last executing test programs: 2m31.370873576s ago: executing program 1 (id=893): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeef, 0x8031, 0xffffffffffffffff, 0x1000) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r0, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000001040)="96", 0x1}], 0x1}}], 0x1, 0x4048841) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000001000/0x3000)=nil, 0x3000}, 0x7}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mount$binderfs(0x0, 0x0, &(0x7f0000000140), 0x4800, &(0x7f0000000180)=ANY=[]) 2m31.233586619s ago: executing program 1 (id=897): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000), 0x8) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000), 0x8) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x81, 0x0, 0xb}]}) mount$binderfs(0x0, 0x0, 0x0, 0x4800, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x2, 0x300) (async) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000), 0x8) (async) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000), 0x8) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x81, 0x0, 0xb}]}) (async) mount$binderfs(0x0, 0x0, 0x0, 0x4800, 0x0) (async) close_range(r1, 0xffffffffffffffff, 0x0) (async) 2m31.109918563s ago: executing program 1 (id=900): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0xa, 0x2}) (async) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) fremovexattr(r0, &(0x7f0000000000)=@known='trusted.syz\x00') (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x31, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x10}], 0x5b, 0x0, 0x0}) 2m31.014912125s ago: executing program 1 (id=902): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) fremovexattr(r0, &(0x7f0000000000)=@random={'osx.', '(}$!!\x00'}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1, 0x22052, r0, 0xfffff000) 2m31.013744765s ago: executing program 1 (id=903): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f0000000340)='y\x105\xfc\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xa4\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01L\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x06\xb3\xf0wVq\xe9d\xac\xe9\xaa\x9dR\x00\x9b\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2G\x1b+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2v\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x1e\x11X\f\x0f\xf0\xe2\xb5\xf8', 0xb) ftruncate(r1, 0xffff) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000280)=0x10) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101740, 0x179) socketpair(0xf, 0x3, 0xb83e, &(0x7f0000000040)) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0xffffffffffffff69, 0x0, &(0x7f0000000140)=[@enter_looper, @enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x18, 0x0, &(0x7f0000000180)=[@decrefs, @clear_death], 0x0, 0x0, 0x0}) 2m31.013078665s ago: executing program 1 (id=905): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeef, 0x8031, 0xffffffffffffffff, 0x1000) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r0, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000001040)="96", 0x1}], 0x1}}], 0x1, 0x4048841) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000001000/0x3000)=nil, 0x3000}, 0x7}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mount$binderfs(0x0, 0x0, &(0x7f0000000140), 0x4800, &(0x7f0000000180)=ANY=[]) 2m15.716538216s ago: executing program 32 (id=905): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeef, 0x8031, 0xffffffffffffffff, 0x1000) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r0, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000001040)="96", 0x1}], 0x1}}], 0x1, 0x4048841) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000001000/0x3000)=nil, 0x3000}, 0x7}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mount$binderfs(0x0, 0x0, &(0x7f0000000140), 0x4800, &(0x7f0000000180)=ANY=[]) 1m35.204681963s ago: executing program 2 (id=1497): r0 = gettid() rt_sigqueueinfo(r0, 0x32, &(0x7f0000000000)={0x27, 0x1, 0xc}) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r2 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$inet_int(r2, 0x0, 0xc, &(0x7f0000000140), &(0x7f0000000180)=0x4) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f00000001c0)={0x9, {{0x2, 0x4e22, @rand_addr=0x64010101}}}, 0x90) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x3000003, 0x50, r1, 0x45809000) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) syz_clone3(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 1m35.025851828s ago: executing program 2 (id=1498): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffa) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) syz_open_dev$usbmon(&(0x7f00000000c0), 0xfd2, 0x440) close(0x4) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f00000007c0)='\x00\x00\x03\x06\x00\x00\x00\x1f\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\x87\xa3\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Hd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xd5\b^[D~\x00\x00\x00\x00\x00\x00\x00') close(0x3) 1m34.809268913s ago: executing program 2 (id=1499): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000080), 0x2040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, 0x1}) ioctl$KVM_IRQ_LINE_STATUS(r2, 0xc008ae67, &(0x7f0000000180)={0x4, 0x2007}) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x20c000, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x100000002000c) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) (async) openat$kvm(0x0, &(0x7f0000000080), 0x2040, 0x0) (async) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, 0x1}) (async) ioctl$KVM_IRQ_LINE_STATUS(r2, 0xc008ae67, &(0x7f0000000180)={0x4, 0x2007}) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x20c000, 0x0) (async) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x100000002000c) (async) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) (async) 1m34.524691531s ago: executing program 2 (id=1500): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000cc0)=ANY=[@ANYBLOB="120100004f92b90857152077ebb7000000010902120001000000000904"], 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000140)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x40, 0x13, 0x5e, @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r2, 0x0, &(0x7f0000001740)={0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x40, 0x19, 0x2, "0200"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r2, 0x0, &(0x7f00000000c0)={0x44, &(0x7f0000000080)=ANY=[@ANYBLOB="000101"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) r3 = socket$inet(0x2, 0x2, 0x1) bind$inet(r3, &(0x7f0000000040)={0x2, 0xa00, @broadcast}, 0x10) syz_usb_disconnect(r2) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffa) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x9cc6d000) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f0000000000)='\x00\x00\x03\x06\x00\x00\x00\x1f\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\x87\xa3\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Hd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\xadP\x1c2\xb8H\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&`<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6#M\"\x87\x05W\f0b(p\xb4;\x0e\x18\xf7/A\xfd8\\\x99\xc7Dp\x98\xa4o\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12KL\xf2\xd5\b^[D~\x00\x00\x00\x00\x00\x00\x00\xfe\x8c\x87\x0f\x99\xc3E\xcfc\x8cX\xa3\xf5&}\a\xbf\xf8N\"C!\x1f\x96\xd7\xe9\xa5tw\'\x8f,_\xa0\xea\x90\"\x19i\f\xd5\x02\xe2+\xc1\x8e\xfb@\xc56\xb5\xe4\x91\xbc\xbf\xf7\xea\x01]\xd8\xf8.\x99\x82\x89\x9a\x97\x8b\xdd\xcf\xe6\xb4\xad\xda\x7f\xc8\xd0(Q\x8dP\xd9\xd8(){\xca\x84\xd3(\xb6\xd5\xd4\x94\xdf\xde\x05B\"\xa3L\xc9t\xd4]\x95.\x02\x97\xb5\xc5E\xc7H\x84d\xe6I\xd8\\&\xc6\x81t\xa38u\xc0\xa3\x9b\b,4-\x8a\x9fo:\x86J?\xac\xd1\xa8\x02\xb6\xc5m\x85,\x97\xbe\xba\x0eWnW\xdd,\x1eT\x9c\xde\x9e{;\xb2X\x89\xdc\xcfO6\xba\xcbK\xb5\xfbD\xc9\xc4D\x04BT\xe1\xe9]s\x18$F\x9b\xe9<\xdb\x03\b\xfc\xe9\x19E\x8b\x83\xa6\x84Y\xab\x85\xea\x1f^K\xd6I\x10G<@n\x9e\x81\xc6\x1d\xbc\x1a\xc1G') ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0) 1m34.419480963s ago: executing program 3 (id=1501): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000200)=0x4000000) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000002c0)) ioperm(0x8, 0x1, 0x10001) ioperm(0x3, 0x5, 0x8) r1 = openat$khugepaged_scan(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) flistxattr(r1, 0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x34, 0x1) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x20000) r2 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$MRT6(r2, 0x3a, 0xcf, 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000380)={0x4c, 0x0, &(0x7f00000003c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f00000001c0)={@flat=@binder={0x73622a85, 0x1, 0x2}, @fd, @ptr={0x70742a85, 0x2, 0x0, 0x0, 0x0, 0x31}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, 0x0}) 1m34.237196808s ago: executing program 3 (id=1502): mount$bpf(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x400408, &(0x7f0000000cc0)=ANY=[@ANYBLOB='uid=', @ANYRESHEX=0xee00]) socket$xdp(0x2c, 0x3, 0x0) (async) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x4) (async) write$uinput_user_dev(r0, &(0x7f0000000100)={'syz0\x00', {0x0, 0x7, 0x0, 0x804}, 0x7, [0x4, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x4, 0x0, 0x0, 0xf6, 0x0, 0x0, 0x3, 0x3, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xfffffffd, 0x3, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0xffffffff], [0x0, 0x0, 0x0, 0x10000000, 0x3, 0x0, 0xfffffffe, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3, 0x0, 0xfffffffc, 0x2, 0x0, 0xfffffffe, 0x5, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x6, 0x0, 0xffffffff, 0xfffffffc, 0x0, 0x0, 0x80000, 0x0, 0x8000180d, 0x0, 0xae4d, 0x0, 0x0, 0x3], [0x1, 0x0, 0xfffffffd, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000005, 0x0, 0x3, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x101, 0x1, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x42c, 0x0, 0x0, 0x400, 0x0, 0xed0, 0x4000000], [0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x80, 0x5, 0x0, 0x0, 0x4, 0x0, 0x3e8, 0xfffffffd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0xf, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x101, 0xfffffffb]}, 0x45c) (async) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) write$uinput_user_dev(r0, &(0x7f0000000980)={'syz0\x00', {0xc, 0xc, 0x8ce, 0x8}, 0x28, [0x6, 0x9, 0x8f28, 0x987, 0x7f, 0x80000001, 0x8, 0x80000000, 0x200, 0x8001, 0x36c9, 0xec, 0x1, 0xfffffffb, 0x7fffffff, 0x1, 0x6, 0x5d9, 0x3, 0x0, 0x5, 0xb, 0x9, 0xc9e2, 0x9, 0x7, 0x3, 0xe, 0x8, 0x2aed2b6e, 0x46, 0x7f, 0x400, 0x8000, 0x2, 0x0, 0x3, 0x0, 0x7, 0xa4, 0x4, 0x3, 0x2, 0x6, 0xfffffff2, 0x6, 0x3, 0x7, 0x5, 0x200, 0x2, 0x0, 0x8, 0x10, 0x3, 0x1, 0x40, 0x80000001, 0x9, 0x6, 0x8, 0xcd2, 0x0, 0x5], [0xe9, 0xf, 0x1000, 0x5, 0xffd, 0x9, 0x346d353, 0x6, 0x2f, 0xff, 0x82000000, 0x7f, 0x7fff, 0x3, 0x80b, 0x1, 0x3d5, 0x10000, 0xffff, 0x6, 0xb, 0x5, 0x3, 0x10, 0xcf37, 0x80000000, 0x5, 0x40, 0x4, 0x10, 0x3, 0xfffffff8, 0x4, 0x3, 0x3f1, 0x2, 0xc, 0x91, 0x30000000, 0xfffffff8, 0x4, 0x1ff, 0x2, 0x1c000, 0x5, 0x7, 0x80000001, 0x7, 0x3, 0x9, 0x22f5688b, 0xd6c, 0xf6e5, 0xdf, 0x5, 0x2, 0x2, 0xfffffff8, 0x4, 0xffff, 0xb, 0xffffffff, 0x1, 0x7], [0x0, 0x48, 0x0, 0xa13e, 0x104, 0x3, 0x3, 0x9, 0x8, 0x4, 0x8000, 0x3, 0x5, 0x2, 0x9, 0x5, 0x6, 0x401, 0x9, 0x80000000, 0x0, 0xf, 0x9, 0x6, 0x0, 0x0, 0x8000, 0x7fff, 0x5, 0x5, 0x14580ffb, 0x6, 0x5, 0x1, 0x1, 0x80, 0x400, 0x8, 0xb0, 0x8, 0x9, 0x7, 0x6, 0x97af, 0x7, 0x3, 0x18000, 0x101, 0x3, 0x4, 0xae3, 0x4, 0x8, 0xec, 0x3a, 0x7, 0x186, 0x0, 0x38000000, 0x8b3, 0x9, 0x7, 0x9, 0x4], [0x200, 0x89, 0x0, 0x2, 0x1, 0x7f, 0xa, 0x3, 0x9, 0x6, 0x0, 0x4, 0x0, 0x3, 0x4d1d, 0x2, 0x6, 0x4, 0x5, 0x0, 0x9, 0x9, 0xff, 0xd, 0x4, 0x2, 0x0, 0xe6, 0x6, 0x81, 0xdbe, 0xffff34e6, 0x0, 0x3, 0x800, 0x8000, 0x7, 0xffffffff, 0x376d, 0x3, 0x2, 0x1a, 0x8, 0xe, 0x7, 0x80, 0x2478e471, 0x2, 0x8, 0x4, 0x40000004, 0x1, 0x868, 0x8001, 0x8, 0xb, 0x8, 0xd, 0x80, 0x400004, 0x1, 0x7, 0x8c, 0x200]}, 0x45c) (async) clock_adjtime(0x0, &(0x7f0000000000)={0xffff, 0x5, 0xb0000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3b9ac9ff, 0x0, 0x81, 0x0, 0x2000000000000000, 0x5a6c101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000}) (async) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') write$eventfd(r1, &(0x7f0000000100)=0xae73, 0x8) (async) lseek(r1, 0x10001, 0x0) 1m34.125976431s ago: executing program 3 (id=1503): r0 = eventfd2(0x0, 0x800) readv(r0, &(0x7f0000000040)=[{&(0x7f00000003c0)=""/236, 0xec}], 0x1) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0xfffffffa) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$ASHMEM_SET_NAME(r1, 0x40087708, &(0x7f00000007c0)='\x00\x00\x03\x06\x00\x00\x00\x1f\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\x87\xa3\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Hd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xd5\b^[D~\x00\x00\x00\x00\x00\x00\x00') ioctl$ASHMEM_SET_NAME(r1, 0x40087708, &(0x7f0000000ac0)='\x00\x00\x03\x86\x00\x00\x00\x01\x00x\x92\x12\xbc\x00\x00\xbb\x0642\x9c\x1a\xd1\xcbx\xb0\xd6\x1e\x10gQ\xca\x0e;\xf7\'\x8c\x95\x83=\t7\x94\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcbzA\x8e\xf6\x89\xc2\'\xdfn\x054Y\xd4\x91s\x00\x00\x00-<\r\xd1?$\x8b\x17Bn\xe0\\\x98\xe1%\x1c\xf4\xd0\xf5\xd5\x80\xc4\xb4a \xac\xc4K\x03\xfa\x13Vz\xbf\xe3c\x8d \x0f\xb1\xe9\xf2oci(\xcb\x82\x05\xfe[H\xaf\x01\x18\xc8\x1b\x1e\xbe\xd8>\a\x00\x00\x00\xf7\xafd%\xf1\xdbjE\x01\xd1sD5hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\x851Y9OB\xdeB\xe1\x02-&\"1hS\x92\xe4$-\x02\x00\xe4\x8e\"\x85\xc9x\xef\x81E.r\x89\xe5\x00\x9e\x97\x96\xb8j\x81\xf0\xa5a\xfb\xa6\xff\xfbj\x11\x12\xc0\xbb\xfdq~#\xf7\xa8\"$,\xf4\x84|\x89o\x00<\xa6-\xb0\xd3\x80\xbe\xcf\a\x00\xfc\xa6\xb1\x05\x94\x84l\x05\x00\xeb\xd8\t\x00\x00\x00CvNx461\x04Nl\xedV\xcet\xaa~\x01j\x94\xec\x92\x86uY\xf6\xb5\t?,~\xa67\\\xb9\xc9K\xf8\x9d\x96\xc0\xb5\xc7wF\f\x00\x97T\x90.\x9c\xe3\x9a\xf1\xb9\x9c\x13\xbc\x19\xde/\xaahB\t\x97\a03\xcd\xb3\xc8\xd5l\x14!\xf9Xg\xc52\x1d\xeeB\xccT\x0e\xd8\xef\xc8\xe9\xb4\xf3l\xc3\x99f.\xeb\xe9\x05\xcbkz3+\xdd\xe1*8\x95@0t0\xad\xe3#\xd7\x19\xe7Q\xdfmI\xe5\x1e\xe4\x87\xc9\x8f\xa7\xe0\xd9v\xf6\x01\x9d\x8f`,\x1a8\x81I\x86l\x8f2\r:\xc1\x02\xdeZ%\xa7\x01\x00\x00\x00\x01\x00\x00\x00\xbe\x97\x1fGe\x94\xa6\xa3\xab\xdb\r\x17\xff[\xb1\x00\xff\x7f\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\"Y\xad\xaf\x83\xaf\x93\xdaHg\xd4\x8c\xee\x0f\x00\x1c/\x9a\xf83\';:q\x92\x010g\\Ym\xd8,\x8d\b\xab\x9dq\xed\xcc\xba\x06\x1ej\xb7s33\xe5\xec\xe90M\xd1\xfd\xbb\xdf\xedc\xd1\xbbI\xa3\xbdqU\x02\x00\x00\x00\x00\x00\x00\x00\xee\xb0\v\x84\xc7\xac\xec\x92t\x00\x00\x00\x92\x1a\f\xbbM\x1cG\xb8\xa4\x05\x16\x06\xb6\x1a\tL\xe3C$K~\xf7\xa1mt\x87E\xc4\xb6h\xf3\x8cG=&\xbd\xa16\xaa\xa2N\xac\xad,Q\x97\xd6\x15\xc46v\x9a\x97\xa6\xb9`\x03\x8ff,V\xe8\xeb\x8bJn\x12o\x8b\xe7K)+\xe0\x06\x8a\\\xfc\nw\xf8\x01\xc4\xd8\x97\xd2\x9cF\xda6F\xfa6I\x03o\xa7\x15&*\xf6Wn\xb9\x00~Y\x17:\x03\xef\xf9\x03\xe7\x8d\x16\\/\xe3\xfcV\x9d\xf2g\xbcFy\xca\x8a\x10*\xbdU#\x7f\xbb\'6\x9e\x1d\n\x19\xff[\x92n\xe1\x81q\xfe\x10\xfd\xa6pL\xc6\x0fN\x06&W\xa2\x9dPWp\x94r\xe2\x92X\x12\x87\xe5\x94\xb3Aa\xb1/\\\xde\x9c\x93\xf5(,u|\f`\x8e\x86\xeb\xcb\x18J+\xdcv\x894\x01\xd0\xc6\x95\xea^j(x\xa5\x9b\xd6f1\x9d\x8fcr\x18\x1fs%\x91~\x19@\x84!u\xc8u\x8aL\x021k\xb4\b\xbb_#A{dw<\xb9\x9dR\xef\xaf]\xe0\xca\xd9x\xdab7@\xfd\x0e\x94\xf8\xab\x8c\xf4\xf1\xb0\xd6\xbe\x8e,\xa2Y\x000F\xe6q\xe3~\xc9\xaa!\xf3\'UF\xf0\xc0\x11\x11\xc2\xc9\x93#K\xea\xc2c\xb9\xe7)\xa4\xd9X\xb9\xaay\xd1\xc7\xab\xe9F\xc6r5\xdf\xa0\'y\r\xbf\xbd\x97\x9d\x8aS\xdb\rF\x9e99\xb4\xf7\x8c\xf9\xca;\xef\xc7]\xa4\xdd<6wc5\xc6\xdeS\xe5*H\xed\xc8^a-\xe8\xb1\xc2\xca\xfaE\xfb\x8du\x94\x97\x1cF\x0f\xe9d\xf2\xe4\fc\xdf\xde\x1c\xd8u\x9b\xd7\x9c\x11\xbe\b\xb5\x1e\x04\xa0\xdc\xe1Oxu\xd7O#\n%\x89+\xcc\x9f\x8e\xb2:\xa0\xb0\xdc\xd1\xba\xbd@\xf4\x00\x00\xfd\aqn:\x83\x84N\x83K\xbf^\xd8&\xde\x14\x17\x9d\xcd\xed\x19\xd0\xc1$*K\b$\x12\xf3\x88#\xb1#\xb6RX\x11\x86X\x94\x84\x8e\xdd\x82b\x19b\x9fQ\x91\x98\x9e\xf7\xf6`\x03\xb3\x8a\x86\xf9\x00\x00\x00\x00\x00P\x00'/1056) close(r1) 1m33.957205735s ago: executing program 3 (id=1505): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000080), 0x2382, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, 0x1}) r3 = socket$igmp(0x2, 0x3, 0x2) getsockopt$inet_int(r3, 0x0, 0x22, 0x0, &(0x7f0000000100)) ioctl$KVM_SET_GSI_ROUTING(r2, 0x4008ae6a, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000400000004"]) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) ioctl$KVM_CAP_HYPERV_SYNIC2(r4, 0x4068aea3, &(0x7f0000002240)) (async) ioctl$KVM_CAP_HYPERV_SYNIC2(r4, 0x4068aea3, &(0x7f0000002240)) ioctl$KVM_IRQ_LINE_STATUS(r2, 0xc008ae67, &(0x7f0000000180)={0x4, 0x2007}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r5 = timerfd_create(0x0, 0x0) timerfd_settime(r5, 0x3, &(0x7f0000000140), 0x0) (async) timerfd_settime(r5, 0x3, &(0x7f0000000140), 0x0) readv(r5, &(0x7f0000002500)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1) (async) readv(r5, &(0x7f0000002500)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1) clock_adjtime(0x0, &(0x7f0000000000)={0xffff, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3b9ac9ff, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc}) (async) clock_adjtime(0x0, &(0x7f0000000000)={0xffff, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3b9ac9ff, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r0, 0x45809000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x2000, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x2000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) (async) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) read(r0, &(0x7f0000000040)=""/106, 0x6a) 1m33.793692099s ago: executing program 3 (id=1507): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r3, 0x4038ae7a, &(0x7f0000000180)={0x1, 0x283, 0x0, &(0x7f0000000340)}) ioctl$KVM_SET_CLOCK(r3, 0x4188aec6, &(0x7f0000000040)={0x1, 0x8, 0x0, 0x20000000000000}) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000000)=[@clear_death={0x400c630f, 0xfffffffc}], 0x0, 0x0, &(0x7f00000002c0)}) 1m33.669193422s ago: executing program 3 (id=1508): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x1081, 0x200000000000}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f00000001c0)=[@enter_looper], 0x1ce, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70b7a440b4187098442946238cdd38a235b264899fa2f8b51f8a660653545ab78b6a47b6462efaa8192061344501fb8d96f8de3b132ee012626f94be7b4a9e572a43167614409ee4aa2a40d2feb04bb54137ca025e367e2eee1e8b4f78b741aac17c55ab77d0fd2b7318207e91fd536b9fb7c994a9ad0769020b45bc05965f6dffb15fd462bb2e49632c788cfeb74472be3d9eaf3284719df7187a354b3915df2661363052a24baf8cc101728d302f75878515b436d1fbdb3fc5fc88e8745c56b1bd79dc2cc7e7b5be814275a3edfc67e923d199c97fd6a8b2d11d2923b688471fe8c1e771545d17bad44fc5f7a91cf43ba91b4627c9554a333b6e8ee1c457b54c30bccbbabdfed6158fed6e548cd54ad7409e0a03fb2f685f8987e98ee687a09a730c2a757d3b1595a1146d57230e178284ef3fed5553bbd1e82bd418a13c03f944421d013d96182302122d01c432e24c43a9dff19658a3680167297367a1ee7f70e0968ce28ca2bc8b8525c41f8d4f9cdcaaa25b2d0fea854626eba2e86e"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0xac, 0x0, &(0x7f00000003c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x10}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs={0x40046307, 0x3}, @acquire_done], 0x0, 0x0, 0x0}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x40, r3, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x20040054}, 0x11) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000340)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x200a82, 0x0) 1m33.627199924s ago: executing program 33 (id=1508): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x1081, 0x200000000000}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f00000001c0)=[@enter_looper], 0x1ce, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70b7a440b4187098442946238cdd38a235b264899fa2f8b51f8a660653545ab78b6a47b6462efaa8192061344501fb8d96f8de3b132ee012626f94be7b4a9e572a43167614409ee4aa2a40d2feb04bb54137ca025e367e2eee1e8b4f78b741aac17c55ab77d0fd2b7318207e91fd536b9fb7c994a9ad0769020b45bc05965f6dffb15fd462bb2e49632c788cfeb74472be3d9eaf3284719df7187a354b3915df2661363052a24baf8cc101728d302f75878515b436d1fbdb3fc5fc88e8745c56b1bd79dc2cc7e7b5be814275a3edfc67e923d199c97fd6a8b2d11d2923b688471fe8c1e771545d17bad44fc5f7a91cf43ba91b4627c9554a333b6e8ee1c457b54c30bccbbabdfed6158fed6e548cd54ad7409e0a03fb2f685f8987e98ee687a09a730c2a757d3b1595a1146d57230e178284ef3fed5553bbd1e82bd418a13c03f944421d013d96182302122d01c432e24c43a9dff19658a3680167297367a1ee7f70e0968ce28ca2bc8b8525c41f8d4f9cdcaaa25b2d0fea854626eba2e86e"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0xac, 0x0, &(0x7f00000003c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x10}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs={0x40046307, 0x3}, @acquire_done], 0x0, 0x0, 0x0}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x40, r3, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x20040054}, 0x11) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000340)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x200a82, 0x0) 1m31.098664178s ago: executing program 2 (id=1529): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, 0x0, 0x0) ioctl$FS_IOC_GETFSSYSFSPATH(r0, 0x80811501, &(0x7f0000000100)={0x80}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000280), 0x8800, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r3, 0x107, 0xd, &(0x7f00000004c0)=@req3={0x410000, 0x100000001, 0x210000, 0x1, 0x10000a}, 0x1c) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'ip_vti0\x00', 0x0}) sendto$packet(r3, 0x0, 0x0, 0x400985c, &(0x7f0000000200)={0x11, 0x3, r4, 0x1, 0x4b, 0x6, @remote}, 0x14) read(r2, &(0x7f0000000080)=""/93, 0xffffff6c) socket$inet_tcp(0x2, 0x1, 0x0) (async) setsockopt$inet_mreqn(r0, 0x0, 0x23, 0x0, 0x0) (async) ioctl$FS_IOC_GETFSSYSFSPATH(r0, 0x80811501, &(0x7f0000000100)={0x80}) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000280), 0x8800, 0x0) (async) socket$packet(0x11, 0x3, 0x300) (async) setsockopt$packet_tx_ring(r3, 0x107, 0xd, &(0x7f00000004c0)=@req3={0x410000, 0x100000001, 0x210000, 0x1, 0x10000a}, 0x1c) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'ip_vti0\x00'}) (async) sendto$packet(r3, 0x0, 0x0, 0x400985c, &(0x7f0000000200)={0x11, 0x3, r4, 0x1, 0x4b, 0x6, @remote}, 0x14) (async) read(r2, &(0x7f0000000080)=""/93, 0xffffff6c) (async) 1m30.916061873s ago: executing program 2 (id=1532): pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYRES64=r0], 0x164}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) splice(r0, 0x0, r3, 0x0, 0x4ffe6, 0x0) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r0, 0xf502, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r5, 0x5411, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_control_io$hid(r6, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="00220f00000054b20000935aa8257f90b39e"], 0x0}, 0x0) r7 = syz_open_dev$hiddev(&(0x7f0000000140), 0x0, 0x0) ioctl$HIDIOCSREPORT(r7, 0x400c4808, &(0x7f0000000080)={0x2, 0x100, 0x20a6}) ioctl$HIDIOCGCOLLECTIONINDEX(r7, 0x40184810, 0x0) r8 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$MRT6_DEL_MFC_PROXY(r8, 0x3a, 0xd3, 0x0, 0x0) syz_usb_connect$uac1(0x0, 0xa4, 0x0, 0x0) r9 = syz_open_dev$hiddev(0x0, 0x7, 0x98000) ioctl$HIDIOCGDEVINFO(r9, 0x801c4803, &(0x7f00000001c0)=""/117) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) io_setup(0x9, &(0x7f00000000c0)) syz_clone(0xa0820000, 0x0, 0x0, 0x0, 0x0, 0x0) fcntl$dupfd(r1, 0x0, r3) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) recvmmsg(r8, &(0x7f00000074c0)=[{{&(0x7f0000000240)=@ieee802154={0x24, @long}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000300)=""/183, 0xb7}, {&(0x7f00000003c0)=""/128, 0x80}, {&(0x7f0000000600)=""/4096, 0x1000}, {&(0x7f0000000040)=""/34, 0x22}], 0x4, &(0x7f0000000480)=""/21, 0x15}}, {{&(0x7f00000004c0)=@ax25={{0x3, @default}, [@bcast, @bcast, @remote, @default, @default, @netrom, @null, @rose]}, 0x80, &(0x7f00000027c0)=[{&(0x7f0000000540)=""/93, 0x5d}, {&(0x7f0000001600)=""/219, 0xdb}, {&(0x7f0000001700)=""/67, 0x43}, {&(0x7f0000001780)=""/4096, 0x1000}, {&(0x7f0000002780)=""/63, 0x3f}], 0x5, &(0x7f0000002840)=""/168, 0xa8}, 0x2}, {{&(0x7f0000002900)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0x80, &(0x7f0000003e80)=[{&(0x7f0000002980)=""/4096, 0x1000}, {&(0x7f0000003980)=""/149, 0x95}, {&(0x7f0000003a40)=""/69, 0x45}, {&(0x7f0000003ac0)=""/45, 0x2d}, {&(0x7f0000003b00)=""/125, 0x7d}, {&(0x7f0000003b80)=""/179, 0xb3}, {&(0x7f0000003c40)=""/106, 0x6a}, {&(0x7f0000003cc0)=""/99, 0x63}, {&(0x7f0000003d40)=""/252, 0xfc}, {&(0x7f0000003e40)=""/4, 0x4}], 0xa, &(0x7f0000003f40)=""/172, 0xac}, 0x80000001}, {{&(0x7f0000004000)=@vsock, 0x80, &(0x7f00000054c0)=[{&(0x7f0000004080)=""/4096, 0x1000}, {&(0x7f0000005080)=""/75, 0x4b}, {&(0x7f0000005100)=""/245, 0xf5}, {&(0x7f0000005200)=""/110, 0x6e}, {&(0x7f0000005280)=""/157, 0x9d}, {&(0x7f0000005340)=""/143, 0x8f}, {&(0x7f0000005400)=""/136, 0x88}], 0x7, &(0x7f0000005540)=""/64, 0x40}, 0xc7}, {{&(0x7f0000005580)=@pppoe={0x18, 0x0, {0x0, @link_local}}, 0x80, &(0x7f0000006b80)=[{&(0x7f0000005600)=""/213, 0xd5}, {&(0x7f0000005700)=""/10, 0xa}, {&(0x7f0000005740)=""/221, 0xdd}, {&(0x7f0000005840)=""/176, 0xb0}, {&(0x7f0000005900)=""/118, 0x76}, {&(0x7f0000005980)=""/253, 0xfd}, {&(0x7f0000005a80)=""/234, 0xea}, {&(0x7f0000005b80)=""/4096, 0x1000}], 0x8, &(0x7f0000006c00)=""/83, 0x53}, 0xab9f}, {{&(0x7f0000006c80)=@rc={0x1f, @none}, 0x80, &(0x7f0000007040)=[{&(0x7f0000006d00)=""/185, 0xb9}, {&(0x7f0000006dc0)=""/231, 0xe7}, {&(0x7f0000006ec0)=""/200, 0xc8}, {&(0x7f0000006fc0)=""/96, 0x60}], 0x4}, 0x1}, {{0x0, 0x0, &(0x7f0000007400)=[{&(0x7f0000007080)=""/52, 0x34}, {&(0x7f00000070c0)=""/142, 0x8e}, {&(0x7f0000007180)=""/18, 0x12}, {&(0x7f00000071c0)=""/12, 0xc}, {&(0x7f0000007200)=""/112, 0x70}, {&(0x7f0000007280)=""/196, 0xc4}, {&(0x7f0000007380)=""/90, 0x5a}], 0x7, &(0x7f0000007480)=""/51, 0x33}, 0x1}], 0x7, 0x40010101, &(0x7f00000076c0)) 1m30.765831687s ago: executing program 34 (id=1532): pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYRES64=r0], 0x164}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) splice(r0, 0x0, r3, 0x0, 0x4ffe6, 0x0) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r0, 0xf502, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r5, 0x5411, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_control_io$hid(r6, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="00220f00000054b20000935aa8257f90b39e"], 0x0}, 0x0) r7 = syz_open_dev$hiddev(&(0x7f0000000140), 0x0, 0x0) ioctl$HIDIOCSREPORT(r7, 0x400c4808, &(0x7f0000000080)={0x2, 0x100, 0x20a6}) ioctl$HIDIOCGCOLLECTIONINDEX(r7, 0x40184810, 0x0) r8 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$MRT6_DEL_MFC_PROXY(r8, 0x3a, 0xd3, 0x0, 0x0) syz_usb_connect$uac1(0x0, 0xa4, 0x0, 0x0) r9 = syz_open_dev$hiddev(0x0, 0x7, 0x98000) ioctl$HIDIOCGDEVINFO(r9, 0x801c4803, &(0x7f00000001c0)=""/117) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) io_setup(0x9, &(0x7f00000000c0)) syz_clone(0xa0820000, 0x0, 0x0, 0x0, 0x0, 0x0) fcntl$dupfd(r1, 