f8974981def15e88c85b175b1bde6143e7c9dec30c32054ee0b0024b026abc82504f4377b2cbc94989a6afa0f425d6fbfa99ee9fd82c350f277da22d3c94a243a5918c4947b2a61e294ce4a3b27ec3a6b39cd75b4617d425cbbb031dfacebdb1d13dbedb7487facad32fd7c0f79b9b27d13caa471dfb3bd5142d9a48aef0f172a4190054959b6e9ce2ab2790c2afcff5c37385db07136abbe37d5cafeccb64b7f6ea8d7bc33aec0f0189c81c759178d28cd636fb059a13a034b351d779e0739cc3d6daa837a5a9c257f6b9c3c55f1f390ea98bb67b0ccccbae562555020b845904ad660bcff4835f7c9276ea85e0d1168ee094befbaff3c4587b8d1adc3185fce898c42f2bec06a48b3d78ca5eae8997e583f165534d1d4205b820464353db78241456a65aefbae849be0318279f77584e9a6f2b00d1f80f732bf6f75ad831a89c775a1dca6e3a4eb587d178f8b1a03dc2f02ef01f24cc85cc9e7242589cbb70aca7bc53d59c909a82c4fc971d939edb954590f57433097b96f4520806770cf9bedb085b9e47a45d95783b7d2398e9bd8816b8c6973d765f222ef568a6f1f45534401662fedb4a82af7b93458ffd43dfeeba2aa29eeb29e89ef197f31a7ab1d81f87aa9b775b6439d1a79de23b8553d1fa1a389e2de94e1685d41ac9d853f31b14e25e7dae65d8db6ff960e2874e6d7bb363b129748bc75de771404740516992e775765af2f1efaaff6ab1e513abbfaf7e9b4a8c6b322874c258e1a3d315f223f4e34d975ddf396cb493be5ce67be79a4aa8a331c746edcac919d6d169f84376c2cef84ac3581c18680d41735d916c7c04c364c958111b3c95efbc98c5bae799d40b710de17dad94e0e4fa8e21b9dfa2398b6bc885dbea714a8510fe01d916ef2ad9bd43c03e7c93214594462ddd730792ad7ae087d357cbda38a57811c5dc8f4e146000793d5ca0ab07d2a7e76a97a7f20b9b5d79d201153db3988d144cae151cac969e2a99b5fd1776b18e8eb6a28314cacec897b23079666cef4bd32cf8f8ebfb6ecd399b8530c2ad64dd79a749b68e99bd66911820bb59cca94daeec066465"}, &(0x7f0000000840)}) r3 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000080)) ioctl$PAGEMAP_SCAN(r3, 0xc0606610, &(0x7f0000000100)={0x60, 0x0, &(0x7f00001c9000/0x3000)=nil, &(0x7f0000887000/0x2000)=nil, 0xfffffffffffffffd, 0x0, 0x0, 0x6, 0x0, 0xa, 0xe4, 0x76}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000001400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x1, &(0x7f0000001480)=""/4096, 0x1000, 0x1, 0x2}, @fda={0x66646185, 0xa, 0x1000000002, 0x9}, @fd}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}}], 0x0, 0x0, 0x0}) 6.409699868s ago: executing program 4 (id=623): r0 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{}, {0x0, 0x989680}}, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x101842, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000140)=0x4) ioctl$PPPIOCSNPMODE(r5, 0x4008744b, &(0x7f0000001600)={0x29, 0x1}) close(r3) r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x3, 0x3, 0x3, 0x1, {0xa, 0x4e24, 0x40, @private0, 0x3a70}}}, 0x32) ioctl$PPPIOCGCHAN(r6, 0x80047437, &(0x7f0000000040)) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f0000000300)=@gcm_128={{0x303}, "fc674d000000f8f7", "c5991ee20139b401046a89606ffcf92e", "2c5be7c6", "a0ca05c0707e52f4"}, 0x28) recvfrom$inet6(r2, &(0x7f00000000c0)=""/3, 0x3, 0x0, 0x0, 0x0) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)=0x0) timer_settime(r8, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) splice(r2, 0x0, r1, 0x0, 0x10000008ebc, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r9 = syz_open_procfs(0x0, &(0x7f0000000080)='mounts\x00') ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) mount$binderfs(0x0, 0x0, 0x0, 0x11084, &(0x7f0000000100)=ANY=[]) ioctl$SIOCGETSGCNT(r9, 0x89e1, &(0x7f00000000c0)={@private=0xa010101, @loopback}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000200)='affs\x00', 0x1004, &(0x7f0000000240)='\xcc\x00\x00\x00\x00\x00\x00\x81C\xd4\xb8\x89l}\xe3\xa1l;\xba\xb4\x02w\xe8>\xe2a_P<\xf4\x9d\xad_\xa3\x0f\xd5\xad\x1b') 4.41137422s ago: executing program 4 (id=623): r0 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{}, {0x0, 0x989680}}, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x101842, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000140)=0x4) ioctl$PPPIOCSNPMODE(r5, 0x4008744b, &(0x7f0000001600)={0x29, 0x1}) close(r3) r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x3, 0x3, 0x3, 0x1, {0xa, 0x4e24, 0x40, @private0, 0x3a70}}}, 0x32) ioctl$PPPIOCGCHAN(r6, 0x80047437, &(0x7f0000000040)) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f0000000300)=@gcm_128={{0x303}, "fc674d000000f8f7", "c5991ee20139b401046a89606ffcf92e", "2c5be7c6", "a0ca05c0707e52f4"}, 0x28) recvfrom$inet6(r2, &(0x7f00000000c0)=""/3, 0x3, 0x0, 0x0, 0x0) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)=0x0) timer_settime(r8, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) splice(r2, 0x0, r1, 0x0, 0x10000008ebc, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r9 = syz_open_procfs(0x0, &(0x7f0000000080)='mounts\x00') ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) mount$binderfs(0x0, 0x0, 0x0, 0x11084, &(0x7f0000000100)=ANY=[]) ioctl$SIOCGETSGCNT(r9, 0x89e1, &(0x7f00000000c0)={@private=0xa010101, @loopback}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000200)='affs\x00', 0x1004, &(0x7f0000000240)='\xcc\x00\x00\x00\x00\x00\x00\x81C\xd4\xb8\x89l}\xe3\xa1l;\xba\xb4\x02w\xe8>\xe2a_P<\xf4\x9d\xad_\xa3\x0f\xd5\xad\x1b') 2.454073929s ago: executing program 1 (id=723): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x165342, 0x0) (async, rerun: 64) mprotect(&(0x7f0000118000/0x1000)=nil, 0x1000, 0x1) (async, rerun: 64) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000240)={&(0x7f0000117000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000040)=""/77, 0x4d, 0x0, &(0x7f00000000c0)=""/90, 0x5a}, &(0x7f0000000280)=0x40) (async, rerun: 32) write$vga_arbiter(r1, &(0x7f0000000300)=@unlock_all, 0xb) (rerun: 32) write$vga_arbiter(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="69b9ad006d9a12f321a8bb3ae836254b64c4bfa76b67c5231a322c7751b0f66ad9f7e130461223783d40134d948b414af938cebca00b5b6135b81642946dbab999fae99bbb6af405057507ef5052b2984ea5e1ac5cd0b1111a8fc6dc34ad5f680ee2343b1e5f2ccbe2f1a197ed80698590a3e427512633069a8c5f043be0f168b98ce1c54fe6ffb194db7a7877dbf4b6648537150c52f8", @ANYRESDEC=r0, @ANYRES32=r0, @ANYRESDEC=r0, @ANYRESDEC=r0], 0xe) 2.453828509s ago: executing program 3 (id=724): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffff3) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x36) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$lock(r1, 0x5, &(0x7f00000000c0)={0x0, 0x2, 0x7fffffffffffffff, 0x4}) ioctl$LOOP_GET_STATUS64(r1, 0x4c05, &(0x7f0000000000)) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) (async) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffff3) (async) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) (async) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x36) (async) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) (async) fcntl$lock(r1, 0x5, &(0x7f00000000c0)={0x0, 0x2, 0x7fffffffffffffff, 0x4}) (async) ioctl$LOOP_GET_STATUS64(r1, 0x4c05, &(0x7f0000000000)) (async) 2.4185184s ago: executing program 1 (id=725): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x700}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa08, &(0x7f0000000000)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x1}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000000)={0x2, 0x3, 0xffffe000, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) sched_setaffinity(0x0, 0x0, 0x0) rt_sigprocmask(0x0, &(0x7f00000000c0)={[0xffffffffffffffff]}, 0x0, 0x8) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x4) r4 = socket$unix(0x1, 0x1, 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='vfat\x00', 0x200000, 0x0) setsockopt$SO_TIMESTAMP(r4, 0x1, 0x4a, &(0x7f0000002900)=0x659c, 0x4) ioctl$KVM_RUN(r3, 0xae80, 0x0) mremap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x400000, 0x3, &(0x7f0000c00000/0x400000)=nil) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x2002) ioctl$EVIOCGRAB(r7, 0x40044590, &(0x7f0000000100)=0x924) ppoll(&(0x7f0000000280)=[{r7, 0x2452}], 0x1, 0x0, 0x0, 0x0) write$evdev(r7, &(0x7f0000000040)=[{{}, 0x0, 0x2}], 0x37) r8 = socket$inet6(0xa, 0x6, 0x7ff) recvfrom$inet6(r8, &(0x7f0000000200)=""/9, 0x9, 0x10101, 0x0, 0x0) sendmsg$nl_generic(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="20100000180001000000000000000000020000000800000004000000040012f38fe1cfe0ab2f872d30ed729eaea052ba4ebce600f753b31e27ba0fd35d319f6d45288223fcc64d99605e32bc9f3960", @ANYRES16=r7, @ANYRESDEC, @ANYRESDEC=r2, @ANYRESDEC=r5, @ANYRES32=r5], 0x1020}, 0x1, 0x0, 0x0, 0x4000809}, 0x8040) mount$fuse(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000002100), 0x8481, &(0x7f0000000080)=ANY=[]) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)=0x0) r10 = syz_open_procfs(r9, &(0x7f0000000000)='mounts\x00') ioctl$EVIOCGREP(r10, 0x80084503, &(0x7f00000001c0)=""/2) read$FUSE(r10, &(0x7f0000002d40)={0x2020}, 0x2020) 2.353839575s ago: executing program 3 (id=726): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000200)={0x2020}, 0x2020) mount(&(0x7f0000000300), &(0x7f0000000080)='.\x00', &(0x7f0000000180)='tmpfs\x00', 0x2200cd0, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x911) r1 = syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') read$FUSE(r1, &(0x7f0000002780)={0x2020}, 0x5ecfb203) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x85) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='mountinfo\x00') r4 = getpid() r5 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000000)) ioctl$BTRFS_IOC_BALANCE(r5, 0x5000940c, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0) read$FUSE(r6, &(0x7f00000020c0)={0x2020}, 0x2020) syz_open_procfs(r4, 0x0) r7 = syz_pidfd_open(r4, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f00000047c0)=ANY=[@ANYBLOB="6b0671855c8d562e3b0fb2d7492b526f1c67c532b9e891ac00c48a0e18fcecdf9ca73ad5affc2909f445af251374ed4c60bcda1db1b4", @ANYRESHEX=r8, @ANYBLOB=',rootmode=00000000000000000010002,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) statx(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100, 0x800, 0x0) read$FUSE(r8, &(0x7f0000006380)={0x2020, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r8, &(0x7f0000002300)="00e7a0633e8438bafa888b9b02144af32e296a0a01dc194d649b6fa26d6d5e63bac4a04baeeb8aacb22c6eec461b67db6a737737c6d2687acb00572f92e3fdb5d0cb2f11121c557a943020200755bcab77b39c406b733239e2bb1175b9322ba39dc7d67da8f77aed1714dae2e6c24c3ea96be9d151c6ab7b3c54bbe507b8b2461fb4be8dc90042184af6d48f8ace16abb5e3fc943cf61cdb75624a259bdb5f7829b9775820f85f2d1a6ee6c6c2af4fd41ab8a41ecb2612abf13cd2c6f9f3e6db505e4bbe68cc000cf5fa6d5636191a4b366ab59af52132a3f9678d4ed1bd577bacffb3b52850804005eebf3dfa4763168ff30490a11acdbbf4c3312a45f30139f6b72b1e7cdec185006bb30e0e8fa88da2cefc718cae7e9830f7ca101e4e23c6bd16bfacf4a9927fb13af4b79c86ab999beda4ad396abdda354a42fb4ef21d6749175dc21a0cf9191aa4f90d274b50370a580ad8dcd166d2b06c0d8b071973c3fde30f7e2bc371a51ca5866bf8b24eaac75bf482dd4436b214ff62d32e20df223b0b680ede28b3a49e66e330a8a3ecace0db9855d235d5ff23765e742d1a739c2ac8743f4c62664a3b347279da55a1a5b16e1e2828b584a013577d50f890e3894d9e8d6bfccdfb2b70221f12a7fac24b7a8818edce72b65f622c77bf1312771a2c0d805ec9a25c536c91868762032255be78903b77b2c1a773a03996fabba69214e76f5df6df0375b592692a2c3c86c75a3be56fe598ddaea0b9901d20db7e43e128e04e5509283f833c24c625887288459db5727210ba9a301fb8c934dd1d8dca68039fe5b2e1a8d7cdfc6d875e5851098100c3cd42544ed90bb55b58d20a501fabbc485d148c615a3b070fa0520da2ed68ee115a4411d5418b47f3d95616096f67a7a36d68f1e8df82eca8ef96fb4a96b3422fe046a37ea5f5967513a559bd770fecab7228b0692f439765c9e9c6ea4fc608e0b27f9b49064daa2bac06f83f6d87ebc61fa3a29bb5ed39641245ce8cf43770df32a84838802b0827ca5a40e2003915e2ed108a005637bb028d29bd2cfd28a1bd55e67ed1b6b7b72163c27c4b0e36d1b134d6dfdb165a66fb46498fc04bb8053b84098af5b18758631d1318d625a6fa4d3ce5a4d3a90e10c6363a26b5ae96c2d56f87ad21a6118af6847d041f88f852ddc3f250c088ef5cb31198f3ac81cff9a5bab26ed56c09f8416188974e08349f7da28fc754b98c1ac4ea0060ac1e1b1c49f7dbadbc59254b265dc418cab9ac14e2bbecc4c3103543e37984efb1f61315e10d2b422732217d3a9b0cfe4561f3765d3bda60be239e02bdc164dd631582e8c87dd8fa60d63dcf9e7f3dadc4ce5e4433a42425b8ee8cb8a2defab0bf9b6109c90b5655b79b18c06884f2670a985d454e08e54de69f645cb0cbb70620bd988ee717c310ae77b4abe81c01c6e7f47268ee20bc30b9062830917705682eba2c5ef966b877f33294aa5f8b29d3dd5ed92302087f34fa18d19a005de05f925e3e93c8c0f24507ff20cd23d9ae5452c32ff58c78ccdb1ab32c98edfaa6d2c3971934ca8f849ac360c286566eb72b0793f12cef84bd282368d533247ee750f18aeda484167f3d680e4aaa3aa0694441d4ff6a71531f1a30f87eeb71afd04c5d686e1f86f27586f4e2c8ff77c09612ba1af9b3fb93efd31af42f8e0498f35d07c662b743a08f2839cad8f95b90cbb4fc0ed2ca45dd093a549cde4c6ff08ce09a2cbc6f9f78b6f96643357f92f8f403202742057731fd3e343a87c0affe803cfdbddb8c2694ab63f2dc35da705624747e30a943000fc82c40f10e1975d2e2ec15aefd531b6dbc053606b054dc976f44d5b5a5f37e9c08532ce16cf8bca55ab6c814ceb855ab50b8b52620f8645a9dc25fcb732080d84bf39c3ebb235b4d96da527b64ec4b72f69e91d16a4efcaf76f2e1f968ca68a06f60b01ec7becc9ffd7877c0992cb0f80fb3daabc039513896bd7697843be06aba53e7761e11e075c61ef2d897d4d9f90041c14283746feeb3f0d456ba4be27843350fe43e7c1110b4439489139f6dae01c43f23ec71f08d3042663c65e059d368e4e2c6e49de45bf078d3182a1bc1208bc59379e705aa3309579947409f2a8b3d79099c8619f916e7a6fa333d2312a274247156b8c25cbcfcc59ef13339c700f56a8691dff39bd4338789001872c0d90929037dc0ad99b380a6ba73f331f73f9274f4c2bf5233d7482edf37bf6ffed4f2c0ee44a1d57cae0d644f25591dc03bf837571a82d0c31b61be7ff85a5b3843e8f96a50eaa43f5c137ecfc4e4530d08a2afa4ba02fcc50117a4ad0d5862302017639344c82749f673dbd650e49b35302d0acbab45c0973198291bb42b4cfcd3b0c252074341ea8eca19e122cd234da6d41bf5eedb706e16c17687ed8b84db67130796d26b94eac83bbcd785b603242bd6252c155711efd7dd22cc54e1eaf6d910d0f22c701f3d4da0314dd2829c6ee13bbcbd126558b47b8066bf0766c792a012315bd29bfeda8f28a2c1f4e638b701758e19a0e5bd5b4f19048b00a877d956292e345f8a3a8367892f955bcb5e50ca145ec5e2c9309e25941bd277e393aaad38f9b72a42514b27da6856223c37a1fc1327fa760551d3fdeb0b222ab180b16c9eea138cf4f327e88fdfee293c5b6b007028eb796a60772148282dcd17ffc1c90ed8b6540ede933545ed5a5301d6ff39734444ff3d85cda4ac3befa5083a4685e9e231eba4a91a35f4f7f48fd5ac2447c64c010e2a9f8e80691c95460e1995444466ec5f3cd71fe509a26ff0b7f3254bc8c3255e903834e841b37c70b267fb33deb0d1ed4ea84a869453ba508fc255b12cf847103d5195046c930ae4a75c956f22fcfe4186d547686b54bd7a534940d5d62216994eac0e8ed3bd2bd59354e6b9c6b5b10511d54a8b928040f1e1024a423b0cf519fc6e9673df5c48c0778c7edb8fa8d8ace77463a77d2d6313160e1ee72742953e433b6732ced59c93464fd91520847db238610ed0c289fc55647881a7d6257cf28090c75a6f19df079cfd35742a74a5ab270314f7c8039c20ff0f3f543d029b75a741b5dc6425241ac2ffabf1f96288e6d4ba34da09fb6049c2c8753fbd41fdb4bc68c57bf374ef4feb0df00c41319debb26afba2ff39e1799a1c2137f4e920ee5b02d93789b6b0c853e8143dae5b08ee85da2ea7c31803610ce797293ea95c16ade6dae2afb008e59d8b9505737f008b5227df5f1e4eb5d707f502698a17ead9b1f5ec09dff34248ff2fb153dc6df4812e39754a4baa42e1d8b77fbddef3ca091701ac28ae5fd422dbd8db5b122d3965383abc37a52d2fca5ce56eba974dba3d059cefe40e3c35c9daa8ae31198214303c1dcb90d58fc983ccfd504fa43925636f94b128d44e8aa5cd3ecfabd50a84062d03f7508a0575ab65ecc749d3ef566fdbc529a8139b7a7fb3a9bd784df52cddc6f2699044ba47615163fbbe19f3d88d38a8b71fe52b2611ca74341429d1cef1a7e350545be29d2caa560e60352cab074c298c44ca2c07f9795ce52f10aa3e2fcdef371f24e309b19e52218881f25a4674527edbe3b3bd0b9b536d810c6f9500c0c81bcfd9a440dd91c1d35c52758d2b2ae1a8497bb394c4f09d3947cf777727b0d1daf5ac4fe4fa3c247a791702cb84b96321b7fec81bf549d4eb5d6dafe019b26187417c68b064e4308908535a3e77b6cd3e28caaf12d726f15590b7958e40134d045a38cbb689131a7e85532f1c63dd4bac9e4d00645cd7b2b71704563f3738b92044a8153f6ba717800ab7cb238175c376d7add2c5ec38e4c856f1ab9c3ee33f6ca6d576ae908dd290e4bae23470182e253765e04e8eb02a791c4396a511ef467879a9e2818b8a4b1b0b39a6c44e816e3ebf6e3be93929dfcb38d5dad7d20b60215447674d0608b8b02331ac20e57083cb9b4449fecbb149441aea0ad82f00a82d87d743fc80d410922bc20923516885440f43c9f32beb81ce148def6140952583a7825c2d2fe012d52d30ef66d32a8a0864ac5c1737e2506228d41ff0515ee80be4cf012927dde0fd2a07cac68eff8c4437f2844d4df07936fd8753e5909f962c5c767f8719cc295bdfa8a16f3f36ff56e34d7b14b6b8c46d5af248b04a9c5396f84990e23d145670950bce5f5638e5e2cea37c371a4483729338f1305cbb32fa1c05dd9d21d2a69e5fa3abe9a2dad2237be20b4088393c04aa66cf13718de4bffac72f641a8c017a1d5568fa15a6a06e4dc833874ec95af6f115bdadf15179bfc8c4e3e64f26f1299e282c4ab397340934efc1e601afc630fe195e8ae7d8da1310568cab4f2fad085d0ec39710d8b7c812b3fd55c6f50925bcfc90fbcb35b8daa0f1e1f69d82fae2034039f7ad6921694ed48a55a68bc541e6d86f1e33c261a92d48b50eb58a03d8e31b2f6564a4ddc3ee988d0dc47b4b610a9a9dcb87571b5c1edb3362df0ec3d58872157e0f7247dfa8100b4478b705702a5620c9201010f40232327550db333e845dbecd6aadbd0a94c064862b1100b4dd45ece811b8c0275e3753e11b4bcd8bc5ed7668e72afa5bc5cc17b4c313273755f532ecfdefdf2d5c47999453a3b7c158d98332f0bd3a820cfb2c8c3bcd43197e7395a032cec6e41662079f2f654965aebc393e22b5c8516d9b8ad01e33ee481a4ac46a2df304dadeaa9e5274d340aaebe14dcea315fe1279f1a41a5c7aa8c94bf4b3d48757503171f53488e01210145e62c0de7c39737848dbdb1b207d4d33b8de180b020e8a76b1b521905e5e3ce97292f8558fb68efdee774681bfffcf1dc3eef35f660dd1659a32950de2d50e762313beee330d9c2a9fe8ce5e4e61ddd86378d3551335f6ef62053d3b248a8c33a11abdf3f3aa1975a15f4a6957a13d5b12a44d0f2b52b9a2d996e98c630c0f2abca80c7ae89efcf81ae284a0d19582cb1319d207077e5657d245533181ed6e07e0f7647123fc46c37bd75b4f4d181112b4a08acdcf445332cb9dde69a0923dd9244dd2ecd818b19588939922e3b2d8dd9d9fed95fa55b0e4564b38aca2c4d24eebc634664400177fbdeaeb278bb1d8eb11baf4be5c87d4f8d9a855bfa75df4c51fb4eec87a27c59df9a47d82523b08022a1c0fb22ff6f93c3d2cc22a4111a6ec5be428cba33617be65739c2240248f3a02d01ddf2d6aca9e537a2296b16d082d2b868504371dd5e41898885b03ebfaca73b40e8924ece83c1c80de6ce14943e1199c6f81bf359f44c3ed5ae3c6eacb730b1039f0b6555347bd566dfff45a7a2176420ab2b40916a73b66a3ad07af6e1ac5597393d203fa1ad34d4564af956a0a3e2997e27a4e5eff67dd89cce8875d995e00c1858234f149f6ad4cac2b8056966f726df57b8c4ee8f22f23097ba1471b1f1036e3a499400fccdb75b56eb13e9eca1407d5bff4b075b06d00fcbfcafc28431eb33156232e73c6577e3eca437330c494ede57b9609e1f40634918dea767338b5542197410cdc000143ace89ca0b7bf645b3267f74767d7c7fce05d2f59c137204e56bfa711f66903c511f681cf7a1b4f9fc0f42b7c438ff8957e1059375321df5b0c5c884f46d94c21686e1300582d34928bc398653118f79bfeea2e7cfbbf31a7718f4aab50fae57db94203d43e060365c9a7455241be03d82dffc3783d0f6aa170c0866eb0dad07485831526922d8348a7a16e2e9903a2ac93c58c6dce83127fab17703ec004a519ae5675baffb31bf4b52f9ca992a84017a44d68dc693abd829947342f277fdcbc87168bcc03c32b8b1e81a1915af2517c464af07d52b79d1b0e53164c82ba049f81e92ed1dc20a88fd72e9ce7aa4b22a7cc57dc5527d14f62bc29cfc9d57ed26fd523cac39ac00ba12d3a49d694709924275fc0793d56acf9558818dc9eb210749fa5307d45886b879257d627cee0542b51c2ce6ce134100efb47c92456ece5b73cdc051f570810a8d534222649eb56cf73a377162b753de6c282bcd4a25dda21dd10901bd8dfe8fd4ba8a70811c39707beded23dd60f23e2933372e3a6bce099899b07f0a4c4956fd98e956a8649622c77717de099463c0c6c9389ab4a1ae10f8ddd086d876af2943ee0b6b402ae5f89e09922e8c510ec0caa0a83e366e916400bfec88a52ab457037a35ddc6a8e2289c33684a5915c37bf5d227cbc65a737b52bdcb4fbbb7b4e7f965db116b46044d0870846c730dce12e120b1fe6dd5798ced24cad72c59a3f44de4978b8bc05a1dbeb766be6e2abf6ef46c67a58a370e54e92d89e5f44525e82b94a388d8d0cb20c3469a258c1633c9dddb6854aee255f93f59435ff317622f6899250aa185c207644275278580c5d32401741fe264a2e03b80f442ed58fd0704ebac923ac6a5abb7f0c695252f82e3fbcf2b99d721589a8fe3fad4d5926aee3d7bfafb6739e525faae3d25b12841fa2cc61dddc44d36acb9a8b72d60ecdd9c8cf04f9bac341b5e0f9bc59042db8126324888b07afe72b18cce36d61eec975b6b4ef5dc4a16ac14440cf770599bd4db630bd110eb63a03a80cd95c16d314a4de60cc5115bf0754cb7ab84a827ecefafa96069c721a5979f227fdc2467b4cd1975dafb5b28e1d6f3c1c3a2816ad831dd98c1378a03798c128f176426eaa0e361571e758d54bf4ec2c988355f016e16d6cd5cf97bb4891ab33f5623b7e796af313cc7a9e2f9510cd2bead1ea5dd080d9de1f595b2629ebccf69a0feaed3963ae8a6c89edd66fbf6e566379898185828925f8669668d6bddff961b08aaedbbe7fc196931a887ec740da6bcdab8f826a34aa2aa1e406a258558f3baf022a64222df4d6ee8726c79ba3dd6e11a19e4b4bb49b4a8cd99c189e6392f08ad731e415b65d0ccb919dca46efe9f79e21437111ab09e926d3038182044ae047bf1cc92e2d2644c528985719667a1a8abaf65d0f211172ea789b2fa016e1a88325d1ed706239da4dbb9e2079e3598b4ae5885667587ba1e0921c9ba55d7a3be4c47bc2f2f3547ce9efe32e5a22855f761bd4cbe1cd9337eda4bd7d82a918084d7e116b656104ca87e64b1b8c62323c3c296c5b5b98051feb607b872edf9f789744aff710c4b7279711182bcac6b76c05f5cd982f52f451e7e29046550e012e01d8cdd3e305427030f4247488c9136303084c12175c5c781cdd