last executing test programs: 3m48.548379751s ago: executing program 2 (id=681): r0 = gettid() ioprio_set$pid(0x2, r0, 0x4000) futex(0x0, 0x84, 0x2, 0x0, &(0x7f00000001c0), 0x22) (async) r1 = fsopen(&(0x7f0000000080)='devpts\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000180)={0x1, 0x8}, 0x0) fsmount(r1, 0x0, 0xb) (async) fsconfig$FSCONFIG_SET_FLAG(r1, 0x0, &(0x7f0000000040)='ro\x00', 0x0, 0x0) (async) fsconfig$FSCONFIG_CMD_RECONFIGURE(r1, 0x7, 0x0, 0x0, 0x0) (async) mount(&(0x7f0000000000)=@sg0, &(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0)='ext3\x00', 0x208003, 0x0) (async) r2 = open(&(0x7f0000000080)='./cgroup\x00', 0x410100, 0x10) (async) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r2) sendmsg$NL80211_CMD_TRIGGER_SCAN(r4, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, r5, 0x301, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_SCHED_SCAN_MULTI={0x4}, @NL80211_ATTR_MEASUREMENT_DURATION={0x6, 0xeb, 0x3}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x4011) (async) pwrite64(r3, 0x0, 0x0, 0xe7c) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) 3m48.523076872s ago: executing program 2 (id=682): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) keyctl$reject(0x13, 0x0, 0x800000000000002c, 0x80001, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) dup(r1) (async) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18, 0xffffffffffffffda}, 0x18) (async) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18, 0xffffffffffffffda}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f0000000440)=ANY=[@ANYBLOB="b0000000000000ab284dc9a94095f54e34f11a5a480d2115805745f8a24d"], 0xb0) socket$packet(0x11, 0x3, 0x300) (async) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000440)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x6, 0x0, 0x2}]}, 0x10) r4 = socket(0xa, 0x3, 0x2) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x1, 0x9, @loopback, 0xd9b}, 0x1c) (async) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x1, 0x9, @loopback, 0xd9b}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000000300)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4004804) (async) sendmmsg$inet6(r4, &(0x7f0000000300)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4004804) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x1004000, &(0x7f0000000880)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB=',ignoreqv,']) syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00') (async) r5 = syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00') syz_open_dev$evdev(&(0x7f0000000080), 0xc000, 0x40040) pselect6(0x2000, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x300}, 0x0, &(0x7f0000000100)={0x8}, 0x0, 0x0) write$P9_RLERRORu(r2, &(0x7f00000000c0)={0x11, 0x7, 0x2, {{0x4, '!!@,'}, 0xffff}}, 0x11) read$FUSE(r5, &(0x7f00000040c0)={0x2020}, 0x2020) 3m48.522570362s ago: executing program 2 (id=683): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) (async) ioctl$TCFLSH(0xffffffffffffffff, 0x400455c8, 0x0) (async, rerun: 32) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (rerun: 32) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) (async) r4 = socket$netlink(0x10, 0x3, 0x0) writev(r4, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000020000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)={0x30, r5, 0x4, 0x70bd2d, 0x25dfdbfe, {{}, {@void, @val={0x0, 0x99, {0xce2a, 0x59}}}}}, 0x30}}, 0x20004000) (async) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000036000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f0000000300)={{0xeeee0000, 0x80a0000, 0x4, 0xad, 0x13, 0x4, 0x6, 0x7, 0x0, 0x4, 0x49}, {0x4000, 0x8080000, 0x4, 0xfc, 0x3, 0x9, 0x34, 0x3, 0x6, 0x8, 0x3, 0x3}, {0x80a0000, 0x1000, 0x3, 0x5, 0x1, 0x2, 0x4, 0x9, 0x8, 0xa7, 0xb}, {0xdddd1000, 0x6000, 0x5, 0xe7, 0xb, 0x2, 0x3, 0xfc, 0x4, 0xa, 0xe, 0xf1}, {0x2, 0x6000, 0x15, 0xfb, 0x5, 0x86, 0xc, 0x6f, 0x9, 0x0, 0xf7}, {0xdddd0000, 0xeeef0000, 0x10, 0x2, 0xb1, 0x5, 0x7, 0x80, 0x4, 0xf, 0x1, 0x3}, {0xdddd0000, 0x11d004, 0xc, 0x7, 0x0, 0x5, 0x1, 0x4, 0x3, 0x80, 0x3, 0x4}, {0xd000, 0x8000000, 0xb, 0x5, 0xd, 0x47, 0x1, 0x0, 0x2, 0x8, 0xf0, 0xa}, {0xeeef0000, 0x7}, {0xdddd0000, 0x407}, 0x80010037, 0x0, 0x4000, 0x2300, 0x5, 0xb800, 0xeeee0000, [0xbb5e, 0xfffffffffffffffc, 0x15e, 0x7]}) (async) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) (async) r7 = getuid() (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0, 0x0}, &(0x7f0000000340)=0xc) setresgid(0x0, r9, r9) (async) mount$fuse(0x0, &(0x7f0000000140)='./file1\x00', &(0x7f00000002c0), 0x200010, &(0x7f0000000480)={{'fd', 0x3d, r6}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, r7}, 0x2c, {'group_id', 0x3d, r9}, 0x2c, {[{@allow_other}, {}, {@blksize}], [{@dont_measure}]}}) (async) r10 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0) fcntl$setlease(r10, 0x400, 0x1) (async) openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x88040, 0x0) (async, rerun: 64) r11 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/locks\x00', 0x0, 0x0) (rerun: 64) pread64(r11, &(0x7f00000006c0)=""/112, 0x70, 0x42) syz_usb_connect(0x2, 0x0, 0x0, 0x0) (async) close_range(r0, 0xffffffffffffffff, 0x0) 3m48.517291472s ago: executing program 2 (id=684): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000580)=@newsa={0x104, 0x1a, 0x7, 0x8, 0x0, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x33, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2}, {0x0, 0x200000, 0x5}, {0x1a7761c0, 0x0, 0x7f}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in=@dev={0xac, 0x14, 0x14, 0x24}}]}, 0x104}}, 0x4000040) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) r2 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_opts(r2, 0x29, 0x3b, &(0x7f0000000300)=ANY=[], 0x40) getsockopt$inet6_opts(r2, 0x29, 0x3b, 0x0, &(0x7f0000000240)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000440)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, &(0x7f0000000200)=""/183, 0x0, 0x2, 0x16}, @flat=@weak_handle={0x77682a85, 0x100}, @flat=@weak_handle={0x77682a85, 0xa}}, &(0x7f0000000080)}}], 0xac, 0x0, &(0x7f00000000c0)="70d07134252032b13c6f6f6f7aaa12b1c0578b26dfe3b2b741205dad1d02a2a4524d5b0d2b225871a4b865d995f95d6aa99c4901dbf986b562794f45f28d37773ab5417f6282e980021d25789ea8edc9"}) ioctl$BTRFS_IOC_SCRUB(r1, 0xc400941b, &(0x7f00000008c0)={0x0, 0x8a6, 0x101, 0x1}) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000000cc0)={0x0, 0x0, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_GET_DEV_STATS(r1, 0xc4089434, &(0x7f00000010c0)={0x0, 0x9, 0x1, [0x4, 0x33af, 0xffffffffffffffff, 0x3, 0x7], [0xf6, 0x443, 0x7, 0x9, 0x3, 0x7, 0x3, 0x7, 0x30cb, 0x400, 0x1b6, 0x3ff, 0x8, 0x7fff, 0x3, 0x800, 0xd458, 0x0, 0xff, 0x3, 0x401, 0x0, 0x9, 0x5, 0x7f, 0x9, 0x100000000, 0x4, 0x6, 0x0, 0x8, 0x90, 0x0, 0x80000000, 0xb, 0x1, 0x36f, 0xa590, 0x1, 0x200, 0x100000000, 0x394353a5, 0x7, 0x101, 0x8, 0xf4, 0xd, 0x649, 0xffff, 0x0, 0xffff, 0x8000000000000000, 0x0, 0x9, 0x6, 0x530, 0xc742, 0x6, 0x7, 0x8000000000000000, 0x46d5, 0xfffffffffffffffc, 0x10000, 0x10001, 0x2, 0x13, 0x9, 0x3, 0x122, 0x1ff, 0x0, 0x2, 0x4, 0x5, 0x1c0000, 0x5, 0x0, 0x3, 0x0, 0x4, 0x1, 0x8, 0xffffffffffffff93, 0x620, 0x2, 0x3, 0x7, 0x2, 0x0, 0x9e, 0x2, 0x4, 0x400, 0x0, 0x4, 0xcec3, 0x6, 0x8, 0x1, 0xffffffffffffffd6, 0x34, 0x8, 0x9, 0x2, 0x1, 0x0, 0x3, 0x7, 0x1, 0x5d8e4f22, 0x5, 0x3, 0x2, 0xda9d, 0x9, 0x1, 0x3, 0x3, 0x7bdb, 0xbd, 0x7]}) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000001500)={0x1, 0x2, {0x8, @struct={0xffffff01, 0x5}, r3, 0xffffffffffffff00, 0xc298, 0x9, 0x0, 0xc7, 0x2, @usage=0x8, 0x3ff, 0x598c3044, [0xa, 0xb3, 0x7, 0x7fffffffffffffff, 0x3]}, {0x8, @usage=0x5, r4, 0x5, 0x9, 0xb6c, 0x80000000, 0xee59, 0x36, @struct={0x3}, 0x2886, 0x5, [0x3, 0x6, 0x543c26af, 0xe9, 0x1, 0xc78]}, {0xa, @struct={0x2, 0x4}, r5, 0x3, 0x7fffffff, 0x100, 0x5, 0x0, 0x81, @usage=0xaae7, 0x7, 0x8, [0xffffffffffffffff, 0xc, 0xbae7, 0xbe3, 0x1000]}, {0x5, 0x10001, 0x44c}}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000001900)={r5, 0x3, 0x6, 0x1}) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000001d00)={r6, 0x9a3, 0x1, [0x0, 0x5, 0x9, 0x8001, 0x100000000], [0x9, 0x401, 0x100000001, 0x1000, 0x9, 0x42, 0x7, 0x3, 0x4, 0x1ff, 0x9caa, 0x7, 0x6, 0x5, 0xfffffffffffffff9, 0xc2, 0xffffffffffff9a21, 0x7, 0x3, 0x3ff, 0x2, 0xfffffffffffffff9, 0x100, 0x10001, 0x8, 0x101, 0x2b8464ea, 0x5, 0x6, 0x7ff, 0x1, 0x0, 0x6, 0x5, 0x3, 0x100, 0x3, 0x0, 0xa81, 0x5, 0xffffffffffffffff, 0xde00000000000, 0x6, 0x23, 0x7ff, 0x2, 0x6, 0xc, 0x9, 0x2, 0x9, 0x5, 0x46f7, 0x1, 0xc000000, 0x9, 0x0, 0xffffffffffffff81, 0x2, 0x78, 0x1, 0xffffffffffffffff, 0x1400000000000, 0x6, 0x100000001, 0x100, 0xfffffffffffffff8, 0x1, 0x1000, 0x81, 0x8, 0x4800000000000000, 0x0, 0x7, 0x0, 0x7, 0x2, 0x100000001, 0x5, 0xa, 0xffffffff, 0xffffffff80000000, 0x5, 0x43d5, 0x7fff, 0x1, 0x8000000000000001, 0x0, 0x8, 0xcd, 0x5, 0xa4, 0x7, 0x4, 0x1, 0x5, 0x7, 0x7ff, 0xffffffffffffffff, 0x9456, 0x6, 0x0, 0x0, 0x23, 0xe85000000, 0x5, 0xa, 0x80, 0x0, 0x7ff, 0x5, 0x7fff, 0x2, 0x7, 0x10001, 0xace, 0xfff, 0x5, 0x4, 0x7, 0x401]}) 3m48.516848552s ago: executing program 2 (id=685): mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000000) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000200)=[@acquire_done={0x40106309, 0x3}], 0x0, 0x0, 0x0}) 3m48.507376512s ago: executing program 2 (id=686): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f0000000440)=ANY=[@ANYRES8], 0xb0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x8480, &(0x7f0000000880)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB=',ignoreqv,']) r3 = syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00') r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000002140)={0x18, 0x54, 0x1, 0x0, 0x800000, "", [@typed={0x7, 0x3ffd, 0x0, 0x0, @str='\x00\x00\x00'}]}, 0x18}], 0x1, 0x0, 0x0, 0x4000001}, 0x0) read$FUSE(r3, &(0x7f00000040c0)={0x2020}, 0x2020) mkdir(&(0x7f0000000000)='./file0\x00', 0x10) 3m32.484444797s ago: executing program 32 (id=686): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f0000000440)=ANY=[@ANYRES8], 0xb0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x8480, &(0x7f0000000880)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB=',ignoreqv,']) r3 = syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00') r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000002140)={0x18, 0x54, 0x1, 0x0, 0x800000, "", [@typed={0x7, 0x3ffd, 0x0, 0x0, @str='\x00\x00\x00'}]}, 0x18}], 0x1, 0x0, 0x0, 0x4000001}, 0x0) read$FUSE(r3, &(0x7f00000040c0)={0x2020}, 0x2020) mkdir(&(0x7f0000000000)='./file0\x00', 0x10) 2m25.315870981s ago: executing program 3 (id=2421): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x400001000001fe) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, 0x0) mmap(&(0x7f000001a000/0x2000)=nil, 0x2000, 0x8, 0x13, r0, 0x66053000) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)={0x30, r2, 0x0, 0x70bd25, 0x25dfdbfc, {{}, {}, {0x14, 0x14, 'broadcast-link\x00'}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x4044090}, 0x40048c1) 2m25.315327211s ago: executing program 3 (id=2422): timer_create(0x3, 0x0, &(0x7f0000044000)=0x0) timer_settime(r0, 0x1, &(0x7f0000040fe0)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000000)={0x2, 0x6}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x1010, 0xffffffffffffffff, 0xf6d0d000) getrlimit(0x5, &(0x7f0000000080)) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)}, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000080, 0x0, 0x0) shutdown(r4, 0x1) splice(r4, 0x0, r3, 0x0, 0x2, 0x0) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r3, 0x40046210, &(0x7f0000000040)=0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) socket(0x15, 0x0, 0x9a6) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x34, r6, 0x705, 0x70bd2b, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x40008d0}, 0xd0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f0000000000)={0x1}) 2m25.315054791s ago: executing program 3 (id=2423): r0 = add_key$fscrypt_v1(&(0x7f00000001c0), &(0x7f0000000180)={'fscrypt:', @desc3}, &(0x7f0000001580)={0x0, "e5cf9087c0bc4eecd575619bf7fe717b09a75040d67944bdf74658aa573ec7ec5fd9ecb3bf2ad2cceb6d2f7879709ab2db2fcfa073f7ab9055774346282c82cc", 0x17}, 0x48, 0xfffffffffffffffb) r1 = socket(0x1e, 0x805, 0x0) sendmsg$tipc(r1, &(0x7f0000000640)={&(0x7f0000000380)=@nameseq={0x1e, 0x1, 0x0, {0x1}}, 0x10, 0x0}, 0x0) keyctl$update(0x2, r0, &(0x7f0000001600)='a`h', 0x3) (async) keyctl$update(0x2, r0, &(0x7f0000001600)='a`h', 0x3) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) read(r2, &(0x7f0000000040)=""/141, 0x8d) pselect6(0x40, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x300}, 0x0, &(0x7f0000000100)={0x80000000}, 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x300}, 0x0, &(0x7f0000000100)={0x80000000}, 0x0, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000140)=""/15, 0xf, 0x4) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0xdb9, 0x0, 0x0, 0x4}, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, 0x0, 0x0) (async) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, 0x0, 0x0) close(0xffffffffffffffff) (async) close(0xffffffffffffffff) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 2m25.288348031s ago: executing program 3 (id=2424): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x24) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f00000004c0)=ANY=[@ANYBLOB="010000000000000080000040"]) close_range(r0, 0xffffffffffffffff, 0x0) 2m25.288117531s ago: executing program 3 (id=2425): mkdir(&(0x7f0000000000)='./file0\x00', 0x2) (async) mount$bpf(0x0, 0x0, 0x0, 0x5085040, &(0x7f0000000100)={[{}]}) (async, rerun: 64) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='devpts\x00', 0x0, &(0x7f0000000100)) (async, rerun: 64) mount$tmpfs(0x0, 0x0, 0x0, 0x400, 0x0) (async) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/sockstat6\x00') (async) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) read$FUSE(r0, &(0x7f0000000140)={0x2020}, 0x2082) 2m25.282060431s ago: executing program 3 (id=2426): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r1 = gettid() rt_sigqueueinfo(r1, 0x41, &(0x7f0000000080)={0x9, 0x2, 0x4}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$sock_int(r2, 0x1, 0x48, &(0x7f0000000600)=0xdfa, 0x4) unshare(0x2a020400) r3 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) bind$802154_raw(r3, &(0x7f0000001440)={0x24, @short={0x2, 0x2, 0xffff}}, 0x8) quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000080)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000280)={@fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000200)=""/123, 0x7e, 0x1, 0x26}, @fda={0x66646185, 0x2, 0x1, 0x25}}, &(0x7f00000001c0)={0x0, 0x11, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) 2m9.332337236s ago: executing program 33 (id=2426): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r1 = gettid() rt_sigqueueinfo(r1, 0x41, &(0x7f0000000080)={0x9, 0x2, 0x4}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$sock_int(r2, 0x1, 0x48, &(0x7f0000000600)=0xdfa, 0x4) unshare(0x2a020400) r3 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) bind$802154_raw(r3, &(0x7f0000001440)={0x24, @short={0x2, 0x2, 0xffff}}, 0x8) quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000080)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000280)={@fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000200)=""/123, 0x7e, 0x1, 0x26}, @fda={0x66646185, 0x2, 0x1, 0x25}}, &(0x7f00000001c0)={0x0, 0x11, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) 2m6.573102598s ago: executing program 5 (id=2695): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) preadv(r0, &(0x7f0000001780)=[{&(0x7f0000000280)=""/162, 0xa2}, {&(0x7f0000000080)=""/88, 0x58}, {&(0x7f0000000340)=""/110, 0x6e}, {&(0x7f0000000440)=""/4096, 0x1000}, {&(0x7f0000001440)=""/67, 0x43}, {&(0x7f00000014c0)=""/162, 0xa2}, {&(0x7f0000001580)=""/195, 0xc3}, {&(0x7f0000001680)=""/219, 0xdb}], 0x8, 0xffff, 0x2) r1 = inotify_init1(0x800) sync_file_range(r1, 0x31d6afbf, 0x400010004, 0x5) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x6}, @flat=@weak_handle={0x77682a85, 0x1000}, @fda={0x66646185, 0x1, 0x0, 0x15}}, &(0x7f00000001c0)={0x0, 0xffffffffffffffaa, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000028c0)=0x0) fcntl$getownex(r0, 0x10, &(0x7f0000002900)={0x0, 0x0}) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r4, r4) (async) setpgid(r4, r4) setpgid(0x0, r4) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000002940)=0x0) r6 = fcntl$getown(r0, 0x9) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) (async) ptrace(0x10, r7) ptrace(0x11, r7) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000002980)) (async) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000002980)=0x0) r9 = gettid() r10 = open_tree(0xffffffffffffff9c, &(0x7f0000002a00)='./file0\x00', 0x0) syz_clone3(&(0x7f0000002a40)={0x4022000, &(0x7f0000000180), &(0x7f00000003c0), &(0x7f0000001800), {0xf}, &(0x7f0000001840)=""/4096, 0x1000, &(0x7f0000002840)=""/69, &(0x7f00000029c0)=[0xffffffffffffffff, r2, r3, r4, r5, r6, r7, r8, r9], 0x9, {r10}}, 0x58) 2m6.451838609s ago: executing program 5 (id=2696): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'ip_vti0\x00', 0x0}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000680)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa05, &(0x7f0000000000)={&(0x7f00001c4000/0x3000)=nil, &(0x7f0000000000/0xc00000)=nil, 0x3000, 0x0, 0x2}) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) sendmsg$NL80211_CMD_SET_POWER_SAVE(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000002c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000425bd7000fd000008000300", @ANYRES32=0x0, @ANYBLOB="08005d000100000008005d000100000008005d000100000008005d000000000008005d000100000008005d0000000000"], 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x2008000) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000440)="66bad10466ed66bad004b8d8000000ef0f01b200000080c4e19d7c8f15cd0000c4c1c168e30f300f20e035200000000f22e0c4e1b9e96db90f01c266b8e9008ed8", 0x41}], 0x1, 0x0, 0x0, 0x0) prctl$PR_SET_MM(0x41555856, 0x20000000, &(0x7f00005d3000/0x2000)=nil) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = socket$can_raw(0x1d, 0x3, 0x1) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r7, r8, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x7c, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r8, 0x4018aee1, &(0x7f0000000040)=@attr_other={0x0, 0x0, 0x0, &(0x7f00000001c0)=0x8}) setsockopt$sock_int(r5, 0x1, 0x29, &(0x7f0000000080)=0x2, 0x4) r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r9, 0x29, 0xc8, 0x0, 0x0) sendmsg$can_raw(r5, &(0x7f0000000300)={&(0x7f0000000800)={0x1d, r1}, 0x10, &(0x7f0000000880)={&(0x7f0000000840)=@can={{}, 0x0, 0x0, 0x0, 0x0, "ded27feeba7ca62a"}, 0x10}}, 0x0) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/custom1\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r10, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r10, 0x0) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, r10, 0x3e6) utime(&(0x7f0000000100)='./file0\x00', &(0x7f0000000200)={0x2, 0x10}) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000004c0)=[@increfs={0x40046304, 0x1}], 0x17, 0x0, 0x0}) 2m6.36636469s ago: executing program 5 (id=2697): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x400001000001fe) unshare(0x28020480) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) ioctl$PTP_SYS_OFFSET(r1, 0x43403d05, 0x0) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000080), 0x38e, 0x20800) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r3, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1000, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000040)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)={@flat=@binder={0x73622a85, 0x1100, 0x1}, @flat=@binder={0x73622a85, 0x1101, 0x1}, @fd={0x66642a85, 0x0, r4}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000400)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046305, 0x1}], 0x0, 0x0, 0x0}) ioctl$MON_IOCX_GETX(r2, 0x4018920a, &(0x7f00000000c0)={0x0, &(0x7f0000000240)=""/71, 0x47}) mmap(&(0x7f000001a000/0x2000)=nil, 0x2000, 0x8, 0x13, r0, 0x66053000) 2m6.31956727s ago: executing program 5 (id=2698): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) personality(0x8) uname(&(0x7f0000000240)=""/201) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x5c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000280)={@flat=@binder={0x73622a85, 0xa, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/7, 0x7, 0x2, 0x21}, @fda={0x66646185, 0x9, 0x0, 0x29}}, &(0x7f0000000100)={0x0, 0x18, 0x40}}, 0x1000}, @clear_death={0x400c630f, 0x1}], 0x56, 0x0, &(0x7f0000000380)="f22439c47e109c6096ea2bae1f7d03b8c44245ee48a8a255e0db445a21505ddddb4f9e2515db95a1de45d524bb52899f326bab2c88053f7a7475b3ec0373c50a7a4d67df5fde31db1a31325bebcf85b344c0596e65b8"}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x88) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) rmdir(&(0x7f0000000040)='./file1\x00') r3 = open(&(0x7f0000000480)='./file0\x00', 0x0, 0x718bb647156ec3b7) mknodat$loop(r3, &(0x7f0000001600)='./file1\x00', 0x200, 0x0) chdir(&(0x7f0000000140)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x42, 0x0) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000400)={[0x2, 0xf318, 0x5, 0x6, 0x1, 0x9, 0xe, 0x4d2a, 0x6, 0x2, 0x7, 0x486368e5, 0xffffffffffffffff, 0x4, 0x5b, 0x5], 0xeeee8000, 0x40000}) ptrace(0x10, r4) ptrace$poke(0x4, r4, &(0x7f0000000380), 0x10000) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3e, 0xfe9, &(0x7f0000000200)={@fd={0x66642a85, 0x0, r0}, @flat=@weak_binder={0x77622a85, 0x1000, 0x3}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x2, 0x28}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) 2m6.19985826s ago: executing program 5 (id=2699): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x161142, 0x0) setxattr$trusted_overlay_opaque(0x0, 0x0, 0x0, 0x0, 0x7) r1 = memfd_secret(0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x13, r1, 0x0) ftruncate(r1, 0x3) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup/syz1\x00', 0x200002, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r3, 0x40305839, &(0x7f00000000c0)={0x0, 0x1}) r4 = openat$cgroup_ro(r2, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x0, 0x400000, 0x0, 0x0, 0x10000}) fchmod(r4, 0x20049549e2a2d659) write$FUSE_GETXATTR(r4, &(0x7f0000000000)={0x18, 0xfffffffffffffffe, 0x0, {0x7}}, 