0x0, r3) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) recvmmsg(r8, &(0x7f00000074c0)=[{{&(0x7f0000000240)=@ieee802154={0x24, @long}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000300)=""/183, 0xb7}, {&(0x7f00000003c0)=""/128, 0x80}, {&(0x7f0000000600)=""/4096, 0x1000}, {&(0x7f0000000040)=""/34, 0x22}], 0x4, &(0x7f0000000480)=""/21, 0x15}}, {{&(0x7f00000004c0)=@ax25={{0x3, @default}, [@bcast, @bcast, @remote, @default, @default, @netrom, @null, @rose]}, 0x80, &(0x7f00000027c0)=[{&(0x7f0000000540)=""/93, 0x5d}, {&(0x7f0000001600)=""/219, 0xdb}, {&(0x7f0000001700)=""/67, 0x43}, {&(0x7f0000001780)=""/4096, 0x1000}, {&(0x7f0000002780)=""/63, 0x3f}], 0x5, &(0x7f0000002840)=""/168, 0xa8}, 0x2}, {{&(0x7f0000002900)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0x80, &(0x7f0000003e80)=[{&(0x7f0000002980)=""/4096, 0x1000}, {&(0x7f0000003980)=""/149, 0x95}, {&(0x7f0000003a40)=""/69, 0x45}, {&(0x7f0000003ac0)=""/45, 0x2d}, {&(0x7f0000003b00)=""/125, 0x7d}, {&(0x7f0000003b80)=""/179, 0xb3}, {&(0x7f0000003c40)=""/106, 0x6a}, {&(0x7f0000003cc0)=""/99, 0x63}, {&(0x7f0000003d40)=""/252, 0xfc}, {&(0x7f0000003e40)=""/4, 0x4}], 0xa, &(0x7f0000003f40)=""/172, 0xac}, 0x80000001}, {{&(0x7f0000004000)=@vsock, 0x80, &(0x7f00000054c0)=[{&(0x7f0000004080)=""/4096, 0x1000}, {&(0x7f0000005080)=""/75, 0x4b}, {&(0x7f0000005100)=""/245, 0xf5}, {&(0x7f0000005200)=""/110, 0x6e}, {&(0x7f0000005280)=""/157, 0x9d}, {&(0x7f0000005340)=""/143, 0x8f}, {&(0x7f0000005400)=""/136, 0x88}], 0x7, &(0x7f0000005540)=""/64, 0x40}, 0xc7}, {{&(0x7f0000005580)=@pppoe={0x18, 0x0, {0x0, @link_local}}, 0x80, &(0x7f0000006b80)=[{&(0x7f0000005600)=""/213, 0xd5}, {&(0x7f0000005700)=""/10, 0xa}, {&(0x7f0000005740)=""/221, 0xdd}, {&(0x7f0000005840)=""/176, 0xb0}, {&(0x7f0000005900)=""/118, 0x76}, {&(0x7f0000005980)=""/253, 0xfd}, {&(0x7f0000005a80)=""/234, 0xea}, {&(0x7f0000005b80)=""/4096, 0x1000}], 0x8, &(0x7f0000006c00)=""/83, 0x53}, 0xab9f}, {{&(0x7f0000006c80)=@rc={0x1f, @none}, 0x80, &(0x7f0000007040)=[{&(0x7f0000006d00)=""/185, 0xb9}, {&(0x7f0000006dc0)=""/231, 0xe7}, {&(0x7f0000006ec0)=""/200, 0xc8}, {&(0x7f0000006fc0)=""/96, 0x60}], 0x4}, 0x1}, {{0x0, 0x0, &(0x7f0000007400)=[{&(0x7f0000007080)=""/52, 0x34}, {&(0x7f00000070c0)=""/142, 0x8e}, {&(0x7f0000007180)=""/18, 0x12}, {&(0x7f00000071c0)=""/12, 0xc}, {&(0x7f0000007200)=""/112, 0x70}, {&(0x7f0000007280)=""/196, 0xc4}, {&(0x7f0000007380)=""/90, 0x5a}], 0x7, &(0x7f0000007480)=""/51, 0x33}, 0x1}], 0x7, 0x40010101, &(0x7f00000076c0)) 1m28.868044855s ago: executing program 0 (id=1555): r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0) fcntl$setflags(r0, 0x2, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) futex(0x0, 0x7, 0x1, 0x0, 0x0, 0x1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000196000/0x1000)=nil, 0x1000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0x0) r2 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mmap(&(0x7f0000fee000/0xf000)=nil, 0xf000, 0x0, 0x11, r2, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x300000c, 0x13, r2, 0x293f000) 1m28.858973996s ago: executing program 0 (id=1556): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x0, 0x0) r1 = socket(0x1e, 0x4, 0x0) connect$tipc(r1, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) sendto$inet6(r1, &(0x7f0000000840)="1cea9f193fe4b3c86784397a3bb7d29f21b4d15eb8024da73e2437f67cac0c25cb77b060fca9732bb03bb48d64b9e94403e56897f3b66bdebb8f21b11ea1e221559fba4080ff5e4fd9f6b53058e576ac419ec8893c67b9961d4789096b1d124cb681cfa5b94297425dfaa40b8eee7c0bcd12fedffa23874ac4162f8b4f8f1f83a1aab2bd42b1b9c551573106a0fa5596dbf4890702b60e07baa343b73f01fde9f17882565993ce6f025a5034e29830b2c0028022770af0c58839f46baae004dc7cedd5cfc6b5267969af21c3788dc83853f05ccc2304d52fd075cd716c266cd847b9cf720f7f6c8139c2a6ac597102be6f3a9ca6293e3eb9baf7ef1328ef0446e96833d1262c956b41b4f13571b8dc8ba20b56c6b896c731e87305b45f317b62aa31271b82a12316322b1871a86b365a3551acfa6225d0bc1a4719c1202b890f4ecb3e00ca99aa9665de61ac1ce39d98389a6922830e9431ce8d52ebea7202b7b65cf9b71ea9170e656ce585e52a81c2ddc3bcb54bf8d52a5ead54f890ed3b88538d7b903e113141d22c50a6864e171c3e26508a464426e601694a5361719971011a0299db3a02d9d1307879c6f2949896198b8e6f801eeb24f0076f1db0e34c33d602a0ab20cfb4fd30855e3e2560de2b66713bed340b8e3a0eabd572b6fef94e4427dc5369532b75e36984f7985558a169311e6921fe2d5ad6d71157b05712983dba5c81e5b39a68f455ca8808aea7f089a62b3e79f6df76bc65efc05658a62c0840882ce41863ab2ec6abd4f3fea801faed4d0ebce21821e479511d7a24d3c1c7e2914ccc2cf47f77f93dfddee9f3bcb91708cd04ac7feee612f6d92f75ba83d7b3a80637d7fbb607088da3bd11236b88bbb2ba6c5056329c636232f2504c3a8e24b85ebf238566133bb8b27a323e6dbc256f47a9f0edd1f4de6e47696f6dbcf966d08aa59300dcb69aa338d71ddb0fcaa33f0095d11f215a39e496d93e4b1965be45d107c37be6c8fc965d9abcb05f31b5fcc4336a94ca2cbcd5ee5ea80289dd23b3eca6fa5de56b144cd0c84dd9edd84c299262700ecfb89ba885f48246d023c08bb138910187aa0ab9a9886218141860316671ab3bd35c60ffab8ce52a95c5596de064f2608f977fde7d898eab9789d5638d0114e8d9799f33d240cb4662d06cfccd7b3d1bdac891d2c32038940e5d6d0bd08b86e6ec6f8a222c0125d35bf08a3d346270ed34df1c84afb6ba17c5da9e6b3ece68bf6ebcbb67bf1e20bc5492a43d53dd8382814a0e0cce694c859ee68886de2e7b3ecd80d55be43b8a800aabbcf008f13f55cc32a0fa52e502a707251ceade1ed7618d2fa284153a8fd4370982c1e818a3368c06e01f0e189b1c0fd61a093da73222293ac18c839822103edbc2f30ef6753dc01bd34323067be728d9686af8128dfbc72fbe76bd69394ff3f0712764943c413e4831629a1a8d185f5cb2300ccf23b5f18f19286a8cd595ee16b90c523626a86c58bb9e240b6b1190060047a1ecf22d6e3a6cf2947b82ddefbe6528cce12d89cc42fd96cb27986db094efd51ecca897f1b2d9e8831a32d1d1c8b9eef08326eedb4239132bdaa9155c021bc9b62b42e6a999cfdddb075ce7200663ca50573214ed3568905abec721b642e0b2fa35f5a566fa9b2c87f23c0d4c8078d4530a23fab5c7bdd33acd2f463921b38af4b4702e3cdf297a29c79f867fbbcd2221b51a8d6895bc4542265efb5cf3bb3c2e386ed6d3ef6912125f64d5aa338f79c8602c983665f37307b6d790cc634a099cfee346319e8a1aad927337e08faaf3108b136ab261d3f74ddb444919972f72bd35b35d9c782cc83bd965a77d1da18438cf4b097eee2576c2273d34c7a3137e3fbccaf0d5282daafdcd0ef4efb4baedee9c49d89883863dbae25570b53ce8f78b3deffc4167ea838b4d6e6990701fa10dafcd3042fc6c8371e53346ea31fa20609bbff94b3b41e49f10043fdab66ffc2da98bd17d29774c6769b3f470f569f1cc643f0c8d8d693ad0260429f2223eae2e3751d06ef8cd5e4cbf874a6bb98b4960d9f1106940e9ead45fa18b37c45ee8ec64a1a40e5963d830e4de65611d270cf18a75894a24fc7c6462e2b38e01310e1ab1bbef20e2fc377b5ee402bc32ba6ea7439efa190bc0d7af9136e13b895352fadc54b079d299dcffaf3a7b5cfc798912e7eda09954e6e832ddaf7c529c58188a606c40647c983be0d7f5757d9827de2b6af175443f7ba90fe5377b0f89962174b5fa8b0ca86c51b178b536ce571eb2007c98100857f943a7f331496027634c8cc77f2d4573c9859d1866cdc543a12b713064bfbf5c25d710467b215da43e4d5686442b5207da66f00b219545dbfe11e820d6fa0bea1b0cc8e947a3b2d51d36d2f9ee0b4e8b2435616993b4bde2f85c7ad6cf438347e151797e91581325a87ccd86c8cd52a35415c47e74fe8d538d15132e4b4b3edd363edf8dcbfe6bc4e87763249e63bfb2b5573a2b8498f56fb42b44105622eabc0e832ab86c318335070d79cb3e54c1d7defaa5dfd87002ef1348076b0a908fa24cc2a39f35b9372a1f9b3f2c745536569a290f90d80c700dd98751f8373f30cd8faa9a45ad9fa80d11ef3f580328da37b3825fe67504df5a92331f58fb2b2a97c219e424b096c6794b2e3e13e64a72db4f471feb3c4ae09099208240251ca5713b055e03bfe3eb67c7d9fbbd3ae3ade5d3e8fe4d7b42c570227d092177195380b1d734fe00114900c9ecad31f86f7d9227d5ee1d5afddf9bcda974c1f63073390eaf83d0d32425", 0x7c1, 0x40001, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00005a1000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000080)="c4e3c579ea040f080f18c78fe978c3ffc4c27d3966ed0f0f960d380000a7c4e1fe12a4b7eddad8efb9800000c00f3235010000000f300fd86300c4e2f13cd5", 0x3f}], 0x1, 0x0, &(0x7f0000000100)=[@cstype3, @efer={0x2, 0x100}], 0x2) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000001180)={0x0, 0xe0ffff, 0x0, 0x0, 0x0, 0x3}) 1m28.729200479s ago: executing program 0 (id=1558): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x1081, 0x200000000000}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=[@enter_looper], 0x720, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70b7a440b4187098442946238cdd38a235b264899fa2f8b51f8a660653545ab78b6a47b6462efaa8192061344501fb8d96f8de3b132ee012626f94be7b4a9e572a43167614409ee4aa2a40d2feb04bb54137ca025e367e2eee1e8b4f78b741aac17c55ab77d0fd2b7318207e91fd536b9fb7c994a9ad0769020b45bc05965f6dffb15fd462bb2e49632c788cfeb74472be3d9eaf3284719df7187a354b3915df2661363052a24baf8cc101728d302f75878515b436d1fbdb3fc5fc88e8745c56b1bd79dc2cc7e7b5be814275a3edfc67e923d199c97fd6a8b2d11d2923b688471fe8c1e771545d17bad44fc5f7a91cf43ba91b4627c9554a333b6e8ee1c457b54c30bccbbabdfed6158fed6e548cd54ad7409e0a03fb2f685f8987e98ee687a09a730c2a757d3b1595a1146d57230e178284ef3fed5553bbd1e82bd418a13c03f944421d013d96182302122d01c432e24c43a9dff19658a3680167297367a1ee7f70e0968ce28ca2bc8b8525c41f8d4f9cdcaaa25b2d0fea854626eba2e86ecb31e9be7b8e704287fe45ad3f169d7f67e798b0de3bf70f485f81ba5e9aef1ec5782c4c609ffdc93a3bdfeeb7e7cd05ea7023895be4a3f78f188fdbd83ded6dcdf1d429c12b1b250284110295e3515bfb117119839f13057ea2366d3c4b75b28f60afe17b195d04ff58dd2f3382bb57152f2928f9a91bbcc42057777ba13becb4552419caa2ffc325219a6995f5d1e9a193a1aede859834ef765009d6c242ad918ecf3fe62c8dfe2ff309cbce740950cdd05c8e0b7f75aa21731be678552b2d0024a4b3815fb52f056ba37f3f466afab6b5728def0fdef93655524121927df3a39af0845df7612e9ccdae25f406ac0ad7a0e4f980398597ab2c2291d87a1ed618b9e392f1d055d5290be67b6cec9e7505c41025d2aa6e82a4f693042989b5f4a9abfe0ec51fd9dcb972a054b80ee6a460fd422eaa971e2cb759c72e676e2877c667c6ce002be1ce6ba8380e6dd691590c84ba68d26f3284280dcacd082b42bf5aac71467b3fcd5d68ab1bc26cf48fe770ccff5f14ff8afafb18d3127a6d989b7d77665a7a9bf4cb488621c904acd0b073396ad8509c9ddb02eb1d23510a52289a5f0d7edba66d4ef271b9c6acc3bfa996b55f6808650236b0001132ef85fc5070b69144ff5fdd8d64f6c3e0dd22711f69a940ebdb4ab5ff6240da3160049d2047e6713d47ad0db40ec543c095ad67c8cbe438fb875927c98e265498b3da8d4ca54bac0e6efe759a2d4d4190e9fc8835599da8237f472411a71236bb930d28a26f49062d270f4087a6a709c005eebc9740ed54dd005c787c44badac9c720b0d424d0ded9bb8c24c0e842deedf386fc7714a31268292d3bcc53b1cf24b156445c8bf64336f742b1ba836eba0ae4a5aaa9a6f35d4f81734e16bce965795d5b1255609d1860fe11c9c536db078af94772830ba000c13e1d9383e3d862fa07f2199da148632c036bc19f6014eeb206a3654d390c78911deeabebf128def61122754e0a4696db82666a018f8d2f44b5aadc12809ade8bed1b1ba2adbb6e3e82180e26748dc30a8eda0edb21fcaa702632ed3fb4e89550c3e0e1fd2b5ecf1983d85bf9569b231e28155756bd97f1220cbc2b5b1c02dab88ee4a8970d4833b9e51529895afe5029823576297d4a917602fe08df57e1d7f63d050877ddf8e82a5383e15f313171b2d5618a1549f3dfced0732b887508ca5e134124d0ed0bd4b767115d1530f73504387e0364d73a2d3b114fcb49219b1c15e066c455b01672e49499995454a502236f5a5007895d3d1d8843007352a3ccc3f71d3e801efd0a6ef922bf39ead16e01ec20ebff2b1ce7cfd0984b26225cb1359b36efe9ad2ae1f6de4862c0faaa52f4d0eb4c13960ceb4aeaa10ae61a09a5abdb0c61661962a0aab14d465a8ae6f45826e1e66428cf8572eb53c98160df6613a62bb611c63f1ffb7a795a889fc16670f6302fd36ee4247bdd4282f1afb6042c832a4b0857cecae0a7090d9b11ae46d9186c710c8dd12911db573493329bea2c743734d86a577cf27aa01e4fc6c91f1fa34bba173d20b97ed8bb4bad43692df90bfd2b193b9e8b93a95ec0d0d42217395d89db511d2e9bbeb3ef47b7b2d81ab54b5c8faa760ef5c0493af13a9327c9432521ed6bfcb9d778d25031da41a983027fe7d794c26326053d38172444307d88501cdd26c3fdeafdf5f599d3dcfd39972f28ec3fb1fb40982615f5d71d6693a8774df072576834c69b89f209b458fad4671f0108fdfc8548a6fcf76a843369a3bca4d2974221ed9af224d151fa8aa73276ba65ca3d8bc98d6504f16bcac30c697f68cb1625b4f2259ee0c694951752845fa11c20fc4dda369d53918c3746918692ee2cda958612808b841b8d36ef3933f5340e1fc8fb10ac2ae97da921f6a67806831356d515c7a32468dfd3385c"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) (async) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000), 0x118000, 0x800}, 0x20) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) fsopen(&(0x7f00000000c0)='devtmpfs\x00', 0x1) (async) r3 = fsopen(&(0x7f00000000c0)='devtmpfs\x00', 0x1) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.numa_stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x2010, r4, 0x0) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) (async) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) pselect6(0x2a, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x0) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000658000/0x2000)=nil, 0x2000}, 0x1}) socket(0x10, 0x803, 0x0) (async) r6 = socket(0x10, 0x803, 0x0) sendto(r6, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r6, &(0x7f0000009800)=[{{0x0, 0x0, 0x0}, 0x4}, {{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, &(0x7f0000003640)=[{&(0x7f0000002180)=""/4096, 0x1000}, {&(0x7f0000003240)=""/106, 0x6a}, {&(0x7f0000000780)=""/18, 0x12}, {&(0x7f00000032c0)=""/246, 0xf6}, {&(0x7f00000033c0)=""/231, 0xe7}, {&(0x7f0000000180)=""/216, 0xd8}, {&(0x7f00000035c0)=""/76, 0x4c}], 0x7}, 0x81}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x1ff}], 0x7, 0x2100, 0x0) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000080)='^\t*([%\x8e\x00', &(0x7f0000000200)='@!\x00', 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000340)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000180)={0x30, 0x30, 0x30}}}], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000340)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000180)={0x30, 0x30, 0x30}}}], 0x0, 0x0, 0x0}) 1m28.441197336s ago: executing program 0 (id=1561): r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@xino_on}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00005cf000/0x4000)=nil, 0x400000, 0x2, 0x2}) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000bf7000)={0x101ff, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) madvise(&(0x7f0000be9000/0x1000)=nil, 0x1000, 0x15) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc0000001900010000000000000000002001000000ffffffffffffffeb000000ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000000000000080400000000000000000080000000000000000000000000000000044000500ac1414aa000000000000000000000000000000003c"], 0xfc}}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000640)=@migrate={0x138, 0x21, 0x1, 0x0, 0xfffffffe, {{@in6=@private2, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x84}}, [@migrate={0xe8, 0x11, [{@in=@dev={0xac, 0x14, 0x14, 0xc}, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in6=@private2, @in6=@local, 0xff, 0x0, 0x0, 0x2, 0x2, 0xa}, {@in=@local, @in6=@local, @in6=@empty, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0xff, 0x4, 0x0, 0x3500, 0xa, 0x8}, {@in6=@ipv4={'\x00', '\xff\xff', @loopback}, @in6=@private2, @in=@rand_addr=0x64010102, @in6=@private2, 0x3c, 0x0, 0x0, 0x0, 0x8, 0x2}]}]}, 0x138}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) r6 = socket$xdp(0x2c, 0x3, 0x0) getsockopt$XDP_STATISTICS(r6, 0x11b, 0x7, 0x0, &(0x7f0000000040)) sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x54, r5, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @loopback}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0180000000000000000017000000400006803c000400be0349cc616573290000000000000000000000000000000000000000000000001b000000e3de3d7b4cd07ec3ee777de774fc7987cca41989"], 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffffb}) faccessat(0xffffffffffffffff, 0x0, 0x3) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000040)=[@acquire], 0x0, 0x0, 0x0}) 1m28.261167461s ago: executing program 0 (id=1564): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000002180)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) (async) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000002180)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000140)='tasks\x00', 0x2, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x20081, 0x0) (async) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x20081, 0x0) write$vga_arbiter(r3, 0x0, 0x13) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0xa000, 0x1da) read$FUSE(r4, &(0x7f0000000080)={0x2020}, 0x2020) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'bridge0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) r7 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f00000003c0)={'ip6tnl0\x00', &(0x7f0000000340)={'syztnl2\x00', r6, 0x0, 0x0, 0x0, 0x0, 0x7, @remote, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x80, 0x8, 0xffffffff, 0xd66}}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f00000003c0)={'ip6tnl0\x00', &(0x7f0000000340)={'syztnl2\x00', r6, 0x0, 0x0, 0x0, 0x0, 0x7, @remote, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x80, 0x8, 0xffffffff, 0xd66}}) openat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) (async) r8 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) r9 = openat$cgroup_ro(r8, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$UHID_INPUT(r9, &(0x7f0000000940)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125b2ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb03bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2033aae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b85b7b26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd6929bbc2850cd4901389e6ea6e86041e0efa1111c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c669bb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b2967cbfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bcddf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d6748c2ce5bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4658098549646bd63175adf77b5cdcf102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4baea02fa76fb4830aebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f8426a9049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21abfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e0068607000000fb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9fb4000000f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002afea6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b46e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae66444a8f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a00", 0xdd52d6c}}, 0x1006) openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETQUEUE(r10, 0x400454d9, &(0x7f00000000c0)={'macsec0\x00', 0x400}) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) (async) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) mkdirat(r9, &(0x7f0000000100)='./file0\x00', 0x0) (async) mkdirat(r9, &(0x7f0000000100)='./file0\x00', 0x0) ioctl$KVM_GET_DIRTY_LOG(r4, 0x4010ae42, &(0x7f00000020c0)={0x4, 0x0, &(0x7f0000002000/0x1000)=nil}) socket$netlink(0x10, 0x3, 0xa) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f0000002100)=0xc) r13 = socket$inet(0x2, 0x3, 0x9) sendmmsg$inet(r13, &(0x7f0000000c80), 0x0, 0x880) mount$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000280), 0x810000, &(0x7f0000000240)=ANY=[@ANYBLOB='uid=', @ANYRESHEX=r12, @ANYBLOB=',fowner>', @ANYRESDEC=0x0, @ANYBLOB="40009b7c2c00"]) quotactl_fd$Q_GETQUOTA(r8, 0xffffffff80000702, r12, &(0x7f0000000380)) syz_open_procfs(r11, &(0x7f00000001c0)='ns\x00') (async) syz_open_procfs(r11, &(0x7f00000001c0)='ns\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xd, 0x0, &(0x7f0000000340)=[@increfs_done={0x40106308, 0x3}, @decrefs, @register_looper, @register_looper], 0x0, 0x0, &(0x7f00000002c0)}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xd, 0x0, &(0x7f0000000340)=[@increfs_done={0x40106308, 0x3}, @decrefs, @register_looper, @register_looper], 0x0, 0x0, &(0x7f00000002c0)}) openat$procfs(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) 1m28.178529363s ago: executing program 0 (id=1566): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) pidfd_send_signal(r0, 0x25, 0x0, 0x0) (async) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) capset(&(0x7f0000000080)={0x20071026, r1}, &(0x7f0000000140)={0x6, 0x5, 0xa, 0x887c, 0x9, 0x1}) (async) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000500)='./file1/file0\x00', 0x0, 0x201008, 0x0) (async) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000000), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) (async) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) (async) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) (async) r2 = userfaultfd(0x1) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) (rerun: 32) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00005cf000/0x4000)=nil, 0x400000, 0x2, 0x2}) chdir(&(0x7f0000001180)='./bus\x00') (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) 1m28.062145936s ago: executing program 35 (id=1566): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) pidfd_send_signal(r0, 0x25, 0x0, 0x0) (async) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) capset(&(0x7f0000000080)={0x20071026, r1}, &(0x7f0000000140)={0x6, 0x5, 0xa, 0x887c, 0x9, 0x1}) (async) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000500)='./file1/file0\x00', 0x0, 0x201008, 0x0) (async) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000000), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) (async) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) (async) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) (async) r2 = userfaultfd(0x1) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) (rerun: 32) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00005cf000/0x4000)=nil, 0x400000, 0x2, 0x2}) chdir(&(0x7f0000001180)='./bus\x00') (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) 7.085262209s ago: executing program 4 (id=2356): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_int(r1, 0x1, 0xa, 0x0, &(0x7f00000015c0)) (async) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in=@broadcast, @in=@multicast2, 0x3, 0x2, 0x0, 0xffff, 0xa, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80000001}, {}, 0x1000, 0x1, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x4d2, 0x32}, 0xa, @in=@remote, 0x0, 0x2}}, 0xe8) sendmmsg$inet6(r0, &(0x7f0000000a80)=[{{&(0x7f0000000040)={0xa, 0x4e21, 0xc, @dev}, 0x1c, 0x0, 0x0, 0x0, 0x0, 0xe00}}], 0x1, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000000280)="db", 0x1}], 0x1}, 0x41) (async) sendmsg$inet(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)="04e0d6", 0x3}], 0x1}, 0x0) (async) read(r2, &(0x7f0000000040)=""/98, 0x3a) mount$binderfs(0x0, &(0x7f0000000000)='./binderfs\x00', &(0x7f0000000140), 0x4800, &(0x7f00000002c0)={[], [{@fscontext={'fscontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, 'fscontext\x017@GT\xa1_\x7f\bK\xb50\x05\x1d\x95\f\xbc\xa3@\xc7Ma\x7f\x97\xfc\xaf{}L\xfa\x93\xe7\r[A\xa6W\x00\x87|.\x02\xc7\xfc\xb7\x99\xc2 \xda\xc50\xa8\xeb7d\xc7\xce\xf2\xea|\xc7\xebo!\b\xfcs^\x03\xbc\x8e\xe04\x8c\xf5y=\x97\x91T\'\xb0a\x7f\xb1\x14\xde\xedM\xe4\xc70xffffffffffffffff}, 0x4800) ioctl$LOOP_SET_CAPACITY(r3, 0x4c07) fcntl$setownex(r2, 0xf, &(0x7f0000000000)={0x0, 0xffffffffffffffff}) r4 = socket$inet6(0xa, 0x802, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000001600010a00000000000000000c0000000c0000800800", @ANYRES16=r4], 0x20}}, 0x40816) 6.871670034s ago: executing program 4 (id=2358): r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$xdp(0x2c, 0x3, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000fffa18105e04da0700000000000109022400010000000009040000"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000200)={'vcan0\x00', 0x0}) sendto$packet(r3, &(0x7f0000000080)="18", 0x10, 0x0, &(0x7f00000000c0)={0x11, 0xc, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmsg$xdp(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x2c, 0x5, r4, 0x17}, 0x10, &(0x7f0000000100)=[{&(0x7f0000000080)="5b171b87467c22ce42cb0792c280dc88deb7db599bf3e43b33cbfba1d9d58f31526f45ead4ab3c019b6dfc65bbe83bbf", 0x30}, {&(0x7f00000000c0)="01de2544e134e9b36ac240a17135cc107df33ee2fb3298bc909e1208718de4ceba9a8d4c97f5cedeba", 0x29}], 0x2, 0x0, 0x0, 0x40001}, 0x4000840) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x2, 0x3, 0x0, 0x3, 0xb, 0x0, 0x700, 0x0, [@sadb_key={0x1, 0x9}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @private=0xa010100}}, @sadb_address={0x3, 0x5, 0x32, 0x0, 0x0, @in={0x2, 0x4e24, @dev}}]}, 0x58}, 0x1, 0x7}, 0x0) 5.185095357s ago: executing program 6 (id=2377): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0xb03cdf087638818c, 0x3}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x15) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000d80)={{0x5, 0x2, 0xf1f8, 0xe}, 'syz1\x00', 0x22}) ioctl$UI_DEV_CREATE(r1, 0x5501) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = add_key$keyring(&(0x7f0000000240), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) r5 = add_key$keyring(&(0x7f00000001c0), &(0x7f0000000300)={'syz', 0x3}, 0x0, 0x0, r4) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f00000000c0)={r5}, &(0x7f0000000100)=ANY=[@ANYBLOB="656e633d6f61657020686173683d787868617368363400000000000000000000000000000000ffffffffffffffff00"/72], 0x0, 0x0) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r3, 0x4068aea3, &(0x7f0000000140)={0xa8, 0x0, 0x3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r3}, @ptr={0x70742a85, 0xfffffffe, 0x0, 0x0, 0x0, 0x1b}, @fda={0x66646185, 0x8, 0x2, 0x40}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) 4.789003558s ago: executing program 6 (id=2380): r0 = open$dir(&(0x7f0000000000)='./file0\x00', 0x20c04, 0x80) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040), 0x101040, 0x0) ioctl$INCFS_IOC_PERMIT_FILL(r0, 0x40046721, &(0x7f0000000080)={r1}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) lsetxattr$trusted_overlay_nlink(&(0x7f0000000180)='./file0/../file0\x00', &(0x7f00000001c0), &(0x7f0000000200)={'U+', 0x2}, 0x16, 0x1) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x200040, 0x180) readlinkat(r5, &(0x7f0000000280)='./file0/../file0\x00', &(0x7f00000002c0)=""/39, 0x27) lseek(r0, 0x6, 0x2) bind$netlink(0xffffffffffffffff, &(0x7f0000000300)={0x10, 0x0, 0x25dfdbfc, 0x140}, 0xc) mkdir(&(0x7f0000000340)='./file1\x00', 0x14) syz_usb_connect$cdc_ecm(0x6, 0x57, &(0x7f0000000380)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x45, 0x1, 0x1, 0x1b, 0x100, 0x0, [{{0x9, 0x4, 0x0, 0x7, 0x2, 0x2, 0x6, 0x0, 0x45, {{0x6, 0x24, 0x6, 0x0, 0x0, "f6"}, {0x5, 0x24, 0x0, 0xae0d}, {0xd, 0x24, 0xf, 0x1, 0x1, 0xb5, 0x1, 0x3}}, {[{{0x9, 0x5, 0x81, 0x3, 0x20, 0xfd, 0xfe, 0x7f}}], {{0x9, 0x5, 0x82, 0x2, 0x48, 0x79, 0x4, 0xd}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x8, 0x4, 0xad}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f0000000400)={0xa, 0x6, 0x201, 0xe, 0xe8, 0x63, 0x20, 0x7}, 0x2d, &(0x7f0000000440)={0x5, 0xf, 0x2d, 0x3, [@ss_container_id={0x14, 0x10, 0x4, 0x1, "334331a51480d596e0ae7c5de4ed5a1a"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x4, 0x0, 0xf6, 0x78b5}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xb, 0x3d, 0x2, 0x200}]}, 0x5, [{0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x809}}, {0x77, &(0x7f00000004c0)=@string={0x77, 0x3, "24526226b0abbd84e58631af95c95a0c640b58888ecca8d2c365caf5c8e264665ccea2be5086bf0044178d89ba3479d47194c0df7ebc88eb90736c40f2d40555d370a87eee24ebdb18bbd2023d5c710f79b121a56bb250bc43273f9f469a29fcfdcb9fe717a42a2b6152dd69dfac245e5da40f06fa"}}, {0x2f, &(0x7f0000000540)=@string={0x2f, 0x3, "09691b84f0bd4a3d4162ade6ab1d354e666677b44e091d13c3116f6d17fe0276104cc2b87fb7512537f2fd2fe8"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x480a}}, {0xbd, &(0x7f00000005c0)=@string={0xbd, 0x3, "ba93c0b85f1d0762ab9e9576656f9f047fdc4ce92edadc42b74941521b9db79961832a45c7701085b368921bfacbee5e2e6dea9be0add9825d41c52d851815737dd41fe2002bec3a1de88985444cfbf334d4dce4c119517e64a6957fb21caeb9fceb6befe84fdc31b08f575274a0d987545104a80a6fd128697f844e99cb0079beacac816157df89f15b4ef9ff75a099c84b6df2efdee5ef35b4a5dc297dadddaf1af4212e4ceecad0bcf9cfeca12d4539e7074318ee81a84ee427"}}]}) clock_gettime(0x0, &(0x7f0000007040)={0x0, 