08aede5a356ea0ccdd05a460be3c7b4bfd62c3ce9ab68e285a36c1546d0b18edad71f69f5bedb340772e1bbb035514b085067259e39f59dc292a12557350c66904b253efee29a5eb7a6920f583c899dc46a1d3e2af2db3a3d1a0e8d1f98722a16c6cc1e401058d60c8c436d8f1166ba53bdde5810f9d0288528affd486c266546a864c92af3df8abd451cc1e0d6bfea534865cea9d49b3ea5e390fa823118df8a61e31022f5fbb8ceee870bf2e60890263c4d14e24d053d0fddf665ff80a66fa00a5957f8a30fe82a4b82cf2f6b4d49def98f66bfcdaa0aef13314e950ca9f3849b1edf3b82eaf74a0dbcf45c3dba9bd2d853281a78484f1efaf4150da1207ec3cb61fbcbf759f8182b7052b28d7164b73197b0a440759fe9d5ddf827f1897a174e82fb968a9a07c61bee44bc1f7f9ee5c6de04c02d57735c5fab741b36aec7c8642e56cba932a08b8e8a9d3eb066a4ee7cbf22e5abbd4346de59eca1f24ad9f7f9ff7621e5f30dd08f4cddda8e80e496908109f5212a72bab1378d1237def07bdda4178719975346c68405de15153031fb17535894e5e3c1de6fdd507333f0226b78ba7cae509cfb48d6735ede9392650bf85ac1db919b1e9fe0a823119d8253204dbb2f7a8f524be6d419f3a45c5051a7a88ef0bd41586d90c11a894d647f03895f671a6e19f1c70e32668653aba8366a3d372522f49844081a9637db080663ab02f4a8af502955d5411461b62f85308c91852f8fb9f0bdddd500b4a133791d3a2f91a82dc4b09f5ad2196a9172ab0cd3fafe7266e9f6d159110d99ca8da8a34b17be17a04ad4509a9fffab1e45e10f10e0cf9cfbd9c761ad044064c07e473fdc626289cfb88b13a11455c069b70aa02426d9119ac878a14c9483be9c0d5bcbb5fa76c8d06531f59c7cf7c26372e750e2f332418ca769e5e7fbeb3ada7bb58b573a0635e2e3ad9a53ddb809ea01086a3fa993ad57e89da6f9c5e61bd0f8ba69212a386b2aa1ae17520d7fb989dbe14021885eb50fa3048aebd42c861a09a308b660d382c0480ead8a52a1e14927c7c77957f94bb59ccfd557f8c4a7af23360a298a603d20ebc386db041d8c306b3e32b0bff541bdec5ff75c3b40950815cf9f89d48a382f67e44c409d046c01fb1262aca0df6f5238a3c3c09977261494f7361ba326815d6e23f49e4d6d4b54665081067332265fff59cf54af9da0db9d19bc611cbcb6e6f3f1e2e1ffb6cdd6253578d78d06a2ff5f9250f1994c5749e3ce49231fbd63bba28e948f9150933e3ae31299babaa41043b181a100882e613b4b4b8f49ceeb742d22f860853a9b917f5a323a8a1fb1f3363a7be4407fba44b408f259b5db79a055b92ce3d7a0649cc59f4afa2b1f69959d5c6f5eef1fa7987a47bee4491f685c52e9db1ee1a231ab5a4bae1019c97868a409dd0d57b32525394a233023c4a7ac429808bbcb57a34b41883202744c3bdebc0a637773273f19c2be6e806bef7fc1002846db762ee4e16867773808c5477987d5851d5b1641d070feabc203cb3d7943ffb206272fcac1bccb616352d85975f5a22c0f247548535ad9fb83fb2be17689453f10691143c060cd964df63c3c70e7b1cfc7e2b468015f327f9869353477bfeeed330b03ddd9e4e0a2441182244da283d7a59d2b2b20e6de3e3a47c26aeef4944c1190bba674523a6c3c4ed6bac53b9edffcb0e9fb19d8bf36949d03ef6a7e59eb903a00d9614f642d1932c766421906f5b177963c71e881453560e3ffcec792e8dc46b1832a8fcb2ab2268a9c1fb648d1c6fa1c8cbd50d5a2d8264fbc6c063e6daac5519d362da389dcd3d12c8039f991de91e728abf5bab95c3aef66dd8cc36c60e73cb10afb02eff6df20ff12c59b142b07fc48fe94612de80b8b958f78256fd7cf3c6f79a83867f3bb5f70da392957badadecefdf7b6e4ebd39ff945397c7d302ca0a5a3918d8abb893cd9cdd680916a50fe19699ff0476ad82e6ba46523f26ccc5eb65313c1df1077c8876d2b73bf86ba311862d12b0c557a92ef827197121512e87f817167d4b17c7e225a48b3f8fbbf4187438e0e9b78e905cdbeb72e80dfb37ec0104f5186b39b4ff34f0cdf4b74dc915acd3f98874cd6a67308d0ad9697121ac477550b1affe004f433705933f9647522be65cb5a7471120ec942aeb956f195be0c1783102cf7d842f2968222ae1a7fa6513f200d3fa85d71724956ed697f0673ee3b40a4d46ba701f71864ced67f1ed52b52b9f72906477d520c90a9f5dd49a7a33a328137a183f439895532b78ae451a8c3db789bc862fbc37241d523027e1a008629c969380f6eb55f9cf3f0675bca6851f00df6aaf90de9f62d5c179945ef81d1073850301f97e379ea415d830e3f3751cf83e2dba541cb6cdd89e6b674f2c53e329e5f3dd418d534ada6469a5b3bca5b7cfbdfdd6df4abaf77d4520d0311e801145c91b52586a56086e663841b702f52cef9fff8cfb7b33dfa125688ba6b4fadd1dca8defaf4259ca85323b23d3bbb45933562c25af3e8d7bc6ad4a50ae974f8d207994b3bd74a6812ab6a40fcaf96bb4e17bd20d742b14c72226caef3e0f5c56c4930071e9f9a894f18650fbb785c6f707605c86b634c9722c8690cf3a954f68d7c2db3a257339ade67a41259f6f878dd0ab7876deffa77f6f00819282a8f4c4da84c6cf4f335cd0410770a2b1a1fbb3f85f4489eeceb78bbfddb2d1866c57b41f6ed179a0bc3750a486403d23473f2feef43ebc5af1018d9c20089e277d77fb9c34f425c8f8af4c49864b57572fa8c232e61ef37194251a1ddc2f73ffecd57e638751cb72bcb2c40d22540166ca1e8588f24b010c9fbd962e3a2c23a7e93f131df61b8703ce326ed80cc87912d3c6aaa27574bbe8d65bcaecd660c31cead132a44b1d0e4a53cacc0b82a263c4e7783944af0af08ea9e68e8e25ed9111cfef841f1b2fd24164f9097f70efe09b1109e5cb91fe68a2760381fd63a7fd422dd578a60661abc9ee3a5db1c2cde2fb21f2040f1ed3fc27b99e254256949d0560e8b98fa028fca50768caa951a87bf8969af498d50a9ee773c9caa7d9f7d8e1955506013f198cda316d79b177e59f233b98f727afd2494fc18642f0015adab756ea6742690c7d00f28655b915ce4eb8b3ba2e8559ba23e1ff1ccc9f79ae2df85f924459c56715dec78ef4592352eb1a850cd65ecd36e1a9121e888586b7b2fa84da920b8cf44480433e61ab076b10171c0537524bb170a4b99b0b0c437418a665b7ef909652b6483b20362e557c1480c2a2a0efa221fc59054a48122b52d38245f9bd026001635be5b155f5c766a59306fbde231fa72b4d74449a2fe8fb969496ee26af5881adaafb4189b439877ab8f78709cfd32c10ea576a010bfc137b7a4aae137ea3d29070ce3bc8dbe6655e967115ca3461ad9d28b9cf8af07441e68a54ec5e889846f3978f07ba51f7d5af5da78c5c675dc5d0c1a4a399ff4247203573a46fb903eaf7bc886e6cbd3126fa4a3fe3bb13bbdfea7da871f6563aa750f6ad7895b34b2809563dcf5ed30f1c60cef4138aa49d4f55e396534ed10cf4d857723a2b442f47d79de162c30ec6c4daf939b4c88649494e3682d1da81b4a5928d8e18a16c46707a685305e592589acb484e28e9d5af89c44b6e563d125ec97c0155410527406d94b90bc9576a662db99da1cb82b04d610d02187ce08f22ea0e8fd31919d53fa6aaf980e31ca7f8610e695a41919c24136a8406c62d5f15fca365892a2b54ece17664b5247583ad60d863f283f3c288946139575dcaedc978762e85f534e56334ef0221c34ffae054ddf79339b8f08701e9699b11041df8f518dd33203363c8098fbefb01555bcc2542422777b38d8dff11b15aadb0c251ce2c5b32f8735b3cb784f2e5731b48feb5a0e791a1106abdea0f7d1f087737cbe7fdf523fa14c9be2a2987511004c5b7ac1814ef6961db16799698242452c469a07c30e4a1f73193c74a41bdd88aef50035e4648bc9dfa276951798420a45e4085932bdb9381af3cc4678bd962af616549e4020d2c9fd25e2117a6d8934fde2218273d7833d60ea492e251417a27e7fb32012a940a6b6487af4b64958bf05f1b1107732149d227eeda5ca5a43cf583dc297d66072a1acd75e93a7caefd36a0d581e21d5cb08654c4ecef46ebac5391546e0b7d2a6418548d8f816446bcf237f676e873e6bae9107234abe5ab24c53ea472ad10653cef068fd9f4e729fc0d526e489f8df13af5575f1e70e0ec22899728b0659d70fc2dd509d9df3ec170638f89e540f4d3f02aa9b1b1819f84da596e0d7b45a5818061728f8eeccd2bea0f460dd7e18cb95f2364c50e351f0690e184eb63ebbb14a0b4b2117e44f3b2b3", 0x2000, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a00)={0x130, 0xfffffffffffffffe, 0x100, {0xfff, 0x10, 0x0, '\x00', {0x80, 0x7, 0x84, 0x2, 0x0, 0xffffffffffffffff, 0x4000, '\x00', 0x4, 0x21, 0xb4e7, 0x1004, {0x80000008103, 0x80000000}, {0x9, 0x1c}, {0x100000000, 0x3e}, {0x1000109, 0xa82}, 0x8000, 0x1b, 0xfffff9dd, 0x5}}}}) r10 = socket$igmp6(0xa, 0x3, 0x2) bind$inet6(r10, &(0x7f0000000880)={0xa, 0x4e20, 0xacc3, @ipv4={'\x00', '\xff\xff', @empty}, 0x9}, 0x1c) write$FUSE_INIT(r8, &(0x7f0000001200)={0x50, 0x0, r9}, 0x50) sendfile(r2, r3, 0x0, 0x3) setns(r7, 0x24020000) umount2(&(0x7f0000000040)='.\x00', 0x2) r11 = socket$inet6_udplite(0xa, 0x2, 0x88) connect$inet6(r11, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @mcast2, 0xc}, 0x1c) getsockopt$sock_buf(r11, 0x1, 0x19, 0x0, &(0x7f0000003080)=0x7a) 2.335264746s ago: executing program 3 (id=728): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x800, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r3 = getgid() setresgid(0xee00, 0x0, r3) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = syz_pidfd_open(r4, 0x0) ioctl$F2FS_IOC_START_VOLATILE_WRITE(r5, 0xf503, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000200)={'veth0_vlan\x00'}) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCBRDELBR(r7, 0x89a2, &(0x7f0000000200)='bridge0\x00') sendmsg$ETHTOOL_MSG_COALESCE_GET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000140)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001c0000180001801400020074756e6c300000000000000000000000288e80ce943183bc7446cab6b74113a6d769c0893c389ec23891e975565c48bda3c952e87602d1482261d8188ebd29f9d8682a9069a18ff61e18a20009a5c5c049fa653c83d12b93d3916cd3aaffb831e7be151550baa5c03d090000000000000055"], 0x2c}}, 0x4000000) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r9 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r9, 0x8946, &(0x7f0000000380)={'team_slave_0\x00', &(0x7f0000000140)=@ethtool_stats={0x17}}) write$uinput_user_dev(r8, &(0x7f0000000a00)={'syz0\x00', {0x6ec9, 0x7, 0x5, 0x7f}, 0x3e, [0x9, 0x2, 0x8, 0x2, 0x5334, 0x400, 0x80000000, 0x5, 0xa, 0x0, 0x6, 0xf5, 0x9, 0x39, 0x747d5a13, 0xdc3, 0xfffffb9a, 0xfffffffc, 0x4, 0xfffffffb, 0x4, 0x3, 0x4, 0xffffffff, 0x4, 0x800, 0x300000, 0x7, 0xe, 0x4623b, 0x0, 0x0, 0x1ff, 0x8008020, 0x3ff, 0x3, 0xd, 0x3, 0xba52, 0x4000800, 0x2, 0x200, 0xffffffff, 0x400008, 0xe, 0x4, 0x1, 0x800de, 0x8, 0x4, 0x1, 0x654e, 0x8, 0x8000002, 0x9, 0xe, 0x4, 0x6, 0x4001000, 0x7, 0x40, 0x9, 0x7, 0x5], [0x6, 0x1e, 0x3, 0x8000, 0xfffffffe, 0x3, 0x0, 0x5, 0x7, 0xfffffffc, 0x4, 0x8001, 0x72c, 0x1c32, 0x101, 0x8, 0x10000, 0x400, 0x8001, 0x3, 0x1, 0x297, 0x5, 0x0, 0x981, 0x400004, 0x7ff, 0x3ff, 0x0, 0xfffffffe, 0x0, 0x1000001, 0x10, 0xfffffff9, 0x0, 0x5, 0x1, 0xffffffff, 0x6, 0x5, 0x800, 0xffff, 0x6, 0x96, 0xfffffff9, 0xc, 0x0, 0x2, 0x401, 0xd, 0xffffffff, 0x379, 0x8, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x1, 0x8, 0x6, 0x2c2, 0x3], [0x401, 0xc584, 0xffff, 0xcd1, 0x7, 0x3, 0x6, 0x4, 0xb, 0x10, 0x5, 0x17, 0xe88, 0x1, 0x80000001, 0x8, 0xffffffff, 0x1000, 0x2, 0x10, 0x1, 0xfffffff9, 0xe55, 0x11, 0x1000, 0x4, 0x4, 0xf, 0x9, 0xe1aa, 0x5, 0x80, 0x3, 0x9, 0x47, 0x2, 0x80000003, 0x4, 0x7, 0x0, 0x7, 0x8, 0x8001, 0xbf23, 0x6, 0x8, 0x95a, 0x0, 0x3ff, 0x3, 0x2, 0x1010001, 0x2007, 0x7, 0x4, 0xea, 0x9, 0x5, 0x8, 0xd9, 0x0, 0x7d, 0x403, 0x5], [0x1e6a, 0x7fff, 0x4, 0x3, 0x88, 0x2, 0x6, 0x0, 0x50, 0x2, 0x75f, 0xb, 0x402, 0x800, 0x4, 0x5, 0x80, 0x7, 0x3fa6, 0x4, 0xffffffff, 0x5, 0x1e0, 0x4, 0x5, 0x4, 0x3, 0x4, 0x1ff, 0x1000, 0x3b, 0xb, 0x1, 0x800, 0xa80a, 0x65f413f9, 0x104, 0x8, 0x8a8, 0x1000, 0x40, 0x7, 0x0, 0x4, 0x4, 0x18, 0x0, 0x200, 0x7fff, 0x2, 0xffffffff, 0xfffffbff, 0x1, 0x200, 0x7, 0x6, 0x0, 0x7, 0xe, 0x2, 0xe, 0xf, 0xfffffff9, 0x6]}, 0x45c) getpeername$packet(r6, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000080)=0x14) ioctl$UI_DEV_CREATE(r8, 0x5501) close_range(r0, 0xffffffffffffffff, 0x0) 2.247945312s ago: executing program 0 (id=730): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x20400, 0x0) ioctl$BLKPBSZGET(r0, 0x127b, &(0x7f0000000040)) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='binder\x00', 0x2800000, 0x0) 2.247239482s ago: executing program 4 (id=623): r0 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{}, {0x0, 0x989680}}, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x101842, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000140)=0x4) ioctl$PPPIOCSNPMODE(r5, 0x4008744b, &(0x7f0000001600)={0x29, 0x1}) close(r3) r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x3, 0x3, 0x3, 0x1, {0xa, 0x4e24, 0x40, @private0, 0x3a70}}}, 0x32) ioctl$PPPIOCGCHAN(r6, 0x80047437, &(0x7f0000000040)) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f0000000300)=@gcm_128={{0x303}, "fc674d000000f8f7", "c5991ee20139b401046a89606ffcf92e", "2c5be7c6", "a0ca05c0707e52f4"}, 0x28) recvfrom$inet6(r2, &(0x7f00000000c0)=""/3, 0x3, 0x0, 0x0, 0x0) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)=0x0) timer_settime(r8, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) splice(r2, 0x0, r1, 0x0, 0x10000008ebc, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r9 = syz_open_procfs(0x0, &(0x7f0000000080)='mounts\x00') ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) mount$binderfs(0x0, 0x0, 0x0, 0x11084, &(0x7f0000000100)=ANY=[]) ioctl$SIOCGETSGCNT(r9, 0x89e1, &(0x7f00000000c0)={@private=0xa010101, @loopback}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000200)='affs\x00', 0x1004, &(0x7f0000000240)='\xcc\x00\x00\x00\x00\x00\x00\x81C\xd4\xb8\x89l}\xe3\xa1l;\xba\xb4\x02w\xe8>\xe2a_P<\xf4\x9d\xad_\xa3\x0f\xd5\xad\x1b') 206.235036ms ago: executing program 0 (id=731): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000040)={@empty, @broadcast, 0x0}, &(0x7f0000000080)=0xc) bind$packet(r1, &(0x7f0000000140)={0x11, 0x9, r2, 0x1, 0x7f, 0x6, @remote}, 0x14) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000100)={0x0, 0x1, 0x800}) 204.781537ms ago: executing program 1 (id=732): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000002c0)) r1 = syz_open_procfs(r0, &(0x7f0000000240)='cpuset\x00') r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000140)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000280)={'#! ', './file0'}, 0xb) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) mount(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='cgroup2\x00', 0x808081, 0x0) openat2(r1, &(0x7f0000000080)='./cgroup/../file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x11}, 0x18) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x1) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000340)='selinuxfs\x00', 0x100002a, 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x200021, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) read$FUSE(r3, &(0x7f0000000440)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_BMAP(r3, &(0x7f0000000300)={0x18, 0x0, r7, {0x6}}, 0x18) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000040)={0x1, 0x3, 0x0, 0x1000, &(0x7f0000fe6000/0x1000)=nil}) syz_kvm_setup_cpu$x86(r5, r6, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000003c0)=[@text16={0x10, &(0x7f0000000280)="da1a0f38f15c00ba2000ed642e0f01c5360f01df0fc701dfdfaa000f00d0baf80c0f98dbe1efbafc0c66ed64660f3809fe0f01c3", 0x34}], 0x1, 0x14, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffffb}) r8 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') pread64(r8, &(0x7f0000001240)=""/102400, 0x19000, 0x1000000000) setsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, &(0x7f00000000c0)=[{{}, {0x4, 0x1, 0x0, 0x1}}, {{}, {0x4, 0x1, 0x1}}, {{}, {0x0, 0x0, 0x1}}, {{0x1, 0x1}, {0x4, 0x1, 0x1}}], 0x20) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ff9000/0x1000)=nil, 0x1000, &(0x7f0000000000)='/dev/net/tun\x00') mremap(&(0x7f000000d000/0x2000)=nil, 0xfffffffffffffe74, 0x1000, 0x3, &(0x7f0000007000/0x1000)=nil) 203.196527ms ago: executing program 3 (id=733): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./file0\x00', 0x4) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_SET_GSI_ROUTING(r2, 0x4008ae6a, &(0x7f0000000700)=ANY=[@ANYBLOB="010042fefa1900000000000000000000030073905ae025bc57277715b10000000000000000000000006033eec3bf12a8b058931a1c0ae5b7dc83c68e8c239776ec0ffce6910eecdbcd291a8104e1fcbd1f68d11c73191ba8392227961903d4863666e829f0c1aec6896b1444d0deec7830cab73c9c52f27d862b30ee8963ea306fdafca4ce873e24c1baad4c37401d3b2f4dc0769277f90c325b531c77c3e320cf92b55f312e6af7f87902c5411f88319cd5ac0bce9693641cb9929e8f48bec6734bc7bec1ec03c3a606432136e671a172d5a22b7d009ca80e4a155324bfc1fe97aa5ac1c0492c"]) mount$incfs(&(0x7f0000000580)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f00000005c0), 0x0, 0x0) r3 = openat$incfs(0xffffffffffffffff, 0x0, 0x10000, 0x101) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) openat(r3, &(0x7f0000000800)='./file1\x00', 0x10000, 0x2) r4 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r4, 0x0) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x4c, 0x12, 0x10, 0x0, 0x0, {0x2a, 0x0, 0x0, 0x0, {0x81, 0x0, [0x0, 0x4, 0x101], [0x5]}, 0x402}}, 0x4c}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) lsetxattr$trusted_overlay_upper(&(0x7f0000000000)='./file2\x00', &(0x7f0000000040), &(0x7f0000000840)=ANY=[@ANYBLOB="00fb450104a090907f74eda5d5ec67078bde4723b38ec8869f694d0a3f4c4b05ddc7519193c7ad544c0c76e6631e4bfb03a0d00494a6b45bd4b506a6c5313e9e7caf9e3325465fde4ae55765a17e3bd39015f41a44e47a43ae92341244f5862baf3c6a44cf14055dacb02d73d278713befbea27f5562ca810f6188e35aa654da729d9338d16547c23a00"/149], 0x45, 0x3) mlock2(&(0x7f0000072000/0x4000)=nil, 0x4000, 0x300) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000500)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@nfs_export_on}, {@verity_require}]}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r6 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r6, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_group_source_req(r6, 0x29, 0x2e, &(0x7f0000000200)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}}}, 0x108) setsockopt$inet6_group_source_req(r6, 0x29, 0x2f, &(0x7f0000000580)={0x5, {{0xa, 0x4e21, 0x200000f, @mcast2, 0x10000}}, {{0xa, 0x4e23, 0xff, @ipv4={'\x00', '\xff\xff', @multicast1}, 0xdbd4}}}, 0x108) stat(&(0x7f0000000180)='./bus\x00', &(0x7f0000000440)) lsetxattr$security_evm(&(0x7f0000000200)='./bus\x00', &(0x7f00000004c0), &(0x7f0000000600)=@v1={0x2, "bbe24029"}, 0x5, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000080)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/233, 0xe9, 0x2, 0x4}, @fda={0x66646185, 0x0, 0x0, 0x24}, @fd}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0}) 180.525218ms ago: executing program 0 (id=734): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 129.641971ms ago: executing program 1 (id=735): mkdir(&(0x7f0000000300)='./bus\x00', 0x0) chdir(&(0x7f00000000c0)='./bus\x00') r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={0x2, 0x4, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x4e22, 0x0, @empty}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x2, 0x2, 0x20000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @mcast1}}]}, 0x70}}, 0x0) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x4, 0x10ffff, 0xfffffffd}) pipe2$watch_queue(0x0, 0x80) symlink(&(0x7f0000001780)='./file0/../file0\x00', &(0x7f00000017c0)='./file0\x00') r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167342, 0x0) readv(r1, &(0x7f0000000140)=[{&(0x7f0000001400)=""/4096, 0x1000}, {0x0, 0xfffffe28}], 0x2) 129.072972ms ago: executing program 0 (id=736): r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000740)={&(0x7f0000000140)={0x2, 0x4e22, @local}, 0x10, 0x0, 0x0, &(0x7f0000000600)=[@ip_retopts={{0x2c, 0x0, 0x7, {[@timestamp_prespec={0x44, 0x1c, 0x17, 0x3, 0x5, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x7188}, {@broadcast, 0x9}, {@dev={0xac, 0x14, 0x14, 0x22}, 0xfffffffa}]}]}}}], 0x30}, 0x4000014) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f00000001c0)={@ipv4={'\x00', '\xff\xff', @local}, @local, @dev={0xfe, 0x80, '\x00', 0x2b}, 0x800000, 0xa, 0x0, 0x0, 0x7ffffffe, 0x140192}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000019480)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000500)=[{&(0x7f0000000280)="dc", 0x1}], 0x1, 0x3) close(r4) openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/fs/binfmt_misc/syz3\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff002, 0x0, 0x2000000000032, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) splice(r3, 0x0, r4, 0x0, 0x10500, 0x0) futex_waitv(&(0x7f0000004040)=[{0x0, &(0x7f00000001c0), 0x2}, {0x3, &(0x7f0000000140)=0x3, 0x2}], 0x2, 0x0, 0x0, 0x1) setsockopt$inet_int(r2, 0x0, 0x31, &(0x7f0000000040)=0x1, 0x4) mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='.