0x28) write(r0, &(0x7f0000001040)="547bbee68789313efe846d6698abfeac0d12b144933fa6f684f1ba13b34680bf4b9ea70f71faa2a82a45ab3a989d4fec09254d34033fbb8b9699eb0b279252dfcf29e377e14dcfbde42857cbf2aa88d3dad8ec2deea7afe4e747fa392fe01d425970fb2dd7a000ea3889f0d9021f347818106963e18c256e3df26b41c61d30284a8ad61c6269756119d62e3a7a24c1dcd09d3eb35dfee6ec945ac190c4797988e0d7f6f38bf9b124431dd8208a9208195a70c8e558c216e78d5f5b3f6df6f155e16bf7dd8f4e9eaf61d5142a82da7a87aeca19c25b631cd8a14ce9f2fc8dbcd05f51dc9260abc82d780c9358bd6411ebf48520694d413024432d0bfc3759a620289c9c8705009fd829da6eb5b72b454436b0af8e9dc4941ca2cff92561cad984e15849dcd73f04c7f70a30304da2fbc17f421767ad5ce47ed79d6698428eada9a39faa02f978699bc8c482224a2d5f85cc1135ea92ac1c610e32f1e7c82da6d91e0c8634da679760c32c3e891db352b76b61a65bbdd023e093a8e0d37fd8cd00679cb1bceaac84b05861740c221b2cb4afa1ce8b091c815fc4bd83995b5bf5dcdf2912572cf6180ec27445404917ff9e8e6604e2afc1efd63f74cb169a1bb3745914f0a101e03e44ea5f64d40402f12a81310c97086fb01d04e82799c40f29348eb283ad58a40d608a47fbf9a25dbb308a37cf49e6dbdeda39ee88aadb26811eba78a0dfe5400a51428c31582edcc5f75b5dd963707a54b9b1e35f9966995d6474acbf7094124cecf38369aba3f6a5e3ad071f5e3df902843a3947623fe01571d97625c3e27721b08a6f85fd7b879acd400de5beabdd2603d566fdb4018bf8bd74c3ea1ae67c988992c7dab4ebcf501a73815e1b527d3ff1cf9e729d55127118565f794d253fef25609e5a415615d1b5fca5381b49446d9b9e75fbfcdd9218b0d8d8d965871b897544e32fd0b4cb5600ffdcdb0056bcad75216759590f8a94db82b0acd2a5a34e5c34246d19f1a7a7cceb894341f55c6b474f3cc052f9863a67519dfadee6576f08d7448929424c13e845e2e636b87dc14e1ab4ad05d69f896ca1bc5c1267befb686c4207e21aa30bdae1d1602d3e4080784834e213c426ba5446f90d3b3885a5d6942c6b0e637f5bb9c7908460bd7d04497ab054c8fc7f89068f7535976ad051bfe94c243ce7604a63b2099b69f1ed73590a318fad9a170fa0cddfe60e981a92de2e1aab3465b11a968108e08deadfa10c546c4cbc0c34ac28597848562583ae8d93cb60f2e06c7a1f743add51eb8cd732b40d48fde00117cb2d654100dfcc66b7c9fefac80e137caa5cf43ae897780251a3ebbc4ddd3b003168963c9e2c9446cb29731fc4bbb5e551aca6913f7b8576ce34012581b5a363917970399ca369688e637cf06ff3c8114383d2fcbf9c69f1ca63cd21695254a440df5ef0a8abfdbd0a651a533b6cdb82382e3bd70f87c1d3eb0a6e22452605026fafe6d35158c0728c1050a39330c80ee2ee0b09366fd8423c73b8c8ace75efade8c75a0c6382883ecd0796feec657b36aee4091471e406e9faffd5ede27943e5fbf1b7249ab8bad71f60063697f04db52e980a9fb3eb5e53b89be8a5f0e6afea7435789ecd444c28eb411cdc2158e434178749f36cc957dbd17efb2b218592f78d6864f2708e8c6db2da0d3f6de53959afec0c90d3d62a13a0bc3857bce58d81223eddd05cf3c1ec6b3fc5307d0f16d470f2065300295197e9fa81d2e5574b2c7b18f1c6c85156a9b1174d62dcd3cb026d66c8f427b9687585f37b18c82e0100507035e78ce010b78ea1b5d3884bb25df36ae929dd535a854a31cba5e47655873df72be7463c600b704e9da0e7cb2d61d0710248814ecced2eef8f227c8aec308c2c9d0a39d1a6b306080e8eaef8edece0f6d0d1612c582d70c3999a1a6bd529538f51ba4869ce74bc8509a7126d96db118cdb55411a36f4361d53c8027c12a7486e9c84e4de445b454630be27bdc2ec268702d9c1890297bdd1fc7a235f1a47f4645d286146f3cb9a7ce650f4157a1e7f134eb1815001d59905d3103efad3c66479330e8a5da941c9c38bf21bc0770e3fd56cafa19ad6e9d51f94ed4f900062b5602653aacdcc956aeecfb1dd613caf918e1ca8ef2e1504c42768e77df43569d5fe4b48c237cad5285c578b26b4e47c8ce06fd26a6e17eb6d5df5645d0fdde7782216be07a1135dabc3a59598bdbab249c5391832f18ac5163aa7a1a890128a4520835a53eb750604c5e328ecb3216516b3eba3f97652caeb4327da8865880a932dc8e7668666ac3b76a2a424ca35b5dfb52495710611e20790427a9f9e7ac59bb86f0fb7a17a5def347a98dd8e733b784d78d5c7f16f327a2606d4252411457465540a60b0757802f470d08337c0fe4eee5f5cfe4f296d0f7068e80828a022c95632beb7b7f802135e246b1adebebf24c821dee7205e9fe1a437b16aaa8dcb4a58b0bdbc8dbc2fce09271c27430cc9ca8141955ec5ff4228627c3816cfe1bb2c0f40f6a61e8bfa4e2dd744e41ed80b83e9aef77119f4b062b98e86690711e83e795bafa7a8db16f241cee76aa01ff749100c113fda966aa8c83ebe975f760c18e3864065a5de67b3b5ee8028a9e3199f4acff11e14bb13bc50faf97fdeab46edc371e55cab78841a2de17ca116b0183ac38b658c57a64ab11bb0de071c971a7a5175ad0bac6ac1d1118230a5412a35bd005b369df0e04e749ea93d7e56f713b9ceff580547a2a76ea4753a78b4a5cd0311024c5536b536c8ede63bac8e8b4c5851248d9098a7c6bcc3d5f209178b45aef3c1afa4ab73d8feac3e1f771626d73d85f72dc15d16bd3b7b93e622626f6f3d96b4425d328236cf1579f1ca834a7b318b012e27b9a2dc528189cf1eb3705d90de50ce7ac0c256b7e41500113e164fb7d53c74c6f829552a5bce73eeab9a46d01551bdab18fd3a7e82b036872f1e876b12c5676f63a6ef0c6ff159788a0c2fc40f179a259c656e8aba9295e90027e74ef910ce3c56d6e2de917947410b05603b6a5052453f13e6ac058b3f621573bfe6224bad8c3a5f575e1eb779529de164c53c9b3ad623df6c5c9627cce856f9ba5847557bc9f854cbb37a936f20a733ba352ee5b343b941290a399fb862434d1b551da420053cad3bad65195cde40b345740e30e9a22619add8aedb763473b729c0649f7a1ea45325534c9b629a1fe3a54a78fe44969715182c6df5c9ecf6878380831b2996579332ac37286e72ab16824c3fc9ef8d74a7f1f5cf80fa37f6bb990db3a7a70139887a4eba0763247c58f4fe770a0496a5ef49a3ba4d62bb900644d49b5fba7e58d58af6ae50c96da346618434ed46b8f4c27cde5e8863d5b090dc117f3b16db2c4273fa84f8b06d3df436bf4a8cfa6d33d7f0e78ef422d5d7640c821398c9adf4d6ccb1b2f7cd0e497023cfdd6b5bb9ad6a29edb8b78fb3322414cad1458eb12699853acb165076db7088f518386380850c111cbe74034ddbfe217db714325ebc4d6b46eba640cf125b87eed083207040075e475e431079756b3da6f9bb3c861ce7eabf6adf70b76eb9642a1bab3d7afef2d7b40c8a19b98123ad7449c1039c494e73bc91a86e8e92c39a9482cf60605b9e5c209262c4fcfde76ee370bd6a78253b64c5cbb19a11b34c5a9ccf634c52751277268cd97e795b43867af5a4db51bd631ac547906fd52aff43eb98edacecf08f94a060902b5cb82e87ec856305005bd1150e581d9717460e31ba724da5e7ad72fa580f8509fe838dbc1bfbbf53e29688f25ca602d2de702e4411d3d133e2ab2f454f71f98efc2cd0eb468544cacf608c6689ef122009cf61e813e26b7b2b1695143fcd510f509ec2bf7205e674ba6767eaa29605c51e434c298bde0969617292e960d22b085632d241aa2a8e0f6ac6f2d56d0ed2c6bd3eca306a3224915065894480e737c7d7a11901bb7f977525cfcab652476baab0fd3b68dc59fd14ccdd6248bd5c5a0ab1dbae28a848b2d4ad0d973bb149ff4115b0436b7d145a6f8081d314039131f60dc8ed0ccf2c4971f0a59a65b3b1ef638e6d009dff793a4b7266c58f88bb117d665cae8fc6f6c2840470333bdbc8d8b000000000000004e089a85dc6d49f52459dd2df1be552194eef6027c1b45f62b97647788c3325f05609c1e02cbc9a18be72e4b502df719e4f9cb82615e3a03b5732328e552023dbfdcf91ed5ab51242e7d09a9b73674f0946976d8a8fa9288dce4d54d5820a0f0053b892685f79a6c8dbac724fce4d24a7b75e383f54ac58af3951d666a22f158637acc4f0e09e248e85f8e1439501afc0d5b7e9eab40fa80390cf23fcbd1f9907c42a672936666e0b3d924d23bb7c5c60346921f2384116bed33db5d4987a38bc3df9b198f175af684b6b26b24a2cd9ee137569598ba2ed61206deddfac6da5c362327a88d27cfa1f98dba6f23e043b4edccb8c605553b919cd837880e0159a0a01918886b68859f7b6a157b1bbbfb6706", 0xc83) 2m6.148964501s ago: executing program 5 (id=2700): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x8401) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x2, 0x3, 0xfffc, 0x0, 0x7995}, 0xffffffffffffff1d, 0x0, 0x0, 0x48000000, 0x0, 0x9e, 0x0}) mkdirat(r1, &(0x7f0000000200)='./file0/file0\x00', 0x101) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@verity_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000f, 0x11, r2, 0xf648e000) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$int_in(r3, 0x5421, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f00000002c0)=@gcm_256={{0x304}, "4f26bccf46c274dd", "cad16d4b2b7f099f2cc053cadcff006713d697663504b974600b72b864de680f", "b92bfe4d", "3c21648f3f69a80c"}, 0x38) read$FUSE(r4, &(0x7f0000003480)={0x2020}, 0x2020) execveat(r4, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={[&(0x7f0000000040)='^w}!\'\x00']}, &(0x7f0000000280)={[&(0x7f0000000100)='tracefs\x00', &(0x7f0000000240)='verity=on']}, 0x800) 2m6.100107721s ago: executing program 34 (id=2700): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x8401) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x2, 0x3, 0xfffc, 0x0, 0x7995}, 0xffffffffffffff1d, 0x0, 0x0, 0x48000000, 0x0, 0x9e, 0x0}) mkdirat(r1, &(0x7f0000000200)='./file0/file0\x00', 0x101) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@verity_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000f, 0x11, r2, 0xf648e000) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$int_in(r3, 0x5421, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f00000002c0)=@gcm_256={{0x304}, "4f26bccf46c274dd", "cad16d4b2b7f099f2cc053cadcff006713d697663504b974600b72b864de680f", "b92bfe4d", "3c21648f3f69a80c"}, 0x38) read$FUSE(r4, &(0x7f0000003480)={0x2020}, 0x2020) execveat(r4, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={[&(0x7f0000000040)='^w}!\'\x00']}, &(0x7f0000000280)={[&(0x7f0000000100)='tracefs\x00', &(0x7f0000000240)='verity=on']}, 0x800) 1m4.22003193s ago: executing program 0 (id=3475): openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x2082, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = open(&(0x7f0000000000)='./bus\x00', 0x40942, 0x8) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r3 = inotify_init() inotify_add_watch(r3, &(0x7f0000000000)='./file1\x00', 0x50000563) splice(r0, 0x0, r2, 0x0, 0x402000784853bb, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2241, 0x0) write$binfmt_misc(r1, &(0x7f0000000100)='F', 0x1) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5}, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'ip6tnl0\x00', 0x0}) r6 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(r6, 0x107, 0xd, &(0x7f0000000180)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) sendto(r6, 0x0, 0x0, 0x4884, &(0x7f0000000480)=@xdp={0x2c, 0x6, r5, 0x36}, 0x80) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x10, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r7, 0x6, 0x9, &(0x7f0000000080)={{0x2, @empty, 0x2, 0x43, 'fo\x00', 0x2, 0x0, 0x3a}, {@private=0xa810101, 0x4, 0x0, 0x0, 0xba0, 0xdffffffe}}, 0x44) getsockopt$inet_tcp_int(r7, 0x6, 0x9, 0x0, &(0x7f0000000040)) r8 = socket(0xa, 0x1, 0x0) setsockopt$sock_int(r6, 0x1, 0xb, &(0x7f0000000040)=0x9, 0x4) bind$inet6(r8, &(0x7f0000000000)={0xa, 0xe64, 0x1ff, @empty, 0x2}, 0x1c) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000040)=0x9, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0xe64, 0x3, @ipv4={'\x00', '\xff\xff', @empty}, 0x202}, 0x1c) r9 = socket(0xa, 0x1, 0x0) setsockopt$sock_int(r9, 0x1, 0x3c, &(0x7f00000001c0)=0x9, 0x4) bind$inet6(r9, &(0x7f0000000000)={0xa, 0xe64, 0x3, @private2, 0x2}, 0x1c) connect$unix(r9, &(0x7f0000000100)=@abs={0x0, 0x0, 0x4e23}, 0x6e) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) 1m4.160247821s ago: executing program 0 (id=3476): r0 = socket$inet_udp(0x2, 0x2, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) mount$tmpfs(0x0, 0x0, 0x0, 0x400, &(0x7f0000000100)=ANY=[@ANYRESOCT=r0]) mount$binderfs(0x0, 0x0, 0x0, 0x80086, &(0x7f0000000100)=ANY=[@ANYBLOB='max=']) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='devpts\x00', 0x0, &(0x7f0000000100)) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000200), r1) sendmsg$IEEE802154_LLSEC_LIST_DEV(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x14, r2, 0x303, 0x70bd2a, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x88d0}, 0x8000) r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x775302, 0x0) readv(r3, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000002400)=""/4096, 0x1000}], 0x3) 1m4.112290081s ago: executing program 0 (id=3477): mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}]}}) stat(&(0x7f0000000b40)='./file0\x00', 0x0) truncate(&(0x7f0000000080)='./file0\x00', 0x3) r1 = inotify_init1(0x800) inotify_add_watch(r1, &(0x7f0000000040)='.\x00', 0x3000426) mknod(&(0x7f0000000000)='./file0\x00', 0x6000, 0x77b) open$dir(&(0x7f00000001c0)='./file0\x00', 0x80000, 0x14) openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x42, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000000)={0x73622a85, 0x200b, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x4}, @fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x6, 0x0, 0x200000000000024}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) 1m3.181867105s ago: executing program 0 (id=3480): openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder-control\x00', 0x800, 0x0) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) fcntl$lock(r1, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$lock(r1, 0x26, &(0x7f0000000080)={0x1, 0x0, 0x2007, 0x1fd}) fcntl$lock(r1, 0x6, &(0x7f0000000240)={0x1, 0x0, 0x9}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x200, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$setstatus(r3, 0x4, 0x40000) getpid() r4 = socket$inet6(0x10, 0x3, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) sendto$inet6(r4, &(0x7f00000001c0)="9c8f", 0x2, 0x881, 0x0, 0x0) r5 = syz_clone(0x606d000, 0x0, 0xfffffffffffffef3, 0x0, 0x0, 0x0) syz_pidfd_open(r5, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) keyctl$set_reqkey_keyring(0xe, 0x5) request_key(&(0x7f00000022c0)='user\x00', &(0x7f0000002300)={'syz', 0x1}, &(0x7f0000002340)='\\\x00', 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0x69) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x89901) move_mount(r6, &(0x7f0000000040)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x1000, 0x0) mount$bind(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000440)='./file0\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x10a5840, 0x0) move_mount(r0, &(0x7f0000010040)='./file0/file0/file0\x00', 0xffffffffffffffff, &(0x7f0000010000)='./file0/file0\x00', 0x252) close(r0) 1m2.19927175s ago: executing program 0 (id=3492): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x34}) r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x4f3, 0x755, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0xb1, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x101, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0xc}}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000340)={0x2c, &(0x7f0000000040)={0x20, 0xa, 0x7, {0x7, 0xf, "00f4000000"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) ioctl$HIDIOCGFEATURE(r1, 0xc0404807, 0x0) r2 = syz_open_dev$usbfs(0x0, 0x75, 0x109301) ioctl$USBDEVFS_ALLOW_SUSPEND(r2, 0x5522) r3 = socket$netlink(0x10, 0x3, 0x4) mremap(&(0x7f0000156000/0x4000)=nil, 0x4000, 0x4000, 0x6, &(0x7f00008ea000/0x4000)=nil) bind$netlink(r3, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r4, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x4000) setsockopt$sock_int(r3, 0x1, 0xb, &(0x7f0000000340)=0x101, 0x4) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x165342, 0x0) r5 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)={0x620400, 0x163, 0x4}, 0x18) mknodat(r5, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$char_usb(0xc, 0xb4, 0x6) syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) socket$unix(0x1, 0x5, 0x0) sendmsg$TIPC_NL_NET_SET(r6, 0x0, 0x0) 1m2.03938742s ago: executing program 0 (id=3498): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x48801, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x2802, 0x0) r2 = socket(0x2, 0x3, 0x2) getsockopt(r2, 0xff, 0x100000000000001, 0x0, 0x0) write$vga_arbiter(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="74f279686f20696f000000"], 0xb) ioctl$BLKRRPART(r0, 0x125f, 0x0) sendto$inet(r2, &(0x7f0000000040)="9d2ef8237be5b5a66506f6777574f433ddd27a3fa03716781435", 0x1a, 0x4004084, &(0x7f00000000c0)={0x2, 0x4e22, @rand_addr=0x64010100}, 0x10) 1m1.997124851s ago: executing program 35 (id=3498): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x48801, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x2802, 0x0) r2 = socket(0x2, 0x3, 0x2) getsockopt(r2, 0xff, 0x100000000000001, 0x0, 0x0) write$vga_arbiter(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="74f279686f20696f000000"], 0xb) ioctl$BLKRRPART(r0, 0x125f, 0x0) sendto$inet(r2, &(0x7f0000000040)="9d2ef8237be5b5a66506f6777574f433ddd27a3fa03716781435", 0x1a, 0x4004084, &(0x7f00000000c0)={0x2, 0x4e22, @rand_addr=0x64010100}, 0x10) 7.828079634s ago: executing program 7 (id=4268): r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000001ec0)='./binderfs/binder-control\x00', 0x0, 0x0) mknod(0x0, 0x1000, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r1, &(0x7f0000000280)={@void, @void, @eth={@multicast, @multicast, @val={@void, {0x8100, 0x5, 0x1, 0x1}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x67, 0x0, 0x6, 0x2f, 0x0, @private=0x1fe1, @multicast1}, {0xa000, 0x86e1, 0xc, 0x0, @opaque="f842651e"}}}}}}, 0x32) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, &(0x7f0000000140)={'binder0\x00'}) 7.827681924s ago: executing program 7 (id=4269): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, {0x2a00, 0x80010000, 0x0, 0x9, 0x7, 0x0, 0x5, 0xc, 0x1c, "fee8a2ab78fc979fd1e0fb950720b7fb810000000000b26b000000000000000000000000002300000000000000000000000000000000000000000800", "2809e8dbe108598948224ad54afac12b8753d7bdb22d0000b520a1a93c060000000000027a8f3d45cdd499a861ac000000000318e341e15ec20e000000000400", "f422741b13103e52f40000ed06000000000200989d8d4200", [0x0, 0x1fffffffbfffd]}}) rt_sigqueueinfo(0x0, 0x39, &(0x7f0000000340)={0x2b, 0xfffffffd, 0x400}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000440)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, &(0x7f0000000200)=""/183, 0x0, 0x2, 0x16}, @flat=@weak_handle={0x77682a85, 0x100}, @flat=@weak_handle={0x77682a85, 0xa}}, &(0x7f0000000080)}}], 0xac, 0x0, &(0x7f00000000c0)="70d07134252032b13c6f6f6f7aaa12b1c0578b26dfe3b2b741205dad1d02a2a4524d5b0d2b225871a4b865d995f95d6aa99c4901dbf986b562794f45f28d37773ab5417f6282e980021d25789ea8edc9"}) 7.825708724s ago: executing program 7 (id=4270): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) (async, rerun: 64) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) (async, rerun: 64) r1 = epoll_create1(0x80000) (async, rerun: 32) r2 = signalfd(r0, &(0x7f0000000080)={[0x4]}, 0x8) (rerun: 32) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x80000000}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfee, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x40000000000000, 0xe}, @fda={0x66646185, 0x1, 0x0, 0x38}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0x1d}}, &(0x7f0000000180)={0x0, 0x28, 0x48}}, 0x400}], 0x50, 0x0, &(0x7f0000000300)="6cc2517326f0182dfaea8b9b0efefe72ca2b3f10c526bb82d4a3786efb2df4fda2a1e2888f71a664cc5a261719fe4cead4d24dcc14edceace088490d882b563ef630b62d95fb3e1b01b472ec8da1d1df"}) 7.802486144s ago: executing program 7 (id=4271): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x11) close_range(r0, r0, 0x2) 7.781782744s ago: executing program 7 (id=4272): r0 = socket(0x10, 0x3, 0x9) (async, rerun: 32) r1 = gettid() (rerun: 32) rt_sigtimedwait(&(0x7f0000000080)={[0x3ff]}, 0xfffffffffffffffc, 0x0, 0x8) (async, rerun: 32) tkill(r1, 0x7) (async, rerun: 32) connect$netlink(r0, &(0x7f00000014c0)=@proc={0x10, 0x0, 0x25dfdbfc}, 0xc) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000001c0)={&(0x7f0000000080), 0xc, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a14"], 0x28}}, 0x0) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000040)={0x0, 'ip_vti0\x00', {0x1}, 0x3}) (async) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r3 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x2840) ioctl$EVIOCSFF(r3, 0x40304580, 0x0) (async, rerun: 64) r4 = socket$inet_udp(0x2, 0x2, 0x0) (rerun: 64) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, 0x0, 0x52) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x101c00, 0x0) 7.715929354s ago: executing program 7 (id=4273): r0 = socket$nl_audit(0x10, 0x3, 0x9) r1 = socket$netlink(0x10, 0x3, 0x0) fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f0000000040)=0x5) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'veth0_to_bond\x00', &(0x7f0000000400)=@ethtool_cmd={0x4d, 0x2, 0xffbf, 0xffff, 0x7, 0x6, 0x40, 0x80, 0x5, 0xb4, 0x5, 0x81, 0x6, 0x2c, 0x40, 0x8, [0x8, 0xc]}}) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="1502000065ffff0310000006003950323030302e4c"], 0x15) r4 = dup(r3) rename(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='./bus\x00') write$FUSE_BMAP(r4, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_INIT(r4, &(0x7f0000001740)={0x50, 0x0, 0x0, {0x7, 0x21, 0x0, 0x14210000, 0x7d, 0x1005, 0x3, 0x3}}, 0x50) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000004380), 0x101c800, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) r5 = syz_open_procfs(0x0, &(0x7f00000003c0)='mountinfo\x00') r6 = open(&(0x7f0000000200)='./bus\x00', 0x141a42, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), r4) sendfile(r6, r5, 0x0, 0xffffffff) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='mounts\x00') mount(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000080)='proc\x00', 0x189, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x9}) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f00000000c0)={@private0={0xfc, 0x0, '\x00', 0x1}, 0x800, 0x2, 0xff, 0xa}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000000080)={@private0={0xfc, 0x0, '\x00', 0xb}, 0x800, 0x2, 0x3, 0x7, 0x7fc, 0xfffe}, 0x20) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r9, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x2, 0xfffffffd, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r9, 0x6, 0x1f, &(0x7f00000003c0), 0x3) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r10, 0x0) getsockopt$bt_hci(r9, 0x11a, 0x3, 0x0, 0x0) read$FUSE(r7, &(0x7f00000005c0)={0x2020}, 0x2020) 3.352605685s ago: executing program 6 (id=4314): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x380, 0x2}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x0, 0x0, 0x0}) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080), 0x440103, 0x0) 3.311324055s ago: executing program 6 (id=4315): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x0, 0x0}) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167342, 0x0) readv(r0, &(0x7f0000000140)=[{&(0x7f0000001400)=""/4096, 0x1000}, {0x0}], 0x2) 3.244093115s ago: executing program 6 (id=4316): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x13, 0x0, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder1\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) futex(0x0, 0x86, 0x0, 0x0, 0x0, 0x40) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom0\x00', 0x800, 0x0) ioctl$BINDER_FREEZE(r1, 0xc0046209, 0x0) 3.242750435s ago: executing program 6 (id=4317): openat$binderfs(0xffffffffffffff9c, 0x0, 0x1002, 0x0) r0 = openat$kvm(0x0, &(0x7f0000000300), 0x22382, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, 0x1}) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000400000004"]) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f0000000180)={0x4, 0x2007}) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}) mkdir(&(0x7f0000000680)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) rename(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000040)='./file0\x00') socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x138a, 0x1000000003}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000500)=[@request_death={0x400c630e, 0x3}], 0x0, 0x0, 0x0}) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/power/reserved_size', 0x80000, 0x8) write$P9_RREADDIR(r4, &(0x7f00000001c0)={0x13e, 0x29, 0x2, {0x4, [{{0x0, 0x4, 0x3}, 0x101, 0x5, 0xfc, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, {{0x0, 0x2}, 0x2a, 0x35, 0x7, './file0'}]}}, 0x13e) 3.137185345s ago: executing program 6 (id=4318): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x3}) r1 = mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x50, 0x0, &(0x7f0000000040)="c77f63941720024fcb205ad3f3502124f14eba8419d2d70aade14d22ca5137369a7e2f7c68839e02d428fe526929aaaeb71b01b4a33854d4ca7681b53a970b1a4175371ccff2ad1d15ed65d48b413559"}) signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x100000000]}, 0x8, 0x180000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000280)={@ptr={0x70742a85, 0x100000, 0x0, 0x0, 0x2, 0x7}, @fda={0x66646185, 0x8, 0x0, 0xf}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x28}}, 0x0}, 0x40}], 0x0, 0x0, 0x0}) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c010000190001000000000000000000fc0200000000000000000000000000defd8000000000000000000000000000bb00000005000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000000000000080400000000000000000080000000000000000000103000000000044000500ac1414aa000000000000000000000000000000003c00000000000000ffffffff00000000000000000000000000000000000300000000000000000000000200000c0015005a07350009"], 0x11c}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRESHEX=r0, @ANYRES32=0x0, @ANYBLOB="02000000000000009c0011005a"], 0xec}, 0x1, 0x0, 0x0, 0x20040854}, 0x4a000) quotactl_fd$Q_QUOTAON(0xffffffffffffffff, 0xffffffff80000202, 0x0, &(0x7f0000000340)='./file0\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000900)={0x9c, 0x0, &(0x7f00000007c0)=[@free_buffer={0x40086303, r1}, @acquire_done={0x40106309, 0x2}, @release={0x40046306, 0x3}, @acquire_done={0x40106309, 0x3}, @dead_binder_done, @clear_death, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000780)={0x30, 0x30, 0x30}}}], 0x29, 0x0, &(0x7f00000008c0)="4b30174b442288c3a9def15973bb88f9681daaf870436e821da0bd6350d981151041f99854174eafdb"}) 2.958880886s ago: executing program 6 (id=4319): openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x165342, 0x0) r0 = syz_clone(0x102200, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r0, 0x0, 0x4000000a, 0x0) syz_clone3(&(0x7f0000000280)={0x800000, &(0x7f0000000080), &(0x7f00000000c0)=0x0, &(0x7f0000000100), {0x2c}, &(0x7f0000000140)=""/201, 0xc9, &(0x7f0000001400)=""/242, &(0x7f0000000240)=[r0, r0], 0x2}, 0x58) r2 = syz_open_procfs(r1, 0x0) pwritev(r2, 0x0, 0x0, 0x7, 0x0) openat$rnullb(0xffffffffffffff9c, 0x0, 0x165342, 0x0) r3 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x4d8, 0xf372, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x3}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000001440)={0x24, 0x0, &(0x7f0000000280)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x480a}}, &(0x7f00000002c0)={0x0, 0x22, 0x5, {[@local=@item_4={0x3, 0x2, 0x7, "79acf79d"}]}}, 0x0}, &(0x7f00000016c0)={0x2c, &(0x7f0000001480)=ANY=[@ANYBLOB="2003a20000003ef70e58d8f774cce6f37160ae2dd37308797f5a18fbbad4af3cd92988a6206b604bec269f8d7df4f7b7160b76ecd31f0bfbf1afe3ecb919430edbcb11bb4173864708c8def7b3e73cc440e21adbd16a9b5ca8ff0d949c5e2359644f3c44966fce9c903110962455ab260f2f846c215dcbc8293a831e80a6529491faac4ba895b39fa040774135e5125aa81f80c50d80b3391c44b9c96fe54c3853880e3cf5384dd5"], 0x0, 0x0, 0x0, &(0x7f0000001680)={0x20, 0x3, 0x1, 0x20}}) r4 = openat$kvm(0xffffffffffffff9c, 0x0, 0x181040, 0x0) r5 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000500)=ANY=[@ANYBLOB]) openat$rtc(0xffffffffffffff9c, &(0x7f0000001700), 0x40000, 0x0) r7 = syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r8, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) syz_usb_control_io(r7, 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000027c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x24004000) syz_usb_control_io$hid(r7, &(0x7f0000000200)={0x24, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="51e8a70eb3f1afd1ee80e3b501dbc74a2805000000c37b4e21a6"], 0x0}, 