0x0}) recvmmsg(r4, &(0x7f0000006e80)=[{{&(0x7f0000000700)=@phonet, 0x80, &(0x7f0000001c40)=[{&(0x7f0000000780)=""/144, 0x90}, {&(0x7f0000000840)=""/250, 0xfa}, {&(0x7f0000000940)=""/187, 0xbb}, {&(0x7f0000000a00)=""/4096, 0x1000}, {&(0x7f0000001a00)=""/128, 0x80}, {&(0x7f0000001a80)=""/184, 0xb8}, {&(0x7f0000001b40)=""/247, 0xf7}], 0x7, &(0x7f0000001cc0)=""/183, 0xb7}, 0x1}, {{&(0x7f0000001d80)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @dev}}, 0x80, &(0x7f0000001fc0)=[{&(0x7f0000001e00)=""/84, 0x54}, {&(0x7f0000001e80)=""/167, 0xa7}, {&(0x7f0000001f40)=""/125, 0x7d}], 0x3, &(0x7f0000002000)=""/27, 0x1b}, 0x200}, {{&(0x7f0000002040)=@xdp, 0x80, &(0x7f00000030c0)=[{&(0x7f00000020c0)=""/4096, 0x1000}], 0x1, &(0x7f0000003100)=""/28, 0x1c}, 0x8}, {{0x0, 0x0, &(0x7f0000003300)=[{&(0x7f0000003140)=""/143, 0x8f}, {&(0x7f0000003200)=""/197, 0xc5}], 0x2, &(0x7f0000003340)=""/55, 0x37}, 0x6}, {{&(0x7f0000003380)=@xdp, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/29, 0x1d}, {&(0x7f0000003440)=""/113, 0x71}], 0x2, &(0x7f0000003500)=""/49, 0x31}, 0x776}, {{&(0x7f0000003540)=@un=@abs, 0x80, &(0x7f0000005b00)=[{&(0x7f00000035c0)=""/4096, 0x1000}, {&(0x7f00000045c0)=""/197, 0xc5}, {&(0x7f00000046c0)=""/182, 0xb6}, {&(0x7f0000004780)=""/4096, 0x1000}, {&(0x7f0000005780)=""/237, 0xed}, {&(0x7f0000005880)=""/43, 0x2b}, {&(0x7f00000058c0)=""/199, 0xc7}, {&(0x7f00000059c0)=""/6, 0x6}, {&(0x7f0000005a00)=""/235, 0xeb}], 0x9, &(0x7f0000005bc0)=""/4096, 0x1000}, 0x9779}, {{&(0x7f0000006bc0)=@l2tp={0x2, 0x0, @initdev}, 0x80, &(0x7f0000006dc0)=[{&(0x7f0000006c40)=""/252, 0xfc}, {&(0x7f0000006d40)=""/114, 0x72}], 0x2, &(0x7f0000006e00)=""/108, 0x6c}, 0x8}], 0x7, 0x40, &(0x7f0000007080)={r6, r7+10000000}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000070c0)={'wg0\x00', 0x8420}) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000007100)='./cgroup/syz0\x00', 0x200002, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000007140)={0x0, ""/256, 0x0}) ioctl$BTRFS_IOC_INO_LOOKUP(r3, 0xd0009412, &(0x7f0000007340)={r8}) getresuid(&(0x7f0000008380)=0x0, &(0x7f00000083c0), &(0x7f0000008400)) sendmsg$nl_generic(r1, &(0x7f0000008600)={&(0x7f0000008340)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000085c0)={&(0x7f0000008440)={0x154, 0x40, 0x4, 0x70bd26, 0x25dfdbfb, {0x1c}, [@typed={0x8, 0x90, 0x0, 0x0, @uid=r9}, @nested={0x8, 0x147, 0x0, 0x1, [@nested={0x4, 0x52}]}, @typed={0x10, 0x101, 0x0, 0x0, @binary="8ca474e768339007cac8b949"}, @typed={0xc, 0x14, 0x0, 0x0, @u64=0x6}, @typed={0x8, 0xd, 0x0, 0x0, @ipv4=@broadcast}, @nested={0x102, 0x13f, 0x0, 0x1, [@generic="20fd637f7c0648f77a511f897707417c5112ed9c32697ebdd4900c88dcec9c3f6931a3921df452011b0c25caf11816774d14f27cdcd3c207cdfb6f4fae01824584afd1b9fbf3b5d800d7d371be20e704bdca23666057d685a6345e237377a533a22a8ff84305eb22ece12f6bfbf88bfb78af0ea27eac5f68957d6a2fb80c8116bd6de9f86ef8c0d23f3c6c8b1f34209480b144693dd9fd530c2039d349d0cc766fedd9cb07289469ce7be3bb58bebffc636c7407e3233e372d476ec8e64f15e29056e2655fd75aa66d8901aab5523c54c6001bf86f7b9a65dea940f064a2c913bd60995a8e7d6aacfa3d3413ede27cb0e0d76136b32140ff2260", @typed={0x4, 0x9c}]}, @typed={0x5, 0x5f, 0x0, 0x0, @str='\x00'}]}, 0x154}, 0x1, 0x0, 0x0, 0x24000001}, 0x4000800) timer_create(0x2, &(0x7f0000008640)={0x0, 0x3c, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000008680)=0x0) clock_gettime(0x0, &(0x7f00000086c0)={0x0, 0x0}) timer_settime(r10, 0x1, &(0x7f0000008700)={{0x0, 0x3938700}, {r11, r12+60000000}}, &(0x7f0000008740)) futex(&(0x7f0000008780)=0x2, 0x1, 0x1, &(0x7f00000087c0), &(0x7f0000008800)=0x2, 0x2) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) listen(r3, 0x2e) lsetxattr$trusted_overlay_nlink(&(0x7f0000008840)='./file0/../file0\x00', &(0x7f0000008880), &(0x7f00000088c0)={'U-', 0x1}, 0x16, 0x1) r13 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000008900)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0xff, 0xc45, 0x5112, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x4, 0x90, 0x9, [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x3, 0x1, 0x3, 0xc, {0x9, 0x21, 0xffff, 0x9, 0x1, {0x22, 0x2dd}}, {{{0x9, 0x5, 0x81, 0x3, 0x50, 0x7, 0x3, 0x1}}, [{{0x9, 0x5, 0x2, 0x3, 0x10, 0xb, 0x5, 0x42}}]}}}]}}]}}, &(0x7f0000008f00)={0xa, &(0x7f0000008940)={0xa, 0x6, 0x5b2c7fed1a03d1c9, 0x5, 0x5, 0x3, 0x8, 0xc}, 0x4a, &(0x7f0000008980)={0x5, 0xf, 0x4a, 0x6, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "1d5711645061dcef308997a51e7479af"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x5, 0x3, 0x8, 0x9}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xf, 0xab, 0x3d, 0x7ff}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x4, 0xcf, 0x1, 0x1}, @ssp_cap={0x10, 0x10, 0xa, 0x6, 0x1, 0x8, 0xf000, 0xe4f2, [0xff3f]}, @ptm_cap={0x3}]}, 0x6, [{0xe6, &(0x7f0000008a00)=@string={0xe6, 0x3, "2698e9cbdb62c514ef06e67cb9a3330320c909ed4ae5160b1eae0e22f59467575172a7e434777a84050724b77d14d3df3dc5fbf8373683473c4d7cabc4750d8cd0fc425bb6382d55d7c493148b6f264c826eef836f23a4948da2526751412b71aec9ce84d8a740b4cb83a71d952d73d3c981b6c45a261d0c1e8ae478d8e8b6ee4138830ccb87439561333f551a7dd91c27f78505d8016025dd94e4ab04d6679c35886715769327f183d159cacae452a9c61af4e8a6d9a96899e018d6e2bf23fe97124b563c98d9973b36562b39a676739b9fa249cdbcc2f91dd876aecf25f66d82c2fac0"}}, {0xb5, &(0x7f0000008b00)=@string={0xb5, 0x3, "d77587e06cbb3b548f6a9ffaa3a7eb2257c17e93e609cb877db97d17bfd81bee12f20adce9d6da45483f49fba1def3486de9e41564ac6f2485b7bf2014eba330651bf85fa8d43392af2519e71133e19f69972b43d21f5d604eac3a7d91d6e92d95767c4c4a5b051b4a570920667f7705e47e96ef321a849fb331814b0f290ed10c74d76d9bb60d453b59a71bed5dcbbe89b88e18d5c34d6414eaae58176257aea922d22be408f801e0f6d1fde015f11fdb5351"}}, {0xcc, &(0x7f0000008bc0)=@string={0xcc, 0x3, "3bf916280e9c7e1fd49e8cd26dab4a0cbc9b0eb17ce4de4e8bc429a299f0efab9b103a88f799e0e4041c1ed706355b2897cbd760642edcb7f001c570337432d93123e1d25d07eaa93a3cce54e0e3d3e1ad974f7608e28c1131b0aebed07ba851ec31e8c54e78c4b8cdd8caa28452bbde3b1964ec75431c4323ea0bf0ea80a39940efa52f55b2e46b85757b35ff9a11a0570e76cb4f9c1834a13c22bb0bc3eb136c1795772ad3397080d93b0bcb12cd990723723ceffe4cd62d6baf35e5a34ca52bb43423e5832c94670c"}}, {0xe5, &(0x7f0000008cc0)=@string={0xe5, 0x3, "661da468bd1ecc3025352c801b97cd01020e5eb8e33ddb9368e2d0c6ad6f0c2da8a38a2a10e3e68f9aa994fc25cd96a0f194c8fd235288360d6bc9e36f67dc068dcb50aae89a97314112ad77f1f323aed7bbbb8669938a2325931a0e6b4738c664c2751cc6ffe21eb7ec028f0196afefeb4a6ad04fe42ceb72721924411a8ab04e4f0029a8e7ab5e670f87ce207a59b64a6f1635fe65ed9c0a7e9502097889b5cd52180726d06b27212d52aef1a1844476b9754d65bb290e1db47e5941372a91f61634e092eefd1275dd895dec2a0424907f23190937151056090b17c30328c7fe40a2"}}, {0xa5, &(0x7f0000008dc0)=@string={0xa5, 0x3, "d1bf5cc84157cff1d5de5416c1a189fcc81a3be820758b1fbc7e91ee6afe2fc5c376740251f1e15ffc028aa35c28dd32b7d3559a48797a3fa13595bd84d1ca4f0f75084b67f1f0422b8a08f137648d74bd79c83f0a787118f1a50ddf200643b808ae134f47795f9af78a2d7e822b33a9c140131e224e5f8fdabb1df7152d8581e7eee41cd29d841cfc14c8d75fcb1f174475669625612c7ab7e7ed2a61a24cc441dd91"}}, {0x62, &(0x7f0000008e80)=@string={0x62, 0x3, "81097e8a481651b784297e3cae14a18d25a3c3070b24e77b4acceb9543bea4a26978616963528f1d6a4c0c26497085f8d6df6c0d854daecae905c50eb543ca74ac5d6a283a16b3eff6e7bbaf1a57b2cc0dd8063d167290121aa12287b9bad594"}}]}) syz_usb_control_io$hid(r13, &(0x7f0000009100)={0x24, &(0x7f0000008f80)={0x0, 0x21, 0x80, {0x80, 0x3, "7bae16cd190b3d25f410600cc255bf80939a53e2a92ffbea7e86f07b719c5a991a27787a4bec7492bd03853d2bb4a1ac53fbfb9e8880f5e18773bd030fc5922c6373538cc093a734ee405e156497d1c11344ecc6e49c15201b42c9f200142f963ca0f864cef76c9439b91b6192e819d5da520819e9c9bfaaca42aab2c59f"}}, &(0x7f0000009040)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3401}}, &(0x7f0000009080)={0x0, 0x22, 0x11, {[@global=@item_012={0x1, 0x1, 0x1, "ea"}, @global=@item_4={0x3, 0x1, 0x1, "d352de0f"}, @global=@item_4={0x3, 0x1, 0x5, "2bb4a008"}, @global=@item_4={0x3, 0x1, 0x1, "9e6f5f05"}]}}, &(0x7f00000090c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0x4dc, 0x4, 0x1, {0x22, 0x741}}}}, &(0x7f00000093c0)={0x2c, &(0x7f0000009140)={0x20, 0xe, 0xe1, "ac6a51e3fd5e4d5ef6427e3ad20c8358481c7315d87dae2420b78ac3325e4a4c2430f3985a082c2a0ddd3b2634672098662967d436d724eacd8996662b3af103d9899f138297655887b859d6a88b150bf0bf74a3513c88d155f78b56c12c4c3c6c577963e317cd5de5483739576592e264dc53ceed701ca6fb7cc7aa7a5f1a94f5853cc04309af3d599f6711fca2c5f58bb88bbe1ad3af382492b40eb4f9bd9627a69ea6a4a1188ef115279cba85d53ccd90d65775b66f297a2d14db2d0be973792cd0f1916c3231e6fceeee1c6e49693c535160655aab29d95a4e02ff979ff71a"}, &(0x7f0000009240)={0x0, 0xa, 0x1, 0xc3}, &(0x7f0000009280)={0x0, 0x8, 0x1, 0x5}, &(0x7f00000092c0)={0x20, 0x1, 0x7b, "69b6b187cf34177781ecceaf54398021f71c93ecc54aa8d0e05ea386f581a29b8187cb9ba5561fc7f7b0475f53415a90224a99ba63752f659bd7acb6878382b6c4543851574ec11e0a478da5ec77169e1fddeaf883cd60dad8975b2b14a05302787e2107a1100ca3b6631b48073204b56bdeab590fb161eb40fd65"}, &(0x7f0000009380)={0x20, 0x3, 0x1, 0xc}}) 3.542050219s ago: executing program 4 (id=2388): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xec202, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x18, &(0x7f00000001c0)={@flat, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/10, 0xa}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, &(0x7f00000002c0)}) 3.320672015s ago: executing program 4 (id=2391): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x2, 0x3, 0x0, 0x3, 0x2, 0x0, 0x700}, 0x10}, 0x1, 0x7}, 0x0) 3.262790067s ago: executing program 4 (id=2392): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeef, 0x8010, 0xffffffffffffffff, 0x701a000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r0 = userfaultfd(0x80001) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) mkdirat$binderfs(0xffffffffffffff9c, &(0x7f00000019c0)='./binderfs2\x00', 0x1ff) mount$binderfs(0x0, &(0x7f0000001dc0)='./binderfs2\x00', &(0x7f0000001e00), 0x0, &(0x7f0000001e40)={[{@stats}]}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000002500)='./binderfs2/binder0\x00', 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) syz_usb_connect$printer(0x2, 0x36, &(0x7f0000003100)=ANY=[@ANYBLOB="12011102000000102505a8aa40000102030109022400010108b00f09040006f0d20187df4f86ff0300005304b429058202080006f305"], &(0x7f0000003440)={0x0, 0x0, 0x0, 0x0}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x60140, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) ioctl$BLKFINISHZONE(r5, 0x40101288, &(0x7f0000001200)={0x1, 0x1ff}) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xa2102, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000180)={0x2710, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r8, 0x4010ae67, &(0x7f0000000380)={0x2, 0x34000, 0x1}) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r8, 0x4010ae67, &(0x7f0000000040)={0x0, 0x12000, 0x1}) ioctl$KVM_RUN(r9, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) 1.54542632s ago: executing program 6 (id=2404): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x1081, 0x200000000000}) r1 = getpgrp(0x0) timer_settime(0x0, 0x1, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) process_vm_readv(r1, &(0x7f0000002e40)=[{&(0x7f0000002b80)=""/189, 0xbd}], 0x1, &(0x7f0000003380)=[{&(0x7f0000002e80)=""/39, 0xea7}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS(r3, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, 0x2}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2d, 0x0, 0x0, 0x0}, 0x10}], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x1081, 0x200000000000}) (async) getpgrp(0x0) (async) timer_settime(0x0, 0x1, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) (async) process_vm_readv(r1, &(0x7f0000002e40)=[{&(0x7f0000002b80)=""/189, 0xbd}], 0x1, &(0x7f0000003380)=[{&(0x7f0000002e80)=""/39, 0xea7}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9, 0x0) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async) ioctl$KVM_CAP_DISABLE_QUIRKS(r3, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, 0x2}) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2d, 0x0, 0x0, 0x0}, 0x10}], 0x0, 0x0, 0x0}) (async) 1.396575254s ago: executing program 6 (id=2407): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/drivers\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000780)={0x2020}, 0x2020) timerfd_create(0x9, 0x800) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f000000ddc0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) mkdir(&(0x7f0000000180)='./file0/../file0/file0\x00', 0x0) write$FUSE_INIT(r1, &(0x7f0000000000)={0x50, 0x0, r2, {0x7, 0x24, 0x4, 0x41046100, 0xffff, 0x0, 0xf7, 0x0, 0x0, 0x0, 0x36}}, 0x50) syz_fuse_handle_req(r1, &(0x7f00000021c0)="1827dacb7cd53e01b4852de2d748e21fa033071acb841f449efc23d452101807ae5c485596338a6d31388444ae8ade7b60a85a37d3db29ef19ae4c4d4db9c2c82c7908debb2e2b5ebef336aad77bef942d064955079af4e914f372cec8ed0440f6ee0bded3c565283bdb75124011227712d5f01e8c1eb86cf69205a8b5b374edee58ebaf09d62191cf41190260c30a719bbc9bc29be0d60c678791de6b236c9b5a057247c281937c2b2ae747c858532113e0a1e7af49298ef54f15572301d3c907b02529bc470beab8f9208cf92b17a9df99ceff90a1e384d6bda3fe823d8eff0e2229a43c31781935de69466b1082c0f88d3716f234e1d6e17e1360f6621e686d661af20eaf08cc97c261590ac3291667a87bbf66f86d9005f034ea5517b2187b6dfecebc1cb8fc4dab511a2890a68ed185483c548168803f353520cc6f820d1349ac985e12a3ff6e8a78b29ed97213962fca3ba7d04d1ab4dbcfe93a88831f784ed278d079eb3e2e69d3161600fc7b0dae825b510a59c14315fc6ca0ce68dafd088f02a92ae0ab3f15ca1a863b640e8e4a89407a8b8d752892e1f8b0e793d430c3ec46cbe2b6a4bdad728c34e734864aeac2b6b2eb51c3a2f9e6773c5834166511086dc35847cfa17974889795ed305353d41c9399bb95936a3c1be1099f21795cfc04d9699929eca65a0edcae5d4e564404e5292dc15f40d78d94be9e8dca92983bc71729ab30a70455bbfd5a98d97cab9778d9b7b69fb20019e7e7c7bc17c84da1dab53a187a116ac229e00312c95b1074afff18a8771a4ab47be2205745836dc3cc1ce531fe697e9a734698fb2343b331ad9f13214d1d7d511dc646fb8b3b70fb4611e6d102a0e2bda6311ca824537f699efdefbd8a3a523e26272f07abd75504188edc788af9c75aabf77f4ac883573f63ded319fa5a8b6317d4490391879629446fa5ea4c695f3db9739f7bc1da7a19f3e1c0ccca98307b3a7a38272b7455c8957b17138c9e170c27895fcf47eb5530948b7cc43d61a621293b0c83dc893f02def2b42a8bd7ad6c9cdfeb7a3bde141e98e5af7500b07d85c6314949b754c88cc666bdaaec89271f56ec11bfa0aa337feb1140b8a07fbd5c79bdd0239f8aa1d454c0e5a16e99d38d1212ff709bb1964c317c98bfef37b56944666f0320ec85b5b1e07731de5584901f8c65e14fd2ba83b500fdbb137c7cdf91d66400688a5da6405ca7e0b8107ed65be0ef5c6234b62f613e7e76d6f3d5cc12bde4342391524e25bab6ec0a358c6c66b7cdbdd9301f91589af65cb7c02fe8271a798c5e122fef9e7581d28884d33d01f0475c9ac052d2d014bdc09e2738487742f7bff40facf2e96dcdfefa336c46923b77b334daf7b01a9fd5d957a29b83adf6f23acc507a58dabe6b2804532bc1a865a01b1126127f7c6a8029531db8a51d8472c0abffca5be97b9b5433ad220ab9ad65cf94a1167f3fb2b8804ce66f9f5cae212724b2b3a04343580f5919f446f40eaa0177f25ebe68ee7c7a35d9d5ef6e1cb220eaf8ad9b269b15c2ab9692c345f3c3bd5965f06adfdfa2d672b5e3184ebe192f73e70e829adfac2e6318d238dceb6e3d7d1422d57ff7124793b92966bd229c0725b0d591e59c57f98841b5ffad16d0ae903406014d3e632d0654e9084f870e124046f3ebae3ecbf5c5365aa32ebf169ccf1243dc8fb296cef006d5f00447ecd2980abb98e3b6e6bf6181e5df7994ea1c1273784af0d92a57394c71926dc143228a8ade103ff61860d21ffd467b2c41bbbd2490dd36add865828fb64396f16831a3a74f57ee2254cc93b25b7219bc00339a2518be3caa4765ed63295c84f1d59144e96aacfb57c6441f64f29729bb7d68127ae2472bbf089570003b1e820191878ab6f53db01c180751e34672cf5a96edfefe164580d6101672281b59f58f3c7b1222f2b6d19c8a8e5f9ad539045f7dbadaa767f993da974dae20744bf5ad0e0ec71ee97696659981e067463c78bd9337b8bcfc070e7e5b47303eaaf9651c19f19a15eab8e2c47041828be50994b5695ee5fbc9a9ecacf9de714215eb7992c07f262db8843937934fdf6fdd31d0f3a44f074f3a1dd6622dbdb3364df79d5ec90ead64c29e05a6c5358cc6b9d8493b7e1c53a91c37aa3653cf2002072461f4b99fcdec142e53b87f61ea55cdb834dd4e03f2f57a206cabe2f3f3cbfad3b4117bf4434718022b09a8419959a9bb97fba50a6b3b9a844cd1301de7bae89f8d1bf549b88dd2bd0697e70ce89cc2e383221ca2ae9d3671a730466c250a8963f6411a42ecc85a00c01b2b43c39432d5065a5fd11c29a23169891cd674cf3a31e82587a26c8d48aa3debeaf067a26669599fae850126dd516512e0cf5ab556b5582add7d2f665723a2244007ddc302f0ec29da73578a80c998849be2f766a334c7ade4dd46f37d648899da5cf7437af2d6e8d03d934903387c4c7e260909d59b546dfac9ffdce11fb92e5bb6ff6836fa0e6d0c5942b4660fdd68d3cc8a76ce0960584dbf634695ca75752b19067ba535e4779189b111c9a3e0ea877067c046d10021b0e60eae8d5dd7536b4474d8ab74679e2d8e68bc9208db5561e28d0bec177cda1e2f944a4cd97b6432033ce40063cbced6b36e486b096adffd699c9fdf58d5ec54bf4afdf52493fbfcd91e807da31ff675b567058697aa088118a6ecf1b7c7dceba3ba87d59d882fce3b3b676763ed658e991c4fd5746946815af0a2c1e96aeb27383cf6638d6d7e1932b3a028250fee18db7c46acd7fab33ab22ff91cf78029a4ed96494151652213fb7dcca0a8944568bf84aded113e20e6897d6b8f6f9fe5f6975c7cbf999d15ce5f8d50454d58e7a5b285fce4ef9d14758cf4a9619b17275fa66f2c6c48d44da95657708062bec9b633ba2df082766f549c5c1b661fc8a5f7b8b6699503da733a66df44f116c4a470b73648cb64bf04101e7bc1d048d230addbf22a5b98aea08beda847e33552faf771d9b181f610ce34530543096257856ea3a08276bec1ea40e7bf6957143623ef47b5c41e61d076eef0a5195431b49beab9fd7f07b1a153491a7250a889b26ce657df550b226fb94cb5f52306f47ee3af4627ef0cdc0c50536af7b386440b878ed5d672670abdb3ea3e3c3c031e67293104a4d6476cf325f6fe4762ce2351dffac116387baadb82f987cab7fe88ce1be7d44ccd572bfd29114d2ce4d5e90f4d6bf7be39ce25ab7de52815e4059d783564d518dd208714de1c524ff69a4ec5f29bb631eff605cc6f30a0bcfba44810a3a6fc263891791b51cb4be0d60d3d0798e38b01b9a21150589a436fb4df4584bf6e7094176884921bbb0f87b1bcdfb6df8aef8f58393800816c15647650448da0ba5bb76f7bf76c3be83aceab79eedae80e1fb46a2557a9485aa7a8053a5835e609fdf54222f5b43cba63c9508dbbd0e22953768f88e2070236d7255f682464d09c7ba12b2e8787a1bc889af686d2c355961d8f92f877bb09baef09d70b5b306047d8d3cb97fb06ba8d09bfbae02314dddf98092b6ef275743e9deb391995003d83b549ecd604daa9bd34ef311aeced5db504242241c0717f8302efedcd3fd43686a7ee21c73ba3c5af98c93d09158c9011e11bc4b51a3a4e904c4b6ced1a786adf310073405c27df6aae6d5da4398d78622ba9144ad09902da49b77046ad22fd303f07c1533f271eb82794b402382d2971f46c7907069907a7afb9e94dd4071685f91cfca10d86aad7c385e4d90f0d44d37588a8f1f267c1d8445634ca4194d1a0c5894a6d00cae3af3aec991cfefda59e3f46c0a6e2fac55b35259a9960ec7dbd1c7dd128368393f0de1e0994ba1f5b41762c22213f56bbf4c2cca458dd5731f9379f0651ba61fbf17a5861eb417e20a7fc9df12c6771f5ab322213ec95beff96dc1811dd0f45be8fb1ed93c2cc01e694620b550e45bd265fb357f52699cf9ca3ddf331fe4d11c5e97bb57631d9c7620b5c19562c85ef8e04ecd5cd5b713fbd94b6b76331a83f304cd8ae1a903ffa722cf5697b1e1bde206735656ce57254744daff8013f47f9aa4f062d8c5956fa8df5ee79d6e6ffbc0c47cd0c99517a6d92fe8ad18c001be4b55af7a6533712c6a2ccb7e813016e7cb74a94bf2a2ce9b3b440faae19210d43320cb81a6472d1da775ca27f2b5bbe5964271eefccdfa0bd6b163357af4539fdb5d5e2e7e1795040776d4d75b70928b8efa954556f4d225bd9b6f9e5a71a8e7a3ef5c36d459233c66650ada1c55dfa02bca3997f93b92028881d9c3ec0e7e1a42c587482b0cfbc77e8520c6ca0f3e5127c96b41056b7279d9e62358e39dc95e779affaaaddc8e9ee66ba336feca8b957ccb4f352c0d162390e3bde27b15132407c97c3a6b5f1704e1e559ee12655a71d7dce3711c8af907d7d2875e2407ff8c59c5457678058d3d00a7971d239c1b1c67dac3ff3fbcc2d8c8035e31040118ac46ba5110a16aedd0b7f731a4f86a63a697501a664946eaf7da6d3cc2a296f294ee765b8f26363ba6116e0ea0ef8eabb0f1e7cc429611194cf0bb66463d26a82dd118cbbd3f1040dca2f5f82ac5eb5df41a4658fcb34b68066c5708a4a16c48fd290b32e392e7f5b662f4e3fa2d79a814f52824cf737872604672bdaf80fc527deb1f690339c92b6c6c6c8635de5a2e1a7ff617d0f1c11bc3a3504d0de94d77678025ab5bea511d783df148e58b0793251db3b7b9e03bb201be89d5939c0a60ab548460d543d015082e00ad9d05418c327ebafbad7924aaf70e5fa6eb0be359b65ac2fbbcad495b17712e033cbf1853d1e2450ac4c8d19287074e76ca3d087d376b0f861b525d4949098dd4e3a3cc50118c8587adf6587ed9aa0352b7d812fe66bb64eb0c0f4d46822aa9c3d4848454d49b61cca24d7d6b82fafc5d8eb4e40e3665f24a95182b70b22c5f9303a49d1278f25de9855246c729fc8ba300fad799a949b9b0ce303477d22337d599d4c8441461d25725965183210a729fc59c4e5ddb45c0b9db06a09619e6009aa0653cd1e8b06d0e55c133d5022dcf91f12a21e9f977de2485f886c5133a8837987e7bc90662156b0250cc76cb03ad9fa36733ef371479ea9c1313682866b963f1f96bba8c658e2c6a10e5e29d8a07d4999b735bdef7f60326aa64fc198c3f2670fa4a44717fc613f1282fc324fd9476e6da7866cb6ce1efa8a1577088f2aa757584b8ade9f2ba34a2287870da2cc7704008b6e057eaf8bfe2fd0d6d60cf03e1751d2284c6439ee6079708451e64b1f7e7dc8400ae99e0d834a7daba6c3a8219812adff0760129e18a41eb0448c57a909714cd395933436e9ae040277f213e30ab7b6e7e3109642ffa051b3c423f6ffa7830c75d229acd617d6bc1f7948f09238f5437ff4fb302034fec1fed96c55c46c7d70d6ab3018c1a3d76120077f815fa67ec8815f44fd0cae7d1509d217a432ce904c778f201a508fdea4672e9cff797bd1d0f58d46f39396e148573ae9b2468e4ee5bd9a5abce8166333c524f0a104da2e3c99ddbc51fc6f4e7c628af79c93d0fbe61b1c4a72b11fe423597f126467a01ee6dad848f24abdfe453592f02c84e017fe553f27e639f88824d70aeeaca54758184f95f12d696291798046bb075fefd6876e8ef893f5b9340e21fc63c67feb6f03055f2f394a591164a61b1aab14c468998175b75974543e79b241dc69a6e346374dec5eebae154e36f29d17273e608ce69d539a5e4702f474bad66fbf3348f0c859bf884576faeeac754e290ec97e863526e55420da72b6b6cd209e6685ffb64e9865d00eb017c843d3c0cf3ab26f53f76316fbe009f0b2c4932b0694fecf1a148dbead458ca9f5f6d678d6c6fbd23fb6aea9e951914300eaaaf69bf35d4ce11c0349a02aa14529a083e701eac0177d4ddb305a9f9a5cf8bacd96327a161bb8b877813ea022d62bac8f0ab9eb5e9d145dda4b1fe79c0bee34c8bbfe866ba376d3a71b9809adda06e64eafaa6cf53fff8ed63e15525fd409e13b1809ae6e6e937acf858a59d2073b304171d5ab35ec92f66fbb2d4e34d46e886c3546c1026d0ff27821a15aa397dbc686540d546ea66fb43dcb9beaeadde6250cfe8e563f9033b432018c88bec07279c6a0228f3eb11031d3435d95c9c1789a5338f74aa6db2c853c87f8f2397f9067fa59774770f64b8ae42b9a07f85f1bcabbc6d3b3456a253bdb73ad3de0aa416589b722053c81db90e7b66a835d636615701e6869fef016bfaba9da0a869005ffc3174b605fdabdb8c7346262ce78a64aa7036960913edfffad202d664d1771018de43b6548a6672f48979b8e30017a93da2c093266306e09eb203fb37d7d54466fb26d4414ba88346d02d8811f100dcb0a3e50ae46247b986b928f12c1ad506c6b33b49d7e6955ae9619f73c79b72a95b053d53c4c54d36dceb8ae780b321aa41b5d61caa21a6c65329f08da522bbbb3d07501b39cc6bfbe4a2ef8054d7c57666bc805ed451517a1432b958141f3ce94752a67a17aadb41590037da8efdb251eb56de30b0e0e75adfbf4e06d4777f843a8d7c31e2ab62d98764217491d46960d67d3ee1213d150c28e75d1f440d41ffc3cf876554e2d4a354f70fce17e4c0fdc64992c32e785263ca4ffcab57d3d46d220627ed05f1628551e9843137996bc7a0b773e1ccfe5364216a8003757ffdc052d93793a3463baf4eef5dd283826f8510bb1f20505a6e61cb3d571d0f77e67ff3c0aa5ca91f6d68c7e0d2d79c649b091b30b2911c5c47157c9c531296eba681e039eaecab83722cc2fd5b91913a463ba9f693e34da60b1adb8ee9f4a83fa67e25f19e4cd6e19ed1381cba8b5b4591109637ae1f7f29b5495fc5f8057da565d937e7577735bd98fe626ce8568897d240f054ad69c8e0ca424d1be51b17d5e639253fb2fe6791e01edcf9c4f8404233d7f98b52c31c4996b6b63112d0126036ca20cf52a2da2478683c41bfd8fb5b34de59d5e87b5075e5e1d78ad06c6a2f6e662145be3d30d140b62c49df203350ea4412c97aaeec7aaa00d81b89f3b7295607840de2a8386f52012b5c4e6e0e1986565bc4f99b6bc10f3a2ab59783a8b9f3c696f741af0f51b6592c68ddff861fc7d2b16876b05a54eae9ec0e170fbf26d9358941c6cba50a5c41e77f72c7f41e0bbf6023f04f7701f676a64cb63ea1a8d373ee6a99ba56449699ccdf8a11dc7d840d695cd5ef987f74e5b16594cc8c6c2251c47b429281b6e34c0288c7242052ac3c9c63213f6ddb08726001e0afe1fb312d463db8722f1617972dc7f365de498027ef0b5c6d100e583348cd777a2afbfd60ef59969c8f88358b6995c177a7d7e69d86b11e36f42bae8c9af599d3f828447c31004000163bb74ef20f656f6a1c8159bd0f867f2e283c10656a40a397b2e514c19efb5d5a5f54316509801bd8208a2c84b2ef13e54d7b8af8787b826b50095a15e33a5e8e306454312a83af7869b7ba0039ca601751b580a9190435d35a8ce9d8e9558ca1bcea3cc3604f4e991aee79fd0d2393b9f87e8dac7782e837e1de5e88a7c79385a2b14556041f49c1113df43efd8aea14c4b651d713fc9989b2fd77ce13a98efef5e83cc6843d313117753d82870c5efec8cc6fd855ab6e0fc6d48c66874fdcb2d007db7fbb9371da3836eb23da1106283a20e32617bcaba574b7b6298d48334eaeef905ff348c2bfbc1c83a88d6915b644d1854161ab4f1d1db12e74de2853e48d1a10f9835c226bca6944d0de6a18e0e07df45ad72a7d354045a6997ffdee010e37091a3a5280e5db8aeea0245217a6f1160a6287d9a28c0eeabaebe755b9485da5b7ccb85166ed902e63200e5e8ac464124bef0196eddee6cfe90fce770b416817e1ca78494786bdaeafa3538841f74bbdb2585d63f667ef227287efa56c030c0999e9ead590f1ce383a138233235494ecec0aed97c803b4d7c4fb80ac9a3bcb1dd2bab51382a94195bee034c3f3d3d9efc44add83ec580a5cfe8f5942b1694b0ab3ef4b2d9f7c0b8634b056c6b6eeb946be1825fa452abdbc1545cd94774abed3fdc2b0399929298221030f6cd0a2b38490f5e4bfd53ee20de10eeb2ffacca980d40e0885cb91c94a4d81a61d863efd0f7a12da233e1dacf7af728950892ef887abcc5e4d08c6b57834a1e5dd1dfc69418fc681b47d8cd34c6a3846b0e1afdc7c7f9033ff817a72ac617c0a1e59e4e6ea40bd668c499f221c5f63700e74b68ba3045b4460f0fa60308cf8964d95237d888d5c1b1be0fa7bd2703eaeb0d2914b8d22cbd8693c16f21bb72566f38aa97e86f212557d40e10b285e1d4de0b153c8f91e168e9d0031bb7ee7fec5f0c3fbf15bc6fbceeae6dd363b7e9835b175b0be16a3348a2c2d07468449fbb2fcfca9e7d8b72b623355715a6a1edc87ea4c699ffeacb2277fbb5658a1eb12d0a7a93bf100ab11cf49b35c16a14044ac8e5bd69af05b252325f0eca41f90681b4a1ec399096939a96685926655a0c4d172d06646c87f35b65c0d7654882b79838f78c35febbdb378f9f28d7e6ba1c1fa191bbcdbf991731f546439a966e4f7a15c77367161bde14b731c9f2b91114fa46e02e70f07d3c40988e8140866ed3dcd98ef5524700deb75c1a6414016da0ce6845e936a8692b7beac01bc855a72a490c667c3b755ffaaa57af54af1bd07ae7b203be85f3653aa63cc5ae10f6e585c7bd8a5257604e82fad6c7be6f1a47eb665c1422c03d3263f351671a48bd5eed22077b8c16e706f009880941c29b90c29a11ef008a371b29200f32523b9847d911fab4ee1468bf98a49ff73703e2d9d7bbf6ae37459c3cb502541f304e1d5918518a06225b65f3b38b91f8e0b49a29ef9aacca369ce5cf8b45738e29118ab06078b885189acf4d0a5200b86cb2269dde90dfada27975dbe6ded12232c0faf7ea12ecacbdf416cff8632e48346478a75c0279c1920b7556fc6670704d5d97912c75d3a9cffe6891abdf747a6850ba7d9668e56c7e7ecc03c5c388e886bc984c8bfd9f470b7e4ea4d146c3c28e4f8ff82b9558266343036e6239a26f567f7633911ccc51522c29ff3ca36ad5b8cfd6ec1c86ae08f30d87a503c909e66dc278e9d14f3fae4bfa4813f315b1610ed76fc149d92f319044e813c3769d4978637e0ee732d3bb86e9fa584181f41d4304c07a1cb71d10f07da649288275a213eff161c536c7366d4c010cf9a4b1c2f2940607dc7468e51204c6983c554d616d48f93ae51e6a7769b3285785ae7bcba3cfb27879df1d7f1f18849a70814eb51df6d1d8cbe80b736cb38326f7db7a06e49cd4fe41b3f7a9156cfac9222ac23d13765e7f2910a365fb23a208f192cfca97b2b8a3de44a2d90d3c865bec109f4bdfb1d37216cf5f71a27c39a83b5562b0c06d76b46b2d8f5b15cb1765d6c78d065d24bedf72405dcb8e795fe183196a6b620f918a2dd7fdfac142aa653fd431ec153e3daac8f615a45b3a0d665d5fe36efb6e2f18b8399429e4f363748eddd5cd2a637e9a0a553fac6d05a3e2bd1b26f2f99433f8f59a3691417a4f35ff7d46a22e39e94641d942706850cb2843ff4a34122e37dcc8224ae9f6ab7f64ff4a0bcb0aaff2f429e4f0f5fcf90ab6a2c45e8f2408d9bbd4f60d6b01a0cf527895e1cd063b178b8973930b9488d81d3f0f7985b900d0a894c29642b809ef39294bfaaa5401f5ed50cbb91a047b60ad54b323a2f2ada04d19d6dbda02e0f22d4d6520f9db2263181c97c9bb74dd8a90adedc80bfd064eb103f67d02ea17571f870c779470bb6460c658da4c502b9a10c8050fc26ad5cc1ae1eb02f0d703d05b48f48ab8c9f9a1bd000181ccf929d45544b44e9a3cd0bcd412ad639323283ed229e5486a2a93babb165880a0a7329834bb51a0631cba5caa30637ca3f07074051c608b7c7170c8c415c2eb88bd6a798bd86953ff71052506ccf0e2357deff6cef24de5b7f68a17082c08d096e43fbe727ab0ab1aa27a703ccd58168039e50dce2d400ed7f2a217c1eea7b29455fbf910d36db324d1c6b53343a78484883ad100a0b5b28c74ab6296df5bf8048fb916e8ddda0ded3f5b08d262b9b1cb1ecb149c02a21490ebebe8856c844d448d2a3878dcc930c3c88d9addf73917e9d3f878fb12fba3e602cfde199a0e69eab56e3d4ffa01135b3145baa613be01f0b94af5bd3b8b432339c954f52b8551fd13790bc1ee18be226b819d8001a3da8e097f84c166e4002e4c1043d3a3721f05105cd17a278b9509d7a04826e8a5b4956bbf976ffb4857fd88da99cfea8d2e0a1c4f52f71f87cbee8c02fbf59b12bdaccb67d0b95f0a56693eafafeefce1953d708b56532ed5bbe12626a3d041c031b48a47b34c504f7dd57e21147b920c058385ddc8cbea5332086c269b0d5c2439f30fa431f88d1a10e25eba0df70d8617ecd5546314ffeae9c4baab872ab82a45eeaf0e1e1533e8a6189c324f31b652aeadc52981b66161313999c5a7bd7c79ef4ee55c7cb00ebd9637ffe01924508a44ab72ab16b70b8b815ce7d27772db315122f4a5a7679af5ac685c26320a71cdd8066b19f749705e2e35d1d9166ecb066053dd05a759270e119944cf99b918cb5e4e6c931031ae2eeffe349ac246c92174091c687c58879e1f05c43b010f7ec3f204c106cf60740b0bc2d355f57bbaec7d060dedab9aebaa4094e72ebffbf61cdfb7d69fbd146daea59339fa83c19c5f75b866af5e7f387740e675e1e2ba29c261d9e7237c6e9ef1b39a8fdacb44de0eaff5f4f9e3e42b75d0a37834eab0cf47acf65e882f0962e01982e783c0dae7efbc95dccb235562e5a2e04fd2b4b43388c0292e6e8198c6df0348920d6e1c8acdd2e892d3f7aef7703824dbb08695642f0e444ade6c4f1ec1e267feb5135cccd50fcde643acb66dbd18f507496957ced435e0db0a8e8441a8e2ebc365f995c32399f7d180b6faeb85ee1921b95f82f3194bed7d157e842257d2da26dfac90f32fb53147e48e232d5115f1cd12b45c55330b29775ab776599afa504b7fe114cd7fb3ab4eb6c30becb82f448b284b20010bea918019af99b2a9ccab1585aec19fd1abe8365a6023f96dddf1a37cce2734bb6585143729850bcd811787bd07cb5fdd57cc987f9278b7f5ef3c7529a9b6d20d18cc4446f1036cf7635da6732986c38df4785e2e428f14b84957319772bdbb7d2d2d20321e522b1ec6c807f3a3f575643d4b71e1bbd1e843b5816aa68900298f5058c65a9fe1022978a44a77bde2b99e221de97cd7fa6a2ea440220bac20e3e4c1e4224958aca15681d3a18f74218114c3e5eefa1fc16de8c07f1d1297b0e772d05f205337175c1dbe88dfc876dcfce367304afac68c41b98ed2ba3f04fd1b37db27dd5d9c9aafaeadfcc44585908ea655ffce1fc2516b060256777e8953e2a6861ec4460034691aed001ea2971627615fc7972773d6a8c343117bae3fc68cfd1f187c478c0f52e86b118c65c39848a8c582ed908fb1242ad3455288cc858e52e119d368e00783c2b8c2916ba564a3501326baefe1dcadac8b4b8b666f20a3a245ca171b43af", 