\x00', &(0x7f0000000040)='f2fs\x00', 0x0, 0x0) 128.797922ms ago: executing program 3 (id=737): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='debugfs\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x4824, &(0x7f0000003e40)={[{@gid}]}) ioctl$EXT4_IOC_SETFSUUID(r0, 0x4008662c, &(0x7f0000000080)={0x0, 0x0, "5d63c5922e128daf77e51acfb3cef4a9"}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x48002, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000000)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x1, &(0x7f0000000280)=""/213, 0xd5, 0x6, 0x2f}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x4, 0x2, 0x27}}, &(0x7f0000000440)={0x0, 0x28, 0x40}}}], 0x0, 0x0, 0x0}) 128.593891ms ago: executing program 1 (id=738): mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00') r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f00000001c0)=0x4000004) r2 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)=ANY=[@ANYBLOB="12010003020000402505a1a440000102030109025c0002010070000904000001020d0000052406000105240000000d240f0101800000000005000006241a06003009058103000000df000904010000020d00000904010102020d000009058202000404000009050302000200140cefa194b760eb6e4cfdb4d431b952cd38213c8a2bc38a4d256fce4ebf4b94f58ae5303b6e746a55ba46be0bb728dbc150b5e7727d815c9658b64287bd707599"], 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000003c0)={0x40, 0xc, 0x5, "916f77668a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r2, 0x0, 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x10, 0x0) pread64(r0, &(0x7f0000002280)=""/4096, 0x1000, 0xd33) 25.953088ms ago: executing program 0 (id=739): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0xffffe000) msync(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BTRFS_IOC_SYNC(r0, 0x9408, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0xc6225a99193a0f6e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) 25.317768ms ago: executing program 3 (id=740): r0 = socket$unix(0x1, 0x1, 0x0) io_setup(0x66eb, &(0x7f0000000080)=0x0) (async, rerun: 64) r2 = epoll_create1(0x0) (rerun: 64) r3 = fcntl$dupfd(0xffffffffffffffff, 0x406, r2) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r2, &(0x7f0000000080)) (async) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, 0xffffffffffffffff, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000100)={0x1}) (async, rerun: 32) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) (rerun: 32) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) (async) ioctl$TUNSETSNDBUF(r5, 0x400454d4, &(0x7f00000000c0)) (async) epoll_pwait(r3, &(0x7f0000000300)=[{}, {}], 0x2, 0x80000001, &(0x7f0000000340)={[0xcf08]}, 0x8) (async) r6 = eventfd(0x5a21) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x7, 0x3899, r0, 0x0, 0x0, 0x4, 0x0, 0x3, r6}]) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) (async) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r7, 0x0) (async, rerun: 32) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f0000000080)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000280)={@fd, @fda={0x66646185, 0x2, 0xffffffffffffffff, 0x28}, @fda={0x66646185, 0x2, 0x0, 0x25}}, &(0x7f00000001c0)={0x0, 0x18, 0x38}}, 0x1000}], 0x0, 0x0, 0x0}) (rerun: 32) r8 = socket$tipc(0x1e, 0x2, 0x0) (async) r9 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r9, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) (async) brk(0x55555ede6001) (async) socket$tipc(0x1e, 0x5, 0x0) (async) getegid() (async, rerun: 64) setsockopt$TIPC_GROUP_JOIN(r8, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) (async, rerun: 64) sendmsg$tipc(r8, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 64) eventfd(0x7) (async, rerun: 64) sendmsg$tipc(r8, &(0x7f00000000c0)={&(0x7f0000000140)=@name={0x1e, 0x2, 0x1, {{0x1}, 0x3}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x20000090) (async) r10 = inotify_init() ioctl$int_in(r10, 0x5452, &(0x7f0000000000)=0x7fffffffffffffff) 24.939318ms ago: executing program 0 (id=741): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x40000100000200) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x158, 0x1a, 0x413, 0x0, 0x25dfdbfb, {{@in6=@remote, @in=@loopback, 0x0, 0x4be6, 0x4e24, 0x0, 0x2, 0x0, 0x20, 0x0, 0x0, 0xee00}, {@in=@dev={0xac, 0x14, 0x14, 0x11}, 0xf, 0x32}, @in6=@dev={0xfe, 0x80, '\x00', 0x14}, {0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x7fffffffffffffc, 0x20000000008}, {0x0, 0x8, 0xcc}, {0xf5, 0x0, 0x1000}, 0x0, 0x4, 0xa, 0x1, 0x1}, [@algo_aead={0x67, 0x12, {{'rfc4309(ccm(aes))\x00'}, 0xd8, 0x40, "00b45a9af75938f5795dc473f9ade9ee5248b03d32f0d1f8f5ac05"}}]}, 0x158}, 0x1, 0x0, 0x0, 0x40080}, 0x4000) (async) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000000c0)='\xc2\xedE\\\xe3\xd5>\x8c\x1b\xa7\bj\xa4\xc4\xde\xd8\x15\xa6|,\xfdD\xcc\x8a\r_H!\x11t\xfc\xac\xe0s\x81\xf8\xae\x98It\x12&\x12\xd6&\xc3\xe4\x11\x8b\xae\xc1#B\x11\xa2\xb2\xf9\x90\xff0\x1e]\x8a]n`\xff\x97\xdf\xe3|i\xd0\xe4Z^\x8cD\x82\x92\xfd\x84\x13\x83n\xc2VW>4\x06\xe6j\x1d\x05\xfc\xa5o\xbc\x93\xcd\x8cSg\xa9\xefo\x11|\x10\xe6\x1b\x02/m\xcd\xdeN\xcb\xb1\xfel\x0f\xeb\xc5\xefF\xa85\x99D\xb0\xf2]\xdf\x93\xc4Z\xf1\xb3\xce\xcc\xe2qc\xc6\x1c\x0e\x12\xbdx\x01\xe8\x0e\x13\xe3r\x9csAJV\x99\xe6qN>$\xb3V\x12Kd\xb7\xc8\xd3\xcb\x88S\x90j^\\x\x1f\v\xc9\xc2{e\x82{\tEH\x90\xa8\x18\x0fG\xeb\xf8\xde\x91\x99\xaf\xe1\x88q\x81IQN\x92h\x980\x03+\xf3\x1a\xd1}\xf7\x87\xd1\xe5@4l\xdci\xd5\x1f\x7f\xaa\xb3k\x8a\xba\x12\x91^\xcb3H\xf00\x8b\x11\x1b\xfcR\xc3\x11\xe2\x8dU\x01\xee\x8eU\xf2\xd8Y>\x86+') mmap(&(0x7f0000018000/0x4000)=nil, 0x4000, 0x0, 0x13, r0, 0x85b83000) (async) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff}, 0x80080) r3 = socket(0xa, 0x3, 0xff) (async) r4 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_inet_SIOCSARP(r4, 0x8955, &(0x7f0000000000)={{0x2, 0x4e23, @broadcast}, {0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x18}}, 0x6f631b4376e74f0e, {0x2, 0x0, @rand_addr=0x64010102}}) (async) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$sock_inet_SIOCSARP(r4, 0x8953, &(0x7f0000000000)={{0x2, 0x1000, @local}, {0x0, @local}, 0x4a, {0x2, 0x0, @private=0xa010101}, 'syz_tun\x00'}) r5 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r5, &(0x7f0000000000), 0x10) (async) readv(r5, &(0x7f0000000780)=[{&(0x7f00000002c0)=""/243, 0xf3}], 0x1) (async) sendmsg$can_bcm(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="05000000030800"/16, @ANYRES64=0x0, @ANYRES64=0x2710], 0x80}}, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000000, 0x8031, 0xffffffffffffffff, 0x0) (async) setsockopt$inet6_int(r3, 0x29, 0x21, &(0x7f0000000080)=0x8, 0x4) (async) sendmsg$inet6(r3, &(0x7f0000001740)={&(0x7f0000000140)={0xa, 0x9, 0x0, @loopback, 0x9}, 0x1c, 0x0}, 0x80090) r6 = socket$igmp6(0xa, 0x3, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x80020, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[{@privport}, {@loose}, {@noextend}, {@access_user}, {@directio}, {@version_L}], [{@pcr={'pcr', 0x3d, 0x7}}, {@uid_lt={'uid<', r7}}, {@fowner_lt}]}}) 0s ago: executing program 4 (id=623): r0 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{}, {0x0, 0x989680}}, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x101842, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000140)=0x4) ioctl$PPPIOCSNPMODE(r5, 0x4008744b, &(0x7f0000001600)={0x29, 0x1}) close(r3) r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x3, 0x3, 0x3, 0x1, {0xa, 0x4e24, 0x40, @private0, 0x3a70}}}, 0x32) ioctl$PPPIOCGCHAN(r6, 0x80047437, &(0x7f0000000040)) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f0000000300)=@gcm_128={{0x303}, "fc674d000000f8f7", "c5991ee20139b401046a89606ffcf92e", "2c5be7c6", "a0ca05c0707e52f4"}, 0x28) recvfrom$inet6(r2, &(0x7f00000000c0)=""/3, 0x3, 0x0, 0x0, 0x0) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)=0x0) timer_settime(r8, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) splice(r2, 0x0, r1, 0x0, 0x10000008ebc, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r9 = syz_open_procfs(0x0, &(0x7f0000000080)='mounts\x00') ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) mount$binderfs(0x0, 0x0, 0x0, 0x11084, &(0x7f0000000100)=ANY=[]) ioctl$SIOCGETSGCNT(r9, 0x89e1, &(0x7f00000000c0)={@private=0xa010101, @loopback}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000200)='affs\x00', 0x1004, &(0x7f0000000240)='\xcc\x00\x00\x00\x00\x00\x00\x81C\xd4\xb8\x89l}\xe3\xa1l;\xba\xb4\x02w\xe8>\xe2a_P<\xf4\x9d\xad_\xa3\x0f\xd5\xad\x1b') kernel console output (not intermixed with test programs): loop9 (被xڬdGݡ [ 33.139705][ T543] ) failed (rc=-5) [ 33.139740][ T336] Buffer I/O error on dev loop9, logical block 0, async page read [ 33.162975][ T336] Buffer I/O error on dev loop9, logical block 0, async page read [ 33.171123][ T543] Buffer I/O error on dev loop9, logical block 0, async page read [ 33.183233][ T336] Buffer I/O error on dev loop9, logical block 0, async page read [ 33.188995][ T543] rust_binder: validate_parent_fixup: fixup_min_offset=46, parent_offset=35 [ 33.191138][ T543] rust_binder: Error while translating object. [ 33.199925][ T543] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 33.200325][ T336] Buffer I/O error on dev loop9, logical block 0, async page read [ 33.206519][ T543] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:91 [ 33.224849][ T336] Buffer I/O error on dev loop9, logical block 0, async page read [ 33.528269][ T31] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 33.611645][ T560] netlink: 182 bytes leftover after parsing attributes in process `syz.3.74'. [ 33.684484][ T31] usb 1-1: config 0 has an invalid interface number: 7 but max is 0 [ 33.693929][ T31] usb 1-1: config 0 has no interface number 0 [ 33.700119][ T31] usb 1-1: config 0 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 33.729680][ T31] usb 1-1: New USB device found, idVendor=5543, idProduct=0522, bcdDevice=22.00 [ 33.739103][ T31] usb 1-1: New USB device strings: Mfr=17, Product=0, SerialNumber=0 [ 33.747420][ T31] usb 1-1: Manufacturer: syz [ 33.761871][ T31] usb 1-1: config 0 descriptor?? [ 33.779918][ T578] KVM: debugfs: duplicate directory 578-4 [ 33.963305][ T9] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 34.033954][ T533] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 34.114768][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 34.126226][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 34.139106][ T9] usb 3-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00 [ 34.148265][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.157170][ T9] usb 3-1: config 0 descriptor?? [ 34.162471][ T569] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 34.171747][ T9] usbhid 3-1:0.0: can't add hid device: -22 [ 34.173340][ T31] uclogic 0003:5543:0522.0001: unbalanced delimiter at end of report description [ 34.177865][ T9] usbhid 3-1:0.0: probe with driver usbhid failed with error -22 [ 34.188870][ T31] uclogic 0003:5543:0522.0001: parse failed [ 34.204809][ T31] uclogic 0003:5543:0522.0001: probe with driver uclogic failed with error -22 [ 34.214599][ T533] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.227251][ T533] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 34.236397][ T533] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.244454][ T533] usb 4-1: Product: syz [ 34.248632][ T533] usb 4-1: Manufacturer: syz [ 34.253322][ T533] usb 4-1: SerialNumber: syz [ 34.392004][ T9] usb 3-1: USB disconnect, device number 5 [ 34.724796][ T583] rust_binder: Read failure Err(EAGAIN) in pid:65 [ 34.908152][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 34.915161][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 34.921906][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 34.928999][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 34.935710][ T586] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 34.939443][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 34.942194][ T586] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:100 [ 34.952244][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 34.967521][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 34.974027][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 34.980480][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 34.987013][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 34.993638][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.000124][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.006637][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.013224][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.019714][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.026227][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.032815][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.039323][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.045820][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.052276][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.058774][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.065559][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.072044][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.078820][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.085319][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.091788][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.098328][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.100949][ T591] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 35.104822][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.104846][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.129547][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.136077][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.142551][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.149427][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.155931][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.162392][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.168901][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.175406][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.181862][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.188356][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.194862][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.201314][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.207820][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.214327][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.220853][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.227440][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.233925][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.240412][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.246906][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.253425][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.259894][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.266761][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.273357][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.279820][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.286725][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.293242][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.299969][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.306505][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.312965][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.319612][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.326240][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.332797][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.339333][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.345837][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.352314][ T585] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.836778][ T600] SELinux: security_context_str_to_sid () failed with errno=-22 [ 35.872789][ T533] cdc_ncm 4-1:1.0: failed to get mac address [ 35.880198][ T533] cdc_ncm 4-1:1.0: bind() failure [ 35.886527][ T533] cdc_ncm 4-1:1.1: probe with driver cdc_ncm failed with error -71 [ 35.894850][ T533] cdc_mbim 4-1:1.1: probe with driver cdc_mbim failed with error -71 [ 35.904343][ T533] usb 4-1: USB disconnect, device number 2 [ 36.075976][ T602] rust_binder: Failed to allocate buffer. len:4248, is_oneway:true [ 36.286910][ T31] hid (null): global environment stack underflow [ 36.301351][ T533] usb 1-1: USB disconnect, device number 3 [ 36.316836][ T31] hid (null): unknown global tag 0xc [ 36.322347][ T31] hid (null): global environment stack underflow [ 36.330565][ T31] hid-generic 0000:07FF:0000.0002: unknown main item tag 0x5 [ 36.338463][ T31] hid-generic 0000:07FF:0000.0002: collection stack underflow [ 36.346203][ T31] hid-generic 0000:07FF:0000.0002: item 0 1 0 12 parsing failed [ 36.354191][ T31] hid-generic 0000:07FF:0000.0002: probe with driver hid-generic failed with error -22 [ 36.385324][ T627] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem [ 36.833182][ T31] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 36.984791][ T31] usb 2-1: unable to get BOS descriptor or descriptor too short [ 36.993308][ T31] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 37.003502][ T31] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 37.014440][ T31] usb 2-1: config 1 interface 1 has no altsetting 0 [ 37.022766][ T31] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 37.031874][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.039952][ T31] usb 2-1: Product: syz [ 37.044377][ T31] usb 2-1: Manufacturer: syz [ 37.049017][ T31] usb 2-1: SerialNumber: syz [ 37.103189][ T65] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 37.253148][ T65] usb 4-1: Using ep0 maxpacket: 16 [ 37.260166][ T65] usb 4-1: config 8 has an invalid interface number: 108 but max is 1 [ 37.268955][ T65] usb 4-1: config 8 has an invalid interface number: 40 but max is 1 [ 37.277234][ T65] usb 4-1: config 8 has no interface number 0 [ 37.283474][ T65] usb 4-1: config 8 has no interface number 1 [ 37.289649][ T65] usb 4-1: config 8 interface 40 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 37.300638][ T31] usb 2-1: 2:1 : no or invalid class specific endpoint descriptor [ 37.308696][ T31] usb 2-1: found format II with max.bitrate = 2418, frame size=7 [ 37.316468][ T65] usb 4-1: config 8 interface 40 altsetting 6 bulk endpoint 0xF has invalid maxpacket 1024 [ 37.326583][ T31] usb 2-1: 2:1: All rates were zero [ 37.331857][ T65] usb 4-1: config 8 interface 40 altsetting 6 has a duplicate endpoint with address 0xF, skipping [ 37.345353][ T65] usb 4-1: config 8 interface 40 altsetting 6 endpoint 0x5 has invalid maxpacket 512, setting to 64 [ 37.357597][ T31] usb 2-1: USB disconnect, device number 3 [ 37.366853][ T65] usb 4-1: config 8 interface 40 has no altsetting 0 [ 37.377229][ T65] usb 4-1: New USB device found, idVendor=0421, idProduct=04c9, bcdDevice=6e.97 [ 37.388832][ T65] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.397034][ T65] usb 4-1: Product: syz [ 37.401256][ T65] usb 4-1: Manufacturer: syz [ 37.406027][ T65] usb 4-1: SerialNumber: syz [ 37.413260][ T9] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 37.563929][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 37.570380][ T9] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 37.578839][ T9] usb 1-1: config 179 has no interface number 0 [ 37.585273][ T9] usb 1-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 37.596626][ T9] usb 1-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 37.608134][ T9] usb 1-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 37.618793][ T9] usb 1-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 37.619065][ T640] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 37.632278][ T9] usb 1-1: config 179 interface 65 has no altsetting 0 [ 37.632330][ T9] usb 1-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 37.642400][ T640] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:63 [ 37.648734][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.664658][ T65] usb 4-1: bad CDC descriptors [ 37.689141][ T65] usb 4-1: USB disconnect, device number 3 [ 37.710979][ T36] kauditd_printk_skb: 36 callbacks suppressed [ 37.711001][ T36] audit: type=1400 audit(1759920729.830:225): avc: denied { lock } for pid=653 comm="syz.2.101" path="socket:[4935]" dev="sockfs" ino=4935 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 37.713956][ T654] binder: Binderfs stats mode cannot be changed during a remount [ 37.717617][ T36] audit: type=1400 audit(1759920729.840:226): avc: denied { remount } for pid=653 comm="syz.2.101" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 37.835238][ T666] netlink: 12 bytes leftover after parsing attributes in process `syz.2.105'. [ 37.877751][ T471] usb 1-1: USB disconnect, device number 4 [ 38.033219][ T31] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 38.103237][ T9] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 38.184987][ T31] usb 2-1: config 1 interface 0 altsetting 133 bulk endpoint 0x1 has invalid maxpacket 32 [ 38.192218][ T672] rust_binder: validate_parent_fixup: fixup_min_offset=46, parent_offset=35 [ 38.195126][ T672] rust_binder: Error while translating object. [ 38.195763][ T31] usb 2-1: config 