0x0) syz_usb_control_io(r3, &(0x7f00000000c0)={0x2c, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) mkdir(&(0x7f0000002280)='./file0\x00', 0x11e) r9 = socket(0x10, 0x3, 0x0) sendmsg$netlink(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000012c0)=[{&(0x7f0000000340)=ANY=[@ANYRES8=r4, @ANYRES32, @ANYBLOB="080029004101"], 0x28}], 0x1, 0x0, 0x0, 0x801}, 0x0) sendmmsg(r9, &(0x7f0000000000), 0x4000000000001f2, 0x0) inotify_init() syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) 2.440031159s ago: executing program 1 (id=4320): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x80cd}], 0x1, 0x7) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x12, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0xa13ca8e5839881ac, 0x4}) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r2, &(0x7f0000000380)={0xa, 0x4e24, 0x5, @initdev={0xfe, 0x88, '\x00', 0xfd, 0x0}, 0x2}, 0x1c) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000280)=[{&(0x7f0000000080)="580000001400add405000000000000000a117fffffff81004e230e227f000001925aa80020007b00090080007f000001e809000000ffff0100f5c71002000000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) timer_create(0x2, &(0x7f0000000080)={0x0, 0x18, 0x1}, &(0x7f00000000c0)) r4 = syz_clone(0x41080000, 0x0, 0x0, 0x0, 0x0, 0x0) kcmp(r4, r4, 0x6, 0xffffffffffffffff, 0xffffffffffffffff) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfee, 0x0, 0x0, 0x78, 0xfffffffffffffffb, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0, 0x62, 0x2, 0x9}, @ptr={0x70742a85, 0xfffffffc, &(0x7f00000029c0)=""/201, 0xc9, 0x1, 0x14}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0x1d}}, &(0x7f0000000180)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0}) 2.405888479s ago: executing program 1 (id=4321): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167342, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x5, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b620a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd00000080190000000000000000000000004800", [0x0, 0x3]}}) r3 = dup(0xffffffffffffffff) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) close_range(r0, 0xffffffffffffffff, 0x0) 2.34164579s ago: executing program 1 (id=4322): r0 = socket$nl_audit(0x10, 0x3, 0x9) statx(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x100, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl_fd$Q_GETQUOTA(r0, 0xffffffff80000700, r1, &(0x7f0000000280)) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000380)={'team_slave_0\x00', &(0x7f0000000040)=@ethtool_wolinfo={0x5, 0x7, 0x7, "20e97b06beda"}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') (async) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') mkdir(&(0x7f0000000000)='./file0\x00', 0x2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2800, 0x0) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2800, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0xc008ae88, &(0x7f0000000040)=ANY=[@ANYBLOB="020000000000000092000040"]) utime(&(0x7f0000000300)='./file0\x00', &(0x7f00000003c0)={0x7, 0x8}) (async) utime(&(0x7f0000000300)='./file0\x00', &(0x7f00000003c0)={0x7, 0x8}) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@nfs_export_on}]}) read$FUSE(r2, &(0x7f00000042c0)={0x2020}, 0x2020) (async) read$FUSE(r2, &(0x7f00000042c0)={0x2020}, 0x2020) 2.1441064s ago: executing program 1 (id=4323): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000100)={0x80000000, 0x0, 0xfffffffc}, 0x10) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000904ff81000000fe0000000000000008000f00fd004000", 0x24) (async) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x4a40, 0x0) preadv2(r1, &(0x7f0000001000)=[{&(0x7f0000000000)=""/4096, 0x1000}], 0x1, 0x0, 0x9, 0xf) bind$tipc(r0, &(0x7f0000001040)=@nameseq={0x1e, 0x1, 0x2, {0x41, 0x0, 0x1}}, 0x10) 2.12327033s ago: executing program 1 (id=4324): r0 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000200)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x56a, 0xf0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0x20, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x807, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x6, 0xff}}}}}]}}]}}, 0x0) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_END_FF_UPLOAD(r2, 0x406855c9, &(0x7f0000000180)={0xc, 0x8001, {0x50, 0x7, 0x40, {0x4, 0x7}, {0x2, 0xb}, @cond=[{0x400, 0x6, 0x3, 0x9, 0x2, 0x6}, {0x400, 0x3, 0x800, 0x6, 0x52d, 0x1}]}, {0x52, 0x2, 0x1, {0x5, 0x6}, {0x5, 0x6}, @period={0x5b, 0x7, 0x7fff, 0xc, 0xd3d8, {0x8f, 0xfcbd, 0x5, 0x9}, 0x0, 0x0}}}) (async, rerun: 64) syz_usb_control_io(r1, 0x0, 0x0) (async, rerun: 64) syz_usb_control_io$hid(r1, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0x8, "79208530"}]}}, 0x0}, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f00000000c0), 0xffffffffffffffff) (async) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$ifreq_SIOCGIFINDEX_wireguard(r5, 0x8933, &(0x7f0000000580)={'wg1\x00'}) (async, rerun: 32) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000940)=ANY=[@ANYBLOB="78030000", @ANYRES16=r4, @ANYBLOB="37040000000000000000010000005c03088030000080060005000000000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39223400008004000980060005000080000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922f4020080cc02098034000080060001000200000008000200ac1414aa0500030003000000060001000200000008000200640101010500030000000000a0000080060001000a00000014000200000000000000000000000000000000000500030003000000060001000a00000014000200000000000000000000000000000000010500030001000000060001000200000008000200ac1414bb0500030002000000060001000200000008000200e00000010500030000000000060001000a00000014000200fe80000000000000000000000000003305000300020000001c000080060001000200000008000200ac1414bb050003000200000028000080060001000a00000014000200fc000000000000000000000000000001050003000000000034000080060001000200000008000200ac1414bb0500030003000000060001000200000008000204e0000002050003000000000088000080060001000a00000014000200ff0100000000000000000000000000010500030003000000060001000a00000014000200fe80000000000000000000000000002e0500030003000000060001000a00000014000200fe8000000000000000000000000000aa0500030001000000060001000200000008000200e00000020500030001000000f4000080060001000a00000014000200fe80000000000000000000000000002f0500030003000000060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200e00000010500030001000000060001000a00000014000200200100000000000000000000000000010500030001000000060001000200000008000200ac1414300500030000000000060001000200000008000200ac1e00010500030002000000060001000200000008000200000000000500030003000000060001000a00000014000200fc010000000000000000000000000000050003000200000024000100000000000000000000000000000000000000000000000000000000000000000008000100", @ANYRES32=r0], 0x378}}, 0x8050) (async, rerun: 32) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000100)=0x5) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2/binder0\x00', 0x0, 0x0) (async, rerun: 64) socket$inet6(0xa, 0xa, 0x9) (async, rerun: 64) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) r7 = socket$inet(0x2, 0xa, 0x7f) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched_retired(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001bc0)=@newtaction={0x524, 0x31, 0x69b6754e5abcd1c9, 0x70bd28, 0x25dfdbfb, {}, [{0x510, 0x1, [@m_ipt={0x34, 0x1, 0x0, 0x0, {{0x8}, {0xc, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_ipt={0x440, 0x9, 0x0, 0x0, {{0x8}, {0x2cc, 0x2, 0x0, 0x1, [@TCA_IPT_HOOK={0x8, 0x2, 0x3}, @TCA_IPT_HOOK={0x8, 0x2, 0x2}, @TCA_IPT_TARG={0x125, 0x6, {0x8, 'security\x00', 0x10, 0x0, "14ca97325fb7e94a6b114910feecc0d0aa880107b1fae20100d02367ae1046808242120e4815cfa9425fd95037c539bb7f6f546e8a2177da4dffcfd3ea538c99e4ebb217b68007ce9493880a4206b87771b357a76790df41b49ab04b53f5950f89dc4e9bb05cf4dc7b08e5a4d8b130a6aecdba4ad9e151a0e07e3924a2530ea882d5071014992a0649aa405b5048bc6065defd46809bcffc0b3eb7a8e7b973f7c7a24294fa2b177e4973bb9479f143dd8278a6a78552c942f4cc2e86ec4ad0925bfb499af4bd55d418caddd6787dd5537a7a3ea24b929cbf38c8cc2571613d9f56077f71aa3c598b34fa86a41b39265cb117be72a1c60f676c0d4f"}}, @TCA_IPT_TARG={0x17f, 0x6, {0x2000, 'mangle\x00', 0x0, 0x5, "e3a1aab3ec4f20b89bacf892280348de1ccb3ed9ab23e68fcd8a75698d6c1c7a9a5f07f61792dfd5c63c61c65f15abfc42547e1fcda33a0f49b8b354df15be94e464276ebd69fc270c7d8aaded60c06ea4a15357904f5383aea8684d76b64598ca8cc41999f871826bd4381c49c0274c0f3a504204c84e33714ab83a4ab77b75bcda16cf91e84a914f637940d38322271c6a1d2bc848abb563504cfaa289beb12a89e85edded3a3b5d7c801166fc427f155c4f542cafdf4eb6fb5c1e4bbfc3548e75395932727aef4cbf93e4b29d0aa9f0b351e8c0492823181457b312d80c1fcf585c49bd48d00ec6a81db42d87ded10dcb5afe226daed6733457f374092f83d5465e501431e7b781c35249165189a035a1df732c99e4846b8144c98ab2569c903a3d3b0b85b94845e3b86aa7269086ee6054ee93ca5a1ed7f9a497ed2ae64f87f2d574c28c58ea8f545ab4af0000000000000000"}}, @TCA_IPT_HOOK={0x8, 0x2, 0x2}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0x150, 0x6, "a55e2efce40f6bab37f04b0caa51b6227acccbc8b6cd6ea0d2a050a52cae218912c9207ee57e8b5179dc20b7d353bf46e7a4641ed1a1391abd5ac5b4c6c28408dfedfa02fa1a9a7d0949f4ddb0f8e68235606e324dfdd5e671519129362a83445ab28010d25e7b978625a6b46839558e7e7a742d4b13aff412bb50a5a1247af7fe64c92f2aaa5f85fe5b6874cf23f3e93037bb2753a871b84b49c3e9885011d8b2a1bf0a2ea3ec616dfc7c8b6faa589c2a514ac6d52c977bebb3065d1eb8dc139ba04a72da28493d3a1ba60704f04381c5ec6b032b4ecbb1d523d1b63ccd8e5051325c5e7d32265bd45d7e94bee3998dc2a062fba51c8fb0b63c7aa4b6d2484e78c079e4932cd95dd369904257c61fdbe7e7b97b149e41340bd470e5d0c5a2aa9d8c57af64e8805b6c5c87c3d3ea92e83533b9c4dfacca208f609a3965fc68c08fa0d1ce488c3feabb096d9d"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}, @m_ipt={0x98, 0x16, 0x0, 0x0, {{0x8}, {0xc, 0x2, 0x0, 0x1, [@TCA_IPT_HOOK={0x8}]}, {0x66, 0x6, "13f97bbc4ef8c6df1cbee4e7fdddda73ab3b02297f443601528d3cc7f6eb2d8b07d87c277a144105bf167f8f080104044a9d9e5e41222079de9f36294a705fb19d5bacc2460e5861218361a5218028fdef7922a2aac05ec435ea868a144218fa5327"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0x524}, 0x1, 0x0, 0x0, 0x200400a0}, 0x9080) syz_open_dev$evdev(0x0, 0x20000000, 0x0) (async) socket$packet(0x11, 0x2, 0x300) (async) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r9, &(0x7f0000000000)={0xa, 0x4e62, 0x1ff, @loopback={0x0, 0x7ffffffe}, 0x23}, 0x1c) sendmsg$sock(r7, &(0x7f0000000480)={&(0x7f0000000000)=@un=@abs={0x1, 0x0, 0x4e24}, 0x80, 0x0}, 0x2000c801) r10 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0xc0040, 0x0) ioctl$ASHMEM_SET_PROT_MASK(r10, 0x40087705, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f00000003c0)=0x11) (async) ioctl$TCGETS(r6, 0x8910, &(0x7f00000002c0)) (async, rerun: 64) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom0\x00', 0x802, 0x0) (async, rerun: 64) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r11, 0x1, 0x4c, &(0x7f000002eff0)={0x0, 0x0}, 0x10) 1.252934514s ago: executing program 1 (id=4330): r0 = memfd_secret(0x80000) ioctl$F2FS_IOC_RESIZE_FS(r0, 0x4008f510, &(0x7f0000000000)=0x4) setsockopt$MRT_ASSERT(r0, 0x0, 0xcf, &(0x7f0000000040), 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) connect$netlink(r1, &(0x7f0000000080)=@proc={0x10, 0x0, 0x25dfdbfd, 0x10}, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_NO_ENOBUFS(r1, 0x10e, 0x5, &(0x7f00000000c0)=0x8, 0x4) close_range(r1, r2, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), r0) sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x50, r3, 0x800, 0x70bd28, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DEST={0x3c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7f}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffff8e2}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x3}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x48000}, 0x24004080) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r2, 0x8983, &(0x7f0000000280)={0x6, 'vlan0\x00', {0x2}, 0x7}) madvise(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x9) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000340)={0x0, 0x0, 0x0}, &(0x7f0000000380)=0xc) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x1, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@nodevmap}, {@dfltgid={'dfltgid', 0x3d, r4}}, {@privport}, {@debug={'debug', 0x3d, 0x100000000}}], [{@obj_role={'obj_role', 0x3d, 'IPVS\x00'}}, {@dont_appraise}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@fscontext={'fscontext', 0x3d, 'system_u'}}, {@dont_measure}, {@appraise_type}, {@permit_directio}]}}) openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x280100, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000500)={0x2, 'pim6reg0\x00', {0xe}, 0x1000}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000540)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}}) r5 = syz_usb_connect$cdc_ncm(0x0, 0x75, &(0x7f0000000580)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x63, 0x2, 0x1, 0x80, 0x20, 0x10, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x7, 0x24, 0x6, 0x0, 0x1, "731d"}, {0x5, 0x24, 0x0, 0x1}, {0xd, 0x24, 0xf, 0x1, 0x101, 0xcd, 0x25af, 0xd}, {0x6, 0x24, 0x1a, 0x3, 0x8}, [@obex={0x5, 0x24, 0x15, 0x7ff}]}, {{0x9, 0x5, 0x81, 0x3, 0x10, 0x5, 0x3, 0x3}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x40, 0x68, 0x4, 0x47}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0xc, 0x52}}}}}}}]}}, &(0x7f0000000880)={0xa, &(0x7f0000000600)={0xa, 0x6, 0x300, 0x0, 0x2, 0x0, 0x10, 0x5}, 0xf2, &(0x7f0000000640)={0x5, 0xf, 0xf2, 0x5, [@generic={0xc0, 0x10, 0x3, "9b86b03c0f7c04b8154c670e44a82df3a88dc8a76286afa426783e6b377714f40b45efe5e1b59a83f396b8a76a1e3404cb414d67d042c9f81958db0fe033426588b1d9d88eabf361a5343ee95be1a0b2a515cbae973fe5aa5c72f6245a657f2aa650a2f3809f6eb9ce0757b67204d78df54c382e217701a7e2d78b50309f6e8e4e63bc27cb4057f63f82b23bb29069220db798350584ab77e44a33bf995c1fd1b76b10581ec0ec4066435462d94a0311eecf497b143727a39fa31dddc2"}, @ss_container_id={0x14, 0x10, 0x4, 0x40, "13f2eb0e2e57326da659ec5ca4a4f11d"}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0xe, 0x5}, @ext_cap={0x7, 0x10, 0x2, 0x12, 0xe, 0x3, 0x9}, @wireless={0xb, 0x10, 0x1, 0xc, 0x2, 0xc, 0x80, 0x0, 0x7}]}, 0x2, [{0x4, &(0x7f0000000740)=@lang_id={0x4, 0x3, 0x409}}, {0xf7, &(0x7f0000000780)=@string={0xf7, 0x3, "ea9dbae479c4a805f2b3e46615421d8c46fb7d4bf55529a02783a2d197b9c9931f1d991016994eb2bf7ac5775c7658ef890a396d4347ad5f9072701e8abda035b1354b4238990a2cde31beeab07ebe3a1eaadd0cfed1ba5a92e4b273d7579eae68ca5653390520385b630a498b29b3e0c4e9b086bf71bada330965f56a5b76de88c4ade36b5cfcbb7b55644b0d2b6c1164d3d73889adcd903b940f84e2868a34a682cf45ec3df1e0cb0fa0df299ee9dd375553728a960b986a38e46058ee270c766356069c3b1fd6cf7363432ede3b434cc0b796ef5f54bbeeca0a9e9ca28491adbc33e2545b9a3509664dfad97b709b6d23e61c59"}}]}) syz_usb_control_io$cdc_ncm(r5, &(0x7f0000000a00)={0x14, &(0x7f00000008c0)={0x40, 0x31, 0xbe, {0xbe, 0x8, "952ec3d295cd1f5a476d3aed5a35d26673454b61b577298777aee1812d8804d12d583dcf09e0dc61f787c7aa62b7791ffd56e6f303e293ee6ce39550295324fc48e3840828c6f4dcd43a7d7698aa08dbd425f78a99f990b2009fa75cb7e58c7dadbb3819f05d33383f600de02101d14406e3b8d6016de68e320a6a3a53793f1028930111bcabdd5f4d6b7e11e5128dd4fe635e2def9c3dcada9fb337935f54ee25877a16c2c09517f457b339677af1c19d57b05ad49fc2fb09aeefc1"}}, &(0x7f00000009c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000cc0)={0x44, &(0x7f0000000a40)={0x20, 0x15, 0x9a, "81b17246796f168120f133f6ea9d6e6dc369a169cee0b619cdf4d5f13806a88f87f84cb87ef3357b239a2da63767f557b546b700f4945170602b56bb12821854b808715a55a58bbbc6181aa438ccfc8b72868fc15754af4abb9742fdc9bc63635a35db2c998e3d269a23ddc080f77f634d245b3d30d7996cb2d1dbcaed04b3b0e0232e623f8c55169272e1c771f461f05d520ecd88095e9fdb16"}, &(0x7f0000000b00)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000b40)={0x0, 0x8, 0x1, 0x80}, &(0x7f0000000b80)={0x20, 0x80, 0x1c, {0x2, 0xe3e0, 0x2, 0x5, 0xfff7, 0x6, 0x4, 0x132a, 0x0, 0x4, 0x200, 0x9}}, &(0x7f0000000bc0)={0x20, 0x85, 0x4, 0x2}, &(0x7f0000000c00)={0x20, 0x83, 0x2}, &(0x7f0000000c40)={0x20, 0x87, 0x2}, &(0x7f0000000c80)={0x20, 0x89, 0x2}}) mknod(&(0x7f0000000d40)='./file0\x00', 0x400, 0xfffffff7) getpeername$inet(r0, &(0x7f0000000d80), &(0x7f0000000dc0)=0x10) ioctl$BTRFS_IOC_RM_DEV(r0, 0x5000940b, &(0x7f0000000e00)={{r0}, "18c71fd25e1a0d7765fb8ad97feec1de2138d9f5a95e8738cc1e6988b58fd7de40cdb9e8ba99015c6764f063ebeac6417e8b62f34bed3f29efbafc9eb7bef56ae593e78917a10abf4be46613d87b87ec63755b80c5ec44dd7c9be6c93af966b95d2611212235edba4e015f4e96c2c4c65319e9bed6c8638ecbda7e4a7a56de3c85e20168ea8d0c1d4e1f085bd570da4ddaeb74ab11c66632b9ae8e6e2ba1976e8226a32de79056204d8ff94f6b525af0deaababa416d205b1790e135a5c2e2c76ab9232a4a22519fa48d9fcf0844b1a20dd5d76367cc8d84ae2a2db3eebfe6ae168c13fa72c3f5867b4001b05a2bd07cd04cc9ce56617767a24a0155354c09b68156139f252eb84d7f2fac6ec6868f1630c821f4712115162654bdefa52745b9b7f2b312b8db98b3553050090a66021e58afe43a09acccf84604d35d26558c2f0f5e427cc03fc23162f6628b25b00bade8d8c862adb1cfb1f6b2dabdc91e3388e0f8c7cbe0f143fff0feb43a82426ac10e02b1cde83b4f91f21afdeac01d52851da8c8347a6d0b6057873de1a5b0310bd6141f27030d6bcc9e469f6ca9facb187eb184e05ee3a13120be613e4e4fcffaae0f7bbabf59721d9241f0eaacbd602778e7095996588b185734833342b4ef88f8c9c4d4d471e9a9fc9dab958a58c7b523b6040adb2da2a6c2f202aa4d145e88491aadaf74bed6060931014b2f76e483acf294a63cb0d860ec200a37ba4ffb8ac0ba4401b98571380c2c361fdb62b0ac1792c207f2c3c5d40986c93dc42caacfbbf5b89aa8f1eb59a32078ef0588d3f1ba376a07e795ae63c307dacb79b750682dedc4db1c19683da46941f7599e89237408aa277cbb2934ad818c5aac8afd55c0b9ed702a68290f1e598769ca5a20ab8ec7eb6c66ea97b6f5e27de9d5875ed010809b1421b997fa1b5325f59f9a1b179ebd9e36c80dccb6b1045977e831e62f8dda324acda2c11ecd07879b38b4082c20c0309df0ac14c01ff19087ad7183b44162a6df22fae656f2d57ffe8a20f0756af931ae61e08f38c904f9800564a6a1a1976116d0425f5c5450602e4be583e1aeed48943fcbde249603816c9e8967c32d66add6145c0cf0f1ce55affa9d166644e3e58e230b2415c5abfc3e638c04be82eff629d4804873ff3639b7fcabdac05ccef02a5e9d786799a4d1d21ad605a43d8305c0695efd51aec55d1018836ed1bf408ce909d566e76d51d8087de8b5b9ec96fc1b4891d250886a703282f144b54774cca54cc21b7f406f6392d0cd78795b7302f41833e3ddbbc940a43f61b76e2f53fc5c54e4eaf9f07ddf4ba5ab4804ef671f4ce897bfc3688bc222961bb9c62755a5133c10a2b11d81410adda276162fd28d19d9403e06db1ddc51a4fff6a15c0996204d2d5b3edd30b724aebc2cc68a8a2134bccdac2d7e6871a27bd17c24532677c0fa72747f1ab58faf7d1bdf32f02aa808eeb2e9716586ee2e2affb1e0ab36c0442f9f75632574019763e9250f2f09b7b9000db420b3714086962b42287487f9d25676260b6601e187cc5b3424db097e65e834a482999bf00049ff59b197d22a427142bee971b8fc175f130e2e8c0342466f7b0d7214a370b36b2d94cc4cae9deedf0d66dbd652a7355e2cc1ffab000e7497381cbe9fb85e681aa4be33b0c57ae989c797a6e59694b95c8fcae45bf32e1875bc218f63327438ea2ecebd0c9a8e9c0711cc6d44f5e56ead9470797f15c5cf7c651fc00aa5eb0c64fe4e04de1a3ff40470f633e95907b2d902d00721f81eb7dae4287691032556bfc9d3ca8429c1ea4289835e31d8e059d461000afe85704462bb914186a151c864854800f221c798b502720963f60e9b9fadb3f2425116e33e16f56839a4728cb8545f900961b719998f457d25adf146ea3ccce3bfd69eca14b6d27b5cc72f2c6d503de212249ebe30c7583a851a078e8ab0c2861844a93e9f7d32afb7c668f6b576795312719266519391d31d10e2d43f6fec17bc43d8716f28816512100aa4e138ed1dce9b2a6c120f9fb563718a793f1f48fbb6b686e4478718456b42a6ad3dca618a25e8dd37eedca38fe03b3bf2209fe8bb5308b5d72ed96154d8b5276760f149b8ee4cba129197e560306d37bbd9dc78a977e00e5727e74db2fd29fd46139071ff5a1d54729bc5de19f3704fca0207cdc231a375aa82024cece9f4fb77748d28285fa499ad55056daec3c8ac2f6bda9c77d3803ba1d8f3094e263f48b29a954f10fcd97263119954d398f0c92148e41bea1b2a9573e646bcc4e6964f6c18676120093796983d8936ed30eb76ad484c822e0dba2c8c701a39bec17348318e3b916dbdd989d8dd15e15724b95dcce0db85a95cca2a937405b444445e9678ff8198609eb5152fe89533e767f497d600155dc8274c0013a1b69238505371d47898d1e0cee1f9f72606708afe685906c04bf9ed8e682e4cb2fb4eb73251eea61fb56c3569f1f795e594b538a680eb859321f0f5b8fdc0514aad5685188ed652609810296ff2c9981fbf8e334992e35ad6de75ccf28836c92ebd55414c68a93af9d1c5da5cc03f7dbc4e6f91e1cf63a80be507a83d2574151275c67854aed5102eb9df7a9112743f11cf27f2a72ef121b56a9c70081a914c473a0fe5d7bd4789eb1bae9f13dd15d8fc6aa4ee9cc6ef24ce197260a67a7cf954cecbbd8e82b4db32904d7550d452e18ee2239cb5cf0fe7df412dd4bfd3bcc7eed37d1bfc97451520406c8f0a13e3c422b983daf136a581b5cc6558363c802ae5bb108faf972104273df86fedc50a31dbfaf1175258e2fb853a1fea24771f997558b62850665e0f7d3a9e0c5f20ce7fe043cf6cc814252e160ccc2978426266bd66fac848b124ccbe813fbf90e269d261e963baf6a3071672a894c7dff5d7111f3804f975ef3f202537689bb4cfc024a5d14d357c885ac9dae18c18e212976d571ea248470936c399559df5f4f83806acf7d5f6e68c6aafeda663575aa06a9c265f81241ca57505b2266af78e5c8c2d122653035627884991b9dee043898797da49568ee3973d64b1f642d2043f27d2fec27d8e863ab11fb5ce0820f58b762bd5983149dbfd82aa7d2e5229ae3137ce6142a6160cc6b98efa3c2a87b9a087c90adf7d697041a3bee917ec6f8fcdd5bdb31ca8417b26446951aa6b052a19517a4b14b9b38b9b89703616a8ddc3ad50fdae56b0dbe2ae323fea03e4fad689b44285958814cb5f8d24b0ae6c6bde8e714bfcf04e62bce08725e11c4a660c91f60b89f322b40e677780ae438962a8d9edfd1890c20261cff6ff6b1e25f603e31c7220f4897f866b2e7a7f4717f609d9a87c020c5649c8328ecae48a4a55f2b44982b4037ced85bddeca47fdcfd24a2438895bb592cab600ff4be428f35c7fc526baeb6767a06cff61811b56933ba0830643e54ada385d463f4849b99e7ff879543a47c53ad23d5b4bdfd894499a336acb87fafc8bd878cd1f37151a9f5a433f7e7e0871287ed3534fa4a9a8db3e65cf798433aece1a2f606571d75b7792ea0cc62a8c7eda37c32f0177fa9f1fbcda7dfbe05d6eb06e829b8369b263eb67b180753ed02c72ad7228c4537f5692ee0db94dd6fc086f7a4a71e043f01507a3a75fb857060d7ffdf9dde5af62da8c372c16c3d1057b0b750df163fcbbce2daddac7726255ceb81369c0de733a0a2b8417d262fdb6f0615294ac9945864b708f386c3f65e3fdd59ffaedfe4d4b2449db385c87ab6c17be73908dd35073dbc4aec7213657c160ae08baf52125834cc3a72c40e9cc8c389de428c6c93b63a76e754e38f15e6188922141940ad89ee7ae9378307f00321cbb205ea70a38853beba33a9d06f2e77c20a77eedd2d15e7f112eb7d06c90a55c747fa55c9de05e87891fc7ec6653cd8a3db1b16dc41768192e7cd111dec5ec0a0d6072754eb64602c0154750a8d0788eb88b6c04450098048d9999e84ed68177427e732bb6be8fa9de4c8f958358b67a72e0bbee2fca5add8597707d1c6b74af4efa233e473759cedfb6507e910fe5be2e971097619a1364abf15b2ac420b906a99bc19bffc9771e04010dcb14e7923e042db121d049f4f2b74f1daab83b56315f927f8212e069958b556c2e67119e8fccccda080d8194fc3d6c88b51e4ee8846310d7b1f58d44a843c68b49b20ac116b7234f574048827a9e784ff6b5f36ab8d15b54d05fef62e83ca147c2b23304af0940dd3c725236540e36c8732762a77a47d7a87e38b6fa51dc91f3de8b57f80cfce07f06ddb936f2c329a2ce304b9ea8c39af8f1b60ed0079926f5254c258a26dc4abcbd54274b8f9cf37f13d8a3cd036730598b3c5a1b385fd1d817675647aaf516d2c2d060676be7431b0819b7068494a240215f0625d16f6fa337a7a9ea4ee6122925b541d7798aba344c5fef7d952db032930014fefecb5c71d169944c2bb31cc486ef7e20090d12ba5ba211f001b84e9e9264c15ffb965faed601be48d62f5970653274baf5cdb76c30006d8ca904d9bd3e04c850c2aa1734fa17741da097ccd1b6252f976f2c5b98ed4669fa22684cd0e99cc794f20ad6e48e5c98f14057cc48521dab13acc475fecf6d1f4bc2229acdb08de52dfa03d657fecae9c3568202ccc9a3bc03bdf909d1ddaa189095f025a748414160a5671162932d92d331ca052f02ca54f57f9a115674267e4246473af2c7f5da633733d6918605bf20eeabe61d2b5d9bd92c6617a145a80cb2bc299a7270a32fe8f08aaf30815ce6414335460f0539c820544e418182fd94b3f7af588878dcfc43978ed20adc1dd77e36219ab5779498198b976545bfa8ea0b8faa26487b457e28fe559ca73eb3588c63e2743ccd5cbf9fe49206dccb41756e97d05397b79c8b439aac1e36fd3fe52cba4014701fd8172cfcb30641f81ad07ac73c5968d17f9c4d9c703a27add5d9a7fe4f1a6ea03290ba4c4128819cc9b2ca50d2d74f5a3387419e0131a466e10bae178ffda2db3222e26a678c8b754db26d26665ab4c157e7644784845384e76c2e48b9407ce891c4bbfe1db6071787974aa58c1ed58ef12c3d3221e2d309a72b2e4c87257765192c2f716dfb49b8e9ac3967c5546456e257edb5be59f52c9da118af9da9a05029d921ab1a2c7e60ccfa8e04de2e37c51409d0b97a4366cda888ba8f426b16dc9f278bdf8b0ee5e280eadbe5677a25f2d1afd1785c707dac15f09501a57ce919dbadea104170a5c0f5badc200523969cd482900e53363e84742bc355aafa784df87405ce54e06a95edbd7b596b73a87134d615f85825d7ab8d67fc2de300df5850a0a55bae2b96cabfc6db604deeacd362928b50abeffe825b1288f9aa423d81cfee7c0e566e61a5d36db5b2f14c3ba7a483e48c829b86a2e96a5304f33810d9f1ee5690a21d7299ede28e9794892919af26b6c6d5024564af78d8a271d470f33905d901a820b24029f2ed50e655d6044b46263348c4f914a1ac02bc6a911e0812e515e6bf8f37a0442d3609d444f1e291897f89bc7cbfabf2a02b580a0d31011a0a896acad1b78d4ceace02c934330cb7035fbeb61c94eba2a0d887cb84a6838eabdc3790fdb526b8c8acbf9b18ec8c48c39e74c071f101a637fe12671429cf65f4d6de4fd5b83b18272372ae327255493b0b93a15fbc876d6bf39df321ea3d0a4d61ad5e9de47f9699f6a6542c7b25d7789efbf7556949224b29bdd58abc089201771e5787bb40f8caa9594d41f9da0d1388282c8c6ca18bff27f6c762"}) setsockopt$CAN_RAW_FD_FRAMES(r0, 0x65, 0x5, &(0x7f0000001e00)=0x1, 0x4) stat(&(0x7f0000001e40)='./file0\x00', &(0x7f0000001e80)) clock_gettime(0x2, &(0x7f0000001f00)) ioctl$FITHAW(r2, 0xc0045878) r6 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000001f40), 0x1, 0x0) ioctl$PPPIOCGIDLE32(r6, 0x8008743f, &(0x7f0000001f80)) r7 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000001fc0), 