0x2000, &(0x7f0000006d00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0x0, 0x7, {0x0, 0x0, 0x20000000, 0x4, 0xfffffffd, 0x0, {0xffffffffffffffff, 0x0, 0x7, 0x0, 0x5, 0x3, 0x2, 0x0, 0x0, 0xc000, 0x0, r3, 0x0, 0x403}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) listen(r4, 0x0) getsockopt$bt_BT_DEFER_SETUP(r4, 0x112, 0x7, 0x0, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r6 = socket$unix(0x1, 0x5, 0x0) dup2(r6, r5) 1.195408819s ago: executing program 5 (id=2409): r0 = openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x2c0000, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000040)=0x4, 0x8) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)={0x2}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x121642, 0x0) ioctl$TIOCVHANGUP(r3, 0x5437, 0x2) write(r3, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ipv6_route\x00') sendfile(r0, r4, &(0x7f00000000c0)=0x8, 0x6) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300030a000000cf17f4faee1431a701000800000000000200010000000053ed4bcd3f000000020000000080030006000080000002004e210a010f00000000000000000002000100000004d2f40d77"], 0x50}, 0x1, 0x7}, 0x0) mkdirat(r4, &(0x7f0000000100)='./file0\x00', 0x40) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) 1.155008421s ago: executing program 5 (id=2410): openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x141a82, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) syz_io_uring_setup(0x7fbc, 0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/udp6\x00') r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) preadv(r2, &(0x7f0000000280)=[{&(0x7f0000000a00)=""/4096, 0x1000}], 0x1, 0x1f2, 0x1) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) write$cgroup_int(r0, &(0x7f0000000040)=0x900, 0x12) 1.109677482s ago: executing program 5 (id=2411): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e, 0x2}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x33}, @flat=@binder={0x73622a85, 0x3000, 0x2}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x1c1341, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000500)='ns/uts\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000019800)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) close(0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 1.063068923s ago: executing program 5 (id=2412): ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sigaltstack(&(0x7f0000000480)={&(0x7f0000004000)=""/4126, 0x80000001, 0x101e}, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x33}, @fda={0x66646185, 0x5, 0x0, 0xf}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) 571.193886ms ago: executing program 7 (id=2414): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) openat$rtc(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r1 = socket(0x10, 0x3, 0x0) pipe2(&(0x7f0000000100), 0x4800) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000280)={0x4000}, 0x10) r2 = socket$inet6(0xa, 0x802, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000001600010a00000000000000000c0000000c0000800800", @ANYRES16=r2], 0x20}}, 0x40816) 522.463576ms ago: executing program 7 (id=2415): newfstatat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x100) setuid(r0) (async) remap_file_pages(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x3, 0x5, 0x4000) (async) rmdir(&(0x7f00000000c0)='./file0/file0\x00') mincore(&(0x7f0000ffd000/0x3000)=nil, 0x3000, &(0x7f0000000100)=""/63) (async) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3) (async) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000004) setresuid(r0, r0, r0) (async, rerun: 64) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 64) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x98, 0x1, 0x1, 0x301, 0x0, 0x0, {0x3, 0x0, 0x5}, [@CTA_SEQ_ADJ_ORIG={0x34, 0xf, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x401}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x27a9}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x96}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x7}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x3}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x7c6}]}, @CTA_SEQ_ADJ_REPLY={0x3c, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0xf}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x523756b3}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0xf}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x4000}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x8}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0xff}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x4e2b}]}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x7}, @CTA_NAT_DST={0xc, 0xd, 0x0, 0x1, [@CTA_NAT_V4_MAXIP={0x8, 0x2, @empty}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x10}, 0x8004000) (async) r2 = openat2$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000300)={0x101, 0x1}, 0x18) mkdirat(r2, &(0x7f0000000340)='./file0/file0\x00', 0x106) (async) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000380), 0xffffffffffffffff) (async) r4 = socket$inet(0x2, 0x80000, 0x10) setsockopt$EBT_SO_SET_ENTRIES(r4, 0x0, 0x80, &(0x7f0000000840)=@nat={'nat\x00', 0x19, 0x2, 0x40c, [0x200000000400, 0x0, 0x0, 0x200000000430, 0x2000000005c6], 0x0, &(0x7f00000003c0), &(0x7f0000000400)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{0x9, 0x10, 0x3, 'veth0_to_bridge\x00', 'pim6reg\x00', 'bond0\x00', 'wlan1\x00', @remote, [0x0, 0xff], @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3e}, [0xff, 0xff, 0x0, 0xff, 0x0, 0xff], 0xde, 0x12e, 0x166, [@cgroup0={{'cgroup\x00', 0x0, 0x8}, {{0x304c}}}, @connbytes={{'connbytes\x00', 0x0, 0x18}, {{[{0x8}, {0x5}], 0x1}}}], [@common=@LED={'LED\x00', 0x28, {{'syz1\x00', 0x1, 0xa, {0x739}}}}], @common=@dnat={'dnat\x00', 0x10, {{@link_local, 0x10}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{0x5, 0x30, 0x8100, 'nicvf0\x00', 'pim6reg1\x00', 'veth0_to_team\x00', 'nicvf0\x00', @empty, [0x0, 0xff, 0xff, 0x0, 0x0, 0xff], @local, [0xff, 0xff], 0xb6, 0xb6, 0x1e6, [@ip={{'ip\x00', 0x0, 0x20}, {{@multicast1, @remote, 0xffffff00, 0xff, 0x4, 0x16, 0x24, 0x4, 0x4e20, 0x4e23, 0x4e24, 0x4e24}}}], [], @common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x1fc, 'system_u:object_r:dhcp_state_t:s0\x00'}}}}]}]}, 0x484) (async) fstat(r4, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(r5, r0) (async) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000940)={'wpan3\x00', 0x0}) mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x4) splice(0xffffffffffffffff, &(0x7f0000000980)=0x19ee00000000, r1, &(0x7f00000009c0)=0x3ff, 0x5950, 0x0) (async) mincore(&(0x7f0000ffb000/0x2000)=nil, 0x2000, &(0x7f0000000a00)=""/210) sendmsg$IEEE802154_DISASSOCIATE_REQ(r6, &(0x7f0000000c00)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b40)={0x6c, r3, 0x600, 0x70bd28, 0x25dfdbfb, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x80) r8 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000c80), r6) sendmsg$NLBL_MGMT_C_PROTOCOLS(r6, &(0x7f0000000d80)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x4c, r8, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@NLBL_MGMT_A_CV4DOI={0x8}, @NLBL_MGMT_A_DOMAIN={0x26, 0x1, 'system_u:object_r:dhcp_state_t:s0\x00'}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40810}, 0x40) (async) madvise(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x12) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000e00), r6) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r9, &(0x7f0000000ec0)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000e80)={&(0x7f0000000e40)={0x34, r10, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008040}, 0x40014) 432.032979ms ago: executing program 6 (id=2416): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x2082, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) (async) utimes(0x0, &(0x7f0000000100)={{0x77359400}, {0x77359400}}) (async, rerun: 32) close(r0) (rerun: 32) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) preadv(r0, &(0x7f00000028c0)=[{&(0x7f0000000480)=""/4096, 0x1000}, {&(0x7f00000001c0)=""/218, 0xda}, {&(0x7f0000001480)=""/4096, 0x1000}, {&(0x7f0000000300)=""/255, 0xff}, {&(0x7f0000002480)=""/152, 0x98}, {&(0x7f0000002540)=""/200, 0xc8}, {&(0x7f0000002640)=""/184, 0xb8}, {&(0x7f0000002700)=""/204, 0xcc}, {&(0x7f0000002800)=""/168, 0xa8}], 0x9, 0xb, 0x5) r2 = memfd_secret(0x0) (async, rerun: 64) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000380), 0x103183, 0x0) (rerun: 64) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x800005, 0x2010, r3, 0x4f793000) (async, rerun: 64) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) (rerun: 64) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0xa, 0x2}) r5 = socket$igmp(0x2, 0x3, 0x2) r6 = openat$kvm(0xffffff9c, &(0x7f0000000000), 0x800, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r8, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x40000103, 0x0, 0x99f5}]}) (async) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, 0x0, 0x0}) (async) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r9, &(0x7f0000000100)=ANY=[], 0x32600) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r9, 0x0) (async) r10 = accept4$unix(r2, 0x0, &(0x7f0000000080), 0x800) (async) ioctl$NS_GET_OWNER_UID(r9, 0xb704, &(0x7f0000000140)=0x0) (async) stat(&(0x7f0000002a00)='./file0\x00', &(0x7f0000002a40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r10, r11, r12) (async) getsockopt$inet_int(r5, 0x0, 0x15, 0x0, &(0x7f0000000180)) r13 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x0, 0x0) modify_ldt$read_default(0x2, &(0x7f0000002b00)=""/213, 0xd5) (async) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000100)={0x50, 0x0, &(0x7f0000002980)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000400)={@fd={0x66642a85, 0x0, r13}, @fd, @fda={0x66646185, 0x2, 0x1, 0x3f}}, &(0x7f0000000040)={0x0, 0x18, 0x30}}, 0x10}, @exit_looper], 0x0, 0x0, 0x0}) syz_genetlink_get_family_id$wireguard(&(0x7f0000002c00), r2) 345.290471ms ago: executing program 7 (id=2417): r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000040), 0x101080, 0x0) ioctl$RNDCLEARPOOL(r0, 0x5206, &(0x7f0000000080)) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', &(0x7f0000000140), 0x4800, &(0x7f0000000000)=ANY=[@ANYBLOB='fscontext?}']) 301.666452ms ago: executing program 6 (id=2418): r0 = socket$packet(0x11, 0x3, 0x300) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000000, 0x810, r1, 0x3000) setsockopt$packet_int(r0, 0x107, 0xe, &(0x7f00000000c0)=0xc, 0x4) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x258a, 0x33, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x7, 0x30, 0x2, [{{0x9, 0x4, 0x0, 0x4, 0x1, 0x3, 0x1, 0x2, 0xfa, {0x9, 0x21, 0x200, 0x40, 0x1, {0x22, 0x3a8}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0xfc, 0x2, 0x2}}}}}]}}]}}, &(0x7f0000000500)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x250, 0xc, 0x9, 0x2, 0x8, 0xb2}, 0x5, &(0x7f0000000080)={0x5, 0xf, 0x5}, 0x6, [{0x2b, &(0x7f0000000140)=@string={0x2b, 0x3, "7474a31f2dbab0c2e300d6898770c195a3e1d5c5025445f12f00b5f26f6a6c4139b04c190d07eb70e1"}}, {0x49, &(0x7f0000000200)=@string={0x49, 0x3, "c1ec4fd75877c32fb0e3b4bd91e3bd42efc914b9bd94461910733f0069e8c370c51d6b55e2c0e4b4cc415f97281d4e3529fcadeab58e176833f9ac4881972858e43eb454253348"}}, {0xf5, &(0x7f0000000400)=@string={0xf5, 0x3, "6401d2e1697c4cee807c2187fe1567aae274fb4941b4ae1657942b80521c319cfa79d92c237e1f400a624c3d4d4f4ff7cf8499c4ae20a0fb717443480ec84b245d4996d2b6b6432d08ea811081f9eab792255b046db88bb6c02750a16a848f322b8a5eca0d7aebb2230be364f8ac6d5ae7c2443b1503ff9b8f02761464b83d4448a133728896846a613daabb9ddbc4583d698f9c53a1152ef08734e8f69a4eaba10c3109eb445cb8fd404dfbab67df85fcddb04ba73dea20a476ac9a25a81b7548d1284cbade9a33e590594b01711fc54f8ec7bed0d9d5cd487b84a8c9fb979d94c65370eeba452a54c4ca7348c85469840f6d"}}, {0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x4c0a}}, {0x4a, &(0x7f0000000280)=@string={0x4a, 0x3, "8964768a547534f6b9c8741873d77d99f8ba9dca8f4c60b2427170af42e4da3786c4d59c92b07c0af73056ef28879105eff75753cdcfec6dccd2165886242bcd9acc23fc71a6e957"}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x41c}}]}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000100)) syz_open_procfs(0x0, &(0x7f0000000000)='io\x00') read$FUSE(r1, &(0x7f00000044c0)={0x2020}, 0x2020) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000300)=[@acquire], 0x0, 0x0, 0x0}) 237.833564ms ago: executing program 7 (id=2419): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$tun(0xffffff9c, &(0x7f00000001c0), 0x402, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000002280)={'pim6reg0\x00', 0x2102}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000080)={'nicvf0\x00', 0x400}) ioctl$KVM_CAP_DISABLE_QUIRKS(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000240)={0x74, 0x0, 0x12}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]}) ioctl$TUNSETTXFILTER(r1, 0x401054d5, &(0x7f00000005c0)=ANY=[@ANYRES64=r0, @ANYBLOB='9o)t']) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000000)={'bridge_slave_1\x00', 0x600}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x0, 0x0) r6 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r6, &(0x7f0000000000)={0x18, 0x2, {0x0, @local}}, 0x1e) connect$pptp(r6, &(0x7f0000000080)={0x18, 0x2, {0x0, @rand_addr=0x64010102}}, 0x1e) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r5, 0xc018620b, 0xfffffffffffffffe) ioctl$FIOCLEX(r5, 0x5451) 93.114548ms ago: executing program 5 (id=2420): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/custom1\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x2, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000180)={0x1, 0x8}, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80002, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) fstat(r3, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(0x0, r4) setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001}, 0x8) r5 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_int(r5, 0x0, 0x12, 0x0, &(0x7f00000027c0)) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}, 0x400}, 0x1c) sendmmsg$inet6(r2, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) r6 = socket$inet_udp(0x2, 0x2, 0x0) recvfrom(r6, 0x0, 0x0, 0x40000140, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000000)={0x73622a85, 0x7790f6ceae8dd49, 0x2}) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/meminfo\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffc9a, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0xfffffffffffffce6}}, 0x10}], 0x0, 0x0, 0x0}) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x10, &(0x7f0000000280)={[{@userxattr}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@redirect_dir_off}, {@userxattr}, {@lowerdir={'lowerdir', 0x3d, './file0'}}], [{@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x1ff}}]}) 41.273189ms ago: executing program 5 (id=2421): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_mreqsrc(r1, 0x0, 0x28, &(0x7f0000000040)={@multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @remote}, 0xc) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 34.281579ms ago: executing program 7 (id=2422): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x101) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000540)={0xc, 0x0, &(0x7f0000000400)=[@free_buffer={0x40086303, r1}], 0x5, 0x0, &(0x7f0000000500)="7da3644468"}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'bridge_slave_0\x00', 0x20}) 0s ago: executing program 7 (id=2423): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) close_range(r0, 0xffffffffffffffff, 0x0) r1 = socket(0x10, 0x3, 0x0) pipe2(&(0x7f0000000100), 0x4800) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000280)={0x4000}, 0x10) r2 = socket$inet6(0xa, 0x802, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000001600010a00000000000000000c0000000c0000800800", @ANYRES16=r2], 0x20}}, 0x40816) kernel console output (not intermixed with test programs): oint 0x6 has invalid wMaxPacketSize 0 [ 182.192546][ T305] usb 7-1: config 11 interface 120 altsetting 14 has a duplicate endpoint with address 0xD, skipping [ 182.204182][ T305] usb 7-1: config 11 interface 120 altsetting 14 has a duplicate endpoint with address 0x2, skipping [ 182.215836][ T305] usb 7-1: config 11 interface 120 altsetting 14 has an endpoint descriptor with address 0x3B, changing to 0xB [ 182.228321][ T305] usb 7-1: config 11 interface 120 altsetting 14 has a duplicate endpoint with address 0xB, skipping [ 182.239948][ T305] usb 7-1: config 11 interface 120 altsetting 14 endpoint 0x8 has invalid maxpacket 512, setting to 64 [ 182.251709][ T305] usb 7-1: config 11 interface 87 has no altsetting 0 [ 182.259137][ T305] usb 7-1: config 11 interface 120 has no altsetting 0 [ 182.270890][ T305] usb 7-1: New USB device found, idVendor=0bfd, idProduct=001b, bcdDevice=fd.be [ 182.281047][ T305] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.289684][ T305] usb 7-1: Product: 噏⯮重麮瓍἞拮୦䝄塮诅骳䲃☢ⷕ⸐ꠂぢ哹獡泫Ⱙ廴摏꓀ગ龾應㠚撯秩䠡쥯䋣襰旪䢟↳꽛ኀⷋ⁧냜⸁驪ힻ낇硝਒㷤ﶻ为ᥣ侏찑啍樵㧯鿧塄륟ꙅ厝妰ⲍ각锜๎젘猝붦接㬏⇊刺Ꭵ痡爎샤ￕ烕膍䎔䏕ᮁꆵ娥샧硴怦忷묊ᠭ噡 [ 182.321855][ T305] usb 7-1: Manufacturer: Έ찞軛롷蚿텀큜​直░︥짟㼧셚؆腄唙뢝➭郕憂淂ⱪ砸驎ឹﱚ꥿ᐿ㕎䭨盈挠헭䍰솂鎐Ⴀ牑艶⼭宖ᘵ赪ⳝ犰⣂겙ꁎ皷햑ᬑ햛랻梠ന쨥탕琍岿됧㷘췞愇㰠ĥ襤ꉲ薏忾㧥ᖼ欼商〹紤땦℈᣹ﵺ宪ꐚ垤 [ 182.357859][ T305] usb 7-1: SerialNumber: syz [ 182.382705][ T5419] rust_binder: Error while translating object. [ 182.382856][ T5419] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 182.389351][ T5419] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:171 [ 182.571520][ T5402] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 182.589222][ T5401] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 182.589330][ T5402] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 182.609606][ T5401] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 182.616538][ T5402] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 182.625992][ T5402] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 182.644838][ T5401] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 182.653420][ T5401] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 182.675089][ T310] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 182.745560][ T36] kauditd_printk_skb: 604 callbacks suppressed [ 182.745579][ T36] audit: type=1400 audit(4000000285.736:5386): avc: denied { ioctl } for pid=5420 comm="syz.5.1702" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 182.825043][ T310] usb 6-1: Using ep0 maxpacket: 32 [ 182.831011][ T36] audit: type=1400 audit(4000000285.816:5387): avc: denied { ioctl } for pid=5420 comm="syz.5.1702" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 182.833634][ T310] usb 6-1: config 0 has an invalid interface number: 67 but max is 0 [ 182.856093][ T36] audit: type=1400 audit(4000000285.816:5388): avc: denied { ioctl } for pid=5420 comm="syz.5.1702" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 182.866323][ T310] usb 6-1: config 0 has no interface number 0 [ 182.890614][ T36] audit: type=1400 audit(4000000285.816:5389): avc: denied { ioctl } for pid=5420 comm="syz.5.1702" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 182.902784][ T310] usb 6-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 182.920796][ T36] audit: type=1400 audit(4000000285.816:5390): avc: denied { ioctl } for pid=5420 comm="syz.5.1702" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 182.939455][ T310] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.977143][ T305] usb 7-1: USB disconnect, device number 4 [ 182.987369][ T36] audit: type=1400 audit(4000000285.816:5391): avc: denied { ioctl } for pid=5420 comm="syz.5.1702" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 182.992373][ T310] usb 6-1: Product: syz [ 183.017525][ T310] usb 6-1: Manufacturer: syz [ 183.022151][ T310] usb 6-1: SerialNumber: syz [ 183.034581][ T310] usb 6-1: config 0 descriptor?? [ 183.040325][ T36] audit: type=1400 audit(4000000285.846:5392): avc: denied { ioctl } for pid=5420 comm="syz.5.1702" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 183.067999][ T310] smsc95xx v2.0.0 [ 183.071775][ T36] audit: type=1400 audit(4000000285.886:5393): avc: denied { ioctl } for pid=5420 comm="syz.5.1702" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 183.096708][ T310] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 183.106819][ T310] smsc95xx 6-1:0.67: probe with driver smsc95xx failed with error -22 [ 183.117442][ T36] audit: type=1400 audit(4000000285.886:5394): avc: denied { ioctl } for pid=5420 comm="syz.5.1702" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 183.142424][ T36] audit: type=1400 audit(4000000285.886:5395): avc: denied { ioctl } for pid=5420 comm="syz.5.1702" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 183.535052][ T305] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 183.577304][ T5432] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 183.584491][ T5432] rust_binder: Write failure EINVAL in pid:113 [ 183.665471][ T305] usb 8-1: device descriptor read/64, error -71 [ 183.915077][ T305] usb 8-1: device descriptor read/64, error -71 [ 184.155050][ T305] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 184.295054][ T305] usb 8-1: device descriptor read/64, error -71 [ 184.535038][ T305] usb 8-1: device descriptor read/64, error -71 [ 184.569088][ T5442] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:390 [ 184.655533][ T305] usb usb8-port1: attempt power cycle [ 184.783470][ T5452] sock: sock_set_timeout: `syz.4.1714' (pid 5452) tries to set negative timeout [ 185.035070][ T305] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 185.057287][ T305] usb 8-1: device descriptor read/8, error -71 [ 185.185075][ T306] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 185.195686][ T305] usb 8-1: device descriptor read/8, error -71 [ 185.335067][ T306] usb 7-1: Using ep0 maxpacket: 16 [ 185.342924][ T306] usb 7-1: config 64 has an invalid descriptor of length 0, skipping remainder of the config [ 185.356676][ T306] usb 7-1: New USB device found, idVendor=9e88, idProduct=9e8f, bcdDevice=9b.e4 [ 185.365856][ T306] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.373869][ T306] usb 7-1: Product: syz [ 185.378179][ T306] usb 7-1: Manufacturer: syz [ 185.382871][ T306] usb 7-1: SerialNumber: syz [ 185.435077][ T305] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 185.438567][ T310] usb 6-1: USB disconnect, device number 5 [ 185.466026][ T305] usb 8-1: device descriptor read/8, error -71 [ 185.603778][ T305] usb 8-1: device descriptor read/8, error -71 [ 185.669150][ T306] ftdi_sio 7-1:64.0: Ignoring interface reserved for JTAG [ 185.690463][ T306] usb 7-1: USB disconnect, device number 5 [ 185.732009][ T305] usb usb8-port1: unable to enumerate USB device [ 186.412301][ T5499] netlink: 20 bytes leftover after parsing attributes in process `syz.7.1731'. [ 186.444818][ T5499] rust_binder: Error in use_page_slow: ESRCH [ 186.444841][ T5499] rust_binder: use_range failure ESRCH [ 186.470914][ T5499] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 186.485050][ T5499] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 186.512350][ T5499] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:117 [ 186.616654][ T5505] rust_binder: Failed to allocate buffer. len:65376, is_oneway:true [ 186.645992][ T5505] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 186.668619][ T5505] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:199 [ 186.694096][ T5506] macsec0: entered allmulticast mode [ 186.736469][ T5506] veth1_macvtap: entered allmulticast mode [ 186.746976][ T5511] rust_binder: Failed to allocate buffer. len:4216, is_oneway:false [ 186.873977][ T5518] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:143 [ 186.968169][ T5527] overlayfs: option "workdir=./file1" is useless in a non-upper mount, ignore [ 187.024179][ T5527] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 187.116593][ T5539] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 187.311293][ T5546] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:217 [ 187.339744][ T5546] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 187.365031][ T310] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 187.429228][ T5546] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 120, limit: 136, size: 128) [ 187.429258][ T5546] rust_binder: Error while translating object. [ 187.455056][ T5546] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 187.461303][ T5546] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:217 [ 187.605049][ T310] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 187.692649][ T310] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 187.710513][ T310] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 187.739581][ T310] usb 7-1: SerialNumber: syz [ 187.766755][ T36] kauditd_printk_skb: 875 callbacks suppressed [ 187.766774][ T36] audit: type=1400 audit(4000000290.756:6271): avc: denied { ioctl } for pid=5535 comm="syz.6.1741" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x550a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 187.857738][ T36] audit: type=1400 audit(4000000290.756:6272): avc: denied { ioctl } for pid=5535 comm="syz.6.1741" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5509 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 187.885447][ T5563] 8021q: VLANs not supported on vcan0 [ 187.890917][ T36] audit: type=1400 audit(4000000290.756:6273): avc: denied { ioctl } for pid=5535 comm="syz.6.1741" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5505 