last executing test programs: 3.390773146s ago: executing program 2 (id=1679): r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000480)='./binderfs/binder-control\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x32, 0xffffffffffffffff, 0x2ec37000) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, &(0x7f0000000540)={'binder1\x00'}) 3.348318237s ago: executing program 2 (id=1682): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioprio_set$pid(0x1, 0x0, 0x0) r1 = socket(0x11, 0x3, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @local}, 0x2}}, 0x2e) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r2, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000001180)={0x0, 0x3a}, 0x1, 0x0, 0x0, 0x4000011}, 0x8010) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'gre0\x00', 0x0}) getgid() bind$packet(r1, &(0x7f0000000180)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000240)=0xe9, 0x4) sendmsg$netlink(r1, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000440)=ANY=[@ANYBLOB="0201"], 0xdd12}], 0x1}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) ioprio_get$pid(0x2, 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) read$FUSE(r6, &(0x7f0000001580)={0x2020}, 0x2020) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0xd6) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x22100, 0x0) r8 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$sock_int(r8, 0x1, 0xf, &(0x7f00000000c0)=0x5, 0x4) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat=@weak_handle={0x77682a85, 0x1}, @flat=@weak_handle={0x77682a85, 0x1100, 0x2}, @ptr={0x70742a85, 0x1, &(0x7f0000000580)=""/4090, 0xffa, 0x2, 0x1}}, &(0x7f0000000140)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000180)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) 3.300317058s ago: executing program 2 (id=1686): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) r0 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f0000000180)=[{&(0x7f0000000240)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) r3 = socket(0xa, 0x1, 0x0) ioctl(r3, 0x8916, &(0x7f0000000240)) writev(r2, &(0x7f00000001c0)=[{&(0x7f00000000c0)="390000001300034700bb65e1c3e4ffff06000300010000004500000025000000190011000600ad000200000000000006040000000000000000", 0x39}], 0x1) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendto$inet6(r4, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090000006e75436914ab717528ee", 0x36, 0x1, 0x0, 0x0) splice(r4, 0x0, r1, 0x0, 0x406f413, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r0, 0x0, 0x1) openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0/file0\x00', 0x2100, 0x0) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="20000000520001000000000000000000020000000c00", @ANYRES16=r6], 0x20}}, 0x0) r7 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt(r7, 0x28, 0x5, 0x0, &(0x7f0000000000)) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="10042abd7000fbdbdf250100000000000000014100000018001700000007000000007564703a73797a3200000000"], 0x34}, 0x1, 0x0, 0x0, 0x8441}, 0x200400c1) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_GET_EXTENDED_ERROR(r8, 0xc0046209, &(0x7f0000001340)) 1.911621249s ago: executing program 0 (id=1705): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) ioprio_set$uid(0x3, 0x0, 0x64) (async) ioprio_set$uid(0x3, 0x0, 0x64) sendmsg(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="e8000000000000000b210000ff3f7c081e0f315b91fcaec7bf495d5c618332756cbb1bb9ce6d12b9d976d1f33aca41e50a3342bcd67c311f7885a05c3fcf2ae21f1498ec481e7ca2c3ca4c7b3bf94448f62e111e5a79929b9182cc977ba6ae766ce37bdaac6da997fbc15f0c79f42155b99a280667b51fdc7902d7be5ef41f953fedb32aceeada13250626957e2013d5b12cc916541ccbeb0d4060a4dd89664eaba2f6b4ede0c9e3dc1c9446d9284ebe0e46eee7bc145ff0a2779c025553298812978ea53a8c60f254f23344a80a0aac7b141787bad6b0ba090000005f2f3158f0d200000000000070000000000000000701000040000000afbb30c2946e41ef3167d1f6ed47aa1f52bad114a89dbed741f74a23cd8d915e2dcc74a4932646b90f90a9d3956d5cadb642ac79fcb0aae3654482188263abd27e9d57cc28032453dc75f333e1f367ab38b7e7719805a454e79802d07ec60c00b0000000000000000100000001"], 0x208}, 0x0) socketpair(0x1, 0x5, 0x0, &(0x7f0000000240)) (async) socketpair(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=0x0) ptrace(0x4208, r3) sendmsg(r1, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[], 0x208}, 0x0) recvmmsg(r2, &(0x7f0000001dc0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdf0e}}], 0x1, 0x2002, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@mcast1, @in6=@loopback}, {@in=@private, 0x0, 0x32}, @in6=@loopback, {0xffffffffffffffff}, {0x3}, {0x4, 0x0, 0xf3}, 0x70bd2b, 0x0, 0x2, 0x0, 0x0, 0x6e}, [@algo_auth={0x48, 0x1, {{'xcbc(aes)\x00'}}}]}, 0x138}}, 0x0) sendfile(r0, r0, 0x0, 0x7ffff000) 1.853404541s ago: executing program 3 (id=1706): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = getpid() syz_open_procfs(r1, &(0x7f0000000080)='comm\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x18, &(0x7f00000001c0)={@flat, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/10, 0xa}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, &(0x7f00000002c0)}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) getpid() (async) syz_open_procfs(r1, &(0x7f0000000080)='comm\x00') (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x18, &(0x7f00000001c0)={@flat, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/10, 0xa}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, &(0x7f00000002c0)}) (async) 1.837758021s ago: executing program 3 (id=1707): openat$ashmem(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x2, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000080)={0x42, 0x1}, 0x10) r2 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r2, 0x8910, &(0x7f00000001c0)={'vlan0\x00', 0x2f}) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000000)={0x40, 0x2, 0x3}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000011c0)=ANY=[@ANYBLOB="12010001090003206d0414c340000000000109022400010000a0000904000001030101000921000800012203000905", @ANYRES64], 0x0) syz_usb_control_io$hid(r3, &(0x7f00000001c0)={0x24, &(0x7f0000001180)=ANY=[@ANYBLOB="00020c0000000c0002"], 0x0, 0x0, 0x0}, 0x0) r4 = userfaultfd(0x1) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_WRITEPROTECT(r4, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000800000/0x800000)=nil, 0x802000}, 0x2}) fcntl$dupfd(r4, 0x0, r4) ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa08, &(0x7f00000002c0)={{&(0x7f0000c91000/0xa000)=nil, 0xa000}}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io$hid(r3, 0x0, &(0x7f0000000200)={0x2c, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000240)={0x2, &(0x7f0000000400)=[{0x28, 0x0, 0x0, 0xfffff010}, {0x6, 0xa5, 0x0, 0x6}]}, 0xffffffffffffff97) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000000)=0x15, 0x4) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000300)={'ip6_vti0\x00', 0x0}) sendto$packet(r6, &(0x7f0000000180)="10030600e0ff020002004788aa96a13bb100001100007fca1a00", 0x1a, 0x0, &(0x7f0000000140)={0x11, 0x0, r8}, 0x14) syz_usb_control_io$hid(r3, 0x0, 0x0) pipe(&(0x7f0000000040)) 1.316763829s ago: executing program 3 (id=1715): stat(0x0, 0x0) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', 0x0, 0x0, 0x2125099, 0x0) umount2(&(0x7f0000000040)='.\x00', 0x2) mount$bind(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) 1.26265283s ago: executing program 3 (id=1717): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x1081, 0x200000000000}) fchmodat(0xffffffffffffff9c, 0x0, 0x1ff) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000540)={'macsec0\x00', 0x7ffc}) (async, rerun: 32) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f00000001c0)=[@enter_looper], 0x53, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70b7a440"}) (async, rerun: 32) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x4, 0x0, &(0x7f0000000040)=[@register_looper], 0x50, 0x0, &(0x7f0000000140)="b23fa6e1e653b2a2fcb8ff0ea7290da4e1593a3edf0f0c9796d7b5190f49d5bcda05a5b5ab9949be179eca4c02b12ac3ea2aa481ad6b2b5da3188d299b5483f1411733f6b08a46b85d1234f4635cd083"}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x10}], 0x0, 0x0, 0x0}) (async, rerun: 32) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000340)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (rerun: 32) 1.26112255s ago: executing program 3 (id=1719): ioprio_set$uid(0x3, 0x0, 0x0) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1fd2, 0x6007, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) r3 = openat$random(0xffffffffffffff9c, &(0x7f000000fe80), 0x40800, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) ioctl$RNDADDENTROPY(r3, 0x40085203, &(0x7f0000000000)=ANY=[@ANYBLOB="04000000000010"]) syz_usb_control_io$hid(r2, &(0x7f0000000240)={0x24, 0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x0}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x8, 0x97c}, 0x0) socket$tipc(0x1e, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000180)={0x1, 0x8}, 0x0) read(0xffffffffffffffff, &(0x7f0000000000), 0x2002) r6 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_buf(r6, 0x0, 0x29, 0x0, &(0x7f0000000080)) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000080)={0x1, 0x0, 0x100801f9, 0x1, 0xb94}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sched_setaffinity(r4, 0x8, &(0x7f0000000100)=0xa400000000000000) sched_setscheduler(r4, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_io_uring_setup(0x3b45, &(0x7f0000000000)={0x0, 0xc5f8, 0x1, 0x1, 0xc3}, 0x0, &(0x7f0000000180)) sendfile(r0, r0, 0x0, 0x7ffff000) 1.107060432s ago: executing program 0 (id=1721): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x20e02, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x11, r0, 0x45809000) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) ioctl$VHOST_SET_LOG_BASE(r1, 0x4008af04, &(0x7f0000000300)=&(0x7f0000000240)) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0, 0xeeee0000}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x1) 1.092325633s ago: executing program 0 (id=1722): openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000340)=ANY=[@ANYBLOB="0209000007000000000000000000000005001700322000000a"], 0x38}}, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x141a82, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) write$cgroup_int(r1, &(0x7f0000000040)=0x900, 0x12) r3 = socket$inet6(0xa, 0x1, 0x0) r4 = dup2(r3, r3) ioctl$sock_inet6_SIOCDELRT(r4, 0x890c, &(0x7f0000000640)={@remote, @private0={0xfc, 0x0, '\x00', 0x10}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x40000, 0x40, 0x5, 0x100, 0x0, 0x40180043}) ioctl$BLKROGET(r4, 0x125e, &(0x7f0000000000)) 1.025555723s ago: executing program 0 (id=1724): sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="4400000002010101000000000000000002"], 0x44}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000002200"], 0x1c}], 0x1}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/snmp6\x00') writev(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)="0475f083306c76729811c07bdbb4ccd031edcb6fe9ec19619f083a01e0300a392b6f309d1d1a28fb3205c4091564061a72133acdfce13f34846c62e5ba35da7a86bdfa6bde9ffef4bb908ab8a76193e6a8b5d93b4643970db17855d6940d73f354ad21714768f4a056accdecf42d93327364a045e5b2a304fce1576b9fe807edb7d1d2", 0x83}, {&(0x7f0000000340)="fdbe5c1e8fc653aee18039e55375a3f1d8a64f32329fefb678c385bf1f33e98ad30860958322c61d583d26f458ce1bdbe8db9525204b552381403529cecbfa300fe40c4f3404aab8d9f2e4f0b4931321218cad23d5715086d3770b576cd365b641f432c425afba1f1810bc29073341165da7bdb9e87b3c38d28f17d6bc", 0x7d}, {&(0x7f00000004c0)="3d57469dd244d663edb9e4ac861b1f7531829dcb02f18182d9ac5af49a786b1c0f30ad1b2d6e4690e89614535b48652db19b5db90acfdadb3784a4f6255a66c00dc396a1b322093cac870a845c1bf0cea5c2be41f780d2c7b7419a82d6226379905cee3653297410293e27a66464c6c24ddcbdf0f28021381c", 0x79}], 0x3) ioctl$VT_SETMODE(r3, 0x5602, &(0x7f0000000080)={0x8, 0xee, 0x3ff, 0x3, 0x6}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000300)=[@increfs], 0x0, 0x0, 0x0}) close(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000480)={0x20, 0x0, &(0x7f0000000000)=[@request_death, @clear_death], 0xfc, 0x1000000, 0x0}) 1.024903543s ago: executing program 0 (id=1726): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x800) setsockopt$packet_int(r1, 0x107, 0xb, &(0x7f0000000080)=0x883a, 0x4) keyctl$set_reqkey_keyring(0xe, 0x7) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x1081, 0x200000000000}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40106309, 0x2}], 0x50, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x10}], 0x0, 0x0, 0x0}) 871.086276ms ago: executing program 1 (id=1735): syslog(0x3, &(0x7f0000000000)=""/64, 0x40) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='vfat\x00', 0x200000, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x7ffff000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x141800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) r5 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$inet(r5, &(0x7f0000000740)={&(0x7f0000000140)={0x2, 0x4e22, @local}, 0x10, 0x0, 0x0, &(0x7f0000000600)=[@ip_retopts={{0x34, 0x0, 0x7, {[@timestamp_prespec={0x44, 0x24, 0x17, 0x3, 0x5, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x7188}, {@broadcast, 0x9}, {@dev={0xac, 0x14, 0x14, 0x22}, 0xfffffffa}, {@remote, 0x3}]}]}}}], 0x38}, 0x4000014) connect$can_bcm(r3, &(0x7f00000000c0)={0x1d, r4}, 0x10) sendmsg$can_bcm(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="01000000310200000700000000000000c7c55ab0f30694ff461b81b9716e3891aeaeee21567f56a63305a8d6607eaf3683387eb208aac20d5744da655c3d5d349006552fc36494e46df543efa51e9ce3c497edc5f1e417e4cebfcdd10501389c02", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="00000000010000000200000003030000ae771958a0cb06cc"], 0x48}}, 0x20000000) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f0000000280)=@arm64) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2/binder0\x00', 0x802, 0x0) r7 = socket$inet6(0xa, 0x3, 0x3a) ioctl$INCFS_IOC_PERMIT_FILL(r7, 0x40046721, &(0x7f00000002c0)={r6}) dup3(r6, r7, 0x80000) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) 828.280887ms ago: executing program 1 (id=1736): r0 = syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000600)={'ip6_vti0\x00', &(0x7f0000000100)={'syztnl2\x00', 0x0, 0x29, 0x8, 0xe1, 0x9, 0x14, @empty, @empty, 0x70, 0x40, 0x5, 0x8}}) stat(0x0, 0x0) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x8000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', 0x0, 0x0, 0x2125099, 0x0) umount2(&(0x7f0000000040)='.\x00', 0x2) 815.334157ms ago: executing program 1 (id=1737): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) r1 = mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086303, r1}], 0xf7, 0x0, &(0x7f0000000340)="321900651ac4f0efabda43826b22f7c19387f7fa8f3be60261d533d168adba2d197711dcf616d9f3f5eb78b38a088390a07d032c042085c2b8a1d330e72c94018850579408c82d2e1deef11afcdf475c3c96885cff3342ee23c9e314c88ff080e9f06528389ff023d6efbe6baf5ca7ec1c5ea98b076972b1d99968923b4180cc7f4bd7ff63a468477b562c359388a0c67f386cfbedef50aa90d90ea047ca11583ec12073ded975c4b8ab60cc1302fa8cb069144ab4fddd54cba2567212d9cc83484212c18a1cd7adb9fea99e2a2c9a32df9b81fe040f17425e2ccbca5562edf7edceb8bf77654b70f25459634a7e1b0e36c70352774568"}) 728.917558ms ago: executing program 3 (id=1739): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) sendmsg$NFQNL_MSG_VERDICT_BATCH(0xffffffffffffffff, 0x0, 0x8000) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) ppoll(&(0x7f0000000080)=[{r1, 0x4020}], 0x1, &(0x7f0000000180)={r2, r3+10000000}, &(0x7f00000001c0)={[0x2]}, 0x8) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000580)={0x0}) openat$dir(0xffffff9c, 0x0, 0x40000, 0x4) gettid() timer_create(0x7, &(0x7f0000000140)={0x0, 0xf, 0x4, @thr={&(0x7f0000001440)="c5530cbbed1b7d32d318e225c9f871a3ba6ac6e38e44d1511507dda88937255e03a70145e0fa488a9bade998fbfda40716adefbd0a69347d7ee4b75b0c47906bf6625260bec3e95b599f0a92878df7", &(0x7f00000014c0)="6adca670e1f2ebc94ca52f9267bb68ae2a28aa9d70a2edf65b3cb0047adbf0e1d95e79ba957b0efec5a59b3edf3de1cc88e1415d7216bf5ba410eff57225"}}, &(0x7f0000001400)) sendmmsg(r0, 0x0, 0x0, 0x81) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000240)) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r1, 0xc0182101, &(0x7f00000003c0)={r4}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x1081, 0x200000000000}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r5, 0x0) inotify_init1(0x800) r6 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCNOTTY(r7, 0x5422) writev(r6, &(0x7f0000000300)=[{0x0}, {&(0x7f0000000200)="100e670873968ef09ad2dc91a457ec22b19fc326b944f5c4c818", 0x1a}], 0x2) close_range(r6, r6, 0x0) socket$inet6(0xa, 0x3, 0x87) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x18d) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') pipe2$9p(&(0x7f00000000c0), 0x4800) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x105042, 0x0) 343.779844ms ago: executing program 1 (id=1738): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000080)={0x1, 0x0, [{0x8f, 0x0, 0x3}]}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) prctl$PR_SET_MM(0x23, 0xa, &(0x7f00002d5000/0x2000)=nil) prctl$PR_SET_MM(0x23, 0xb, &(0x7f0000951000/0x1000)=nil) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r5, 0x4068aea3, &(0x7f0000000080)) ioctl$KVM_SET_GSI_ROUTING(r5, 0x4008ae6a, &(0x7f0000000200)={0x1, 0x0, [{0x0, 0x5, 0x0, 0x0, @msi={0x6fb4}}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000300)=[@increfs_done={0x40106308, 0x1}], 0x0, 0x0, 0x0}) 287.314365ms ago: executing program 2 (id=1740): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x22102, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) eventfd(0x2) (async) r3 = eventfd(0x2) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000080)={r3, 