1 interface 0 altsetting 133 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 38.204194][ T672] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 38.210471][ T31] usb 2-1: config 1 interface 0 has no altsetting 0 [ 38.223573][ T672] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:65 [ 38.235210][ T31] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 38.260429][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.265217][ T9] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 38.268902][ T31] usb 2-1: Product: у [ 38.277357][ T9] usb 3-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 38.280883][ T31] usb 2-1: Manufacturer: Ё [ 38.280904][ T31] usb 2-1: SerialNumber: syz [ 38.290251][ T9] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 38.309717][ T9] usb 3-1: config 220 has no interface number 2 [ 38.314486][ T664] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 38.317685][ T676] input: syz0 as /devices/virtual/input/input5 [ 38.328318][ T664] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 38.332478][ T9] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 38.342493][ T36] audit: type=1400 audit(1759920730.450:227): avc: denied { read } for pid=95 comm="acpid" name="event3" dev="devtmpfs" ino=470 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 38.353145][ T9] usb 3-1: config 220 interface 0 has no altsetting 0 [ 38.375309][ T36] audit: type=1400 audit(1759920730.450:228): avc: denied { open } for pid=95 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=470 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 38.382653][ T9] usb 3-1: config 220 interface 76 has no altsetting 0 [ 38.402246][ T36] audit: type=1400 audit(1759920730.450:229): avc: denied { ioctl } for pid=95 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=470 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 38.416174][ T9] usb 3-1: config 220 interface 1 has no altsetting 0 [ 38.446560][ T9] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 38.447462][ T36] audit: type=1400 audit(1759920730.570:230): avc: denied { lock } for pid=677 comm="syz.0.110" path="/dev/binderfs/binder1" dev="binder" ino=11 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 38.455783][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.489260][ T36] audit: type=1400 audit(1759920730.610:231): avc: denied { accept } for pid=677 comm="syz.0.110" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 38.493180][ T9] usb 3-1: Product: syz [ 38.513446][ T9] usb 3-1: Manufacturer: syz [ 38.518158][ T9] usb 3-1: SerialNumber: syz [ 38.528621][ T36] audit: type=1400 audit(1759920730.650:232): avc: denied { write } for pid=679 comm="syz.0.111" name="001" dev="devtmpfs" ino=114 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 38.561745][ T682] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 38.561774][ T682] rust_binder: Read failure Err(EFAULT) in pid:79 [ 38.570880][ T682] x_tables: unsorted underflow at hook 4 [ 38.584059][ T664] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.592732][ T664] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.600995][ T664] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.610351][ T664] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.620247][ T685] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 38.624080][ T664] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.642032][ T36] audit: type=1400 audit(1759920730.760:233): avc: denied { connect } for pid=686 comm="syz.0.114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 38.647342][ T664] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.670642][ T36] audit: type=1400 audit(1759920730.790:234): avc: denied { accept } for pid=686 comm="syz.0.114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 38.678467][ T664] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.698615][ T664] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.706842][ T664] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.715413][ T664] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.733244][ T9] usb 3-1: selecting invalid altsetting 0 [ 38.741976][ T9] usb 3-1: Found UVC 7.01 device syz (8086:0b07) [ 38.748726][ T9] usb 3-1: No valid video chain found. [ 38.760695][ T9] usb 3-1: USB disconnect, device number 6 [ 38.929800][ T31] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 4 if 0 alt 133 proto 1 vid 0x0525 pid 0xA4A8 [ 38.944280][ T31] usb 2-1: USB disconnect, device number 4 [ 38.951923][ T31] usblp0: removed [ 39.108744][ T695] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:71 [ 39.177443][ T702] SELinux: security_context_str_to_sid () failed with errno=-22 [ 39.370158][ T710] overlayfs: missing 'workdir' [ 39.401050][ T718] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:97 [ 39.565843][ T737] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 39.580756][ T739] capability: warning: `syz.0.133' uses deprecated v2 capabilities in a way that may be insecure [ 39.597594][ T739] __vm_enough_memory: pid: 739, comm: syz.0.133, bytes: 17592186077184 not enough memory for the allocation [ 39.665343][ T748] SELinux: ebitmap: truncated map [ 39.670473][ T748] SELinux: failed to load policy [ 39.688842][ T751] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 39.697232][ T750] rust_binder: Error in use_page_slow: ESRCH [ 39.697254][ T750] rust_binder: use_range failure ESRCH [ 39.703563][ T750] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 39.709272][ T750] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 39.717424][ T750] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:113 [ 39.727752][ T751] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:113 [ 39.833202][ T471] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 39.995697][ T471] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 40.006762][ T471] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 40.018194][ T471] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 40.031264][ T471] usb 3-1: New USB device found, idVendor=0810, idProduct=0002, bcdDevice= 0.00 [ 40.040477][ T471] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.049664][ T471] usb 3-1: config 0 descriptor?? [ 40.193192][ T533] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 40.345484][ T31] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 40.345654][ T533] usb 1-1: Using ep0 maxpacket: 8 [ 40.362287][ T533] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 40.371459][ T533] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.388673][ T533] usb 1-1: config 0 descriptor?? [ 40.459638][ T781] rust_binder: Write failure EFAULT in pid:136 [ 40.461066][ T471] pantherlord 0003:0810:0002.0003: unknown main item tag 0x1 [ 40.480296][ T471] pantherlord 0003:0810:0002.0003: hidraw0: USB HID v0.00 Device [HID 0810:0002] on usb-dummy_hcd.2-1/input0 [ 40.500444][ T471] pantherlord 0003:0810:0002.0003: Force feedback for PantherLord/GreenAsia devices by Anssi Hannula [ 40.516311][ T31] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 40.525601][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.533771][ T31] usb 4-1: Product: syz [ 40.538075][ T31] usb 4-1: Manufacturer: syz [ 40.542796][ T31] usb 4-1: SerialNumber: syz [ 40.595194][ T533] asix 1-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 40.662474][ T31] usb 3-1: USB disconnect, device number 7 [ 40.743204][ T338] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 40.756214][ T772] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 40.893156][ T338] usb 2-1: Using ep0 maxpacket: 32 [ 40.906229][ T338] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 40.911613][ T31] usb 4-1: USB disconnect, device number 4 [ 40.919903][ T338] usb 2-1: New USB device found, idVendor=056a, idProduct=0097, bcdDevice= 0.00 [ 40.931089][ T338] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=255 [ 40.939437][ T338] usb 2-1: SerialNumber: syz [ 40.944897][ T338] usb 2-1: config 0 descriptor?? [ 41.151818][ T786] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 41.160505][ T786] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.169371][ T786] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 41.178087][ T786] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.189287][ T786] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 41.198682][ T786] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.209845][ T338] usbhid 2-1:0.0: can't add hid device: -71 [ 41.215952][ T338] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 41.227708][ T338] usb 2-1: USB disconnect, device number 5 [ 41.343259][ T795] rust_binder: Got transaction with invalid offset. [ 41.343306][ T795] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 41.349981][ T795] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:95 [ 41.643222][ T471] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 41.719174][ T806] rust_binder: Failed to allocate buffer. len:4216, is_oneway:false [ 41.719318][ T806] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 41.728508][ T808] rust_binder: Failed to allocate buffer. len:4216, is_oneway:false [ 41.794566][ T823] binder: Unknown parameter '~w' [ 41.808756][ T471] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 41.821019][ T824] rust_binder: 816 RLIMIT_NICE not set [ 41.833143][ T471] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 41.852093][ T471] usb 4-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00 [ 41.870057][ T471] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 41.887070][ T471] usb 4-1: config 0 descriptor?? [ 41.892632][ T804] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 41.907389][ T471] usbhid 4-1:0.0: can't add hid device: -22 [ 41.913552][ T471] usbhid 4-1:0.0: probe with driver usbhid failed with error -22 [ 42.007842][ T765] FAT-fs (rnullb0): bogus number of reserved sectors [ 42.010654][ T854] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 42.015333][ T854] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:167 [ 42.024670][ T765] FAT-fs (rnullb0): Can't find a valid FAT filesystem [ 42.057038][ T533] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 42.070614][ T858] rust_binder: 117: no such ref 1 [ 42.075982][ T533] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 42.086823][ T858] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:117 [ 42.093195][ T533] asix 1-1:0.0: probe with driver asix failed with error -71 [ 42.114759][ T533] usb 1-1: USB disconnect, device number 5 [ 42.123789][ T579] usb 4-1: USB disconnect, device number 5 [ 42.353206][ T471] usb 2-1: new low-speed USB device number 6 using dummy_hcd [ 42.503731][ T471] usb 2-1: Invalid ep0 maxpacket: 32 [ 42.633196][ T471] usb 2-1: new low-speed USB device number 7 using dummy_hcd [ 42.657192][ T872] rust_binder: Write failure EINVAL in pid:106 [ 42.662016][ T872] rust_binder: 106: no such ref 2 [ 42.674208][ T872] rust_binder: 106: no such ref 0 [ 42.823245][ T471] usb 2-1: Invalid ep0 maxpacket: 32 [ 42.838095][ T471] usb usb2-port1: attempt power cycle [ 42.995195][ T882] binder: Bad value for 'stats' [ 43.001817][ T36] kauditd_printk_skb: 27 callbacks suppressed [ 43.001834][ T36] audit: type=1400 audit(1759920735.120:262): avc: denied { create } for pid=881 comm="syz.2.183" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 43.033803][ T883] netlink: 8 bytes leftover after parsing attributes in process `syz.3.182'. [ 43.052603][ T883] erspan0: default FDB implementation only supports local addresses [ 43.069536][ T879] netlink: 'syz.3.182': attribute type 33 has an invalid length. [ 43.083195][ T36] audit: type=1400 audit(1759920735.190:263): avc: denied { getopt } for pid=881 comm="syz.2.183" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 43.105716][ T879] netlink: 4 bytes leftover after parsing attributes in process `syz.3.182'. [ 43.139128][ T36] audit: type=1400 audit(1759920735.190:264): avc: denied { ioctl } for pid=881 comm="syz.2.183" path="socket:[7686]" dev="sockfs" ino=7686 ioctlcmd=0x8904 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 43.203193][ T471] usb 2-1: new low-speed USB device number 8 using dummy_hcd [ 43.255014][ T471] usb 2-1: Invalid ep0 maxpacket: 32 [ 43.281140][ T886] rust_binder: Failed to allocate buffer. len:4208, is_oneway:false [ 43.286413][ T36] audit: type=1400 audit(1759920735.400:265): avc: denied { ioctl } for pid=885 comm="syz.2.184" path="socket:[7703]" dev="sockfs" ino=7703 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 43.349541][ T888] binder: Unknown parameter 'lazyime' [ 43.434528][ T471] usb 2-1: new low-speed USB device number 9 using dummy_hcd [ 43.615136][ T894] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 43.623540][ T471] usb 2-1: Invalid ep0 maxpacket: 32 [ 43.635926][ T471] usb usb2-port1: unable to enumerate USB device [ 43.670154][ T895] rust_binder: 894 RLIMIT_NICE not set [ 43.670242][ T895] rust_binder: got new transaction with bad transaction stack [ 43.676037][ T895] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:139 [ 43.906250][ T903] SELinux: failed to load policy [ 43.925707][ T36] audit: type=1400 audit(1759920736.050:266): avc: denied { write } for pid=902 comm="syz.3.191" lport=4 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 43.990061][ T36] audit: type=1400 audit(1759920736.110:267): avc: denied { getopt } for pid=909 comm="syz.3.194" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 44.058487][ T917] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 44.058604][ T917] rust_binder: Failed to allocate buffer. len:1152, is_oneway:false [ 44.084355][ T919] netlink: 182 bytes leftover after parsing attributes in process `syz.2.193'. [ 44.291762][ T36] audit: type=1400 audit(1759920736.410:268): avc: denied { append } for pid=926 comm="syz.2.199" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 44.294401][ T927] capability: warning: `syz.2.199' uses 32-bit capabilities (legacy support in use) [ 44.314457][ T36] audit: type=1400 audit(1759920736.420:269): avc: denied { shutdown } for pid=926 comm="syz.2.199" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 44.344525][ T471] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 44.452920][ T31] rust_binder: 892: removing orphan mapping 0:1048 [ 44.500597][ T471] usb 4-1: config 1 has an invalid interface number: 105 but max is 0 [ 44.509009][ T471] usb 4-1: config 1 has no interface number 0 [ 44.516066][ T471] usb 4-1: config 1 interface 105 has no altsetting 0 [ 44.524500][ T471] usb 4-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=31.6d [ 44.534194][ T471] usb 4-1: New USB device strings: Mfr=107, Product=102, SerialNumber=146 [ 44.542763][ T471] usb 4-1: Product: syz [ 44.547266][ T471] usb 4-1: Manufacturer: syz [ 44.551901][ T471] usb 4-1: SerialNumber: syz [ 44.613158][ T790] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 44.641871][ T942] af_packet: tpacket_rcv: packet too big, clamped from 1 to 4294967272. macoff=96 [ 44.773171][ T790] usb 3-1: Using ep0 maxpacket: 32 [ 44.779614][ T790] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 44.790791][ T790] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 44.802381][ T790] usb 3-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 44.811907][ T790] usb 3-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 44.820497][ T790] usb 3-1: Product: syz [ 44.824993][ T790] usb 3-1: Manufacturer: syz [ 44.831557][ T790] hub 3-1:4.0: USB hub found [ 45.035825][ T790] hub 3-1:4.0: 9 ports detected [ 45.041053][ T790] hub 3-1:4.0: insufficient power available to use all downstream ports [ 45.068154][ T954] netlink: 'syz.0.209': attribute type 11 has an invalid length. [ 45.105679][ T963] input: syz1 as /devices/virtual/input/input6 [ 45.208227][ T965] rust_binder: Error in use_page_slow: ESRCH [ 45.208248][ T965] rust_binder: use_range failure ESRCH [ 45.216995][ T965] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 45.222542][ T965] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 45.230647][ T965] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:175 [ 45.239284][ T932] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 45.257091][ T932] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 45.273354][ T932] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 45.281325][ T932] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 45.297524][ T790] hub 3-1:4.0: hub_hub_status failed (err = -71) [ 45.304139][ T790] hub 3-1:4.0: config failed, can't get hub status (err -71) [ 45.334965][ T790] usb 3-1: USB disconnect, device number 8 [ 45.357465][ T36] audit: type=1400 audit(1759920737.480:270): avc: denied { create } for pid=979 comm="syz.0.217" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 45.379306][ T36] audit: type=1400 audit(1759920737.500:271): avc: denied { bind } for pid=981 comm="syz.2.216" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 45.380355][ T982] rust_binder: Got transaction with invalid offset. [ 45.398679][ T982] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 45.411051][ T982] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:155 [ 45.412391][ T984] binder: Bad value for 'stats' [ 45.562712][ T991] tmpfs: Unknown parameter 'iuge4/9$0x0000000000000003' [ 45.579446][ T471] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 45.590558][ T471] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 45.603297][ T471] aqc111 4-1:1.105 eth1: register 'aqc111' at usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 72:19:56:c1:3e:8e [ 45.617038][ T471] usb 4-1: USB disconnect, device number 6 [ 45.623817][ T471] aqc111 4-1:1.105 eth1: unregister 'aqc111' usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 45.695425][ T471] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 45.705098][ T471] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 45.714997][ T471] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 45.773194][ T790] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 45.913203][ T533] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 45.924347][ T790] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 45.935333][ T790] usb 3-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 45.944489][ T790] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 45.957075][ T790] usb 3-1: config 0 descriptor?? [ 45.974297][ T995] GUP no longer grows the stack in syz.1.222 (995): 200000005000-200000008000 (200000004000) [ 45.984657][ T995] CPU: 1 UID: 0 PID: 995 Comm: syz.1.222 Not tainted syzkaller #0 d27bf65064ef37e242848a5d573511e9710340a8 [ 45.984696][ T995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 45.984728][ T995] Call Trace: [ 45.984736][ T995] [ 45.984746][ T995] __dump_stack+0x21/0x30 [ 45.984785][ T995] dump_stack_lvl+0x10c/0x190 [ 45.984817][ T995] ? __cfi_dump_stack_lvl+0x10/0x10 [ 45.984848][ T995] ? futex_lock_pi_atomic+0xdd/0xc70 [ 45.984880][ T995] dump_stack+0x19/0x20 [ 45.984909][ T995] fixup_user_fault+0x63d/0x6d0 [ 45.984936][ T995] fault_in_user_writeable+0x76/0xe0 [ 45.984953][ T995] futex_lock_pi+0x258/0xa10 [ 45.984971][ T995] ? futex_unqueue+0x136/0x160 [ 45.984991][ T995] ? __cfi_futex_lock_pi+0x10/0x10 [ 45.985018][ T995] ? __cfi_futex_wake_mark+0x10/0x10 [ 45.985048][ T995] ? futex_setup_timer+0xb4/0xd0 [ 45.985070][ T995] ? __cfi_futex_wake_mark+0x10/0x10 [ 45.985094][ T995] ? vfs_write+0x93e/0xf30 [ 45.985110][ T995] do_futex+0x25c/0x500 [ 45.985127][ T995] ? __cfi_do_futex+0x10/0x10 [ 45.985145][ T995] ? mutex_unlock+0x8b/0x240 [ 45.985182][ T995] __se_sys_futex+0x28f/0x300 [ 45.985205][ T995] ? fput+0x1a5/0x240 [ 45.985230][ T995] ? __x64_sys_futex+0x110/0x110 [ 45.985248][ T995] ? __cfi_ksys_write+0x10/0x10 [ 45.985263][ T995] ? __kasan_check_write+0x18/0x20 [ 45.985289][ T995] __x64_sys_futex+0xe9/0x110 [ 45.985315][ T995] x64_sys_call+0x227f/0x2ee0 [ 45.985349][ T995] do_syscall_64+0x58/0xf0 [ 45.985375][ T995] ? clear_bhb_loop+0x50/0xa0 [ 45.985392][ T995] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 45.985486][ T995] RIP: 0033:0x7f1a5bd8eec9 [ 45.985511][ T995] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 45.985526][ T995] RSP: 002b:00007f1a5cbdb038 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 45.985548][ T995] RAX: ffffffffffffffda RBX: 00007f1a5bfe5fa0 RCX: 00007f1a5bd8eec9 [ 45.985561][ T995] RDX: 00000000fffffffd RSI: 000000000000008d RDI: 0000200000004000 [ 45.985572][ T995] RBP: 00007f1a5be11f91 R08: 0000000000000000 R09: 0000000000000000 [ 45.985589][ T995] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 45.985605][ T995] R13: 00007f1a5bfe6038 R14: 00007f1a5bfe5fa0 R15: 00007ffed2e59ff8 [ 45.985626][ T995] [ 45.987071][ T995] __vm_enough_memory: pid: 995, comm: syz.1.222, bytes: 18014402804453376 not enough memory for the allocation [ 46.083151][ T533] usb 1-1: Using ep0 maxpacket: 8 [ 46.138047][ T1003] FAT-fs (rnullb0): bogus number of reserved sectors [ 46.141076][ T533] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 46.146021][ T1003] FAT-fs (rnullb0): Can't find a valid FAT filesystem [ 46.150219][ T533] usb 1-1: config 179 has no interface number 0 [ 46.267024][ T533] usb 1-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 46.278352][ T533] usb 1-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 46.288042][ T471] rust_binder: 1007: removing orphan mapping 0:1048 [ 46.290543][ T533] usb 1-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 46.307086][ T533] usb 1-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 46.321063][ T533] usb 1-1: config 179 interface 65 has no altsetting 0 [ 46.328233][ T533] usb 1-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 46.337932][ T533] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 46.405273][ T790] steelseries 0003:1038:12B6.0004: hidraw0: USB HID v0.00 Device [HID 1038:12b6] on usb-dummy_hcd.2-1/input0 [ 46.471582][ T1034] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 46.471615][ T1034] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:161 [ 46.559325][ T399] usb 1-1: USB disconnect, device number 6 [ 46.575253][ T1041] netlink: 'syz.3.234': attribute type 11 has an invalid length. [ 46.604150][ T986] rust_binder: Error while translating object. [ 46.604211][ T986] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 46.610721][ T986] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:157 [ 46.622819][ T986] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 46.642086][ T986] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 46.665724][ T533] usb 3-1: USB disconnect, device number 9 [ 46.684908][ T1051] rust_binder: Failed to allocate buffer. len:1168, is_oneway:true [ 47.003232][ T399] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 47.091619][ T1072] raw_sendmsg: syz.0.244 forgot to set AF_INET. Fix it! [ 47.103348][ T471] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 47.164859][ T399] usb 4-1: unable to get BOS descriptor or descriptor too short [ 47.173250][ T399] usb 4-1: not running at top speed; connect to a high speed hub [ 47.181828][ T399] usb 4-1: config 5 has an invalid interface number: 29 but max is 0 [ 47.190089][ T399] usb 4-1: config 5 has no interface number 0 [ 47.196464][ T399] usb 4-1: config 5 interface 29 altsetting 3 endpoint 0xF has invalid maxpacket 512, setting to 64 [ 47.207564][ T399] usb 4-1: config 5 interface 29 has no altsetting 0 [ 47.216059][ T399] usb 4-1: New USB device found, idVendor=05a9, idProduct=2643, bcdDevice=49.45 [ 47.225435][ T399] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.233842][ T399] usb 4-1: Product: syz [ 47.238140][ T399] usb 4-1: Manufacturer: syz [ 47.242759][ T399] usb 4-1: SerialNumber: syz [ 47.254390][ T471] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 47.255047][ T1064] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 47.273738][ T471] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 47.283668][ T471] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 47.292742][ T471] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.301514][ T471] usb 3-1: config 0 descriptor?? [ 47.303157][ T533] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 47.307590][ T471] hub 3-1:0.0: USB hub found [ 47.474393][ T533] usb 2-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 47.483605][ T533] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.492625][ T533] usb 2-1: config 0 descriptor?? [ 47.507833][ T471] hub 3-1:0.0: 1 port detected [ 47.902760][ T1070] netlink: 8 bytes leftover after parsing attributes in process `syz.1.243'. [ 47.911893][ T1088] netlink: 8 bytes leftover after parsing attributes in process `syz.1.243'. [ 47.912664][ T1058] __vm_enough_memory: pid: 1058, comm: syz.2.238, bytes: 18014402804453376 not enough memory for the allocation [ 47.932979][ T533] usb 2-1: Cannot set MAC address [ 47.938161][ T533] MOSCHIP usb-ethernet driver 2-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 47.951008][ T533] usb 2-1: USB disconnect, device number 10 [ 48.035015][ T36] kauditd_printk_skb: 14 callbacks suppressed [ 48.035033][ T36] audit: type=1400 audit(1759920740.160:286): avc: denied { sqpoll } for pid=1089 comm="syz.0.248" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 48.043562][ T1090] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 48.060477][ T1090] rust_binder: Read failure Err(EFAULT) in pid:203 [ 48.090110][ T36] audit: type=1400 audit(1759920740.210:287): avc: denied { read } for pid=1091 comm="syz.0.249" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 48.117956][ T1092] __vm_enough_memory: pid: 1092, comm: syz.0.249, bytes: 18014402804453376 not enough memory for the allocation [ 48.176528][ T1103] binder: Bad value for 'max' [ 48.321872][ T1110] 9pnet_fd: Insufficient options for proto=fd [ 48.434803][ T36] audit: type=1400 audit(1759920740.560:288): avc: denied { unlink } for pid=291 comm="syz-executor" name="file2" dev="tmpfs" ino=336 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 48.457927][ T1114] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 48.571871][ T1116] x_tables: unsorted underflow at hook 4 [ 48.577923][ T36] audit: type=1400 audit(1759920740.700:289): avc: denied { nlmsg_read } for pid=1115 comm="syz.1.256" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 48.585442][ T579] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 48.754304][ T579] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 48.765606][ T579] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 48.776716][ T579] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 64 [ 48.787806][ T579] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 48.800022][ T579] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 48.809232][ T579] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 48.817278][ T579] usb 1-1: Product: syz [ 48.821670][ T579] usb 1-1: Manufacturer: syz [ 48.826622][ T579] usb 1-1: SerialNumber: syz [ 48.832323][ T1112] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 48.840341][ T579] cdc_mbim 1-1:1.0: skipping garbage [ 48.994117][ T45] hub 3-1:0.0: hub_ext_port_status failed (err = -32) [ 49.040531][ T1112] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 49.047879][ T1112] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 49.456517][ T579] cdc_mbim 1-1:1.0: failed GET_NTB_PARAMETERS [ 49.462765][ T579] cdc_mbim 1-1:1.0: bind() failure [ 49.468992][ T579] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 49.475880][ T579] cdc_ncm 1-1:1.1: bind() failure [ 49.576728][ T36] audit: type=1400 audit(1759920741.700:290): avc: denied { block_suspend } for pid=1122 comm="syz.1.258" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 49.712116][ T1141] rust_binder: 216: no such ref 1 [ 49.717338][ T1141] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:216 [ 49.777510][ T399] usb 4-1: Found UVC 0.00 device syz (05a9:2643) [ 49.797658][ T399] usb 4-1: No valid video chain found. [ 49.803148][ T1147] mmap: syz.1.266 (1147) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 49.805691][ T399] usb 4-1: USB disconnect, device number 7 [ 49.833499][ T36] audit: type=1400 audit(1759920741.950:291): avc: denied { bind } for pid=1111 comm="syz.0.254" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 49.858757][ T533] rust_binder: 0: removing orphan mapping 0:1048 [ 49.865851][ T790] usb 3-1: USB disconnect, device number 10 [ 49.871342][ T1155] rust_binder: Error while translating object. [ 49.871812][ T1155] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 49.880346][ T1155] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:176 [ 49.948948][ T1168] usb usb8: usbfs: interface 0 claimed by hub while 'syz.2.274' sets config #4096 [ 49.972673][ T1168] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 50.153214][ T399] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 50.153210][ T45] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 50.283190][ T45] usb 2-1: device descriptor read/64, error -71 [ 50.323161][ T399] usb 4-1: Using ep0 maxpacket: 8 [ 50.329392][ T399] usb 4-1: config 1 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 50.340835][ T399] usb 4-1: config 1 interface 0 altsetting 5 bulk endpoint 0x82 has invalid maxpacket 1024 [ 50.351252][ T399] usb 4-1: config 1 interface 0 altsetting 5 bulk endpoint 0x3 has invalid maxpacket 64 [ 50.361087][ T399] usb 4-1: config 1 interface 0 has no altsetting 0 [ 50.369358][ T399] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 50.378586][ T399] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 50.386666][ T399] usb 4-1: Product: syz [ 50.390852][ T399] usb 4-1: Manufacturer: syz [ 50.395588][ T399] usb 4-1: SerialNumber: syz [ 50.402771][ T1150] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 50.410111][ T1150] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 50.493164][ T579] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 50.543159][ T45] usb 2-1: device descriptor read/64, error -71 [ 50.643195][ T579] usb 3-1: Using ep0 maxpacket: 8 [ 50.650334][ T579] usb 3-1: config 1 interface 0 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 50.661521][ T579] usb 3-1: config 1 interface 0 altsetting 128 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 50.674962][ T579] usb 3-1: config 1 interface 0 has no altsetting 0 [ 50.683119][ T579] usb 3-1: New USB device found, idVendor=056a, idProduct=005e, bcdDevice= 0.40 [ 50.692194][ T579] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 50.700244][ T579] usb 3-1: Product: syz [ 50.704468][ T579] usb 3-1: Manufacturer: Ч [ 50.709106][ T579] usb 3-1: SerialNumber: syz [ 50.803189][ T45] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 50.821821][ T1150] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.830910][ T1150] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.843242][ T399] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 50.855492][ T399] usb 4-1: USB disconnect, device number 8 [ 50.915827][ T1182] >: renamed from veth0_vlan (while UP) [ 50.927708][ T579] usbhid 3-1:1.0: can't add hid device: -71 [ 50.933891][ T579] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 50.942152][ T45] usb 2-1: device descriptor read/64, error -71 [ 50.949162][ T579] usb 3-1: USB disconnect, device number 11 [ 51.183175][ T45] usb 2-1: device descriptor read/64, error -71 [ 51.293252][ T45] usb usb2-port1: attempt power cycle [ 51.357936][ T399] usb 1-1: USB disconnect, device number 7 [ 51.378106][ T1188] rust_binder: Write failure EFAULT in pid:185 [ 51.446680][ T1193] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 [ 51.499509][ T1198] binder: Binderfs stats mode cannot be changed during a remount [ 51.527404][ T31] hid-generic 007F:6E8D:0005.0005: item fetching failed at offset 1/5 [ 51.536166][ T31] hid-generic 007F:6E8D:0005.0005: probe with driver hid-generic failed with error -22 [ 51.559076][ T1202] netlink: 9 bytes leftover after parsing attributes in process `syz.2.286'. [ 51.568256][ T1202] gretap0: entered promiscuous mode [ 51.574508][ T1202] netlink: 5 bytes leftover after parsing attributes in process `syz.2.286'. [ 51.583541][ T1202] 0{X: renamed from gretap0 [ 51.589217][ T1202] 0{X: left promiscuous mode [ 51.594387][ T1202] 0{X: entered allmulticast mode [ 51.601035][ T1202] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 51.623288][ T790] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 51.651156][ T45] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 51.681247][ T45] usb 2-1: device descriptor read/8, error -71 [ 51.783596][ T790] usb 4-1: not running at top speed; connect to a high speed hub [ 51.792276][ T790] usb 4-1: config 4 has an invalid interface number: 8 but max is 1 [ 51.800666][ T790] usb 4-1: config 4 has an invalid interface number: 194 but max is 1 [ 51.809134][ T790] usb 4-1: config 4 has an invalid descriptor of length 206, skipping remainder of the config [ 51.819651][ T790] usb 4-1: config 4 has no interface number 0 [ 51.825926][ T790] usb 4-1: config 4 has no interface number 1 [ 51.836324][ T45] usb 2-1: device descriptor read/8, error -71 [ 51.836420][ T790] usb 4-1: config 4 interface 194 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 51.853979][ T790] usb 4-1: config 4 interface 194 altsetting 9 endpoint 0x2 has invalid maxpacket 1023, setting to 64 [ 51.866124][ T790] usb 4-1: config 4 interface 194 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 51.877463][ T790] usb 4-1: config 4 interface 194 altsetting 9 endpoint 0xA has invalid maxpacket 1024, setting to 64 [ 51.888853][ T790] usb 4-1: config 4 interface 194 altsetting 9 has 5 endpoint descriptors, different from the interface descriptor's value: 10 [ 51.902262][ T790] usb 4-1: config 4 interface 8 has no altsetting 0 [ 51.909105][ T790] usb 4-1: config 4 interface 194 has no altsetting 0 [ 51.917681][ T790] usb 4-1: New USB device found, idVendor=05c6, idProduct=9069, bcdDevice=16.60 [ 51.927045][ T790] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 51.935333][ T790] usb 4-1: Product: 쌋譿꽺턱㍫ۢ鑄䊋げ⛨隈㦭ش䒠擼ဖ芠༷藞≙邫蕃汞躐벓庌倒怾팏㈠逋峍ាࢳ嶎Ǝꩧ샒韯뮧糷ﺪ刁뒀뵛㠳焺퉉飖狵䩍ᶜᴒ [ 51.953623][ T790] usb 4-1: Manufacturer: Ъ [ 51.958215][ T790] usb 4-1: SerialNumber: 㰁 [ 52.081557][ T36] audit: type=1400 audit(1759920744.200:292): avc: denied { mounton } for pid=1212 comm="syz.2.290" path="/75/file0" dev="fuse" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 52.103714][ T45] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 52.122041][ T1216] FAT-fs (rnullb0): bogus number of reserved sectors [ 52.124263][ T45] usb 2-1: device descriptor read/8, error -71 [ 52.128876][ T1216] FAT-fs (rnullb0): Can't find a valid FAT filesystem [ 52.158300][ T1218] fuse: Unknown parameter 'max_re))0000' [ 52.159970][ T36] audit: type=1400 audit(1759920744.280:293): avc: denied { ioctl } for pid=1217 comm="syz.2.292" path="/dev/fuse" dev="devtmpfs" ino=23 ioctlcmd=0x9436 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 52.227013][ T1191] rust_binder: 188: no such ref 0 [ 52.232313][ T1191] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 52.240430][ T1191] rust_binder: 188: no such ref 2 [ 52.251463][ T1191] rust_binder: Failed to allocate buffer. len:1128, is_oneway:true [ 52.258119][ T790] usb 4-1: USB disconnect, device number 9 [ 52.264215][ T45] usb 2-1: device descriptor read/8, error -71 [ 52.393269][ T45] usb usb2-port1: unable to enumerate USB device [ 52.796273][ T1242] binder: Unknown parameter 'defcontext01777777777777777777777' [ 52.846936][ T1247] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 52.846969][ T1247] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 52.881031][ T36] audit: type=1400 audit(1759920745.000:294): avc: denied { associate } for pid=1250 comm="syz.3.301" name="pfkey" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 52.909338][ T1251] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 52.909365][ T1251] rust_binder: Read failure Err(EFAULT) in pid:199 [ 52.994278][ T1257] rust_binder: 201: no such ref 3 [ 53.028730][ T1257] rust_binder: 201: no such ref 1 [ 53.035733][ T1259] binder: Bad value for 'stats' [ 53.040869][ T1257] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:201 [ 53.042567][ T36] audit: type=1400 audit(1759920745.160:295): avc: denied { write } for pid=1252 comm="syz.3.302" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 53.108387][ T36] audit: type=1400 audit(1759920745.160:296): avc: denied { write } for pid=1252 comm="syz.3.302" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 53.153329][ T36] audit: type=1400 audit(1759920745.190:297): avc: denied { setopt } for pid=1252 comm="syz.3.302" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 53.733396][ T1272] __vm_enough_memory: pid: 1272, comm: syz.2.309, bytes: 18014402804453376 not enough memory for the allocation [ 53.847668][ T36] audit: type=1400 audit(1759920745.970:298): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 53.852852][ T1303] rust_binder: Write failure EINVAL in pid:247 [ 53.884769][ T36] audit: type=1400 audit(1759920746.010:299): avc: denied { create } for pid=1304 comm="syz.2.319" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 53.892685][ T1303] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 53.988529][ T1310] netlink: 4 bytes leftover after parsing attributes in process `syz.0.321'. [ 53.999343][ T1310] netlink: 4 bytes leftover after parsing attributes in process `syz.0.321'. [ 54.047766][ T790] usb 4-1: new full-speed USB device number 10 using dummy_hcd [ 54.061946][ T1322] rust_binder: 253: no such ref 1 [ 54.067280][ T45] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 54.074936][ T1322] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:253 [ 54.091163][ T1324] rust_binder: Write failure EFAULT in pid:255 [ 54.118235][ T36] audit: type=1400 audit(1759921006.237:300): avc: denied { mount } for pid=1325 comm="syz.2.327" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 54.146503][ T36] audit: type=1400 audit(1759921006.247:301): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 54.224772][ T45] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 54.235057][ T790] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 54.235271][ T45] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 54.246202][ T790] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 54.258392][ T45] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 54.268193][ T790] usb 4-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00 [ 54.278403][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 54.294342][ T45] usb 2-1: SerialNumber: syz [ 54.297667][ T790] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 54.310669][ T790] usb 4-1: config 0 descriptor?? [ 54.316020][ T1289] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 54.326238][ T790] usbhid 4-1:0.0: can't add hid device: -22 [ 54.332260][ T790] usbhid 4-1:0.0: probe with driver usbhid failed with error -22 [ 54.351614][ T1345] binder: Binderfs stats mode cannot be changed during a remount [ 54.411946][ T36] audit: type=1400 audit(1759921006.527:302): avc: denied { create } for pid=1344 comm="syz.0.332" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 54.417591][ T1346] tipc: Enabling of bearer rejected, failed to enable media [ 54.432722][ T36] audit: type=1400 audit(1759921006.537:303): avc: denied { connect } for pid=1344 comm="syz.0.332" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 54.510619][ T1294] netlink: 124 bytes leftover after parsing attributes in process `syz.1.315'. [ 54.522196][ T1294] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 54.531820][ T1294] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.540676][ T790] usb 4-1: USB disconnect, device number 10 [ 54.706581][ T45] usb 2-1: USB disconnect, device number 15 [ 54.724862][ T1350] binder: Bad value for 'max' [ 54.728116][ T1351] binder: Bad value for 'max' [ 54.768224][ T1355] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8230 sclass=netlink_route_socket pid=1355 comm=syz.2.335 [ 54.858292][ T1356] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8230 sclass=netlink_route_socket pid=1356 comm=syz.2.335 [ 54.905593][ T1360] netlink: 'syz.2.336': attribute type 28 has an invalid length. [ 55.153092][ T45] usb 3-1: new low-speed USB device number 12 using dummy_hcd [ 55.281593][ T36] audit: type=1400 audit(1759921007.397:304): avc: denied { bind } for pid=1395 comm="syz.0.349" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 55.303336][ T45] usb 3-1: device descriptor read/64, error -71 [ 55.319352][ T1401] netlink: 'syz.1.350': attribute type 3 has an invalid length. [ 55.327114][ T1401] netlink: 944 bytes leftover after parsing attributes in process `syz.1.350'. [ 55.437108][ T1414] rust_binder: 1410 RLIMIT_NICE not set [ 55.442184][ T533] rust_binder: 1409: removing orphan mapping 0:1024 [ 55.457786][ T1416] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 224, size: 226) [ 55.457826][ T1416] rust_binder: Error while translating object. [ 55.468749][ T1416] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 55.475138][ T1416] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:292 [ 55.508686][ T1420] netlink: 12 bytes leftover after parsing attributes in process `syz.1.357'. [ 55.530207][ T36] audit: type=1400 audit(1759921007.647:305): avc: denied { mounton } for pid=1419 comm="syz.1.357" path="/97/file0" dev="tmpfs" ino=538 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 55.563043][ T45] usb 3-1: device descriptor read/64, error -71 [ 55.653004][ T790] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 55.802966][ T45] usb 3-1: new low-speed USB device number 13 using dummy_hcd [ 55.804270][ T790] usb 1-1: New USB device found, idVendor=0b05, idProduct=17e0, bcdDevice= 0.00 [ 55.819633][ T790] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 55.828331][ T790] usb 1-1: config 0 descriptor?? [ 55.937474][ T45] usb 3-1: device descriptor read/64, error -71 [ 55.953050][ T579] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 56.037223][ T790] usb 1-1: string descriptor 0 read error: -71 [ 56.045999][ T790] usbhid 1-1:0.0: can't add hid device: -71 [ 56.052021][ T790] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 56.064379][ T790] usb 1-1: USB disconnect, device number 8 [ 56.102872][ T579] usb 2-1: Using ep0 maxpacket: 32 [ 56.109112][ T579] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 56.117622][ T579] usb 2-1: config 0 has no interface number 0 [ 56.123789][ T579] usb 2-1: config 0 interface 184 has no altsetting 0 [ 56.132031][ T579] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 56.141876][ T579] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 56.152019][ T579] usb 2-1: Product: syz [ 56.156287][ T579] usb 2-1: Manufacturer: syz [ 56.160918][ T579] usb 2-1: SerialNumber: syz [ 56.169608][ T579] usb 2-1: config 0 descriptor?? [ 56.177053][ T579] smsc75xx v1.0.0 [ 56.192826][ T45] usb 3-1: device descriptor read/64, error -71 [ 56.206643][ T1442] rust_binder: Write failure EFAULT in pid:222 [ 56.207154][ T1442] rust_binder: Write failure EFAULT in pid:222 [ 56.302999][ T45] usb usb3-port1: attempt power cycle [ 56.652728][ T45] usb 3-1: new low-speed USB device number 14 using dummy_hcd [ 56.673877][ T45] usb 3-1: device descriptor read/8, error -71 [ 56.692778][ T533] usb 4-1: new full-speed USB device number 11 using dummy_hcd [ 56.779547][ T579] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 56.790602][ T579] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 56.803775][ T45] usb 3-1: device descriptor read/8, error -71 [ 56.843943][ T533] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 56.853715][ T533] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xB has an invalid bInterval 0, changing to 4 [ 56.866196][ T533] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 56.875338][ T533] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 56.883389][ T533] usb 4-1: Product: syz [ 56.887574][ T533] usb 4-1: Manufacturer: syz [ 56.892183][ T533] usb 4-1: SerialNumber: syz [ 56.897612][ T533] usb 4-1: config 0 descriptor?? [ 57.052717][ T45] usb 3-1: new low-speed USB device number 15 using dummy_hcd [ 57.080375][ T45] usb 3-1: device descriptor read/8, error -71 [ 57.100788][ T1467] IPv6: Can't replace route, no match found [ 57.170969][ T1456] rust_binder: Error in use_page_slow: ESRCH [ 57.170996][ T1456] rust_binder: use_range failure ESRCH [ 57.177339][ T1456] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 57.183091][ T1456] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 57.191172][ T1456] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:236 [ 57.205416][ T533] usb 4-1: USB disconnect, device number 11 [ 57.223919][ T45] usb 3-1: device descriptor read/8, error -71 [ 57.229287][ T336] udevd[336]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 57.332627][ T45] usb usb3-port1: unable to enumerate USB device [ 57.804282][ T579] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 57.818482][ T579] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to write PMT_CTL: -71 [ 57.828640][ T579] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 57.838628][ T579] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -71 [ 57.851103][ T579] usb 2-1: USB disconnect, device number 16 [ 57.995728][ T1485] 9pnet_fd: Insufficient options for proto=fd [ 64.736570][ T1492] syz.2.380 uses obsolete (PF_INET,SOCK_PACKET) [ 64.738776][ T1493] SELinux: security_context_str_to_sid (E) failed with errno=-22 [ 64.751728][ T1498] SELinux: security_context_str_to_sid (sytem_uGй :) failed with errno=-22 [ 64.760973][ T36] kauditd_printk_skb: 4 callbacks suppressed [ 64.761006][ T36] audit: type=1400 audit(1759921016.879:310): avc: denied { bind } for pid=1488 comm="syz.2.380" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 64.807925][ T1504] tmpfs: Bad value for 'nr_blocks' [ 64.881450][ T1515] rust_binder: Write failure EFAULT in pid:307 [ 64.889524][ T1517] SELinux: Context system_u:object_r:fsadm_exec_t:s0 is not valid (left unmapped). [ 64.932974][ T1522] netlink: 8 bytes leftover after parsing attributes in process `syz.0.388'. [ 64.942290][ T36] audit: type=1400 audit(1759921017.059:311): avc: denied { relabelto } for pid=1508 comm="syz.2.385" name="file0" dev="tmpfs" ino=548 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="system_u:object_r:fsadm_exec_t:s0" [ 64.970694][ T1522] erspan0: entered promiscuous mode [ 65.000478][ T36] audit: type=1400 audit(1759921017.059:312): avc: denied { associate } for pid=1508 comm="syz.2.385" name="file0" dev="tmpfs" ino=548 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:fsadm_exec_t:s0" [ 65.044257][ T36] audit: type=1400 audit(1759921017.119:313): avc: denied { mounton } for pid=1508 comm="syz.2.385" path="/99/file0" dev="tmpfs" ino=548 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="system_u:object_r:fsadm_exec_t:s0" [ 65.147861][ T36] audit: type=1400 audit(1759921017.269:314): avc: denied { unlink } for pid=289 comm="syz-executor" name="file0" dev="tmpfs" ino=548 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="system_u:object_r:fsadm_exec_t:s0" [ 65.163162][ T1536] rust_binder: 295: no such ref 3 [ 65.186565][ T1536] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:295 [ 65.234543][ T36] audit: type=1400 audit(1759921017.359:315): avc: denied { connect } for pid=1537 comm="syz.2.393" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 65.320618][ T1118] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 65.338825][ T1542] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:313 [ 65.354410][ T399] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 65.374056][ T36] audit: type=1400 audit(1759921017.499:316): avc: denied { setattr } for pid=1543 comm="syz.2.396" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 65.465735][ T1550] overlayfs: missing 'lowerdir' [ 65.480644][ T1118] usb 4-1: Using ep0 maxpacket: 8 [ 65.487188][ T1118] usb 4-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 65.496593][ T1118] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 65.505627][ T1118] usb 4-1: config 0 descriptor?? [ 65.527415][ T1559] 9pnet_fd: Insufficient options for proto=fd [ 65.534848][ T399] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 28, changing to 8 [ 65.556682][ T399] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 65.577029][ T399] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 65.594794][ T399] usb 1-1: New USB device found, idVendor=056a, idProduct=00bb, bcdDevice= 0.00 [ 65.603911][ T399] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 65.618306][ T399] usb 1-1: config 0 descriptor?? [ 65.620529][ T579] usb 2-1: new full-speed USB device number 17 using dummy_hcd [ 65.635482][ T1568] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.635505][ T1568] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.642312][ T1568] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.648810][ T1568] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.655338][ T1568] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.661888][ T1568] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.668378][ T1568] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.675041][ T1568] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.681563][ T1568] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.688068][ T1568] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.694605][ T1568] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.701402][ T1568] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.707942][ T1568] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.711729][ T1118] asix 4-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 65.714439][ T1568] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.730536][ T1568] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.737023][ T1568] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.743538][ T1568] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.750023][ T1568] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.781949][ T579] usb 2-1: config index 0 descriptor too short (expected 1051, got 27) [ 65.796905][ T579] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 10 [ 65.809048][ T579] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 65.820380][ T579] usb 2-1: New USB device found, idVendor=06f8, idProduct=b000, bcdDevice=7d.f9 [ 65.829613][ T579] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 65.837720][ T579] usb 2-1: Product: syz [ 65.841951][ T579] usb 2-1: Manufacturer: syz [ 65.846695][ T579] usb 2-1: SerialNumber: syz [ 65.855415][ T579] usb 2-1: config 0 descriptor?? [ 65.982852][ T36] audit: type=1400 audit(1759921018.109:317): avc: denied { bind } for pid=1573 comm="syz.2.405" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 66.064348][ T1547] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 66.073042][ T1547] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 66.083189][ T1547] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 66.091868][ T1547] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 66.104200][ T790] usb 2-1: USB disconnect, device number 17 [ 66.149037][ T36] audit: type=1400 audit(1759921018.270:318): avc: denied { create } for pid=1573 comm="syz.2.405" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 66.169729][ T36] audit: type=1400 audit(1759921018.270:319): avc: denied { write } for pid=1573 comm="syz.2.405" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 66.235284][ T399] usbhid 1-1:0.0: can't add hid device: -71 [ 66.241482][ T399] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 66.250426][ T399] usb 1-1: USB disconnect, device number 9 [ 66.315819][ T1579] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 66.316487][ T1578] netlink: 12 bytes leftover after parsing attributes in process `syz.2.406'. [ 66.332679][ T1578] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:331 [ 66.332685][ T1579] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:331 [ 66.646979][ T1589] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 66.656270][ T1589] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:320 [ 66.826866][ T1603] tipc: Started in network mode [ 66.841064][ T1603] tipc: Node identity 08000000000000000b, cluster identity 4711 [ 67.116815][ T1530] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 67.116961][ T1530] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:255 [ 67.124026][ T1118] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 67.143452][ T1118] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 67.153995][ T1118] asix 4-1:0.0: probe with driver asix failed with error -71 [ 67.162386][ T1118] usb 4-1: USB disconnect, device number 12 [ 67.247077][ T1612] netlink: 72 bytes leftover after parsing attributes in process `syz.2.418'. [ 67.370102][ T579] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 67.447620][ T1618] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:345 [ 67.520099][ T579] usb 1-1: Using ep0 maxpacket: 32 [ 67.535764][ T579] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 67.554091][ T579] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 67.570559][ T579] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 67.579758][ T579] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 67.593626][ T579] usb 1-1: config 0 descriptor?? [ 67.600477][ T1610] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 67.801020][ T1640] rust_binder: Write failure EFAULT in pid:265 [ 67.863224][ T1648] kvm_intel: kvm [1647]: vcpu2, guest rIP: 0xfff0 Unhandled WRMSR(0x1d9) = 0x20000007edd [ 67.888015][ T1648] SELinux: failed to load policy [ 68.018926][ T579] savu 0003:1E7D:2D5A.0006: hiddev96,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.0-1/input0 [ 68.199947][ T1118] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 68.273440][ T579] usb 1-1: USB disconnect, device number 10 [ 68.349877][ T1118] usb 4-1: Using ep0 maxpacket: 16 [ 68.356595][ T1118] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 68.367718][ T1118] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 68.377612][ T1118] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 68.386702][ T1118] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 68.399231][ T1118] usb 4-1: config 0 descriptor?? [ 68.524313][ T1662] netlink: 32 bytes leftover after parsing attributes in process `syz.1.433'. [ 68.544399][ T1662] binder: Unknown parameter 'context[7' [ 68.659200][ T1673] netlink: 8 bytes leftover after parsing attributes in process `syz.1.437'. [ 68.668604][ T1673] rust_binder: Error while translating object. [ 68.668659][ T1673] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 68.675183][ T1673] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:348 [ 68.689823][ T533] usb 3-1: new full-speed USB device number 16 using dummy_hcd [ 68.719062][ T1675] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 68.719956][ T1675] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:350 [ 68.884399][ T1118] savu 0003:1E7D:2D5A.0007: ignoring exceeding usage max [ 68.943063][ T1118] savu 0003:1E7D:2D5A.0007: hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.3-1/input0 [ 68.986513][ T1688] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 69.087953][ T1118] usb 4-1: USB disconnect, device number 13 [ 69.217648][ T1694] netlink: 'syz.0.444': attribute type 27 has an invalid length. [ 69.235601][ T1694] /dev/sr0: Can't lookup blockdev [ 69.248111][ T1694] 9pnet_fd: Insufficient options for proto=fd [ 69.669547][ T579] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 69.789616][ T36] kauditd_printk_skb: 325 callbacks suppressed [ 69.789636][ T36] audit: type=1400 audit(1759921021.920:645): avc: denied { accept } for pid=1707 comm="syz.1.450" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 69.821503][ T533] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 69.833569][ T579] usb 1-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 0 [ 69.834214][ T533] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 69.846606][ T579] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 69.859386][ T533] usb 3-1: New USB device found, idVendor=091c, idProduct=8866, bcdDevice= 0.00 [ 69.869486][ T579] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 69.878713][ T533] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 69.892993][ T579] usb 1-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 69.901780][ T1713] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 69.908623][ T579] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 69.915567][ T533] usb 3-1: config 0 descriptor?? [ 69.927271][ T579] usb 1-1: Product: syz [ 69.932624][ T579] usb 1-1: Manufacturer: syz [ 69.932732][ T1659] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 69.937354][ T579] usb 1-1: SerialNumber: syz [ 69.950277][ T533] usbhid 3-1:0.0: can't add hid device: -22 [ 69.955411][ T579] usb 1-1: config 0 descriptor?? [ 69.959513][ T533] usbhid 3-1:0.0: probe with driver usbhid failed with error -22 [ 69.976516][ T579] usb-storage 1-1:0.0: USB Mass Storage device detected [ 69.980027][ T1715] __vm_enough_memory: pid: 1715, comm: syz.1.452, bytes: 18014402804453376 not enough memory for the allocation [ 69.986613][ T579] usb-storage 1-1:0.0: Quirks match for vid 1908 pid 1315: 20000 [ 70.150043][ T1659] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 70.150119][ T1659] rust_binder: Failed to allocate buffer. len:1160, is_oneway:false [ 70.166771][ T45] usb 3-1: USB disconnect, device number 16 [ 70.216377][ T1699] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:346 [ 70.216777][ T533] usb 1-1: USB disconnect, device number 11 [ 70.249724][ T31] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 70.409435][ T31] usb 2-1: Using ep0 maxpacket: 8 [ 70.415870][ T31] usb 2-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 70.425351][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 70.440430][ T31] usb 2-1: config 0 descriptor?? [ 70.647197][ T31] asix 2-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 71.219204][ T533] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 71.369156][ T533] usb 3-1: Using ep0 maxpacket: 8 [ 71.376189][ T533] usb 3-1: config 1 has an invalid interface number: 6 but max is 3 [ 71.384370][ T533] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 71.393157][ T533] usb 3-1: config 1 has an invalid interface number: 99 but max is 3 [ 71.401356][ T533] usb 3-1: config 1 has an invalid interface number: 94 but max is 3 [ 71.409606][ T533] usb 3-1: config 1 has an invalid interface number: 64 but max is 3 [ 71.417878][ T533] usb 3-1: config 1 has an invalid interface number: 78 but max is 3 [ 71.426671][ T533] usb 3-1: config 1 has an invalid interface number: 6 but max is 3 [ 71.434775][ T533] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 71.443558][ T533] usb 3-1: config 1 has 5 interfaces, different from the descriptor's value: 4 [ 71.452626][ T533] usb 3-1: config 1 has no interface number 0 [ 71.458865][ T533] usb 3-1: config 1 has no interface number 1 [ 71.465038][ T533] usb 3-1: config 1 has no interface number 2 [ 71.471358][ T533] usb 3-1: config 1 has no interface number 3 [ 71.477590][ T533] usb 3-1: config 1 has no interface number 4 [ 71.483752][ T533] usb 3-1: config 1 interface 6 altsetting 228 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 71.495012][ T533] usb 3-1: config 1 interface 6 altsetting 228 has a duplicate endpoint with address 0x3, skipping [ 71.505915][ T533] usb 3-1: config 1 interface 6 altsetting 228 has a duplicate endpoint with address 0x3, skipping [ 71.516721][ T533] usb 3-1: config 1 interface 99 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 71.527618][ T533] usb 3-1: config 1 interface 99 altsetting 5 has a duplicate endpoint with address 0x3, skipping [ 71.528200][ T36] audit: type=1400 audit(1759921023.651:646): avc: denied { read } for pid=1753 comm="syz.3.464" path="socket:[12371]" dev="sockfs" ino=12371 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 71.538330][ T533] usb 3-1: config 1 interface 99 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 