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 187.947989][ T36] audit: type=1400 audit(4000000290.756:6274): avc: denied { ioctl } for pid=5535 comm="syz.6.1741" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5505 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 188.003364][ T36] audit: type=1400 audit(4000000290.756:6275): avc: denied { ioctl } for pid=5535 comm="syz.6.1741" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 188.064454][ T36] audit: type=1400 audit(4000000290.786:6276): avc: denied { read write } for pid=5022 comm="syz-executor" name="loop7" dev="devtmpfs" ino=56 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 188.115021][ T36] audit: type=1400 audit(4000000290.786:6277): avc: denied { read write open } for pid=5022 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=56 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 188.155890][ T5570] audit: audit_backlog=65 > audit_backlog_limit=64 [ 188.162473][ T5570] audit: audit_lost=4 audit_rate_limit=0 audit_backlog_limit=64 [ 188.175346][ T5566] audit: audit_backlog=65 > audit_backlog_limit=64 [ 188.225032][ T715] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 188.399062][ T715] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 188.418966][ T715] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 188.435023][ T715] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.443105][ T715] usb 8-1: Product: syz [ 188.453189][ T715] usb 8-1: Manufacturer: syz [ 188.457894][ T715] usb 8-1: SerialNumber: syz [ 188.464487][ T310] cdc_ether 7-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.6-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 189.027500][ T5588] binder: Bad value for 'max' [ 189.249411][ T5596] syzkaller0: tun_chr_ioctl cmd 2147767506 [ 189.423190][ T45] usb 7-1: USB disconnect, device number 6 [ 189.429608][ T45] cdc_ether 7-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.6-1, CDC Ethernet Device [ 189.519745][ T715] cdc_ncm 8-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 189.532704][ T715] cdc_ncm 8-1:1.0: dwNtbInMaxSize=20 is too small. Using 2048 [ 189.550893][ T715] cdc_ncm 8-1:1.0: setting rx_max = 2048 [ 189.751297][ T715] cdc_ncm 8-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.7-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 189.782736][ T715] usb 8-1: USB disconnect, device number 11 [ 189.789046][ T715] cdc_ncm 8-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.7-1, CDC NCM (NO ZLP) [ 190.214727][ T5633] binder: Unknown parameter 'coyBLV"i5ntext' [ 190.339092][ T5638] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:145 [ 190.424553][ T5641] rust_binder: Write failure EFAULT in pid:430 [ 190.435021][ T305] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 190.542917][ T5645] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 190.542952][ T5645] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:147 [ 190.605055][ T305] usb 6-1: Using ep0 maxpacket: 32 [ 190.630490][ T305] usb 6-1: config 0 has an invalid interface number: 67 but max is 0 [ 190.645134][ T305] usb 6-1: config 0 has no interface number 0 [ 190.666049][ T305] usb 6-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 190.696560][ T305] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 190.703620][ T5652] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 190.710087][ T5652] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:432 [ 190.716006][ T305] usb 6-1: Product: syz [ 190.746432][ T305] usb 6-1: Manufacturer: syz [ 190.751134][ T305] usb 6-1: SerialNumber: syz [ 190.768821][ T305] usb 6-1: config 0 descriptor?? [ 190.790237][ T305] smsc95xx v2.0.0 [ 190.890371][ T5661] kvm: user requested TSC rate below hardware speed [ 191.057785][ T5666] rust_binder: Failed copying remainder into alloc: EFAULT [ 191.057809][ T5666] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 191.065275][ T5666] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 191.073779][ T5666] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:158 [ 191.433679][ T5687] KVM: debugfs: duplicate directory 5687-11 [ 191.528285][ T5689] binder: Bad value for 'max' [ 191.590973][ T5691] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 191.591000][ T5691] rust_binder: Read failure Err(EFAULT) in pid:448 [ 191.753777][ T5693] random: crng reseeded on system resumption [ 191.864759][ T5700] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 191.871236][ T5702] rust_binder: Error in use_page_slow: ESRCH [ 191.877750][ T5702] rust_binder: use_range failure ESRCH [ 191.883758][ T5702] rust_binder: Failed to allocate buffer. len:4232, is_oneway:false [ 191.889256][ T5702] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 191.897296][ T5702] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:457 [ 191.939852][ T5704] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 192.170400][ T5711] binder: Unknown parameter 'dm' [ 192.577035][ T5728] syz.6.1793(5728): Attempt to set a LOCK_MAND lock via flock(2). This support has been removed and the request ignored. [ 192.779603][ T36] kauditd_printk_skb: 1219 callbacks suppressed [ 192.779622][ T36] audit: type=1400 audit(4000000295.766:7494): avc: denied { read write } for pid=3504 comm="syz-executor" name="loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 192.830180][ T36] audit: type=1400 audit(4000000295.766:7495): avc: denied { read write open } for pid=3504 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 192.855926][ T36] audit: type=1400 audit(4000000295.766:7496): avc: denied { ioctl } for pid=3504 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 192.891930][ T36] audit: type=1400 audit(4000000295.796:7497): avc: denied { create } for pid=5735 comm="syz.4.1796" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 192.913555][ T36] audit: type=1400 audit(4000000295.796:7498): avc: denied { write } for pid=5735 comm="syz.4.1796" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 192.959511][ T36] audit: type=1400 audit(4000000295.796:7499): avc: denied { read } for pid=5735 comm="syz.4.1796" dev="nsfs" ino=4026532298 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 193.000558][ T36] audit: type=1400 audit(4000000295.796:7500): avc: denied { read open } for pid=5735 comm="syz.4.1796" path="net:[4026532298]" dev="nsfs" ino=4026532298 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 193.025081][ T36] audit: type=1400 audit(4000000295.796:7501): avc: denied { create } for pid=5735 comm="syz.4.1796" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 193.084543][ T36] audit: type=1400 audit(4000000295.806:7502): avc: denied { write } for pid=5735 comm="syz.4.1796" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 193.112627][ T36] audit: type=1400 audit(4000000295.806:7503): avc: denied { read } for pid=5735 comm="syz.4.1796" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 193.235872][ T305] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 193.280234][ T305] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 193.301971][ T305] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 193.324483][ T305] smsc95xx 6-1:0.67: probe with driver smsc95xx failed with error -71 [ 193.326617][ T5752] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 193.344490][ T305] usb 6-1: USB disconnect, device number 6 [ 193.375139][ T5755] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 193.469175][ T5760] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 194.171372][ T5778] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 144, size: 87) [ 194.177980][ T5778] rust_binder: Error while translating object. [ 194.189334][ T5778] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 194.196850][ T5778] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:248 [ 194.210677][ T5779] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 194.242385][ T305] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 194.424135][ T305] usb 8-1: Using ep0 maxpacket: 32 [ 194.432031][ T305] usb 8-1: config 0 has an invalid interface number: 67 but max is 0 [ 194.440285][ T305] usb 8-1: config 0 has no interface number 0 [ 194.454867][ T305] usb 8-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 194.477600][ T305] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 194.485696][ T305] usb 8-1: Product: syz [ 194.489992][ T305] usb 8-1: Manufacturer: syz [ 194.494823][ T305] usb 8-1: SerialNumber: syz [ 194.501526][ T305] usb 8-1: config 0 descriptor?? [ 194.509402][ T305] smsc95xx v2.0.0 [ 194.531038][ T310] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 194.691384][ T310] usb 6-1: Using ep0 maxpacket: 32 [ 194.699260][ T310] usb 6-1: config 0 has an invalid interface number: 67 but max is 0 [ 194.707436][ T310] usb 6-1: config 0 has no interface number 0 [ 194.713620][ T310] usb 6-1: config 0 interface 67 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 165 [ 194.735223][ T310] usb 6-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 194.744394][ T310] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 194.752584][ T310] usb 6-1: Product: syz [ 194.756796][ T310] usb 6-1: Manufacturer: syz [ 194.761431][ T310] usb 6-1: SerialNumber: syz [ 194.768158][ T310] usb 6-1: config 0 descriptor?? [ 194.774948][ T5783] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 194.783169][ T310] smsc95xx v2.0.0 [ 194.883847][ T306] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 195.046823][ T306] usb 7-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 195.058487][ T306] usb 7-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 195.069497][ T306] usb 7-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 195.080775][ T306] usb 7-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 195.089920][ T306] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 195.101635][ T5795] raw-gadget.3 gadget.6: fail, usb_ep_enable returned -22 [ 195.377721][ T5797] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 197.203687][ T305] smsc95xx 8-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 197.235806][ T305] smsc95xx 8-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 197.248508][ T305] smsc95xx 8-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 197.278023][ T305] smsc95xx 8-1:0.67: probe with driver smsc95xx failed with error -71 [ 197.293663][ T305] usb 8-1: USB disconnect, device number 12 [ 197.506378][ T310] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 197.546916][ T310] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 197.567171][ T310] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 197.598017][ T310] smsc95xx 6-1:0.67: probe with driver smsc95xx failed with error -71 [ 197.621565][ T310] usb 6-1: USB disconnect, device number 7 [ 197.959440][ T5834] rust_binder: Error while translating object. [ 197.959488][ T5834] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 197.975024][ T5834] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:181 [ 198.133550][ T36] kauditd_printk_skb: 597 callbacks suppressed [ 198.133578][ T36] audit: type=1400 audit(4000000300.778:8101): avc: denied { read write } for pid=5022 comm="syz-executor" name="loop7" dev="devtmpfs" ino=56 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 198.188997][ T36] audit: type=1400 audit(4000000300.778:8102): avc: denied { read write open } for pid=5022 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=56 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 198.228230][ T5845] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 198.236757][ T5845] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 198.272748][ T36] audit: type=1400 audit(4000000300.778:8103): avc: denied { ioctl } for pid=5022 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=56 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 198.298897][ T36] audit: type=1400 audit(4000000300.825:8104): avc: denied { ioctl } for pid=5838 comm="syz.5.1829" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 198.323859][ T310] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 198.337030][ T36] audit: type=1400 audit(4000000300.844:8105): avc: denied { read write } for pid=5843 comm="syz.7.1830" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 198.360708][ T36] audit: type=1400 audit(4000000300.844:8106): avc: denied { read write open } for pid=5843 comm="syz.7.1830" path="/dev/raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 198.385243][ T36] audit: type=1400 audit(4000000300.844:8107): avc: denied { ioctl } for pid=5843 comm="syz.7.1830" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 198.410201][ T36] audit: type=1400 audit(4000000300.844:8108): avc: denied { ioctl } for pid=5843 comm="syz.7.1830" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 198.435164][ T36] audit: type=1400 audit(4000000300.844:8109): avc: denied { ioctl } for pid=5843 comm="syz.7.1830" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 198.460172][ T36] audit: type=1400 audit(4000000300.844:8110): avc: denied { ioctl } for pid=5843 comm="syz.7.1830" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 198.486688][ T64] usb 8-1: new full-speed USB device number 13 using dummy_hcd [ 198.507969][ T310] usb 6-1: Using ep0 maxpacket: 32 [ 198.515611][ T310] usb 6-1: config 0 has an invalid interface number: 67 but max is 0 [ 198.523732][ T310] usb 6-1: config 0 has no interface number 0 [ 198.529845][ T310] usb 6-1: too many endpoints for config 0 interface 67 altsetting 255: 243, using maximum allowed: 30 [ 198.540910][ T310] usb 6-1: config 0 interface 67 altsetting 255 bulk endpoint 0x82 has invalid maxpacket 640 [ 198.551114][ T310] usb 6-1: config 0 interface 67 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 243 [ 198.565175][ T310] usb 6-1: config 0 interface 67 has no altsetting 0 [ 198.574988][ T310] usb 6-1: New USB device found, idVendor=e824, idProduct=9900, bcdDevice=c2.57 [ 198.584081][ T310] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.592064][ T310] usb 6-1: Product: syz [ 198.596257][ T310] usb 6-1: Manufacturer: syz [ 198.600866][ T310] usb 6-1: SerialNumber: syz [ 198.607386][ T310] usb 6-1: config 0 descriptor?? [ 198.614076][ T5839] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 198.650908][ T64] usb 8-1: unable to get BOS descriptor or descriptor too short [ 198.659727][ T64] usb 8-1: not running at top speed; connect to a high speed hub [ 198.669126][ T64] usb 8-1: config 0 has an invalid interface number: 88 but max is 0 [ 198.677347][ T64] usb 8-1: config 0 has no interface number 0 [ 198.683582][ T64] usb 8-1: config 0 interface 88 altsetting 8 endpoint 0x86 has an invalid bInterval 0, changing to 10 [ 198.694825][ T64] usb 8-1: config 0 interface 88 altsetting 8 endpoint 0x86 has invalid wMaxPacketSize 0 [ 198.704668][ T64] usb 8-1: config 0 interface 88 has no altsetting 0 [ 198.714200][ T64] usb 8-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.31 [ 198.723319][ T64] usb 8-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3 [ 198.731413][ T64] usb 8-1: Product: syz [ 198.735629][ T64] usb 8-1: Manufacturer: syz [ 198.740333][ T64] usb 8-1: SerialNumber: syz [ 198.746847][ T64] usb 8-1: config 0 descriptor?? [ 198.855389][ T5839] netlink: 188 bytes leftover after parsing attributes in process `syz.5.1829'. [ 198.970039][ T5844] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 198.979883][ T5844] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 198.990173][ T5844] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 198.998709][ T5844] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 199.009672][ T5844] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 199.018275][ T5844] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 199.029089][ T5844] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 199.038883][ T5844] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 199.114027][ T64] input: syz syz as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.88/input/input39 [ 199.129864][ T64] usb 8-1: USB disconnect, device number 13 [ 199.301493][ T5795] rust_binder: Read failure Err(EAGAIN) in pid:210 [ 199.301840][ T306] aiptek 7-1:17.0: Aiptek using 400 ms programming speed [ 199.316341][ T306] input: Aiptek as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:17.0/input/input37 [ 199.335038][ T306] usb 7-1: USB disconnect, device number 7 [ 199.340923][ C1] aiptek 7-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 199.812609][ T5856] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 199.812643][ T5856] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:191 [ 199.887255][ T5858] binfmt_misc: register: failed to install interpreter file ./file0 [ 200.008371][ T5867] rust_binder: Write failure EFAULT in pid:198 [ 200.043535][ T5869] binder: Bad value for 'context' [ 200.252370][ T5880] overlayfs: missing 'lowerdir' [ 201.214390][ T310] usb 6-1: USB disconnect, device number 8 [ 201.579179][ T5901] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:504 [ 201.684653][ T5905] overlayfs: missing 'lowerdir' [ 202.596652][ T5929] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 202.610208][ T5926] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 202.618980][ T5926] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 203.480266][ T36] kauditd_printk_skb: 596 callbacks suppressed [ 203.480285][ T36] audit: type=1400 audit(4000000305.783:8707): avc: denied { execmem } for pid=5931 comm="syz.7.1859" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 203.543946][ T36] audit: type=1400 audit(4000000305.820:8708): avc: denied { create } for pid=5933 comm="syz.5.1860" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 203.595782][ T36] audit: type=1400 audit(4000000305.839:8709): avc: denied { write } for pid=5933 comm="syz.5.1860" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 203.650494][ T36] audit: type=1400 audit(4000000305.867:8710): avc: denied { read write } for pid=4842 comm="syz-executor" name="loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 203.702180][ T36] audit: type=1400 audit(4000000305.867:8711): avc: denied { read write open } for pid=4842 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 203.762251][ T5940] rust_binder: Read failure Err(EAGAIN) in pid:294 [ 203.762879][ T5940] rust_binder: Write failure EFAULT in pid:294 [ 203.773269][ T5940] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 203.782213][ T36] audit: type=1400 audit(4000000305.867:8712): avc: denied { ioctl } for pid=4842 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 203.839520][ T36] audit: type=1400 audit(4000000305.923:8713): avc: denied { read } for pid=5935 comm="syz.5.1861" name="binder0" dev="binder" ino=34 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 203.863209][ T5945] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:236 [ 203.863832][ T36] audit: type=1400 audit(4000000305.923:8714): avc: denied { read open } for pid=5935 comm="syz.5.1861" path="/dev/binderfs/binder0" dev="binder" ino=34 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 203.898833][ T36] audit: type=1400 audit(4000000305.932:8715): avc: denied { read } for pid=5935 comm="syz.5.1861" name="binder0" dev="binder" ino=34 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 203.924984][ T36] audit: type=1400 audit(4000000305.932:8716): avc: denied { read open } for pid=5935 comm="syz.5.1861" path="/dev/binderfs/binder0" dev="binder" ino=34 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 203.945021][ T5947] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:214 [ 204.092011][ T5952] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 204.157220][ T5954] overlayfs: missing 'lowerdir' [ 204.632793][ T5961] rust_binder: Read failure Err(EAGAIN) in pid:301 [ 205.084147][ T5978] binder: Bad value for 'max' [ 205.295734][ T5996] overlayfs: failed to resolve './file1/file0': -2 [ 205.353670][ T6002] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 205.392978][ T6002] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 205.428696][ T6005] binder: Bad value for 'stats' [ 205.543990][ T6009] rust_binder: Failed to allocate buffer. len:4240, is_oneway:false [ 205.589687][ T6011] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 205.611937][ T6011] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1885'. [ 205.639849][ T6015] rust_binder: Write failure EFAULT in pid:332 [ 205.652491][ T6011] rust_binder: Error while translating object. [ 205.666250][ T6011] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 205.679430][ T6011] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:519 [ 206.471138][ T6042] input: syz1 as /devices/virtual/input/input41 [ 206.893134][ T6050] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 207.009335][ T6056] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 207.019723][ T6056] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 207.374152][ T6066] binder: Unknown parameter '0xffffffffffffffff' [ 207.778266][ T6092] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:255 [ 207.784705][ T6092] rust_binder: Error while translating object. [ 207.794423][ T6092] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 207.807098][ T6092] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:255 [ 207.838510][ T6094] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION freeze notification not active [ 207.856341][ T6094] rust_binder: Write failure EINVAL in pid:284 [ 207.908429][ T6098] rust_binder: validate_parent_fixup: new_min_offset=56, sg_entry.length=0 [ 207.915054][ T6098] rust_binder: Error while translating object. [ 207.924841][ T6098] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 207.931929][ T6098] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:346 [ 207.990963][ T6097] rust_binder: Failed copying remainder into alloc: EFAULT [ 208.003268][ T6097] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 208.010561][ T6097] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 208.033312][ T6097] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:286 [ 208.163795][ T6111] rust_binder: Write failure EFAULT in pid:295 [ 208.212175][ T6113] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:297 [ 208.325906][ T6119] tmpfs: Bad value for 'huge' [ 208.339940][ T305] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 208.506138][ T305] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 208.515991][ T305] usb 6-1: config 0 interface 0 has no altsetting 0 [ 208.522784][ T305] usb 6-1: New USB device found, idVendor=04fc, idProduct=05d8, bcdDevice= 0.00 [ 208.546406][ T305] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 208.567221][ T305] usb 6-1: config 0 descriptor?? [ 208.715795][ T6137] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 208.716303][ T6137] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 208.730865][ T6137] rust_binder: Write failure EINVAL in pid:261 [ 208.843489][ T36] kauditd_printk_skb: 817 callbacks suppressed [ 208.843510][ T36] audit: type=1400 audit(4000000310.796:9534): avc: denied { read } for pid=6142 comm="syz.7.1931" dev="nsfs" ino=4026532297 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 208.905950][ T36] audit: type=1400 audit(4000000310.796:9535): avc: denied { read open } for pid=6142 comm="syz.7.1931" path="pid:[4026532297]" dev="nsfs" ino=4026532297 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 208.942244][ T36] audit: type=1400 audit(4000000310.796:9536): avc: denied { ioctl } for pid=6142 comm="syz.7.1931" path="pid:[4026532297]" dev="nsfs" ino=4026532297 ioctlcmd=0xb701 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 208.967727][ T6146] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1933'. [ 209.019112][ T36] audit: type=1400 audit(4000000310.796:9537): avc: denied { read open } for pid=6142 comm="syz.7.1931" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 209.030515][ T305] sunplus 0003:04FC:05D8.0010: unknown main item tag 0x0 [ 209.082842][ T305] sunplus 0003:04FC:05D8.0010: unknown main item tag 0x0 [ 209.097541][ T305] sunplus 0003:04FC:05D8.0010: unknown main item tag 0x0 [ 209.102353][ T36] audit: type=1400 audit(4000000310.796:9538): avc: denied { append } for pid=6142 comm="syz.7.1931" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 209.113045][ T305] sunplus 0003:04FC:05D8.0010: unknown main item tag 0x0 [ 209.165255][ T6152] audit: audit_backlog=65 > audit_backlog_limit=64 [ 209.171927][ T305] sunplus 0003:04FC:05D8.0010: unknown main item tag 0x0 [ 209.173823][ T4918] audit: audit_backlog=65 > audit_backlog_limit=64 [ 209.185584][ T36] audit: type=1400 audit(4000000310.796:9539): avc: denied { append open } for pid=6142 comm="syz.7.1931" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 209.188774][ T6152] audit: audit_lost=6 audit_rate_limit=0 audit_backlog_limit=64 [ 209.209887][ T4918] audit: audit_lost=7 audit_rate_limit=0 audit_backlog_limit=64 [ 209.221368][ T305] sunplus 0003:04FC:05D8.0010: unknown main item tag 0x0 [ 209.253208][ T305] sunplus 0003:04FC:05D8.0010: unknown main item tag 0x0 [ 209.263393][ T305] sunplus 0003:04FC:05D8.0010: unknown main item tag 0x0 [ 209.270466][ T305] sunplus 0003:04FC:05D8.0010: unknown main item tag 0x0 [ 209.298232][ T305] sunplus 0003:04FC:05D8.0010: unknown main item tag 0x0 [ 209.316311][ T305] sunplus 0003:04FC:05D8.0010: unknown main item tag 0x0 [ 209.330452][ T6156] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1937'. [ 209.338954][ T305] sunplus 0003:04FC:05D8.0010: hidraw0: USB HID v0.05 Device [HID 04fc:05d8] on usb-dummy_hcd.5-1/input0 [ 209.380893][ T6156] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 209.382831][ T6156] rust_binder: Error while translating object. [ 209.383248][ T305] usb 6-1: USB disconnect, device number 9 [ 209.389329][ T6156] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 209.443156][ T6156] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:527 [ 209.457361][ T6156] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1937'. [ 209.567826][ T6172] block device autoloading is deprecated and will be removed. [ 209.587518][ T6172] syz.6.1940: attempt to access beyond end of device [ 209.587518][ T6172] loop0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 209.619116][ T6173] bridge0: port 2(bridge_slave_1) entered disabled state [ 209.660601][ T6173] binder: Bad value for 'max' [ 209.752457][ T6178] fido_id[6178]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 209.943089][ T6194] SELinux: security_context_str_to_sid (sytem_uGй=rx ܲtəQ׿) failed with errno=-22 [ 210.123046][ T6204] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 210.192773][ T310] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 210.401151][ T310] usb 8-1: config 1 interface 0 altsetting 253 bulk endpoint 0x3 has invalid maxpacket 1023 [ 210.414896][ T46] bridge_slave_1: left allmulticast mode [ 210.420655][ T46] bridge_slave_1: left promiscuous mode [ 210.426299][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 210.440041][ T46] bridge_slave_0: left allmulticast mode [ 210.441511][ T310] usb 8-1: config 1 interface 0 altsetting 253 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 210.445804][ T46] bridge_slave_0: left promiscuous mode [ 210.476471][ T310] usb 8-1: config 1 