0x0, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r7, 0xc0c89425, &(0x7f0000002240)={"ef772c996b12141e0c7375ef49512c83", 0x0, 0x0, {0x1, 0x80000000}, {0x2, 0x63a}, 0xfffffffffffffeff, [0xffffffffffffff04, 0x1, 0x3, 0x18264a15, 0x600, 0x3ff, 0x7fffffff, 0x5, 0xf, 0x1, 0x8, 0x4, 0x3, 0xf79, 0x8001, 0x1]}) 1.212207505s ago: executing program 4 (id=4331): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000043000100000000000000000002004000140001"], 0x28}}, 0x0) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000043000100000000000000000002004000140001"], 0x28}}, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x6082, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5}, 0x0) ioprio_set$pid(0x1, 0x0, 0x4007) (async) ioprio_set$pid(0x1, 0x0, 0x4007) sendfile(r1, r1, 0x0, 0x1000007fd) 232.082719ms ago: executing program 4 (id=4332): r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_X86_SETUP_MCE(r0, 0x4008ae9c, &(0x7f0000000000)={0x12, 0x6, 0x7}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4c, 0x4c, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 231.225559ms ago: executing program 4 (id=4333): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) setsockopt$MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f0000000280)={{0xa, 0x4e21, 0x7fffffff, @remote, 0x8}, {0xa, 0x4e21, 0x7, @private0, 0x1ff}, 0xffffffffffffffff, {[0x3, 0x800, 0x63, 0xde9, 0x9, 0x7, 0x8]}}, 0x5c) write$tun(0xffffffffffffffff, &(0x7f0000000540)=ANY=[@ANYBLOB="00006003ffffffffffffbbbbbbbbbbbb08004500001c0068e0000a2f9078ffffffffd81c91673bbbba87000890121085751e2e1c0f48b6ed3cc7bc33ac5184f94aa52d891aec991d08908116f299fb6ce841b23aa6a038507d1f1b2d3b0addb35001ae99fe7e00"/114], 0x2e) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240), r3) sendmsg$IPVS_CMD_SET_SERVICE(r3, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000300)={&(0x7f0000000600)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="00032dbd7000ffdbdf2502000000200001800c00070004000000390000000800090072000000080005000300000008000500000000000c000180060001000a0000001400018008000800ffffffff08000b00736970007a0361ee6e5a43b1c1a7d966993fe7b2d6ab462556ef575a6ad1727a2816f61aff69096e4b3195228a2b495e540599bd6b1be509ea9ebaf4d37b518af7f761474285dae9a2d32d884bc7cd35ca618ae4a2a298fa5a2e774564d25cf322e765b721ffd411abd1fab8fa58720ed583fe071fcc12ea3565fa2226ad0bc353561c14efb4d6f5377431c5c2e3b58bd4f834d2c15bf1b217f39fa3e9005906a0661633"], 0x5c}}, 0x4000080) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) lstat(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="640100004a000102"], 0x164}}, 0x0) quotactl_fd$Q_GETINFO(0xffffffffffffffff, 0xffffffff80000501, r5, &(0x7f0000000500)) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1000, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000040)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x7b, &(0x7f0000000100)={@flat=@weak_binder, @flat=@binder={0x73622a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0x100a, 0x1003}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs2/binder0\x00', 0x0, 0x0) 192.51274ms ago: executing program 4 (id=4334): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r1, &(0x7f0000000000)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x8) (async) bind$bt_sco(r1, &(0x7f0000000000)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x8) listen(r1, 0x3) socketpair(0xf, 0x3, 0x2, &(0x7f0000003b40)) (async) socketpair(0xf, 0x3, 0x2, &(0x7f0000003b40)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000040)=[@request_death], 0x4d, 0x0, 0x0}) 117.32453ms ago: executing program 4 (id=4335): mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000, 0x3, &(0x7f0000ffc000/0x2000)=nil) r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$setperm(0x5, r0, 0x70505) add_key$keyring(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x2}, 0x0, 0x0, r0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x20a00, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r2, &(0x7f0000000000)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x8) listen(r2, 0x3) preadv2(r1, &(0x7f0000000580)=[{&(0x7f0000000000)=""/113, 0x71}, {0x0}, {0x0}], 0x3, 0x9, 0xd, 0x9) 0s ago: executing program 4 (id=4336): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x138a, 0x1000000003}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = dup(r2) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="5e54e574da93883e8c628a600b17cbe584d2e73c68141965f3fbcf0e16db6e759d", 0x21}], 0x1}}], 0x1, 0x40) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f0000000640)={0x0, 0xd000}) ioctl$KVM_NMI(r4, 0xae9a) ioctl$KVM_RUN(r4, 0xae80, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000002, 0x28011, r0, 0xffff8000) kernel console output (not intermixed with test programs): 3*128kB (M) 4*256kB (M) 4*512kB (M) 5*1024kB (UM) 5*2048kB (M) 718*4096kB (M) = 2960212kB [ 209.057160][ T9742] Normal: 638*4kB (UME) 684*8kB (UME) 654*16kB (UE) 310*32kB (UE) 367*64kB (UME) 28*128kB (UE) 8*256kB (UE) 6*512kB (UE) 4*1024kB (UE) 3*2048kB (UME) 635*4096kB (UM) = 2671800kB [ 209.076394][ T9742] 103830 total pagecache pages [ 209.082246][ T9742] 57 pages in swap cache [ 209.083969][ T360] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 209.086906][ T9742] Free swap = 124360kB [ 209.109572][ T9742] Total swap = 124996kB [ 209.114565][ T9742] 2097051 pages RAM [ 209.119450][ T9742] 0 pages HighMem/MovableOnly [ 209.124283][ T9742] 351537 pages reserved [ 209.128588][ T9742] 0 pages cma reserved [ 209.135266][ T9742] Memory allocations: [ 209.139476][ T9742] 0 B 0 init/main.c:1370 func:do_initcalls [ 209.147393][ T9742] 0 B 0 init/do_mounts.c:186 func:mount_root_generic [ 209.155626][ T9742] 0 B 0 init/do_mounts.c:158 func:do_mount_root [ 209.163467][ T9742] 0 B 0 init/do_mounts.c:352 func:mount_nodev_root [ 209.171450][ T9742] 0 B 0 init/do_mounts_rd.c:241 func:rd_load_image [ 209.179524][ T9742] 0 B 0 init/do_mounts_rd.c:72 func:identify_ramdisk_image [ 209.189449][ T9742] 0 B 0 init/initramfs.c:507 func:unpack_to_rootfs [ 209.197491][ T9742] 0 B 0 init/initramfs.c:508 func:unpack_to_rootfs [ 209.205807][ T9742] 0 B 0 init/initramfs.c:509 func:unpack_to_rootfs [ 209.214130][ T9742] 0 B 0 init/initramfs.c:101 func:find_link [ 209.234290][ T331] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 209.267472][ T331] usb 1-1: device descriptor read/8, error -71 [ 209.282593][ T360] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 209.305394][ T360] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 209.317954][ T360] usb 5-1: New USB device found, idVendor=256c, idProduct=006e, bcdDevice= 0.00 [ 209.339950][ T360] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.349037][ T360] usb 5-1: config 0 descriptor?? [ 209.394433][ T9765] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 209.394774][ T9765] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 209.403475][ T9765] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 209.415380][ T9765] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:154 [ 209.415440][ T331] usb 1-1: device descriptor read/8, error -71 [ 209.563786][ T331] usb usb1-port1: unable to enumerate USB device [ 209.577643][ T360] usbhid 5-1:0.0: can't add hid device: -71 [ 209.583867][ T360] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 209.606619][ T360] usb 5-1: USB disconnect, device number 18 [ 210.139280][ T1377] tipc: Node number set to 2132934940 [ 210.241151][ T9775] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 210.250466][ T9775] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 210.491114][ T360] usb 5-1: new full-speed USB device number 19 using dummy_hcd [ 210.587026][ T1377] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 210.664666][ T360] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 210.672398][ T360] usb 5-1: can't read configurations, error -71 [ 210.746953][ T1377] usb 1-1: Using ep0 maxpacket: 16 [ 210.753956][ T1377] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 210.765128][ T1377] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 210.776801][ T1377] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 210.790734][ T1377] usb 1-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 210.799792][ T1377] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 210.809189][ T1377] usb 1-1: config 0 descriptor?? [ 211.031241][ T1377] input: HID 05ac:8241 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:05AC:8241.000E/input/input27 [ 211.050664][ T1377] appleir 0003:05AC:8241.000E: input,hiddev96,hidraw0: USB HID v0.00 Device [HID 05ac:8241] on usb-dummy_hcd.0-1/input0 [ 211.243553][ T9769] overlay: Unknown parameter '/' [ 211.309160][ T9786] rust_binder: Error while translating object. [ 211.309189][ T9786] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 211.315622][ T9786] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:441 [ 211.575197][ T36] kauditd_printk_skb: 37 callbacks suppressed [ 211.575220][ T36] audit: type=1400 audit(200.769:925): avc: denied { read write } for pid=9398 comm="syz-executor" name="loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 211.615255][ T36] audit: type=1400 audit(200.769:926): avc: denied { read write open } for pid=9398 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 211.664087][ T36] audit: type=1400 audit(200.769:927): avc: denied { ioctl } for pid=9398 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 211.691866][ T36] audit: type=1400 audit(200.787:928): avc: denied { read write } for pid=9795 comm="syz.4.3157" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 211.723394][ T36] audit: type=1400 audit(200.787:929): avc: denied { read write open } for pid=9795 comm="syz.4.3157" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 211.749537][ T36] audit: type=1400 audit(200.787:930): avc: denied { name_bind } for pid=9795 comm="syz.4.3157" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 211.770849][ T36] audit: type=1400 audit(200.787:931): avc: denied { node_bind } for pid=9795 comm="syz.4.3157" saddr=fe80::2d src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 211.792659][ T36] audit: type=1400 audit(200.787:932): avc: denied { name_bind } for pid=9795 comm="syz.4.3157" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 211.814915][ T36] audit: type=1400 audit(200.787:933): avc: denied { node_bind } for pid=9795 comm="syz.4.3157" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 211.835428][ T36] audit: type=1400 audit(200.806:934): avc: denied { read write } for pid=9795 comm="syz.4.3157" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 212.175407][ T360] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 212.338405][ T360] usb 5-1: Using ep0 maxpacket: 16 [ 212.352211][ T360] usb 5-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 212.364282][ T360] usb 5-1: config 0 interface 0 has no altsetting 0 [ 212.371741][ T360] usb 5-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 212.380985][ T360] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 212.392416][ T360] usb 5-1: config 0 descriptor?? [ 212.639827][ T9820] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3164'. [ 212.674555][ T360] usbhid 5-1:0.0: can't add hid device: -71 [ 212.684933][ T360] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 212.688523][ T9820] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 212.703232][ T9820] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 212.709186][ T360] usb 5-1: USB disconnect, device number 21 [ 212.711053][ T9820] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:157 [ 212.777469][ T9823] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:159 [ 212.826600][ T9825] incfs: Error accessing: ./file0. [ 212.841451][ T9825] incfs: mount failed -20 [ 212.852594][ T9825] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 212.853743][ T9825] netlink: 'syz.6.3166': attribute type 1 has an invalid length. [ 212.869066][ T9825] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:161 [ 212.870680][ T9825] rust_binder: Failed to allocate buffer. len:5192, is_oneway:false [ 212.880608][ T9825] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 212.888775][ T9825] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:161 [ 213.110345][ T9835] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 213.125821][ T9835] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 213.166685][ T9840] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3171'. [ 213.182736][ T9841] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3171'. [ 213.192563][ T9840] binder: Bad value for 'max' [ 213.227659][ T9843] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 213.228369][ T9843] rust_binder: Failed to allocate buffer. len:1168, is_oneway:true [ 213.245137][ T9843] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 213.266033][ T9843] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:179 [ 213.305976][ T9848] rust_binder: inc_ref_done called when no active inc_refs [ 213.337073][ T9850] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3176'. [ 213.432801][ T384] usb 1-1: USB disconnect, device number 59 [ 213.771785][ T9884] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 213.828746][ T9887] rust_binder: 193: no such ref 3 [ 213.843584][ T9887] rust_binder: inc_ref_done called when no active inc_refs [ 213.843613][ T9887] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 213.858510][ T9887] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:193 [ 213.903307][ T9888] rust_binder: Write failure EFAULT in pid:447 [ 214.626765][ T9926] random: crng reseeded on system resumption [ 214.662812][ T62] usb 5-1: new full-speed USB device number 22 using dummy_hcd [ 214.834688][ T62] usb 5-1: not running at top speed; connect to a high speed hub [ 214.852738][ T62] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 214.893958][ T62] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 214.914335][ T62] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 214.947080][ T62] usb 5-1: Product: ⠉ [ 214.951299][ T62] usb 5-1: Manufacturer: 㐉 [ 214.955899][ T62] usb 5-1: SerialNumber: ᧾渵ꈠ躎듭ꖟ겅縜謉は戻ﲖ딅᰹⃪擮꛵➘﫬簇﹭曆䏉冘⨐㶈牂棁侘Κ픺劖叐宕륌鐃㡒锪혪풑쭋樻澊綀컅툃Ŋ焽娪歩⤉ﳓ᎘暴떀獣ᆛ㰔㩄虿騊抲泋䘍쯔륝轍䵲鸨䷀뀆⺭ὗ鱗垊鸕瀄ᗃ쬦⪞䘇挤喃曘ⶎ龘ꓪ，鮕 [ 214.956589][ T9940] fuse: Unknown parameter '0x00000000000000070x0000000000000007' [ 215.107647][ T9943] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 152, size: 18446744073709551507) [ 215.107673][ T9943] rust_binder: Error while translating object. [ 215.125167][ T9943] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 215.131648][ T9943] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:457 [ 215.489261][ T62] usb 5-1: USB disconnect, device number 22 [ 215.772841][ T9967] rust_binder: 467: no such ref 1 [ 216.192937][ T9983] overlayfs: failed to clone upperpath [ 216.215546][ T1377] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 216.239268][ T9988] netlink: 'syz.1.3220': attribute type 7 has an invalid length. [ 216.247077][ T9988] netlink: 'syz.1.3220': attribute type 5 has an invalid length. [ 216.255058][ T9988] netlink: 17 bytes leftover after parsing attributes in process `syz.1.3220'. [ 216.285751][ T9990] overlayfs: failed to clone lowerpath [ 216.375421][ T1377] usb 1-1: Using ep0 maxpacket: 8 [ 216.388693][ T1377] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 216.409807][ T1377] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 216.429909][ T1377] usb 1-1: New USB device found, idVendor=5543, idProduct=0064, bcdDevice= 0.00 [ 216.448962][ T1377] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 216.468716][ T1377] usb 1-1: config 0 descriptor?? [ 216.702329][ T1377] uclogic 0003:5543:0064.000F: unknown main item tag 0x0 [ 216.717411][ T1377] uclogic 0003:5543:0064.000F: unknown main item tag 0x0 [ 216.725915][ T1377] uclogic 0003:5543:0064.000F: unknown main item tag 0x0 [ 216.736640][ T1377] uclogic 0003:5543:0064.000F: unknown main item tag 0x0 [ 216.753398][T10017] overlayfs: failed to clone lowerpath [ 216.758634][ T1377] uclogic 0003:5543:0064.000F: unknown main item tag 0x0 [ 216.766381][ T1377] uclogic 0003:5543:0064.000F: unknown main item tag 0x0 [ 216.773487][ T1377] uclogic 0003:5543:0064.000F: unknown main item tag 0x0 [ 216.780839][ T1377] uclogic 0003:5543:0064.000F: No inputs registered, leaving [ 216.803360][ T1377] uclogic 0003:5543:0064.000F: hidraw0: USB HID v0.01 Device [HID 5543:0064] on usb-dummy_hcd.0-1/input0 [ 216.908948][ T36] kauditd_printk_skb: 623 callbacks suppressed [ 216.908967][ T36] audit: type=1400 audit(205.778:1558): avc: denied { create } for pid=10026 comm="syz.1.3232" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 216.916628][ T9975] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 216.944619][ T36] audit: type=1400 audit(205.778:1559): avc: denied { read write } for pid=9973 comm="syz.0.3216" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 216.970223][ T36] audit: type=1400 audit(205.778:1560): avc: denied { read write open } for pid=9973 comm="syz.0.3216" path="/dev/raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 217.022634][ T9975] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 217.044965][ T36] audit: type=1400 audit(205.778:1561): avc: denied { ioctl } for pid=9973 comm="syz.0.3216" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 217.049189][ T9974] 9pnet_fd: Insufficient options for proto=fd [ 217.072625][ T36] audit: type=1400 audit(205.778:1562): avc: denied { ioctl } for pid=9973 comm="syz.0.3216" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 217.101838][ T384] usb 1-1: USB disconnect, device number 60 [ 217.174998][ T36] audit: type=1400 audit(205.806:1563): avc: denied { read } for pid=10027 comm="syz.6.3233" name="binder0" dev="binder" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 217.228179][ T36] audit: type=1400 audit(205.806:1564): avc: denied { read open } for pid=10027 comm="syz.6.3233" path="/dev/binderfs/binder0" dev="binder" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 217.263231][ T36] audit: type=1400 audit(205.806:1565): avc: denied { read } for pid=10027 comm="syz.6.3233" name="binder0" dev="binder" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 217.299758][ T36] audit: type=1400 audit(205.806:1566): avc: denied { read open } for pid=10027 comm="syz.6.3233" path="/dev/binderfs/binder0" dev="binder" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 217.335076][ T36] audit: type=1400 audit(205.806:1567): avc: denied { read write } for pid=10027 comm="syz.6.3233" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 217.704770][T10062] rust_binder: Error while translating object. [ 217.704809][T10062] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 217.712055][T10062] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:130 [ 217.736072][T10064] rust_binder: Error while translating object. [ 217.736113][T10064] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 217.743057][T10062] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 217.752872][T10064] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:130 [ 217.809368][T10066] 9pnet_fd: Insufficient options for proto=fd [ 218.081079][ T384] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 218.155718][ T1377] usb 5-1: new low-speed USB device number 23 using dummy_hcd [ 218.251639][ T384] usb 1-1: Using ep0 maxpacket: 32 [ 218.258700][ T384] usb 1-1: config 0 has an invalid interface number: 35 but max is 0 [ 218.266952][ T384] usb 1-1: config 0 has no interface number 0 [ 218.276043][ T384] usb 1-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.8f [ 218.285226][ T384] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.293222][ T384] usb 1-1: Product: syz [ 218.297426][ T384] usb 1-1: Manufacturer: syz [ 218.302027][ T384] usb 1-1: SerialNumber: syz [ 218.308117][ T384] usb 1-1: config 0 descriptor?? [ 218.329072][ T1377] usb 5-1: invalid descriptor for config index 0: type = 0x2, length = 4 [ 218.337825][ T1377] usb 5-1: can't read configurations, error -22 [ 218.475636][ T1377] usb 5-1: new low-speed USB device number 24 using dummy_hcd [ 218.637960][ T1377] usb 5-1: invalid descriptor for config index 0: type = 0x2, length = 4 [ 218.651049][ T1377] usb 5-1: can't read configurations, error -22 [ 218.658542][ T1377] usb usb5-port1: attempt power cycle [ 219.019320][ T1377] usb 5-1: new low-speed USB device number 25 using dummy_hcd [ 219.044246][ T1377] usb 5-1: invalid descriptor for config index 0: type = 0x2, length = 4 [ 219.052974][ T1377] usb 5-1: can't read configurations, error -22 [ 219.071584][ T384] usb 1-1: USB disconnect, device number 61 [ 219.189766][ T1377] usb 5-1: new low-speed USB device number 26 using dummy_hcd [ 219.214604][ T1377] usb 5-1: invalid descriptor for config index 0: type = 0x2, length = 4 [ 219.223203][ T1377] usb 5-1: can't read configurations, error -22 [ 219.229647][ T1377] usb usb5-port1: unable to enumerate USB device [ 219.445593][ T384] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 219.605513][ T384] usb 1-1: Using ep0 maxpacket: 32 [ 219.613074][ T384] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 219.624872][ T384] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 219.635389][ T384] usb 1-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 219.648637][ T384] usb 1-1: config 0 interface 0 has no altsetting 0 [ 219.655265][ T384] usb 1-1: New USB device found, idVendor=5543, idProduct=004d, bcdDevice= 0.00 [ 219.664860][ T384] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 219.674962][ T384] usb 1-1: config 0 descriptor?? [ 220.146063][T10096] fuse: Bad value for 'rootmode' [ 220.210909][T10097] 9pnet_fd: Insufficient options for proto=fd [ 220.297759][T10101] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3256'. [ 220.331992][ T384] usbhid 1-1:0.0: can't add hid device: -71 [ 220.341016][ T384] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 220.364728][ T384] usb 1-1: USB disconnect, device number 62 [ 220.458040][T10113] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found [ 220.473691][T10113] rust_binder: Write failure EINVAL in pid:240 [ 220.479875][T10116] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found [ 220.495607][T10116] rust_binder: Write failure EINVAL in pid:240 [ 220.589654][T10126] rust_binder: Write failure EFAULT in pid:247 [ 220.641027][T10132] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 220.650429][T10130] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 220.658148][T10132] overlayfs: missing 'lowerdir' [ 220.749223][T10141] netlink: 'syz.1.3268': attribute type 4 has an invalid length. [ 220.795269][T10141] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=10141 comm=syz.1.3268 [ 220.802616][T10130] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 220.807853][T10130] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:250 [ 221.007929][T10156] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3274'. [ 221.131661][T10168] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 221.174797][T10168] rust_binder: Failed to allocate buffer. len:4256, is_oneway:false [ 221.181274][T10168] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 221.191053][T10168] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:262 [ 221.325181][T10172] netlink: 'syz.6.3281': attribute type 11 has an invalid length. [ 221.450044][T10179] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 221.473447][T10179] rust_binder: Failed to allocate buffer. len:1168, is_oneway:true [ 221.483941][T10179] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 221.491926][T10179] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:266 [ 221.609439][ T360] usb 1-1: new full-speed USB device number 63 using dummy_hcd [ 221.728560][T10192] netlink: 'syz.6.3287': attribute type 29 has an invalid length. [ 221.741035][T10192] netlink: 64138 bytes leftover after parsing attributes in process `syz.6.3287'. [ 221.822628][ T360] usb 1-1: device descriptor read/64, error -71 [ 221.971856][ T1377] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 222.078749][ T360] usb 1-1: device descriptor read/64, error -71 [ 222.142450][ T1377] usb 5-1: Using ep0 maxpacket: 32 [ 222.151927][ T1377] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 222.162887][ T1377] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 222.172673][ T1377] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 222.181737][ T1377] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 222.190980][ T1377] usb 5-1: config 0 descriptor?? [ 222.206869][ T1377] hub 5-1:0.0: USB hub found [ 222.273687][ T36] kauditd_printk_skb: 699 callbacks suppressed [ 222.273705][ T36] audit: type=1400 