71.572391][ T533] usb 3-1: config 1 interface 99 altsetting 5 endpoint 0x9 has invalid maxpacket 512, setting to 64 [ 71.583320][ T533] usb 3-1: config 1 interface 99 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 7 [ 71.596435][ T533] usb 3-1: too many endpoints for config 1 interface 94 altsetting 128: 161, using maximum allowed: 30 [ 71.607626][ T533] usb 3-1: config 1 interface 94 altsetting 128 has a duplicate endpoint with address 0x7, skipping [ 71.618534][ T533] usb 3-1: config 1 interface 94 altsetting 128 has 3 endpoint descriptors, different from the interface descriptor's value: 161 [ 71.631985][ T533] usb 3-1: config 1 interface 64 altsetting 8 has a duplicate endpoint with address 0x9, skipping [ 71.638247][ T1761] fuse: Bad value for 'fd' [ 71.642966][ T533] usb 3-1: config 1 interface 64 altsetting 8 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 71.660433][ T533] usb 3-1: too many endpoints for config 1 interface 78 altsetting 5: 112, using maximum allowed: 30 [ 71.671563][ T533] usb 3-1: config 1 interface 78 altsetting 5 has a duplicate endpoint with address 0xB, skipping [ 71.682448][ T533] usb 3-1: config 1 interface 78 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 112 [ 71.695768][ T533] usb 3-1: config 1 interface 6 altsetting 253 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 71.706826][ T533] usb 3-1: config 1 interface 6 altsetting 253 has an invalid descriptor for endpoint zero, skipping [ 71.742345][ T533] usb 3-1: config 1 interface 6 altsetting 253 endpoint 0xF has invalid maxpacket 512, setting to 64 [ 71.756048][ T533] usb 3-1: config 1 interface 6 altsetting 253 has a duplicate endpoint with address 0xF, skipping [ 71.766911][ T533] usb 3-1: config 1 interface 6 altsetting 253 has a duplicate endpoint with address 0x2, skipping [ 71.777671][ T533] usb 3-1: config 1 interface 6 altsetting 253 has a duplicate endpoint with address 0x9, skipping [ 71.790477][ T533] usb 3-1: config 1 interface 6 altsetting 253 has a duplicate endpoint with address 0x2, skipping [ 71.792309][ T1776] netlink: 'syz.3.471': attribute type 4 has an invalid length. [ 71.801293][ T533] usb 3-1: config 1 interface 6 altsetting 253 has a duplicate endpoint with address 0x6, skipping [ 71.801328][ T533] usb 3-1: config 1 interface 6 altsetting 253 has an endpoint descriptor with address 0x1F, changing to 0xF [ 71.809123][ T1776] netlink: 3657 bytes leftover after parsing attributes in process `syz.3.471'. [ 71.820236][ T533] usb 3-1: config 1 interface 6 altsetting 253 has a duplicate endpoint with address 0xF, skipping [ 71.851578][ T533] usb 3-1: config 1 interface 6 altsetting 253 has a duplicate endpoint with address 0x9, skipping [ 71.863283][ T533] usb 3-1: config 1 interface 6 altsetting 253 endpoint 0x7 has invalid maxpacket 1072, setting to 1024 [ 71.876401][ T533] usb 3-1: config 1 interface 6 altsetting 253 has a duplicate endpoint with address 0xD, skipping [ 71.887184][ T533] usb 3-1: config 1 interface 6 altsetting 253 has a duplicate endpoint with address 0x2, skipping [ 71.903677][ T533] usb 3-1: config 1 interface 6 altsetting 253 has 16 endpoint descriptors, different from the interface descriptor's value: 15 [ 71.917391][ T533] usb 3-1: config 1 interface 6 has no altsetting 0 [ 71.924120][ T533] usb 3-1: config 1 interface 6 has no altsetting 1 [ 71.932847][ T533] usb 3-1: config 1 interface 99 has no altsetting 0 [ 71.945295][ T533] usb 3-1: config 1 interface 94 has no altsetting 0 [ 71.952903][ T533] usb 3-1: config 1 interface 64 has no altsetting 0 [ 71.959681][ T533] usb 3-1: config 1 interface 78 has no altsetting 0 [ 71.970331][ T533] usb 3-1: New USB device found, idVendor=0b05, idProduct=171d, bcdDevice=d5.00 [ 71.979490][ T533] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.987531][ T533] usb 3-1: Product: ⡦䝪㿾辌岔染肛ಝ臎寸൪ꩡ鿀ꅏ껣쉇鑧陁ᅰ論끯彉巉愹ᔆ㋀濤별謃撎俁ߜ鉚㲴춻惢顆혩売ᯧ屈춗뮚◜佯黕㜆婇″垇嚂흺ᓛᤱ␷㊛九ﲁႍ♖⑛豅點㤄滃竰ồ㦴☾엁ʌ寻푰㻌壑矵섧䊉뾚鸧藓졘ඌ剋槚傀梠쫚遻攭䢧嬯㺵痁╾⣇蝭㸈㿴瓺큄ᒂ䷙঵㵠 [ 72.020645][ T533] usb 3-1: Manufacturer: 〉 [ 72.025261][ T533] usb 3-1: SerialNumber: syz [ 72.053222][ T1719] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 72.053393][ T1719] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:372 [ 72.060905][ T31] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 72.080719][ T31] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 72.091060][ T31] asix 2-1:0.0: probe with driver asix failed with error -71 [ 72.099566][ T31] usb 2-1: USB disconnect, device number 18 [ 72.233513][ T1752] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 72.233542][ T1752] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:368 [ 72.247160][ T533] hub 3-1:1.99: Invalid hub with more than one config or interface [ 72.264393][ T533] hub 3-1:1.99: probe with driver hub failed with error -22 [ 72.277113][ T533] usb 3-1: USB disconnect, device number 17 [ 72.475424][ T36] audit: type=1400 audit(1759921024.601:647): avc: denied { map } for pid=1786 comm="syz.3.474" path="socket:[13416]" dev="sockfs" ino=13416 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 72.544958][ T36] audit: type=1400 audit(1759921024.671:648): avc: denied { associate } for pid=1794 comm="syz.3.477" name="#b" scontext=root:object_r:etc_runtime_t tcontext=system_u:object_r:root_t tclass=filesystem permissive=1 [ 72.545004][ T1795] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 72.573181][ T1795] overlayfs: failed to set xattr on upper [ 72.578942][ T1795] overlayfs: ...falling back to redirect_dir=nofollow. [ 72.585801][ T1795] overlayfs: ...falling back to uuid=null. [ 72.594615][ T36] audit: type=1400 audit(1759921024.721:649): avc: denied { create } for pid=1794 comm="syz.3.477" name="#d" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=chr_file permissive=1 [ 72.618071][ T36] audit: type=1400 audit(1759921024.721:650): avc: denied { link } for pid=1794 comm="syz.3.477" name="#d" dev="rootfs" ino=13460 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=chr_file permissive=1 [ 72.639773][ T36] audit: type=1400 audit(1759921024.721:651): avc: denied { rename } for pid=1794 comm="syz.3.477" name="#e" dev="rootfs" ino=13460 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=chr_file permissive=1 [ 72.661637][ T36] audit: type=1400 audit(1759921024.721:652): avc: denied { unlink } for pid=1794 comm="syz.3.477" name="file0" dev="rootfs" ino=13460 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=chr_file permissive=1 [ 72.878875][ T1808] netlink: 'syz.0.481': attribute type 11 has an invalid length. [ 73.026266][ T1819] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.202466][ T1832] binder: Binderfs stats mode cannot be changed during a remount [ 73.260493][ T1838] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:384 [ 73.288734][ T31] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 73.448623][ T31] usb 1-1: Using ep0 maxpacket: 8 [ 73.454982][ T31] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 73.464122][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 73.472757][ T31] usb 1-1: config 0 descriptor?? [ 73.518642][ T790] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 73.648827][ T790] usb 2-1: device descriptor read/64, error -71 [ 73.688603][ T31] asix 1-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 73.888540][ T790] usb 2-1: device descriptor read/64, error -71 [ 74.128462][ T790] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 74.220024][ T1858] IPv6: NLM_F_CREATE should be specified when creating new route [ 74.258444][ T790] usb 2-1: device descriptor read/64, error -71 [ 74.498370][ T790] usb 2-1: device descriptor read/64, error -71 [ 74.538412][ T36] audit: type=1400 audit(1759921026.672:653): avc: denied { bind } for pid=1868 comm="syz.3.504" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 74.559432][ T1869] fuse: Bad value for 'fd' [ 74.608454][ T790] usb usb2-port1: attempt power cycle [ 74.628389][ T471] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 74.655854][ T1882] overlayfs: failed to clone upperpath [ 74.745025][ T1891] netlink: 44 bytes leftover after parsing attributes in process `syz.3.512'. [ 74.786571][ T1893] netlink: 'syz.3.513': attribute type 7 has an invalid length. [ 74.794372][ T1893] netlink: 'syz.3.513': attribute type 5 has an invalid length. [ 74.802346][ T1893] netlink: 17 bytes leftover after parsing attributes in process `syz.3.513'. [ 74.803309][ T471] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 74.822732][ T471] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 74.833056][ T36] audit: type=1400 audit(1759921026.952:654): avc: denied { shutdown } for pid=1894 comm="syz.3.514" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 74.846706][ T1897] netlink: 188 bytes leftover after parsing attributes in process `syz.3.515'. [ 74.852719][ T471] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 74.871222][ T36] audit: type=1400 audit(1759921026.952:655): avc: denied { ioctl } for pid=1894 comm="syz.3.514" path="socket:[13755]" dev="sockfs" ino=13755 ioctlcmd=0x9432 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 74.896007][ T471] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 74.905171][ T471] usb 3-1: config 0 descriptor?? [ 74.948321][ T790] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 74.969517][ T790] usb 2-1: device descriptor read/8, error -71 [ 75.039741][ T36] audit: type=1400 audit(1759921027.172:656): avc: denied { mounton } for pid=1911 comm="syz.3.522" path="/" dev="rootfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 75.096812][ T1827] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 75.097024][ T1827] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:388 [ 75.104596][ T31] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 75.104986][ T790] usb 2-1: device descriptor read/8, error -71 [ 75.114957][ T31] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 75.140868][ T31] asix 1-1:0.0: probe with driver asix failed with error -71 [ 75.149630][ T31] usb 1-1: USB disconnect, device number 12 [ 75.358246][ T790] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 75.379491][ T790] usb 2-1: device descriptor read/8, error -71 [ 75.509297][ T790] usb 2-1: device descriptor read/8, error -71 [ 75.578753][ T471] usb 3-1: string descriptor 0 read error: -71 [ 75.585231][ T471] uclogic 0003:256C:006D.0008: failed retrieving string descriptor #200: -71 [ 75.594303][ T471] uclogic 0003:256C:006D.0008: failed retrieving pen parameters: -71 [ 75.602888][ T471] uclogic 0003:256C:006D.0008: failed probing pen v2 parameters: -71 [ 75.611319][ T471] uclogic 0003:256C:006D.0008: failed probing parameters: -71 [ 75.619207][ T471] uclogic 0003:256C:006D.0008: probe with driver uclogic failed with error -71 [ 75.628354][ T790] usb usb2-port1: unable to enumerate USB device [ 75.630117][ T471] usb 3-1: USB disconnect, device number 18 [ 76.216354][ T1946] overlayfs: failed to clone upperpath [ 76.235968][ T36] audit: type=1400 audit(1759921028.362:657): avc: denied { getopt } for pid=1948 comm="syz.3.534" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 76.707865][ T399] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 76.857791][ T399] usb 2-1: Using ep0 maxpacket: 16 [ 76.864669][ T399] usb 2-1: unable to get BOS descriptor or descriptor too short [ 76.873621][ T399] usb 2-1: config 13 has an invalid interface number: 221 but max is 0 [ 76.882127][ T399] usb 2-1: config 13 has an invalid descriptor of length 36, skipping remainder of the config [ 76.892839][ T399] usb 2-1: config 13 has no interface number 0 [ 76.899316][ T399] usb 2-1: config 13 interface 221 altsetting 167 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 76.913245][ T399] usb 2-1: config 13 interface 221 has no altsetting 0 [ 76.922839][ T399] usb 2-1: string descriptor 0 read error: -22 [ 76.929457][ T399] usb 2-1: New USB device found, idVendor=19d2, idProduct=0c84, bcdDevice=5d.35 [ 76.938923][ T399] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 77.190391][ T471] usb 2-1: USB disconnect, device number 23 [ 77.217382][ T36] audit: type=1400 audit(1759921029.332:658): avc: denied { mount } for pid=1972 comm="syz.3.542" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 77.607919][ T1987] rust_binder: 1986 RLIMIT_NICE not set [ 77.608991][ T1986] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 77.619593][ T399] rust_binder: 1985: removing orphan mapping 0:1144 [ 77.661928][ T1994] rust_binder: Failed copying remainder into alloc: EFAULT [ 77.661948][ T1994] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 77.669274][ T1994] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 77.677798][ T1994] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:429 [ 77.713650][ T36] audit: type=1326 audit(1759921029.832:659): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1999 comm="syz.1.550" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1a5bd8eec9 code=0x7ffc0000 [ 77.717294][ T2000] rust_binder: Error while translating object. [ 77.723014][ T36] audit: type=1326 audit(1759921029.832:660): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1999 comm="syz.1.550" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1a5bd8eec9 code=0x7ffc0000 [ 77.747180][ T2000] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 77.764117][ T36] audit: type=1326 audit(1759921029.832:661): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1999 comm="syz.1.550" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f1a5bd8eec9 code=0x7ffc0000 [ 77.776655][ T2000] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:393 [ 77.789091][ T36] audit: type=1326 audit(1759921029.832:662): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1999 comm="syz.1.550" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1a5bd8eec9 code=0x7ffc0000 [ 77.844289][ T2004] overlayfs: conflicting options: metacopy=off,verity=require [ 77.849030][ T36] audit: type=1326 audit(1759921029.832:663): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1999 comm="syz.1.550" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f1a5bd8eec9 code=0x7ffc0000 [ 77.937589][ T471] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 78.067521][ T471] usb 3-1: device descriptor read/64, error -71 [ 78.157507][ T45] usb 2-1: new full-speed USB device number 24 using dummy_hcd [ 78.307574][ T471] usb 3-1: device descriptor read/64, error -71 [ 78.315121][ T45] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 78.328233][ T45] usb 2-1: New USB device found, idVendor=0458, idProduct=5014, bcdDevice= 0.00 [ 78.337806][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 78.346821][ T45] usb 2-1: config 0 descriptor?? [ 78.373534][ T2015] incfs_lookup_dentry err:-13 [ 78.378343][ T2015] incfs: Can't find or create .index dir in ./bus [ 78.384854][ T2015] incfs: mount failed -13 [ 78.547412][ T471] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 78.677367][ T471] usb 3-1: device descriptor read/64, error -71 [ 78.758339][ T45] kye 0003:0458:5014.0009: tablet report size too small, or kye_tablet_rdesc unexpectedly large [ 78.769116][ T45] kye 0003:0458:5014.0009: unknown main item tag 0x4 [ 78.776563][ T45] kye 0003:0458:5014.0009: hidraw0: USB HID v1.00 Device [HID 0458:5014] on usb-dummy_hcd.1-1/input0 [ 78.787690][ T45] kye 0003:0458:5014.0009: tablet-enabling feature report not found [ 78.795718][ T45] kye 0003:0458:5014.0009: tablet enabling failed [ 78.927349][ T471] usb 3-1: device descriptor read/64, error -71 [ 79.003984][ T2007] rust_binder: Error in use_page_slow: ESRCH [ 79.004014][ T2007] rust_binder: use_range failure ESRCH [ 79.010167][ T2007] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 79.015675][ T2007] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 79.024113][ T2007] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:398 [ 79.038036][ T471] usb usb3-port1: attempt power cycle [ 79.038117][ T790] usb 2-1: USB disconnect, device number 24 [ 79.387203][ T471] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 79.408393][ T471] usb 3-1: device descriptor read/8, error -71 [ 79.538253][ T471] usb 3-1: device descriptor read/8, error -71 [ 79.659413][ T2064] fuse: Bad value for 'fd' [ 79.777101][ T471] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 79.793991][ T2090] rust_binder: Error while translating object. [ 79.794018][ T2090] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 79.800414][ T2090] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:404 [ 79.808016][ T471] usb 3-1: device descriptor read/8, error -71 [ 79.958282][ T471] usb 3-1: device descriptor read/8, error -71 [ 79.997073][ T790] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 80.009067][ T2103] binder: Bad value for 'max' [ 80.013962][ T2103] binder: Bad value for 'max' [ 80.019041][ T2103] binder: Bad value for 'max' [ 80.024397][ T2103] binder: Bad value for 'max' [ 80.029876][ T2103] binder: Bad value for 'max' [ 80.034776][ T2103] binder: Bad value for 'max' [ 80.039992][ T2103] binder: Bad value for 'max' [ 80.044909][ T2103] binder: Bad value for 'max' [ 80.050089][ T2103] binder: Bad value for 'max' [ 80.055009][ T2103] binder: Bad value for 'max' [ 80.060117][ T2103] binder: Bad value for 'max' [ 80.064970][ T2103] binder: Bad value for 'max' [ 80.070022][ T2103] binder: Bad value for 'max' [ 80.074949][ T2103] binder: Bad value for 'max' [ 80.080035][ T471] usb usb3-port1: unable to enumerate USB device [ 80.086551][ T2103] binder: Bad value for 'max' [ 80.092064][ T2103] binder: Bad value for 'max' [ 80.096929][ T2103] binder: Bad value for 'max' [ 80.102053][ T2103] binder: Bad value for 'max' [ 80.106919][ T2103] binder: Bad value for 'max' [ 80.112039][ T2103] binder: Bad value for 'max' [ 80.116898][ T2103] binder: Bad value for 'max' [ 80.121957][ T2103] binder: Bad value for 'max' [ 80.126898][ T2103] binder: Bad value for 'max' [ 80.127028][ T790] usb 2-1: device descriptor read/64, error -71 [ 80.133113][ T2103] binder: Bad value for 'max' [ 80.142906][ T2103] binder: Bad value for 'max' [ 80.147942][ T2103] binder: Bad value for 'max' [ 80.152803][ T2103] binder: Bad value for 'max' [ 80.157855][ T2103] binder: Bad value for 'max' [ 80.162691][ T2103] binder: Bad value for 'max' [ 80.167728][ T2103] binder: Bad value for 'max' [ 80.172609][ T2103] binder: Bad value for 'max' [ 80.177679][ T2103] binder: Bad value for 'max' [ 80.182550][ T2103] binder: Bad value for 'max' [ 80.187694][ T2103] binder: Bad value for 'max' [ 80.192601][ T2103] binder: Bad value for 'max' [ 80.197430][ T2103] binder: Bad value for 'max' [ 80.202309][ T2103] binder: Bad value for 'max' [ 80.207125][ T2103] binder: Bad value for 'max' [ 80.211892][ T2103] binder: Bad value for 'max' [ 80.216655][ T2103] binder: Bad value for 'max' [ 80.221481][ T2103] binder: Bad value for 'max' [ 80.226274][ T2103] binder: Bad value for 'max' [ 80.231086][ T2103] binder: Bad value for 'max' [ 80.235920][ T2103] binder: Bad value for 'max' [ 80.240791][ T2103] binder: Bad value for 'max' [ 80.245571][ T2103] binder: Bad value for 'max' [ 80.250385][ T2103] binder: Bad value for 'max' [ 80.255164][ T2103] binder: Bad value for 'max' [ 80.260089][ T2103] binder: Bad value for 'max' [ 80.265646][ T2103] binder: Bad value for 'max' [ 80.270830][ T2103] binder: Bad value for 'max' [ 80.275660][ T2103] binder: Bad value for 'max' [ 80.280701][ T2103] binder: Bad value for 'max' [ 80.285571][ T2103] binder: Bad value for 'max' [ 80.290389][ T2103] binder: Bad value for 'max' [ 80.295359][ T2103] binder: Bad value for 'max' [ 80.300244][ T2103] binder: Bad value for 'max' [ 80.305029][ T2103] binder: Bad value for 'max' [ 80.309899][ T2103] binder: Bad value for 'max' [ 80.315116][ T2103] binder: Bad value for 'max' [ 80.319984][ T2103] binder: Bad value for 'max' [ 80.324750][ T2103] binder: Bad value for 'max' [ 80.329575][ T2103] binder: Bad value for 'max' [ 80.334352][ T2103] binder: Bad value for 'max' [ 80.339390][ T2103] binder: Bad value for 'max' [ 80.387172][ T2107] proc: Unknown parameter '0x0000000000000000' [ 