0x1}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) close_range(r0, 0xffffffffffffffff, 0x0) (async) close_range(r0, 0xffffffffffffffff, 0x0) 159.753057ms ago: executing program 0 (id=1741): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) write(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect(0x0, 0x3b, &(0x7f0000000140)=ANY=[@ANYBLOB="120100001b3ebd40d80483009c830102030109022900010000000009040000000202010004"], 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) 115.012978ms ago: executing program 2 (id=1742): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x89901) lsetxattr$trusted_overlay_upper(0x0, &(0x7f0000000600), 0x0, 0xff, 0x3) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) close(0xffffffffffffffff) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, 0x0) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) mkdir(&(0x7f00000003c0)='./file0\x00', 0x16) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir, 0x3a}], [], 0x2f}) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000000c0)='./file0/../file0/../file0/../file0/../file0\x00') r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder-control\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_READY(r2, 0xc1086201, 0x20002000) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)=0xf) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6}]}, 0x10) bind$bt_hci(r4, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) ioctl$TCFLSH(r3, 0x400455c8, 0x0) 95.798198ms ago: executing program 2 (id=1743): r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/nf_conntrack\x00') pread64(r0, &(0x7f000001a240)=""/102400, 0x19000, 0x41e) (async) mount$binderfs(0x0, &(0x7f0000000280)='./binderfs\x00', 0x0, 0x20c0421, 0x0) 23.652489ms ago: executing program 1 (id=1744): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) (async) r1 = socket$inet_icmp(0x2, 0x2, 0x1) (async) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x60840, 0x0) (async) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f00000002c0)={0x3f}) (async) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x3) (async) write$uinput_user_dev(r3, &(0x7f0000001740)={'syz1\x00', {}, 0x0, [], [], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100]}, 0x45c) (async) fcntl$setlease(r2, 0x400, 0x0) unlink(&(0x7f0000000080)='./file0\x00') (async) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async, rerun: 32) readv(r1, &(0x7f0000001240)=[{&(0x7f0000000040)=""/183, 0xb7}], 0x1) (async, rerun: 32) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) (async) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r5 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000), 0xd6603, 0x0) write$cgroup_int(r5, &(0x7f0000000040)=0x7fff, 0x12) getsockopt$inet6_tcp_buf(r4, 0x6, 0xb, 0x0, &(0x7f0000000080)) 0s ago: executing program 1 (id=1745): ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x1081, 0x200000000000}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2d, 0x0, 0x0, 0x0}, 0x10}], 0x0, 0x0, 0x0}) kernel console output (not intermixed with test programs): 750629860.220:704): avc: denied { load_policy } for pid=2679 comm="syz.3.711" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 83.723162][ T2680] SELinux: failed to load policy [ 83.852508][ T10] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 83.893500][ T10] usb 3-1: device descriptor read/8, error -71 [ 84.002543][ T2206] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 84.023601][ T10] usb 3-1: device descriptor read/8, error -71 [ 84.142536][ T10] usb usb3-port1: unable to enumerate USB device [ 84.154033][ T2206] usb 4-1: config 0 has an invalid interface number: 97 but max is 0 [ 84.162289][ T2206] usb 4-1: config 0 has no interface number 0 [ 84.168605][ T2206] usb 4-1: too many endpoints for config 0 interface 97 altsetting 116: 97, using maximum allowed: 30 [ 84.182438][ T2206] usb 4-1: config 0 interface 97 altsetting 116 has 0 endpoint descriptors, different from the interface descriptor's value: 97 [ 84.195970][ T2206] usb 4-1: config 0 interface 97 has no altsetting 0 [ 84.202906][ T2206] usb 4-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 84.212091][ T2206] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 84.221141][ T2206] usb 4-1: config 0 descriptor?? [ 84.420049][ T36] audit: type=1400 audit(1750629860.910:705): avc: denied { write } for pid=2695 comm="syz.1.717" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 84.449355][ T2680] binder: Unknown parameter 'coyBLV"i5ntext' [ 84.462480][ T2206] usb 4-1: string descriptor 0 read error: -71 [ 84.471144][ T2206] usb 4-1: Cannot read MAC address [ 84.482364][ T2206] MOSCHIP usb-ethernet driver 4-1:0.97: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 84.506814][ T2704] 9pnet_fd: Insufficient options for proto=fd [ 84.513720][ T2206] usb 4-1: USB disconnect, device number 21 [ 84.537751][ T36] audit: type=1400 audit(1750629861.030:706): avc: denied { write } for pid=2705 comm="syz.0.722" name="/" dev="incremental-fs" ino=857 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 84.564613][ T36] audit: type=1400 audit(1750629861.030:707): avc: denied { add_name } for pid=2705 comm="syz.0.722" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 84.573351][ T2712] SELinux: security_context_str_to_sid () failed with errno=-22 [ 84.585705][ T36] audit: type=1400 audit(1750629861.030:708): avc: denied { create } for pid=2705 comm="syz.0.722" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 84.613414][ T36] audit: type=1400 audit(1750629861.030:709): avc: denied { associate } for pid=2705 comm="syz.0.722" name="file0" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 84.664505][ T2716] 9pnet_fd: Insufficient options for proto=fd [ 84.772204][ T2725] fuseblk: Bad value for 'source' [ 84.793790][ T36] audit: type=1400 audit(1750629861.280:710): avc: denied { create } for pid=2726 comm="syz.0.730" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 84.808301][ T2730] bridge0: port 3(syz_tun) entered blocking state [ 84.820435][ T2730] bridge0: port 3(syz_tun) entered disabled state [ 84.827599][ T2730] syz_tun: entered allmulticast mode [ 84.834405][ T2730] syz_tun: entered promiscuous mode [ 84.839865][ T2730] bridge0: port 3(syz_tun) entered blocking state [ 84.846379][ T2730] bridge0: port 3(syz_tun) entered forwarding state [ 84.856955][ T2730] binder: Unknown parameter 'coyBLV"i5ntext' [ 84.879428][ T2733] SELinux: security_context_str_to_sid () failed with errno=-22 [ 84.902726][ T2735] 9p: Unknown access argument : -22 [ 84.930014][ T2737] rust_binder: Write failure EFAULT in pid:468 [ 84.953415][ T36] audit: type=1400 audit(1750629861.450:711): avc: denied { ioctl } for pid=2734 comm="syz.0.733" path="socket:[19917]" dev="sockfs" ino=19917 ioctlcmd=0x48cb scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 85.041233][ T2742] netlink: 'syz.2.735': attribute type 8 has an invalid length. [ 85.126644][ T2748] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:566 [ 85.127847][ T2748] rust_binder: Read failure Err(EFAULT) in pid:566 [ 85.234635][ T2206] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 85.260843][ T2756] rust_binder: Write failure EINVAL in pid:477 [ 85.291951][ T2760] binder: Unknown parameter '0x0000000000000000' [ 85.340685][ T36] audit: type=1400 audit(1750629861.830:712): avc: denied { setopt } for pid=2761 comm="syz.2.743" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 85.364719][ T2762] 9pnet_fd: Insufficient options for proto=fd [ 85.391507][ T2765] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 85.392531][ T2206] usb 1-1: Using ep0 maxpacket: 8 [ 85.406849][ T2206] usb 1-1: unable to get BOS descriptor or descriptor too short [ 85.415396][ T2206] usb 1-1: config 10 has an invalid interface number: 81 but max is 0 [ 85.423853][ T2206] usb 1-1: config 10 has no interface number 0 [ 85.430111][ T2206] usb 1-1: config 10 interface 81 has no altsetting 0 [ 85.439026][ T2206] usb 1-1: New USB device found, idVendor=05dc, idProduct=0001, bcdDevice= 0.01 [ 85.448234][ T2206] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.456391][ T2206] usb 1-1: Product: syz [ 85.460727][ T2206] usb 1-1: Manufacturer: syz [ 85.465483][ T2206] usb 1-1: SerialNumber: syz [ 85.549583][ T2773] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 85.549920][ T2773] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 85.557183][ T2775] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 85.565601][ T2773] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 85.585656][ T2778] binder: Bad value for 'max' [ 85.651386][ T2785] SELinux: security_context_str_to_sid (sytem_uGй) failed with errno=-22 [ 85.674436][ T2206] ums-jumpshot 1-1:10.81: USB Mass Storage device detected [ 85.693787][ T2206] ums-jumpshot 1-1:10.81: Quirks match for vid 05dc pid 0001: 2 [ 85.737539][ T2206] usb 1-1: USB disconnect, device number 27 [ 85.798838][ T2800] binder: Unknown parameter 'coyBLV"i5ntext' [ 85.829118][ T2802] overlayfs: failed to resolve './file0': -2 [ 86.064330][ T2824] netlink: 116 bytes leftover after parsing attributes in process `syz.2.760'. [ 86.078433][ T2824] binder: Unknown parameter 'defcontext01777777777777777777777' [ 86.096340][ T2826] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:573 [ 86.097109][ T2826] rust_binder: Read failure Err(EFAULT) in pid:573 [ 86.155597][ T2834] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 86.185375][ T2833] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 86.198263][ T2834] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 86.237293][ T2841] binder: Unknown parameter 'coyBLntext' [ 86.249851][ T2843] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:580 [ 86.281990][ T2846] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 86.292509][ T2846] rust_binder: Read failure Err(EFAULT) in pid:510 [ 86.547056][ T2862] rust_binder: Write failure EFAULT in pid:592 [ 86.965844][ T2867] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:549 [ 86.966689][ T2866] rust_binder: Error while translating object. [ 86.981469][ T2866] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 86.987700][ T2866] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:549 [ 87.094150][ T2881] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:601 [ 87.112842][ T2883] binder: Unknown parameter 'context' [ 87.155327][ T2884] rust_binder: Error while translating object. [ 87.155362][ T2884] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 87.161797][ T2884] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:601 [ 87.201505][ T2891] rust_binder: Error in use_page_slow: ESRCH [ 87.201537][ T2891] rust_binder: use_range failure ESRCH [ 87.207074][ T2893] overlay: filesystem on ./bus not supported as upperdir [ 87.208808][ T2891] rust_binder: Failed to allocate buffer. len:40, is_oneway:false [ 87.221023][ T2891] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 87.229111][ T2891] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:604 [ 87.270553][ T2899] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:524 [ 87.582531][ T10] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 87.703797][ T2913] binder: Unknown parameter 'defcontext' [ 87.753427][ T10] usb 1-1: config 0 has an invalid interface number: 25 but max is 0 [ 87.761581][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 87.782610][ T10] usb 1-1: config 0 has no interface number 0 [ 87.788802][ T10] usb 1-1: config 0 interface 25 altsetting 205 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 87.820383][ T10] usb 1-1: config 0 interface 25 has no altsetting 0 [ 87.844000][ T10] usb 1-1: New USB device found, idVendor=1b3b, idProduct=2951, bcdDevice=9e.ee [ 87.853192][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.861215][ T10] usb 1-1: Product: syz [ 87.872501][ T10] usb 1-1: Manufacturer: syz [ 87.877165][ T10] usb 1-1: SerialNumber: syz [ 87.887787][ T10] usb 1-1: config 0 descriptor?? [ 88.038108][ T2970] rust_binder: Write failure EFAULT in pid:608 [ 88.073823][ T2976] rust_binder: Write failure EINVAL in pid:611 [ 88.257582][ T2987] kvm: vcpu 0: requested 64 ns lapic timer period limited to 200000 ns [ 88.445358][ T3010] rust_binder: Error while translating object. [ 88.445394][ T3010] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 88.458631][ T3010] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:621 [ 88.749890][ T3033] rust_binder: Failed to allocate buffer. len:40, is_oneway:false [ 88.769305][ T36] kauditd_printk_skb: 43 callbacks suppressed [ 88.769325][ T36] audit: type=1400 audit(1750629865.260:756): avc: denied { getopt } for pid=3035 comm="syz.0.813" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 88.809632][ T10] usb 1-1: Found UVC 0.00 device syz (1b3b:2951) [ 88.818101][ T10] usb 1-1: No valid video chain found. [ 88.845379][ T10] usb 1-1: USB disconnect, device number 28 [ 88.857835][ T3042] netlink: 12 bytes leftover after parsing attributes in process `syz.2.816'. [ 88.869935][ T3046] incfs: Error accessing: ./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 88.870215][ T3046] incfs: mount failed -36 [ 88.963030][ T36] audit: type=1400 audit(1750629865.410:757): avc: denied { lock } for pid=3045 comm="syz.3.817" path="/dev/binderfs/binder0" dev="binder" ino=19 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 89.029736][ T36] audit: type=1400 audit(1750629865.520:758): avc: denied { mounton } for pid=3055 comm="syz.0.819" path="/proc/531/cgroup" dev="proc" ino=22600 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=file permissive=1 [ 89.068122][ T3046] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 89.068156][ T3046] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:635 [ 89.078512][ T36] audit: type=1400 audit(1750629865.520:759): avc: denied { remount } for pid=3055 comm="syz.0.819" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=filesystem permissive=1 [ 89.125934][ T36] audit: type=1400 audit(1750629865.520:760): avc: denied { execheap } for pid=3055 comm="syz.0.819" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 89.157055][ T3066] overlayfs: failed to resolve './file0': -2 [ 89.172522][ T36] audit: type=1400 audit(1750629865.520:761): avc: denied { bind } for pid=3057 comm="syz.2.821" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 89.205531][ T3071] : renamed from xfrm0 (while UP) [ 89.232548][ T36] audit: type=1326 audit(1750629865.560:762): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3055 comm="syz.0.819" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3df0d8e929 code=0x7ffc0000 [ 89.273165][ T36] audit: type=1326 audit(1750629865.560:763): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3055 comm="syz.0.819" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3df0d8e929 code=0x7ffc0000 [ 89.276732][ T3081] overlayfs: failed to clone upperpath [ 89.302490][ T3071] rust_binder: Write failure EINVAL in pid:639 [ 89.302785][ T3071] rust_binder: Error in use_page_slow: ESRCH [ 89.305188][ T36] audit: type=1326 audit(1750629865.560:764): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3055 comm="syz.0.819" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f3df0d8e929 code=0x7ffc0000 [ 89.308980][ T3071] rust_binder: use_range failure ESRCH [ 89.308999][ T3071] rust_binder: Failed to allocate buffer. len:40, is_oneway:false [ 89.309018][ T3071] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 89.338219][ T36] audit: type=1326 audit(1750629865.560:765): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3055 comm="syz.0.819" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3df0d8e929 code=0x7ffc0000 [ 89.361629][ T3071] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:639 [ 89.446183][ T2206] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 89.508137][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.517080][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.525721][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.534551][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.543232][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.552588][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.558448][ T3076] rust_binder: Read failure Err(EFAULT) in pid:533 [ 89.561227][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.576648][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.593529][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.602674][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.611147][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.620907][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.622520][ T2206] usb 3-1: Using ep0 maxpacket: 32 [ 89.634729][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.635581][ T2206] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 89.643854][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.651626][ T2206] usb 3-1: config 0 has no interface number 0 [ 89.666318][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.669353][ T2206] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 89.675234][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.684515][ T2206] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.700793][ T2206] usb 3-1: Product: syz [ 89.705371][ T2206] usb 3-1: Manufacturer: syz [ 89.707428][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.712739][ T2206] usb 3-1: SerialNumber: syz [ 89.719415][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.732567][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.739091][ T2206] usb 3-1: config 0 descriptor?? [ 89.741365][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.749616][ T2206] smsc95xx v2.0.0 [ 89.758310][ T2206] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 89.758674][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.768595][ T2206] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -22 [ 89.777716][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.795090][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.805474][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.814091][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.823218][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.832275][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.841165][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.850720][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.859825][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.868814][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.878892][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.888372][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.897362][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.897618][ T3123] @: renamed from vlan0 (while UP) [ 89.911205][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.920531][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.929339][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.940049][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.944943][ T3127] rust_binder: Write failure EFAULT in pid:543 [ 89.950027][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 89.959944][ T31] usb 3-1: USB disconnect, device number 26 [ 89.978058][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 89.992723][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 90.001471][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 90.042808][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 90.051713][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 90.060689][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 90.069754][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 90.105160][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 90.114330][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 90.123465][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 90.132355][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 90.140003][ T3138] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:553 [ 90.141641][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 90.160185][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 90.169001][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 90.181004][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 90.189674][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 90.198496][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 90.212742][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 90.221480][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 90.230151][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 90.238955][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 90.248081][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 90.256895][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 90.265557][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 90.274333][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 90.283026][ T3117] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 90.291990][ T3117] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 90.395723][ T3163] binder: Bad value for 'max' [ 90.420583][ T3164] binder: Bad value for 'defcontext' [ 90.482543][ T3178] rust_binder: Write failure EINVAL in pid:570 [ 90.523298][ T3182] rust_binder: Write failure EINVAL in pid:605 [ 90.526310][ T3189] tipc: Started in network mode [ 90.535600][ T3182] rust_binder: Write failure EINVAL in pid:605 [ 90.542545][ T3189] tipc: Node identity ac14140f, cluster identity 4711 [ 90.556574][ T3189] tipc: New replicast peer: 255.255.255.255 [ 90.563047][ T3189] tipc: Enabled bearer , priority 10 [ 90.569583][ T3194] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 90.582880][ T3189] overlayfs: failed to clone upperpath [ 90.612795][ T3195] af_packet: tpacket_rcv: packet too big, clamped from 25 to 4294967272. macoff=96 [ 90.625807][ T3194] rust_binder: Error in use_page_slow: ESRCH [ 90.625832][ T3194] rust_binder: use_range failure ESRCH [ 90.633147][ T3194] rust_binder: Failed to allocate buffer. len:4232, is_oneway:false [ 90.638912][ T3194] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 90.647029][ T3194] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:607 [ 90.656874][ T3201] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 90.725722][ T3205] tmpfs: Invalid gid '0x00000000ffffffff' [ 90.770760][ T3208] input: syz1 as /devices/virtual/input/input10 [ 90.814548][ T3213] rust_binder: Failed to allocate buffer. len:128, is_oneway:false [ 90.916675][ T3232] /dev/rnullb0: Can't open blockdev [ 91.353055][ T3251] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 91.365437][ T3251] bridge0: port 3(gretap0) entered blocking state [ 91.378416][ T3251] bridge0: port 3(gretap0) entered disabled state [ 91.385304][ T3251] gretap0: entered allmulticast mode [ 91.391561][ T3251] gretap0: entered promiscuous mode [ 91.397368][ T3251] bridge0: port 3(gretap0) entered blocking state [ 91.403895][ T3251] bridge0: port 3(gretap0) entered forwarding state [ 91.411996][ T3251] rust_binder: Write failure EINVAL in pid:645 [ 91.412100][ T3252] rust_binder: Write failure EINVAL in pid:645 [ 91.455073][ T1457] Bluetooth: hci0: Frame reassembly failed (-84) [ 91.682537][ T468] tipc: Node number set to 2886997007 [ 91.731735][ T3275] overlayfs: failed to clone upperpath [ 91.774678][ T3282] overlayfs: failed to resolve './file0': -2 [ 91.852571][ T2206] usb 1-1: new low-speed USB device number 29 using dummy_hcd [ 92.015051][ T2206] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 8 [ 92.026296][ T2206] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x82 is Bulk; changing to Interrupt [ 92.036754][ T2206] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x3 is Bulk; changing to Interrupt [ 92.212558][ T468] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 92.363617][ T468] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 92.374794][ T468] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 92.385202][ T468] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 92.398921][ T468] usb 4-1: New USB device found, idVendor=056a, idProduct=0017, bcdDevice= 0.00 [ 92.408649][ T468] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.417946][ T468] usb 4-1: config 0 descriptor?? [ 93.512562][ T53] Bluetooth: hci0: command 0x1003 tx timeout [ 93.512562][ T428] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 93.772602][ T305] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 93.922508][ T305] usb 3-1: Using ep0 maxpacket: 16 [ 93.928895][ T305] usb 3-1: config 4 has an invalid interface number: 15 but max is 0 [ 93.937271][ T305] usb 3-1: config 4 has no interface number 0 [ 93.943521][ T305] usb 3-1: config 4 interface 15 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 93.953404][ T305] usb 3-1: config 4 interface 15 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 93.963366][ T305] usb 3-1: config 4 interface 15 has no altsetting 0 [ 93.971491][ T305] usb 3-1: New USB device found, idVendor=0930, idProduct=0a13, bcdDevice=76.44 [ 93.980604][ T305] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.988747][ T305] usb 3-1: Product: syz [ 93.992962][ T305] usb 3-1: Manufacturer: syz [ 93.997631][ T305] usb 3-1: SerialNumber: syz [ 94.003364][ T3334] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 94.010810][ T3334] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 94.186531][ T36] kauditd_printk_skb: 33 callbacks suppressed [ 94.186550][ T36] audit: type=1326 audit(1750629870.680:799): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3328 comm="syz.1.913" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f166f92ab19 code=0x7fc00000 [ 94.216186][ T36] audit: type=1326 audit(1750629870.680:800): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3328 comm="syz.1.913" exe="/root/syz-executor" sig=0 arch=c000003e syscall=13 compat=0 ip=0x7f166f92abdf code=0x7fc00000 [ 94.240627][ T3334] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 94.248182][ T3334] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 94.303449][ T36] audit: type=1400 audit(1750629870.800:801): avc: denied { create } for pid=3344 comm="syz.1.918" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 94.330535][ T36] audit: type=1400 audit(1750629870.820:802): avc: denied { unlink } for pid=761 comm="syz-executor" name="file0" dev="tmpfs" ino=1362 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 94.361885][ T3352] 9pnet: p9_errstr2errno: server reported unknown error aaaaaaa [ 94.626134][ T2206] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 94.643946][ T2206] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.652315][ T2206] usb 1-1: Product: Р [ 94.656719][ T2206] usb 1-1: Manufacturer: 餃ᨰȶ攢淳싼ꗿỺ씪ା啛ᄧ삔튬䭽餎㑏䦫䆝຤㓓鮺欽ꗆ㝔፼郄蠛㇇⴦ͷ궵귷찅 [ 94.677055][ T2206] usb 1-1: can't set config #1, error -71 [ 94.685162][ T2206] usb 1-1: USB disconnect, device number 29 [ 95.025618][ T468] usbhid 4-1:0.0: can't add hid device: -71 [ 95.031686][ T468] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 95.041397][ T468] usb 4-1: USB disconnect, device number 22 [ 95.081318][ T36] audit: type=1400 audit(1750629871.570:803): avc: denied { connect } for pid=3367 comm="syz.3.925" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 95.102375][ T36] audit: type=1400 audit(1750629871.590:804): avc: denied { map } for pid=3367 comm="syz.3.925" path="socket:[24624]" dev="sockfs" ino=24624 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 95.126654][ T36] audit: type=1400 audit(1750629871.590:805): avc: denied { accept } for pid=3367 comm="syz.3.925" path="socket:[24624]" dev="sockfs" ino=24624 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 95.477602][ T3383] binder: Unknown parameter 'L9' [ 95.577993][ T3334] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 95.586697][ T3334] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 95.589809][ T3389] rust_binder: Error while translating object. [ 95.595284][ T3334] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 95.596871][ T3389] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 95.601815][ T3334] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 95.611455][ T3389] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:592 [ 95.628176][ T3389] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 95.637534][ T3391] rust_binder: Error while translating object. [ 95.650432][ T3391] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 95.650460][ T3391] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:592 [ 95.742628][ T3393] SELinux: security_context_str_to_sid () failed with errno=-22 [ 95.822000][ T3406] syz.0.938 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 95.822906][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0006: -71 [ 95.844686][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0005: -71 [ 95.855798][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 95.867038][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 95.878119][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 95.889910][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 95.901497][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0002: -71 [ 95.905122][ T3411] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:602 [ 95.912781][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 95.938534][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0002: -71 [ 95.950327][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 [ 95.961406][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 [ 95.973724][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 95.974510][ T36] audit: type=1400 audit(1750629872.470:806): avc: denied { ioctl } for pid=3415 comm="syz.0.942" path="socket:[23820]" dev="sockfs" ino=23820 ioctlcmd=0x8982 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 95.984880][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x001f: -71 [ 96.020807][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0019: -71 [ 96.033647][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x001f: -71 [ 96.052739][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 96.063997][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 96.082877][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 96.094081][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to read reg index 0x000e: -71 [ 96.112744][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 96.132718][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 96.143905][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 96.155316][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 96.166484][ T305] ax88179_178a 3-1:4.15 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 96.180053][ T305] ax88179_178a 3-1:4.15 eth1: register 'ax88179_178a' at usb-dummy_hcd.2-1, Toshiba USB Ethernet Adapter, 3c:0c:2e:00:00:00 [ 96.203284][ T305] usb 3-1: USB disconnect, device number 27 [ 96.209753][ T305] ax88179_178a 3-1:4.15 eth1: unregister 'ax88179_178a' usb-dummy_hcd.2-1, Toshiba USB Ethernet Adapter [ 96.369261][ T36] audit: type=1400 audit(1750629872.860:807): avc: denied { getopt } for pid=3421 comm="syz.2.944" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 96.416096][ T36] audit: type=1400 audit(1750629872.910:808): avc: denied { nlmsg_tty_audit } for pid=3428 comm="syz.2.946" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 96.473496][ T3431] overlayfs: failed to clone upperpath [ 97.178622][ T3496] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=770 sclass=netlink_route_socket pid=3496 comm=syz.1.970 [ 97.192562][ T3497] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=770 sclass=netlink_route_socket pid=3497 comm=syz.1.970 [ 97.512586][ T10] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 97.662576][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 97.669194][ T10] usb 3-1: config index 0 descriptor too short (expected 16456, got 72) [ 97.677671][ T10] usb 3-1: config 0 has an invalid interface number: 125 but max is 1 [ 97.686872][ T10] usb 3-1: config 0 has an invalid interface number: 125 but max is 1 [ 97.695208][ T10] usb 3-1: config 0 has an invalid interface number: 125 but max is 1 [ 97.703535][ T10] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 97.712437][ T10] usb 3-1: config 0 has no interface number 0 [ 97.718699][ T10] usb 3-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 97.729838][ T10] usb 3-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 97.739758][ T10] usb 3-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 97.749628][ T10] usb 3-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 97.762729][ T10] usb 3-1: config 0 interface 125 has no altsetting 0 [ 97.769510][ T10] usb 3-1: config 0 interface 125 has no altsetting 2 [ 97.780007][ T10] usb 3-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 97.789260][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.797333][ T10] usb 3-1: Product: syz [ 97.801522][ T10] usb 3-1: Manufacturer: syz [ 97.806381][ T10] usb 3-1: SerialNumber: syz [ 97.812089][ T10] usb 3-1: config 0 descriptor?? [ 98.175195][ T3539] syzkaller0: entered promiscuous mode [ 98.180824][ T3539] syzkaller0: entered allmulticast mode [ 98.193656][ T3539] rust_binder: Write failure EINVAL in pid:623 [ 98.625700][ T3571] overlayfs: failed to clone upperpath [ 98.956751][ T3577] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 99.022498][ T2206] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 99.193748][ T2206] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 99.204900][ T2206] usb 1-1: New USB device found, idVendor=046d, idProduct=c295, bcdDevice= 0.00 [ 99.214554][ T2206] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.227733][ T2206] usb 1-1: config 0 descriptor?? [ 99.636970][ T2206] logitech 0003:046D:C295.0009: unknown main item tag 0x0 [ 99.644225][ T2206] logitech 0003:046D:C295.0009: unknown main item tag 0x0 [ 99.651376][ T2206] logitech 0003:046D:C295.0009: unknown main item tag 0x0 [ 99.658568][ T2206] logitech 0003:046D:C295.0009: unknown main item tag 0x0 [ 99.665937][ T2206] logitech 0003:046D:C295.0009: unknown main item tag 0x0 [ 99.673521][ T2206] logitech 0003:046D:C295.0009: unknown main item tag 0x0 [ 99.680780][ T2206] logitech 0003:046D:C295.0009: unknown main item tag 0x0 [ 99.689543][ T2206] logitech 0003:046D:C295.0009: hidraw0: USB HID v0.00 Device [HID 046d:c295] on usb-dummy_hcd.0-1/input0 [ 99.700906][ T2206] logitech 0003:046D:C295.0009: no inputs found [ 99.838765][ T3575] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 99.848264][ T3575] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 99.856713][ T3575] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 144, size: 255) [ 99.856748][ T3575] rust_binder: Error while translating object. [ 99.867475][ T3575] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 99.873947][ T3575] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:632 [ 99.884525][ T10] usb 1-1: USB disconnect, device number 30 [ 99.937598][ T3640] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION already set [ 99.944929][ T3640] rust_binder: Write failure EINVAL in pid:742 [ 100.019544][ T3645] overlayfs: failed to resolve './file1': -2 [ 100.032229][ T3645] rust_binder: Error while translating object. [ 100.032262][ T3645] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 100.038557][ T3645] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:747 [ 100.094186][ T3649] kvm: Disabled LAPIC found during irq injection [ 100.234963][ T36] kauditd_printk_skb: 11 callbacks suppressed [ 100.234983][ T36] audit: type=1400 audit(1750629876.730:820): avc: denied { bind } for pid=3662 