audit(2000000001.313:2267): avc: denied { create } for pid=10208 comm="syz.1.3292" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 222.300661][ T36] audit: type=1400 audit(2000000001.313:2268): avc: denied { write } for pid=10208 comm="syz.1.3292" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 222.321274][ T36] audit: type=1400 audit(2000000001.322:2270): avc: denied { ioctl } for pid=10174 comm="syz.0.3280" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 222.346364][ T36] audit: type=1400 audit(2000000001.313:2269): avc: denied { ioctl } for pid=10208 comm="syz.1.3292" path="socket:[40835]" dev="sockfs" ino=40835 ioctlcmd=0x9425 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 222.355572][ T360] usb 1-1: new full-speed USB device number 64 using dummy_hcd [ 222.372356][ T36] audit: type=1400 audit(2000000001.322:2271): avc: denied { create } for pid=10208 comm="syz.1.3292" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 222.400436][ T36] audit: type=1400 audit(2000000001.322:2272): avc: denied { write } for pid=10208 comm="syz.1.3292" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 222.423192][ T36] audit: type=1400 audit(2000000001.322:2273): avc: denied { read } for pid=10208 comm="syz.1.3292" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 222.444174][ T36] audit: type=1400 audit(2000000001.322:2274): avc: denied { read } for pid=10208 comm="syz.1.3292" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 222.466495][ T1377] hub 5-1:0.0: config failed, can't read hub descriptor (err -22) [ 222.480838][ C0] raw-gadget.1 gadget.4: ignoring, device is not running [ 222.498134][ T1377] usbhid 5-1:0.0: can't add hid device: -71 [ 222.519662][ T1377] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 222.522933][T10223] tmpfs: Bad value for 'nr_inodes' [ 222.536743][ T36] audit: type=1400 audit(2000000001.351:2275): avc: denied { create } for pid=10210 comm="syz.1.3293" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 222.545124][ T360] usb 1-1: device descriptor read/64, error -71 [ 222.563519][ T36] audit: type=1400 audit(2000000001.351:2276): avc: denied { mount } for pid=10210 comm="syz.1.3293" name="/" dev="configfs" ino=2202 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 222.586998][ T1377] usb 5-1: USB disconnect, device number 27 [ 222.672875][T10233] overlayfs: missing 'lowerdir' [ 222.867210][ T360] usb 1-1: device descriptor read/64, error -71 [ 222.920487][ T1377] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 222.984847][ T360] usb usb1-port1: attempt power cycle [ 223.082379][ T1377] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 223.093377][ T1377] usb 5-1: New USB device found, idVendor=0c12, idProduct=0005, bcdDevice= 0.00 [ 223.102449][ T1377] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 223.111650][ T1377] usb 5-1: config 0 descriptor?? [ 223.346841][ T360] usb 1-1: new full-speed USB device number 65 using dummy_hcd [ 223.370773][ T360] usb 1-1: device descriptor read/8, error -71 [ 223.509405][ T360] usb 1-1: device descriptor read/8, error -71 [ 223.549359][ T1377] zeroplus 0003:0C12:0005.0010: unknown main item tag 0x5 [ 223.558577][ T1377] zeroplus 0003:0C12:0005.0010: hidraw0: USB HID v0.02 Device [HID 0c12:0005] on usb-dummy_hcd.4-1/input0 [ 223.570814][ T1377] zeroplus 0003:0C12:0005.0010: no inputs found [ 223.762385][ T1377] usb 5-1: USB disconnect, device number 28 [ 223.762530][ T360] usb 1-1: new full-speed USB device number 66 using dummy_hcd [ 223.798042][ T360] usb 1-1: device descriptor read/8, error -71 [ 223.844906][T10243] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3304'. [ 223.946035][ T360] usb 1-1: device descriptor read/8, error -71 [ 224.061088][ T360] usb usb1-port1: unable to enumerate USB device [ 224.586973][ T1377] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 224.753765][ T1377] usb 5-1: Using ep0 maxpacket: 32 [ 224.770937][ T1377] usb 5-1: config 0 has an invalid interface number: 214 but max is 0 [ 224.785721][ T1377] usb 5-1: config 0 has no interface number 0 [ 224.791931][ T1377] usb 5-1: config 0 interface 214 has no altsetting 0 [ 224.816516][ T1377] usb 5-1: New USB device found, idVendor=07c9, idProduct=000e, bcdDevice=5d.4f [ 224.828385][ T1377] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 224.838134][ T1377] usb 5-1: Product: syz [ 224.843159][ T1377] usb 5-1: Manufacturer: syz [ 224.846334][T10278] 9pnet_fd: Insufficient options for proto=fd [ 224.847788][ T1377] usb 5-1: SerialNumber: syz [ 224.861941][ T1377] usb 5-1: config 0 descriptor?? [ 224.883224][ T1377] ax88179_178a 5-1:0.214: probe with driver ax88179_178a failed with error -22 [ 225.662359][T10307] 9pnet_fd: Insufficient options for proto=fd [ 225.837807][T10321] 9pnet_virtio: no channels available for device syz [ 225.994072][T10327] veth0_virt_wifi: mtu less than device minimum [ 226.036134][T10331] rust_binder: Write failure EINVAL in pid:521 [ 226.124157][T10334] rust_binder: 523: no such ref 1 [ 226.481106][T10346] SELinux: Context system_u:object_r:apt_var_log_t:s0 is not valid (left unmapped). [ 227.512613][T10378] batadv_slave_1: entered promiscuous mode [ 227.522067][T10377] batadv_slave_1: left promiscuous mode [ 227.596039][ T384] usb 5-1: USB disconnect, device number 29 [ 227.631477][ T36] kauditd_printk_skb: 542 callbacks suppressed [ 227.631495][ T36] audit: type=1400 audit(2000000006.332:2819): avc: denied { read write } for pid=10387 comm="syz.4.3351" name="binder1" dev="binder" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 227.716616][ T36] audit: type=1400 audit(2000000006.360:2820): avc: denied { read write open } for pid=10387 comm="syz.4.3351" path="/dev/binderfs/binder1" dev="binder" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 227.766546][ T36] audit: type=1400 audit(2000000006.370:2821): avc: denied { read } for pid=10387 comm="syz.4.3351" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 227.775719][T10391] 9pnet_fd: Insufficient options for proto=fd [ 227.789395][ T36] audit: type=1400 audit(2000000006.370:2822): avc: denied { read open } for pid=10387 comm="syz.4.3351" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 227.835442][ T36] audit: type=1400 audit(2000000006.370:2823): avc: denied { create } for pid=10387 comm="syz.4.3351" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 227.856737][ T36] audit: type=1400 audit(2000000006.370:2824): avc: denied { write } for pid=10387 comm="syz.4.3351" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 227.878782][ T36] audit: type=1400 audit(2000000006.417:2825): avc: denied { read write } for pid=9398 comm="syz-executor" name="loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 227.903365][ T372] usb 1-1: new full-speed USB device number 67 using dummy_hcd [ 227.911202][ T36] audit: type=1400 audit(2000000006.417:2826): avc: denied { read write open } for pid=9398 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 227.958860][ T36] audit: type=1400 audit(2000000006.417:2827): avc: denied { ioctl } for pid=9398 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 227.985427][ T36] audit: type=1400 audit(2000000006.464:2828): avc: denied { ioctl } for pid=10375 comm="syz.0.3347" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 228.124112][ T372] usb 1-1: config 0 has an invalid interface number: 151 but max is 0 [ 228.132361][ T372] usb 1-1: config 0 has no interface number 0 [ 228.143252][ T372] usb 1-1: config 0 interface 151 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 10 [ 228.162209][ T372] usb 1-1: New USB device found, idVendor=0499, idProduct=6bb7, bcdDevice=68.2f [ 228.181640][ T372] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 228.201079][ T372] usb 1-1: Product: syz [ 228.205282][ T372] usb 1-1: Manufacturer: syz [ 228.228105][ T372] usb 1-1: SerialNumber: syz [ 228.244231][ T372] usb 1-1: config 0 descriptor?? [ 228.340307][ T329] Bluetooth: hci0: Frame reassembly failed (-84) [ 228.512232][ T372] usb 1-1: invalid MIDI out EP 0 [ 228.523236][ T372] snd-usb-audio 1-1:0.151: probe with driver snd-usb-audio failed with error -22 [ 228.537725][ T372] usb 1-1: USB disconnect, device number 67 [ 228.561961][T10430] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 228.608119][ T7155] udevd[7155]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.151/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 228.639134][T10431] rust_binder: Failed to allocate buffer. len:1144, is_oneway:true [ 228.639160][T10431] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 228.647213][T10431] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:289 [ 228.984714][T10435] __vm_enough_memory: pid: 10435, comm: syz.1.3367, bytes: 21200614072320 not enough memory for the allocation [ 229.634752][T10446] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 229.812301][T10460] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 230.520364][ T1009] Bluetooth: hci0: command 0x1003 tx timeout [ 230.520372][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 230.609540][T10474] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 230.609571][T10474] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:182 [ 231.078367][ T372] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 231.255592][ T372] usb 5-1: Using ep0 maxpacket: 8 [ 231.263599][ T372] usb 5-1: unable to get BOS descriptor or descriptor too short [ 231.273570][ T372] usb 5-1: config 1 has an invalid interface number: 4 but max is 2 [ 231.281612][ T372] usb 5-1: config 1 has an invalid interface descriptor of length 6, skipping [ 231.291112][ T372] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 231.301309][ T372] usb 5-1: config 1 has no interface number 1 [ 231.307545][ T372] usb 5-1: config 1 interface 4 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 8 [ 231.320543][ T372] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 231.330203][ T360] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 231.331464][ T372] usb 5-1: config 1 interface 4 has no altsetting 0 [ 231.348469][ T372] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 231.357570][ T372] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 231.365582][ T372] usb 5-1: Product: syz [ 231.369744][ T372] usb 5-1: Manufacturer: syz [ 231.374416][ T372] usb 5-1: SerialNumber: syz [ 231.490064][ T360] usb 1-1: Using ep0 maxpacket: 8 [ 231.498045][ T360] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 231.508028][ T360] usb 1-1: config 179 has no interface number 0 [ 231.514401][ T360] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 231.525675][ T360] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 231.537408][ T360] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 231.548578][ T360] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 231.560092][ T360] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 231.573504][ T360] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 231.582577][ T360] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 231.593401][T10497] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 231.821658][ T62] usb 1-1: USB disconnect, device number 68 [ 231.821757][ C1] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 231.836307][ C1] dummy_hcd dummy_hcd.0: timer fired with no URBs pending? [ 232.715840][ T360] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 232.878036][ T360] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 232.887939][ T360] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 232.902559][ T360] usb 1-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 232.912765][ T360] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.920846][ T360] usb 1-1: Product: syz [ 232.925091][ T360] usb 1-1: Manufacturer: syz [ 232.929965][ T360] usb 1-1: SerialNumber: syz [ 232.936805][ T360] usb 1-1: config 0 descriptor?? [ 232.946317][T10518] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 232.957747][T10518] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 232.965437][ T36] kauditd_printk_skb: 604 callbacks suppressed [ 232.965453][ T36] audit: type=1400 audit(2000000011.352:3433): avc: denied { ioctl } for pid=10517 comm="syz.0.3395" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 233.028865][ T36] audit: type=1400 audit(2000000011.408:3434): avc: denied { read write } for pid=8408 comm="syz-executor" name="loop6" dev="devtmpfs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 233.099539][ T36] audit: type=1400 audit(2000000011.408:3435): avc: denied { read write open } for pid=8408 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 233.119784][T10524] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 233.127135][T10524] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 233.156640][ T36] audit: type=1400 audit(2000000011.408:3436): avc: denied { ioctl } for pid=8408 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=55 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 233.218997][T10526] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 233.219850][T10526] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 233.225534][T10518] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 233.240067][ T36] audit: type=1400 audit(2000000011.464:3437): avc: denied { read } for pid=10523 comm="syz.6.3398" name="binder1" dev="binder" ino=22 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 233.283414][T10518] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 233.295335][ T36] audit: type=1400 audit(2000000011.474:3438): avc: denied { read open } for pid=10523 comm="syz.6.3398" path="/dev/binderfs/binder1" dev="binder" ino=22 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 233.321783][ T36] audit: type=1400 audit(2000000011.474:3439): avc: denied { create } for pid=10523 comm="syz.6.3398" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 233.352963][ T36] audit: type=1400 audit(2000000011.474:3440): avc: denied { write } for pid=10523 comm="syz.6.3398" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 233.386249][T10528] audit: audit_backlog=65 > audit_backlog_limit=64 [ 233.388896][T10529] audit: audit_backlog=65 > audit_backlog_limit=64 [ 233.716800][T10534] netlink: 'syz.6.3402': attribute type 4 has an invalid length. [ 233.729771][T10534] netlink: 3581 bytes leftover after parsing attributes in process `syz.6.3402'. [ 233.938011][T10543] binder: Unknown parameter '00000000000000000000003' [ 233.974591][ T360] dm9601 1-1:0.0 (unnamed net_device) (uninitialized): Error reading chip ID [ 234.049416][ T372] usb 5-1: 2:1 : invalid UAC_AS_GENERAL desc [ 234.080181][ T372] usb 5-1: USB disconnect, device number 30 [ 234.157702][ T8046] udevd[8046]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 234.394178][T10550] 9pnet: Could not find request transport: xen [ 234.495524][T10552] cgroup: Unknown subsys name 'fsuuid' [ 234.874239][T10570] 9pnet_fd: Insufficient options for proto=fd [ 234.894800][T10572] af_packet: tpacket_rcv: packet too big, clamped from 40 to 4294967272. macoff=96 [ 234.950564][T10579] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 234.951199][T10579] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 234.958374][T10579] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 234.967649][T10579] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:336 [ 235.622534][ T372] usb 1-1: USB disconnect, device number 69 [ 235.673782][T10597] fuse: Bad value for 'fd' [ 235.892850][T10603] netlink: 'syz.1.3425': attribute type 27 has an invalid length. [ 235.905550][T10603] sit0: left promiscuous mode [ 236.312557][T10634] rust_binder: Write failure EFAULT in pid:583 [ 236.366700][T10640] 9pnet_fd: Insufficient options for proto=fd [ 236.707950][T10658] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3444'. [ 237.395095][T10668] binder: Unknown parameter 'defcontext01777777777777777777777' [ 238.311312][ T36] kauditd_printk_skb: 585 callbacks suppressed [ 238.311336][ T36] audit: type=1400 audit(2000000016.352:4022): avc: denied { read write } for pid=10679 comm="syz.6.3450" name="binder1" dev="binder" ino=22 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 238.349432][ T36] audit: type=1400 audit(2000000016.352:4023): avc: denied { read write open } for pid=10679 comm="syz.6.3450" path="/dev/binderfs/binder1" dev="binder" ino=22 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 238.353324][T10680] input input29: cannot allocate more than FF_MAX_EFFECTS effects [ 238.375262][ T36] audit: type=1400 audit(2000000016.390:4024): avc: denied { read write } for pid=10679 comm="syz.6.3450" name="uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 238.422645][ T36] audit: type=1400 audit(2000000016.390:4025): avc: denied { read write open } for pid=10679 comm="syz.6.3450" path="/dev/uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 238.451705][ T36] audit: type=1400 audit(2000000016.390:4026): avc: denied { ioctl } for pid=10679 comm="syz.6.3450" path="/dev/uinput" dev="devtmpfs" ino=194 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 238.478504][ T36] audit: type=1400 audit(2000000016.390:4027): avc: denied { ioctl } for pid=10679 comm="syz.6.3450" path="/dev/uinput" dev="devtmpfs" ino=194 ioctlcmd=0x5501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 238.505625][ T36] audit: type=1400 audit(2000000016.446:4028): avc: denied { read write } for pid=10679 comm="syz.6.3450" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 238.529998][ T36] audit: type=1400 audit(2000000016.446:4029): avc: denied { read write open } for pid=10679 comm="syz.6.3450" path="/dev/raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 238.561406][ T36] audit: type=1400 audit(2000000016.446:4030): avc: denied { ioctl } for pid=10679 comm="syz.6.3450" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 238.618722][ T36] audit: type=1400 audit(2000000016.446:4031): avc: denied { ioctl } for pid=10679 comm="syz.6.3450" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 238.972507][ T372] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 239.134316][ T372] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 239.145334][ T372] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 239.156797][ T372] usb 5-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 239.165864][ T372] usb 5-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 239.173855][ T372] usb 5-1: Manufacturer: syz [ 239.180073][ T372] usb 5-1: config 0 descriptor?? [ 240.287296][T10740] rust_binder: Write failure EINVAL in pid:608 [ 240.355489][T10745] rust_binder: Error while translating object. [ 240.361780][T10745] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 240.368060][T10745] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:613 [ 240.461265][T10749] rust_binder: Write failure EINVAL in pid:617 [ 240.729604][T10757] rust_binder: Error while translating object. [ 240.735941][T10757] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 240.742188][T10757] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:624 [ 241.762533][T10771] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 241.772071][T10772] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 241.864593][ T372] uclogic 0003:256C:006D.0011: failed retrieving string descriptor #100: -71 [ 241.879981][ T372] uclogic 0003:256C:006D.0011: failed retrieving pen parameters: -71 [ 241.888559][ T372] uclogic 0003:256C:006D.0011: failed probing pen v1 parameters: -71 [ 241.898102][ T372] uclogic 0003:256C:006D.0011: failed probing parameters: -71 [ 241.906380][ T372] uclogic 0003:256C:006D.0011: probe with driver uclogic failed with error -71 [ 241.917439][ T372] usb 5-1: USB disconnect, device number 31 [ 241.927591][ T8046] udevd[8046]: setting mode of /dev/bus/usb/005/031 to 020664 failed: No such file or directory [ 241.960337][ T8046] udevd[8046]: setting owner of /dev/bus/usb/005/031 to uid=0, gid=0 failed: No such file or directory [ 242.646399][T10812] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3496'. [ 242.882607][T10822] bridge0: port 1(bridge_slave_0) entered blocking state [ 242.889902][T10822] bridge0: port 1(bridge_slave_0) entered disabled state [ 242.897172][T10822] bridge_slave_0: entered allmulticast mode [ 242.903425][T10822] bridge_slave_0: entered promiscuous mode [ 242.911294][T10822] bridge0: port 2(bridge_slave_1) entered blocking state [ 242.918392][T10822] bridge0: port 2(bridge_slave_1) entered disabled state [ 242.925500][T10822] bridge_slave_1: entered allmulticast mode [ 242.932011][T10822] bridge_slave_1: entered promiscuous mode [ 243.006254][T10822] bridge0: port 2(bridge_slave_1) entered blocking state [ 243.013339][T10822] bridge0: port 2(bridge_slave_1) entered forwarding state [ 243.020591][T10822] bridge0: port 1(bridge_slave_0) entered blocking state [ 243.027634][T10822] bridge0: port 1(bridge_slave_0) entered forwarding state [ 243.067152][ T329] bridge0: port 1(bridge_slave_0) entered disabled state [ 243.074574][ T329] bridge0: port 2(bridge_slave_1) entered disabled state [ 243.087231][ T329] bridge0: port 1(bridge_slave_0) entered blocking state [ 243.094312][ T329] bridge0: port 1(bridge_slave_0) entered forwarding state [ 243.105311][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 243.112393][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 243.173944][T10822] veth0_vlan: entered promiscuous mode [ 243.202410][T10822] veth1_macvtap: entered promiscuous mode [ 243.412430][T10841] input: syz0 as /devices/virtual/input/input30 [ 243.660307][ T36] kauditd_printk_skb: 658 callbacks suppressed [ 243.660324][ T36] audit: type=1400 audit(2000000021.372:4690): avc: denied { write } for pid=10860 comm="syz.4.3509" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 243.686435][ T36] audit: type=1400 audit(2000000021.409:4691): avc: denied { write } for pid=10860 comm="syz.4.3509" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 243.689137][T10861] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3509'. [ 243.706698][ T36] audit: type=1400 audit(2000000021.409:4692): avc: denied { create } for pid=10860 comm="syz.4.3509" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 243.737790][ T36] audit: type=1400 audit(2000000021.409:4693): avc: denied { write } for pid=10860 comm="syz.4.3509" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 243.765875][T10866] rust_binder: 262: no such ref 4294967293 [ 243.787094][ T36] audit: type=1400 audit(2000000021.437:4694): avc: denied { read write } for pid=10860 comm="syz.4.3509" name="binder1" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 243.808779][T10868] rust_binder: validate_parent_fixup: new_min_offset=16, sg_entry.length=0 [ 243.811204][T10868] rust_binder: Error while translating object. [ 243.820701][T10868] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 243.824371][ T36] audit: type=1400 audit(2000000021.437:4695): avc: denied { read write open } for pid=10860 comm="syz.4.3509" path="/dev/binderfs/binder1" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 243.828035][T10868] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:264 [ 243.861412][ T36] audit: type=1400 audit(2000000021.437:4696): avc: denied { write } for pid=10860 comm="syz.4.3509" name="001" dev="devtmpfs" ino=114 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 243.870032][T10868] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 243.870650][ T36] audit: type=1400 audit(2000000021.437:4697): avc: denied { write } for pid=10860 comm="syz.4.3509" path="/dev/bus/usb/007/001" dev="devtmpfs" ino=114 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 243.899266][T10868] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 243.900212][ T36] audit: type=1400 audit(2000000021.437:4698): avc: denied { write } for pid=10860 comm="syz.4.3509" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 243.950837][ T36] audit: type=1400 audit(2000000021.437:4699): avc: denied { write } for pid=10860 comm="syz.4.3509" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 244.194585][T10882] overlayfs: failed to clone lowerpath [ 244.226046][T10885] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 244.231404][T10885] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 244.238021][T10885] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:277 [ 244.472745][T10897] __vm_enough_memory: pid: 10897, comm: syz.4.3522, bytes: 18014402804453376 not enough memory for the allocation [ 244.610667][T10907] netlink: 28 bytes leftover after parsing attributes in process `syz.7.3525'. [ 244.623191][T10909] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3524'. [ 244.632918][T10909] netlink: 35 bytes leftover after parsing