interface 0 has no altsetting 0 [ 210.476596][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 210.492437][ T310] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 210.503744][ T310] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 210.520730][ T310] usb 8-1: SerialNumber: syz [ 210.529862][ T6189] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 210.645151][ T46] tipc: Left network mode [ 210.652252][ T46] veth1_macvtap: left promiscuous mode [ 210.663043][ T46] veth0_vlan: left promiscuous mode [ 210.705077][ T6222] 9pnet_fd: Insufficient options for proto=fd [ 211.025756][ T6232] block device autoloading is deprecated and will be removed. [ 211.035682][ T6232] syz.5.1960: attempt to access beyond end of device [ 211.035682][ T6232] loop0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 211.072999][ T6228] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 211.073725][ T6228] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 211.091899][ T6228] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 211.112274][ T6229] syz.5.1960: attempt to access beyond end of device [ 211.112274][ T6229] loop0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 211.115814][ T6228] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:356 [ 211.157975][ T310] cdc_ether 8-1:1.0: probe with driver cdc_ether failed with error -71 [ 211.194443][ T310] usb 8-1: USB disconnect, device number 14 [ 211.283229][ T305] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 211.296489][ T6242] rust_binder: Failed to allocate buffer. len:65376, is_oneway:true [ 211.296516][ T6242] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 211.302779][ T6244] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 211.316325][ T6242] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:362 [ 211.385794][ T6246] rust_binder: validate_parent_fixup: new_min_offset=56, sg_entry.length=0 [ 211.395019][ T6246] rust_binder: Error while translating object. [ 211.404777][ T6246] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 211.412841][ T6246] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:364 [ 211.464961][ T305] usb 7-1: Using ep0 maxpacket: 8 [ 211.480505][ T6248] binder: Bad value for 'max' [ 211.493246][ T305] usb 7-1: config 179 has an invalid interface number: 65 but max is 0 [ 211.502798][ T305] usb 7-1: config 179 has no interface number 0 [ 211.511186][ T305] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 211.530838][ T305] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 211.543778][ T6248] hub 6-0:1.0: USB hub found [ 211.552161][ T6248] hub 6-0:1.0: 1 port detected [ 211.557017][ T305] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 211.571853][ T305] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 211.585560][ T305] usb 7-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 211.599574][ T305] usb 7-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 211.609370][ T305] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 211.627964][ T6234] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 211.774774][ T6255] overlayfs: missing 'lowerdir' [ 211.812540][ T6257] rust_binder: Failed to allocate buffer. len:65376, is_oneway:true [ 211.812566][ T6257] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 211.821887][ T6257] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:288 [ 211.890347][ T6259] overlayfs: missing 'lowerdir' [ 211.913130][ T6259] binder: Unknown parameter '' [ 212.095293][ T715] usb 7-1: USB disconnect, device number 8 [ 212.095383][ C1] xpad 7-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 212.109734][ C1] dummy_hcd dummy_hcd.6: timer fired with no URBs pending? [ 212.265386][ T6270] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:300 [ 212.265964][ T6269] rust_binder: Failed to vm_insert_page(35184372744192): vma_addr:35184372744192 i:0 err:EBUSY [ 212.275809][ T6269] rust_binder: Error in use_page_slow: EBUSY [ 212.297764][ T6269] rust_binder: use_range failure EBUSY [ 212.304417][ T6269] rust_binder: Failed to allocate buffer. len:8, is_oneway:true [ 212.320178][ T6269] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBUSY } [ 212.330336][ T6269] rust_binder: Failure BR_FAILED_REPLY { source: EBUSY } during reply - delivering BR_FAILED_REPLY to sender. [ 212.341727][ T6269] rust_binder: Transaction failed: BR_TRANSACTION_COMPLETE my_pid:300 [ 212.774915][ T6294] tipc: Enabling of bearer rejected, failed to enable media [ 212.847109][ T6299] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=28 sclass=netlink_tcpdiag_socket pid=6299 comm=syz.5.1986 [ 212.897249][ T6303] rust_binder: Error while translating object. [ 212.897282][ T6303] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 212.929589][ T6303] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:312 [ 213.028607][ T6310] rust_binder: Failed to allocate buffer. len:128, is_oneway:false [ 213.079247][ T6312] binder: Unknown parameter 'coyBLV"i5ntext' [ 213.173483][ T6314] 9pnet_fd: Insufficient options for proto=fd [ 213.230000][ T6317] rust_binder: Error while translating object. [ 213.230039][ T6317] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 213.236255][ T6317] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:382 [ 213.315360][ T6325] netlink: 80 bytes leftover after parsing attributes in process `syz.6.1997'. [ 213.369240][ T6328] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 213.426423][ T6331] netlink: 80 bytes leftover after parsing attributes in process `syz.6.1997'. [ 213.535561][ T6340] rust_binder: Write failure EINVAL in pid:323 [ 213.588982][ T6345] can: request_module (can-proto-0) failed. [ 213.603978][ T6341] can: request_module (can-proto-0) failed. [ 213.611397][ T6346] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 213.679444][ T6349] 8021q: VLANs not supported on ip_vti0 [ 213.692998][ T6349] binder: Unknown parameter 'pcr' [ 213.784814][ T31] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 213.804104][ T6358] netlink: 'syz.5.2009': attribute type 4 has an invalid length. [ 213.957264][ T31] usb 8-1: Using ep0 maxpacket: 32 [ 213.975545][ T31] usb 8-1: config 1 interface 0 altsetting 74 endpoint 0x81 has an invalid bInterval 142, changing to 11 [ 213.989525][ T31] usb 8-1: config 1 interface 0 altsetting 74 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 214.003389][ T31] usb 8-1: config 1 interface 0 has no altsetting 0 [ 214.020828][ T31] usb 8-1: New USB device found, idVendor=056a, idProduct=00d3, bcdDevice= 0.40 [ 214.030631][ T31] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 214.071294][ T31] usb 8-1: Product: ࠐ [ 214.076715][ T31] usb 8-1: Manufacturer: Ф [ 214.085896][ T31] usb 8-1: SerialNumber: 麖 [ 214.211769][ T36] kauditd_printk_skb: 1070 callbacks suppressed [ 214.211825][ T36] audit: type=1400 audit(4000000315.810:10593): avc: denied { read } for pid=6369 comm="syz.5.2012" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 214.241531][ T36] audit: type=1400 audit(4000000315.810:10594): avc: denied { read open } for pid=6369 comm="syz.5.2012" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 214.268378][ T36] audit: type=1400 audit(4000000315.838:10595): avc: denied { create } for pid=6369 comm="syz.5.2012" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 214.289021][ T36] audit: type=1400 audit(4000000315.838:10596): avc: denied { getopt } for pid=6369 comm="syz.5.2012" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 214.310749][ T36] audit: type=1400 audit(4000000315.838:10597): avc: denied { getopt } for pid=6369 comm="syz.5.2012" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 214.331406][ T36] audit: type=1400 audit(4000000315.838:10598): avc: denied { setopt } for pid=6369 comm="syz.5.2012" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 214.347326][ T6373] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2013'. [ 214.352769][ T36] audit: type=1400 audit(4000000315.838:10599): avc: denied { read } for pid=6369 comm="syz.5.2012" dev="nsfs" ino=4026532418 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 214.360554][ T6373] netlink: 32 bytes leftover after parsing attributes in process `syz.5.2013'. [ 214.382679][ T36] audit: type=1400 audit(4000000315.838:10600): avc: denied { read open } for pid=6369 comm="syz.5.2012" path="net:[4026532418]" dev="nsfs" ino=4026532418 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 214.414333][ T36] audit: type=1400 audit(4000000315.838:10601): avc: denied { create } for pid=6369 comm="syz.5.2012" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 214.434812][ T36] audit: type=1400 audit(4000000315.847:10602): avc: denied { read } for pid=6369 comm="syz.5.2012" dev="nsfs" ino=4026532418 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 214.457117][ T31] usbhid 8-1:1.0: can't add hid device: -71 [ 214.463255][ T31] usbhid 8-1:1.0: probe with driver usbhid failed with error -71 [ 214.471900][ T31] usb 8-1: USB disconnect, device number 15 [ 214.677585][ T6374] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 214.677609][ T6374] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:405 [ 214.972651][ T6389] SELinux: security_context_str_to_sid (sytem_uGй) failed with errno=-22 [ 215.634345][ T31] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 215.769955][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 215.780534][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 215.790802][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 215.800436][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 215.810488][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 215.816048][ T31] usb 8-1: Using ep0 maxpacket: 8 [ 215.820618][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 215.834195][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 215.834718][ T31] usb 8-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 215.844849][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 215.853601][ T31] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 215.862203][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 215.870187][ T31] usb 8-1: Product: syz [ 215.879504][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 215.882967][ T31] usb 8-1: Manufacturer: syz [ 215.892162][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 215.896303][ T31] usb 8-1: SerialNumber: syz [ 215.905582][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 215.911818][ T31] usb 8-1: config 0 descriptor?? [ 215.923290][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 215.933267][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 215.943536][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 215.953556][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 215.963778][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 215.973703][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 215.983755][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 215.993631][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 216.003630][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 216.013531][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 216.023545][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 216.033452][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 216.043531][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 216.053443][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 216.063522][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 216.073463][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 216.083421][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 216.093302][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 216.103280][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 216.113126][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 216.123122][ T6438] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 216.240485][ T6445] SELinux: security_context_str_to_sid (syte) failed with errno=-22 [ 216.418019][ T6454] SELinux: security_context_str_to_sid (sytem_uGй) failed with errno=-22 [ 216.726245][ T6469] random: crng reseeded on system resumption [ 216.814621][ T9] usb 6-1: new full-speed USB device number 10 using dummy_hcd [ 217.012043][ T9] usb 6-1: not running at top speed; connect to a high speed hub [ 217.022881][ T9] usb 6-1: config 38 has an invalid interface number: 144 but max is 2 [ 217.034167][ T9] usb 6-1: config 38 has an invalid interface number: 202 but max is 2 [ 217.059614][ T9] usb 6-1: config 38 has an invalid interface number: 87 but max is 2 [ 217.069991][ T6489] FAULT_INJECTION: forcing a failure. [ 217.069991][ T6489] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 217.079070][ T9] usb 6-1: config 38 has an invalid interface number: 38 but max is 2 [ 217.098826][ T6489] CPU: 1 UID: 0 PID: 6489 Comm: syz.4.2050 Not tainted 6.12.23-syzkaller-g6c1c18fcb8b7 #0 ba78288b1e32eb9f88d3f8d8da6b79a037cd8362 [ 217.098865][ T6489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 217.098879][ T6489] Call Trace: [ 217.098886][ T6489] [ 217.098895][ T6489] __dump_stack+0x21/0x30 [ 217.098924][ T6489] dump_stack_lvl+0x10c/0x190 [ 217.098951][ T6489] ? __cfi_dump_stack_lvl+0x10/0x10 [ 217.098975][ T6489] ? kstrtoull+0x13b/0x1e0 [ 217.098994][ T6489] dump_stack+0x19/0x20 [ 217.099016][ T6489] should_fail_ex+0x3d9/0x530 [ 217.099040][ T6489] should_fail+0xf/0x20 [ 217.099060][ T6489] should_fail_usercopy+0x1e/0x30 [ 217.099084][ T6489] _copy_from_user+0x22/0xb0 [ 217.099110][ T6489] ___sys_sendmsg+0x159/0x2a0 [ 217.099150][ T6489] ? __sys_sendmsg+0x280/0x280 [ 217.099183][ T6489] ? proc_fail_nth_write+0x17e/0x210 [ 217.099203][ T6489] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 217.099229][ T6489] __x64_sys_sendmsg+0x1eb/0x2c0 [ 217.099249][ T6489] ? fput+0x1a5/0x240 [ 217.099279][ T6489] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 217.099298][ T6489] ? ksys_write+0x1ef/0x250 [ 217.099324][ T6489] ? __kasan_check_read+0x15/0x20 [ 217.099348][ T6489] x64_sys_call+0x2a4c/0x2ee0 [ 217.099375][ T6489] do_syscall_64+0x58/0xf0 [ 217.099402][ T6489] ? clear_bhb_loop+0x35/0x90 [ 217.099433][ T6489] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 217.099463][ T6489] RIP: 0033:0x7f7f4bd8e929 [ 217.099482][ T6489] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 217.099499][ T6489] RSP: 002b:00007f7f4cb3f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 217.099522][ T6489] RAX: ffffffffffffffda RBX: 00007f7f4bfb5fa0 RCX: 00007f7f4bd8e929 [ 217.099537][ T6489] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 217.099569][ T6489] RBP: 00007f7f4cb3f090 R08: 0000000000000000 R09: 0000000000000000 [ 217.099583][ T6489] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 217.099596][ T6489] R13: 0000000000000000 R14: 00007f7f4bfb5fa0 R15: 00007fffe89e8568 [ 217.099614][ T6489] [ 217.109592][ T9] usb 6-1: config 38 has 4 interfaces, different from the descriptor's value: 3 [ 217.321448][ T9] usb 6-1: config 38 has no interface number 0 [ 217.328857][ T9] usb 6-1: config 38 has no interface number 1 [ 217.335093][ T9] usb 6-1: config 38 has no interface number 2 [ 217.342895][ T9] usb 6-1: config 38 has no interface number 3 [ 217.352009][ T9] usb 6-1: config 38 interface 144 altsetting 16 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 217.363133][ T9] usb 6-1: config 38 interface 144 altsetting 16 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 217.374331][ T9] usb 6-1: config 38 interface 144 altsetting 16 has a duplicate endpoint with address 0x8, skipping [ 217.385264][ T9] usb 6-1: config 38 interface 144 altsetting 16 has an invalid descriptor for endpoint zero, skipping [ 217.402839][ T9] usb 6-1: config 38 interface 144 altsetting 16 has a duplicate endpoint with address 0x5, skipping [ 217.414747][ T9] usb 6-1: config 38 interface 144 altsetting 16 has a duplicate endpoint with address 0xA, skipping [ 217.454168][ T9] usb 6-1: config 38 interface 144 altsetting 16 has 11 endpoint descriptors, different from the interface descriptor's value: 15 [ 217.489569][ T9] usb 6-1: config 38 interface 202 altsetting 145 has an invalid descriptor for endpoint zero, skipping [ 217.523421][ T9] usb 6-1: config 38 interface 202 altsetting 145 has a duplicate endpoint with address 0xA, skipping [ 217.549138][ T9] usb 6-1: config 38 interface 202 altsetting 145 endpoint 0xF has invalid maxpacket 1023, setting to 64 [ 217.567503][ T9] usb 6-1: config 38 interface 202 altsetting 145 endpoint 0x9 has invalid maxpacket 1023, setting to 64 [ 217.574513][ T6495] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 217.578989][ T9] usb 6-1: config 38 interface 202 altsetting 145 has 4 endpoint descriptors, different from the interface descriptor's value: 27 [ 217.600456][ T9] usb 6-1: config 38 interface 87 altsetting 8 has a duplicate endpoint with address 0x6, skipping [ 217.613487][ T9] usb 6-1: config 38 interface 87 altsetting 8 endpoint 0xE has invalid maxpacket 112, setting to 64 [ 217.626783][ T9] usb 6-1: config 38 interface 87 altsetting 8 has a duplicate endpoint with address 0xA, skipping [ 217.638185][ T9] usb 6-1: config 38 interface 87 altsetting 8 has a duplicate endpoint with address 0x2, skipping [ 217.649038][ T9] usb 6-1: config 38 interface 87 altsetting 8 has a duplicate endpoint with address 0x2, skipping [ 217.659819][ T9] usb 6-1: config 38 interface 87 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 217.670760][ T9] usb 6-1: config 38 interface 87 altsetting 8 has a duplicate endpoint with address 0x2, skipping [ 217.682999][ T6498] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:580 [ 217.683167][ T9] usb 6-1: config 38 interface 87 altsetting 8 has a duplicate endpoint with address 0x6, skipping [ 217.703114][ T9] usb 6-1: config 38 interface 87 altsetting 8 has a duplicate endpoint with address 0x4, skipping [ 217.719849][ T9] usb 6-1: config 38 interface 87 altsetting 8 has a duplicate endpoint with address 0x5, skipping [ 217.732358][ T9] usb 6-1: config 38 interface 87 altsetting 8 has a duplicate endpoint with address 0x2, skipping [ 217.744384][ T9] usb 6-1: config 38 interface 87 altsetting 8 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 217.756513][ T9] usb 6-1: config 38 interface 144 has no altsetting 0 [ 217.764072][ T9] usb 6-1: config 38 interface 202 has no altsetting 0 [ 217.771036][ T9] usb 6-1: config 38 interface 87 has no altsetting 0 [ 217.781865][ T9] usb 6-1: config 38 interface 38 has no altsetting 0 [ 217.796071][ T9] usb 6-1: New USB device found, idVendor=12d1, idProduct=bdd3, bcdDevice=c4.c1 [ 217.805308][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 217.813411][ T9] usb 6-1: Product: syz [ 217.819242][ T9] usb 6-1: Manufacturer: syz [ 217.823932][ T9] usb 6-1: SerialNumber: syz [ 217.837445][ T6462] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 217.908465][ T6502] binder: Bad value for 'max' [ 218.069841][ T6462] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 218.097911][ T6462] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 218.122277][ T6462] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 218.131386][ T6462] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 218.208152][ T6515] binder: Unknown parameter 'context' [ 218.481817][ T6522] overlayfs: missing 'workdir' [ 218.607898][ T31] usb 8-1: USB disconnect, device number 16 [ 218.630632][ T6528] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 218.630667][ T6528] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:338 [ 219.000912][ T6544] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 219.027902][ T9] usb 6-1: Found UVC 0.00 device syz (12d1:bdd3) [ 219.044084][ T9] usb 6-1: No valid video chain found. [ 219.062396][ T9] usb 6-1: USB disconnect, device number 10 [ 219.070833][ T6545] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:600 [ 219.140826][ T31] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 219.290516][ T31] usb 8-1: device descriptor read/64, error -71 [ 219.547096][ T31] usb 8-1: device descriptor read/64, error -71 [ 219.594855][ T36] kauditd_printk_skb: 734 callbacks suppressed [ 219.594875][ T36] audit: type=1400 audit(4000000320.852:11335): avc: denied { read write } for pid=4842 comm="syz-executor" name="loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 219.626420][ T36] audit: type=1400 audit(4000000320.852:11336): avc: denied { read write open } for pid=4842 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 219.658027][ T36] audit: type=1400 audit(4000000320.852:11337): avc: denied { ioctl } for pid=4842 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 219.685437][ T36] audit: type=1400 audit(4000000320.917:11338): avc: denied { read } for pid=6551 comm="syz.5.2075" name="binder0" dev="binder" ino=34 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 219.710091][ T36] audit: type=1400 audit(4000000320.917:11339): avc: denied { read open } for pid=6551 comm="syz.5.2075" path="/dev/binderfs/binder0" dev="binder" ino=34 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 219.742038][ T36] audit: type=1400 audit(4000000320.936:11340): avc: denied { ioctl } for pid=6551 comm="syz.5.2075" path="/dev/binderfs/binder0" dev="binder" ino=34 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 219.769814][ T36] audit: type=1400 audit(4000000320.936:11341): avc: denied { set_context_mgr } for pid=6551 comm="syz.5.2075" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 219.777351][ T6554] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 219.790522][ T36] audit: type=1400 audit(4000000320.936:11342): avc: denied { map } for pid=6551 comm="syz.5.2075" path="/dev/binderfs/binder0" dev="binder" ino=34 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 219.792668][ T6554] rust_binder: Failed to allocate buffer. len:16, is_oneway:false [ 219.798056][ T36] audit: type=1400 audit(4000000320.936:11343): avc: denied { read } for pid=6551 comm="syz.5.2075" path="/dev/binderfs/binder0" dev="binder" ino=34 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 219.852993][ T31] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 219.853035][ T36] audit: type=1400 audit(4000000320.936:11344): avc: denied { setattr } for pid=6551 comm="syz.5.2075" name="binder0" dev="binder" ino=34 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 219.996069][ T31] usb 8-1: device descriptor read/64, error -71 [ 220.252651][ T31] usb 8-1: device descriptor read/64, error -71 [ 220.375404][ T31] usb usb8-port1: attempt power cycle [ 220.417685][ T6578] rust_binder: Error while translating object. [ 220.417738][ T6578] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 220.435030][ T6578] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:451 [ 220.744453][ T31] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 220.778985][ T31] usb 8-1: device descriptor read/8, error -71 [ 220.917951][ T31] usb 8-1: device descriptor read/8, error -71 [ 221.172079][ T31] usb 8-1: new high-speed USB device number 20 using dummy_hcd [ 221.198047][ T31] usb 8-1: device descriptor read/8, error -71 [ 221.357367][ T31] usb 8-1: device descriptor read/8, error -71 [ 221.405600][ T6588] x_tables: duplicate underflow at hook 1 [ 221.482154][ T31] usb usb8-port1: unable to enumerate USB device [ 221.504115][ T319] udevd[319]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 221.729837][ T6595] rust_binder: Error while translating object. [ 221.729872][ T6595] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 221.737121][ T6595] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:462 [ 222.062703][ T6605] overlayfs: workdir and upperdir must be separate subtrees [ 223.278636][ T6654] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:354 [ 223.445459][ T6671] binder: Bad value for 'stats' [ 223.460042][ T6673] binder: Bad value for 'stats' [ 223.624844][ T6679] SELinux: security_context_str_to_sid (E) failed with errno=-22 [ 223.694322][ T6687] rust_binder: Failed to allocate buffer. len:152, is_oneway:false [ 223.739726][ T6689] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:479 [ 223.782049][ T6689] rust_binder: Error while translating object. [ 223.803253][ T6689] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 223.809463][ T6689] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:479 [ 223.890821][ T6693] tmpfs: Invalid uid '0x00000000ffffffff' [ 224.261628][ T9] usb 8-1: new full-speed USB device number 21 using dummy_hcd [ 224.277771][ T6706] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 224.302077][ T6706] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 224.456328][ T9] usb 8-1: not running at top speed; connect to a high speed hub [ 224.483439][ T9] usb 8-1: config 38 has an invalid interface number: 144 but max is 2 [ 224.484446][ T6713] fuse: Bad value for 'rootmode' [ 224.501555][ T9] usb 8-1: config 38 has an invalid interface number: 202 but max is 2 [ 224.511457][ T9] usb 8-1: config 38 has an invalid interface number: 87 but max is 2 [ 224.519709][ T9] usb 8-1: config 38 has an invalid interface number: 38 but max is 2 [ 224.528084][ T9] usb 8-1: config 38 has 4 interfaces, different from the descriptor's value: 3 [ 224.538138][ T9] usb 8-1: config 38 has no interface number 0 [ 224.544787][ T9] usb 8-1: config 38 has no interface number 1 [ 224.551000][ T9] usb 8-1: config 38 has no interface number 2 [ 224.557247][ T9] usb 8-1: config 38 has no interface number 3 [ 224.563457][ T9] usb 8-1: config 38 interface 144 altsetting 16 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 224.575598][ T9] usb 8-1: config 38 interface 144 altsetting 16 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 224.587144][ T9] usb 8-1: config 38 interface 144 altsetting 16 has a duplicate endpoint with address 0x8, skipping [ 224.598245][ T9] usb 8-1: config 38 interface 144 altsetting 16 has an invalid descriptor for endpoint zero, skipping [ 224.609386][ T9] usb 8-1: config 38 interface 144 altsetting 16 has a duplicate endpoint with address 0x5, skipping [ 224.629875][ T9] usb 8-1: config 38 interface 144 altsetting 16 has a duplicate endpoint with address 0xA, skipping [ 224.649101][ T9] usb 8-1: config 38 interface 144 altsetting 16 has 11 endpoint descriptors, different from the interface descriptor's value: 15 [ 224.666455][ T6715] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 224.667291][ T6715] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 224.673875][ T6715] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:623 [ 224.683375][ T9] usb 8-1: config 38 interface 202 altsetting 145 has an invalid descriptor for endpoint zero, skipping [ 224.715800][ T9] usb 8-1: config 38 interface 202 altsetting 145 has a duplicate endpoint with address 0xA, skipping [ 224.729757][ T9] usb 8-1: config 38 interface 202 altsetting 145 endpoint 0xF has invalid maxpacket 1023, setting to 64 [ 224.743806][ T9] usb 8-1: config 38 interface 202 altsetting 145 endpoint 0x9 has invalid maxpacket 1023, setting to 64 [ 224.760867][ T9] usb 8-1: config 38 interface 202 altsetting 145 has 4 endpoint descriptors, different from the interface descriptor's value: 27 [ 224.774835][ T9] usb 8-1: config 38 interface 87 altsetting 8 has a duplicate endpoint with address 0x6, skipping [ 