comm="syz.1.1030" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 100.262502][ T36] audit: type=1400 audit(1750629876.750:821): avc: denied { name_bind } for pid=3664 comm="syz.3.1031" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 100.302975][ T10] usb 3-1: USB disconnect, device number 28 [ 100.365411][ T3682] overlayfs: failed to resolve './file1': -2 [ 100.379504][ T3683] serio: Serial port ttynull [ 100.457518][ T3699] rust_binder: Write failure EINVAL in pid:642 [ 100.462121][ T3700] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000000 not found [ 100.476753][ T3700] rust_binder: Write failure EINVAL in pid:672 [ 100.493854][ T3704] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 100.501086][ T3704] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 100.507628][ T3704] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:674 [ 100.542816][ T36] audit: type=1400 audit(1750629877.040:822): avc: denied { write } for pid=3703 comm="syz.2.1045" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 100.576971][ T36] audit: type=1400 audit(1750629877.040:823): avc: denied { open } for pid=3703 comm="syz.2.1045" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 100.643876][ T36] audit: type=1400 audit(1750629877.140:824): avc: denied { read } for pid=3709 comm="syz.2.1048" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 100.672537][ T468] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 100.757679][ T36] audit: type=1400 audit(1750629877.250:825): avc: denied { bind } for pid=3713 comm="syz.2.1050" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 100.823710][ T468] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 100.834160][ T468] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 100.844031][ T468] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 100.852533][ T10] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 100.853340][ T468] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 100.869006][ T468] usb 4-1: SerialNumber: syz [ 101.003726][ T10] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 101.015618][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 101.026743][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 101.037562][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 101.050753][ T10] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 101.060136][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.072719][ T10] usb 1-1: config 0 descriptor?? [ 101.081682][ T468] usb 4-1: 0:2 : does not exist [ 101.091003][ T468] usb 4-1: USB disconnect, device number 23 [ 101.273620][ T319] udevd[319]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 101.491656][ T10] plantronics 0003:047F:FFFF.000A: report_id 0 is invalid [ 101.512529][ T10] plantronics 0003:047F:FFFF.000A: item 0 0 1 8 parsing failed [ 101.520333][ T10] plantronics 0003:047F:FFFF.000A: parse failed [ 101.532613][ T10] plantronics 0003:047F:FFFF.000A: probe with driver plantronics failed with error -22 [ 101.659915][ T3738] rust_binder: validate_parent_fixup: new_min_offset=56, sg_entry.length=0 [ 101.659935][ T3738] rust_binder: Error while translating object. [ 101.668834][ T3738] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 101.680469][ T3738] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:767 [ 101.692081][ T3738] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 101.696547][ T3708] rust_binder: Write failure EINVAL in pid:648 [ 101.701513][ T36] audit: type=1400 audit(1750629878.180:826): avc: denied { setattr } for pid=3707 comm="syz.0.1047" name="[io_uring]" dev="anon_inodefs" ino=25528 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 101.710273][ T2206] usb 1-1: USB disconnect, device number 31 [ 101.719826][ T3744] usb usb8: usbfs: process 3744 (syz.2.1059) did not claim interface 0 before use [ 101.840557][ T3757] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 101.846580][ T3757] rust_binder: validate_parent_fixup: new_min_offset=56, sg_entry.length=0 [ 101.853090][ T3757] rust_binder: Error while translating object. [ 101.861727][ T3757] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 101.867949][ T3757] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:705 [ 101.904527][ T3759] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 101.942839][ T36] audit: type=1400 audit(1750629878.440:827): avc: denied { setopt } for pid=3764 comm="syz.2.1067" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 102.012694][ T305] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 102.163645][ T305] usb 4-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=a0.b5 [ 102.172799][ T305] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.181469][ T305] usb 4-1: config 0 descriptor?? [ 102.226886][ T36] audit: type=1400 audit(1750629878.720:828): avc: denied { map } for pid=3772 comm="syz.1.1070" path="socket:[24531]" dev="sockfs" ino=24531 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 102.491240][ T3787] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:715 [ 102.529776][ T36] audit: type=1400 audit(1750629879.020:829): avc: denied { ioctl } for pid=3788 comm="syz.2.1075" path="socket:[25724]" dev="sockfs" ino=25724 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 102.563832][ T10] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 102.584914][ T3792] SELinux: security_context_str_to_sid (sytem_uGй) failed with errno=-22 [ 102.594009][ T3791] SELinux: security_context_str_to_sid (sytem_uGй) failed with errno=-22 [ 102.612736][ T3748] rust_binder: Error while translating object. [ 102.612768][ T3748] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 102.619082][ T3748] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:772 [ 102.630406][ T305] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 102.649704][ T305] asix 4-1:0.0 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 102.660237][ T305] asix 4-1:0.0: probe with driver asix failed with error -71 [ 102.668561][ T305] usb 4-1: USB disconnect, device number 24 [ 102.715886][ T10] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 102.727837][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 102.740324][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 102.750400][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 102.764620][ T10] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 102.773883][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.782917][ T10] usb 1-1: config 0 descriptor?? [ 103.000932][ T10] usbhid 1-1:0.0: can't add hid device: -71 [ 103.007539][ T10] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 103.011485][ T3811] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1081'. [ 103.016999][ T10] usb 1-1: USB disconnect, device number 32 [ 103.158663][ T3824] netlink: 84 bytes leftover after parsing attributes in process `syz.1.1086'. [ 103.168082][ T3824] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1086'. [ 103.178727][ T3826] netlink: 84 bytes leftover after parsing attributes in process `syz.1.1086'. [ 103.187953][ T3824] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1086'. [ 103.362553][ T10] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 103.513704][ T10] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 103.524963][ T10] usb 1-1: config 27 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 103.536792][ T10] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 103.547836][ T10] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 103.557821][ T10] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 103.566913][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.576984][ T10] usb 1-1: invalid MIDI out EP 0 [ 103.584810][ T10] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 103.630903][ T354] udevd[354]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:27.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 103.671890][ T3841] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 103.677170][ T3843] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1093'. [ 103.781220][ T3815] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 103.781247][ T3815] rust_binder: Read failure Err(EFAULT) in pid:659 [ 103.791487][ T421] usb 1-1: USB disconnect, device number 33 [ 104.448998][ T3868] syz.0.1101: attempt to access beyond end of device [ 104.448998][ T3868] loop0: rw=0, sector=0, nr_sectors = 1 limit=0 [ 104.462046][ T3868] FAT-fs (loop0): unable to read boot sector [ 104.525941][ T3877] binder: Bad value for 'stats' [ 104.550512][ T3882] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 104.559203][ T3882] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 104.575183][ T3882] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 104.583778][ T3882] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 104.752549][ T2206] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 104.782567][ T305] usb 4-1: new full-speed USB device number 25 using dummy_hcd [ 104.902530][ T2206] usb 1-1: Using ep0 maxpacket: 16 [ 104.912172][ T2206] usb 1-1: config 0 has an invalid interface number: 41 but max is 0 [ 104.920411][ T2206] usb 1-1: config 0 has no interface number 0 [ 104.926614][ T2206] usb 1-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 104.936560][ T2206] usb 1-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 104.947005][ T2206] usb 1-1: config 0 interface 41 has no altsetting 0 [ 104.955579][ T2206] usb 1-1: New USB device found, idVendor=0fe6, idProduct=9700, bcdDevice=d1.9a [ 104.964705][ T2206] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.972779][ T2206] usb 1-1: Product: syz [ 104.977061][ T2206] usb 1-1: Manufacturer: syz [ 104.981813][ T2206] usb 1-1: SerialNumber: syz [ 104.987862][ T2206] usb 1-1: config 0 descriptor?? [ 104.993422][ T3875] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 105.000906][ T3875] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 105.062225][ T3898] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 105.071931][ T3900] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 105.134877][ T3908] netlink: 'syz.1.1115': attribute type 11 has an invalid length. [ 105.208887][ T3875] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 105.216210][ T3875] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 105.373695][ T3912] random: crng reseeded on system resumption [ 105.379769][ T36] kauditd_printk_skb: 3 callbacks suppressed [ 105.379787][ T36] audit: type=1400 audit(1750629881.870:833): avc: denied { write } for pid=3911 comm="syz.2.1117" name="snapshot" dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 105.422194][ T36] audit: type=1400 audit(1750629881.910:834): avc: denied { ioctl } for pid=3911 comm="syz.2.1117" path="/dev/snapshot" dev="devtmpfs" ino=21 ioctlcmd=0x3305 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 105.647900][ T2206] Error reading MAC address [ 105.904727][ T3923] rust_binder: 3875 RLIMIT_NICE not set [ 105.982501][ T305] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 106.142491][ T305] usb 4-1: Using ep0 maxpacket: 16 [ 106.148814][ T305] usb 4-1: config 4 has an invalid interface number: 15 but max is 0 [ 106.157235][ T305] usb 4-1: config 4 has no interface number 0 [ 106.163437][ T305] usb 4-1: config 4 interface 15 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 106.173347][ T305] usb 4-1: config 4 interface 15 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 106.183530][ T305] usb 4-1: config 4 interface 15 has no altsetting 0 [ 106.191939][ T305] usb 4-1: New USB device found, idVendor=0930, idProduct=0a13, bcdDevice=76.44 [ 106.201185][ T305] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.209269][ T305] usb 4-1: Product: syz [ 106.213517][ T305] usb 4-1: Manufacturer: syz [ 106.218145][ T305] usb 4-1: SerialNumber: syz [ 106.223966][ T3919] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 106.231233][ T3919] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 106.407825][ T2206] sr9700 1-1:0.41: probe with driver sr9700 failed with error -71 [ 106.417551][ T2206] usb 1-1: USB disconnect, device number 34 [ 106.439338][ T3919] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 106.446824][ T3919] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 106.572320][ T3934] syzkaller0: entered allmulticast mode [ 106.578927][ T3934] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:685 [ 106.578958][ T3934] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 106.588192][ T3934] rust_binder: Read failure Err(EFAULT) in pid:685 [ 106.643692][ T3937] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 106.737250][ T3944] input: syz1 as /devices/virtual/input/input11 [ 106.788202][ T36] audit: type=1400 audit(1750629883.280:835): avc: denied { read } for pid=3943 comm="syz.3.1126" name="msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 106.812920][ T36] audit: type=1400 audit(1750629883.290:836): avc: denied { open } for pid=3943 comm="syz.3.1126" path="/dev/cpu/0/msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 106.888506][ T36] audit: type=1400 audit(1750629883.380:837): avc: denied { shutdown } for pid=3955 comm="syz.1.1131" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 106.908383][ T2206] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 106.962857][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 107.062997][ T2206] usb 1-1: Using ep0 maxpacket: 16 [ 107.069236][ T2206] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 107.080165][ T2206] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 107.089961][ T2206] usb 1-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 107.099023][ T2206] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.107732][ T2206] usb 1-1: config 0 descriptor?? [ 107.182830][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 [ 107.194273][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to read reg index 0x0006: -71 [ 107.205149][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): invalid MAC address, using random [ 107.216084][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0006: -71 [ 107.228220][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0005: -71 [ 107.239375][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 107.250605][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 107.262011][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 107.273177][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 107.284422][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0002: -71 [ 107.295644][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 107.311569][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0002: -71 [ 107.323149][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 [ 107.334444][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 [ 107.335178][ T3984] rust_binder: Error while translating object. [ 107.345874][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 107.346733][ T3984] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 107.352420][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x001f: -71 [ 107.363059][ T3984] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:821 [ 107.372774][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x0019: -71 [ 107.411371][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x001f: -71 [ 107.422887][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 107.434340][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 107.451635][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 107.467185][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to read reg index 0x000e: -71 [ 107.478366][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 107.490117][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 107.502546][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 107.517050][ T4004] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000000 not found [ 107.525492][ T4004] rust_binder: Write failure EINVAL in pid:829 [ 107.525701][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 107.550757][ T305] ax88179_178a 4-1:4.15 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 107.564944][ T305] ax88179_178a 4-1:4.15 eth1: register 'ax88179_178a' at usb-dummy_hcd.3-1, Toshiba USB Ethernet Adapter, 36:6b:a4:7f:12:92 [ 107.602611][ T305] usb 4-1: USB disconnect, device number 26 [ 107.618601][ T305] ax88179_178a 4-1:4.15 eth1: unregister 'ax88179_178a' usb-dummy_hcd.3-1, Toshiba USB Ethernet Adapter [ 107.698812][ T2206] usbhid 1-1:0.0: can't add hid device: -71 [ 107.721430][ T2206] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 107.742884][ T3912] Restarting kernel threads ... done. [ 107.753506][ T2206] usb 1-1: USB disconnect, device number 35 [ 107.776304][ T4017] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 107.805771][ T4021] input: syz0 as /devices/virtual/input/input12 [ 107.826932][ T4025] tmpfs: Bad value for 'nr_inodes' [ 107.935346][ T4044] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 107.947622][ T4032] fuse: Unknown parameter 'goup_id' [ 108.137953][ T4057] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1156'. [ 108.190729][ T4067] binder: Unknown parameter 'ync ' [ 108.196549][ T4067] rust_binder: Write failure EFAULT in pid:765 [ 108.213590][ T4072] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 108.221945][ T4072] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1158'. [ 108.254264][ T4075] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 108.665149][ T36] audit: type=1400 audit(1750629885.160:838): avc: denied { listen } for pid=4083 comm="syz.2.1161" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 108.772903][ T4095] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 108.806211][ T4109] rust_binder: Write failure EFAULT in pid:788 [ 108.885662][ T4125] tipc: Enabling of bearer rejected, already enabled [ 108.908821][ T4128] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 108.956632][ T36] audit: type=1400 audit(1750629885.450:839): avc: denied { create } for pid=4123 comm="syz.1.1175" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 108.957654][ T4129] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00aa [ 109.142517][ T421] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 109.302626][ T421] usb 3-1: Using ep0 maxpacket: 32 [ 109.313072][ T421] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 109.321265][ T421] usb 3-1: config 0 has no interface number 0 [ 109.334060][ T421] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 109.352607][ T421] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.361350][ T421] usb 3-1: Product: syz [ 109.369621][ T421] usb 3-1: Manufacturer: syz [ 109.374563][ T421] usb 3-1: SerialNumber: syz [ 109.380410][ T421] usb 3-1: config 0 descriptor?? [ 109.387474][ T421] smsc95xx v2.0.0 [ 109.580832][ T4149] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 109.581404][ T4149] rust_binder: validate_parent_fixup: new_min_offset=56, sg_entry.length=0 [ 109.588326][ T4149] rust_binder: Error while translating object. [ 109.598482][ T4149] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 109.604994][ T4149] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:712 [ 109.752563][ T53] Bluetooth: hci0: command 0x1003 tx timeout [ 109.752844][ T428] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 109.797576][ T421] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 109.809011][ T421] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 109.902378][ T4160] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 109.925735][ T36] audit: type=1400 audit(1750629886.420:840): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 109.960355][ T4164] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 109.960717][ T4164] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 109.976784][ T4164] rust_binder: Write failure EINVAL in pid:719 [ 109.985977][ T4171] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 110.022227][ T36] audit: type=1400 audit(1750629886.510:841): avc: denied { append } for pid=4177 comm="syz.3.1189" name="ppp" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 110.252513][ T31] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 110.382525][ T31] usb 1-1: device descriptor read/64, error -71 [ 110.452602][ T4128] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION already set [ 110.460525][ T4128] rust_binder: Write failure EINVAL in pid:795 [ 110.462874][ T4187] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 110.469613][ T4128] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 110.485587][ T4128] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 110.501485][ T421] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000104: -71 [ 110.512466][ T421] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -71 [ 110.521982][ T421] usb 3-1: USB disconnect, device number 29 [ 110.622530][ T31] usb 1-1: device descriptor read/64, error -71 [ 110.812548][ T421] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 110.872493][ T31] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 110.917190][ T4220] overlay: ./file0 is not a directory [ 110.973581][ T421] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 111.000252][ T421] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 111.012504][ T31] usb 1-1: device descriptor read/64, error -71 [ 111.020641][ T421] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 111.031734][ T421] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 111.052885][ T421] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 111.061961][ T421] usb 3-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 111.082603][ T421] usb 3-1: Manufacturer: syz [ 111.092805][ T421] usb 3-1: config 0 descriptor?? [ 111.252522][ T31] usb 1-1: device descriptor read/64, error -71 [ 111.362634][ T31] usb usb1-port1: attempt power cycle [ 111.450287][ T4222] 9pnet_fd: Insufficient options for proto=fd [ 111.502934][ T421] appleir 0003:05AC:8243.000B: unknown main item tag 0x0 [ 111.510246][ T421] appleir 0003:05AC:8243.000B: No inputs registered, leaving [ 111.537725][ T421] appleir 0003:05AC:8243.000B: hiddev96,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.2-1/input0 [ 111.693608][ T4245] 9pnet: p9_errstr2errno: server reported unknown error pA;KZ4 [ 111.712605][ T31] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 111.745208][ T31] usb 1-1: device descriptor read/8, error -71 [ 111.763875][ T4191] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:800 [ 111.814372][ T36] audit: type=1400 audit(1750629888.310:842): avc: denied { watch watch_reads } for pid=4257 comm="syz.1.1217" path="/400/file0" dev="tmpfs" ino=2177 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 111.877657][ T31] usb 1-1: device descriptor read/8, error -71 [ 112.132519][ T31] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 112.153901][ T31] usb 1-1: device descriptor read/8, error -71 [ 112.271993][ T45] usb 3-1: USB disconnect, device number 30 [ 112.293638][ T31] usb 1-1: device descriptor read/8, error -71 [ 112.353901][ T4281] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 112.367079][ T4281] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 112.373931][ T4281] rust_binder: Write failure EINVAL in pid:804 [ 112.402716][ T31] usb usb1-port1: unable to enumerate USB device [ 112.498303][ T4284] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 112.498953][ T4285] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 112.522547][ T4285] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:807 [ 112.552842][ T36] audit: type=1400 audit(1750629889.050:843): avc: denied { execute } for pid=4286 comm="syz.2.1227" name="file0" dev="ramfs" ino=28397 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 112.584337][ T36] audit: type=1400 audit(1750629889.060:844): avc: denied { nosuid_transition } for pid=4286 comm="syz.2.1227" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=process2 permissive=1 [ 112.605646][ T36] audit: type=1400 audit(1750629889.060:845): avc: denied { transition } for pid=4286 comm="syz.2.1227" path="/file0" dev="ramfs" ino=28397 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=process permissive=1 [ 112.631702][ T36] audit: type=1400 audit(1750629889.060:846): avc: denied { entrypoint } for pid=4286 comm="syz.2.1227" path="/file0" dev="ramfs" ino=28397 scontext=system_u:object_r:hugetlbfs_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 112.655020][ T36] audit: type=1400 audit(1750629889.060:847): avc: denied { share } for pid=4286 comm="syz.2.1227" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=process permissive=1 [ 112.675181][ T36] audit: type=1400 audit(1750629889.060:848): avc: denied { noatsecure } for pid=4286 comm="syz.2.1227" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=process permissive=1 [ 113.051359][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.051393][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.059108][ T4294] netlink: 'syz.0.1229': attribute type 12 has an invalid length. [ 113.059128][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.059148][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.080353][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.088398][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.095840][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.102736][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.109400][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.117040][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.127586][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.134753][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.143215][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.150691][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.157478][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.164406][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.171142][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.179172][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.186046][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.197917][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.205293][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.211917][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.223309][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.237236][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.245962][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.252910][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.259541][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.267165][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.274802][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.281490][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.322512][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.329166][ T4296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 113.332956][ T36] audit: type=1400 audit(1750629889.820:849): avc: denied { execute } for pid=4302 comm="syz.0.1232" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=111 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 113.458125][ T4311] tipc: Cannot configure node identity twice [ 113.465731][ T4311] binder: Bad value for 'defcontext' [ 113.495165][ T36] audit: type=1400 audit(1750629889.990:850): avc: denied { bind } for pid=4290 comm="syz.2.1228" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 113.567243][ T4316] Unsupported ieee802154 address type: 0 [ 113.685857][ T4327] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 4200, limit: 4216, size: 89) [ 113.685887][ T4327] rust_binder: Error while translating object. [ 113.707904][ T36] audit: type=1400 audit(1750629890.200:851): avc: denied { mounton } for pid=4317 comm="syz.3.1238" path="/279/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 113.712561][ T4327] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 113.737128][ T4327] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:821 [ 113.810952][ T4332] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:823 [ 113.832556][ T31] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 113.972545][ T31] usb 1-1: device descriptor read/64, error -71 [ 114.212551][ T31] usb 1-1: device descriptor read/64, error -71 [ 114.452573][ T31] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 114.582545][ T31] usb 1-1: device descriptor read/64, error -71 [ 114.832975][ T31] usb 1-1: device descriptor read/64, error -71 [ 114.943092][ T31] usb usb1-port1: attempt power cycle [ 115.282550][ T31] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 115.313616][ T31] usb 1-1: device descriptor read/8, error -71 [ 115.368658][ T305] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 115.378563][ T305] hid-generic 0000:0000:0000.000C: hidraw0: HID v0.00 Device [syz1] on syz0 [ 115.453500][ T31] usb 1-1: device descriptor read/8, error -71 [ 115.692600][ T31] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 115.713699][ T31] usb 1-1: device descriptor read/8, error -71 [ 115.805245][ T4382] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1255'. [ 115.843857][ T31] usb 1-1: device descriptor read/8, error -71 [ 115.952666][ T31] usb usb1-port1: unable to enumerate USB device [ 116.369238][ T4396] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 116.372501][ T4396] rust_binder: Write failure EFAULT in pid:844 [ 116.382845][ T4396] rust_binder: validate_parent_fixup: new_min_offset=100, sg_entry.length=0 [ 116.389057][ T4396] rust_binder: Error while translating object. [ 116.398030][ T4396] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 116.404252][ T4396] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:844 [ 116.503958][ T4398] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 116.513864][ T4398] rust_binder: Got transaction with invalid offset. [ 116.520370][ T4398] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 116.527091][ T4398] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:846 [ 116.546727][ T4400] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 116.671917][ T4406] SELinux: security_context_str_to_sid () failed with errno=-22 [ 116.812530][ T10] usb 3-1: new full-speed USB device number 31 using dummy_hcd [ 116.963676][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 116.976881][ T10] usb 3-1: New USB device found, idVendor=1b96, idProduct=0005, bcdDevice= 0.00 [ 116.985980][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 116.994706][ T10] usb 3-1: config 0 descriptor?? [ 117.132554][ T31] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 117.282539][ T31] usb 4-1: Using ep0 maxpacket: 32 [ 117.289171][ T31] usb 4-1: config 1 interface 0 altsetting 8 bulk endpoint 0x1 has invalid maxpacket 8 [ 117.299110][ T31] usb 4-1: config 1 interface 0 altsetting 8 bulk endpoint 0x82 has invalid maxpacket 1023 [ 117.309170][ T31] usb 4-1: config 1 interface 0 has no altsetting 0 [ 117.317356][ T31] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 117.326829][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.334911][ T31] usb 4-1: Product: syz [ 117.339200][ T31] usb 4-1: Manufacturer: syz [ 117.343853][ T31] usb 4-1: SerialNumber: syz [ 117.349885][ T4416] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 117.357483][ T4416] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 117.402701][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.409721][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.416693][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.423857][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.430841][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.438012][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.445159][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.452159][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.459117][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.466158][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.473105][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.480099][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.480446][ T36] kauditd_printk_skb: 18 callbacks suppressed [ 117.480476][ T36] audit: type=1400 audit(1750629893.970:870): avc: denied { ioctl } for pid=4427 comm="syz.0.1271" path="socket:[28855]" dev="sockfs" ino=28855 ioctlcmd=0x8982 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 117.487038][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.487068][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.496240][ T36] audit: type=1400 audit(1750629893.990:871): avc: denied { getopt } for pid=4427 comm="syz.0.1271" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 117.519415][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.559051][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.566531][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.573729][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.580081][ T31] usblp 4-1:1.0: usblp0: USB Bidirectional printer dev 27 if 0 alt 8 proto 2 vid 0x0525 pid 0xA4A8 [ 117.580658][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.593721][ T31] usb 4-1: USB disconnect, device number 27 [ 117.602199][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.606439][ T31] usblp0: removed [ 117.613545][ T4429] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 117.614815][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.619019][ T4400] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 117.622756][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.630489][ T4400] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 117.638069][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.659172][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.667268][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.668055][ T4433] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 117.674663][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.678173][ T4433] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 144, size: 255) [ 117.681758][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.688700][ T4433] rust_binder: Error while translating object. [ 117.699092][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.706253][ T4433] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 117.713256][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.719439][ T4433] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:853 [ 117.728842][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.751274][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.758297][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.768252][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.775622][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.783094][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.800281][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.807800][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.826584][ T10] ntrig 0003:1B96:0005.000D: unknown main item tag 0x0 [ 117.834739][ T10] ntrig 0003:1B96:0005.000D: hidraw0: USB HID v0.00 Device [HID 1b96:0005] on usb-dummy_hcd.2-1/input0 [ 117.851496][ T10] usb 3-1: USB disconnect, device number 31 [ 117.888710][ T4448] fido_id[4448]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 117.889163][ T4452] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 117.918845][ T4452] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 117.927469][ T4452] rust_binder: Read failure Err(EFAULT) in pid:861 [ 117.982249][ T4473] rust_binder: Write failure EFAULT in pid:867 [ 118.029822][ T4481] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.045927][ T4481] kvm: emulating exchange as write [ 118.059684][ T4481] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:754 [ 118.138340][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.147604][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.154551][ T4507] rust_binder: Error in use_page_slow: ESRCH [ 118.160767][ T4507] rust_binder: use_range failure ESRCH [ 118.170618][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.181892][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.182420][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.189105][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.196092][ T4507] rust_binder: Failed to allocate buffer. len:4200, is_oneway:false [ 118.210305][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.210874][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.223844][ T4507] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 118.224073][ T4507] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:759 [ 118.235092][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.242688][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.257440][ T4514] overlayfs: failed to clone upperpath [ 118.264629][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.264652][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.271250][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.278150][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.285076][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.291701][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.298853][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.305406][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.312058][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.318808][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.326687][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.333314][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.336372][ T4509] kvm: apic: phys broadcast and lowest prio [ 118.339892][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.352346][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.358853][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.365455][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.371976][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.378596][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.385462][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.392063][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.398634][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.405144][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.411632][ T4504] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 118.436225][ T4519] input: syz0 as /devices/virtual/input/input13 [ 118.697084][ T36] audit: type=1400 audit(1750629895.190:872): avc: denied { setattr } for pid=4528 comm="syz.2.1304" name="#de" dev="tmpfs" ino=1637 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 118.762530][ T31] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 118.922488][ T31] usb 1-1: Using ep0 maxpacket: 32 [ 118.934693][ T31] usb 1-1: config 0 has an invalid interface number: 195 but max is 0 [ 118.952760][ T31] usb 1-1: config 0 has no interface number 0 [ 118.963873][ T31] usb 1-1: New USB device found, idVendor=0403, idProduct=ed22, bcdDevice=55.ea [ 118.982559][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.000815][ T31] usb 1-1: Product: syz [ 119.018365][ T31] usb 1-1: Manufacturer: syz [ 119.042520][ T31] usb 1-1: SerialNumber: syz [ 119.048076][ T31] usb 1-1: config 0 descriptor?? [ 119.061051][ T4545] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:875 [ 119.066211][ T4545] rust_binder: Failed to allocate buffer. len:96, is_oneway:false [ 119.082560][ T4545] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 119.090528][ T4545] rust_binder: Read failure Err(EFAULT) in pid:875 [ 119.110797][ T4545] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 119.258930][ T4526] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 119.277919][ T31] hub 1-1:0.195: bad descriptor, ignoring hub [ 119.297797][ T31] hub 1-1:0.195: probe with driver hub failed with error -5 [ 119.306848][ T31] ftdi_sio 1-1:0.195: FTDI USB Serial Device converter detected [ 119.315510][ T31] ftdi_sio ttyUSB0: unknown device type: 0x55ea [ 119.343919][ T31] usb 1-1: USB disconnect, device number 44 [ 119.352329][ T31] ftdi_sio 1-1:0.195: device disconnected [ 119.702516][ T31] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 119.777500][ T4580] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1321'. [ 119.795635][ T4582] overlay: Unknown parameter 'mask' [ 119.834777][ T4591] tipc: Enabling of bearer rejected, failed to enable media [ 119.863612][ T31] usb 1-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 119.876011][ T31] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 119.887429][ T31] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 119.900268][ T31] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 119.909474][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 119.918685][ T4574] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 120.686083][ T4610] fuse: Bad value for 'fd' [ 121.003567][ T36] audit: type=1400 audit(1750629897.500:873): avc: denied { setattr } for pid=4625 comm="syz.3.1337" name="" dev="pipefs" ino=30437 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 121.036975][ T4630] SELinux: Context system_u:object_r:etc_mail_t:s0 is not valid (left unmapped). [ 121.046777][ T36] audit: type=1400 audit(1750629897.540:874): avc: denied { relabelto } for pid=4628 comm="syz.3.1338" name="file0" dev="tmpfs" ino=1637 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sock_file permissive=1 trawcon="system_u:object_r:etc_mail_t:s0" [ 121.073638][ T36] audit: type=1400 audit(1750629897.540:875): avc: denied { associate } for pid=4628 comm="syz.3.1338" name="file0" dev="tmpfs" ino=1637 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:etc_mail_t:s0" [ 121.102872][ T36] audit: type=1400 audit(1750629897.570:876): avc: denied { unlink } for pid=291 comm="syz-executor" name="file0" dev="tmpfs" ino=1637 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sock_file permissive=1 trawcon="system_u:object_r:etc_mail_t:s0" [ 121.183488][ T4641] overlayfs: failed to clone upperpath [ 121.326671][ T36] audit: type=1400 audit(1750629897.820:877): avc: denied { read } for pid=4675 comm="syz.3.1356" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 121.362506][ T10] usb 3-1: new full-speed USB device number 32 using dummy_hcd [ 121.373273][ T36] audit: type=1400 audit(1750629897.870:878): avc: denied { read } for pid=4679 comm="syz.3.1358" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 121.514059][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 121.522150][ T10] usb 3-1: not running at top speed; connect to a high speed hub [ 121.530760][ T10] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 121.539777][ T10] usb 3-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 121.550094][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 121.560933][ T10] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 121.570220][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.578364][ T10] usb 3-1: Product: syz [ 121.582572][ T10] usb 3-1: Manufacturer: syz [ 121.587375][ T10] usb 3-1: SerialNumber: syz [ 121.832962][ T31] aiptek 1-1:17.0: Aiptek using 400 ms programming speed [ 121.840980][ T31] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:17.0/input/input14 [ 122.383585][ T4710] tipc: Enabling of bearer rejected, failed to enable media [ 122.392045][ T4711] netlink: 'syz.1.1370': attribute type 4 has an invalid length. [ 122.400318][ T4711] netlink: 17 bytes leftover after parsing attributes in process `syz.1.1370'. [ 122.435752][ T36] audit: type=1400 audit(1750629898.930:879): avc: denied { create } for pid=4720 comm="syz.1.1373" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 122.564835][ T4744] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2048 sclass=netlink_route_socket pid=4744 comm=syz.3.1382 [ 122.661701][ T4755] tc_dump_action: action bad kind [ 122.850326][ T421] usb 1-1: USB disconnect, device number 45 [ 122.850326][ C1] aiptek 1-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 122.879790][ T4762] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.884795][ T4762] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 122.891694][ T4762] rust_binder: Read failure Err(EFAULT) in pid:782 [ 123.013439][ T36] audit: type=1326 audit(1750629899.510:880): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4769 comm="syz.0.1391" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3df0d8e929 code=0x0 [ 123.114923][ T4772] random: crng reseeded on system resumption [ 123.527578][ T36] audit: type=1400 audit(1750629900.020:881): avc: denied { create } for pid=4803 comm="syz.1.1402" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_dnrt_socket permissive=1 [ 123.529802][ T4806] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1403'. [ 123.716043][ T36] audit: type=1326 audit(1750629900.210:882): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4833 comm="syz.3.1414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40a198e929 code=0x7ffc0000 [ 123.739996][ T36] audit: type=1326 audit(1750629900.210:883): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4833 comm="syz.3.1414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40a198e929 code=0x7ffc0000 [ 123.765424][ T36] audit: type=1326 audit(1750629900.210:884): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4833 comm="syz.3.1414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=250 compat=0 ip=0x7f40a198e929 code=0x7ffc0000 [ 123.793327][ T36] audit: type=1326 audit(1750629900.210:885): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4833 comm="syz.3.1414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40a198e929 code=0x7ffc0000 [ 123.822653][ T36] audit: type=1326 audit(1750629900.210:886): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4833 comm="syz.3.1414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40a198e929 code=0x7ffc0000 [ 123.847420][ T36] audit: type=1326 audit(1750629900.230:887): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4833 comm="syz.3.1414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f40a198e929 code=0x7ffc0000 [ 123.855066][ T10] usb 3-1: 0:2 : does not exist [ 123.874631][ T36] audit: type=1326 audit(1750629900.230:888): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4833 comm="syz.3.1414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40a198e929 code=0x7ffc0000 [ 123.904472][ T4772] Restarting kernel threads ... done. [ 123.912649][ T10] usb 3-1: USB disconnect, device number 32 [ 123.927372][ T36] audit: type=1326 audit(1750629900.230:889): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4833 comm="syz.3.1414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f40a198e929 code=0x7ffc0000 [ 123.955183][ T4845] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 123.955831][ T4845] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION freeze notification not active [ 123.973318][ T4845] rust_binder: Write failure EINVAL in pid:907 [ 123.984263][ T4847] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 123.990204][ T4849] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=514 sclass=netlink_route_socket pid=4849 comm=syz.2.1420 [ 123.991008][ T4847] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:801 [ 124.010993][ T4847] rust_binder: Error while translating object. [ 124.020342][ T4847] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 124.026759][ T4847] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:801 [ 124.103533][ T319] udevd[319]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 124.266791][ T4862] incfs: Options parsing error. -22 [ 124.272192][ T4862] incfs: mount failed -22 [ 124.940476][ T4891] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 124.940511][ T4891] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:806 [ 124.950324][ T4891] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 124.960683][ T4891] rust_binder: Read failure Err(EFAULT) in pid:806 [ 124.984922][ T4897] rust_binder: Write failure EFAULT in pid:811 [ 125.010988][ T1453] Bluetooth: hci0: Frame reassembly failed (-84) [ 125.092586][ T10] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 125.222517][ T10] usb 3-1: device descriptor read/64, error -71 [ 125.462538][ T10] usb 3-1: device descriptor read/64, error -71 [ 125.702645][ T10] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 125.785493][ T4910] netlink: 'syz.3.1443': attribute type 6 has an invalid length. [ 125.842519][ T10] usb 3-1: device descriptor read/64, error -71 [ 126.102562][ T10] usb 3-1: device descriptor read/64, error -71 [ 126.212636][ T10] usb usb3-port1: attempt power cycle [ 126.308559][ T4926] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1449'. [ 126.552588][ T10] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 126.573781][ T10] usb 3-1: device descriptor read/8, error -71 [ 126.703940][ T10] usb 3-1: device descriptor read/8, error -71 [ 126.942572][ T10] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 126.963843][ T10] usb 3-1: device descriptor read/8, error -71 [ 127.032552][ T428] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 127.032591][ T53] Bluetooth: hci0: command 0x1003 tx timeout [ 127.094595][ T10] usb 3-1: device descriptor read/8, error -71 [ 127.120494][ T4940] fuse: Bad value for 'fd' [ 127.167241][ T4947] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:815 [ 127.202657][ T10] usb usb3-port1: unable to enumerate USB device [ 127.848802][ T4957] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 127.857699][ T4957] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:914 [ 128.085253][ T36] kauditd_printk_skb: 5 callbacks suppressed [ 128.085273][ T36] audit: type=1400 audit(1750629904.580:895): avc: denied { create } for pid=4967 comm="syz.2.1464" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 128.186284][ T4973] input: syz1 as /devices/virtual/input/input16 [ 128.193137][ T10] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 128.352577][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 128.359608][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 128.371391][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 128.382814][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 128.397287][ T10] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 128.407642][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.416855][ T10] usb 1-1: config 0 descriptor?? [ 128.827096][ T10] microsoft 0003:045E:07DA.000E: unknown main item tag 0xd [ 128.836144][ T10] microsoft 0003:045E:07DA.000E: unknown global tag 0xc [ 128.844677][ T10] microsoft 0003:045E:07DA.000E: item 0 0 1 12 parsing failed [ 128.861014][ T10] microsoft 0003:045E:07DA.000E: parse failed [ 128.867984][ T10] microsoft 0003:045E:07DA.000E: probe with driver microsoft failed with error -22 [ 128.932545][ T36] audit: type=1400 audit(1750629905.420:896): avc: denied { sqpoll } for pid=5000 comm="syz.3.1475" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 129.034669][ T4959] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 129.034706][ T4959] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:818 [ 129.046424][ T31] usb 1-1: USB disconnect, device number 46 [ 129.058241][ T5033] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 129.169458][ T5033] cgroup: Name too long [ 129.181956][ T5033] rust_binder: Error while translating object. [ 129.181980][ T5033] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 129.189063][ T5033] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:932 [ 129.220308][ T5038] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 129.562519][ T10] usb 3-1: new full-speed USB device number 37 using dummy_hcd [ 129.582769][ T5045] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 129.584069][ T5045] rust_binder: Error in use_page_slow: ESRCH [ 129.591921][ T5045] rust_binder: use_range failure ESRCH [ 129.598579][ T5045] rust_binder: Failed to allocate buffer. len:4240, is_oneway:false [ 129.604783][ T5045] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 129.613729][ T5045] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:820 [ 129.654442][ T5049] 9pnet_fd: Insufficient options for proto=fd [ 129.682020][ T5051] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 129.682417][ T5051] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 129.696370][ T5051] rust_binder: Write failure EINVAL in pid:826 [ 129.724143][ T10] usb 3-1: not running at top speed; connect to a high speed hub [ 129.738947][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 129.749286][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 129.760335][ T10] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 129.769861][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.778534][ T10] usb 3-1: Product: Ъ [ 129.783017][ T10] usb 3-1: Manufacturer: ꒨ꪶ͛䵍棈ꉤԔ蛢脒⹍露ᓿꢴ犨䖼㘱륾䙝䈸菧⊕뫦쇙칣㯪옸㭢Ꝺ辡︵誋蟳끩䵖䴘嵞脒셒娑巛懢麶䐱ꪎ뎂↻⒏᜙༰ʫ왯䦣혂쑅쭞쁰ꎚ뛶햄ꭍ괄﫦氪ድ뤬蹏䕛ᵬ烩ԁ懲، [ 129.809683][ T10] usb 3-1: SerialNumber: 뉑셙㌡넬ꔍ눨賗꾔恓㇉蟇䗙퉵ᴖ鰼鷝㨓奍ᝫ⮡竞덳촦间ᚎ緕ꋽ䖇ᐦ﹥⿢뛦⤉縐ᒹ [ 129.867945][ T36] audit: type=1400 audit(1750629906.360:897): avc: denied { lock } for pid=5057 comm="syz.3.1490" path="socket:[31365]" dev="sockfs" ino=31365 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 129.952509][ T421] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 130.029273][ T5043] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 130.038218][ T5043] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 130.048502][ T36] audit: type=1400 audit(1750629906.540:898): avc: granted { setsecparam } for pid=5042 comm="syz.2.1483" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 130.052039][ T5043] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 130.080444][ T5043] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 130.101865][ T10] usb 3-1: 0:2 : does not exist [ 130.111068][ T421] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 130.129170][ T10] usb 3-1: USB disconnect, device number 37 [ 130.142059][ T421] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 130.160618][ T421] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 130.173054][ T421] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.185586][ T421] usb 1-1: config 0 descriptor?? [ 130.293019][ T319] udevd[319]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 130.599957][ T421] plantronics 0003:047F:FFFF.000F: unknown main item tag 0x0 [ 130.616556][ T421] plantronics 0003:047F:FFFF.000F: No inputs registered, leaving [ 130.631289][ T5083] netlink: 80 bytes leftover after parsing attributes in process `syz.2.1501'. [ 130.634633][ T421] plantronics 0003:047F:FFFF.000F: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 130.644554][ T5083] rust_binder: Error while translating object. [ 130.661711][ T5083] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 130.680991][ T5083] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:943 [ 130.854117][ T421] usb 1-1: USB disconnect, device number 47 [ 130.875350][ T36] audit: type=1400 audit(1750629907.370:899): avc: denied { mounton } for pid=5109 comm="syz.2.1511" path="/proc/952/task" dev="proc" ino=32217 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 131.273572][ T5129] netlink: 'syz.2.1517': attribute type 29 has an invalid length. [ 131.343589][ T5135] netlink: 'syz.3.1520': attribute type 6 has an invalid length. [ 131.427473][ T5139] syzkaller0: entered promiscuous mode [ 131.433292][ T5139] syzkaller0: entered allmulticast mode [ 131.457312][ T5139] binder: Unknown parameter '/dev/net/tun' [ 131.833759][ T5143] netlink: 5 bytes leftover after parsing attributes in process `syz.1.1524'. [ 131.846579][ T5143] 0{X: renamed from gretap0 (while UP) [ 131.852612][ T305] usb 1-1: new full-speed USB device number 48 using dummy_hcd [ 131.866316][ T5143] 0{X: entered allmulticast mode [ 131.872611][ T5143] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 131.965168][ T36] audit: type=1326 audit(1750629908.460:900): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5160 comm="syz.1.1531" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f166f98e929 code=0x7ffc0000 [ 131.998129][ T36] audit: type=1326 audit(1750629908.460:901): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5160 comm="syz.1.1531" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f166f98e929 code=0x7ffc0000 [ 132.031809][ T36] audit: type=1326 audit(1750629908.460:902): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5160 comm="syz.1.1531" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f166f98e929 code=0x7ffc0000 [ 132.049765][ T305] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 132.073627][ T36] audit: type=1326 audit(1750629908.460:903): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5160 comm="syz.1.1531" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f166f98e929 code=0x7ffc0000 [ 132.092501][ T305] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 132.125049][ T36] audit: type=1326 audit(1750629908.460:904): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5160 comm="syz.1.1531" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f166f98e929 code=0x7ffc0000 [ 132.164623][ T305] usb 1-1: New USB device found, idVendor=17ef, idProduct=6067, bcdDevice= 0.00 [ 132.174930][ T305] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.198622][ T305] usb 1-1: config 0 descriptor?? [ 132.273741][ T5178] overlayfs: failed to clone upperpath [ 132.609077][ T305] lenovo 0003:17EF:6067.0010: unknown main item tag 0xd [ 132.626684][ T305] lenovo 0003:17EF:6067.0010: hidraw0: USB HID v0.01 Device [HID 17ef:6067] on usb-dummy_hcd.0-1/input0 [ 132.811912][ T305] usb 1-1: USB disconnect, device number 48 [ 133.358977][ T5207] overlayfs: failed to clone upperpath [ 133.383542][ T5211] support for the xor transformation has been removed. [ 133.495726][ T5224] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 133.871853][ T36] kauditd_printk_skb: 37 callbacks suppressed [ 133.871876][ T36] audit: type=1400 audit(1750629910.360:942): avc: denied { setattr } for pid=5238 comm="syz.0.1555" path="/dev/ppp" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 133.916617][ T421] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 133.995917][ T36] audit: type=1326 audit(1750629910.490:943): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5262 comm="syz.0.1563" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3df0d8e929 code=0x7ffc0000 [ 134.024407][ T36] audit: type=1326 audit(1750629910.490:944): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5262 comm="syz.0.1563" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3df0d8e929 code=0x7ffc0000 [ 134.061040][ T36] audit: type=1326 audit(1750629910.490:945): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5262 comm="syz.0.1563" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3df0d8e929 code=0x7ffc0000 [ 134.088319][ T36] audit: type=1326 audit(1750629910.490:946): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5262 comm="syz.0.1563" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7f3df0d8e929 code=0x7ffc0000 [ 134.103018][ T421] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 134.114580][ T36] audit: type=1326 audit(1750629910.490:947): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5262 comm="syz.0.1563" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3df0d8e929 code=0x7ffc0000 [ 134.131136][ T421] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 134.167282][ T421] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 134.177970][ T421] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 134.178941][ T36] audit: type=1326 audit(1750629910.490:948): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5262 comm="syz.0.1563" exe="/root/syz-executor" sig=0 arch=c000003e syscall=280 compat=0 ip=0x7f3df0d8e929 code=0x7ffc0000 [ 134.216188][ T5216] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 134.221176][ T36] audit: type=1326 audit(1750629910.490:949): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5262 comm="syz.0.1563" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3df0d8e929 code=0x7ffc0000 [ 134.252609][ T36] audit: type=1326 audit(1750629910.490:950): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5262 comm="syz.0.1563" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f3df0d8e929 code=0x7ffc0000 [ 134.279226][ T36] audit: type=1326 audit(1750629910.490:951): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5262 comm="syz.0.1563" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3df0d8e929 code=0x7ffc0000 [ 134.354770][ T5277] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 134.380328][ T5281] netlink: 'syz.3.1569': attribute type 7 has an invalid length. [ 134.396269][ T5281] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1569'. [ 134.507279][ T421] usb 3-1: USB disconnect, device number 38 [ 134.660547][ T5301] batadv_slave_1: entered promiscuous mode [ 134.668008][ T5300] batadv_slave_1: left promiscuous mode [ 135.122568][ T5312] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 135.122614][ T5312] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:992 [ 135.482593][ T421] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 135.582721][ T5339] binder: Binderfs stats mode cannot be changed during a remount [ 135.654946][ T421] usb 3-1: unable to get BOS descriptor or descriptor too short [ 135.666685][ T421] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 135.676643][ T421] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 135.684984][ T421] usb 3-1: Product: syz [ 135.690335][ T421] usb 3-1: Manufacturer: syz [ 135.696138][ T421] usb 3-1: SerialNumber: syz [ 135.842546][ T468] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 135.905892][ T5337] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 135.916801][ T5337] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 135.985919][ T5355] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 135.995557][ T5355] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 136.007112][ T468] usb 1-1: unable to get BOS descriptor or descriptor too short [ 136.017133][ T468] usb 1-1: too many configurations: 13, using maximum allowed: 8 [ 136.027072][ T468] usb 1-1: config 1 has an invalid descriptor of length 64, skipping remainder of the config [ 136.041815][ T468] usb 1-1: config 1 interface 0 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 136.058237][ T468] usb 1-1: config 1 interface 0 has no altsetting 0 [ 136.066684][ T468] usb 1-1: config 1 has an invalid descriptor of length 64, skipping remainder of the config [ 136.078502][ T468] usb 1-1: config 1 interface 0 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 136.092785][ T468] usb 1-1: config 1 interface 0 has no altsetting 0 [ 136.101136][ T468] usb 1-1: config 1 has an invalid descriptor of length 64, skipping remainder of the config [ 136.112580][ T468] usb 1-1: config 1 interface 0 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 136.127607][ T468] usb 1-1: config 1 interface 0 has no altsetting 0 [ 136.136439][ T468] usb 1-1: config 1 has an invalid descriptor of length 64, skipping remainder of the config [ 136.147532][ T468] usb 1-1: config 1 interface 0 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 136.163215][ T468] usb 1-1: config 1 interface 0 has no altsetting 0 [ 136.171071][ T468] usb 1-1: config 1 has an invalid descriptor of length 64, skipping remainder of the config [ 136.183501][ T468] usb 1-1: config 1 interface 0 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 136.197219][ T468] usb 1-1: config 1 interface 0 has no altsetting 0 [ 136.205261][ T468] usb 1-1: config 1 has an invalid descriptor of length 64, skipping remainder of the config [ 136.216582][ T468] usb 1-1: config 1 interface 0 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 136.236040][ T468] usb 1-1: config 1 interface 0 has no altsetting 0 [ 136.243921][ T468] usb 1-1: config 1 has an invalid descriptor of length 64, skipping remainder of the config [ 136.255023][ T468] usb 1-1: config 1 interface 0 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 136.269804][ T468] usb 1-1: config 1 interface 0 has no altsetting 0 [ 136.279223][ T468] usb 1-1: config 1 has an invalid descriptor of length 64, skipping remainder of the config [ 136.289692][ T468] usb 1-1: config 1 interface 0 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 136.304407][ T468] usb 1-1: config 1 interface 0 has no altsetting 0 [ 136.313969][ T468] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 136.325212][ T468] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.333825][ T468] usb 1-1: Product: syz [ 136.338149][ T468] usb 1-1: Manufacturer: syz [ 136.343392][ T468] usb 1-1: SerialNumber: syz [ 136.553147][ T5341] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 136.575734][ T5341] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 136.606527][ T5369] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1601'. [ 136.705030][ T468] usb 1-1: USB disconnect, device number 49 [ 137.279748][ T5390] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 137.692547][ T468] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 137.852927][ T468] usb 1-1: Using ep0 maxpacket: 16 [ 137.861167][ T468] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 137.872960][ T468] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 137.884145][ T468] usb 1-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 137.894655][ T468] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 137.907286][ T468] usb 1-1: config 0 descriptor?? [ 138.261955][ T421] usb 3-1: 2:1 : format type 0 is detected, processed as PCM [ 138.271733][ T421] usb 3-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 138.276108][ T5444] rust_binder: Write failure EFAULT in pid:1007 [ 138.290170][ T421] usb 3-1: USB disconnect, device number 39 [ 138.382117][ T468] usbhid 1-1:0.0: can't add hid device: -71 [ 138.391812][ T468] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 138.406009][ T468] usb 1-1: USB disconnect, device number 50 [ 138.514299][ T5451] 9pnet: p9_errstr2errno: server reported unknown error pA;KZ44/@q [ 138.518741][ T5449] netlink: 'syz.2.1629': attribute type 4 has an invalid length. [ 138.532986][ T5449] netlink: 'syz.2.1629': attribute type 6 has an invalid length. [ 138.534281][ T319] udevd[319]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 138.542115][ T5449] netlink: 3657 bytes leftover after parsing attributes in process `syz.2.1629'. [ 138.690633][ T1453] Bluetooth: hci0: Frame reassembly failed (-84) [ 138.702514][ T5477] Bluetooth: received HCILL_WAKE_UP_ACK in state 2 [ 138.927453][ T5480] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 138.927834][ T5480] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 138.942621][ T5480] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 138.958740][ T5480] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 138.972575][ T5480] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 138.982571][ T5480] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 139.000460][ T5480] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 139.007789][ T5480] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 139.022769][ T5480] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 139.247619][ T5498] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1643'. [ 139.313255][ T36] kauditd_printk_skb: 55 callbacks suppressed [ 139.313273][ T36] audit: type=1400 audit(1750629915.810:1007): avc: denied { create } for pid=5502 comm="syz.0.1645" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 139.340108][ T5499] fuse: Unknown parameter '000000000000000000000x0000000000000008' [ 139.375352][ T5507] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 139.427022][ T5508] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:902 [ 140.048777][ T5518] fuse: Bad value for 'fd' [ 140.371379][ T5537] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:910 [ 140.374544][ T5537] rust_binder: Read failure Err(EFAULT) in pid:910 [ 140.423760][ T36] audit: type=1400 audit(1750629916.920:1008): avc: denied { accept } for pid=5538 comm="syz.0.1657" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 140.589613][ T5544] overlayfs: failed to resolve './file1': -2 [ 140.630757][ T5549] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 140.684263][ T5557] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:916 [ 140.712498][ T53] Bluetooth: hci0: command 0x1003 tx timeout [ 140.712494][ T428] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 140.977773][ T36] audit: type=1400 audit(1750629917.470:1009): avc: denied { create } for pid=5574 comm="syz.1.1670" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 141.025225][ T36] audit: type=1400 audit(1750629917.520:1010): avc: denied { execstack } for pid=5576 comm="syz.1.1671" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 141.049469][ T5581] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1025 [ 141.475218][ T5583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 141.485831][ T5583] rust_binder: Error while translating object. [ 141.493886][ T5583] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 141.500555][ T5583] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:919 [ 141.683954][ T5605] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1033 [ 141.694061][ T5605] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:1033 [ 141.704411][ T5608] netlink: 'syz.3.1683': attribute type 4 has an invalid length. [ 141.723404][ T5608] netlink: 17 bytes leftover after parsing attributes in process `syz.3.1683'. [ 141.747228][ T5616] netlink: 'syz.2.1686': attribute type 4 has an invalid length. [ 141.757736][ T5616] netlink: 'syz.2.1686': attribute type 17 has an invalid length. [ 141.783135][ T468] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 141.809846][ T5627] fuse: Bad value for 'group_id' [ 141.815055][ T5627] fuse: Bad value for 'group_id' [ 141.854669][ T5636] binder: Bad value for 'stats' [ 141.932513][ T468] usb 1-1: Using ep0 maxpacket: 32 [ 141.941496][ T468] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 141.954419][ T468] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 141.966823][ T468] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 141.980161][ T468] usb 1-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 141.990467][ T468] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.002744][ T468] usb 1-1: config 0 descriptor?? [ 142.011169][ T5587] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 142.020430][ T468] hub 1-1:0.0: USB hub found [ 142.220741][ T468] hub 1-1:0.0: 2 ports detected [ 142.422536][ T468] hub 1-1:0.0: hub_hub_status failed (err = -71) [ 142.430096][ T468] hub 1-1:0.0: config failed, can't get hub status (err -71) [ 142.441040][ T468] usbhid 1-1:0.0: can't add hid device: -71 [ 142.448189][ T468] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 142.477515][ T468] usb 1-1: USB disconnect, device number 51 [ 142.943704][ T5664] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 142.944263][ T36] audit: type=1400 audit(1750629919.440:1011): avc: denied { execute } for pid=5663 comm="syz.0.1702" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 142.979176][ T5664] rust_binder: validate_parent_fixup: new_min_offset=96, sg_entry.length=0 [ 142.979202][ T5664] rust_binder: Error while translating object. [ 142.989298][ T5664] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 