attributes in process `syz.4.3524'. [ 244.649486][T10909] netlink: 'syz.4.3524': attribute type 6 has an invalid length. [ 244.662495][T10909] netlink: 35 bytes leftover after parsing attributes in process `syz.4.3524'. [ 245.146918][T10926] overlay: Unknown parameter 'obj_role' [ 245.316703][T10930] rust_binder: BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 245.429353][T10936] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 245.461598][T10936] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 245.819914][T10959] rust_binder: Error while translating object. [ 245.819971][T10959] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 245.840181][T10959] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:294 [ 246.249402][T10985] 9pnet_fd: Insufficient options for proto=fd [ 247.347748][T11017] netlink: 'syz.7.3563': attribute type 16 has an invalid length. [ 247.377711][T11019] 9pnet_fd: Insufficient options for proto=fd [ 247.435192][T11025] netlink: 448 bytes leftover after parsing attributes in process `syz.7.3566'. [ 248.626398][T11072] fuseblk: Unknown parameter 'user_00000000000000000000' [ 248.710554][T11079] input: syz1 as /devices/virtual/input/input31 [ 248.823719][T11087] netlink: 'syz.6.3584': attribute type 4 has an invalid length. [ 248.836285][T11087] netlink: 3581 bytes leftover after parsing attributes in process `syz.6.3584'. [ 248.848075][T11084] binder: Bad value for 'stats' [ 248.915094][T11092] rust_binder: Write failure EFAULT in pid:378 [ 248.995251][ T36] kauditd_printk_skb: 541 callbacks suppressed [ 248.995270][ T36] audit: type=1400 audit(2000000026.382:5241): avc: denied { execmem } for pid=11098 comm="syz.7.3590" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 249.027767][ T36] audit: type=1400 audit(2000000026.382:5242): avc: denied { execute } for pid=11098 comm="syz.7.3590" path="/dev/rnullb0" dev="tmpfs" ino=79 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 249.051185][ T36] audit: type=1400 audit(2000000026.419:5243): avc: denied { create } for pid=11098 comm="syz.7.3590" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 249.077095][ T36] audit: type=1400 audit(2000000026.419:5244): avc: denied { getopt } for pid=11098 comm="syz.7.3590" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 249.080414][T11101] fuse: Bad value for 'fd' [ 249.098618][ T36] audit: type=1400 audit(2000000026.466:5245): avc: denied { mounton } for pid=11100 comm="syz.7.3591" path="/32/file0" dev="tmpfs" ino=191 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 249.124411][T11102] fuse: Bad value for 'fd' [ 249.125956][ T36] audit: type=1400 audit(2000000026.504:5246): avc: denied { mounton } for pid=11100 comm="syz.7.3591" path="/32/file0" dev="tmpfs" ino=191 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 249.151898][ T36] audit: type=1400 audit(2000000026.513:5247): avc: denied { create } for pid=11100 comm="syz.7.3591" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 249.173633][ T36] audit: type=1400 audit(2000000026.513:5248): avc: denied { map } for pid=11100 comm="syz.7.3591" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=45458 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 249.198509][ T36] audit: type=1400 audit(2000000026.513:5249): avc: denied { read write } for pid=11100 comm="syz.7.3591" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=45458 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 249.223819][ T36] audit: type=1400 audit(2000000026.513:5250): avc: denied { map } for pid=11100 comm="syz.7.3591" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=45458 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 249.352904][T11110] geneve1: tun_chr_ioctl cmd 1074025675 [ 249.358550][T11110] geneve1: persist disabled [ 249.363463][T11110] geneve1: tun_chr_ioctl cmd 1074025677 [ 249.369335][T11110] geneve1: linktype set to 256 [ 249.727604][T11116] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3596'. [ 249.743486][T11116] 9pnet: Unknown protocol version 9p200A:xp.L [ 250.110836][ T1377] usb 5-1: new full-speed USB device number 32 using dummy_hcd [ 250.273225][ T1377] usb 5-1: unable to get BOS descriptor or descriptor too short [ 250.282081][ T1377] usb 5-1: not running at top speed; connect to a high speed hub [ 250.291182][ T1377] usb 5-1: config 1 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 250.304137][ T1377] usb 5-1: config 1 interface 0 has no altsetting 0 [ 250.316357][ T1377] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 250.325457][ T1377] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 250.333457][ T1377] usb 5-1: Manufacturer: 탈ᖩ쒸阡翀⎇碭밨񦅡 [ 250.340269][ T1377] usb 5-1: SerialNumber: syz [ 250.411500][T11129] 9pnet_fd: Insufficient options for proto=fd [ 250.575325][ T1377] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 32 if 0 alt 7 proto 1 vid 0x0525 pid 0xA4A8 [ 250.589372][ T1377] usb 5-1: USB disconnect, device number 32 [ 250.597132][ T1377] usblp0: removed [ 250.796529][T11140] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 250.844761][ T329] Bluetooth: hci0: Frame reassembly failed (-84) [ 251.669426][ T329] tipc: Subscription rejected, illegal request [ 252.587147][T11210] netlink: 'syz.1.3627': attribute type 11 has an invalid length. [ 253.031426][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 253.761963][T11245] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 253.768806][T11245] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 253.788124][T11245] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:385 [ 253.872004][T11250] Bluetooth: hci0: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 253.908262][T11250] Bluetooth: hci0: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 253.956663][T11252] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 253.959658][ T329] Bluetooth: hci0: Frame reassembly failed (-84) [ 253.960543][T11252] rust_binder: Failed to allocate buffer. len:1144, is_oneway:true [ 253.966546][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 253.988976][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 253.996756][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.004143][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.012862][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.019581][T11252] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 254.019612][T11252] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:387 [ 254.019619][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.019916][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.064725][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.072287][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.079826][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.087443][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.094144][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.102059][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.109430][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.132762][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.140620][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.147648][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.155432][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.162934][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.169746][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.177638][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.185183][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.196712][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.207031][T11258] netlink: 'syz.1.3645': attribute type 4 has an invalid length. [ 254.215329][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.229218][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.237258][T11258] netlink: 'syz.1.3645': attribute type 4 has an invalid length. [ 254.247013][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.256642][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.284755][T11250] Bluetooth: hci0: Frame reassembly failed (-84) [ 254.373854][ T36] kauditd_printk_skb: 317 callbacks suppressed [ 254.373872][ T36] audit: type=1400 audit(2000000031.420:5568): avc: denied { read write } for pid=9398 comm="syz-executor" name="loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 254.408043][ T36] audit: type=1400 audit(2000000031.467:5569): avc: denied { read write open } for pid=9398 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 254.437059][ T36] audit: type=1400 audit(2000000031.467:5570): avc: denied { ioctl } for pid=9398 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 254.464325][ T36] audit: type=1400 audit(2000000031.476:5571): avc: denied { create } for pid=11268 comm="syz.7.3652" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 254.485932][ T36] audit: type=1400 audit(2000000031.476:5572): avc: denied { setopt } for pid=11268 comm="syz.7.3652" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 254.510980][ T36] audit: type=1400 audit(2000000031.476:5573): avc: denied { write } for pid=11268 comm="syz.7.3652" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 254.514847][T11276] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:332 [ 254.532766][ T36] audit: type=1400 audit(2000000031.485:5574): avc: denied { read } for pid=11268 comm="syz.7.3652" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 254.563444][ T36] audit: type=1400 audit(2000000031.485:5575): avc: denied { read } for pid=11268 comm="syz.7.3652" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 254.591206][ T36] audit: type=1400 audit(2000000031.485:5576): avc: denied { write } for pid=11268 comm="syz.7.3652" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 254.613131][ T36] audit: type=1400 audit(2000000031.485:5577): avc: denied { read } for pid=11268 comm="syz.7.3652" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 255.141755][ T1377] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 255.304128][ T1377] usb 5-1: config 18 has too many interfaces: 228, using maximum allowed: 32 [ 255.313045][ T1377] usb 5-1: config 18 has an invalid descriptor of length 225, skipping remainder of the config [ 255.323921][ T1377] usb 5-1: config 18 has 0 interfaces, different from the descriptor's value: 228 [ 255.333149][ T1377] usb 5-1: New USB device found, idVendor=256c, idProduct=006e, bcdDevice= 0.00 [ 255.342273][ T1377] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 255.570241][ T1377] usb 5-1: string descriptor 0 read error: -71 [ 255.578621][ T1377] usb 5-1: USB disconnect, device number 33 [ 256.015847][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 256.203128][T11333] netlink: 'syz.4.3669': attribute type 27 has an invalid length. [ 256.235475][T11333] bridge0: port 2(bridge_slave_1) entered disabled state [ 256.242738][T11333] bridge0: port 1(bridge_slave_0) entered disabled state [ 256.473944][T11341] rust_binder: Error while translating object. [ 256.474037][T11341] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 256.486606][T11341] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:351 [ 256.496831][T11341] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 256.506083][T11341] rust_binder: Read failure Err(EFAULT) in pid:351 [ 256.629771][T11359] rust_binder: Error while translating object. [ 256.636451][T11359] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 256.646914][T11359] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:357 [ 256.803759][T11373] binder: Unknown parameter './binderfs' [ 257.043203][T11406] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3688'. [ 257.073840][T11404] rust_binder: Failed to allocate buffer. len:1168, is_oneway:true [ 257.103174][T11409] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3688'. [ 257.635883][ T372] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 257.798760][ T372] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 257.810481][ T372] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 257.821386][ T372] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 257.831148][ T372] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 257.844142][ T372] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 257.853217][ T372] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 257.862745][ T372] usb 5-1: config 0 descriptor?? [ 258.287990][T11436] overlayfs: failed to clone lowerpath [ 258.301028][ T372] plantronics 0003:047F:FFFF.0012: unknown main item tag 0x2 [ 258.315828][ T372] plantronics 0003:047F:FFFF.0012: No inputs registered, leaving [ 258.331515][ T372] plantronics 0003:047F:FFFF.0012: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 258.509720][T11448] overlayfs: failed to clone upperpath [ 258.520224][T11448] netlink: 'syz.1.3702': attribute type 27 has an invalid length. [ 258.526242][T11412] __vm_enough_memory: pid: 11412, comm: syz.4.3689, bytes: 18014402804453376 not enough memory for the allocation [ 258.530394][T11448] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 258.543058][ T331] usb 5-1: USB disconnect, device number 34 [ 259.228151][T11466] 9pnet: Could not find request transport: f` [ 259.394366][T11474] overlayfs: disabling nfs_export due to verity=on [ 259.417531][T11474] overlayfs: missing 'lowerdir' [ 259.639747][T11493] IPv6: Can't replace route, no match found [ 259.718551][ T36] kauditd_printk_skb: 943 callbacks suppressed [ 259.718570][ T36] audit: type=1400 audit(2000000036.449:6521): avc: denied { read write } for pid=11496 comm="syz.4.3717" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 259.788928][ T36] audit: type=1400 audit(2000000036.449:6522): avc: denied { read write open } for pid=11496 comm="syz.4.3717" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 259.818767][ T36] audit: type=1400 audit(2000000036.449:6523): avc: denied { read } for pid=11496 comm="syz.4.3717" dev="nsfs" ino=4026533232 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 259.842246][ T36] audit: type=1400 audit(2000000036.449:6524): avc: denied { read open } for pid=11496 comm="syz.4.3717" path="net:[4026533232]" dev="nsfs" ino=4026533232 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 259.866491][ T36] audit: type=1400 audit(2000000036.449:6525): avc: denied { create } for pid=11496 comm="syz.4.3717" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 259.890663][ T36] audit: type=1400 audit(2000000036.449:6526): avc: denied { setopt } for pid=11496 comm="syz.4.3717" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 259.911373][ T36] audit: type=1400 audit(2000000036.477:6527): avc: denied { bind } for pid=11496 comm="syz.4.3717" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 259.931872][ T36] audit: type=1400 audit(2000000036.477:6528): avc: denied { read } for pid=11496 comm="syz.4.3717" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 260.029559][ T36] audit: type=1400 audit(2000000036.730:6529): avc: denied { mounton } for pid=11500 comm="syz.1.3719" path="/408/file0" dev="tmpfs" ino=2260 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 260.059618][ T36] audit: type=1400 audit(2000000036.768:6530): avc: denied { mount } for pid=11500 comm="syz.1.3719" name="/" dev="9p" ino=281474976710658 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 260.938928][T11512] netlink: 176 bytes leftover after parsing attributes in process `syz.6.3723'. [ 260.955558][T11510] rust_binder: Error while translating object. [ 260.955601][T11510] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 260.973558][T11510] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:406 [ 261.047877][T11514] fuse: Unknown parameter '0x0000000000000005' [ 261.492846][T11534] netlink: 116 bytes leftover after parsing attributes in process `syz.4.3730'. [ 261.504682][T11534] rust_binder: Write failure EINVAL in pid:424 [ 262.040575][T11572] 9pnet_fd: Insufficient options for proto=fd [ 262.163384][T11579] x_tables: duplicate underflow at hook 2 [ 262.267171][T11585] netlink: 'syz.7.3747': attribute type 13 has an invalid length. [ 262.278295][T11585] netlink: 'syz.7.3747': attribute type 13 has an invalid length. [ 262.986535][ T331] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 263.032986][T11640] netlink: 44 bytes leftover after parsing attributes in process `syz.7.3766'. [ 263.135773][ T331] usb 5-1: device descriptor read/64, error -71 [ 263.391589][ T331] usb 5-1: device descriptor read/64, error -71 [ 263.881897][ T331] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 264.020486][ T331] usb 5-1: device descriptor read/64, error -71 [ 264.276226][ T331] usb 5-1: device descriptor read/64, error -71 [ 264.282734][T11662] binder: Unknown parameter 'dont_measure' [ 264.415355][ T331] usb usb5-port1: attempt power cycle [ 264.557452][T11675] overlayfs: failed to clone upperpath [ 264.705497][T11688] overlayfs: failed to clone upperpath [ 264.787922][ T331] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 264.829315][T11701] rust_binder: 459: no such ref 0 [ 264.836720][ T331] usb 5-1: device descriptor read/8, error -71 [ 264.850821][T11700] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 264.850882][T11701] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 264.864527][T11701] rust_binder: 459: no such ref 2 [ 264.870788][T11701] rust_binder: Error while translating object. [ 264.870854][T11701] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 264.878537][T11701] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:459 [ 264.982560][ T331] usb 5-1: device descriptor read/8, error -71 [ 265.105650][ T36] kauditd_printk_skb: 567 callbacks suppressed [ 265.105672][ T36] audit: type=1400 audit(2000000041.496:7098): avc: denied { read } for pid=11715 comm="syz.6.3791" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 265.135263][ T36] audit: type=1400 audit(2000000041.496:7099): avc: denied { read open } for pid=11715 comm="syz.6.3791" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 265.177163][ T36] audit: type=1400 audit(2000000041.496:7100): avc: denied { execmem } for pid=11715 comm="syz.6.3791" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 265.197109][ T36] audit: type=1400 audit(2000000041.505:7101): avc: denied { ioctl } for pid=11606 comm="syz.4.3754" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 265.223576][ T36] audit: type=1400 audit(2000000041.505:7102): avc: denied { ioctl } for pid=11606 comm="syz.4.3754" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 265.246210][ T331] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 265.249861][ T36] audit: type=1400 audit(2000000041.543:7103): avc: denied { read write } for pid=8408 comm="syz-executor" name="loop6" dev="devtmpfs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 265.282667][ T36] audit: type=1400 audit(2000000041.543:7104): avc: denied { read write open } for pid=8408 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 265.291107][ T331] usb 5-1: device descriptor read/8, error -71 [ 265.309088][ T36] audit: type=1400 audit(2000000041.543:7105): avc: denied { ioctl } for pid=8408 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=55 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 265.339311][T11720] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 265.339370][ T36] audit: type=1400 audit(2000000041.562:7106): avc: denied { write } for pid=11717 comm="syz.6.3792" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 265.346175][T11720] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 152, size: 18446744073709551507) [ 265.368697][ T36] audit: type=1400 audit(2000000041.562:7107): avc: denied { write open } for pid=11717 comm="syz.6.3792" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 265.368752][T11720] rust_binder: Error while translating object. [ 265.404554][T11720] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 265.410761][T11720] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:474 [ 265.451113][ T331] usb 5-1: device descriptor read/8, error -71 [ 265.578599][ T331] usb usb5-port1: unable to enumerate USB device [ 265.882529][T11756] 9pnet_fd: Insufficient options for proto=fd [ 265.900481][T11756] 9pnet_fd: Insufficient options for proto=fd [ 266.177513][T11776] fuse: Unknown parameter '000000000000000000000040x0000000000000004' [ 266.476022][T11800] __vm_enough_memory: pid: 11800, comm: syz.4.3820, bytes: 18014402804453376 not enough memory for the allocation [ 266.597742][T11817] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3823'. [ 266.854038][T11833] rust_binder: Error while translating object. [ 266.854067][T11833] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 266.860356][T11833] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:470 [ 267.536791][T11848] netlink: 124 bytes leftover after parsing attributes in process `syz.1.3836'. [ 267.594871][T11850] netlink: 'syz.1.3837': attribute type 16 has an invalid length. [ 267.783571][T11853] fuseblk: Bad value for 'user_id' [ 267.788741][T11853] fuseblk: Bad value for 'user_id' [ 268.285230][T11870] overlayfs: failed to clone upperpath [ 268.352377][ T60] tipc: Subscription rejected, illegal request [ 268.615921][T11889] netlink: 188 bytes leftover after parsing attributes in process `syz.1.3851'. [ 269.571028][T11949] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3872'. [ 269.580735][T11949] rust_binder: 495: no such ref 0 [ 270.020375][T11966] 9pnet_fd: Insufficient options for proto=fd [ 270.129145][T11976] bridge0: port 3(syz_tun) entered blocking state [ 270.135680][T11976] bridge0: port 3(syz_tun) entered disabled state [ 270.142252][T11976] syz_tun: entered allmulticast mode [ 270.148148][T11976] syz_tun: entered promiscuous mode [ 270.153688][T11976] bridge0: port 3(syz_tun) entered blocking state [ 270.160167][T11976] bridge0: port 3(syz_tun) entered forwarding state [ 270.515530][ T36] kauditd_printk_skb: 680 callbacks suppressed [ 270.515551][ T36] audit: type=1400 audit(2000000053.572:7788): avc: denied { read } for pid=11977 comm="syz.6.3881" dev="nsfs" ino=4026533310 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 270.543688][ T36] audit: type=1400 audit(2000000053.572:7789): avc: denied { read open } for pid=11977 comm="syz.6.3881" path="net:[4026533310]" dev="nsfs" ino=4026533310 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 270.567454][ T36] audit: type=1400 audit(2000000053.572:7790): avc: denied { create } for pid=11977 comm="syz.6.3881" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 270.587478][ T36] audit: type=1400 audit(2000000053.582:7791): avc: denied { ioctl } for pid=11977 comm="syz.6.3881" path="socket:[49410]" dev="sockfs" ino=49410 ioctlcmd=0x48cb scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 270.612731][ T36] audit: type=1400 audit(2000000053.582:7792): avc: denied { create } for pid=11977 comm="syz.6.3881" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 270.741656][ T36] audit: type=1400 audit(2000000053.788:7793): avc: denied { write } for pid=11977 comm="syz.6.3881" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 270.762759][ T36] audit: type=1400 audit(2000000053.788:7794): avc: denied { create } for pid=11987 comm="syz.1.3884" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 270.784791][ T36] audit: type=1400 audit(2000000053.788:7795): avc: denied { write } for pid=11987 comm="syz.1.3884" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 270.815030][ T36] audit: type=1400 audit(2000000053.854:7796): avc: denied { create } for pid=11996 comm="syz.7.3886" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 270.835580][ T36] audit: type=1400 audit(2000000053.854:7797): avc: denied { mounton } for pid=11996 comm="syz.7.3886" path="/123/file0" dev="tmpfs" ino=682 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 270.904048][T12006] fuseblk: Unknown parameter 'S' [ 270.914926][T12006] fuseblk: Unknown parameter 'S' [ 270.938616][T12006] fuseblk: Unknown parameter 'S' [ 270.944335][T12006] fuseblk: Unknown parameter 'S' [ 270.963535][T12006] fuseblk: Unknown parameter 'S' [ 270.978491][T12006] fuseblk: Unknown parameter 'S' [ 270.984734][T12006] fuseblk: Unknown parameter 'S' [ 270.990505][T12006] fuseblk: Unknown parameter 'S' [ 270.998566][T12006] fuseblk: Unknown parameter 'S' [ 271.004895][T12006] fuseblk: Unknown parameter 'S' [ 271.010692][T12006] fuseblk: Unknown parameter 'S' [ 271.017005][T12006] fuseblk: Unknown parameter 'S' [ 271.022832][T12006] fuseblk: Unknown parameter 'S' [ 271.030666][T12006] fuseblk: Unknown parameter 'S' [ 271.037044][T12006] fuseblk: Unknown parameter 'S' [ 271.042825][T12006] fuseblk: Unknown parameter 'S' [ 271.049182][T12019] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3892'. [ 