224.811053][ T9] usb 8-1: config 38 interface 87 altsetting 8 endpoint 0xE has invalid maxpacket 112, setting to 64 [ 224.829795][ T9] usb 8-1: config 38 interface 87 altsetting 8 has a duplicate endpoint with address 0xA, skipping [ 224.853030][ T9] usb 8-1: config 38 interface 87 altsetting 8 has a duplicate endpoint with address 0x2, skipping [ 224.863841][ T9] usb 8-1: config 38 interface 87 altsetting 8 has a duplicate endpoint with address 0x2, skipping [ 224.874618][ T9] usb 8-1: config 38 interface 87 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 224.885557][ T9] usb 8-1: config 38 interface 87 altsetting 8 has a duplicate endpoint with address 0x2, skipping [ 224.896340][ T9] usb 8-1: config 38 interface 87 altsetting 8 has a duplicate endpoint with address 0x6, skipping [ 224.912852][ T9] usb 8-1: config 38 interface 87 altsetting 8 has a duplicate endpoint with address 0x4, skipping [ 224.924456][ T45] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 224.929408][ T9] usb 8-1: config 38 interface 87 altsetting 8 has a duplicate endpoint with address 0x5, skipping [ 224.953543][ T9] usb 8-1: config 38 interface 87 altsetting 8 has a duplicate endpoint with address 0x2, skipping [ 224.961927][ T36] kauditd_printk_skb: 722 callbacks suppressed [ 224.961948][ T36] audit: type=1400 audit(4000000325.866:12067): avc: denied { read write } for pid=3504 comm="syz-executor" name="loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 224.964342][ T9] usb 8-1: config 38 interface 87 altsetting 8 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 224.972724][ T36] audit: type=1400 audit(4000000325.884:12068): avc: denied { read write open } for pid=3504 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 224.994713][ T9] usb 8-1: config 38 interface 144 has no altsetting 0 [ 225.044151][ T9] usb 8-1: config 38 interface 202 has no altsetting 0 [ 225.047225][ T36] audit: type=1400 audit(4000000325.922:12069): avc: denied { ioctl } for pid=3504 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 225.051103][ T9] usb 8-1: config 38 interface 87 has no altsetting 0 [ 225.078278][ T36] audit: type=1400 audit(4000000325.922:12070): avc: denied { ioctl } for pid=6716 comm="syz.6.2134" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 225.108485][ T45] usb 7-1: device descriptor read/64, error -71 [ 225.114686][ T9] usb 8-1: config 38 interface 38 has no altsetting 0 [ 225.116290][ T36] audit: type=1326 audit(4000000325.959:12071): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6722 comm="syz.4.2137" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7f4bd8e929 code=0x0 [ 225.125992][ T9] usb 8-1: New USB device found, idVendor=12d1, idProduct=bdd3, bcdDevice=c4.c1 [ 225.145942][ T36] audit: type=1400 audit(4000000326.025:12072): avc: denied { ioctl } for pid=6696 comm="syz.7.2126" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 225.155005][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 225.180006][ T36] audit: type=1400 audit(4000000326.025:12073): avc: denied { ioctl } for pid=6696 comm="syz.7.2126" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 225.187347][ T9] usb 8-1: Product: syz [ 225.212811][ T36] audit: type=1400 audit(4000000326.025:12074): avc: denied { ioctl } for pid=6696 comm="syz.7.2126" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 225.241770][ T9] usb 8-1: Manufacturer: syz [ 225.255830][ T9] usb 8-1: SerialNumber: syz [ 225.267430][ T6697] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 225.312840][ T36] audit: type=1400 audit(4000000326.025:12075): avc: denied { ioctl } for pid=6696 comm="syz.7.2126" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 225.349923][ T6727] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 225.363180][ T6724] rust_binder: Write failure EINVAL in pid:629 [ 225.374263][ T36] audit: type=1400 audit(4000000326.025:12076): avc: denied { ioctl } for pid=6696 comm="syz.7.2126" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 225.405511][ T45] usb 7-1: device descriptor read/64, error -71 [ 225.513264][ T6697] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 225.521940][ T6697] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 225.537293][ T6697] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 225.548277][ T6697] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 225.598843][ T6733] fuse: Unknown parameter '' [ 225.662077][ T45] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 225.811763][ T45] usb 7-1: device descriptor read/64, error -71 [ 226.082414][ T45] usb 7-1: device descriptor read/64, error -71 [ 226.163389][ T6757] input: syz1 as /devices/virtual/input/input42 [ 226.207809][ T45] usb usb7-port1: attempt power cycle [ 226.235574][ T6759] rust_binder: Write failure EINVAL in pid:514 [ 226.242106][ T6759] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 226.480986][ T9] usb 8-1: Found UVC 0.00 device syz (12d1:bdd3) [ 226.524397][ T9] usb 8-1: No valid video chain found. [ 226.555889][ T6776] SELinux: security_context_str_to_sid (sytem_uGй) failed with errno=-22 [ 226.560238][ T9] usb 8-1: USB disconnect, device number 21 [ 226.581476][ T45] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 226.589559][ T6780] rust_binder: Write failure EINVAL in pid:526 [ 226.603981][ T6783] SELinux: security_context_str_to_sid (sytem_uGй) failed with errno=-22 [ 226.653916][ T45] usb 7-1: device descriptor read/8, error -71 [ 226.787670][ T6787] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:531 [ 226.799082][ T45] usb 7-1: device descriptor read/8, error -71 [ 226.901326][ T6790] rust_binder: Write failure EINVAL in pid:533 [ 226.968743][ T6792] fuse: Bad value for 'group_id' [ 226.980047][ T6792] fuse: Bad value for 'group_id' [ 227.074100][ T6798] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 227.105318][ T45] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 227.157431][ T45] usb 7-1: device descriptor read/8, error -71 [ 227.170422][ T6802] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2166'. [ 227.260616][ T6807] binder: Bad value for 'max' [ 227.265730][ T6808] binder: Bad value for 'max' [ 227.301295][ T45] usb 7-1: device descriptor read/8, error -71 [ 227.340330][ T6810] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2169'. [ 227.436822][ T45] usb usb7-port1: unable to enumerate USB device [ 227.652016][ T6823] syzkaller0: entered promiscuous mode [ 227.657668][ T6823] syzkaller0: entered allmulticast mode [ 227.681872][ T6823] overlayfs: failed to resolve './file0': -2 [ 227.719054][ T6827] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2176'. [ 227.798322][ T6829] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:380 [ 227.920196][ T6833] rust_binder: Error while translating object. [ 227.958864][ T6833] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 227.981986][ T6833] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:382 [ 228.094889][ T6836] rust_binder: Error in use_page_slow: ESRCH [ 228.120910][ T6836] rust_binder: use_range failure ESRCH [ 228.139460][ T6836] rust_binder: Failed to allocate buffer. len:4096, is_oneway:false [ 228.154179][ T6836] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 228.162230][ T6836] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:558 [ 228.234438][ T6847] random: crng reseeded on system resumption [ 228.315973][ T6852] rust_binder: Write failure EINVAL in pid:389 [ 228.365564][ T6855] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 228.406019][ T6855] rust_binder: Write failure EINVAL in pid:561 [ 228.561271][ T6867] binder: Unknown parameter 'permit_directio' [ 228.606336][ T6863] binder: Unknown parameter 'permit_directio' [ 229.222051][ T9] usb 8-1: new full-speed USB device number 22 using dummy_hcd [ 229.385266][ T9] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 229.401591][ T9] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 229.426760][ T9] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 229.437341][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.448274][ T9] usb 8-1: Product: syz [ 229.452507][ T9] usb 8-1: Manufacturer: syz [ 229.457124][ T9] usb 8-1: SerialNumber: syz [ 229.536543][ T6924] fuse: Bad value for 'rootmode' [ 229.701607][ T6885] binder: Bad value for 'stats' [ 229.707257][ T6924] syz.6.2209 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 229.719351][ T9] usb 8-1: 0:2 : does not exist [ 229.729359][ T9] usb 8-1: 5:0: failed to get current value for ch 0 (-22) [ 229.747272][ T9] usb 8-1: USB disconnect, device number 22 [ 229.939781][ T319] udevd[319]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 230.137157][ T6935] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 230.183060][ T6938] fuse: Unknown parameter 'f~:P@V' [ 230.301787][ T36] kauditd_printk_skb: 939 callbacks suppressed [ 230.301808][ T36] audit: type=1400 audit(4000000330.861:13016): avc: denied { read } for pid=6940 comm="syz.7.2216" dev="nsfs" ino=4026532293 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 230.389684][ T36] audit: type=1400 audit(4000000330.861:13017): avc: denied { read open } for pid=6940 comm="syz.7.2216" path="net:[4026532293]" dev="nsfs" ino=4026532293 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 230.451474][ T36] audit: type=1400 audit(4000000330.861:13018): avc: denied { create } for pid=6940 comm="syz.7.2216" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 230.494229][ T36] audit: type=1400 audit(4000000330.870:13019): avc: denied { write } for pid=6940 comm="syz.7.2216" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 230.543166][ T36] audit: type=1400 audit(4000000330.870:13020): avc: denied { read } for pid=6940 comm="syz.7.2216" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 230.574846][ T36] audit: type=1400 audit(4000000330.870:13021): avc: denied { read } for pid=6940 comm="syz.7.2216" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 230.643895][ T36] audit: type=1400 audit(4000000330.870:13022): avc: denied { write } for pid=6940 comm="syz.7.2216" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 230.718766][ T36] audit: type=1400 audit(4000000330.870:13023): avc: denied { create } for pid=6940 comm="syz.7.2216" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 230.722868][ T6956] audit: audit_backlog=65 > audit_backlog_limit=64 [ 230.761729][ T6955] audit: audit_backlog=65 > audit_backlog_limit=64 [ 230.770848][ T6958] FAULT_INJECTION: forcing a failure. [ 230.770848][ T6958] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 230.789535][ T6958] CPU: 1 UID: 0 PID: 6958 Comm: syz.5.2223 Not tainted 6.12.23-syzkaller-g6c1c18fcb8b7 #0 ba78288b1e32eb9f88d3f8d8da6b79a037cd8362 [ 230.789569][ T6958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 230.789583][ T6958] Call Trace: [ 230.789590][ T6958] [ 230.789598][ T6958] __dump_stack+0x21/0x30 [ 230.789629][ T6958] dump_stack_lvl+0x10c/0x190 [ 230.789654][ T6958] ? __cfi_dump_stack_lvl+0x10/0x10 [ 230.789680][ T6958] ? kstrtoull+0x13b/0x1e0 [ 230.789701][ T6958] dump_stack+0x19/0x20 [ 230.789724][ T6958] should_fail_ex+0x3d9/0x530 [ 230.789746][ T6958] should_fail+0xf/0x20 [ 230.789767][ T6958] should_fail_usercopy+0x1e/0x30 [ 230.789790][ T6958] _copy_from_user+0x22/0xb0 [ 230.789817][ T6958] ___sys_sendmsg+0x159/0x2a0 [ 230.789848][ T6958] ? __sys_sendmsg+0x280/0x280 [ 230.789879][ T6958] ? proc_fail_nth_write+0x17e/0x210 [ 230.789899][ T6958] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 230.789926][ T6958] __x64_sys_sendmsg+0x1eb/0x2c0 [ 230.789945][ T6958] ? fput+0x1a5/0x240 [ 230.789975][ T6958] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 230.789994][ T6958] ? ksys_write+0x1ef/0x250 [ 230.790020][ T6958] ? __kasan_check_read+0x15/0x20 [ 230.790044][ T6958] x64_sys_call+0x2a4c/0x2ee0 [ 230.790072][ T6958] do_syscall_64+0x58/0xf0 [ 230.790099][ T6958] ? clear_bhb_loop+0x35/0x90 [ 230.790138][ T6958] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 230.790166][ T6958] RIP: 0033:0x7f26e198e929 [ 230.790184][ T6958] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 230.790202][ T6958] RSP: 002b:00007f26e278b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 230.790224][ T6958] RAX: ffffffffffffffda RBX: 00007f26e1bb5fa0 RCX: 00007f26e198e929 [ 230.790241][ T6958] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 230.790254][ T6958] RBP: 00007f26e278b090 R08: 0000000000000000 R09: 0000000000000000 [ 230.790267][ T6958] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 230.790279][ T6958] R13: 0000000000000000 R14: 00007f26e1bb5fa0 R15: 00007ffe540d8f18 [ 230.790296][ T6958] [ 231.135672][ T45] usb 8-1: new high-speed USB device number 23 using dummy_hcd [ 231.169914][ T292] tipc: Subscription rejected, illegal request [ 231.177847][ T6966] rust_binder: 6962 RLIMIT_NICE not set [ 231.181723][ T6966] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 231.328125][ T45] usb 8-1: config 1 has an invalid interface association descriptor of length 3, skipping [ 231.344713][ T6973] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 231.349628][ T45] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 231.366992][ T45] usb 8-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 231.382948][ T45] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice=26.40 [ 231.413557][ T45] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 231.421673][ T45] usb 8-1: SerialNumber: syz [ 231.487440][ T6973] rust_binder: Got transaction with invalid offset. [ 231.487500][ T6973] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 231.494916][ T6973] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:601 [ 231.681120][ T6981] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 231.711117][ T306] usb 8-1: USB disconnect, device number 23 [ 231.756567][ T6983] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 231.802160][ T6981] syzkaller0: entered promiscuous mode [ 231.814125][ T6981] syzkaller0: entered allmulticast mode [ 231.829407][ T6981] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:664 [ 232.304339][ T6994] rust_binder: Write failure EFAULT in pid:413 [ 232.434353][ T6998] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:417 [ 232.630723][ T7005] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 232.697621][ T7009] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 232.704909][ T7009] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:619 [ 233.102837][ T7026] 9pnet_fd: Insufficient options for proto=fd [ 233.136785][ T292] tipc: Subscription rejected, illegal request [ 233.509008][ T9] usb 8-1: new full-speed USB device number 24 using dummy_hcd [ 233.672192][ T9] usb 8-1: config 0 has an invalid interface number: 41 but max is 0 [ 233.683457][ T9] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 233.693884][ T9] usb 8-1: config 0 has no interface number 0 [ 233.699991][ T9] usb 8-1: config 0 interface 41 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 233.713004][ T9] usb 8-1: config 0 interface 41 has no altsetting 0 [ 233.722785][ T9] usb 8-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 233.731876][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 233.739902][ T9] usb 8-1: Product: syz [ 233.744218][ T9] usb 8-1: Manufacturer: syz [ 233.748823][ T9] usb 8-1: SerialNumber: syz [ 233.756421][ T9] usb 8-1: config 0 descriptor?? [ 233.763102][ T9] CoreChips 8-1:0.41: probe with driver CoreChips failed with error -22 [ 234.380385][ T7057] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 234.400975][ T7057] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 234.549201][ T7059] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 234.567353][ T7059] rust_binder: Error while translating object. [ 234.574152][ T7059] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 234.581392][ T7059] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:629 [ 235.005704][ T9] usb 7-1: new full-speed USB device number 13 using dummy_hcd [ 235.179341][ T9] usb 7-1: config 0 has an invalid interface number: 230 but max is 0 [ 235.187764][ T9] usb 7-1: config 0 has no interface number 0 [ 235.193891][ T9] usb 7-1: config 0 interface 230 altsetting 2 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 235.204827][ T9] usb 7-1: config 0 interface 230 altsetting 2 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 235.215870][ T9] usb 7-1: config 0 interface 230 has no altsetting 0 [ 235.226010][ T9] usb 7-1: New USB device found, idVendor=0781, idProduct=0005, bcdDevice= 0.05 [ 235.235219][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 235.243246][ T9] usb 7-1: Product: syz [ 235.247420][ T9] usb 7-1: Manufacturer: syz [ 235.252047][ T9] usb 7-1: SerialNumber: syz [ 235.258263][ T9] usb 7-1: config 0 descriptor?? [ 235.264681][ T7069] raw-gadget.3 gadget.6: fail, usb_ep_enable returned -22 [ 235.272144][ T7069] raw-gadget.3 gadget.6: fail, usb_ep_enable returned -22 [ 235.280758][ T9] ums-usbat 7-1:0.230: USB Mass Storage device detected [ 235.289092][ T9] ums-usbat 7-1:0.230: Quirks match for vid 0781 pid 0005: 1 [ 235.667114][ T36] kauditd_printk_skb: 734 callbacks suppressed [ 235.667135][ T36] audit: type=1400 audit(4000000335.884:13742): avc: denied { create } for pid=7078 comm="syz.5.2266" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 235.693716][ T36] audit: type=1400 audit(4000000335.884:13743): avc: denied { write } for pid=7078 comm="syz.5.2266" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 235.716577][ T36] audit: type=1400 audit(4000000335.940:13744): avc: denied { ioctl } for pid=7068 comm="syz.6.2263" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 235.742150][ T36] audit: type=1400 audit(4000000335.940:13745): avc: denied { read write } for pid=4842 comm="syz-executor" name="loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 235.775939][ T36] audit: type=1400 audit(4000000335.940:13746): avc: denied { read write open } for pid=4842 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 235.806694][ T36] audit: type=1400 audit(4000000335.940:13747): avc: denied { ioctl } for pid=4842 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 235.837491][ T36] audit: type=1400 audit(4000000335.996:13748): avc: denied { read } for pid=7080 comm="syz.5.2267" name="ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 235.860365][ T36] audit: type=1400 audit(4000000335.996:13749): avc: denied { read open } for pid=7080 comm="syz.5.2267" path="/dev/ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 235.884019][ T36] audit: type=1400 audit(4000000335.996:13750): avc: denied { ioctl } for pid=7080 comm="syz.5.2267" path="/dev/ashmem" dev="devtmpfs" ino=201 ioctlcmd=0x7703 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 235.908804][ T36] audit: type=1400 audit(4000000336.015:13751): avc: denied { create } for pid=7080 comm="syz.5.2267" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 236.064048][ T306] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 236.203031][ T306] usb 6-1: device descriptor read/64, error -71 [ 236.459643][ T306] usb 6-1: device descriptor read/64, error -71 [ 236.557717][ T310] usb 8-1: USB disconnect, device number 24 [ 236.622407][ T7085] rust_binder: Write failure EINVAL in pid:430 [ 236.622772][ T7086] rust_binder: Write failure EINVAL in pid:430 [ 236.726878][ T306] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 236.876546][ T306] usb 6-1: device descriptor read/64, error -71 [ 237.143830][ T306] usb 6-1: device descriptor read/64, error -71 [ 237.154143][ T7107] overlayfs: missing 'workdir' [ 237.261872][ T306] usb usb6-port1: attempt power cycle [ 237.624905][ T306] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 237.648647][ T306] usb 6-1: device descriptor read/8, error -71 [ 237.768090][ T7110] SELinux: security_context_str_to_sid (syte) failed with errno=-22 [ 237.792327][ T306] usb 6-1: device descriptor read/8, error -71 [ 237.936014][ T9] ums-usbat 7-1:0.230: probe with driver ums-usbat failed with error -5 [ 237.947305][ T9] usb 7-1: USB disconnect, device number 13 [ 238.052524][ T306] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 238.097491][ T306] usb 6-1: device descriptor read/8, error -71 [ 238.237373][ T306] usb 6-1: device descriptor read/8, error -71 [ 238.309105][ T715] usb 8-1: new high-speed USB device number 25 using dummy_hcd [ 238.352387][ T306] usb usb6-port1: unable to enumerate USB device [ 238.469449][ T715] usb 8-1: Using ep0 maxpacket: 8 [ 238.486827][ T715] usb 8-1: config 179 has an invalid interface number: 65 but max is 0 [ 238.508017][ T715] usb 8-1: config 179 has no interface number 0 [ 238.515414][ T715] usb 8-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 238.526570][ T715] usb 8-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 238.537863][ T715] usb 8-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 238.549290][ T715] usb 8-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 238.560723][ T715] usb 8-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 238.574705][ T715] usb 8-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 238.583790][ T715] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.594916][ T7117] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 238.783296][ T7127] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 238.786801][ T7129] rust_binder: Write failure EINVAL in pid:646 [ 239.315888][ C0] xpad 8-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 239.315888][ T306] usb 8-1: USB disconnect, device number 25 [ 239.316034][ C0] xpad 8-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 239.831952][ T7146] rust_binder: Failed to allocate buffer. len:4294966472, is_oneway:false [ 239.831980][ T7146] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 239.841261][ T7146] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:655 [ 239.963844][ T7148] rust_binder: Write failure EINVAL in pid:451 [ 240.063769][ T7150] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:453 [ 240.963803][ T7178] kvm: kvm [7177]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010015) = 0x882 [ 240.997629][ T7180] incfs: Error accessing: ./file0. [ 241.009408][ T7180] incfs: mount failed -20 [ 241.017120][ T36] kauditd_printk_skb: 540 callbacks suppressed [ 241.017138][ T36] audit: type=1400 audit(4000000340.897:14292): avc: denied { read } for pid=7177 comm="syz.5.2300" name="binder0" dev="binder" ino=46 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 241.093396][ T36] audit: type=1400 audit(4000000340.897:14293): avc: denied { read write } for pid=4918 comm="syz-executor" name="loop6" dev="devtmpfs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 241.126982][ T36] audit: type=1400 audit(4000000340.897:14294): avc: denied { read write open } for pid=4918 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 241.140956][ T7183] block device autoloading is deprecated and will be removed. [ 241.152147][ T36] audit: type=1400 audit(4000000340.897:14295): avc: denied { ioctl } for pid=4918 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=55 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 241.186144][ T7183] syz.6.2302: attempt to access beyond end of device [ 241.186144][ T7183] loop0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 241.213978][ T36] audit: type=1400 audit(4000000340.907:14296): avc: denied { read write } for pid=7179 comm="syz.7.2301" name="fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 241.233173][ T7188] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 241.237617][ T36] audit: type=1400 audit(4000000340.907:14297): avc: denied { read write open } for pid=7179 comm="syz.7.2301" path="/dev/fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 241.298619][ T7183] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 241.367789][ T36] audit: type=1400 audit(4000000340.907:14298): avc: denied { mounton } for pid=7179 comm="syz.7.2301" path="/164/file0" dev="tmpfs" ino=912 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 241.426932][ T36] audit: type=1400 audit(4000000340.907:14299): avc: denied { mount } for pid=7179 comm="syz.7.2301" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 241.453734][ T36] audit: type=1400 audit(4000000340.925:14300): avc: denied { read open } for pid=7177 comm="syz.5.2300" path="/dev/binderfs/binder0" dev="binder" ino=46 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 241.489776][ T7194] FAULT_INJECTION: forcing a failure. [ 241.489776][ T7194] name failslab, interval 1, probability 0, space 0, times 0 [ 241.515577][ T36] audit: type=1400 audit(4000000340.925:14301): avc: denied { ioctl } for pid=7177 comm="syz.5.2300" path="/dev/binderfs/binder0" dev="binder" ino=46 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 241.548360][ T7194] CPU: 1 UID: 0 PID: 7194 Comm: syz.6.2306 Not tainted 6.12.23-syzkaller-g6c1c18fcb8b7 #0 ba78288b1e32eb9f88d3f8d8da6b79a037cd8362 [ 241.548395][ T7194] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 241.548410][ T7194] Call Trace: [ 241.548418][ T7194] [ 241.548427][ T7194] __dump_stack+0x21/0x30 [ 241.548459][ T7194] dump_stack_lvl+0x10c/0x190 [ 241.548484][ T7194] ? __cfi_dump_stack_lvl+0x10/0x10 [ 241.548510][ T7194] ? __kasan_check_write+0x18/0x20 [ 241.548536][ T7194] dump_stack+0x19/0x20 [ 241.548559][ T7194] should_fail_ex+0x3d9/0x530 [ 241.548583][ T7194] should_failslab+0xac/0x100 [ 241.548611][ T7194] kmem_cache_alloc_node_noprof+0x45/0x3b0 [ 241.548637][ T7194] ? __alloc_skb+0x10c/0x370 [ 241.548664][ T7194] __alloc_skb+0x10c/0x370 [ 241.548691][ T7194] netlink_dump+0x237/0xeb0 [ 241.548719][ T7194] ? kernel_text_address+0xa9/0xe0 [ 241.548754][ T7194] ? refcount_inc+0x90/0x90 [ 241.548792][ T7194] ? unwind_get_return_address+0x51/0x90 [ 241.548813][ T7194] ? __kasan_check_write+0x18/0x20 [ 241.548852][ T7194] ? mutex_lock+0x92/0x1c0 [ 241.548870][ T7194] ? __cfi_mutex_lock+0x10/0x10 [ 241.548889][ T7194] ? stack_trace_save+0x9d/0xe0 [ 241.548915][ T7194] __netlink_dump_start+0x6f8/0x980 [ 241.548945][ T7194] rtnetlink_rcv_msg+0x717/0xa00 [ 241.548970][ T7194] ? avc_has_perm_noaudit+0x268/0x360 [ 241.548991][ T7194] ? __cfi_rtnl_dump_all+0x10/0x10 [ 241.549013][ T7194] ? __cfi_rtnetlink_rcv_msg+0x10/0x10 [ 241.549037][ T7194] ? avc_has_perm_noaudit+0x286/0x360 [ 241.549058][ T7194] ? __cfi_rtnl_dumpit+0x10/0x10 [ 241.549081][ T7194] ? __cfi_rtnl_dump_all+0x10/0x10 [ 241.549103][ T7194] ? avc_has_perm+0x144/0x220 [ 241.549124][ T7194] netlink_rcv_skb+0x22b/0x4a0 [ 241.549152][ T7194] ? __cfi_rtnetlink_rcv_msg+0x10/0x10 [ 241.549177][ T7194] ? __cfi_netlink_rcv_skb+0x10/0x10 [ 241.549207][ T7194] ? netlink_autobind+0x1c0/0x1c0 [ 241.549238][ T7194] ? is_vmalloc_addr+0x11/0x40 [ 241.549266][ T7194] rtnetlink_rcv+0x20/0x30 [ 241.549289][ T7194] netlink_unicast+0x8c6/0xa60 [ 241.549344][ T7194] netlink_sendmsg+0x7f0/0xaf0 [ 241.549394][ T7194] ? __cfi_netlink_sendmsg+0x10/0x10 [ 241.549425][ T7194] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 241.549457][ T7194] ? security_socket_sendmsg+0x33/0xd0 [ 241.549481][ T7194] ? __cfi_netlink_sendmsg+0x10/0x10 [ 241.549510][ T7194] ____sys_sendmsg+0xa15/0xa70 [ 241.549543][ T7194] ? __sys_sendmsg_sock+0x50/0x50 [ 241.549593][ T7194] ? import_iovec+0x81/0xb0 [ 241.549624][ T7194] ___sys_sendmsg+0x220/0x2a0 [ 241.549656][ T7194] ? __sys_sendmsg+0x280/0x280 [ 241.549690][ T7194] ? proc_fail_nth_write+0x17e/0x210 [ 241.549718][ T7194] __x64_sys_sendmsg+0x1eb/0x2c0 [ 241.549738][ T7194] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 241.549758][ T7194] ? ksys_write+0x1ef/0x250 [ 241.549785][ T7194] ? __secure_computing+0xef/0x2b0 [ 241.549812][ T7194] x64_sys_call+0x2a4c/0x2ee0 [ 241.549840][ T7194] do_syscall_64+0x58/0xf0 [ 241.549866][ T7194] ? clear_bhb_loop+0x35/0x90 [ 241.549899][ T7194] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 241.549929][ T7194] RIP: 0033:0x7f637618e929 [ 241.549947][ T7194] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 241.549967][ T7194] RSP: 002b:00007f6376f51038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 241.549991][ T7194] RAX: ffffffffffffffda RBX: 00007f63763b5fa0 RCX: 00007f637618e929 [ 241.550008][ T7194] RDX: 0000000000040816 RSI: 0000200000000040 RDI: 0000000000000000 [ 241.550022][ T7194] RBP: 00007f6376f51090 R08: 0000000000000000 R09: 0000000000000000 [ 241.550036][ T7194] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 241.550049][ T7194] R13: 0000000000000000 R14: 00007f63763b5fa0 R15: 00007ffec88fb8d8 [ 241.550067][ T7194] [ 241.986260][ T7201] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 242.187414][ T7209] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 242.190306][ T7209] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 242.193954][ T7203] rust_binder: Failed to allocate buffer. len:64, is_oneway:false [ 242.435645][ T715] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 242.675232][ T715] usb 7-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=e2.3d [ 242.699069][ T715] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 242.719463][ T715] usb 7-1: Product: syz [ 242.729581][ T715] usb 7-1: Manufacturer: syz [ 242.734281][ T715] usb 7-1: SerialNumber: syz [ 242.749334][ T715] r8152-cfgselector 7-1: Unknown version 0x0000 [ 242.777425][ T715] r8152-cfgselector 7-1: config 0 descriptor?? [ 242.854663][ T7220] rust_binder: Write failure EINVAL in pid:680 [ 243.025778][ T715] r8152-cfgselector 7-1: Unknown version 0x0000 [ 243.057967][ T715] r8152-cfgselector 7-1: bad CDC descriptors [ 243.069628][ T7224] GUP no longer grows the stack in syz.5.2317 (7224): 200000003000-200000005000 (200000001000) [ 243.098544][ T7224] CPU: 1 UID: 0 PID: 7224 Comm: syz.5.2317 Not tainted 6.12.23-syzkaller-g6c1c18fcb8b7 #0 ba78288b1e32eb9f88d3f8d8da6b79a037cd8362 [ 243.098583][ T7224] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 243.098603][ T7224] Call Trace: [ 243.098612][ T7224] [ 243.098621][ T7224] __dump_stack+0x21/0x30 [ 243.098655][ T7224] dump_stack_lvl+0x10c/0x190 [ 243.098698][ T7224] ? __cfi_dump_stack_lvl+0x10/0x10 [ 243.098728][ T7224] ? find_vma+0xcd/0x110 [ 243.098757][ T7224] ? vma_is_secretmem+0x11/0x50 [ 243.098795][ T7224] dump_stack+0x19/0x20 [ 243.098819][ T7224] __get_user_pages+0x1e34/0x22d0 [ 243.098854][ T7224] ? x64_sys_call+0x2adc/0x2ee0 [ 243.098908][ T7224] ? populate_vma_page_range+0x230/0x230 [ 243.098948][ T7224] __gup_longterm_locked+0x3fb/0x1580 [ 243.098974][ T7224] ? down_read+0x79/0xe0 [ 243.099000][ T7224] pin_user_pages+0x102/0x160 [ 243.099023][ T7224] xdp_umem_pin_pages+0x134/0x430 [ 243.099062][ T7224] xdp_umem_create+0x66c/0x9d0 [ 243.099098][ T7224] xsk_setsockopt+0x626/0x6f0 [ 243.099137][ T7224] ? __cfi_xsk_setsockopt+0x10/0x10 [ 243.099173][ T7224] ? bpf_lsm_socket_setsockopt+0xd/0x20 [ 243.099195][ T7224] ? security_socket_setsockopt+0x33/0xd0 [ 243.099224][ T7224] ? __cfi_xsk_setsockopt+0x10/0x10 [ 243.099258][ T7224] do_sock_setsockopt+0x26a/0x400 [ 243.099298][ T7224] ? __cfi_do_sock_setsockopt+0x10/0x10 [ 243.099354][ T7224] __x64_sys_setsockopt+0x1b8/0x250 [ 243.099392][ T7224] x64_sys_call+0x2adc/0x2ee0 [ 243.099425][ T7224] do_syscall_64+0x58/0xf0 [ 243.099466][ T7224] ? clear_bhb_loop+0x35/0x90 [ 243.099507][ T7224] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 243.099545][ T7224] RIP: 0033:0x7f26e198e929 [ 243.099566][ T7224] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 243.099589][ T7224] RSP: 002b:00007f26e278b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 243.099617][ T7224] RAX: ffffffffffffffda RBX: 00007f26e1bb5fa0 RCX: 00007f26e198e929 [ 243.099637][ T7224] RDX: 0000000000000004 RSI: 000000000000011b RDI: 0000000000000006 [ 243.099653][ T7224] RBP: 00007f26e1a10b39 R08: 0000000000000020 R09: 0000000000000000 [ 243.099677][ T7224] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000000 [ 243.099692][ T7224] R13: 0000000000000000 R14: 00007f26e1bb5fa0 R15: 00007ffe540d8f18 [ 243.099712][ T7224] [ 243.107999][ T7224] SELinux: security_context_str_to_sid (syte) failed with errno=-22 [ 243.421181][ T7229] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 243.427481][ T7229] rust_binder: Error while translating object. [ 243.440577][ T7229] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 243.450235][ T7229] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:706 [ 243.641891][ T7236] netlink: 22 bytes leftover after parsing attributes in process `syz.5.2322'. [ 243.780394][ T7241] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 243.785280][ T7241] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:710 [ 244.379124][ T7270] rust_binder: validate_parent_fixup: new_min_offset=84, sg_entry.length=75 [ 244.388437][ T7270] rust_binder: Error while translating object. [ 244.398127][ T7270] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 244.405128][ T7270] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:709 [ 244.536443][ T7268] team_slave_0: mtu less than device minimum [ 245.146821][ T7297] : tun_chr_ioctl cmd 1074025675 [ 245.172445][ T7297] : persist disabled [ 245.307745][ T31] r8152-cfgselector 7-1: USB disconnect, device number 14 [ 245.421588][ T7301] binder: Bad value for 'stats' [ 245.443191][ T7303] binder: Bad value for 'stats' [ 246.109094][ T7319] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 246.109608][ T7319] rust_binder: inc_ref_done called when no active inc_refs [ 246.391770][ T36] kauditd_printk_skb: 563 callbacks suppressed [ 246.391792][ T36] audit: type=1400 audit(4000000345.921:14856): avc: denied { ioctl } for pid=7322 comm="syz.6.2351" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 246.487407][ T305] usb 7-1: new full-speed USB device number 15 using dummy_hcd [ 246.495882][ T36] audit: type=1400 audit(4000000346.014:14857): avc: denied { ioctl } for pid=7322 comm="syz.6.2351" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 246.524213][ T36] audit: type=1400 audit(4000000346.042:14858): avc: denied { ioctl } for pid=7322 comm="syz.6.2351" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 246.551143][ T36] audit: type=1400 audit(4000000346.042:14859): avc: denied { ioctl } for pid=7322 comm="syz.6.2351" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 246.576994][ T36] audit: type=1400 audit(4000000346.042:14860): avc: denied { ioctl } for pid=7322 comm="syz.6.2351" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 246.602788][ T36] audit: type=1400 audit(4000000346.042:14861): avc: denied { ioctl } for pid=7322 comm="syz.6.2351" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 246.629243][ T36] audit: type=1400 audit(4000000346.061:14862): avc: denied { ioctl } for pid=7322 comm="syz.6.2351" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 246.655048][ T36] audit: type=1400 audit(4000000346.061:14863): avc: denied { ioctl } for pid=7322 comm="syz.6.2351" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 246.682691][ T36] audit: type=1400 audit(4000000346.145:14864): avc: denied { ioctl } for pid=7322 comm="syz.6.2351" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 246.707778][ T305] usb 7-1: device descriptor read/64, error -71 [ 246.830759][ T36] audit: type=1400 audit(4000000346.332:14865): avc: denied { ioctl } for pid=7322 comm="syz.6.2351" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 246.989861][ T305] usb 7-1: device descriptor read/64, error -71 [ 247.172349][ T7328] binder: Unknown parameter 'appraise' [ 247.246424][ T305] usb 7-1: new full-speed USB device number 16 using dummy_hcd [ 247.396105][ T305] usb 7-1: device descriptor read/64, error -71 [ 247.599224][ T306] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 247.652678][ T305] usb 7-1: device descriptor read/64, error -71 [ 247.759561][ T306] usb 6-1: Using ep0 maxpacket: 16 [ 247.771079][ T305] usb usb7-port1: attempt power cycle [ 247.777944][ T306] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1023 [ 247.789786][ T306] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 64 [ 247.804361][ T306] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 247.813966][ T306] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 247.822022][ T306] usb 6-1: Product: 燉삏䥈謐밃觊޺쎔穨䊫礮䘎㙦燏ꅴ降Ꟶ뾈ꔶ繁猈赂ꫳ寊뛪鲣 [ 247.834389][ T306] usb 6-1: Manufacturer: Л [ 248.074649][ T7332] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 248.087979][ T7332] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 248.108786][ T7332] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 248.123187][ T7332] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 248.144459][ T305] usb 7-1: new full-speed USB device number 17 using dummy_hcd [ 248.169423][ T305] usb 7-1: device descriptor read/8, error -71 [ 248.308371][ T305] usb 7-1: device descriptor read/8, error -71 [ 248.354741][ T7332] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 248.375089][ T7332] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 248.401016][ T7332] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 248.414594][ T7332] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 248.429851][ T306] cdc_ncm 6-1:1.0: bind() failure [ 248.443394][ T306] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 248.454448][ T306] cdc_ncm 6-1:1.1: bind() failure [ 248.465885][ T306] usb 6-1: USB disconnect, device number 15 [ 248.484719][ T319] udevd[319]: setting mode of /dev/bus/usb/006/015 to 020664 failed: No such file or directory [ 248.509001][ T319] udevd[319]: setting owner of /dev/bus/usb/006/015 to uid=0, gid=0 failed: No such file or directory [ 248.572148][ T305] usb 7-1: new full-speed USB device number 18 using dummy_hcd [ 248.596343][ T305] usb 7-1: device descriptor read/8, error -71 [ 248.646283][ T7334] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 248.745814][ T305] usb 7-1: device descriptor read/8, error -71 [ 248.860798][ T305] usb usb7-port1: unable to enumerate USB device [ 249.493022][ T7348] binder: Bad value for 'max' [ 249.502821][ T7349] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:746 [ 249.683019][ T7355] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 249.704177][ T7355] rust_binder: Write failure EINVAL in pid:696 [ 249.831969][ T7359] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 249.843477][ T7361] rust_binder: Write failure EFAULT in pid:752 [ 250.186623][ T7376] netlink: 5308 bytes leftover after parsing attributes in process `syz.6.2372'. [ 250.229962][ T7377] netlink: 5308 bytes leftover after parsing attributes in process `syz.6.2372'. [ 250.386578][ T7384] binder: Unknown parameter 'fscontext?}' [ 250.511302][ T7389] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 250.516820][ T7389] input: syz1 as /devices/virtual/input/input43 [ 250.562361][ T7391] Dead loop on virtual device ip6_vti0, fix it urgently! [ 250.644381][ T7389] rust_binder: Error while translating object. [ 250.644413][ T7389] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 250.667681][ T7389] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:707 [ 251.127116][ T715] usb 7-1: new full-speed USB device number 19 using dummy_hcd [ 251.287499][ T715] usb 7-1: device descriptor read/64, error -71 [ 251.463236][ T7408] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 251.549995][ T715] usb 7-1: device descriptor read/64, error -71 [ 251.758435][ T36] kauditd_printk_skb: 496 callbacks suppressed [ 251.758455][ T36] audit: type=1400 audit(4000000350.944:15362): avc: denied { ioctl } for pid=7394 comm="syz.6.2380" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 251.854137][ T715] usb 7-1: new full-speed USB device number 20 using dummy_hcd [ 251.866340][ T36] audit: type=1400 audit(4000000351.037:15363): avc: denied { ioctl } for pid=7394 comm="syz.6.2380" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 251.917614][ T36] audit: type=1400 audit(4000000351.047:15364): avc: denied { ioctl } for pid=7394 comm="syz.6.2380" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 251.945045][ T36] audit: type=1400 audit(4000000351.047:15365): avc: denied { ioctl } for pid=7394 comm="syz.6.2380" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 251.972291][ T36] audit: type=1400 audit(4000000351.065:15366): avc: denied { ioctl } for pid=7394 comm="syz.6.2380" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 252.031840][ T36] audit: type=1400 audit(4000000351.065:15367): avc: denied { ioctl } for pid=7394 comm="syz.6.2380" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 252.032279][ T715] usb 7-1: device descriptor read/64, error -71 [ 252.059406][ T36] audit: type=1400 audit(4000000351.075:15368): avc: denied { ioctl } for pid=7394 comm="syz.6.2380" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 252.107154][ T36] audit: type=1400 audit(4000000351.075:15369): avc: denied { ioctl } for pid=7394 comm="syz.6.2380" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 252.160505][ T36] audit: type=1400 audit(4000000351.075:15370): avc: denied { read write } for pid=4842 comm="syz-executor" name="loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 252.208607][ T7420] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 252.212614][ T36] audit: type=1400 audit(4000000351.075:15371): avc: denied { read write open } for pid=4842 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 252.244584][ T46] tipc: Subscription rejected, illegal request [ 252.247581][ T7420] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 252.250900][ T7420] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:747 [ 252.340676][ T7424] rust_binder: Error while translating object. [ 252.364704][ T7424] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 252.375458][ T7424] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:802 [ 252.377971][ T715] usb 7-1: device descriptor read/64, error -71 [ 252.489563][ T7430] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 252.491785][ T7430] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 252.507109][ T7430] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:804 [ 252.581597][ T715] usb usb7-port1: attempt power cycle [ 252.944550][ T310] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 252.987436][ T715] usb 7-1: new full-speed USB device number 21 using dummy_hcd [ 253.013428][ T715] usb 7-1: device descriptor read/8, error -71 [ 253.109563][ T310] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 253.119886][ T310] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 253.131493][ T310] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 253.140662][ T310] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 253.148921][ T310] usb 6-1: SerialNumber: syz [ 253.164000][ T715] usb 7-1: device descriptor read/8, error -71 [ 253.381953][ T7434] rust_binder: Failed copying remainder into alloc: EFAULT [ 253.381991][ T7434] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 253.389457][ T7434] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 253.397925][ T7434] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:808 [ 253.410303][ T310] usb 6-1: 0:2 : does not exist [ 253.432024][ T715] usb 7-1: new full-speed USB device number 22 using dummy_hcd [ 253.447081][ T310] usb 6-1: USB disconnect, device number 16 [ 253.461815][ T715] usb 7-1: device descriptor read/8, error -71 [ 253.607589][ T7436] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 253.627119][ T715] usb 7-1: device descriptor read/8, error -71 [ 253.641144][ T319] udevd[319]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 253.721703][ T7439] rust_binder: Error while translating object. [ 253.721748][ T7439] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 253.729174][ T7439] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:482 [ 253.746496][ T715] usb usb7-port1: unable to enumerate USB device [ 254.172241][ T7460] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 254.188200][ T7460] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 254.194714][ T7460] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:711 [ 254.218069][ T7463] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 254.305618][ T7467] rust_binder: Error while translating object. [ 254.312497][ T7467] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 254.329596][ T7467] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:819 [ 255.349202][ T7500] binder: Unknown parameter 'fscontext?}' [ 255.659927][ T305] usb 7-1: new low-speed USB device number 23 using dummy_hcd [ 255.678783][ T45] ================================================================== [ 255.686990][ T45] BUG: KASAN: null-ptr-deref in down_write+0x83/0x2a0 [ 255.693788][ T45] Write of size 8 at addr 0000000000000098 by task kworker/1:1/45 [ 255.701617][ T45] [ 255.703958][ T45] CPU: 1 UID: 0 PID: 45 Comm: kworker/1:1 Not tainted 6.12.23-syzkaller-g6c1c18fcb8b7 #0 ba78288b1e32eb9f88d3f8d8da6b79a037cd8362 [ 255.703990][ T45] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 255.704006][ T45] Workqueue: events _RNvXs6_NtCs43vyB533jt3_6kernel9workqueueINtNtNtB7_4sync3arc3ArcNtNtCshgDM7dBCdno_11rust_binder7process7ProcessEINtB5_15WorkItemPointerKy0_E3runB13_ [ 255.704069][ T45] Call Trace: [ 255.704078][ T45] [ 255.704088][ T45] __dump_stack+0x21/0x30 [ 255.704116][ T45] dump_stack_lvl+0x10c/0x190 [ 255.704141][ T45] ? __cfi_dump_stack_lvl+0x10/0x10 [ 255.704172][ T45] ? __switch_to+0xc7b/0x1310 [ 255.704199][ T45] print_report+0x3d/0x70 [ 255.704218][ T45] kasan_report+0x163/0x1a0 [ 255.704255][ T45] ? down_write+0x83/0x2a0 [ 255.704279][ T45] ? down_write+0x83/0x2a0 [ 255.704301][ T45] kasan_check_range+0x299/0x2a0 [ 255.704330][ T45] __kasan_check_write+0x18/0x20 [ 255.704353][ T45] down_write+0x83/0x2a0 [ 255.704374][ T45] ? __cfi_down_write+0x10/0x10 [ 255.704396][ T45] ? _raw_spin_lock+0x8c/0x120 [ 255.704423][ T45] ? __cfi__raw_spin_lock+0x10/0x10 [ 255.704448][ T45] ? mutex_unlock+0x8b/0x240 [ 255.704467][ T45] ? __cfi_mutex_unlock+0x10/0x10 [ 255.704493][ T45] rust_binderfs_remove_file+0x6c/0x110 [ 255.704515][ T45] _RNvXs2_NtCshgDM7dBCdno_11rust_binder7processNtB5_7ProcessNtNtCs43vyB533jt3_6kernel9workqueue8WorkItem3run+0x9d4/0x2860 [ 255.704552][ T45] ? update_curr_dl_se+0x10c/0xb20 [ 255.704577][ T45] ? __kasan_check_write+0x18/0x20 [ 255.704602][ T45] ? __cfi___update_load_avg_cfs_rq+0x10/0x10 [ 255.704626][ T45] ? update_curr+0x60d/0xc60 [ 255.704654][ T45] ? __cfi__RNvXs2_NtCshgDM7dBCdno_11rust_binder7processNtB5_7ProcessNtNtCs43vyB533jt3_6kernel9workqueue8WorkItem3run+0x10/0x10 [ 255.704689][ T45] ? update_load_avg+0x506/0x19a0 [ 255.704709][ T45] ? detach_entity_load_avg+0x7b0/0x7b0 [ 255.704738][ T45] ? dequeue_entity+0xa9c/0x1750 [ 255.704760][ T45] ? _raw_spin_unlock_irq+0x45/0x70 [ 255.704789][ T45] ? tg_unthrottle_up+0x980/0x980 [ 255.704811][ T45] ? kvm_sched_clock_read+0x15/0x30 [ 255.704834][ T45] ? kvm_sched_clock_read+0x15/0x30 [ 255.704855][ T45] ? sched_clock_noinstr+0xd/0x30 [ 255.704875][ T45] ? sched_clock+0x44/0x60 [ 255.704896][ T45] ? sched_clock_cpu+0x75/0x400 [ 255.704920][ T45] ? __cfi___update_load_avg_cfs_rq+0x10/0x10 [ 255.704943][ T45] ? __cfi_min_vruntime_cb_rotate+0x10/0x10 [ 255.704970][ T45] ? __cfi_sched_clock_cpu+0x10/0x10 [ 255.704993][ T45] ? find_inode_fast+0x1ca/0x240 [ 255.705026][ T45] ? ilookup+0x10f/0x360 [ 255.705046][ T45] ? __kasan_check_write+0x18/0x20 [ 255.705069][ T45] ? _raw_spin_lock_irq+0x8d/0x120 [ 255.705096][ T45] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 255.705124][ T45] ? __kasan_check_write+0x18/0x20 [ 255.705148][ T45] ? kernfs_put+0x314/0x360 [ 255.705176][ T45] ? __kasan_check_write+0x18/0x20 [ 255.705199][ T45] ? kernfs_notify_workfn+0x552/0x5a0 [ 255.705239][ T45] ? __kasan_check_write+0x18/0x20 [ 255.705263][ T45] ? pwq_dec_nr_in_flight+0x6c7/0xc60 [ 255.705290][ T45] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 255.705319][ T45] ? kick_pool+0xb9/0x550 [ 255.705349][ T45] process_scheduled_works+0x7d2/0x1020 [ 255.705379][ T45] worker_thread+0xc58/0x1250 [ 255.705407][ T45] ? try_to_wake_up+0xdd2/0x1aa0 [ 255.705439][ T45] kthread+0x2c7/0x370 [ 255.705468][ T45] ? __cfi_worker_thread+0x10/0x10 [ 255.705495][ T45] ? __cfi_kthread+0x10/0x10 [ 255.705522][ T45] ret_from_fork+0x64/0xa0 [ 255.705544][ T45] ? __cfi_kthread+0x10/0x10 [ 255.705574][ T45] ret_from_fork_asm+0x1a/0x30 [ 255.705613][ T45] [ 255.705622][ T45] ================================================================== [ 256.066775][ T45] Disabling lock debugging due to kernel taint [ 256.073461][ T45] BUG: kernel NULL pointer dereference, address: 0000000000000098 [ 256.081291][ T45] #PF: supervisor write access in kernel mode [ 256.087376][ T45] #PF: error_code(0x0002) - not-present page [ 256.093369][ T45] PGD 800000012037e067 P4D 800000012037e067 PUD 0 [ 256.099910][ T45] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 256.106003][ T45] CPU: 1 UID: 0 PID: 45 Comm: kworker/1:1 Tainted: G B 6.12.23-syzkaller-g6c1c18fcb8b7 #0 ba78288b1e32eb9f88d3f8d8da6b79a037cd8362 [ 256.120874][ T45] Tainted: [B]=BAD_PAGE [ 256.125038][ T45] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 256.135111][ T45] Workqueue: events _RNvXs6_NtCs43vyB533jt3_6kernel9workqueueINtNtNtB7_4sync3arc3ArcNtNtCshgDM7dBCdno_11rust_binder7process7ProcessEINtB5_15WorkItemPointerKy0_E3runB13_ [ 256.152008][ T45] RIP: 0010:down_write+0x9a/0x2a0 [ 256.157063][ T45] Code: 48 c7 44 24 20 00 00 00 00 be 08 00 00 00 e8 2d 34 55 fc 4c 89 f7 be 08 00 00 00 e8 20 34 55 fc 48 8b 44 24 20 b9 01 00 00 00 48 0f b1 0b 0f 85 a0 00 00 00 48 c7 c0 c0 b9 20 87 48 c1 e8 03 [ 256.176690][ T45] RSP: 0018:ffffc900002ef500 EFLAGS: 00010256 [ 256.182794][ T45] RAX: 0000000000000000 RBX: 0000000000000098 RCX: 0000000000000001 [ 256.190789][ T45] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffc900002ef520 [ 256.198784][ T45] RBP: ffffc900002ef598 R08: ffffc900002ef527 R09: 1ffff9200005dea4 [ 256.206792][ T45] R10: dffffc0000000000 R11: fffff5200005dea5 R12: dffffc0000000000 [ 256.214785][ T45] R13: 1ffff9200005dea0 R14: ffffc900002ef520 R15: 0000000000000000 [ 256.222779][ T45] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 256.231728][ T45] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 256.238317][ T45] CR2: 0000000000000098 CR3: 0000000138244000 CR4: 00000000003526b0 [ 256.246301][ T45] DR0: 0000000000000000 DR1: 0000000000000f6e DR2: 0000000000000000 [ 256.254279][ T45] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 256.262258][ T45] Call Trace: [ 256.265548][ T45] [ 256.268487][ T45] ? __cfi_down_write+0x10/0x10 [ 256.273347][ T45] ? _raw_spin_lock+0x8c/0x120 [ 256.278132][ T45] ? __cfi__raw_spin_lock+0x10/0x10 [ 256.283344][ T45] ? mutex_unlock+0x8b/0x240 [ 256.287960][ T45] ? __cfi_mutex_unlock+0x10/0x10 [ 256.292531][ T7520] rust_binder: Write failure EINVAL in pid:838 [ 256.293010][ T45] rust_binderfs_remove_file+0x6c/0x110 [ 256.304726][ T45] _RNvXs2_NtCshgDM7dBCdno_11rust_binder7processNtB5_7ProcessNtNtCs43vyB533jt3_6kernel9workqueue8WorkItem3run+0x9d4/0x2860 [ 256.317521][ T45] ? update_curr_dl_se+0x10c/0xb20 [ 256.322658][ T45] ? __kasan_check_write+0x18/0x20 [ 256.327784][ T45] ? __cfi___update_load_avg_cfs_rq+0x10/0x10 [ 256.333874][ T45] ? update_curr+0x60d/0xc60 [ 256.338491][ T45] ? __cfi__RNvXs2_NtCshgDM7dBCdno_11rust_binder7processNtB5_7ProcessNtNtCs43vyB533jt3_6kernel9workqueue8WorkItem3run+0x10/0x10 [ 256.351694][ T45] ? update_load_avg+0x506/0x19a0 [ 256.356802][ T45] ? detach_entity_load_avg+0x7b0/0x7b0 [ 256.362377][ T45] ? dequeue_entity+0xa9c/0x1750 [ 256.367420][ T45] ? _raw_spin_unlock_irq+0x45/0x70 [ 256.372643][ T45] ? tg_unthrottle_up+0x980/0x980 [ 256.377676][ T45] ? kvm_sched_clock_read+0x15/0x30 [ 256.382887][ T45] ? kvm_sched_clock_read+0x15/0x30 [ 256.388108][ T45] ? sched_clock_noinstr+0xd/0x30 [ 256.393142][ T45] ? sched_clock+0x44/0x60 [ 256.397669][ T45] ? sched_clock_cpu+0x75/0x400 [ 256.402636][ T45] ? __cfi___update_load_avg_cfs_rq+0x10/0x10 [ 256.408714][ T45] ? __cfi_min_vruntime_cb_rotate+0x10/0x10 [ 256.414819][ T45] ? __cfi_sched_clock_cpu+0x10/0x10 [ 256.420135][ T45] ? find_inode_fast+0x1ca/0x240 [ 256.425086][ T45] ? ilookup+0x10f/0x360 [ 256.429342][ T45] ? __kasan_check_write+0x18/0x20 [ 256.434478][ T45] ? _raw_spin_lock_irq+0x8d/0x120 [ 256.439596][ T45] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 256.445149][ T45] ? __kasan_check_write+0x18/0x20 [ 256.450269][ T45] ? kernfs_put+0x314/0x360 [ 256.454801][ T45] ? __kasan_check_write+0x18/0x20 [ 256.459916][ T45] ? kernfs_notify_workfn+0x552/0x5a0 [ 256.465294][ T45] ? __kasan_check_write+0x18/0x20 [ 256.470407][ T45] ? pwq_dec_nr_in_flight+0x6c7/0xc60 [ 256.475792][ T45] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 256.481359][ T45] ? kick_pool+0xb9/0x550 [ 256.485705][ T45] process_scheduled_works+0x7d2/0x1020 [ 256.491271][ T45] worker_thread+0xc58/0x1250 [ 256.495956][ T45] ? try_to_wake_up+0xdd2/0x1aa0 [ 256.500932][ T45] kthread+0x2c7/0x370 [ 256.505109][ T45] ? __cfi_worker_thread+0x10/0x10 [ 256.510247][ T45] ? __cfi_kthread+0x10/0x10 [ 256.514857][ T45] ret_from_fork+0x64/0xa0 [ 256.519276][ T45] ? __cfi_kthread+0x10/0x10 [ 256.523873][ T45] ret_from_fork_asm+0x1a/0x30 [ 256.528647][ T45] [ 256.531697][ T45] Modules linked in: [ 256.535604][ T45] CR2: 0000000000000098 [ 256.539780][ T45] ---[ end trace 0000000000000000 ]--- [ 256.545253][ T45] RIP: 0010:down_write+0x9a/0x2a0 [ 256.550287][ T45] Code: 48 c7 44 24 20 00 00 00 00 be 08 00 00 00 e8 2d 34 55 fc 4c 89 f7 be 08 00 00 00 e8 20 34 55 fc 48 8b 44 24 20 b9 01 00 00 00 48 0f b1 0b 0f 85 a0 00 00 00 48 c7 c0 c0 b9 20 87 48 c1 e8 03 [ 256.569893][ T45] RSP: 0018:ffffc900002ef500 EFLAGS: 00010256 [ 256.575981][ T45] RAX: 0000000000000000 RBX: 0000000000000098 RCX: 0000000000000001 [ 256.583972][ T45] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffc900002ef520 [ 256.591948][ T45] RBP: ffffc900002ef598 R08: ffffc900002ef527 R09: 1ffff9200005dea4 [ 256.599925][ T45] R10: dffffc0000000000 R11: fffff5200005dea5 R12: dffffc0000000000 [ 256.607988][ T45] R13: 1ffff9200005dea0 R14: ffffc900002ef520 R15: 0000000000000000 [ 256.616050][ T45] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 256.625074][ T45] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 256.631678][ T45] CR2: 0000000000000098 CR3: 0000000138244000 CR4: 00000000003526b0 [ 256.639685][ T45] DR0: 0000000000000000 DR1: 0000000000000f6e DR2: 0000000000000000 [ 256.647658][ T45] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 256.655636][ T45] Kernel panic - not syncing: Fatal exception [ 256.661986][ T45] Kernel Offset: disabled [ 256.666311][ T45] Rebooting in 86400 seconds..