80.388065][ T36] kauditd_printk_skb: 20 callbacks suppressed [ 80.388088][ T36] audit: type=1400 audit(1759921032.513:684): avc: denied { remount } for pid=2106 comm="syz.0.589" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 80.419470][ T790] usb 2-1: device descriptor read/64, error -71 [ 80.438915][ T36] audit: type=1326 audit(1759921032.563:685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2111 comm="syz.0.591" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff42ff8eec9 code=0x0 [ 80.491803][ T36] audit: type=1400 audit(1759921032.613:686): avc: denied { setattr } for pid=2120 comm="syz.3.595" name="RAW" dev="sockfs" ino=12850 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 80.656903][ T790] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 80.786862][ T790] usb 2-1: device descriptor read/64, error -71 [ 81.015853][ T2135] rust_binder: Failed to allocate buffer. len:4240, is_oneway:false [ 81.036846][ T790] usb 2-1: device descriptor read/64, error -71 [ 81.056702][ T2146] rust_binder: 452: no such ref 0 [ 81.062024][ T2146] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 81.069130][ T2146] rust_binder: 452: no such ref 2 [ 81.074286][ T2146] rust_binder: Failed to allocate buffer. len:1128, is_oneway:false [ 81.129309][ T36] audit: type=1400 audit(1759921033.253:687): avc: denied { create } for pid=2156 comm="syz.3.606" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 81.160504][ T790] usb usb2-port1: attempt power cycle [ 81.240567][ T36] audit: type=1400 audit(1759921033.363:688): avc: denied { map } for pid=2167 comm="syz.2.610" path="socket:[13014]" dev="sockfs" ino=13014 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 81.506717][ T790] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 81.527862][ T790] usb 2-1: device descriptor read/8, error -71 [ 81.657753][ T790] usb 2-1: device descriptor read/8, error -71 [ 81.792889][ T2184] rust_binder: Error while translating object. [ 81.792920][ T2184] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 81.799308][ T2184] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:470 [ 81.817119][ T36] audit: type=1400 audit(1759921033.943:689): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 81.906611][ T790] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 81.927681][ T790] usb 2-1: device descriptor read/8, error -71 [ 82.039236][ T13] bridge_slave_1: left allmulticast mode [ 82.045017][ T13] bridge_slave_1: left promiscuous mode [ 82.050955][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.059269][ T790] usb 2-1: device descriptor read/8, error -71 [ 82.065752][ T13] bridge_slave_0: left allmulticast mode [ 82.071810][ T13] bridge_slave_0: left promiscuous mode [ 82.077657][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.173396][ T790] usb usb2-port1: unable to enumerate USB device [ 82.230893][ T13] veth1_macvtap: left promiscuous mode [ 82.236620][ T13] >: left promiscuous mode [ 83.848921][ T2234] rust_binder: Error while translating object. [ 83.848975][ T2234] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 83.872282][ T2234] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:418 [ 84.636563][ T36] audit: type=1400 audit(1759921036.764:690): avc: denied { name_bind } for pid=2250 comm="syz.1.636" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 84.675996][ T36] audit: type=1400 audit(1759921036.794:691): avc: denied { create } for pid=2250 comm="syz.1.636" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 84.697212][ T36] audit: type=1400 audit(1759921036.794:692): avc: denied { write } for pid=2250 comm="syz.1.636" name="tcp6" dev="proc" ino=4026532599 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 84.704490][ T2251] tmpfs: Unknown parameter 'noswap00000000000000000000000001000000:0002 00000000000000000000000001000000:0002 01 00000000:0000000C 00:00000000 00000000 0 0 13307 2 ffff888113e44b40 21 4 30 7 7 [ 84.704490][ T2251] ' [ 84.779417][ T2251] __vm_enough_memory: pid: 2251, comm: syz.1.636, bytes: 18014402804453376 not enough memory for the allocation [ 84.809331][ T2249] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:428 [ 85.628507][ T2296] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:427 [ 85.657575][ T36] audit: type=1400 audit(1759921037.784:693): avc: denied { setopt } for pid=2298 comm="syz.1.642" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 85.688323][ T2299] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 85.688629][ T2299] rust_binder: Error while translating object. [ 85.695128][ T2299] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 85.702790][ T2302] rust_binder: 2297 RLIMIT_NICE not set [ 85.712380][ T2299] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:429 [ 85.725864][ T471] rust_binder: 2294: removing orphan mapping 0:1024 [ 85.807874][ T2311] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:436 [ 85.813454][ T2313] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 85.852774][ T2313] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 86.684220][ T36] audit: type=1400 audit(1759921038.804:694): avc: denied { create } for pid=2318 comm="syz.3.648" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 86.985461][ T790] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 87.136618][ T790] usb 1-1: config 0 has an invalid interface number: 182 but max is 1 [ 87.144825][ T790] usb 1-1: config 0 has no interface number 1 [ 87.150984][ T790] usb 1-1: New USB device found, idVendor=0763, idProduct=2001, bcdDevice=9c.af [ 87.160072][ T790] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.168864][ T790] usb 1-1: config 0 descriptor?? [ 87.377556][ T790] usb 1-1: USB disconnect, device number 13 [ 88.155096][ T790] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 88.305069][ T790] usb 1-1: Using ep0 maxpacket: 8 [ 88.312146][ T790] usb 1-1: config 1 has an invalid descriptor of length 157, skipping remainder of the config [ 88.322518][ T790] usb 1-1: config 1 interface 0 altsetting 128 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 88.335621][ T790] usb 1-1: config 1 interface 0 has no altsetting 0 [ 88.343848][ T790] usb 1-1: New USB device found, idVendor=056a, idProduct=005e, bcdDevice= 0.40 [ 88.353119][ T790] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.361190][ T790] usb 1-1: Product: syz [ 88.365405][ T790] usb 1-1: Manufacturer: Ч [ 88.370019][ T790] usb 1-1: SerialNumber: syz [ 88.580189][ T790] usbhid 1-1:1.0: couldn't find an input interrupt endpoint [ 88.589853][ T790] usb 1-1: USB disconnect, device number 14 [ 88.960344][ T2371] netlink: 596 bytes leftover after parsing attributes in process `syz.0.664'. [ 88.975855][ T36] audit: type=1400 audit(1759921041.105:695): avc: denied { ioctl } for pid=2369 comm="syz.1.665" path="socket:[15560]" dev="sockfs" ino=15560 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 89.033989][ T2378] rust_binder: inc_ref_done called when no active inc_refs [ 90.226092][ T2393] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 90.246745][ T2393] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 90.255770][ T2393] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 90.264018][ T2393] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 90.345730][ T2405] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 90.357924][ T36] audit: type=1400 audit(1759921042.485:696): avc: denied { append } for pid=2403 comm="syz.0.676" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 90.476557][ T36] audit: type=1400 audit(1759921042.605:697): avc: denied { lock } for pid=2400 comm="syz.3.675" path="socket:[15671]" dev="sockfs" ino=15671 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 90.503214][ T36] audit: type=1326 audit(1759921042.625:698): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2400 comm="syz.3.675" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5c6218eec9 code=0x0 [ 90.654533][ T790] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 90.804495][ T790] usb 1-1: Using ep0 maxpacket: 16 [ 90.811680][ T790] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 90.820721][ T790] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 90.830927][ T790] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 90.841522][ T790] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 90.850753][ T790] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 90.859001][ T790] usb 1-1: Product: syz [ 90.863189][ T790] usb 1-1: Manufacturer: syz [ 90.867841][ T790] usb 1-1: SerialNumber: syz [ 91.074545][ T2409] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 91.083258][ T2409] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 91.094328][ T790] usb 1-1: 0:2 : does not exist [ 91.109582][ T790] usb 1-1: USB disconnect, device number 15 [ 91.119292][ T1660] udevd[1660]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 91.676063][ T36] audit: type=1400 audit(1759921043.806:699): avc: denied { listen } for pid=2414 comm="syz.0.678" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 91.699916][ T2421] binder: Bad value for 'stats' [ 93.188370][ T36] audit: type=1400 audit(1759921045.316:700): avc: denied { read } for pid=2427 comm="syz.1.683" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 93.373920][ T31] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 93.523783][ T31] usb 1-1: Using ep0 maxpacket: 8 [ 93.530971][ T31] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 93.541236][ T31] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 93.551968][ T31] usb 1-1: New USB device found, idVendor=056a, idProduct=005e, bcdDevice= 0.40 [ 93.561086][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.569130][ T31] usb 1-1: Product: syz [ 93.573303][ T31] usb 1-1: Manufacturer: Ч [ 93.577857][ T31] usb 1-1: SerialNumber: syz [ 93.788659][ T31] usb 1-1: USB disconnect, device number 16 [ 94.083698][ T31] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 94.233716][ T31] usb 1-1: Using ep0 maxpacket: 8 [ 94.240571][ T31] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 94.250732][ T31] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 94.261840][ T31] usb 1-1: language id specifier not provided by device, defaulting to English [ 94.272145][ T31] usb 1-1: New USB device found, idVendor=056a, idProduct=005e, bcdDevice= 0.40 [ 94.281371][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.289434][ T31] usb 1-1: Product: ы [ 94.293527][ T31] usb 1-1: Manufacturer: ࠝ [ 94.298210][ T31] usb 1-1: SerialNumber: ௏躃鱕᫄◗彀姥욢羸쵛쳀櫂㠵弨㵭萶匫씻ƭ覸堲‹ⵉ闩’鋨ⴱ缈舃䜺쩙攠왲턵齀뱐뭙뇌옧北鞚ḷ樲屪닸⧭瘣㊔䰓翱婲煥뺤䠜㛏樕錢鄧訑뀦㣫づ䋰⚀愔德⑂仙姣鷎謨蒔鏲鮾忊韞Œ鋜㚳ᜰ㿰⟉㍥䴕纮抃㨟໳玞錬쩁⋃⋲♄烎녂 [ 94.537309][ T31] usb 1-1: USB disconnect, device number 17 [ 94.705625][ T36] audit: type=1400 audit(1759921046.836:701): avc: denied { map } for pid=2440 comm="syz.3.686" path="socket:[15048]" dev="sockfs" ino=15048 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 94.767253][ T36] audit: type=1400 audit(1759921046.896:702): avc: denied { ioctl } for pid=2447 comm="syz.3.688" path="socket:[15728]" dev="sockfs" ino=15728 ioctlcmd=0x5828 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 94.794295][ T36] audit: type=1400 audit(1759921046.926:703): avc: denied { read } for pid=2447 comm="syz.3.688" path="socket:[15728]" dev="sockfs" ino=15728 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 94.845076][ T36] audit: type=1400 audit(1759921046.926:704): avc: denied { mounton } for pid=2450 comm="syz.1.689" path="/158/file0" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 96.488203][ T2468] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 96.499950][ T2468] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 96.514153][ T2468] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:475 [ 96.514472][ T2468] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=2468 comm=syz.1.694 [ 96.560348][ T36] audit: type=1400 audit(1759921048.687:705): avc: denied { relabelfrom } for pid=2471 comm="syz.1.695" name="" dev="pipefs" ino=15222 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 96.583653][ T2472] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 96.583781][ T2472] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:477 [ 96.612255][ T2474] netlink: 16 bytes leftover after parsing attributes in process `syz.0.696'. [ 96.623150][ T36] audit: type=1400 audit(1759921048.737:706): avc: denied { ioctl } for pid=2473 comm="syz.0.696" path="mnt:[4026532434]" dev="nsfs" ino=4026532434 ioctlcmd=0xb708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 96.647285][ T2474] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 96.664243][ T2474] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 96.672771][ T2474] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 96.681482][ T2474] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 96.863102][ T31] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 97.014219][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 97.026249][ T31] usb 2-1: New USB device found, idVendor=a461, idProduct=bac0, bcdDevice=ab.84 [ 97.035449][ T31] usb 2-1: New USB device strings: Mfr=206, Product=28, SerialNumber=0 [ 97.043739][ T31] usb 2-1: Product: syz [ 97.047897][ T31] usb 2-1: Manufacturer: syz [ 97.053626][ T31] usb 2-1: config 0 descriptor?? [ 97.462437][ T31] hid-generic 0003:A461:BAC0.000A: hidraw0: USB HID v0.00 Device [syz syz] on usb-dummy_hcd.1-1/input0 [ 97.661802][ T2472] rust_binder: Write failure EFAULT in pid:477 [ 97.663046][ T31] usb 2-1: USB disconnect, device number 29 [ 98.314514][ T2481] netlink: 12 bytes leftover after parsing attributes in process `syz.3.699'. [ 98.394293][ T2494] usb usb7: usbfs: process 2494 (syz.1.703) did not claim interface 0 before use [ 98.437013][ T2502] netlink: 8 bytes leftover after parsing attributes in process `syz.0.706'. [ 98.534093][ T36] audit: type=1400 audit(1759921050.657:707): avc: denied { create } for pid=2511 comm="syz.0.710" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 98.555449][ T36] audit: type=1400 audit(1759921050.667:708): avc: denied { write } for pid=2511 comm="syz.0.710" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 100.359056][ T2526] __vm_enough_memory: pid: 2526, comm: syz.0.714, bytes: 18014402804453376 not enough memory for the allocation [ 100.360956][ T2528] rust_binder: Failed to allocate buffer. len:1152, is_oneway:true [ 100.371541][ T2528] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 100.410639][ T36] audit: type=1400 audit(1759921052.538:709): avc: denied { map } for pid=2533 comm="syz.1.716" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=111 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 100.682127][ T31] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 100.742094][ T533] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 100.843314][ T31] usb 1-1: config 8 has an invalid interface number: 223 but max is 0 [ 100.851519][ T31] usb 1-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 100.861783][ T31] usb 1-1: config 8 has no interface number 0 [ 100.868042][ T31] usb 1-1: config 8 interface 223 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 100.882738][ T31] usb 1-1: New USB device found, idVendor=a6da, idProduct=7458, bcdDevice=2d.4d [ 100.892081][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.900249][ T31] usb 1-1: Product: syz [ 100.904586][ T31] usb 1-1: Manufacturer: syz [ 100.909290][ T31] usb 1-1: SerialNumber: syz [ 100.912072][ T533] usb 2-1: Using ep0 maxpacket: 32 [ 100.920541][ T533] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 100.928857][ T533] usb 2-1: config 0 has no interface number 0 [ 100.935336][ T533] usb 2-1: config 0 interface 184 has no altsetting 0 [ 100.943860][ T533] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 100.952989][ T533] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.961027][ T533] usb 2-1: Product: syz [ 100.965247][ T533] usb 2-1: Manufacturer: syz [ 100.970268][ T533] usb 2-1: SerialNumber: syz [ 100.978403][ T533] usb 2-1: config 0 descriptor?? [ 100.984349][ T533] smsc75xx v1.0.0 [ 100.988032][ T533] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 100.998233][ T533] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -22 [ 101.127593][ T31] usb 1-1: USB disconnect, device number 18 [ 102.319778][ T2547] binder: Bad value for 'defcontext' [ 102.326902][ T36] audit: type=1400 audit(1759921054.458:710): avc: denied { setopt } for pid=2543 comm="syz.3.719" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 102.347479][ T2546] netlink: 4 bytes leftover after parsing attributes in process `syz.3.719'. [ 103.611711][ T790] usb 2-1: USB disconnect, device number 30 [ 104.451950][ T2564] binder: Unknown parameter 'context[7' [ 104.485812][ T2570] FAT-fs (rnullb0): bogus number of reserved sectors [ 104.504718][ T2572] fuse: Unknown parameter 'kq\V.;I+Rog2葬' [ 104.511935][ T2570] FAT-fs (rnullb0): Can't find a valid FAT filesystem [ 104.579553][ T2580] bridge0: port 3(veth0_vlan) entered blocking state [ 104.597035][ T2580] bridge0: port 3(veth0_vlan) entered disabled state [ 104.611195][ T2580] veth0_vlan: entered allmulticast mode [ 104.617412][ T2580] bridge0: port 3(veth0_vlan) entered blocking state [ 104.624173][ T2580] bridge0: port 3(veth0_vlan) entered forwarding state [ 104.646166][ T2580] netlink: 24 bytes leftover after parsing attributes in process `syz.3.728'. [ 106.690849][ T2589] overlayfs: disabling nfs_export due to verity=require [ 106.708085][ T2589] overlayfs: failed to clone upperpath [ 106.777472][ T36] audit: type=1400 audit(1759921058.909:711): avc: denied { mount } for pid=2597 comm="syz.3.737" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 106.822812][ T2607] rust_binder: Write failure EFAULT in pid:523 [ 106.857012][ T2613] __vm_enough_memory: pid: 2613, comm: syz.0.741, bytes: 18014402804453376 not enough memory for the allocation SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: tun: ioctl(TUNSETIFF) failed (errno 22: Invalid argument) loop exited with status 67 SYZFAIL: repeatedly failed to execute the program proc=4 req=623 state=3 status=67 (errno 11: Resource temporarily unavailable) [ 106.928782][ T36] audit: type=1400 audit(1759921059.059:712): avc: denied { write } for pid=282 comm="syz-executor" path="pipe:[3202]" dev="pipefs" ino=3202 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 107.020589][ T533] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 107.103305][ T1226] bridge_slave_1: left allmulticast mode [ 107.109011][ T1226] bridge_slave_1: left promiscuous mode [ 107.121065][ T1226] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.141017][ T1226] bridge_slave_0: left allmulticast mode [ 107.146717][ T1226] bridge_slave_0: left promiscuous mode [ 107.160826][ T1226] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.343405][ T1226] tipc: Left network mode [ 107.348755][ T1226] veth1_macvtap: left promiscuous mode [ 107.354360][ T1226] veth0_vlan: left promiscuous mode [ 107.653242][ T1226] veth0_vlan: left allmulticast mode [ 107.658728][ T1226] bridge0: port 3(veth0_vlan) entered disabled state [ 107.665957][ T1226] bridge_slave_1: left allmulticast mode [ 107.671766][ T1226] bridge_slave_1: left promiscuous mode [ 107.677398][ T1226] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.685006][ T1226] bridge_slave_0: left allmulticast mode [ 107.690776][ T1226] bridge_slave_0: left promiscuous mode [ 107.696591][ T1226] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.704574][ T1226] bridge_slave_1: left allmulticast mode [ 107.710250][ T1226] bridge_slave_1: left promiscuous mode [ 107.716216][ T1226] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.724000][ T1226] bridge_slave_0: left allmulticast mode [ 107.729653][ T1226] bridge_slave_0: left promiscuous mode [ 107.735416][ T1226] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.983848][ T1226] veth1_macvtap: left promiscuous mode [ 107.989418][ T1226] veth0_vlan: left promiscuous mode [ 107.995059][ T1226] veth1_macvtap: left promiscuous mode [ 108.000743][ T1226] veth0_vlan: left promiscuous mode