271.049188][T12006] fuseblk: Unknown parameter 'S' [ 271.049836][T12006] fuseblk: Unknown parameter 'S' [ 271.070972][T12006] fuseblk: Unknown parameter 'S' [ 271.077311][T12006] fuseblk: Unknown parameter 'S' [ 271.083160][T12006] fuseblk: Unknown parameter 'S' [ 271.090794][T12006] fuseblk: Unknown parameter 'S' [ 271.096729][T12006] fuseblk: Unknown parameter 'S' [ 271.103378][T12006] fuseblk: Unknown parameter 'S' [ 271.110511][T12006] fuseblk: Unknown parameter 'S' [ 271.116395][T12006] fuseblk: Unknown parameter 'S' [ 271.123049][T12006] fuseblk: Unknown parameter 'S' [ 271.128938][T12006] fuseblk: Unknown parameter 'S' [ 271.135679][T12006] fuseblk: Unknown parameter 'S' [ 271.142118][T12006] fuseblk: Unknown parameter 'S' [ 271.148033][T12006] fuseblk: Unknown parameter 'S' [ 271.154692][T12006] fuseblk: Unknown parameter 'S' [ 271.160636][T12006] fuseblk: Unknown parameter 'S' [ 271.167391][T12006] fuseblk: Unknown parameter 'S' [ 271.173779][T12006] fuseblk: Unknown parameter 'S' [ 271.179675][T12006] fuseblk: Unknown parameter 'S' [ 271.186348][T12006] fuseblk: Unknown parameter 'S' [ 271.192217][T12006] fuseblk: Unknown parameter 'S' [ 271.200527][T12006] fuseblk: Unknown parameter 'S' [ 271.207371][T12006] fuseblk: Unknown parameter 'S' [ 271.213223][T12006] fuseblk: Unknown parameter 'S' [ 271.219672][T12006] fuseblk: Unknown parameter 'S' [ 271.225421][T12006] fuseblk: Unknown parameter 'S' [ 271.232130][T12006] fuseblk: Unknown parameter 'S' [ 271.240065][T12006] fuseblk: Unknown parameter 'S' [ 271.245658][T12006] fuseblk: Unknown parameter 'S' [ 271.252319][T12006] fuseblk: Unknown parameter 'S' [ 271.258713][T12006] fuseblk: Unknown parameter 'S' [ 271.264469][T12006] fuseblk: Unknown parameter 'S' [ 271.271789][T12006] fuseblk: Unknown parameter 'S' [ 271.277342][T12006] fuseblk: Unknown parameter 'S' [ 271.283992][T12006] fuseblk: Unknown parameter 'S' [ 271.311660][T12006] fuseblk: Unknown parameter 'S' [ 271.317671][T12006] fuseblk: Unknown parameter 'S' [ 271.337983][T12006] fuseblk: Unknown parameter 'S' [ 271.352386][T12006] fuseblk: Unknown parameter 'S' [ 271.366101][T12006] fuseblk: Unknown parameter 'S' [ 271.381462][T12006] fuseblk: Unknown parameter 'S' [ 271.387914][T12006] fuseblk: Unknown parameter 'S' [ 271.395080][T12006] fuseblk: Unknown parameter 'S' [ 271.401906][T12006] fuseblk: Unknown parameter 'S' [ 271.411749][T12006] fuseblk: Unknown parameter 'S' [ 271.418025][T12006] fuseblk: Unknown parameter 'S' [ 271.424945][T12006] fuseblk: Unknown parameter 'S' [ 271.443610][T12006] fuseblk: Unknown parameter 'S' [ 271.570549][T12057] netlink: 84 bytes leftover after parsing attributes in process `syz.4.3905'. [ 271.608311][T12059] netlink: 'syz.4.3906': attribute type 4 has an invalid length. [ 271.616998][T12059] netlink: 17 bytes leftover after parsing attributes in process `syz.4.3906'. [ 271.897445][T12073] rust_binder: Error in use_page_slow: ESRCH [ 271.897463][T12073] rust_binder: use_range failure ESRCH [ 271.903495][T12073] rust_binder: Failed to allocate buffer. len:1048, is_oneway:true [ 271.909038][T12073] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 271.916944][T12073] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:502 [ 271.970975][T12075] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 2 [ 271.987536][T12075] rust_binder: Write failure EINVAL in pid:504 [ 272.313435][T12106] fuse: Bad value for 'rootmode' [ 272.708862][T12115] Invalid ELF header magic: != ELF [ 273.105145][T12141] overlayfs: failed to clone lowerpath [ 273.244785][T12160] devpts: called with bogus options [ 273.308374][T12166] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3943'. [ 274.625596][T12192] can0: slcan on ptm1. [ 274.644862][T12192] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 274.759404][T12191] can0 (unregistered): slcan off ptm1. [ 274.766502][T12201] netlink: 'syz.1.3954': attribute type 3 has an invalid length. [ 274.777644][ T329] bridge_slave_1: left allmulticast mode [ 274.785728][ T329] bridge_slave_1: left promiscuous mode [ 274.812875][ T329] bridge0: port 2(bridge_slave_1) entered disabled state [ 274.829577][ T329] bridge_slave_0: left allmulticast mode [ 274.860304][ T329] bridge_slave_0: left promiscuous mode [ 274.865966][ T329] bridge0: port 1(bridge_slave_0) entered disabled state [ 274.881682][ T329] tipc: Resetting bearer [ 274.916893][ T329] tipc: Disabling bearer [ 275.017680][ T329] tipc: Disabling bearer [ 275.035917][ T329] tipc: Left network mode [ 275.058550][ T329] veth1_macvtap: left promiscuous mode [ 275.064233][ T329] veth0_vlan: left promiscuous mode [ 275.747280][T12268] netlink: 32 bytes leftover after parsing attributes in process `syz.7.3968'. [ 275.895142][ T36] kauditd_printk_skb: 1006 callbacks suppressed [ 275.895159][ T36] audit: type=1400 audit(2000000058.620:8804): avc: denied { read write } for pid=9398 comm="syz-executor" name="loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 275.937809][ T36] audit: type=1400 audit(2000000058.620:8805): avc: denied { read write open } for pid=9398 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 275.964795][ T36] audit: type=1400 audit(2000000058.620:8806): avc: denied { ioctl } for pid=9398 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 275.992062][ T36] audit: type=1400 audit(2000000058.657:8807): avc: denied { create } for pid=12274 comm="syz.4.3971" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 276.012600][ T36] audit: type=1400 audit(2000000058.685:8808): avc: denied { ioctl } for pid=12274 comm="syz.4.3971" path="socket:[50365]" dev="sockfs" ino=50365 ioctlcmd=0x8904 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 276.060068][ T36] audit: type=1400 audit(2000000058.685:8809): avc: denied { read } for pid=12274 comm="syz.4.3971" path="socket:[50365]" dev="sockfs" ino=50365 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 276.084204][ T36] audit: type=1400 audit(2000000058.685:8810): avc: denied { write } for pid=12274 comm="syz.4.3971" path="socket:[50365]" dev="sockfs" ino=50365 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 276.108431][ T36] audit: type=1400 audit(2000000058.714:8811): avc: denied { create } for pid=12276 comm="syz.1.3972" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 276.129660][ T36] audit: type=1400 audit(2000000058.714:8812): avc: denied { write } for pid=12276 comm="syz.1.3972" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 276.167348][ T36] audit: type=1400 audit(2000000058.714:8813): avc: denied { read } for pid=12276 comm="syz.1.3972" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 276.789559][ T384] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 276.949633][ T384] usb 5-1: Using ep0 maxpacket: 32 [ 276.958685][ T384] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 276.967276][ T384] usb 5-1: config 0 has no interface number 0 [ 276.977051][ T384] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 276.986270][ T384] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 276.989172][T12322] IPv6: NLM_F_CREATE should be specified when creating new route [ 276.994386][ T384] usb 5-1: Product: syz [ 277.006773][ T384] usb 5-1: Manufacturer: syz [ 277.011510][ T384] usb 5-1: SerialNumber: syz [ 277.018776][ T384] usb 5-1: config 0 descriptor?? [ 277.034349][ T384] smsc95xx v2.0.0 [ 277.216670][T12340] netlink: 'syz.7.3992': attribute type 2 has an invalid length. [ 277.224444][T12340] netlink: 1 bytes leftover after parsing attributes in process `syz.7.3992'. [ 277.424187][T12356] overlayfs: failed to clone lowerpath [ 277.466357][ T384] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 277.477489][ T384] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 277.701828][ T384] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 277.712643][ T384] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -61 [ 279.440053][T12398] tipc: Started in network mode [ 279.444992][T12398] tipc: Node identity 4, cluster identity 4711 [ 279.451161][T12398] tipc: Node number set to 4 [ 280.233759][ T60] bridge_slave_1: left allmulticast mode [ 280.239638][ T60] bridge_slave_1: left promiscuous mode [ 280.245370][ T60] bridge0: port 2(bridge_slave_1) entered disabled state [ 280.253800][ T60] bridge_slave_0: left allmulticast mode [ 280.259647][ T60] bridge_slave_0: left promiscuous mode [ 280.265857][ T60] bridge0: port 1(bridge_slave_0) entered disabled state [ 280.470908][T12430] tipc: Enabling of bearer rejected, failed to enable media [ 280.509893][ T372] usb 5-1: USB disconnect, device number 39 [ 280.806529][T12461] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 280.816063][T12461] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 281.063702][ T372] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 281.121823][T12495] netlink: 44 bytes leftover after parsing attributes in process `syz.7.4046'. [ 281.130867][T12495] netlink: 35 bytes leftover after parsing attributes in process `syz.7.4046'. [ 281.139856][T12495] netlink: 'syz.7.4046': attribute type 6 has an invalid length. [ 281.147581][T12495] netlink: 'syz.7.4046': attribute type 5 has an invalid length. [ 281.159321][T12495] netlink: 35 bytes leftover after parsing attributes in process `syz.7.4046'. [ 281.212930][ T372] usb 5-1: device descriptor read/64, error -71 [ 281.267468][ T36] kauditd_printk_skb: 367 callbacks suppressed [ 281.267485][ T36] audit: type=1400 audit(2000000063.667:9181): avc: denied { execmem } for pid=12494 comm="syz.7.4046" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 281.298626][T12498] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pid=12498 comm=syz.1.4047 [ 281.299259][ T36] audit: type=1400 audit(2000000063.686:9182): avc: denied { create } for pid=12496 comm="syz.1.4047" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 281.337446][ T36] audit: type=1400 audit(2000000063.714:9183): avc: denied { write } for pid=12496 comm="syz.1.4047" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 281.359015][ T36] audit: type=1400 audit(2000000063.714:9184): avc: denied { read } for pid=12496 comm="syz.1.4047" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 281.385924][ T36] audit: type=1400 audit(2000000063.714:9185): avc: denied { read } for pid=12496 comm="syz.1.4047" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 281.407005][ T36] audit: type=1400 audit(2000000063.714:9186): avc: denied { write } for pid=12496 comm="syz.1.4047" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 281.428509][ T36] audit: type=1400 audit(2000000063.714:9187): avc: denied { create } for pid=12502 comm="syz.7.4048" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 281.450836][ T36] audit: type=1400 audit(2000000063.714:9188): avc: denied { create } for pid=12502 comm="syz.7.4048" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 281.500050][ T36] audit: type=1400 audit(2000000063.724:9189): avc: denied { create } for pid=12502 comm="syz.7.4048" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 281.519874][ T372] usb 5-1: device descriptor read/64, error -71 [ 281.527896][ T36] audit: type=1400 audit(2000000063.724:9190): avc: denied { bind } for pid=12502 comm="syz.7.4048" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 281.560593][T12514] rust_binder: Read failure Err(EAGAIN) in pid:517 [ 281.592425][T12516] netlink: 76 bytes leftover after parsing attributes in process `syz.7.4052'. [ 281.738766][T12524] rust_binder: 521: no such ref 0 [ 281.754113][T12524] rust_binder: 521: no such ref 0 [ 281.759252][T12524] rust_binder: 521: no such ref 3 [ 281.764310][T12524] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 281.771452][T12524] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:521 [ 281.771484][T12524] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 281.780659][ T372] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 281.796962][T12524] rust_binder: Read failure Err(EFAULT) in pid:521 [ 281.937726][ T372] usb 5-1: device descriptor read/64, error -71 [ 282.219384][ T372] usb 5-1: device descriptor read/64, error -71 [ 282.342850][ T372] usb usb5-port1: attempt power cycle [ 282.352906][T12565] netlink: 182 bytes leftover after parsing attributes in process `syz.7.4067'. [ 282.374300][T12567] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=258 sclass=netlink_route_socket pid=12567 comm=syz.1.4070 [ 282.394695][T12565] batadv_slave_1: entered promiscuous mode [ 282.418827][T12569] cgroup: name respecified [ 282.442547][T12560] batadv_slave_1: left promiscuous mode [ 282.575799][T12580] netlink: 'syz.7.4072': attribute type 11 has an invalid length. [ 282.718358][ T372] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 282.750047][ T372] usb 5-1: device descriptor read/8, error -71 [ 282.890812][ T372] usb 5-1: device descriptor read/8, error -71 [ 283.152917][ T372] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 283.176450][ T372] usb 5-1: device descriptor read/8, error -71 [ 283.325314][ T372] usb 5-1: device descriptor read/8, error -71 [ 283.441217][ T372] usb usb5-port1: unable to enumerate USB device [ 283.533034][T12596] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:544 [ 283.615155][T12598] /dev/rnullb0: Can't open blockdev [ 284.353589][T12626] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4090'. [ 285.160912][T12685] overlayfs: failed to clone upperpath [ 285.721554][ T1377] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 285.756255][T12707] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=12925 sclass=netlink_route_socket pid=12707 comm=syz.7.4116 [ 285.881432][ T1377] usb 5-1: Using ep0 maxpacket: 16 [ 285.889013][ T1377] usb 5-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 285.898787][ T1377] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 285.908257][ T1377] usb 5-1: config 0 descriptor?? [ 285.924721][ T1377] ftdi_sio 5-1:0.0: FTDI USB Serial Device converter detected [ 286.685895][ T36] kauditd_printk_skb: 641 callbacks suppressed [ 286.685911][ T36] audit: type=1400 audit(2000000068.743:9832): avc: denied { read write } for pid=9398 comm="syz-executor" name="loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 286.730479][ T1377] usb 5-1: Detected FT232A [ 286.744362][ T1377] usb 5-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 286.769475][ T36] audit: type=1400 audit(2000000068.743:9833): avc: denied { read write open } for pid=9398 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 286.801545][ T1377] usb 5-1: USB disconnect, device number 44 [ 286.814224][ T36] audit: type=1400 audit(2000000068.743:9834): avc: denied { ioctl } for pid=9398 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 286.820998][ T1377] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 286.845543][ T36] audit: type=1400 audit(2000000068.799:9835): avc: denied { read write } for pid=12741 comm="syz.4.4128" name="binder1" dev="binder" ino=37 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 286.858016][ T1377] ftdi_sio 5-1:0.0: device disconnected [ 286.876492][ T36] audit: type=1400 audit(2000000068.799:9836): avc: denied { read write open } for pid=12741 comm="syz.4.4128" path="/dev/binderfs/binder1" dev="binder" ino=37 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 286.923742][T12746] netlink: 80 bytes leftover after parsing attributes in process `syz.7.4130'. [ 286.952711][ T36] audit: type=1400 audit(2000000068.865:9837): avc: denied { write } for pid=12741 comm="syz.4.4128" name="rtc0" dev="devtmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 287.008006][T12750] netlink: 'syz.7.4132': attribute type 14 has an invalid length. [ 287.022181][ T36] audit: type=1400 audit(2000000068.865:9838): avc: denied { write open } for pid=12741 comm="syz.4.4128" path="/dev/rtc0" dev="devtmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 287.061726][ T36] audit: type=1400 audit(2000000069.006:9839): avc: denied { read write } for pid=9398 comm="syz-executor" name="loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 287.086049][ T36] audit: type=1400 audit(2000000069.006:9840): avc: denied { read write open } for pid=9398 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 287.117370][ T36] audit: type=1400 audit(2000000069.006:9841): avc: denied { ioctl } for pid=9398 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 287.169274][T12758] netlink: 'syz.4.4135': attribute type 1 has an invalid length. [ 287.177184][T12758] netlink: 'syz.4.4135': attribute type 3 has an invalid length. [ 287.185794][T12758] netlink: 296 bytes leftover after parsing attributes in process `syz.4.4135'. [ 287.203301][T12758] loop2: detected capacity change from 0 to 8388607 [ 287.351255][T12767] rust_binder: Error while translating object. [ 287.351300][T12767] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 287.357741][T12767] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:626 [ 287.545488][T12771] netlink: 'syz.4.4139': attribute type 6 has an invalid length. [ 287.562505][T12771] IPv6: NLM_F_CREATE should be specified when creating new route [ 287.602221][T12778] @: renamed from vlan0 (while UP) [ 287.709468][T12788] 8021q: VLANs not supported on ip_vti0 [ 287.970637][ T1377] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 288.130457][ T1377] usb 5-1: Using ep0 maxpacket: 32 [ 288.137595][ T1377] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 288.147797][ T1377] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 288.156799][ T1377] usb 5-1: New USB device found, idVendor=04e7, idProduct=0009, bcdDevice= 0.00 [ 288.165864][ T1377] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 288.175019][ T1377] usb 5-1: config 0 descriptor?? [ 288.755106][T12814] netlink: 'syz.1.4154': attribute type 1 has an invalid length. [ 288.762952][T12814] netlink: 'syz.1.4154': attribute type 3 has an invalid length. [ 288.770770][T12814] netlink: 296 bytes leftover after parsing attributes in process `syz.1.4154'. [ 288.803957][T12817] erofs: dax options not supported [ 288.925567][T12825] netlink: 'syz.7.4158': attribute type 10 has an invalid length. [ 289.343764][T12854] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 289.343787][T12854] rust_binder: Read failure Err(EFAULT) in pid:594 [ 289.344359][T12855] rust_binder: BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 289.737455][T12884] netlink: 288 bytes leftover after parsing attributes in process `syz.7.4175'. [ 289.750357][T12884] futex_wake_op: syz.7.4175 tries to shift op by 144; fix this program [ 289.761206][T12884] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4175'. [ 289.823195][T12888] overlay: ./file0 is not a directory [ 289.860409][T12894] overlayfs: conflicting options: metacopy=on,redirect_dir=follow [ 289.862761][T12896] overlayfs: failed to clone lowerpath [ 289.875141][T12894] SELinux: Context system_u:object_r:admin_passwd_exec_t:s0 is not valid (left unmapped). [ 290.763945][T12941] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=12941 comm=syz.1.4195 [ 290.769624][T12942] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=12942 comm=syz.1.4195 [ 290.896926][ T1377] usb 5-1: USB disconnect, device number 45 [ 290.956609][T12958] /dev/loop0: Can't lookup blockdev [ 291.016425][T12960] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 291.016458][T12960] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:636 [ 291.349342][ T1377] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 291.447513][T12989] overlayfs: failed to clone lowerpath [ 291.521965][ T1377] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 291.531841][ T1377] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xB has an invalid bInterval 0, changing to 7 [ 291.545353][ T1377] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 291.554493][ T1377] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 291.562511][ T1377] usb 5-1: Product: syz [ 291.566686][ T1377] usb 5-1: Manufacturer: syz [ 291.571303][ T1377] usb 5-1: SerialNumber: syz [ 291.577447][ T1377] usb 5-1: config 0 descriptor?? [ 291.744271][T12992] fuseblk: Bad value for 'fd' [ 291.784297][T12994] netlink: 'syz.7.4211': attribute type 1 has an invalid length. [ 291.792160][T12994] netlink: 'syz.7.4211': attribute type 3 has an invalid length. [ 291.801166][T12994] netlink: 296 bytes leftover after parsing attributes in process `syz.7.4211'. [ 291.803780][T12975] rust_binder: Got transaction with invalid offset. [ 291.810293][T12975] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 291.817040][T12975] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:646 [ 291.835881][ T1377] usb 5-1: USB disconnect, device number 46 [ 291.868234][T12996] overlayfs: failed to clone upperpath [ 291.896944][T10039] udevd[10039]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 291.968588][T13000] netlink: 'syz.7.4214': attribute type 1 has an invalid length. [ 292.091823][ T36] kauditd_printk_skb: 784 callbacks suppressed [ 292.091842][ T36] audit: type=1400 audit(2000000073.819:10626): avc: denied { execute } for pid=12999 comm="syz.7.4214" path="/251/cpu.stat" dev="tmpfs" ino=1377 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 292.377235][ T36] audit: type=1400 audit(2000000074.081:10627): avc: denied { read write } for pid=9398 comm="syz-executor" name="loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 292.402193][ T36] audit: type=1400 audit(2000000074.081:10628): avc: denied { read write open } for pid=9398 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 292.429423][ T36] audit: type=1400 audit(2000000074.081:10629): avc: denied { ioctl } for pid=9398 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 292.463222][ T36] audit: type=1400 audit(2000000074.100:10630): avc: denied { mounton } for pid=13004 comm="syz.4.4215" path="/206/file0" dev="tmpfs" ino=1135 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 292.486298][ T36] audit: type=1400 audit(2000000074.166:10631): avc: denied { create } for pid=13004 comm="syz.4.4215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 292.506169][ T36] audit: type=1400 audit(2000000074.166:10632): avc: denied { setopt } for pid=13004 comm="syz.4.4215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 292.526274][ T36] audit: type=1400 audit(2000000074.166:10633): avc: denied { setopt } for pid=13004 comm="syz.4.4215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 292.546170][ T36] audit: type=1400 audit(2000000074.185:10634): avc: denied { create } for pid=13004 comm="syz.4.4215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 292.566047][ T36] audit: type=1400 audit(2000000074.194:10635): avc: denied { setopt } for pid=13004 comm="syz.4.4215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 292.699991][T13010] netlink: 'syz.4.4217': attribute type 4 has an invalid length. [ 292.709730][T13010] netlink: 'syz.4.4217': attribute type 4 has an invalid length. [ 292.727202][T13010] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4217'. [ 294.596552][T13016] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:619 [ 294.962368][T13032] cgroup: noprefix used incorrectly [ 295.283811][T13045] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=13045 comm=syz.7.4230 [ 295.484930][ T1377] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 295.557174][T13076] overlayfs: failed to clone lowerpath [ 295.668243][ T1377] usb 5-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 295.687415][ T1377] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 295.699664][ T1377] usb 5-1: config 0 descriptor?? [ 295.773026][T13087] kvm: apic: phys broadcast and lowest prio [ 295.895493][T13091] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=13091 comm=syz.6.4246 [ 296.100182][T13104] usb usb8: usbfs: interface 0 claimed by hub while 'syz.4.4229' resets device [ 296.333940][T13125] tipc: New replicast peer: 255.255.255.255 [ 296.340302][T13125] tipc: Enabled bearer , priority 10 [ 296.351674][T13125] overlayfs: failed to clone lowerpath [ 297.425287][ T36] kauditd_printk_skb: 589 callbacks suppressed [ 297.425305][ T36] audit: type=1400 audit(2000000078.829:11225): avc: denied { write } for pid=13186 comm="syz.1.4278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 297.451195][ T36] audit: type=1400 audit(2000000078.829:11226): avc: denied { write } for pid=13186 comm="syz.1.4278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 297.470927][ T36] audit: type=1400 audit(2000000078.829:11227): avc: denied { write } for pid=13186 comm="syz.1.4278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 297.490819][ T36] audit: type=1400 audit(2000000078.829:11228): avc: denied { write } for