142.996440][ T5664] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:925 [ 143.012971][ T5666] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 143.091425][ T5670] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 143.646723][ T5682] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1708'. [ 143.807103][ T5709] netlink: 116 bytes leftover after parsing attributes in process `syz.1.1718'. [ 143.997753][ T5723] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 144.009752][ T36] audit: type=1400 audit(1750629920.500:1012): avc: denied { map } for pid=5724 comm="syz.1.1725" path="socket:[33678]" dev="sockfs" ino=33678 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 144.025891][ T5727] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 144.043384][ T36] audit: type=1400 audit(1750629920.500:1013): avc: denied { read } for pid=5724 comm="syz.1.1725" path="socket:[33678]" dev="sockfs" ino=33678 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 144.103648][ T5742] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1730'. [ 144.410225][ T5764] bridge0: port 1(bridge_slave_0) entered blocking state [ 144.417746][ T5764] bridge0: port 1(bridge_slave_0) entered disabled state [ 144.425010][ T5764] bridge_slave_0: entered allmulticast mode [ 144.431393][ T5764] bridge_slave_0: entered promiscuous mode [ 144.438072][ T5764] bridge0: port 2(bridge_slave_1) entered blocking state [ 144.445325][ T5764] bridge0: port 2(bridge_slave_1) entered disabled state [ 144.452399][ T5764] bridge_slave_1: entered allmulticast mode [ 144.458854][ T5764] bridge_slave_1: entered promiscuous mode [ 144.514351][ T5764] bridge0: port 2(bridge_slave_1) entered blocking state [ 144.521517][ T5764] bridge0: port 2(bridge_slave_1) entered forwarding state [ 144.528950][ T5764] bridge0: port 1(bridge_slave_0) entered blocking state [ 144.536028][ T5764] bridge0: port 1(bridge_slave_0) entered forwarding state [ 144.559698][ T1455] bridge0: port 1(bridge_slave_0) entered disabled state [ 144.567155][ T1455] bridge0: port 2(bridge_slave_1) entered disabled state [ 144.576910][ T1453] bridge0: port 1(bridge_slave_0) entered blocking state [ 144.584020][ T1453] bridge0: port 1(bridge_slave_0) entered forwarding state [ 144.594943][ T1455] bridge0: port 2(bridge_slave_1) entered blocking state [ 144.602087][ T1455] bridge0: port 2(bridge_slave_1) entered forwarding state [ 144.628694][ T5764] veth0_vlan: entered promiscuous mode [ 144.640934][ T5764] veth1_macvtap: entered promiscuous mode [ 144.660748][ T36] audit: type=1400 audit(1750629921.150:1014): avc: denied { mounton } for pid=5764 comm="syz-executor" path="/root/syzkaller.vzmvGy/syz-tmp" dev="sda1" ino=2045 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 144.687353][ T36] audit: type=1400 audit(1750629921.160:1015): avc: denied { mounton } for pid=5764 comm="syz-executor" path="/root/syzkaller.vzmvGy/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 144.716928][ T36] audit: type=1400 audit(1750629921.160:1016): avc: denied { mounton } for pid=5764 comm="syz-executor" path="/root/syzkaller.vzmvGy/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=35929 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 144.748343][ T36] audit: type=1400 audit(1750629921.180:1017): avc: denied { mounton } for pid=5764 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=434 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 144.778615][ T36] audit: type=1400 audit(1750629921.180:1018): avc: denied { mounton } for pid=5764 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 144.955115][ T5778] overlayfs: cannot append lower layer [ 145.021378][ T1806] ------------[ cut here ]------------ [ 145.027511][ T1806] WARNING: CPU: 0 PID: 1806 at fs/inode.c:340 drop_nlink+0xce/0x110 [ 145.036189][ T1806] Modules linked in: [ 145.040907][ T1806] CPU: 0 UID: 0 PID: 1806 Comm: syz.2.438 Not tainted 6.12.23-syzkaller-gd9fd901baa98 #0 f1acc3ef52b3e732a05c4f7a2560722db90bb473 [ 145.056131][ T1806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 145.066745][ T1806] RIP: 0010:drop_nlink+0xce/0x110 [ 145.072049][ T1806] Code: 04 00 00 be 08 00 00 00 e8 7f 56 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 e2 68 98 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c [ 145.092072][ T1806] RSP: 0018:ffffc9000c18f860 EFLAGS: 00010293 [ 145.098248][ T1806] RAX: ffffffff81ed146e RBX: ffff888106fce958 RCX: ffff888117f41300 [ 145.106389][ T1806] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 145.114493][ T1806] RBP: ffffc9000c18f888 R08: 0000000000000003 R09: 0000000000000004 [ 145.122651][ T1806] R10: dffffc0000000000 R11: fffff52001831efc R12: dffffc0000000000 [ 145.130747][ T1806] R13: 1ffff11020df9d34 R14: ffff888106fce9a0 R15: 0000000000000000 [ 145.139533][ T1806] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 145.148946][ T1806] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 145.155777][ T1806] CR2: 00007ff0415e8990 CR3: 000000010c70e000 CR4: 00000000003526b0 [ 145.163822][ T1806] DR0: 0000000000000000 DR1: 0000000000000008 DR2: 0000000000000000 [ 145.171983][ T1806] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 145.180144][ T1806] Call Trace: [ 145.183499][ T1806] [ 145.186473][ T1806] shmem_rmdir+0x5f/0x90 [ 145.191155][ T1806] vfs_rmdir+0x3dd/0x560 [ 145.195766][ T1806] incfs_kill_sb+0x109/0x230 [ 145.200907][ T1806] deactivate_locked_super+0xd5/0x2a0 [ 145.207076][ T1806] deactivate_super+0xb8/0xe0 [ 145.212282][ T1806] cleanup_mnt+0x3f1/0x480 [ 145.217177][ T1806] __cleanup_mnt+0x1d/0x40 [ 145.222002][ T1806] task_work_run+0x1e0/0x250 [ 145.227039][ T1806] ? __cfi_task_work_run+0x10/0x10 [ 145.232273][ T1806] ? free_nsproxy+0x223/0x290 [ 145.237906][ T1806] do_exit+0x9b4/0x2630 [ 145.242859][ T1806] ? __sched_text_start+0x10/0x10 [ 145.248262][ T1806] ? __cfi_do_exit+0x10/0x10 [ 145.253331][ T1806] ? __kasan_check_write+0x18/0x20 [ 145.258653][ T1806] ? _raw_spin_lock_irq+0x8d/0x120 [ 145.264130][ T1806] ? __kasan_check_read+0x15/0x20 [ 145.269603][ T1806] ? cgroup_update_frozen+0x160/0x990 [ 145.275441][ T1806] do_group_exit+0x22a/0x300 [ 145.280065][ T1806] ? cgroup_leave_frozen+0x16c/0x2b0 [ 145.286376][ T1806] get_signal+0x139d/0x14f0 [ 145.291091][ T1806] arch_do_signal_or_restart+0x96/0x720 [ 145.297309][ T1806] ? common_nsleep+0x93/0xb0 [ 145.302202][ T1806] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 145.309402][ T1806] ? __se_sys_clock_nanosleep+0x2fd/0x390 [ 145.315286][ T1806] ? __kasan_check_read+0x15/0x20 [ 145.320348][ T1806] ? fpregs_assert_state_consistent+0xb7/0xe0 [ 145.326997][ T1806] syscall_exit_to_user_mode+0x58/0xb0 [ 145.332717][ T1806] do_syscall_64+0x64/0xf0 [ 145.337349][ T1806] ? clear_bhb_loop+0x35/0x90 [ 145.342240][ T1806] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 145.348376][ T1806] RIP: 0033:0x7f397bbc11e5 [ 145.353040][ T1806] Code: Unable to access opcode bytes at 0x7f397bbc11bb. [ 145.360345][ T1806] RSP: 002b:00007f397c926f80 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6 [ 145.368908][ T1806] RAX: fffffffffffffdfc RBX: 00007f397bdb5fa0 RCX: 00007f397bbc11e5 [ 145.376946][ T1806] RDX: 00007f397c926fc0 RSI: 0000000000000000 RDI: 0000000000000000 [ 145.385021][ T1806] RBP: 00007f397bc10b39 R08: 0000000000000000 R09: 0000000000000000 [ 145.393187][ T1806] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 145.401536][ T1806] R13: 0000000000000000 R14: 00007f397bdb5fa0 R15: 00007ffcb84060a8 [ 145.409844][ T1806] [ 145.413017][ T1806] ---[ end trace 0000000000000000 ]--- [ 145.421051][ T1806] ================================================================== [ 145.429339][ T1806] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 [ 145.435772][ T1806] Write of size 4 at addr 0000000000000168 by task syz.2.438/1806 [ 145.443667][ T1806] [ 145.445988][ T1806] CPU: 1 UID: 0 PID: 1806 Comm: syz.2.438 Tainted: G W 6.12.23-syzkaller-gd9fd901baa98 #0 f1acc3ef52b3e732a05c4f7a2560722db90bb473 [ 145.446014][ T1806] Tainted: [W]=WARN [ 145.446019][ T1806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 145.446029][ T1806] Call Trace: [ 145.446035][ T1806] [ 145.446042][ T1806] __dump_stack+0x21/0x30 [ 145.446064][ T1806] dump_stack_lvl+0x10c/0x190 [ 145.446082][ T1806] ? __cfi_dump_stack_lvl+0x10/0x10 [ 145.446101][ T1806] print_report+0x3d/0x70 [ 145.446115][ T1806] kasan_report+0x163/0x1a0 [ 145.446137][ T1806] ? ihold+0x24/0x70 [ 145.446158][ T1806] ? _raw_spin_unlock+0x45/0x60 [ 145.446177][ T1806] ? ihold+0x24/0x70 [ 145.446197][ T1806] kasan_check_range+0x299/0x2a0 [ 145.446219][ T1806] __kasan_check_write+0x18/0x20 [ 145.446236][ T1806] ihold+0x24/0x70 [ 145.446255][ T1806] vfs_rmdir+0x26a/0x560 [ 145.446269][ T1806] incfs_kill_sb+0x109/0x230 [ 145.446287][ T1806] deactivate_locked_super+0xd5/0x2a0 [ 145.446302][ T1806] deactivate_super+0xb8/0xe0 [ 145.446316][ T1806] cleanup_mnt+0x3f1/0x480 [ 145.446337][ T1806] __cleanup_mnt+0x1d/0x40 [ 145.446357][ T1806] task_work_run+0x1e0/0x250 [ 145.446372][ T1806] ? __cfi_task_work_run+0x10/0x10 [ 145.446386][ T1806] ? free_nsproxy+0x223/0x290 [ 145.446404][ T1806] do_exit+0x9b4/0x2630 [ 145.446418][ T1806] ? __sched_text_start+0x10/0x10 [ 145.446441][ T1806] ? __cfi_do_exit+0x10/0x10 [ 145.446455][ T1806] ? __kasan_check_write+0x18/0x20 [ 145.446472][ T1806] ? _raw_spin_lock_irq+0x8d/0x120 [ 145.446492][ T1806] ? __kasan_check_read+0x15/0x20 [ 145.446508][ T1806] ? cgroup_update_frozen+0x160/0x990 [ 145.446529][ T1806] do_group_exit+0x22a/0x300 [ 145.446544][ T1806] ? cgroup_leave_frozen+0x16c/0x2b0 [ 145.446565][ T1806] get_signal+0x139d/0x14f0 [ 145.446583][ T1806] arch_do_signal_or_restart+0x96/0x720 [ 145.446608][ T1806] ? common_nsleep+0x93/0xb0 [ 145.446627][ T1806] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 145.446647][ T1806] ? __se_sys_clock_nanosleep+0x2fd/0x390 [ 145.446667][ T1806] ? __kasan_check_read+0x15/0x20 [ 145.446683][ T1806] ? fpregs_assert_state_consistent+0xb7/0xe0 [ 145.446700][ T1806] syscall_exit_to_user_mode+0x58/0xb0 [ 145.446717][ T1806] do_syscall_64+0x64/0xf0 [ 145.446737][ T1806] ? clear_bhb_loop+0x35/0x90 [ 145.446760][ T1806] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 145.446782][ T1806] RIP: 0033:0x7f397bbc11e5 [ 145.446795][ T1806] Code: Unable to access opcode bytes at 0x7f397bbc11bb. [ 145.446803][ T1806] RSP: 002b:00007f397c926f80 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6 [ 145.446819][ T1806] RAX: fffffffffffffdfc RBX: 00007f397bdb5fa0 RCX: 00007f397bbc11e5 [ 145.446831][ T1806] RDX: 00007f397c926fc0 RSI: 0000000000000000 RDI: 0000000000000000 [ 145.446841][ T1806] RBP: 00007f397bc10b39 R08: 0000000000000000 R09: 0000000000000000 [ 145.446851][ T1806] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 145.446860][ T1806] R13: 0000000000000000 R14: 00007f397bdb5fa0 R15: 00007ffcb84060a8 [ 145.446873][ T1806] [ 145.446878][ T1806] ================================================================== [ 145.472669][ T421] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 145.478486][ T1806] Disabling lock debugging due to kernel taint [ 145.643888][ T421] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 145.654069][ T1806] BUG: kernel NULL pointer dereference, address: 0000000000000168 [ 145.661554][ T421] usb 1-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=83.9c [ 145.665959][ T1806] #PF: supervisor write access in kernel mode [ 145.665978][ T1806] #PF: error_code(0x0002) - not-present page [ 145.665990][ T1806] PGD 0 P4D 0 [ 145.666009][ T1806] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 145.666032][ T1806] CPU: 1 UID: 0 PID: 1806 Comm: syz.2.438 Tainted: G B W 6.12.23-syzkaller-gd9fd901baa98 #0 f1acc3ef52b3e732a05c4f7a2560722db90bb473 [ 145.673952][ T421] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 145.676132][ T1806] Tainted: [B]=BAD_PAGE, [W]=WARN [ 145.680821][ T421] usb 1-1: Product: syz [ 145.687057][ T1806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 145.687079][ T1806] RIP: 0010:ihold+0x2a/0x70 [ 145.687112][ T1806] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 cd 5f 98 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 3c 4d ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 dd [ 145.687130][ T1806] RSP: 0018:ffffc9000c18f8a0 EFLAGS: 00010246 [ 145.687149][ T1806] RAX: ffff888117f41300 RBX: 0000000000000000 RCX: ffff888117f41300 [ 145.692142][ T421] usb 1-1: Manufacturer: syz [ 145.698787][ T1806] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 145.698815][ T1806] RBP: ffffc9000c18f8b0 R08: ffffffff88954947 R09: 1ffffffff112a928 [ 145.698830][ T1806] R10: dffffc0000000000 R11: fffffbfff112a929 R12: ffff888106fce964 [ 145.698846][ T1806] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 145.698858][ T1806] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 145.698877][ T1806] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 145.707977][ T421] usb 1-1: SerialNumber: syz [ 145.715757][ T1806] CR2: 0000000000000168 CR3: 000000012b724000 CR4: 00000000003526b0 [ 145.715787][ T1806] DR0: 0000000000000000 DR1: 0000000000000008 DR2: 0000000000000000 [ 145.715800][ T1806] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 145.715813][ T1806] Call Trace: [ 145.715820][ T1806] [ 145.715830][ T1806] vfs_rmdir+0x26a/0x560 [ 145.725682][ T421] usb 1-1: config 0 descriptor?? [ 145.731806][ T1806] incfs_kill_sb+0x109/0x230 [ 145.741460][ T421] cdc_acm 1-1:0.0: skipping garbage [ 145.749581][ T1806] deactivate_locked_super+0xd5/0x2a0 [ 145.749617][ T1806] deactivate_super+0xb8/0xe0 [ 145.749635][ T1806] cleanup_mnt+0x3f1/0x480 [ 145.749664][ T1806] __cleanup_mnt+0x1d/0x40 [ 145.749691][ T1806] task_work_run+0x1e0/0x250 [ 145.752893][ T36] audit: type=1400 audit(1750629922.160:1019): avc: denied { read } for pid=91 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 145.761041][ T1806] ? __cfi_task_work_run+0x10/0x10 [ 145.771525][ T36] audit: type=1400 audit(1750629922.170:1020): avc: denied { search } for pid=91 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 145.776136][ T1806] ? free_nsproxy+0x223/0x290 [ 145.776170][ T1806] do_exit+0x9b4/0x2630 [ 145.776191][ T1806] ? __sched_text_start+0x10/0x10 [ 145.797250][ T36] audit: type=1400 audit(1750629922.170:1021): avc: denied { write } for pid=91 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 145.804109][ T1806] ? __cfi_do_exit+0x10/0x10 [ 145.804142][ T1806] ? __kasan_check_write+0x18/0x20 [ 145.804166][ T1806] ? _raw_spin_lock_irq+0x8d/0x120 [ 145.804194][ T1806] ? __kasan_check_read+0x15/0x20 [ 145.810964][ T36] audit: type=1400 audit(1750629922.170:1022): avc: denied { add_name } for pid=91 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 145.817051][ T1806] ? cgroup_update_frozen+0x160/0x990 [ 145.817092][ T1806] do_group_exit+0x22a/0x300 [ 145.817114][ T1806] ? cgroup_leave_frozen+0x16c/0x2b0 [ 145.821992][ T36] audit: type=1400 audit(1750629922.170:1023): avc: denied { create } for pid=91 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 145.827923][ T1806] get_signal+0x139d/0x14f0 [ 145.827962][ T1806] arch_do_signal_or_restart+0x96/0x720 [ 145.827991][ T1806] ? common_nsleep+0x93/0xb0 [ 145.969706][ T421] usb 1-1: USB disconnect, device number 52 [ 145.976578][ T1806] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 145.976620][ T1806] ? __se_sys_clock_nanosleep+0x2fd/0x390 [ 146.274566][ T1806] ? __kasan_check_read+0x15/0x20 [ 146.280336][ T1806] ? fpregs_assert_state_consistent+0xb7/0xe0 [ 146.286861][ T1806] syscall_exit_to_user_mode+0x58/0xb0 [ 146.293438][ T1806] do_syscall_64+0x64/0xf0 [ 146.298684][ T1806] ? clear_bhb_loop+0x35/0x90 [ 146.304087][ T1806] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 146.310021][ T1806] RIP: 0033:0x7f397bbc11e5 [ 146.314555][ T1806] Code: Unable to access opcode bytes at 0x7f397bbc11bb. [ 146.321695][ T1806] RSP: 002b:00007f397c926f80 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6 [ 146.330141][ T1806] RAX: fffffffffffffdfc RBX: 00007f397bdb5fa0 RCX: 00007f397bbc11e5 [ 146.339265][ T1806] RDX: 00007f397c926fc0 RSI: 0000000000000000 RDI: 0000000000000000 [ 146.348572][ T1806] RBP: 00007f397bc10b39 R08: 0000000000000000 R09: 0000000000000000 [ 146.357102][ T1806] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 146.366240][ T1806] R13: 0000000000000000 R14: 00007f397bdb5fa0 R15: 00007ffcb84060a8 [ 146.375105][ T1806] [ 146.378573][ T1806] Modules linked in: [ 146.383214][ T1806] CR2: 0000000000000168 [ 146.387989][ T1806] ---[ end trace 0000000000000000 ]--- [ 146.393890][ T1806] RIP: 0010:ihold+0x2a/0x70 [ 146.399467][ T1806] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 cd 5f 98 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 3c 4d ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 dd [ 146.420114][ T1806] RSP: 0018:ffffc9000c18f8a0 EFLAGS: 00010246 [ 146.426480][ T1806] RAX: ffff888117f41300 RBX: 0000000000000000 RCX: ffff888117f41300 [ 146.434708][ T1806] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 146.443234][ T1806] RBP: ffffc9000c18f8b0 R08: ffffffff88954947 R09: 1ffffffff112a928 [ 146.451310][ T1806] R10: dffffc0000000000 R11: fffffbfff112a929 R12: ffff888106fce964 [ 146.459565][ T1806] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 146.467616][ T1806] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 146.476552][ T1806] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 146.483217][ T1806] CR2: 0000000000000168 CR3: 000000012b724000 CR4: 00000000003526b0 [ 146.491554][ T1806] DR0: 0000000000000000 DR1: 0000000000000008 DR2: 0000000000000000 [ 146.499849][ T1806] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 146.508613][ T1806] Kernel panic - not syncing: Fatal exception [ 146.515218][ T1806] Kernel Offset: disabled [ 146.520168][ T1806] Rebooting in 86400 seconds..