pid=13186 comm="syz.1.4278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 297.510721][ T36] audit: type=1400 audit(2000000078.829:11229): avc: denied { write } for pid=13186 comm="syz.1.4278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 297.530952][ T36] audit: type=1400 audit(2000000078.829:11230): avc: denied { write } for pid=13186 comm="syz.1.4278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 297.550866][ T36] audit: type=1400 audit(2000000078.829:11231): avc: denied { write } for pid=13186 comm="syz.1.4278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 297.570580][ T36] audit: type=1400 audit(2000000078.829:11232): avc: denied { write } for pid=13186 comm="syz.1.4278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 297.590279][ T36] audit: type=1400 audit(2000000078.829:11233): avc: denied { write } for pid=13186 comm="syz.1.4278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 297.610177][ T36] audit: type=1400 audit(2000000078.829:11234): avc: denied { write } for pid=13186 comm="syz.1.4278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 297.838140][T10093] bridge0: port 3(syz_tun) entered disabled state [ 297.846040][T10093] syz_tun (unregistering): left allmulticast mode [ 297.852642][T10093] syz_tun (unregistering): left promiscuous mode [ 297.859070][T10093] bridge0: port 3(syz_tun) entered disabled state [ 297.911310][ T60] bridge_slave_1: left allmulticast mode [ 297.917119][ T60] bridge_slave_1: left promiscuous mode [ 297.922833][ T60] bridge0: port 2(bridge_slave_1) entered disabled state [ 297.931110][ T60] bridge_slave_0: left allmulticast mode [ 297.936847][ T60] bridge_slave_0: left promiscuous mode [ 297.942440][ T60] bridge0: port 1(bridge_slave_0) entered disabled state [ 297.951099][ T60] tipc: Resetting bearer [ 297.972409][ T60] tipc: Disabling bearer [ 298.059837][T13213] bridge0: port 1(bridge_slave_0) entered blocking state [ 298.066925][T13213] bridge0: port 1(bridge_slave_0) entered disabled state [ 298.074022][T13213] bridge_slave_0: entered allmulticast mode [ 298.080454][T13213] bridge_slave_0: entered promiscuous mode [ 298.087951][T13213] bridge0: port 2(bridge_slave_1) entered blocking state [ 298.095004][T13213] bridge0: port 2(bridge_slave_1) entered disabled state [ 298.102159][T13213] bridge_slave_1: entered allmulticast mode [ 298.108431][T13213] bridge_slave_1: entered promiscuous mode [ 298.141506][ T60] tipc: Left network mode [ 298.150423][ T60] veth1_macvtap: left promiscuous mode [ 298.244832][T13213] bridge0: port 2(bridge_slave_1) entered blocking state [ 298.251929][T13213] bridge0: port 2(bridge_slave_1) entered forwarding state [ 298.259282][T13213] bridge0: port 1(bridge_slave_0) entered blocking state [ 298.266460][T13213] bridge0: port 1(bridge_slave_0) entered forwarding state [ 298.319317][ T329] bridge0: port 1(bridge_slave_0) entered disabled state [ 298.326783][ T329] bridge0: port 2(bridge_slave_1) entered disabled state [ 298.341376][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 298.348509][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 298.359907][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 298.367006][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 298.434074][T13213] veth0_vlan: entered promiscuous mode [ 298.474648][T13213] veth1_macvtap: entered promiscuous mode [ 298.546105][ T1377] usb 5-1: Cannot read MAC address [ 298.551319][ T1377] MOSCHIP usb-ethernet driver 5-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 298.579134][ T1377] usb 5-1: USB disconnect, device number 47 [ 298.753370][T13228] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 298.761602][T13229] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 298.908101][T13238] netlink: 'syz.4.4291': attribute type 4 has an invalid length. [ 298.920585][T13238] netlink: 'syz.4.4291': attribute type 17 has an invalid length. [ 298.938876][T13238] SELinux: security_context_str_to_sid (sytem_uGй :) failed with errno=-22 [ 298.960057][ T384] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 298.998136][T13240] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:689 [ 299.130577][ T384] usb 2-1: Using ep0 maxpacket: 32 [ 299.146872][ T384] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 299.155879][ T384] usb 2-1: config 0 has no interface number 0 [ 299.164631][ T384] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 299.174235][ T384] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 299.182222][ T384] usb 2-1: Product: syz [ 299.187359][ T384] usb 2-1: Manufacturer: syz [ 299.191984][ T384] usb 2-1: SerialNumber: syz [ 299.199197][ T384] usb 2-1: config 0 descriptor?? [ 299.207115][ T384] smsc95xx v2.0.0 [ 299.639483][T13226] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 299.648076][T13226] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 299.832153][T13247] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:659 [ 299.882256][ T384] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 299.902198][ T384] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 299.911568][ T384] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 299.922805][ T384] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 299.932137][ T384] usb 2-1: USB disconnect, device number 40 [ 300.171635][T13257] exFAT-fs (rnullb0): invalid boot record signature [ 300.178472][T13257] exFAT-fs (rnullb0): failed to read boot sector [ 300.184895][T13257] exFAT-fs (rnullb0): failed to recognize exfat type [ 300.227704][T13259] ./cgroup: Can't lookup blockdev [ 300.328316][T13262] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:705 [ 300.361276][T13267] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 300.446831][T13270] SELinux: failed to load policy [ 300.511646][T13272] rust_binder: Error while translating object. [ 300.511674][T13272] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 300.519387][T13272] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:8 [ 300.585079][T13278] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 300.593701][T13278] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 300.622412][ T384] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 300.782283][ T384] usb 5-1: Using ep0 maxpacket: 32 [ 300.791910][ T384] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 300.801014][ T384] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 300.809728][ T384] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 300.820687][ T384] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 300.830420][ T384] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 300.840113][ T384] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 300.853359][ T384] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 300.878207][ T384] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 300.899226][ T384] usb 5-1: config 0 descriptor?? [ 301.057522][T13291] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 301.071164][T13291] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:666 [ 301.102047][ T62] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 301.125454][ T384] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 48 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 301.148274][ T384] usb 5-1: USB disconnect, device number 48 [ 301.158798][ T384] usblp0: removed [ 301.286992][ T62] usb 2-1: Using ep0 maxpacket: 32 [ 301.295229][ T62] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 301.306384][ T62] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 301.317163][ T62] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 301.330152][ T62] usb 2-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 301.339248][ T62] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 301.348556][ T62] usb 2-1: config 0 descriptor?? [ 301.355945][ T62] usbhid 2-1:0.0: can't add hid device: -22 [ 301.368651][ T62] usbhid 2-1:0.0: probe with driver usbhid failed with error -22 [ 301.485800][ T384] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 301.531456][T13318] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 [ 301.656332][ T384] usb 5-1: Using ep0 maxpacket: 32 [ 301.679855][ T384] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 301.692010][T13321] netlink: 20 bytes leftover after parsing attributes in process `syz.6.4318'. [ 301.697788][ T62] usb 2-1: USB disconnect, device number 41 [ 301.701029][ T384] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 301.718571][T13321] rust_binder: 695: no such ref 3 [ 301.724431][ T384] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 301.734119][T13321] rust_binder: inc_ref_done called when no active inc_refs [ 301.734142][T13321] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 301.748451][ T384] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 301.752327][T13321] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:695 [ 301.759344][ T384] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 301.780081][ T384] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 301.794256][ T384] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 301.809080][ T384] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 301.824921][ T384] usb 5-1: config 0 descriptor?? [ 302.050202][T13267] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 302.058756][ T384] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 49 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 302.062362][T13267] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 302.081488][ T384] usb 5-1: USB disconnect, device number 49 [ 302.099521][ T384] usblp0: removed [ 302.311732][T13328] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 302.311766][T13328] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:26 [ 302.353265][T13331] loop2: detected capacity change from 0 to 8388607 [ 302.767645][ T36] kauditd_printk_skb: 682 callbacks suppressed [ 302.767662][ T36] audit: type=1400 audit(2000000083.839:11917): avc: denied { read write } for pid=13344 comm="syz.4.4326" name="binder1" dev="binder" ino=37 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 302.806928][T13345] SELinux: security_context_str_to_sid (E) failed with errno=-22 [ 302.822722][ T36] audit: type=1400 audit(2000000083.867:11918): avc: denied { read write open } for pid=13344 comm="syz.4.4326" path="/newroot/dev/binderfs/binder1" dev="binder" ino=37 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 302.891915][ T36] audit: type=1400 audit(2000000083.867:11919): avc: denied { create } for pid=13344 comm="syz.4.4326" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 302.922874][ T36] audit: type=1400 audit(2000000083.867:11920): avc: denied { sys_admin } for pid=13344 comm="syz.4.4326" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 302.946037][ T384] usb 2-1: new full-speed USB device number 42 using dummy_hcd [ 302.955371][ T36] audit: type=1400 audit(2000000083.867:11921): avc: denied { sys_admin } for pid=13344 comm="syz.4.4326" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 302.987382][ T36] audit: type=1400 audit(2000000083.886:11922): avc: denied { ioctl } for pid=13339 comm="syz.1.4324" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 303.020612][ T36] audit: type=1400 audit(2000000083.923:11923): avc: denied { read write } for pid=9398 comm="syz-executor" name="loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 303.052584][ T36] audit: type=1400 audit(2000000083.923:11924): avc: denied { read write open } for pid=9398 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 303.089289][T13352] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 303.089543][T13352] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 303.099210][ T36] audit: type=1400 audit(2000000083.932:11925): avc: denied { ioctl } for pid=9398 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 303.129541][ T384] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 303.148880][T13352] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 303.149123][T13352] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 303.165783][ T384] usb 2-1: New USB device found, idVendor=056a, idProduct=00f0, bcdDevice= 0.00 [ 303.181777][T13352] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 303.182028][T13352] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 303.183438][ T36] audit: type=1400 audit(2000000083.942:11926): avc: denied { ioctl } for pid=13339 comm="syz.1.4324" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 303.188733][T13352] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 303.219952][ T384] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 303.236271][ T384] usb 2-1: config 0 descriptor?? [ 303.477338][ T384] usbhid 2-1:0.0: can't add hid device: -71 [ 303.489121][ T384] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 303.501277][ T384] usb 2-1: USB disconnect, device number 42 [ 303.894628][ T384] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 304.054520][ T384] usb 2-1: Using ep0 maxpacket: 32 [ 304.064145][ T384] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 64 [ 304.079185][ T384] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 304.088724][ T384] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 304.096737][ T384] usb 2-1: Product: syz [ 304.102346][ T384] usb 2-1: Manufacturer: 鷪쑹֨돲曤䈕谝צּ䭽嗵ꀩ茧톢릗鏉ᴟ႙餖뉎窿矅癜ઉ洹䝃徭犐Ṱ붊㖠㖱䉋餸Ⰺ㇞纰㪾ꨞೝ퇾媺玲埗꺞쩨卖Թ㠠捛䤊⦋蚰熿ळ孪쒈屫민啻䭤⬍ᅬ퍤㣗궉郍鐻萏蛢㒊芦䗏㷬࿋鸩唷牓隊頋㡪惤ధ捶ٖ㮜혟珏䍣䌻쁌隷忯뭔쫮鸊ꊜ醄벭孔㖚昉祉篙魰⍭᳦ [ 304.137911][ T384] usb 2-1: SerialNumber: syz [ 304.523904][T13370] rust_binder: Got transaction with invalid offset. [ 304.523975][T13370] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 304.530634][T13370] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:737 [ 304.588094][ T384] cdc_ncm 2-1:1.0: bind() failure [ 304.594185][ T384] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 304.605618][T13372] rust_binder: Write failure EFAULT in pid:739 [ 304.606910][ T384] cdc_ncm 2-1:1.1: bind() failure [ 304.630197][ T384] usb 2-1: USB disconnect, device number 43 [ 304.771234][T13377] kvm: emulating exchange as write [ 304.790057][ T37] INFO: task syz.3.2426:7577 blocked for more than 122 seconds. [ 304.798646][ T37] Not tainted syzkaller #0 [ 304.804166][ T37] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 304.814458][ T37] task:syz.3.2426 state:D stack:0 pid:7577 tgid:7576 ppid:292 flags:0x00004004 [ 304.827063][ T37] Call Trace: [ 304.830734][ T37] [ 304.835356][ T37] __schedule+0x1322/0x1df0 [ 304.840346][ T37] ? __sched_text_start+0x10/0x10 [ 304.846933][ T37] ? _raw_spin_lock_irqsave+0xaf/0x150 [ 304.852626][ T37] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 304.859994][ T37] schedule+0xc6/0x240 [ 304.864269][ T37] super_lock+0x150/0x300 [ 304.870144][ T37] ? user_get_super+0x350/0x350 [ 304.875912][ T37] ? __cfi_var_wake_function+0x10/0x10 [ 304.881820][ T37] ? __kasan_check_write+0x18/0x20 [ 304.888704][ T37] iterate_supers+0x8a/0x560 [ 304.893425][ T37] ? __cfi_quota_sync_one+0x10/0x10 [ 304.900205][ T37] ? security_quotactl+0x3b/0xf0 [ 304.905276][ T37] __se_sys_quotactl+0x308/0x7d0 [ 304.911913][ T37] ? __x64_sys_quotactl+0xc0/0xc0 [ 304.917053][ T37] ? __kasan_check_write+0x18/0x20 [ 304.922843][ T37] ? fpregs_restore_userregs+0x11d/0x260 [ 304.930120][ T37] __x64_sys_quotactl+0x9f/0xc0 [ 304.935190][ T37] x64_sys_call+0x2818/0x2ee0 [ 304.941059][ T37] do_syscall_64+0x58/0xf0 [ 304.946001][ T37] ? clear_bhb_loop+0x50/0xa0 [ 304.951895][ T37] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 304.958320][ T37] RIP: 0033:0x7f9c2178f6c9 [ 304.964178][ T37] RSP: 002b:00007f9c2268f038 EFLAGS: 00000246 ORIG_RAX: 00000000000000b3 [ 304.974052][ T37] RAX: ffffffffffffffda RBX: 00007f9c219e5fa0 RCX: 00007f9c2178f6c9 [ 304.983348][ T37] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff80000101 [ 304.991556][ T37] RBP: 00007f9c21811f91 R08: 0000000000000000 R09: 0000000000000000 [ 305.001074][ T37] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 305.016432][ T37] R13: 00007f9c219e6038 R14: 00007f9c219e5fa0 R15: 00007fff2173b228 [ 305.035854][ T37] [ 305.041854][ T37] INFO: task syz.3.2426:7578 blocked for more than 123 seconds. [ 305.050925][ T37] Not tainted syzkaller #0 [ 305.056268][ T37] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 305.066936][ T37] task:syz.3.2426 state:D stack:0 pid:7578 tgid:7576 ppid:292 flags:0x00004004 [ 305.078359][ T37] Call Trace: [ 305.081946][ T37] [ 305.085169][ T37] __schedule+0x1322/0x1df0 [ 305.100639][ T37] ? __sched_text_start+0x10/0x10 [ 305.112516][ T37] ? _raw_spin_lock_irqsave+0xaf/0x150 [ 305.125024][ T37] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 305.134689][ T37] schedule+0xc6/0x240 [ 305.138905][ T37] super_lock+0x150/0x300 [ 305.144590][ T37] ? user_get_super+0x350/0x350 [ 305.149784][ T37] ? __cfi_var_wake_function+0x10/0x10 [ 305.156685][ T37] ? __kasan_check_write+0x18/0x20 [ 305.161932][ T37] iterate_supers+0x8a/0x560 [ 305.167996][ T37] ? __cfi_quota_sync_one+0x10/0x10 [ 305.180279][ T37] ? security_quotactl+0x3b/0xf0 [ 305.192378][ T37] __se_sys_quotactl+0x308/0x7d0 [ 305.205672][ T37] ? __x64_sys_quotactl+0xc0/0xc0 [ 305.214232][ T37] ? __kasan_check_write+0x18/0x20 [ 305.223499][ T37] ? fpregs_restore_userregs+0x11d/0x260 [ 305.229941][ T37] __x64_sys_quotactl+0x9f/0xc0 [ 305.234880][ T37] x64_sys_call+0x2818/0x2ee0 [ 305.240719][ T37] do_syscall_64+0x58/0xf0 [ 305.245250][ T37] ? clear_bhb_loop+0x50/0xa0 [ 305.250895][ T37] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 305.256864][ T37] RIP: 0033:0x7f9c2178f6c9 [ 305.262436][ T37] RSP: 002b:00007f9c2266e038 EFLAGS: 00000246 ORIG_RAX: 00000000000000b3 [ 305.271625][ T37] RAX: ffffffffffffffda RBX: 00007f9c219e6090 RCX: 00007f9c2178f6c9 [ 305.279653][ T37] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff80000100 [ 305.288180][ T37] RBP: 00007f9c21811f91 R08: 0000000000000000 R09: 0000000000000000 [ 305.297420][ T37] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 305.306374][ T37] R13: 00007f9c219e6128 R14: 00007f9c219e6090 R15: 00007fff2173b228 [ 305.315123][ T37] [ 305.318348][ T37] NMI backtrace for cpu 1 [ 305.318363][ T37] CPU: 1 UID: 0 PID: 37 Comm: khungtaskd Not tainted syzkaller #0 0b5ffdee5fcd2f7749818d1ff954e9c21353764e [ 305.318388][ T37] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 305.318398][ T37] Call Trace: [ 305.318405][ T37] [ 305.318413][ T37] __dump_stack+0x21/0x30 [ 305.318441][ T37] dump_stack_lvl+0x10c/0x190 [ 305.318464][ T37] ? __cfi_dump_stack_lvl+0x10/0x10 [ 305.318490][ T37] dump_stack+0x19/0x20 [ 305.318511][ T37] nmi_cpu_backtrace+0x2bf/0x2d0 [ 305.318533][ T37] ? rcu_read_unlock_special+0xab/0x410 [ 305.318556][ T37] ? __cfi_nmi_cpu_backtrace+0x10/0x10 [ 305.318577][ T37] ? __rcu_read_unlock+0xc0/0xc0 [ 305.318596][ T37] ? __cfi_nmi_raise_cpu_backtrace+0x10/0x10 [ 305.318621][ T37] ? __cfi_nmi_raise_cpu_backtrace+0x10/0x10 [ 305.318642][ T37] nmi_trigger_cpumask_backtrace+0x142/0x2c0 [ 305.318665][ T37] arch_trigger_cpumask_backtrace+0x14/0x20 [ 305.318688][ T37] watchdog+0xd8f/0xed0 [ 305.318715][ T37] ? __cfi_watchdog+0x10/0x10 [ 305.318740][ T37] ? __kasan_check_read+0x15/0x20 [ 305.318769][ T37] ? __kthread_parkme+0x138/0x180 [ 305.318788][ T37] ? schedule+0xc6/0x240 [ 305.318814][ T37] kthread+0x2ca/0x370 [ 305.318834][ T37] ? __cfi_watchdog+0x10/0x10 [ 305.318858][ T37] ? __cfi_kthread+0x10/0x10 [ 305.318879][ T37] ret_from_fork+0x67/0xa0 [ 305.318904][ T37] ? __cfi_kthread+0x10/0x10 [ 305.318922][ T37] ret_from_fork_asm+0x1a/0x30 [ 305.318952][ T37] [ 305.318960][ T37] Sending NMI from CPU 1 to CPUs 0: [ 305.472725][ C0] NMI backtrace for cpu 0 [ 305.472740][ C0] CPU: 0 UID: 0 PID: 60 Comm: kworker/u8:2 Not tainted syzkaller #0 0b5ffdee5fcd2f7749818d1ff954e9c21353764e [ 305.472760][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 305.472770][ C0] Workqueue: wg-kex-wg1 wg_packet_handshake_send_worker [ 305.472795][ C0] RIP: 0010:enqueue_entity+0x85/0xf90 [ 305.472816][ C0] Code: 00 00 e8 ce 44 01 00 48 89 df 4c 89 fe ba 05 00 00 00 e8 2e b1 ff ff 49 8d 9f a8 00 00 00 48 89 d8 48 c1 e8 03 42 80 3c 28 00 <74> 08 48 89 df e8 b1 0e 7f 00 4c 8b 33 4d 85 f6 74 57 49 8d 7e 14 [ 305.472829][ C0] RSP: 0018:ffffc900000078a8 EFLAGS: 00000046 [ 305.472842][ C0] RAX: 1ffff11020dd09ad RBX: ffff888106e84d68 RCX: b43b7c84097e8800 [ 305.472854][ C0] RDX: 0000000000008400 RSI: dffffc0000000000 RDI: ffff8881f6e4fc1c [ 305.472865][ C0] RBP: ffffc90000007910 R08: 0000000000000000 R09: 1ffff11020dd09b3 [ 305.472876][ C0] R10: 0000000000000001 R11: ffff888106e84d9c R12: ffff888106e84c00 [ 305.472887][ C0] R13: dffffc0000000000 R14: ffff8881f6e4fbd0 R15: ffff888106e84cc0 [ 305.472898][ C0] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 305.472912][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 305.472923][ C0] CR2: ffffffff8a73622a CR3: 0000000155372000 CR4: 00000000003526b0 [ 305.472937][ C0] Call Trace: [ 305.472943][ C0] [ 305.472949][ C0] ? __cfi_resched_curr+0x10/0x10 [ 305.472970][ C0] enqueue_task_fair+0x3fb/0x17e0 [ 305.472990][ C0] ? ttwu_do_activate+0x630/0x630 [ 305.473005][ C0] ? __cfi_enqueue_task_fair+0x10/0x10 [ 305.473025][ C0] enqueue_task+0x7df/0x11f0 [ 305.473038][ C0] ? try_to_wake_up+0xdfb/0x1b00 [ 305.473053][ C0] ? __cfi_enqueue_task+0x10/0x10 [ 305.473066][ C0] ? kvm_steal_clock+0x137/0x170 [ 305.473085][ C0] ? arch_scale_cpu_capacity+0x1c/0xb0 [ 305.473105][ C0] ? update_rq_clock+0x31b/0x7c0 [ 305.473124][ C0] activate_task+0x38b/0x3d0 [ 305.473137][ C0] ttwu_do_activate+0x154/0x630 [ 305.473153][ C0] try_to_wake_up+0xd87/0x1b00 [ 305.473167][ C0] ? __cfi_queue_work_on+0x10/0x10 [ 305.473184][ C0] wake_up_process+0x14/0x20 [ 305.473203][ C0] hrtimer_wakeup+0x52/0x70 [ 305.473220][ C0] ? __cfi_hrtimer_wakeup+0x10/0x10 [ 305.473236][ C0] __hrtimer_run_queues+0x3c0/0x9e0 [ 305.473254][ C0] ? hrtimer_interrupt+0xf00/0xf00 [ 305.473269][ C0] ? read_tsc+0xd/0x20 [ 305.473285][ C0] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 305.473306][ C0] hrtimer_interrupt+0x37e/0xf00 [ 305.473324][ C0] __sysvec_apic_timer_interrupt+0x8e/0x2b0 [ 305.473339][ C0] sysvec_apic_timer_interrupt+0x7d/0x90 [ 305.473355][ C0] [ 305.473360][ C0] [ 305.473366][ C0] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 305.473396][ C0] RIP: 0010:curve25519_base_arch+0xd1a/0x2fc0 [ 305.473416][ C0] Code: 41 50 c4 62 ab f6 5e 28 f3 4d 0f 38 f6 d1 66 4c 0f 38 f6 d3 4c 89 51 58 c4 62 e3 f6 6e 30 f3 49 0f 38 f6 db 66 49 0f 38 f6 de <49> c7 c0 00 00 00 00 c4 e2 8b f6 56 38 f3 4d 0f 38 f6 f5 66 4c 0f [ 305.473429][ C0] RSP: 0018:ffffc90000c87560 EFLAGS: 00000247 [ 305.473441][ C0] RAX: 5c95b9c0ab2a3a7e RBX: 84d35511330159cd RCX: ffffc90000c87700 [ 305.473453][ C0] RDX: 0098f6e1cef81c1e RSI: ffffc90000c87680 RDI: ffffc90000c87640 [ 305.473464][ C0] RBP: ffffc90000c87850 R08: 06a71fdfe8e358df R09: 007f3dab0a321b4a [ 305.473476][ C0] R10: 57ef0dcff59cb8e8 R11: 006fb24c2fad33fe R12: ffffc90000c87680 [ 305.473487][ C0] R13: 0071565d96b1bd35 R14: d6842f11ba840ec9 R15: ffffc90000c87600 [ 305.473502][ C0] ? __cfi_curve25519_base_arch+0x10/0x10 [ 305.473525][ C0] ? __crypto_memneq+0x324/0x4a0 [ 305.473546][ C0] wg_noise_handshake_create_initiation+0x22f/0x7f0 [ 305.473563][ C0] ? __cfi_wg_noise_handshake_create_initiation+0x10/0x10 [ 305.473580][ C0] ? tg_unthrottle_up+0x980/0x980 [ 305.473596][ C0] ? calc_wheel_index+0x1a7/0x8e0 [ 305.473610][ C0] ? __kasan_check_write+0x18/0x20 [ 305.473631][ C0] ? timer_update_keys+0xd0/0xd0 [ 305.473644][ C0] ? send6+0x4c0/0x670 [ 305.473662][ C0] ? kvm_sched_clock_read+0x15/0x30 [ 305.473676][ C0] ? sched_clock_noinstr+0xd/0x30 [ 305.473689][ C0] ? sched_clock+0x44/0x60 [ 305.473705][ C0] ? sched_clock_cpu+0x75/0x400 [ 305.473723][ C0] ? __cfi___update_load_avg_cfs_rq+0x10/0x10 [ 305.473741][ C0] ? __kasan_check_write+0x18/0x20 [ 305.473760][ C0] ? __switch_to_xtra+0x3ca/0xd30 [ 305.473778][ C0] ? save_fpregs_to_fpstate+0x196/0x230 [ 305.473793][ C0] ? __switch_to+0xc7b/0x1310 [ 305.473812][ C0] ? irqentry_exit+0x4a/0x60 [ 305.473826][ C0] ? sysvec_reschedule_ipi+0x73/0x80 [ 305.473840][ C0] ? ktime_get_coarse_with_offset+0x157/0x1a0 [ 305.473859][ C0] wg_packet_handshake_send_worker+0x160/0x240 [ 305.473877][ C0] ? __cfi_wg_packet_handshake_send_worker+0x10/0x10 [ 305.473896][ C0] ? finish_task_switch+0x142/0x780 [ 305.473914][ C0] ? kick_pool+0xb9/0x550 [ 305.473929][ C0] process_scheduled_works+0x7d2/0x1020 [ 305.473952][ C0] worker_thread+0xc58/0x1250 [ 305.473967][ C0] kthread+0x2ca/0x370 [ 305.473982][ C0] ? __cfi_worker_thread+0x10/0x10 [ 305.473995][ C0] ? __cfi_kthread+0x10/0x10 [ 305.474009][ C0] ret_from_fork+0x67/0xa0 [ 305.474026][ C0] ? __cfi_kthread+0x10/0x10 [ 305.474040][ C0] ret_from_fork_asm+0x1a/0x30 [ 305.474060][ C0]